WO2020258988A1 - 接入请求的发送、处理方法及装置 - Google Patents

接入请求的发送、处理方法及装置 Download PDF

Info

Publication number
WO2020258988A1
WO2020258988A1 PCT/CN2020/084020 CN2020084020W WO2020258988A1 WO 2020258988 A1 WO2020258988 A1 WO 2020258988A1 CN 2020084020 W CN2020084020 W CN 2020084020W WO 2020258988 A1 WO2020258988 A1 WO 2020258988A1
Authority
WO
WIPO (PCT)
Prior art keywords
configuration parameter
terminal
core network
anonymization
string
Prior art date
Application number
PCT/CN2020/084020
Other languages
English (en)
French (fr)
Inventor
白晓春
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP20832833.6A priority Critical patent/EP3972307A4/en
Priority to US17/622,793 priority patent/US20220247727A1/en
Publication of WO2020258988A1 publication Critical patent/WO2020258988A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present disclosure relates to the field of communication technology, and in particular, to a method and device for sending and processing an access request.
  • the unique identification of the terminal In the field of wireless communication, when the terminal accesses the network for the first time or the synchronization relationship between the core network and the terminal is lost, the unique identification of the terminal (IMSI for 2/3/4G and SUPI/SUCI for 5G) must be used for terminal identification. In the process, attackers often use this process to initiate a terminal identification request message to the terminal. After receiving the message, the terminal will use its own identity to access. At this time, the user's unique identification number is easily stolen by the attacker.
  • the embodiments of the present disclosure provide a method and device for sending and processing an access request.
  • a method for sending an access request including: processing a terminal identifier using a first anonymous algorithm and a first configuration parameter to obtain an intermediate operator, wherein the intermediate operator is used for Identify the terminal identifier of the core network access layer in different regions, the terminal identifier is stored in the terminal and the identity authentication server of the core network; the intermediate operator is performed using the second anonymous algorithm and the second configuration parameter Process to obtain the uplink anonymization string; send an access request including the uplink anonymization string and the second configuration parameter to the core network, where the access request is used to request access to the core network and indicate The core network uses the locally stored uplink anonymization string and the second configuration parameter to match the uplink anonymization string and the second configuration parameter carried in the access request.
  • a method for processing an access request including: receiving an access request sent by a terminal, wherein the access request is used to request access to the core network, and The access request carries an uplink anonymization string and a second configuration parameter, and the uplink anonymization string is obtained by the terminal using the second anonymity algorithm and the second configuration parameter to process the intermediate operator, and the intermediate operator
  • the terminal is obtained by processing the terminal identification using the first anonymous algorithm and the first configuration parameter, the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification is stored in the The terminal and the identity authentication server of the core network; combining the uplink anonymization string and the second configuration parameter carried in the access request with the uplink anonymization string and the The second configuration parameter is matched.
  • a device for sending an access request including: a first processing module, configured to process a terminal identifier using a first anonymous algorithm and a first configuration parameter to obtain an intermediate operator, Wherein, the intermediate operator is used to identify the terminal identifier of the core network access layer in different regions, and the terminal identifier is stored in the terminal and the identity authentication server of the core network; the second processing module is used to use The second anonymization algorithm and the second configuration parameter process the intermediate operator to obtain an uplink anonymization string; a sending module is configured to send an access request including the uplink anonymization string and the second configuration parameter to the core Network, wherein the access request is used to request access to the core network, and instruct the core network to use the locally stored uplink anonymization string and the second configuration parameters, which are the same as those in the access request The carried uplink anonymization string is matched with the second configuration parameter.
  • an access request processing device including: a receiving module, configured to receive an access request sent by a terminal, wherein the access request is used to request access to the In the core network, the access request carries an uplink anonymization string and a second configuration parameter, and the uplink anonymization string is obtained by the terminal using a second anonymity algorithm and a second configuration parameter to process the intermediate operator, The intermediate operator is used by the terminal to process the terminal identification using a first anonymous algorithm and a first configuration parameter.
  • the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification Stored in the terminal and the identity authentication server of the core network; a matching module configured to compare the uplink anonymization string and the second configuration parameter carried in the access request with those stored locally in the core network The uplink anonymization string is matched with the second configuration parameter.
  • a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.
  • an electronic device including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any of the foregoing. Steps in a method embodiment.
  • FIG. 1 is a block diagram of the hardware structure of a mobile terminal of a method for sending an access request according to an embodiment of the present disclosure
  • Figure 2 is a flowchart of a method for sending an access request in an embodiment of the present disclosure
  • Fig. 3 is a flowchart of a method for processing an access request in an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of an anonymization algorithm flow diagram according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic diagram of visibility of information related to terminal identification according to an embodiment of the present disclosure.
  • Fig. 6 is a structural block diagram of a device for sending an access request according to an embodiment of the present disclosure
  • Fig. 7 is a structural block diagram of a device for sending an access request according to an embodiment of the present disclosure
  • FIG. 8 is a schematic diagram 1 of an anonymous algorithm according to an embodiment of the present disclosure.
  • FIG. 9 is a second schematic diagram of an anonymous algorithm according to an embodiment of the present disclosure.
  • FIG. 10 is a third schematic diagram of an anonymous algorithm according to an embodiment of the present disclosure.
  • FIG. 11 is an interactive flowchart of a terminal accessing a core network for the first time according to an embodiment of the present disclosure
  • Fig. 12 is a configuration flow interaction diagram of configuration parameter 2 according to an embodiment of the present disclosure.
  • Figure 14 is a flow chart of interaction when the core network paging a designated phone number according to an embodiment of the present disclosure
  • Fig. 15 is an interaction flowchart when a terminal accesses in an international roaming state according to an embodiment of the present disclosure.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal of a method for sending an access request according to an embodiment of the present disclosure.
  • the mobile terminal 10 may include one or more (only one is shown in FIG. 1) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA. ) And a memory 104 for storing data.
  • the above mobile terminal may also include a transmission device 106 and an input/output device 108 for communication functions.
  • FIG. 1 is only for illustration, and does not limit the structure of the above-mentioned mobile terminal.
  • the mobile terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration from that shown in FIG.
  • the memory 104 may be used to store computer programs, for example, software programs and modules of application software, such as the computer programs corresponding to the method for obtaining scheduling throughput in the embodiments of the present disclosure.
  • the processor 102 runs the computer programs stored in the memory 104, Thereby, various functional applications and data processing are executed, that is, the above-mentioned method is realized.
  • the memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory 104 may further include a memory remotely provided with respect to the processor 102, and these remote memories may be connected to the mobile terminal 10 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the transmission device 106 is used to receive or send data via a network.
  • the above-mentioned specific example of the network may include a wireless network provided by the communication provider of the mobile terminal 10.
  • the transmission device 106 includes a network adapter (Network Interface Controller, NIC for short), which can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 may be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • Fig. 2 is a flowchart of a method for sending an access request in an embodiment of the present disclosure. As shown in Fig. 2, the method includes:
  • Step S201 Use the first anonymous algorithm and the first configuration parameter to process the terminal identification to obtain an intermediate operator, where the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification is stored in the terminal and the core network.
  • Identity authentication server
  • Step S203 Use the second anonymity algorithm and the second configuration parameter to process the intermediate operator to obtain the uplink anonymization string;
  • Step S205 Send an access request containing the uplink anonymization string and the second configuration parameter to the core network, where the access request is used to request access to the core network and instruct the core network to use the locally stored uplink anonymization string and the first configuration parameter.
  • the second configuration parameter is matched with the uplink anonymization string carried in the access request and the second configuration parameter.
  • the terminal identification is two-way encrypted when interacting between the terminal and the core network, the interaction is performed through the uplink anonymization string and the downlink anonymization string, and through the setting of the intermediate operator, the core network in different regions
  • the terminal identification can also be encrypted when interacting with each other.
  • the terminal identification is only stored in the terminal and the core network identity authentication server, and the core network access server uses the intermediate operator and anonymization string to identify the terminal. This effectively solves the problem in the prior art that the terminal identity is easily stolen by an attacker, making it difficult for the terminal identity to be matched and utilized by the attacker.
  • the access uses an anonymous string instead of the terminal identification for identification, which can effectively prevent the leakage of the terminal identification.
  • the method further includes: receiving a first negotiation message issued by the core network, wherein the first negotiation message carries a first configuration parameter negotiation randomly generated by the core network Value: Use the negotiated value of the first configuration parameter and the default value of the second configuration parameter to resend the access request to the core network.
  • the first configuration parameter and the second configuration parameter used in generating the uplink anonymization string for the terminal that accesses the core network for the first time use default values, that is, the parameter values agreed by the terminal and the core network in advance.
  • the core network matches the received uplink anonymization string according to the local default value of the second configuration parameter, the default value of the first parameter, and the terminal identifier. After the match is successful, it will randomly generate the first parameter.
  • the negotiated value of a configuration parameter is sent to the terminal. This step is equivalent to assigning a first configuration parameter to the terminal after confirming the identity of the terminal to facilitate the encryption of the subsequent access process.
  • the terminal After receiving the negotiated value of the first configuration parameter, the terminal will use the first anonymous algorithm and the negotiated value of the first configuration parameter to process the terminal identifier to obtain a new intermediate operator, and then use the second anonymous algorithm and the second configuration parameter default Value to process the new intermediate operator to obtain a new uplink anonymization string, and re-send the access request to the core network.
  • the method further includes: receiving the second The negotiation message, where the second negotiation message carries the second configuration parameter negotiation value randomly generated by the core network.
  • the core network side matches the uplink anonymization string sent by the terminal, it will randomly generate a second configuration parameter negotiation value and send it to the terminal.
  • the terminal uses the first configuration parameter negotiation value and the second configuration parameter negotiation value. Regenerate the uplink anonymization string and re-initiate an access request to the core network. At this time, it can be considered that the terminal has officially accessed the core network, and the terminal side and the core network side have saved the first configuration parameter negotiation value and the second configuration parameter respectively.
  • the configuration parameter negotiation value can also be understood as storing the second configuration parameter negotiation value and the intermediate operator obtained by using the first configuration parameter negotiation value.
  • the method further includes: the terminal receives a paging message from the core network, wherein the paging message carries a downlink anonymization string, and the downlink anonymization string is used by the core network as a third anonymity string.
  • the algorithm and the second configuration parameter are obtained by processing the intermediate operator; the terminal determines whether the object of the downlink anonymization string page is itself through the downlink anonymization string and the first and second configuration parameters stored locally.
  • the core network access server initiates a phone number identification request to the identity identification server.
  • the identity recognition server recognizes the terminal through the phone number, and returns the anonymized intermediate operator of the terminal, and sends it to the core network access server where the terminal is nearest.
  • the core network access server identifies the terminal through the intermediate operator, and obtains the current second configuration parameter of the terminal.
  • the core network access server calculates the downlink anonymization string through the second configuration parameter and the intermediate operator, and initiates paging.
  • the base station uses the downlink anonymization string to initiate a paging message. After receiving the downlink anonymization string, the terminal matches the downlink anonymization string under the current configuration, and if the matching is successful, initiates an access request.
  • the terminal access request message carries the uplink anonymization string calculated by the current configuration parameter and the second configuration parameter to initiate an access request.
  • the core network access server After the core network access server receives the uplink anonymization string and the second configuration parameter, it matches the terminal, and if the matching is successful, completes the terminal identification of the paging process. Other processes can follow. Paging and terminal paging response messages use different anonymization strings to prevent matching attacks.
  • the matching of the terminal's downlink anonymization string can also be that the terminal uses the third anonymity algorithm and the currently configured second configuration parameter to decrypt the downlink anonymization string to obtain the intermediate operator, and then use the currently configured first configuration parameter pair
  • the intermediate operator decrypts to obtain the terminal identification, and after comparing with its own identification, it can be known whether the paging object is itself.
  • the method before receiving the first negotiation message or the second negotiation message issued by the core network, the method further includes: the terminal uses a pre-appointed public key and private key to perform two-way authentication with the core network. right.
  • FIG. 3 is a flowchart of the method for processing an access request in an embodiment of the present disclosure. As shown in FIG. 3, the method includes:
  • Step S301 Receive an access request sent by the terminal, where the access request is used to request access to the core network, the access request carries an uplink anonymization string and a second configuration parameter, and the uplink anonymization string is used by the terminal using the second anonymity algorithm
  • the intermediate operator is obtained by processing the intermediate operator with the second configuration parameter, the intermediate operator is obtained by the terminal using the first anonymous algorithm and the first configuration parameter to process the terminal identification, and the intermediate operator is used to identify the terminals of the core network access layer in different regions Identification, the terminal identification is stored in the terminal and the identity authentication server of the core network;
  • Step S303 Match the uplink anonymization string and the second configuration parameter carried in the access request with the uplink anonymization string and the second configuration parameter stored locally in the core network.
  • the terminal identification is two-way encrypted when interacting between the terminal and the core network, the interaction is performed through the uplink anonymization string and the downlink anonymization string, and through the setting of the intermediate operator, the core network in different regions
  • the terminal identification can also be encrypted when interacting with each other.
  • the terminal identification is only stored in the terminal and the core network identity authentication server, and the core network access server uses the intermediate operator and anonymization string to identify the terminal. This effectively solves the problem in the prior art that the terminal identity is easily stolen by an attacker, making it difficult for the terminal identity to be matched and utilized by the attacker.
  • the access uses an anonymous string instead of the terminal identification for identification, which can effectively prevent the leakage of the terminal identification.
  • the access request when the access request is an access request for the terminal to access the core network for the first time, the first configuration parameter and the second configuration parameter both use default values.
  • the The method further includes: the access server of the core network sends the uplink anonymization string to the identity authentication server of the core network; after the identity authentication server completes the matching between the uplink anonymization string and the second configuration parameter, randomly generating the negotiated value of the first configuration parameter;
  • the identity authentication server sends a first negotiation message to the terminal, where the first negotiation message carries the negotiation value of the first configuration parameter, and the first negotiation message is used to instruct the terminal to use the negotiation value of the first configuration parameter and the default value of the second configuration parameter.
  • the terminal identification is only stored in the terminal and the core network identity authentication server, and the core network access server uses intermediate operators and anonymization strings to identify the terminal.
  • the uplink anonymization string is sent to the identity authentication server for matching. It can prevent the terminal identification from leaking when the access layer of the core network is attacked.
  • both the first configuration parameter and the second configuration parameter used when generating the uplink anonymization string use default values, that is, the parameter values agreed upon in advance by the terminal and the core network.
  • the core network matches the received uplink anonymization string according to the local default value of the second configuration parameter, the default value of the first parameter, and the terminal identifier. After the match is successful, it will randomly generate the first parameter.
  • the negotiated value of a configuration parameter is sent to the terminal. This step is equivalent to assigning a first configuration parameter to the terminal after confirming the identity of the terminal to facilitate the encryption of the subsequent access process.
  • the terminal After receiving the negotiated value of the first configuration parameter, the terminal will use the first anonymous algorithm and the negotiated value of the first configuration parameter to process the terminal identifier to obtain a new intermediate operator, and then use the second anonymous algorithm and the second configuration parameter default Value to process the new intermediate operator to obtain a new uplink anonymization string, and re-send the access request to the core network.
  • the method further includes: the access server receives the access request re-sent by the terminal, where the re-sent access request Carry the newly generated uplink anonymization string and the default value of the second configuration parameter.
  • the newly generated uplink anonymization string is obtained by the terminal using the negotiated value of the first configuration parameter and the default value of the second configuration parameter to process the terminal identification; the access server will generate a new Send the upstream anonymization string of the identity authentication server to the identity authentication server; after the identity authentication server matches the terminal, it sends the newly generated intermediate operator using the negotiated value of the first configuration parameter to the access server; the access server saves the newly generated intermediate operator obtained from the identity authentication server And randomly generate a second configuration parameter negotiation value; the access server delivers a second negotiation message to the terminal, where the second negotiation message carries the second configuration parameter negotiation value.
  • the negotiated values of the first configuration parameter and the second configuration parameter are configured by the identity authentication server and the access server respectively, and the intermediate operator and the anonymization string use different encryption algorithms (that is, anonymous algorithms). Further improve the security of terminal identification.
  • the method further includes: when the access server needs to initiate a paging to the specified terminal, receiving the intermediate operator of the specified terminal sent by the identity authentication server; using the intermediate operator of the specified terminal After successfully matching with the designated terminal, the downlink anonymization string is sent to the designated terminal, where the downlink anonymization string is obtained by the access server using the third anonymity algorithm and the second configuration parameter to process the intermediate operator of the designated terminal, and the downlink anonymization The string is used to instruct the designated terminal to send an access request to the access server.
  • the core network access server initiates a phone number identification request to the identity identification server.
  • the identity recognition server recognizes the terminal through the phone number, and returns the anonymized intermediate operator of the terminal, and sends it to the core network access server where the terminal is nearest.
  • the core network access server identifies the terminal through the intermediate operator, and obtains the current second configuration parameter of the terminal.
  • the core network access server calculates the downlink anonymization string through the second configuration parameter and the intermediate operator, and initiates paging.
  • the base station uses the downlink anonymization string to initiate a paging message. After receiving the downlink anonymization string, the terminal matches the downlink anonymization string under the current configuration, and if the matching is successful, it initiates an access request.
  • the terminal access request message carries the uplink anonymization string calculated by the current configuration parameter and the second configuration parameter to initiate an access request.
  • the core network access server After the core network access server receives the uplink anonymization string and the second configuration parameter, it matches the terminal, and if the matching is successful, completes the terminal identification of the paging process. Other processes can follow. Paging and terminal paging response messages use different anonymization strings to prevent matching attacks.
  • the method when the terminal first sends an access request to the access core network during the roaming process, the method further includes: the access core network transfers the uplink anonymity carried in the access request The transformation string is sent to the home core network of the terminal; the access core network receives the intermediate operator sent by the home core network, where the received intermediate operator is obtained by the home core network using the negotiated value of the first configuration parameter; The access core network saves the intermediate operator obtained from the home core network, and randomly generates the second configuration parameter negotiation value; the access core network sends the randomly generated second configuration parameter negotiation value to the terminal.
  • the terminal access process in the international roaming state may include the following steps:
  • the uplink anonymization string calculated using the first configuration parameter and the second configuration parameter as the default value of 0, and the anonymization string and the second configuration parameter are carried when the access request is initiated.
  • the home PLMN public land mobile (communication) network
  • the local core network After the local core network receives the uplink anonymization string, it cannot match the terminal locally, and performs identity authentication with the core network where the terminal belongs, and the authentication information carries the uplink anonymization string.
  • the home core network After the authentication is successful, the home core network sends the intermediate operator of the terminal to the local core network.
  • a new second configuration parameter is randomly generated, and the corresponding uplink anonymization string is calculated.
  • the local core network ensures that the second configuration parameter and the uplink anonymization string are unique in the access server.
  • the terminal After receiving the second configuration parameter, the terminal saves the second configuration parameter and responds to the configuration validation message.
  • the terminal identification is only saved in the terminal and the core network identity authentication server.
  • the core network access server uses intermediate operators and anonymized strings to identify the terminal. When the user roams across operators or internationally, the local operator cannot obtain the terminal identification information, and For the protection of the user identity, there is no need to preset the operator public key.
  • the present invention utilizes combined anonymization processing methods to realize hierarchical processing of anonymization algorithms, and uses the characteristics of this anonymization processing to construct different uplink and downlink anonymization strings for the terminal identification, and the terminal and wireless network perform different anonymization strings.
  • Identity recognition is used during access, paging, and roaming through anonymized strings to avoid the risk of user identity leakage.
  • Fig. 4 is a schematic diagram of an anonymization algorithm flow diagram according to an embodiment of the present disclosure.
  • the intermediate operator is obtained through anonymization algorithm 1 (equivalent to the aforementioned first anonymity algorithm) for the terminal identifier, and the configuration parameter 1 ( (Equivalent to the aforementioned first configuration parameter) participates in anonymization processing.
  • Anonymization algorithm 2 (equivalent to the aforementioned second anonymity algorithm) and algorithm 3 (equivalent to the aforementioned third anonymity algorithm) are to use intermediate operators to calculate the uplink anonymization string and the downlink anonymization string, anonymization algorithm 2 and algorithm 3 Use the same configuration parameter 2 (equivalent to the aforementioned second configuration parameter) to participate in anonymization processing.
  • configuration parameter 1 and configuration parameter 2 can be used to obtain the uplink anonymization string and the downlink anonymization string.
  • the uplink anonymization string plus configuration parameter 2 can be used for access, and the core network uses the uplink anonymization string and configuration parameter 2 for terminal identification.
  • the paging process uses the downlink anonymization string.
  • the terminal can identify whether the paging is itself through the anonymization string.
  • the configuration parameter 1 negotiates with the core network identity authentication server.
  • the negotiated configuration parameter 1 is stored in the terminal and the core network identity authentication server, and the configuration parameter 1 does not need to be modified for a long time.
  • Configuration parameter 2 is negotiated between the terminal and the core network access server, and the parameter modification frequency can be flexibly set according to the situation.
  • Fig. 5 is a schematic diagram of visibility of information related to terminal identification according to an embodiment of the present disclosure, as shown in Fig. 5:
  • the terminal identity information is only stored in the terminal and the core network identity authentication server, and no interaction is required under any circumstances.
  • the intermediate operator is calculated by the configuration parameter 1 and the user identity through the anonymization algorithm 1.
  • the terminal needs to be saved, and the core network identity authentication server and the core network access server are visible to the intermediate operator.
  • Configuration parameter 2 is the negotiated configuration between the terminal and the core network access server, and the uplink message can be transmitted over the air interface.
  • the uplink anonymization string is obtained by the anonymization algorithm 2 through the intermediate operator and the configuration parameter 2, and can be transmitted in the clear text on the air interface.
  • the downstream anonymization string is obtained through the intermediate operator and the configuration parameter 2 using the anonymization algorithm 3, and can be transmitted in plaintext over the air interface.
  • the initial access terminal uses configuration parameter 1 and configuration parameter 2 as initial values to calculate the uplink anonymization string for identification.
  • configuration parameter 1 is solidified, if the synchronization information of the configuration parameter 2 is lost, the terminal uses the configuration parameter 2 as the initial value for identification.
  • the method for sending/processing an access request provided in the embodiments of the present disclosure can achieve the following technical effects:
  • Access uses an anonymized string instead of terminal identification for identification to prevent leakage of terminal identification
  • the terminal identification is only stored in the terminal and the core network identity authentication server, and the core network access server uses intermediate operators and anonymized strings to identify the terminal;
  • the embodiment of the present disclosure also provides a device for sending an access request, and the device is used to implement the above-mentioned method embodiments and preferred implementations for the access request, and those that have been explained will not be repeated.
  • the term "module” can implement a combination of software and/or hardware with predetermined functions.
  • the devices described in the following embodiments are preferably implemented by software, hardware or a combination of software and hardware is also possible and conceived.
  • Fig. 6 is a structural block diagram of a device for sending an access request according to an embodiment of the present disclosure. As shown in Fig. 6, the device includes:
  • the first processing module 60 is configured to use the first anonymous algorithm and the first configuration parameter to process the terminal identification to obtain an intermediate operator, where the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification is stored Identity authentication server in the terminal and core network;
  • the second processing module 62 is configured to use the second anonymity algorithm and the second configuration parameter to process the intermediate operator to obtain the uplink anonymization string;
  • the sending module 64 is configured to send an access request including the uplink anonymization string and the second configuration parameter to the core network, where the access request is used to request access to the core network and instruct the core network to use the locally stored uplink anonymization
  • the string and the second configuration parameter are matched with the uplink anonymization string and the second configuration parameter carried in the access request.
  • the first processing module 60 uses the first anonymity algorithm and the first configuration parameter to process the terminal identification to obtain an intermediate operator, where the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification
  • the identity authentication server stored in the terminal and the core network uses the second anonymity algorithm and the second configuration parameter to process the intermediate operator to obtain the uplink anonymization string
  • the sending module 64 will include the uplink anonymization string and the second
  • the access request for the configuration parameters is sent to the core network, where the access request is used to request access to the core network, and instruct the core network to use the locally stored uplink anonymization string and the second configuration parameter, and the uplink carried in the access request
  • the anonymization string is matched with the second configuration parameter.
  • the access uses an anonymous string instead of the terminal identification for identification, which can effectively prevent the leakage of the terminal identification.
  • the method further includes: receiving a first negotiation message issued by the core network, wherein the first negotiation message carries a first configuration parameter negotiation randomly generated by the core network Value: Use the negotiated value of the first configuration parameter and the default value of the second configuration parameter to resend the access request to the core network.
  • the above-mentioned apparatus also includes a receiving module for receiving a first negotiation message issued by the core network, where the first negotiation message carries a first configuration parameter negotiation value randomly generated by the core network; the sending module 64 may also be used for The negotiated value of the configuration parameter and the default value of the second configuration parameter are re-sent to the core network for an access request.
  • the first configuration parameter and the second configuration parameter used in generating the uplink anonymization string for the terminal that accesses the core network for the first time use default values, that is, the parameter values agreed by the terminal and the core network in advance.
  • the core network matches the received uplink anonymization string according to the local default value of the second configuration parameter, the default value of the first parameter, and the terminal identifier. After the match is successful, it will randomly generate the first parameter.
  • the negotiated value of a configuration parameter is sent to the terminal. This step is equivalent to assigning a first configuration parameter to the terminal after confirming the identity of the terminal to facilitate the encryption of the subsequent access process.
  • the terminal After receiving the negotiated value of the first configuration parameter, the terminal will use the first anonymous algorithm and the negotiated value of the first configuration parameter to process the terminal identifier to obtain a new intermediate operator, and then use the second anonymous algorithm and the second configuration parameter default Value to process the new intermediate operator to obtain a new uplink anonymization string, and re-send the access request to the core network.
  • the method further includes: receiving the second The negotiation message, where the second negotiation message carries the second configuration parameter negotiation value randomly generated by the core network.
  • the foregoing receiving module may also be used to receive a second negotiation message issued by the core network, where the second negotiation message carries a second configuration parameter negotiation value randomly generated by the core network.
  • the core network side matches the uplink anonymization string sent by the terminal, it will randomly generate a second configuration parameter negotiation value and send it to the terminal.
  • the terminal uses the first configuration parameter negotiation value and the second configuration parameter negotiation value. Regenerate the uplink anonymization string and re-initiate an access request to the core network. At this time, it can be considered that the terminal has officially accessed the core network, and the terminal side and the core network side have saved the first configuration parameter negotiation value and the second configuration parameter respectively.
  • the configuration parameter negotiation value can also be understood as storing the second configuration parameter negotiation value and the intermediate operator obtained by using the first configuration parameter negotiation value.
  • the above-mentioned receiving module may also be used to: receive a paging message from the core network, where the paging message carries a downlink anonymization string, and the downlink anonymization string is used by the core network.
  • the anonymity algorithm and the second configuration parameter are obtained by processing the intermediate operator; the terminal determines whether the object of the downlink anonymization string paging is itself through the downlink anonymization string and the first and second configuration parameters stored locally.
  • the core network access server initiates a phone number identification request to the identity identification server.
  • the identity recognition server recognizes the terminal through the phone number, and returns the anonymized intermediate operator of the terminal, and sends it to the core network access server where the terminal is nearest.
  • the core network access server identifies the terminal through the intermediate operator, and obtains the current second configuration parameter of the terminal.
  • the core network access server calculates the downlink anonymization string through the second configuration parameter and the intermediate operator, and initiates paging.
  • the base station uses the downlink anonymization string to initiate a paging message. After receiving the downlink anonymization string, the terminal matches the downlink anonymization string under the current configuration, and if the matching is successful, it initiates an access request.
  • the terminal access request message carries the uplink anonymization string calculated by the current configuration parameter and the second configuration parameter to initiate an access request.
  • the core network access server After the core network access server receives the uplink anonymization string and the second configuration parameter, it matches the terminal, and if the matching is successful, completes the terminal identification of the paging process. Other processes can follow. Paging and terminal paging response messages use different anonymization strings to prevent matching attacks.
  • the method before receiving the first negotiation message or the second negotiation message issued by the core network, the method further includes: the terminal uses a pre-appointed public key and private key to perform two-way authentication with the core network. right.
  • the above-mentioned device also includes an authentication module, which is used to perform two-way authentication with the core network using the pre-appointed public key and private key.
  • the embodiment of the present disclosure also provides a device for sending an access request, and the device is used to implement the above-mentioned method embodiments and preferred implementations of the access request processing method, and those that have been described will not be repeated.
  • the term "module" can implement a combination of software and/or hardware with predetermined functions.
  • the devices described in the following embodiments are preferably implemented by software, hardware or a combination of software and hardware is also possible and conceived.
  • Fig. 7 is a structural block diagram of a device for sending an access request according to an embodiment of the present disclosure. As shown in Fig. 7, the device includes:
  • the receiving module 70 is configured to receive an access request sent by the terminal.
  • the access request is used to request access to the core network.
  • the access request carries the uplink anonymization string and the second configuration parameter.
  • the uplink anonymization string is used by the terminal.
  • the anonymous algorithm and the second configuration parameter are obtained by processing the intermediate operator.
  • the intermediate operator is processed by the terminal using the first anonymous algorithm and the first configuration parameter to process the terminal identification.
  • the intermediate operator is used to identify the core network access layer in different regions
  • the terminal identifier of the terminal is stored in the terminal and the identity authentication server of the core network;
  • the matching module 72 is configured to match the uplink anonymization string and the second configuration parameter carried in the access request with the uplink anonymization string and the second configuration parameter stored locally in the core network.
  • the receiving module 70 receives the access request sent by the terminal, and the matching module 72 compares the uplink anonymization string and second configuration parameter carried in the access request with the uplink anonymization string and second configuration parameter stored locally in the core network. match.
  • the access uses an anonymous string instead of the terminal identification for identification, which can effectively prevent the leakage of the terminal identification.
  • the access server of the core network sends the uplink anonymization string to the identity authentication server of the core network; after the identity authentication server completes the matching of the uplink anonymization string and the second configuration parameter, it randomly generates the first configuration parameter negotiation Value; the identity authentication server sends a first negotiation message to the terminal, where the first negotiation message carries the first configuration parameter negotiation value, and the first negotiation message is used to instruct the terminal to use the first configuration parameter negotiation value and the second configuration parameter default value , Re-send the access request to the core network.
  • the terminal identification is only stored in the terminal and the core network identity authentication server, and the core network access server uses intermediate operators and anonymization strings to identify the terminal.
  • the uplink anonymization string is sent to the identity authentication server for matching. It can prevent the terminal identification from leaking when the access layer of the core network is attacked.
  • both the first configuration parameter and the second configuration parameter used when generating the uplink anonymization string use default values, that is, the parameter values agreed upon in advance by the terminal and the core network.
  • the core network matches the received uplink anonymization string according to the local default value of the second configuration parameter, the default value of the first parameter, and the terminal identifier. After the match is successful, it will randomly generate the first parameter.
  • the negotiated value of a configuration parameter is sent to the terminal. This step is equivalent to assigning a first configuration parameter to the terminal after confirming the identity of the terminal to facilitate the encryption of the subsequent access process.
  • the terminal After receiving the negotiated value of the first configuration parameter, the terminal will use the first anonymous algorithm and the negotiated value of the first configuration parameter to process the terminal identifier to obtain a new intermediate operator, and then use the second anonymous algorithm and the second configuration parameter default Value to process the new intermediate operator to obtain a new uplink anonymization string, and re-send the access request to the core network.
  • the core network will also perform the following operations: the access server receives the access request re-sent by the terminal, where the re-sent access The request carries the newly generated uplink anonymization string and the default value of the second configuration parameter.
  • the newly generated uplink anonymization string is obtained by the terminal using the negotiated value of the first configuration parameter and the default value of the second configuration parameter to process the terminal identification; the access server will The newly generated uplink anonymization string is sent to the identity authentication server; after the identity authentication server matches the terminal, it sends the newly generated intermediate operator using the negotiated value of the first configuration parameter to the access server; the access server saves the information obtained from the identity authentication server The newly generated intermediate operator generates a second configuration parameter negotiation value randomly; the access server delivers a second negotiation message to the terminal, where the second negotiation message carries the second configuration parameter negotiation value.
  • the negotiated values of the first configuration parameter and the second configuration parameter are configured by the identity authentication server and the access server respectively, and the intermediate operator and the anonymization string use different encryption algorithms (that is, anonymous algorithms). Further improve the security of terminal identification.
  • the core network will also perform the following operations: when the access server needs to initiate a paging to the designated terminal, receive the intermediate operator of the designated terminal sent by the identity authentication server; use the intermediate operator of the designated terminal After the operator is successfully matched with the designated terminal, the downlink anonymization string is sent to the designated terminal, where the downlink anonymization string is obtained by the access server using the third anonymity algorithm and the second configuration parameter to process the intermediate operator of the designated terminal.
  • the anonymization string is used to instruct the designated terminal to send an access request to the access server.
  • the core network access server initiates a phone number identification request to the identity identification server.
  • the identity recognition server recognizes the terminal through the phone number, and returns the anonymized intermediate operator of the terminal, and sends it to the core network access server where the terminal is nearest.
  • the core network access server identifies the terminal through the intermediate operator, and obtains the current second configuration parameter of the terminal.
  • the core network access server calculates the downlink anonymization string through the second configuration parameter and the intermediate operator, and initiates paging.
  • the base station uses the downlink anonymization string to initiate a paging message. After receiving the downlink anonymization string, the terminal matches the downlink anonymization string under the current configuration, and if the matching is successful, it initiates an access request.
  • the terminal access request message carries the uplink anonymization string calculated by the current configuration parameter and the second configuration parameter to initiate an access request.
  • the core network access server After the core network access server receives the uplink anonymization string and the second configuration parameter, it matches the terminal, and if the matching is successful, completes the terminal identification of the paging process. Other processes can follow. Paging and terminal paging response messages use different anonymization strings to prevent matching attacks.
  • the core network when the terminal first sends an access request to the core network where it is accessed during roaming, the core network will also perform the following operations:
  • the uplink anonymization string is sent to the home core network of the terminal;
  • the access core network receives the intermediate operator sent by the home core network, where the received intermediate operator is processed by the home core network using the first configuration parameter negotiation value Obtained;
  • the access core network saves the intermediate operator obtained from the home core network, and randomly generates the second configuration parameter negotiation value;
  • the access core network sends the randomly generated second configuration parameter negotiation value to the terminal.
  • the first step construct confusion number and adjustment number
  • the IMSI number is 15 digits. Add a padding number before the number to make up to 16 digits.
  • the filling number is defined as the sine value of the last four digits of the IMSI number and the second digit after the decimal point. In this example, the last four digits of the IMSI number are 4321 and the sine value is -0.966. Take the second digit 6 after the decimal point as the filling number , Before filling the IMSI number, as shown in Figure 8.
  • Fig. 8 is a first schematic diagram of an anonymous algorithm according to an embodiment of the present disclosure.
  • 16-digit numbers are divided into 4 groups, and numbered from left to right as shown in Figure 8, 4 confusion numbers can be obtained, namely: 6084, 4173, 6162, 951.
  • each obfuscation number has 24 construction methods. These different construction methods can be used as the configuration parameters of the anonymization algorithm. 1. Used to adjust the result of the anonymization string.
  • Step 2 Construct the intermediate operator
  • Fig. 9 is a second schematic diagram of an anonymous algorithm according to an embodiment of the present disclosure. As shown in Figure 9, the algorithm for calculating the intermediate operator includes the following steps:
  • the confusion number is respectively summed with the adjustment number b and the adjustment number c to obtain two new confusion numbers.
  • the sine and cosine values are respectively taken to obtain two sequence of 16 integers.
  • Fig. 10 is a third schematic diagram of an anonymous algorithm according to an embodiment of the present disclosure. There are four numbers in each column (all less than 16), the first number is shifted by 12 digits to the left, the second number is shifted by 8 digits, and the third number is shifted to the left by 4 digits. Sum the numbers, you can get a 16-bit positive integer.
  • Step 3 Construct an anonymized string
  • the basic algorithm is based on the use of an intermediate operator. Find the sine value of the operator and multiply it by 1000 to round up, then take the absolute value, and add the calculated value to the intermediate operator. Sum, the calculated sum modulo 16, yields a positive integer less than 16.
  • the 16 intermediate operators are sequentially calculated, and 16 positive integers less than 16 can be obtained. Arrange these 16 positive integers in sequence to form a sinusoidal anonymization string.
  • the sine anonymization string value in this example is 89735D6D423B696B.
  • the cosine anonymization string has the same algorithm as the sine anonymization string, but the difference is that the cosine value is used in the calculation.
  • the cosine anonymization string is: DD9D4F6B07586D7F.
  • a 16-bit integer can be used to perform a bitwise XOR operation with each intermediate operator, and the result of the XOR calculation will then participate in the subsequent calculations.
  • This 16-bit integer is used as the configuration parameter 2 of the anonymization algorithm, and the result of the anonymization string can be adjusted through the configuration parameter 2.
  • the sine anonymization string and the cosine anonymization string can be defined as an upstream anonymization string and one as a downstream anonymization string.
  • the anonymization algorithm has the following characteristics:
  • a set of intermediate operators is constructed through the IMSI number, and the value of the intermediate operator can be adjusted by configuring parameter 1.
  • the intermediate operator cannot restore the IMSI number.
  • the sine anonymized string and the cosine anonymized string can be calculated through the intermediate operator.
  • the value of the anonymized string can also be adjusted through the configuration parameter 2, and the anonymized string cannot restore the intermediate operator.
  • Configuration parameter 1 and configuration parameter 2 can be managed by levels, and there is no correlation between the parameters.
  • the anonymized string has a low probability of conflict. Without using configuration parameters, theoretically calculating 100 billion IMSI numbers in the world, the collision probability is about one in 18 million. If you add configuration parameter judgments, the collision probability will be lower.
  • the uplink anonymization string, the downlink anonymization string, and the intermediate operator can be obtained, and the information can be used for terminal access, paging, and terminal identity confidentiality in the global roaming state.
  • Fig. 11 is an interactive flowchart of the terminal accessing the core network for the first time according to an embodiment of the present disclosure. As shown in Fig. 11, the initial access process is as follows:
  • the terminal identification is first initialized in the core network identity authentication server, and the uplink anonymization parameter is calculated under the condition that the configuration parameter 1 and the configuration parameter 2 are both the default values for the initial identification of the terminal.
  • the terminal initiates an access procedure when the configuration parameter 1 and the configuration parameter 2 are both initial values.
  • both configuration parameter 1 and configuration parameter 2 use default values, carrying the uplink anonymization string calculated from the default configuration parameters for an access request, and carrying configuration parameter 2 as the default value.
  • the core network access server After the core network access server receives the uplink anonymization string, it cannot match the corresponding terminal and needs to make an identification request to the identity authentication server.
  • the identity authentication server After the identity authentication server receives the uplink anonymization string, it matches the saved uplink anonymization string to the corresponding terminal.
  • the core network identity authentication server After successful two-way authentication, the core network identity authentication server randomly generates configuration parameter 1, and uses configuration parameter 1 (configuration parameter 2 uses the default value) to generate the uplink anonymization string. If the generated uplink anonymization string does not conflict with the existing anonymization string in the core network identity authentication server, this will send configuration parameter 1 to the terminal.
  • the terminal After receiving the configuration parameter 1, the terminal saves the configuration parameter 1, and sends a confirmation message to the core network.
  • the core network identity authentication server After receiving the message, the core network identity authentication server replaces the terminal's default uplink anonymization string. And send a configuration confirmation message to the terminal.
  • the terminal After receiving the configuration confirmation message of the core network, the terminal disconnects the air interface connection, and re-initiates access according to the method of embodiment 3 to verify the configuration.
  • the terminal can perform the modification process of the configuration parameter 1 under safe conditions, so as to avoid the risk of anonymization string leakage caused by not modifying for a long time.
  • Fig. 12 is a configuration flow interaction diagram of configuration parameter 2 according to an embodiment of the present disclosure, as shown in Fig. 12:
  • the core network access server After receiving the request, the core network access server initiates an identification request to the core network identity authentication server at the home location of the terminal when the terminal cannot be matched through the uplink anonymization string, and carries the uplink anonymization string.
  • the core network identity authentication server After the terminal is authenticated successfully, the core network identity authentication server sends the current intermediate operator of the terminal to the core network access server.
  • the core network access server After the core network access server receives the intermediate operator, it randomly generates a new configuration parameter 2 and calculates the corresponding uplink anonymization string. The core network access server ensures that the configuration parameter 2 and the uplink anonymization string are in the access server The only one.
  • the terminal After receiving configuration 2, the terminal saves configuration parameter 2 and responds to the configuration effective message.
  • FIG. 13 is a flowchart of terminal access when both configuration parameter 1 and configuration parameter 2 are valid according to an embodiment of the present disclosure, as shown in FIG. 13:
  • the terminal uses configuration parameter 1 and configuration parameter 2 to generate an uplink anonymization string.
  • the terminal carries the uplink anonymization string and configuration parameter 2 to initiate an access request message.
  • the core network After the core network receives the request, it matches the terminal according to the configuration parameter 2 and the uplink anonymization string.
  • Fig. 14 is an interactive flow chart of the core network paging a designated phone number according to an embodiment of the present disclosure. As shown in Fig. 14, when the core network needs to page a designated phone number, the processing flow is as follows:
  • the core network access server initiates a phone number recognition request to the identity recognition server.
  • the identity recognition server recognizes the terminal through the phone number, and returns the anonymized intermediate operator of the terminal, and sends it to the core network access server where the terminal is nearest.
  • the core network access server identifies the terminal through the intermediate operator, and obtains the current configuration parameter 2 of the terminal.
  • the core network accesses the access server to calculate the downlink anonymization string through configuration parameter 2 and the intermediate operator, and initiate paging.
  • the base station uses the downlink anonymization string to initiate a paging message.
  • the terminal After the terminal receives the downlink anonymization string, it matches the downlink anonymization string under the current configuration. If the matching is successful, it initiates an access request.
  • the terminal access request message carries the uplink anonymization string calculated by the current configuration parameter and the configuration parameter 2 to initiate an access request.
  • the core network access server After the core network access server receives the uplink anonymization string and the configuration parameter 2, it matches the terminal, and if the matching is successful, completes the terminal identification of the paging process. Other processes can follow.
  • Fig. 15 is a flow chart of interaction when a terminal accesses in an international roaming state according to an embodiment of the present disclosure, as shown in Fig. 15:
  • the terminal accesses the international roaming area for the first time, it uses the uplink anonymization string calculated with configuration parameter 1 and configuration parameter 2 as the default value 0.
  • the terminal When initiating an access request, it carries the anonymization string, configuration parameter 2 and home location. PLMN.
  • the local core network After the local core network receives the uplink anonymization string, it cannot match the terminal locally, and performs identity authentication with the core network where the terminal belongs, and the authentication information carries the uplink anonymization string.
  • the home core network After the authentication is successful, the home core network sends the intermediate operator of the terminal to the local core network.
  • a new configuration parameter 2 is randomly generated, and the corresponding uplink anonymization string is calculated.
  • the local core network guarantees that the configuration parameter 2 and the uplink anonymization string are unique in the access server.
  • This embodiment is a method for paging the terminal when the terminal is roaming in multiple core network coverage areas and the configuration parameter 2 is modified by other core networks, but the terminal returns to the original core network coverage area and does not interact with the core network.
  • the terminal can distinguish according to the serving PLMN, save the latest configuration parameter 2 and the corresponding downlink anonymization string under multiple PLMNs.
  • the core network When the core network initiates a paging, it may initiate a paging request to the core network where the terminal has camped.
  • the camped core network uses the configuration parameter 2 saved by itself to initiate paging, and the terminal only needs to match the downlink anonymization string and the corresponding PLMN , You can identify whether you are paging. If the matching is successful, the terminal can initiate an access, the access is successful, the authentication process is performed, and the configuration parameter 2 is updated.
  • the embodiment of the present disclosure also provides a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • Step S1 Use the first anonymous algorithm and the first configuration parameter to process the terminal identification to obtain an intermediate operator, where the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification is stored in the terminal and the core network Identity authentication server;
  • Step S2 Use the second anonymity algorithm and the second configuration parameter to process the intermediate operator to obtain the uplink anonymization string;
  • Step S3 Send an access request containing the uplink anonymization string and the second configuration parameter to the core network, where the access request is used to request access to the core network and instruct the core network to use the locally stored uplink anonymization string and the first configuration parameter.
  • the second configuration parameter is matched with the uplink anonymization string carried in the access request and the second configuration parameter.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • the first negotiation message carries the first configuration parameter negotiation value randomly generated by the core network; use the first configuration parameter negotiation value and the second configuration parameter default value to re-transmit to the core network Send an access request.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • a second negotiation message issued by the core network is received, where the second negotiation message carries a second configuration parameter negotiation value randomly generated by the core network.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • the terminal receives the paging message from the core network, where the paging message carries the downlink anonymization string, which is obtained by the core network using the third anonymity algorithm and the second configuration parameter to process the intermediate operator;
  • the anonymization string and the first configuration parameter and the second configuration parameter stored locally determine whether the object of the downlink anonymization string paging is oneself.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • Step S11 Receive an access request sent by the terminal, where the access request is used to request access to the core network, the access request carries an uplink anonymization string and a second configuration parameter, and the uplink anonymization string is used by the terminal using the second anonymity algorithm
  • the intermediate operator is obtained by processing the intermediate operator with the second configuration parameter, the intermediate operator is obtained by the terminal using the first anonymous algorithm and the first configuration parameter to process the terminal identification, and the intermediate operator is used to identify the terminals of the core network access layer in different regions Identification, the terminal identification is stored in the terminal and the identity authentication server of the core network;
  • Step S12 Match the uplink anonymization string and the second configuration parameter carried in the access request with the uplink anonymization string and the second configuration parameter stored locally in the core network.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • the access server of the core network sends the uplink anonymization string to the identity authentication server of the core network; after the identity authentication server completes the matching between the uplink anonymization string and the second configuration parameter, it randomly generates the negotiated value of the first configuration parameter; the identity authentication server sends The terminal sends a first negotiation message, where the first negotiation message carries the first configuration parameter negotiation value, and the first negotiation message is used to instruct the terminal to use the first configuration parameter negotiation value and the second configuration parameter default value to resend to the core network Access request.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • the access server receives the access request re-sent by the terminal, where the re-sent access request carries the newly generated uplink anonymization string and the default value of the second configuration parameter, and the newly generated uplink anonymization string is used by the terminal using the first configuration
  • the parameter negotiation value and the second configuration parameter default value are processed to obtain the terminal identification; the access server sends the newly generated uplink anonymization string to the identity authentication server; after the identity authentication server matches the terminal, it will use the newly generated first configuration parameter negotiation value
  • the intermediate operator is sent to the access server; the access server saves the newly generated intermediate operator obtained from the identity authentication server, and randomly generates the second configuration parameter negotiation value; the access server delivers the second negotiation message to the terminal, where, The second negotiation message carries the second configuration parameter negotiation value.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • the access server When the access server needs to initiate a paging to the designated terminal, it receives the intermediate operator of the designated terminal sent by the identity authentication server; after the intermediate operator of the designated terminal is successfully matched with the designated terminal, it sends the downlink anonymization string to the designated terminal, where The downlink anonymization string is obtained by the access server using the third anonymity algorithm and the second configuration parameter to process the intermediate operator of the designated terminal.
  • the downlink anonymization string is used to instruct the designated terminal to send an access request to the access server.
  • the foregoing storage medium may be configured to store a computer program for executing the following steps:
  • the access core network sends the uplink anonymization string carried in the access request to the home core network of the terminal; the access core network receives the intermediate operator sent by the home core network, where the received intermediate operator is determined by The home core network uses the first configuration parameter negotiation value processing to obtain; the access core network saves the intermediate operator obtained from the home core network, and randomly generates the second configuration parameter negotiation value; the access core network will randomly generate The negotiated value of the second configuration parameter is sent to the terminal.
  • the foregoing storage medium may include, but is not limited to: U disk, Read-Only Memory (Read-Only Memory, ROM for short), Random Access Memory (Random Access Memory, RAM for short), Various media that can store computer programs, such as mobile hard disks, magnetic disks, or optical disks.
  • the embodiment of the present disclosure also provides an electronic device including a memory and a processor, the memory is stored with a computer program, and the processor is configured to run the computer program to execute the steps in any of the foregoing method embodiments.
  • the aforementioned electronic device may further include a transmission device and an input-output device, wherein the transmission device is connected to the aforementioned processor, and the input-output device is connected to the aforementioned processor.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • Step S1 Use the first anonymous algorithm and the first configuration parameter to process the terminal identification to obtain an intermediate operator, where the intermediate operator is used to identify the terminal identification of the core network access layer in different regions, and the terminal identification is stored in the terminal and the core network Identity authentication server;
  • Step S2 Use the second anonymity algorithm and the second configuration parameter to process the intermediate operator to obtain the uplink anonymization string;
  • Step S3 Send an access request containing the uplink anonymization string and the second configuration parameter to the core network, where the access request is used to request access to the core network and instruct the core network to use the locally stored uplink anonymization string and the first configuration parameter.
  • the second configuration parameter is matched with the uplink anonymization string carried in the access request and the second configuration parameter.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the physical downlink shared channel PDSCH carrying downlink allocation index DAI information is sent to the receiving end, wherein the DAI information includes count DAI information and/or total DAI information, and the count DAI is used to indicate the current transmission Up to PDSCH, the transmitting end accumulates the number of PDSCHs that have been transmitted in the carrier of the receiving end. The total DAI information is used to indicate that until the current transmission opportunity, the transmitting end accumulates the number of transmitted PDSCHs in the carrier of the receiving end The sum of the number of PDSCHs and the number of PDSCHs queued to be sent at the current transmission opportunity.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the first negotiation message carries the first configuration parameter negotiation value randomly generated by the core network; use the first configuration parameter negotiation value and the second configuration parameter default value to re-transmit to the core network Send an access request.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • a second negotiation message issued by the core network is received, where the second negotiation message carries a second configuration parameter negotiation value randomly generated by the core network.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the terminal receives the paging message from the core network, where the paging message carries the downlink anonymization string, which is obtained by the core network using the third anonymity algorithm and the second configuration parameter to process the intermediate operator;
  • the anonymization string and the first configuration parameter and the second configuration parameter stored locally determine whether the object of the downlink anonymization string paging is oneself.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • Step S11 Receive an access request sent by the terminal, where the access request is used to request access to the core network, the access request carries an uplink anonymization string and a second configuration parameter, and the uplink anonymization string is used by the terminal using the second anonymity algorithm
  • the intermediate operator is obtained by processing the intermediate operator with the second configuration parameter, the intermediate operator is obtained by the terminal using the first anonymous algorithm and the first configuration parameter to process the terminal identification, and the intermediate operator is used to identify the terminals of the core network access layer in different regions Identification, the terminal identification is stored in the terminal and the identity authentication server of the core network;
  • Step S12 Match the uplink anonymization string and the second configuration parameter carried in the access request with the uplink anonymization string and the second configuration parameter stored locally in the core network.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the access server of the core network sends the uplink anonymization string to the identity authentication server of the core network; after the identity authentication server completes the matching between the uplink anonymization string and the second configuration parameter, it randomly generates the negotiated value of the first configuration parameter; the identity authentication server sends The terminal sends a first negotiation message, where the first negotiation message carries the first configuration parameter negotiation value, and the first negotiation message is used to instruct the terminal to use the first configuration parameter negotiation value and the second configuration parameter default value to resend to the core network Access request.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the access server receives the access request re-sent by the terminal, where the re-sent access request carries the newly generated uplink anonymization string and the default value of the second configuration parameter, and the newly generated uplink anonymization string is used by the terminal using the first configuration
  • the parameter negotiation value and the second configuration parameter default value are processed to obtain the terminal identification; the access server sends the newly generated uplink anonymization string to the identity authentication server; after the identity authentication server matches the terminal, it will use the newly generated first configuration parameter negotiation value
  • the intermediate operator is sent to the access server; the access server saves the newly generated intermediate operator obtained from the identity authentication server, and randomly generates the second configuration parameter negotiation value; the access server delivers the second negotiation message to the terminal, where, The second negotiation message carries the second configuration parameter negotiation value.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the access server When the access server needs to initiate a paging to the designated terminal, it receives the intermediate operator of the designated terminal sent by the identity authentication server; after the intermediate operator of the designated terminal is successfully matched with the designated terminal, it sends the downlink anonymization string to the designated terminal, where The downlink anonymization string is obtained by the access server using the third anonymity algorithm and the second configuration parameter to process the intermediate operator of the designated terminal.
  • the downlink anonymization string is used to instruct the designated terminal to send an access request to the access server.
  • the foregoing processor may be configured to execute the following steps through a computer program:
  • the access core network sends the uplink anonymization string carried in the access request to the home core network of the terminal; the access core network receives the intermediate operator sent by the home core network, where the received intermediate operator is determined by The home core network uses the first configuration parameter negotiation value processing to obtain; the access core network saves the intermediate operator obtained from the home core network, and randomly generates the second configuration parameter negotiation value; the access core network will randomly generate The negotiated value of the second configuration parameter is sent to the terminal.
  • modules or steps of the present disclosure can be implemented by a general computing device, and they can be concentrated on a single computing device or distributed on a network composed of multiple computing devices.
  • they can be implemented with program codes executable by the computing device, so that they can be stored in the storage device for execution by the computing device, and in some cases, can be executed in a different order than here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本公开实施例提供了一种接入请求的发送、处理方法及装置，所述发送方法包括：使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；使用第二匿名算法和第二配置参数对所述中间算子进行处理得到上行匿名化串；将包含所述上行匿名化串和所述第二配置参数的接入请求发送至核心网，其中，所述接入请求用于请求接入所述核心网，并指示所述核心网使用本地保存的所述上行匿名化串和所述第二配置参数，与所述接入请求中携带的所述上行匿名化串和所述第二配置参数进行匹配。

Description

接入请求的发送、处理方法及装置
相关申请的交叉引用
本申请基于申请号为201910556362.1、申请日为2019年6月25日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本公开涉及通信技术领域，具体而言，涉及一种接入请求的发送、处理方法及装置。
背景技术
在无线通讯领域，当终端初次接入网络或者核心网与终端同步关系丢失时，必须使用终端的唯一标识(2/3/4G使用IMSI，5G是SUPI/SUCI)进行终端身份识别，而在此过程中，攻击者往往利用该流程，向终端发起终端标识请求消息，终端收到该消息后，会使用自身身份标识进行接入，此时用户的唯一标识号很容易被攻击者窃取。
针对相关技术中，终端身份标识容易被攻击者窃取的问题，目前尚未有合理的解决办法。
发明内容
本公开实施例提供了一种接入请求的发送、处理方法及装置。
根据本公开的一个实施例，提供了一种接入请求的发送方法，包括：使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；使用第二匿名算法和第二配置参数对所述中间算子进行处理得到上行匿名化串；将包含所述上行匿名化串和所述第二配置参数的接入请求发送至核心网，其中，所述接入请求用于请求接入所述核心网，并指示所述核心网使用本地保存的所述上行匿名化串和所述第二配置参数，与所述接入请求中携带的所述上行匿名化串和所述第二配置参数进行匹配。
根据本公开的另一个实施例，还提供了一种接入请求的处理方法，包括：接收终端发送的接入请求，其中，所述接入请求用于请求接入所述核心网，所述接入请求中携带上行匿名化串和第二配置参数，所述上行匿名化串由所述终端使用第二匿名算法和第二配置参数对所述中间算子进行处理获得，所述中间算子由所述终端使用第一匿名算法和第一配置参数对终端标识进行处理获得，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；将所述接入请求中携带的所述上行匿名化串和所述第二配置参数与所述核心网本地保存的所述上行匿名化串和 所述第二配置参数进行匹配。
根据本公开的另一个实施例，还提供了一种接入请求的发送装置，包括：第一处理模块，用于使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；第二处理模块，用于使用第二匿名算法和第二配置参数对所述中间算子进行处理得到上行匿名化串；发送模块，用于将包含所述上行匿名化串和所述第二配置参数的接入请求发送至核心网，其中，所述接入请求用于请求接入所述核心网，并指示所述核心网使用本地保存的所述上行匿名化串和所述第二配置参数，与所述接入请求中携带的所述上行匿名化串和所述第二配置参数进行匹配。
根据本公开的另一个实施例，还提供了一种接入请求的处理装置，包括：接收模块，用于接收终端发送的接入请求，其中，所述接入请求用于请求接入所述核心网，所述接入请求中携带上行匿名化串和第二配置参数，所述上行匿名化串由所述终端使用第二匿名算法和第二配置参数对所述中间算子进行处理获得，所述中间算子由所述终端使用第一匿名算法和第一配置参数对终端标识进行处理，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；匹配模块，用于将所述接入请求中携带的所述上行匿名化串和所述第二配置参数与所述核心网本地保存的所述上行匿名化串和所述第二配置参数进行匹配。
根据本公开的另一个实施例，还提供了一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
根据本公开的另一个实施例，还提供了一种电子装置，包括存储器和处理器，其中，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
附图说明
此处所说明的附图用来提供对本公开的进一步理解，构成本申请的一部分，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1是本公开实施例的一种接入请求的发送方法的移动终端的硬件结构框图；
图2是本公开实施例中接入请求的发送方法的流程图；
图3是本公开实施例中接入请求的处理方法的流程图；
图4是根据本公开实施例的匿名化算法流程示意图；
图5是根据本公开实施例的与终端身份识别相关信息的可见性示意图；
图6是根据本公开实施例的接入请求的发送装置的结构框图；
图7是根据本公开实施例的接入请求的发送装置的结构框图；
图8是根据本公开实施例的匿名算法示意图一；
图9是根据本公开实施例的匿名算法示意图二；
图10是根据本公开实施例的匿名算法示意图三；
图11是根据本公开实施例的终端初次接入核心网的交互流程图；
图12是根据本公开实施例的配置参数2的配置流程交互图；
图13是根据本公开实施例的在配置参数1和配置参数2均有效时终端的接入流程图；
图14是根据本公开实施例的核心网寻呼指定电话号码时的交互流程图；
图15是根据本公开实施例的终端在国际漫游状态接入时的交互流程图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本公开。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例一所提供的接入请求的发送方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在移动终端上为例，图1是本公开实施例的一种接入请求的发送方法的移动终端的硬件结构框图。如图1所示，移动终端10可以包括一个或多个(图1中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)和用于存储数据的存储器104，可选地，上述移动终端还可以包括用于通信功能的传输设备106以及输入输出设备108。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述移动终端的结构造成限定。例如，移动终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可用于存储计算机程序，例如，应用软件的软件程序以及模块，如本公开实施例中的调度吞吐量的获取方法对应的计算机程序，处理器102通过运行存储在存储器104内的计算机程序，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括移动终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，简称为NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，简称为RF)模块，其用于通过无线方式与互联网进行通讯。
本公开实施例提供了一种接入请求的发送方法。图2是本公开实施例中接入请求的发送方法的流程图，如图2所示，该方法包括：
步骤S201，使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
步骤S203，使用第二匿名算法和第二配置参数对中间算子进行处理得到上行匿名化串；
步骤S205，将包含上行匿名化串和第二配置参数的接入请求发送至核心网，其中，接入请求用于请求接入核心网，并指示核心网使用本地保存的上行匿名化串和第二配置参数，与接入请求中携带的上行匿名化串和第二配置参数进行匹配。
通过上述方法，终端和核心网之间进行交互时对终端标识进行双向加密，通过上行匿名化串和下行匿名化串的方式进行交互，并且通过中间算子的设置，使得不同地区的核心网之间交互终端标识时也可以保证加密进行，终端标识仅在终端和核心网身份认证服务器保存，核心网接入服务器使用中间算子和匿名化串识别终端。有效解决了现有技术中终端身份标识容易被攻击者窃取的问题，使得终端标识难以被攻击者匹配利用。接入使用匿名化串代替终端标识进行身份识别，可以有效防止终端标识泄漏。
根据本公开实施例的一个优选实施方式，当接入请求为终端初次接入核心网的接入请求时，第一配置参数和第二配置参数均使用默认值，将包含上行匿名化串和第二配置参数默认值的接入请求发送至核心网之后，所述方法还包括：接收核心网下发的第一协商消息，其中，第一协商消息中携带核心网随机生成的第一配置参数协商值；使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
需要说明的是，初次接入核心网的终端，在生成上行匿名化串时使用的第一配置参数和第二配置参数都使用默认值，也就是终端和核心网事先约定的参数值。使用第一匿名算法和第一配置参数默认值对终端标识进行处理得到中间算子，然后使用第二匿名算法和第二配置参数默认值对中间算子进行处理得到上行匿名化串，将上行匿名化串发送到核心网后，核心网根据本地的第二配置参数默认值和第一参数默认值以及终端标识，对接收到的上行匿名化串进行匹配，匹配成功后，就将随机生成的第一配置参数的协商值发送给终端，这一步骤相当于是确认终端身份后，给终端分配一个第一配置参数，方便后面接入流程的加密。终端在收到第一配置参数协商值之后，将会使用第一匿名算法和第一配置参数协商值对终端标识进行处理得到新的中间算子，然后使用第二匿名算法和第二配置参数默认值对新的中间算子进行处理得到新的上行匿名化串，并向核心网重新发送接入请求。
根据本公开实施例的一个优选实施方式，使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求之后，所述方法还包括：接收核心网下发的第二协商消息，其中，第二协商消息中携带核心网随机生成的第二配置参数协商值。
需要说明的是，核心网侧匹配到终端发送的上行匿名化串之后，将会随机生成一个第二配置参数协商值，发送给终端，终端在使用第一配置参数协商值和第二配置参数协商值重新生成上行匿名化串，并重新 向核心网发起接入请求，此时，可以认为终端正式接入了核心网，且终端侧和核心网侧分别保存了第一配置参数协商值和第二配置参数协商值，也可以理解为分别保存了第二配置参数协商值，和使用第一配置参数协商值获得的中间算子。
根据本公开实施例的一个优选实施方式，所述方法还包括：终端接收来自核心网的寻呼消息，其中，寻呼消息中携带下行匿名化串，下行匿名化串由核心网使用第三匿名算法和第二配置参数对中间算子进行处理得到；终端通过下行匿名化串以及本地保存的第一配置参数和第二配置参数，确定下行匿名化串寻呼的对象是否为自己。
需要说明的是，当核心网需要寻呼指定电话号码时，核心网接入服务器向身份识别服务器发起电话号码识别请求。身份识别服务器通过电话号码识别终端，并返回该终端的匿名化中间算子，发送给终端最近所在的核心网接入服务器。核心网接入服务器通过中间算子识别终端，并获取该终端当前第二配置参数。核心网接入服务器通过第二配置参数和中间算子计算下行匿名化串，发起寻呼。基站使用下行匿名化串发起寻呼消息。终端收到下行匿名化串后，和当前配置下的下行匿名化串进行匹配，如果匹配成功，发起接入请求。终端接入请求消息携带当前配置参数计算的上行匿名化串和第二配置参数发起接入请求。核心网接入服务器收到上行匿名化串和第二配置参数后，匹配终端，如果匹配成功则完成寻呼过程的终端识别。后续可以进行其它流程。寻呼和终端寻呼响应消息，使用不同匿名化串进行，可以防止匹配攻击。
终端下行匿名化串的的匹配也可以是，终端使用第三匿名算法和当前配置的第二配置参数对下行匿名化串进行解密，得到中间算子，然后再使用当前配置的第一配置参数对中间算子进行解密，得到终端标识，与自身标识比对后就可以知道寻呼对象是否为自己。
根据本公开实施例的一个优选实施方式，接收核心网下发的第一协商消息或第二协商消息之前，所述方法还包括：终端使用预先约定的公钥和私钥与核心网进行双向鉴权。
根据本公开的另一个实施例，还提供了一种接入请求的处理方法，图3是本公开实施例中接入请求的处理方法的流程图，如图3所示，该方法包括：
步骤S301，接收终端发送的接入请求，其中，接入请求用于请求接入核心网，接入请求中携带上行匿名化串和第二配置参数，上行匿名化串由终端使用第二匿名算法和第二配置参数对中间算子进行处理获得，中间算子由终端使用第一匿名算法和第一配置参数对终端标识进行处理获得，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
步骤S303，将接入请求中携带的上行匿名化串和第二配置参数与核心网本地保存的上行匿名化串和第二配置参数进行匹配。
通过上述方法，终端和核心网之间进行交互时对终端标识进行双向加密，通过上行匿名化串和下行匿名化串的方式进行交互，并且通过中间算子的设置，使得不同地区的核心网之间交互终端标识时也可以保证加密进行，终端标识仅在终端和核心网身份认证服务器保存，核心网接入服务器使用中间算子和匿名化 串识别终端。有效解决了现有技术中终端身份标识容易被攻击者窃取的问题，使得终端标识难以被攻击者匹配利用。接入使用匿名化串代替终端标识进行身份识别，可以有效防止终端标识泄漏。
根据本公开实施例的一个优选实施方式，当接入请求为终端初次接入核心网的接入请求时，第一配置参数和第二配置参数均使用默认值，接收接入请求之后，所述方法还包括：核心网的接入服务器将上行匿名化串发送到核心网的身份认证服务器；身份认证服务器完成上行匿名化串和第二配置参数的匹配后，随机生成第一配置参数协商值；身份认证服务器向终端发送第一协商消息，其中，第一协商消息中携带第一配置参数协商值，第一协商消息用于指示终端使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
需要说明的是，终端标识仅在终端和核心网身份认证服务器保存，核心网接入服务器使用中间算子和匿名化串识别终端。当接入服务器无法匹配终端时，就将上行匿名化串发送到身份认证服务器进行匹配。可以防止核心网的接入层受到攻击时泄露终端标识。
初次接入核心网的终端，在生成上行匿名化串时使用的第一配置参数和第二配置参数都使用默认值，也就是终端和核心网事先约定的参数值。使用第一匿名算法和第一配置参数默认值对终端标识进行处理得到中间算子，然后使用第二匿名算法和第二配置参数默认值对中间算子进行处理得到上行匿名化串，将上行匿名化串发送到核心网后，核心网根据本地的第二配置参数默认值和第一参数默认值以及终端标识，对接收到的上行匿名化串进行匹配，匹配成功后，就将随机生成的第一配置参数的协商值发送给终端，这一步骤相当于是确认终端身份后，给终端分配一个第一配置参数，方便后面接入流程的加密。终端在收到第一配置参数协商值之后，将会使用第一匿名算法和第一配置参数协商值对终端标识进行处理得到新的中间算子，然后使用第二匿名算法和第二配置参数默认值对新的中间算子进行处理得到新的上行匿名化串，并向核心网重新发送接入请求。
根据本公开实施例的一个优选实施方式，身份认证服务器向终端发送第一协商消息之后，所述方法还包括：接入服务器接收终端重新发送的接入请求，其中，重新发送的接入请求中携带新生成的上行匿名化串和第二配置参数默认值，新生成的上行匿名化串由终端使用第一配置参数协商值和第二配置参数默认值处理终端标识获得；接入服务器将新生成的上行匿名化串发送给身份认证服务器；身份认证服务器匹配终端后，将使用第一配置参数协商值新生成的中间算子发送给接入服务器；接入服务器保存从身份认证服务器获取的新生成的中间算子，并随机生成第二配置参数协商值；接入服务器向终端下发第二协商消息，其中，第二协商消息中携带第二配置参数协商值。
需要说明的是，第一配置参数和第二配置参数的协商值分别由身份认证服务器和接入服务器进行配置，而且中间算子和匿名化串采用不同的加密算法(也就是匿名算法)，可以进一步提高终端标识的安全性。
根据本公开实施例的一个优选实施方式，所述方法还包括：当接入服务器需要向指定终端发起寻呼时，接收身份认证服务器发送的指定终端的中间算子；使用指定终端的中间算子与指定终端匹配成功后，向指 定终端发送下行匿名化串，其中，下行匿名化串由接入服务器使用第三匿名算法和第二配置参数对指定终端的中间算子进行处理得到，下行匿名化串用于指示指定终端向接入服务器发送接入请求。
需要说明的是，当核心网需要寻呼指定电话号码时，核心网接入服务器向身份识别服务器发起电话号码识别请求。身份识别服务器通过电话号码识别终端，并返回该终端的匿名化中间算子，发送给终端最近所在的核心网接入服务器。核心网接入服务器通过中间算子识别终端，并获取该终端当前第二配置参数。核心网接入服务器通过第二配置参数和中间算子计算下行匿名化串，发起寻呼。基站使用下行匿名化串发起寻呼消息。终端收到下行匿名化串后，和当前配置下的下行匿名化串进行匹配，如果匹配成功，这发起接入请求。终端接入请求消息携带当前配置参数计算的上行匿名化串和第二配置参数发起接入请求。核心网接入服务器收到上行匿名化串和第二配置参数后，匹配终端，如果匹配成功则完成寻呼过程的终端识别。后续可以进行其它流程。寻呼和终端寻呼响应消息，使用不同匿名化串进行，可以防止匹配攻击。
根据本公开实施例的一个优选实施方式，当终端在漫游过程中初次向接入地核心网发送接入请求时，所述方法还包括：接入地核心网将接入请求中携带的上行匿名化串发送到终端的归属地核心网；接入地核心网接收归属地核心网发送的中间算子，其中，接收到的中间算子由归属地核心网使用第一配置参数协商值处理获得；接入地核心网保存从归属地核心网获取的中间算子，并随机生成第二配置参数协商值；接入地核心网将随机生成的第二配置参数协商值发送至终端。
需要说明的是，终端在国际漫游状态接入流程，可以包括以下步骤：
1)终端在国际漫游区域进行初次接入时，使用第一配置参数和第二配置参数为默认值0计算出的上行匿名化串，发起接入请求时携带由匿名化串和第二配置参数以及归属地PLMN(公用陆地移动(通信)网)。
2)当地核心网收到上行匿名化串后，本地无法匹配到终端，向终端归属地核心网进行身份认证，认证信息携带上行匿名化串。
3)归属地核心网利用匿名化串完成身份识别后，发起鉴权流程。
4)鉴权成功后，归属地核心网将该终端的中间算子发送给当地核心网。
5)当地核心网保存中间算子。
6)随机生成新的第二配置参数，并计算出对应的上行匿名化串，当地核心网保证第二配置参数与上行匿名化串在接入服务器中唯一。
7)当地核心网完成第二配置参数生成后，将第二配置参数发送终端。
8)终端收到第二配置参数后，保存第二配置参数，并响应配置生效消息。
终端标识仅在终端和核心网身份认证服务器保存，核心网接入服务器使用中间算子和匿名化串识别终端，用户在跨运营商漫游、国际漫游时，当地运营商无法得到终端标识信息，而且出于对用户标识的保护，无需预设运营商公钥。
为了更好地理解本公开实施例中记载的技术方案，将上述方案总结如下：
本发明利用组合的匿名化处理方式，实现匿名化算法分级处理，利用这一匿名化处理的特性，对终端标识构建上行、下行不同的匿名化串，终端和无线网络通过不同的匿名化串进行身份识别，通过匿名化串在接入、寻呼、漫游时使用，避免用户标识泄漏风险。
图4是根据本公开实施例的匿名化算法流程示意图，如图4所示，对于终端标识通过匿名化算法1(相当于前述第一匿名算法)得到中间算子，该过程使用配置参数1(相当于前述第一配置参数)参与匿名化处理。匿名化算法2(相当于前述第二匿名算法)和算法3(相当于前述第三匿名算法)，是利用中间算子分别计算出上行匿名化串和下行匿名化串，匿名化算法2和算法3使用同一个配置参数2(相当于前述第二配置参数)参与匿名化处理。
实现上述匿名化处理后，利用配置参数1和配置参数2可以得到上行匿名化串和下行匿名化串。终端接入过程中，可以使用上行匿名化串加配置参数2的方式进行接入，核心网利用上行匿名化串和配置参数2进行终端识别。寻呼过程使用下行匿名化串进行，当配置参数1和配置参数2一定的场景下，终端可以通过匿名化串识别寻呼的是否为自己。
配置参数1在终端完成双向鉴权后，与核心网身份认证服务器进行协商，协商后的配置参数1保存在终端和核心网身份认证服务器，配置参数1可以长时间不必修改。
配置参数2在终端与核心网接入服务器之间进行协商，参数修改频率可以根据情况灵活设定。
图5是根据本公开实施例的与终端身份识别相关信息的可见性示意图，如图5所示：
1)终端身份标识信息，仅保存在终端和核心网身份认证服务器，在任何情况下都不需要进行交互。
2)配置参数1只有在双向鉴权成功的场景下，终端与核心网身份认证服务器进行协商配置。
3)中间算子是配置参数1和用户身份标识通过匿名化算法1计算得到，终端需要保存，核心网身份认证服务器和核心网接入服务器对中间算子可见。
4)配置参数2是终端和核心网接入服务器协商配置，上行消息中可以在空口传递。
5)上行匿名化串是通过中间算子和配置参数2利用匿名化算法2得到，可以在空口明文传递。
6)下行匿名化串是通过中间算子和配置参数2利用匿名化算法3得到，可以在空口明文传递。
初次接入终端使用配置参数1和配置参数2为初始值的方式计算上行匿名化串进行身份识别。在配置参数1固化的情况下，如果配置参数2同步信息丢失，终端使用配置参数2为初始值的方式进行识别。
本公开实施例中提供的接入请求的发送/处理方法，可以实现如下技术效果：
1)接入使用匿名化串代替终端标识进行身份识别，防止终端标识泄漏；
2)寻呼和终端寻呼响应消息，使用不同匿名化串进行，防止匹配攻击；
3)终端标识仅在终端和核心网身份认证服务器保存，核心网接入服务器使用中间算子和匿名化串识别终端；
4)利用有益效果3)，用户在跨运营商漫游、国际漫游时，可实现当地运营商无法得到终端标识信息的 目的；
5)对用户标识的保护，无需预设运营商公钥。
实施例2
本公开实施例中还提供了一种接入请求的发送装置，该装置用于实现上述接入请求的发送方法实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图6是根据本公开实施例的接入请求的发送装置的结构框图，如图6所示，该装置包括：
第一处理模块60，用于使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
第二处理模块62，用于使用第二匿名算法和第二配置参数对中间算子进行处理得到上行匿名化串；
发送模块64，用于将包含上行匿名化串和第二配置参数的接入请求发送至核心网，其中，接入请求用于请求接入核心网，并指示核心网使用本地保存的上行匿名化串和第二配置参数，与接入请求中携带的上行匿名化串和第二配置参数进行匹配。
通过上述装置，第一处理模块60使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；第二处理模块62使用第二匿名算法和第二配置参数对中间算子进行处理得到上行匿名化串；发送模块64将包含上行匿名化串和第二配置参数的接入请求发送至核心网，其中，接入请求用于请求接入核心网，并指示核心网使用本地保存的上行匿名化串和第二配置参数，与接入请求中携带的上行匿名化串和第二配置参数进行匹配。有效解决了现有技术中终端身份标识容易被攻击者窃取的问题，使得终端标识难以被攻击者匹配利用。接入使用匿名化串代替终端标识进行身份识别，可以有效防止终端标识泄漏。
根据本公开实施例的一个优选实施方式，当接入请求为终端初次接入核心网的接入请求时，第一配置参数和第二配置参数均使用默认值，将包含上行匿名化串和第二配置参数默认值的接入请求发送至核心网之后，所述方法还包括：接收核心网下发的第一协商消息，其中，第一协商消息中携带核心网随机生成的第一配置参数协商值；使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
上述装置还包括接收模块，用于接收核心网下发的第一协商消息，其中，第一协商消息中携带核心网随机生成的第一配置参数协商值；发送模块64还可以用于，使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
需要说明的是，初次接入核心网的终端，在生成上行匿名化串时使用的第一配置参数和第二配置参数都使用默认值，也就是终端和核心网事先约定的参数值。使用第一匿名算法和第一配置参数默认值对终端标识进行处理得到中间算子，然后使用第二匿名算法和第二配置参数默认值对中间算子进行处理得到上行 匿名化串，将上行匿名化串发送到核心网后，核心网根据本地的第二配置参数默认值和第一参数默认值以及终端标识，对接收到的上行匿名化串进行匹配，匹配成功后，就将随机生成的第一配置参数的协商值发送给终端，这一步骤相当于是确认终端身份后，给终端分配一个第一配置参数，方便后面接入流程的加密。终端在收到第一配置参数协商值之后，将会使用第一匿名算法和第一配置参数协商值对终端标识进行处理得到新的中间算子，然后使用第二匿名算法和第二配置参数默认值对新的中间算子进行处理得到新的上行匿名化串，并向核心网重新发送接入请求。
根据本公开实施例的一个优选实施方式，使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求之后，所述方法还包括：接收核心网下发的第二协商消息，其中，第二协商消息中携带核心网随机生成的第二配置参数协商值。
上述接收模块还可以用于，接收核心网下发的第二协商消息，其中，第二协商消息中携带核心网随机生成的第二配置参数协商值。
需要说明的是，核心网侧匹配到终端发送的上行匿名化串之后，将会随机生成一个第二配置参数协商值，发送给终端，终端在使用第一配置参数协商值和第二配置参数协商值重新生成上行匿名化串，并重新向核心网发起接入请求，此时，可以认为终端正式接入了核心网，且终端侧和核心网侧分别保存了第一配置参数协商值和第二配置参数协商值，也可以理解为分别保存了第二配置参数协商值，和使用第一配置参数协商值获得的中间算子。
根据本公开实施例的一个优选实施方式，上述接收模块还可以用于：接收来自核心网的寻呼消息，其中，寻呼消息中携带下行匿名化串，下行匿名化串由核心网使用第三匿名算法和第二配置参数对中间算子进行处理得到；终端通过下行匿名化串以及本地保存的第一配置参数和第二配置参数，确定下行匿名化串寻呼的对象是否为自己。
需要说明的是，当核心网需要寻呼指定电话号码时，核心网接入服务器向身份识别服务器发起电话号码识别请求。身份识别服务器通过电话号码识别终端，并返回该终端的匿名化中间算子，发送给终端最近所在的核心网接入服务器。核心网接入服务器通过中间算子识别终端，并获取该终端当前第二配置参数。核心网接入服务器通过第二配置参数和中间算子计算下行匿名化串，发起寻呼。基站使用下行匿名化串发起寻呼消息。终端收到下行匿名化串后，和当前配置下的下行匿名化串进行匹配，如果匹配成功，这发起接入请求。终端接入请求消息携带当前配置参数计算的上行匿名化串和第二配置参数发起接入请求。核心网接入服务器收到上行匿名化串和第二配置参数后，匹配终端，如果匹配成功则完成寻呼过程的终端识别。后续可以进行其它流程。寻呼和终端寻呼响应消息，使用不同匿名化串进行，可以防止匹配攻击。
根据本公开实施例的一个优选实施方式，接收核心网下发的第一协商消息或第二协商消息之前，所述方法还包括：终端使用预先约定的公钥和私钥与核心网进行双向鉴权。
上述装置还包括鉴权模块，用于使用预先约定的公钥和私钥与核心网进行双向鉴权。
本公开实施例中还提供了一种接入请求的发送装置，该装置用于实现上述接入请求的处理方法实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图7是根据本公开实施例的接入请求的发送装置的结构框图，如图7所示，该装置包括：
接收模块70，用于接收终端发送的接入请求，其中，接入请求用于请求接入核心网，接入请求中携带上行匿名化串和第二配置参数，上行匿名化串由终端使用第二匿名算法和第二配置参数对中间算子进行处理获得，中间算子由终端使用第一匿名算法和第一配置参数对终端标识进行处理，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
匹配模块72，用于将接入请求中携带的上行匿名化串和第二配置参数与核心网本地保存的上行匿名化串和第二配置参数进行匹配。
通过上述装置，接收模块70接收终端发送的接入请求，匹配模块72将接入请求中携带的上行匿名化串和第二配置参数与核心网本地保存的上行匿名化串和第二配置参数进行匹配。有效解决了现有技术中终端身份标识容易被攻击者窃取的问题，使得终端标识难以被攻击者匹配利用。接入使用匿名化串代替终端标识进行身份识别，可以有效防止终端标识泄漏。
根据本公开实施例的一个优选实施方式，当接入请求为终端初次接入核心网的接入请求时，第一配置参数和第二配置参数均使用默认值，接收接入请求之后，核心网还会执行以下操作：核心网的接入服务器将上行匿名化串发送到核心网的身份认证服务器；身份认证服务器完成上行匿名化串和第二配置参数的匹配后，随机生成第一配置参数协商值；身份认证服务器向终端发送第一协商消息，其中，第一协商消息中携带第一配置参数协商值，第一协商消息用于指示终端使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
需要说明的是，终端标识仅在终端和核心网身份认证服务器保存，核心网接入服务器使用中间算子和匿名化串识别终端。当接入服务器无法匹配终端时，就将上行匿名化串发送到身份认证服务器进行匹配。可以防止核心网的接入层受到攻击时泄露终端标识。
初次接入核心网的终端，在生成上行匿名化串时使用的第一配置参数和第二配置参数都使用默认值，也就是终端和核心网事先约定的参数值。使用第一匿名算法和第一配置参数默认值对终端标识进行处理得到中间算子，然后使用第二匿名算法和第二配置参数默认值对中间算子进行处理得到上行匿名化串，将上行匿名化串发送到核心网后，核心网根据本地的第二配置参数默认值和第一参数默认值以及终端标识，对接收到的上行匿名化串进行匹配，匹配成功后，就将随机生成的第一配置参数的协商值发送给终端，这一步骤相当于是确认终端身份后，给终端分配一个第一配置参数，方便后面接入流程的加密。终端在收到第一配置参数协商值之后，将会使用第一匿名算法和第一配置参数协商值对终端标识进行处理得到新的中间 算子，然后使用第二匿名算法和第二配置参数默认值对新的中间算子进行处理得到新的上行匿名化串，并向核心网重新发送接入请求。
根据本公开实施例的一个优选实施方式，身份认证服务器向终端发送第一协商消息之后，核心网还会执行以下操作：接入服务器接收终端重新发送的接入请求，其中，重新发送的接入请求中携带新生成的上行匿名化串和第二配置参数默认值，新生成的上行匿名化串由终端使用第一配置参数协商值和第二配置参数默认值处理终端标识获得；接入服务器将新生成的上行匿名化串发送给身份认证服务器；身份认证服务器匹配终端后，将使用第一配置参数协商值新生成的中间算子发送给接入服务器；接入服务器保存从身份认证服务器获取的新生成的中间算子，并随机生成第二配置参数协商值；接入服务器向终端下发第二协商消息，其中，第二协商消息中携带第二配置参数协商值。
需要说明的是，第一配置参数和第二配置参数的协商值分别由身份认证服务器和接入服务器进行配置，而且中间算子和匿名化串采用不同的加密算法(也就是匿名算法)，可以进一步提高终端标识的安全性。
根据本公开实施例的一个优选实施方式，核心网还会执行以下操作：当接入服务器需要向指定终端发起寻呼时，接收身份认证服务器发送的指定终端的中间算子；使用指定终端的中间算子与指定终端匹配成功后，向指定终端发送下行匿名化串，其中，下行匿名化串由接入服务器使用第三匿名算法和第二配置参数对指定终端的中间算子进行处理得到，下行匿名化串用于指示指定终端向接入服务器发送接入请求。
需要说明的是，当核心网需要寻呼指定电话号码时，核心网接入服务器向身份识别服务器发起电话号码识别请求。身份识别服务器通过电话号码识别终端，并返回该终端的匿名化中间算子，发送给终端最近所在的核心网接入服务器。核心网接入服务器通过中间算子识别终端，并获取该终端当前第二配置参数。核心网接入服务器通过第二配置参数和中间算子计算下行匿名化串，发起寻呼。基站使用下行匿名化串发起寻呼消息。终端收到下行匿名化串后，和当前配置下的下行匿名化串进行匹配，如果匹配成功，这发起接入请求。终端接入请求消息携带当前配置参数计算的上行匿名化串和第二配置参数发起接入请求。核心网接入服务器收到上行匿名化串和第二配置参数后，匹配终端，如果匹配成功则完成寻呼过程的终端识别。后续可以进行其它流程。寻呼和终端寻呼响应消息，使用不同匿名化串进行，可以防止匹配攻击。
根据本公开实施例的一个优选实施方式，当终端在漫游过程中初次向接入地核心网发送接入请求时，核心网还会执行以下操作：接入地核心网将接入请求中携带的上行匿名化串发送到终端的归属地核心网；接入地核心网接收归属地核心网发送的中间算子，其中，接收到的中间算子由归属地核心网使用第一配置参数协商值处理获得；接入地核心网保存从归属地核心网获取的中间算子，并随机生成第二配置参数协商值；接入地核心网将随机生成的第二配置参数协商值发送至终端。
实施例3
为了更好地理解本公开实施例中的技术方案，本实施例通过具体示例对前述实施例中的技术方案进行说明。
优选实施例一
在本优选实施例中，以IMSI号码460011987654321为例，设计了一种满足条件的匿名化算法，不可逆算法过程如下：
第一步：构建混淆数和调整数
IMSI号码为15位数字，在该号码前添加一位填充数，凑够16位。填充数这里定义为IMSI号码后四位的正弦值，小数点后第二位数字，本例中，IMSI号码后四位为4321，正弦值为-0.966，取取小数点后第二位6作为填充数，填充到IMSI号码前，如图8所示。图8是根据本公开实施例的匿名算法示意图一。
这里将16位数字分为4组，如图8所示从左向右编号，可以得到4个混淆数，分别为：6084，4173，6162，951。
这4个混淆数构建方式是完全按照顺序构建，从数学上可以分析出，根据不同的排列，每个混淆数均有24种构建方法，这些不同的构建方式，可以作为匿名化算法的配置参数1，用来调整匿名化串的结果。
将增加填充数的16位号码，分为三组，如图3所示。第一组前6位，第二组7到11位，第三组12到16位。这三组数字分别取正弦值，取小数点后5位，构成三个调整数。样例号码的三个调整数据分别为：调整数a＝99988，调整数b＝75569，调整数c＝27498。
第二步：构建中间算子
使用每一个混淆数和三个调整数，利用正弦、余弦函数，各生成一组数列。利用这4组数列来生成匿名化算法的中间算子。图9是根据本公开实施例的匿名算法示意图二。如图9所示，计算中间算子的算法包含如下步骤：
1)将混淆数取正弦函数，并取正弦值小数点后第2到第9位的值，构成8个正整数组成的数列。混淆数加上调整数a后，取余弦值，同样用余弦值的小数点后第2位到第9位，构成一个8正整数组成的数列。将两个数列依次排列，构成一个16个整数组成的数列。
2)混淆数分别与调整数b和调整数c求和，得到两个新的混淆数，按照第一步的方式，分别取正弦、余弦值，可以得到两个16个整数组成的数列。
3)将三组数列一一对齐排列，每一列的三个数求和并模16后，可以得到16个小于16的正整数，这16个数字，组成一组数列。
4)按照同样的算法，分别用4个混淆数生成四组小于16的正整数数列。
5)这四组数据对应排列，如图10所示。图10是根据本公开实施例的匿名算法示意图三。每一列四个数字(均小于16)，这四个数字分别第一个数左移12位，第二个数左移8位，第三个数左移4位后，移位后的四个数字求和，可以得到一个16位的正整数。
6)将16列数字，均按照第5步方式处理，可以得到16个16位正整数，这16个按照顺序排列的正整数及为该IMSI号的中间算子。
第三步：构建匿名化串
构建匿名化串分为两种，一种为正弦匿名化串，一种为余弦匿名化串。
以正弦匿名化串为例，基础算法为使用一个中间算子为基础，求该算子的正弦值并乘以1000取整，再取绝对值，计算出的值和该中间算子相加求和，计算的和模16，得到一个小于16的正整数。
按照上述算法，对16个中间算子依次进行计算，可以得到16个小于16的正整数。将这16个正整数依次排列，构成正弦匿名化串。本例中正弦匿名化串值为：89735D6D423B696B。
余弦匿名化串，算法和正弦匿名化串相同，区别在算计计算时采用余弦值参与计算，本例中余弦匿名化串为：DD9D4F6B07586D7F。
在构建匿名化串的算法中，使用中间算子前，可以使用一个16位整数与每一个中间算子进行一次按位异或运算，异或计算后的结果再参与后面的计算。这个16位整数作为匿名化算法的配置参数2，通过配置参数2可以调整匿名化串的结果。
正弦匿名化串和余弦匿名化串可以将一个定义为上行匿名化串，一个定义为下行匿名化串。
根据上述算法描述，总结下匿名化算法有如下特点：
1)算法第一步通过IMSI号构建一组中间算子，可以通过配置参数1调节中间算子的值，中间算子无法还原出IMSI号。
2)通过中间算子可以计算出正弦匿名化串和余弦匿名化串，这里也可以通过配置参数二调节匿名化串的值，且匿名化串无法还原出中间算子。
3)正弦匿名化串和余弦匿名化串之间无法相互推导。
4)配置参数1、配置参数2可以分级别管理，参数之间没有相关性。
5)匿名化后的串，冲突概率低。在不使用配置参数的情况下，理论计算全球1000亿个IMSI号，冲突概率约为一千八百万分之一。如果添加配置参数判断，冲突概率将更低。
根据本例中的匿名化算法，可以得到上行匿名化串、下行匿名化串、中间算子，利用这些信息可以用于终端接入、寻呼、全球漫游状态下的终端身份保密。
优选实施例二
图11是根据本公开实施例的终端初次接入核心网的交互流程图，如图11所示，初次接入过程如下：
1)终端标识首先在核心网身份认证服务器进行初始化，按照配置参数1和配置参数2均为默认值的情况下，计算出上行匿名化参数，用于终端初次识别。
2)终端在配置参数1和配置参数2均为初始值的情况下，发起接入流程。
3)由于初次接入，配置参数1和配置参数2均使用默认值，携带由默认配置参数计算出的上行匿名化串进行接入请求，携带配置参数2为默认值。
4)核心网接入服务器收到上行匿名化串后，无法匹配到对应终端，需要向身份认证服务器进行识别请求。
5)身份认证服务器收到上行匿名化串后，匹配保存的上行匿名化串，匹配到对应终端。
6)使用现有协议中的鉴权过程，进行核心网和终端间双向鉴权。
7)双向鉴权成功后，核心网身份认证服务器随机生成配置参数1，并使用配置参数1(配置参数2使用默认值)生成上行匿名化串。如果生成的上行匿名化串和核心网身份认证服务器中已有的匿名化串不冲突，这将配置参数1发送给终端。
8)终端收到配置参数1后，保存配置参数1，并向核心网发送确认消息。
9)核心网身份认证服务器收到该消息后，替换该终端的默认上行匿名化串。并向终端发送配置确认消息。
10)终端收到核心网的配置确认消息后，断开空口连接，按照实施例3的方式重新发起接入，以验证配置。
优选实施方式中，终端可以在安全情况下进行配置参数1的修改流程，避免长时间不修改导致匿名化串泄漏带来的风险。
优选实施例三
本实施例为终端完成了配置参数1的设置，但是配置参数2未配置或者配置参数2失步的情况下，终端发起接入。图12是根据本公开实施例的配置参数2的配置流程交互图，如图12所示：
1)当终端无配置参数2时，使用配置参数1和配置参数2为默认值(默认值可以设置为0)的情况下计算出的上行匿名化串，接入请求消息中携带上行匿名化串和配置参数2以及归属地PLMN发起接入请求。
2)核心网接入服务器收到该请求后，通过上行匿名化串无法匹配到终端时，向该终端的归属地核心网身份认证服务器发起识别请求，携带上行匿名化串。
3)核心网身份认证服务器匹配到上行匿名化串后，即为识别出该终端。
4)完成终端识别后，发起现有的相互鉴权流程。
5)终端鉴权成功后，核心网身份认证服务器将该终端的当前中间算子发送给核心网接入服务器。
6)核心网接入服务器收到中间算子后，随机生成新的配置参数2，并计算出对应的上行匿名化串，核心网接入服务器保证配置参数2与上行匿名化串在接入服务器中唯一。
7)核心网接入服务器完成配置参数2生成后，将配置参数2发送终端。
8)终端收到配置2后，保存配置参数2，并响应配置生效消息。
优选实施例四
图13是根据本公开实施例的在配置参数1和配置参数2均有效时终端的接入流程图，如图13所示：
1)终端利用配置参数1和配置参数2生成上行匿名化串。
2)终端携带上行匿名化串和配置参数2发起接入请求消息。
3)核心网收到请求后，根据配置参数2和上行匿名化串匹配终端。
4)匹配成功后继续后续流程。
优选实施例五
图14是根据本公开实施例的核心网寻呼指定电话号码时的交互流程图，如图14所示，当核心网需要寻呼指定电话号码时，处理流程如下：
1)核心网接入服务器向身份识别服务器发起电话号码识别请求。
2)身份识别服务器通过电话号码识别终端，并返回该终端的匿名化中间算子，发送给终端最近所在的核心网接入服务器。
3)核心网接入服务器通过中间算子识别终端，并获取该终端当前配置参数2。
4)核心网接入接入服务器通过配置参数2和中间算子计算下行匿名化串，发起寻呼。
5)基站使用下行匿名化串发起寻呼消息。
6)终端收到下行匿名化串后，和当前配置下的下行匿名化串进行匹配，如果匹配成功，这发起接入请求。
7)终端接入请求消息携带当前配置参数计算的上行匿名化串和配置参数2发起接入请求。
8)核心网接入服务器收到上行匿名化串和配置参数2后，匹配终端，如果匹配成功则完成寻呼过程的终端识别。后续可以进行其它流程。
优选实施例六
图15是根据本公开实施例的终端在国际漫游状态接入时的交互流程图，如图15所示：
1)终端在国际漫游区域进行初次接入时，使用配置参数1和配置参数2为默认值0计算出的上行匿名化串，发起接入请求时携带由匿名化串和配置参数2以及归属地PLMN。
2)当地核心网收到上行匿名化串后，本地无法匹配到终端，向终端归属地核心网进行身份认证，认证信息携带上行匿名化串。
3)归属地核心网利用匿名化串完成身份识别后，发起鉴权流程。
4)鉴权成功后，归属地核心网将该终端的中间算子发送给当地核心网。
5)当地核心网保存中间算子。
6)随机生成新的配置参数2，并计算出对应的上行匿名化串，当地核心网保证配置参数2与上行匿名化串在接入服务器中唯一。
7)当地核心网完成配置参数2生成后，将配置参数2发送终端。
8)终端收到配置参数2后，保存配置参数2，并响应配置生效消息。
优选实施例七
本实施例为终端在多个核心网覆盖区域漫游时，配置参数2其它核心网修改，但终端回到原核心网覆盖区域，且未与核心网交互情况下，寻呼终端的方法。
终端可以按照服务PLMN区分，保存多个PLMN下，最新的配置参数2以及对应的下行匿名化串。
核心网在发起寻呼时，可能向终端驻留过的核心网发起寻呼请求，驻留核心网会使用自己保存的配置参数2发起寻呼，终端只需要匹配下行匿名化串和对应的PLMN，可以识别是否寻呼的是自己。如果能匹配成功，终端可以发起接入，接入成功进行鉴权流程，并更新配置参数2。
实施例4
本公开的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
步骤S1，使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
步骤S2，使用第二匿名算法和第二配置参数对中间算子进行处理得到上行匿名化串；
步骤S3，将包含上行匿名化串和第二配置参数的接入请求发送至核心网，其中，接入请求用于请求接入核心网，并指示核心网使用本地保存的上行匿名化串和第二配置参数，与接入请求中携带的上行匿名化串和第二配置参数进行匹配。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
接收核心网下发的第一协商消息，其中，第一协商消息中携带核心网随机生成的第一配置参数协商值；使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
接收核心网下发的第二协商消息，其中，第二协商消息中携带核心网随机生成的第二配置参数协商值。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
终端接收来自核心网的寻呼消息，其中，寻呼消息中携带下行匿名化串，下行匿名化串由核心网使用第三匿名算法和第二配置参数对中间算子进行处理得到；终端通过下行匿名化串以及本地保存的第一配置参数和第二配置参数，确定下行匿名化串寻呼的对象是否为自己。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
步骤S11，接收终端发送的接入请求，其中，接入请求用于请求接入核心网，接入请求中携带上行匿 名化串和第二配置参数，上行匿名化串由终端使用第二匿名算法和第二配置参数对中间算子进行处理获得，中间算子由终端使用第一匿名算法和第一配置参数对终端标识进行处理获得，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
步骤S12，将接入请求中携带的上行匿名化串和第二配置参数与核心网本地保存的上行匿名化串和第二配置参数进行匹配。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
核心网的接入服务器将上行匿名化串发送到核心网的身份认证服务器；身份认证服务器完成上行匿名化串和第二配置参数的匹配后，随机生成第一配置参数协商值；身份认证服务器向终端发送第一协商消息，其中，第一协商消息中携带第一配置参数协商值，第一协商消息用于指示终端使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
接入服务器接收终端重新发送的接入请求，其中，重新发送的接入请求中携带新生成的上行匿名化串和第二配置参数默认值，新生成的上行匿名化串由终端使用第一配置参数协商值和第二配置参数默认值处理终端标识获得；接入服务器将新生成的上行匿名化串发送给身份认证服务器；身份认证服务器匹配终端后，将使用第一配置参数协商值新生成的中间算子发送给接入服务器；接入服务器保存从身份认证服务器获取的新生成的中间算子，并随机生成第二配置参数协商值；接入服务器向终端下发第二协商消息，其中，第二协商消息中携带第二配置参数协商值。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
当接入服务器需要向指定终端发起寻呼时，接收身份认证服务器发送的指定终端的中间算子；使用指定终端的中间算子与指定终端匹配成功后，向指定终端发送下行匿名化串，其中，下行匿名化串由接入服务器使用第三匿名算法和第二配置参数对指定终端的中间算子进行处理得到，下行匿名化串用于指示指定终端向接入服务器发送接入请求。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
接入地核心网将接入请求中携带的上行匿名化串发送到终端的归属地核心网；接入地核心网接收归属地核心网发送的中间算子，其中，接收到的中间算子由归属地核心网使用第一配置参数协商值处理获得；接入地核心网保存从归属地核心网获取的中间算子，并随机生成第二配置参数协商值；接入地核心网将随机生成的第二配置参数协商值发送至终端。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本公开的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处 理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
步骤S1，使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
步骤S2，使用第二匿名算法和第二配置参数对中间算子进行处理得到上行匿名化串；
步骤S3，将包含上行匿名化串和第二配置参数的接入请求发送至核心网，其中，接入请求用于请求接入核心网，并指示核心网使用本地保存的上行匿名化串和第二配置参数，与接入请求中携带的上行匿名化串和第二配置参数进行匹配。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
向接收端发送承载着下行分配索引DAI信息的物理下行共享信道PDSCH，其中，所述DAI信息中包含计数DAI信息和/或总数DAI信息，所述计数DAI用于指示截止到当前发送的所述PDSCH为止，发送端在接收端的载波中累计已发送的所述PDSCH的个数，所述总数DAI信息用于指示截止到当前发送时机为止，所述发送端中在接收端的载波中累计已发送的所述PDSCH个数和排队准备在所述当前发送时机发送的所述PDSCH个数之和。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
接收核心网下发的第一协商消息，其中，第一协商消息中携带核心网随机生成的第一配置参数协商值；使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
接收核心网下发的第二协商消息，其中，第二协商消息中携带核心网随机生成的第二配置参数协商值。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
终端接收来自核心网的寻呼消息，其中，寻呼消息中携带下行匿名化串，下行匿名化串由核心网使用第三匿名算法和第二配置参数对中间算子进行处理得到；终端通过下行匿名化串以及本地保存的第一配置参数和第二配置参数，确定下行匿名化串寻呼的对象是否为自己。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
步骤S11，接收终端发送的接入请求，其中，接入请求用于请求接入核心网，接入请求中携带上行匿名化串和第二配置参数，上行匿名化串由终端使用第二匿名算法和第二配置参数对中间算子进行处理获得，中间算子由终端使用第一匿名算法和第一配置参数对终端标识进行处理获得，中间算子用于识别不同地区核心网接入层的终端标识，终端标识保存在终端以及核心网的身份认证服务器；
步骤S12，将接入请求中携带的上行匿名化串和第二配置参数与核心网本地保存的上行匿名化串和第 二配置参数进行匹配。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
核心网的接入服务器将上行匿名化串发送到核心网的身份认证服务器；身份认证服务器完成上行匿名化串和第二配置参数的匹配后，随机生成第一配置参数协商值；身份认证服务器向终端发送第一协商消息，其中，第一协商消息中携带第一配置参数协商值，第一协商消息用于指示终端使用第一配置参数协商值和第二配置参数默认值，重新向核心网发送接入请求。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
接入服务器接收终端重新发送的接入请求，其中，重新发送的接入请求中携带新生成的上行匿名化串和第二配置参数默认值，新生成的上行匿名化串由终端使用第一配置参数协商值和第二配置参数默认值处理终端标识获得；接入服务器将新生成的上行匿名化串发送给身份认证服务器；身份认证服务器匹配终端后，将使用第一配置参数协商值新生成的中间算子发送给接入服务器；接入服务器保存从身份认证服务器获取的新生成的中间算子，并随机生成第二配置参数协商值；接入服务器向终端下发第二协商消息，其中，第二协商消息中携带第二配置参数协商值。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
当接入服务器需要向指定终端发起寻呼时，接收身份认证服务器发送的指定终端的中间算子；使用指定终端的中间算子与指定终端匹配成功后，向指定终端发送下行匿名化串，其中，下行匿名化串由接入服务器使用第三匿名算法和第二配置参数对指定终端的中间算子进行处理得到，下行匿名化串用于指示指定终端向接入服务器发送接入请求。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
接入地核心网将接入请求中携带的上行匿名化串发送到终端的归属地核心网；接入地核心网接收归属地核心网发送的中间算子，其中，接收到的中间算子由归属地核心网使用第一配置参数协商值处理获得；接入地核心网保存从归属地核心网获取的中间算子，并随机生成第二配置参数协商值；接入地核心网将随机生成的第二配置参数协商值发送至终端。
本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本公开的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本公开不限制于任何特定的硬件和软件结合。
以上所述仅为本公开的优选实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开 可以有各种更改和变化。凡在本公开的原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。

Claims (14)

  1. 一种接入请求的发送方法，包括：
    使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；
    使用第二匿名算法和第二配置参数对所述中间算子进行处理得到上行匿名化串；
    将包含所述上行匿名化串和所述第二配置参数的接入请求发送至核心网，其中，所述接入请求用于请求接入所述核心网，并指示所述核心网使用本地保存的所述上行匿名化串和所述第二配置参数，与所述接入请求中携带的所述上行匿名化串和所述第二配置参数进行匹配。
  2. 根据权利要求1所述的方法，其中，当所述接入请求为所述终端初次接入所述核心网的接入请求时，所述第一配置参数和所述第二配置参数均使用默认值，将包含所述上行匿名化串和所述第二配置参数默认值的接入请求发送至核心网之后，所述方法还包括：
    接收所述核心网下发的第一协商消息，其中，所述第一协商消息中携带所述核心网随机生成的第一配置参数协商值；
    使用所述第一配置参数协商值和所述第二配置参数默认值处理所述终端标识，得到新生成的上行匿名化串；
    向所述核心网重新发送所述接入请求，其中，所述重新发送的接入请求中携带所述新生成的上行匿名化串和所述第二配置参数默认值。
  3. 根据权利要求2所述的方法，其中，使用所述第一配置参数协商值和所述第二配置参数默认值，重新向所述核心网发送所述接入请求之后，所述方法还包括：
    接收所述核心网下发的第二协商消息，其中，所述第二协商消息中携带所述核心网随机生成的第二配置参数协商值。
  4. 根据权利要求1所述的方法，其中，所述方法还包括：
    终端接收来自所述核心网的寻呼消息，其中，所述寻呼消息中携带下行匿名化串，所述下行匿名化串由所述核心网使用第三匿名算法和所述第二配置参数对所述中间算子进行处理得到；
    所述终端通过所述下行匿名化串以及本地保存的所述第一配置参数和所述第二配置参数，确定所述下行匿名化串寻呼的对象是否为自己。
  5. 根据权利要求3所述的方法，其中，接收所述核心网下发的所述第一协商消息或所述第二协商消息之前，所述方法还包括：
    所述终端使用预先约定的公钥和私钥与所述核心网进行双向鉴权。
  6. 一种接入请求的处理方法，包括：
    接收终端发送的接入请求，其中，所述接入请求用于请求接入核心网，所述接入请求中携带上行匿名化串和第二配置参数，所述上行匿名化串由所述终端使用第二匿名算法和第二配置参数对中间算子进行处理获得，所述中间算子由所述终端使用第一匿名算法和第一配置参数对终端标识进行处理获得，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；
    将所述接入请求中携带的所述上行匿名化串和所述第二配置参数与所述核心网本地保存的所述上行匿名化串和所述第二配置参数进行匹配。
  7. 根据权利要求6所述的方法，其中，当所述接入请求为所述终端初次接入所述核心网的接入请求时，所述第一配置参数和所述第二配置参数均使用默认值，接收所述接入请求之后，所述方法还包括：
    所述核心网的接入服务器将所述上行匿名化串发送到所述核心网的身份认证服务器；
    所述身份认证服务器完成所述上行匿名化串和所述第二配置参数的匹配后，随机生成第一配置参数协商值；
    所述身份认证服务器向所述终端发送第一协商消息，其中，所述第一协商消息中携带所述第一配置参数协商值，所述第一协商消息用于指示所述终端使用所述第一配置参数协商值和所述第二配置参数默认值，重新向所述核心网发送所述接入请求。
  8. 根据权利要求7所述的方法，其中，所述身份认证服务器向所述终端发送第一协商消息之后，所述方法还包括：
    所述接入服务器接收所述终端重新发送的所述接入请求，其中，所述重新发送的所述接入请求中携带新生成的上行匿名化串和所述第二配置参数默认值，所述新生成的上行匿名化串由所述终端使用所述第一配置参数协商值和所述第二配置参数默认值处理所述终端标识获得；
    所述接入服务器将所述新生成的上行匿名化串发送给所述身份认证服务器；
    所述身份认证服务器匹配所述终端后，将使用所述第一配置参数协商值新生成的中间算子发送给所述接入服务器；
    所述接入服务器保存从所述身份认证服务器获取的所述新生成的中间算子，并随机生成第二配置参数协商值；
    所述接入服务器向所述终端下发第二协商消息，其中，所述第二协商消息中携带所述第二配置参数协商值。
  9. 根据权利要求6所述的方法，其中，所述方法还包括：
    当所述接入服务器需要向指定终端发起寻呼时，接收所述身份认证服务器发送的所述指定终端的中间算子；
    使用所述指定终端的中间算子与所述指定终端匹配成功后，向所述指定终端发送下行匿名化串，其中，所述下行匿名化串由所述接入服务器使用第三匿名算法和所述第二配置参数对所述指定终端的中间算子进行处理得到，所述下行匿名化串用于指示所述指定终端向所述接入服务器发送接入请求。
  10. 根据权利要求7所述的方法，其中，当所述终端在漫游过程中初次向接入地核心网发送所述接入请求时，所述方法还包括：
    所述接入地核心网将所述接入请求中携带的所述上行匿名化串发送到所述终端的归属地核心网；
    所述接入地核心网接收所述归属地核心网发送的中间算子，其中，接收到的所述中间算子由所述归属地核心网使用所述第一配置参数协商值处理获得；
    所述接入地核心网保存从所述归属地核心网获取的所述中间算子，并随机生成第二配置参数协商值；
    所述接入地核心网将随机生成的所述第二配置参数协商值发送至所述终端。
  11. 一种接入请求的发送装置，包括：
    第一处理模块，用于使用第一匿名算法和第一配置参数对终端标识进行处理得到中间算子，其中，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；
    第二处理模块，用于使用第二匿名算法和第二配置参数对所述中间算子进行处理得到上行匿名化串；
    发送模块，用于将包含所述上行匿名化串和所述第二配置参数的接入请求发送至核心网，其中，所述接入请求用于请求接入所述核心网，并指示所述核心网使用本地保存的所述上行匿名化串和所述第二配置参数，与所述接入请求中携带的所述上行匿名化串和所述第二配置参数进行匹配。
  12. 一种接入请求的处理装置，包括：
    接收模块，用于接收终端发送的接入请求，其中，所述接入请求用于请求接入核心网，所述接入请求中携带上行匿名化串和第二配置参数，所述上行匿名化串由所述终端使用第二匿名算法和第二配置参数对中间算子进行处理获得，所述中间算子由所述终端使用第一匿名算法和第一配置参数对终端标识进行处理，所述中间算子用于识别不同地区核心网接入层的所述终端标识，所述终端标识保存在所述终端以及所述核心网的身份认证服务器；
    匹配模块，用于将所述接入请求中携带的所述上行匿名化串和所述第二配置参数与所述核心网 本地保存的所述上行匿名化串和所述第二配置参数进行匹配。
  13. 一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行所述权利要求1至10任一项中所述的方法。
  14. 一种电子装置，包括存储器和处理器，其中，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至10任一项中所述的方法。
PCT/CN2020/084020 2019-06-25 2020-04-09 接入请求的发送、处理方法及装置 WO2020258988A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20832833.6A EP3972307A4 (en) 2019-06-25 2020-04-09 METHOD AND DEVICE FOR TRANSMITTING AND PROCESSING ACCESS REQUESTS
US17/622,793 US20220247727A1 (en) 2019-06-25 2020-04-09 Method and apparatus for sending and processing access request

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910556362.1A CN112134831B (zh) 2019-06-25 2019-06-25 接入请求的发送、处理方法及装置
CN201910556362.1 2019-06-25

Publications (1)

Publication Number Publication Date
WO2020258988A1 true WO2020258988A1 (zh) 2020-12-30

Family

ID=73849734

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/084020 WO2020258988A1 (zh) 2019-06-25 2020-04-09 接入请求的发送、处理方法及装置

Country Status (4)

Country Link
US (1) US20220247727A1 (zh)
EP (1) EP3972307A4 (zh)
CN (1) CN112134831B (zh)
WO (1) WO2020258988A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114095355A (zh) * 2019-07-31 2022-02-25 华为技术有限公司 一种设备配网注册的方法、设备及系统
CN115696314A (zh) * 2022-10-27 2023-02-03 天翼数字生活科技有限公司 设备匿名标识获取方法、装置、存储介质及计算机设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026174A (zh) * 2009-09-17 2011-04-20 中兴通讯股份有限公司 一种寻呼过程中用户标识的保密方法及装置
CN104754581A (zh) * 2015-03-24 2015-07-01 河海大学 一种基于公钥密码体制的lte无线网络的安全认证方法
JP2016111660A (ja) * 2014-11-27 2016-06-20 パナソニックＩｐマネジメント株式会社 認証サーバ、端末及び認証方法
CN107820244A (zh) * 2016-09-12 2018-03-20 中兴通讯股份有限公司 入网认证方法及装置
CN108632817A (zh) * 2018-07-27 2018-10-09 中国电子科技集团公司第三十研究所 一种5g高安全终端内部imsi隐私保护的方法
CN108809637A (zh) * 2018-05-02 2018-11-13 西南交通大学 基于混合密码的lte-r车-地通信非接入层认证密钥协商方法

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150278845A1 (en) * 2005-06-06 2015-10-01 Jp Morgan Chase Bank System and method for presenting loyalty offers at a point-of-sale
DE602005018216D1 (de) * 2005-09-28 2010-01-21 Nortel Networks Ltd Authentifizierungsverfahren und dazugehörige Vorrichtungen
CN101034979B (zh) * 2007-04-10 2011-05-11 中兴通讯股份有限公司 一种用户身份的保护方法
US8886200B2 (en) * 2008-09-18 2014-11-11 Qualcomm Incorporated Using signal monitoring to resolve access point identifier ambiguity
CN101771992B (zh) * 2009-01-04 2012-06-27 中国移动通信集团公司 国际移动用户标识符imsi机密性保护的方法、设备及系统
CN101998377B (zh) * 2009-08-25 2013-04-17 华为技术有限公司 国际移动用户识别码的保护方法、装置和通信系统
US8862880B2 (en) * 2011-09-23 2014-10-14 Gfk Holding Inc. Two-stage anonymization of mobile network subscriber personal information
US10419907B2 (en) * 2012-02-22 2019-09-17 Qualcomm Incorporated Proximity application discovery and provisioning
CN103152731A (zh) * 2013-02-27 2013-06-12 东南大学 一种3g接入的imsi隐私保护方法
CN105101194B (zh) * 2014-04-28 2019-07-09 华为技术有限公司 终端安全认证方法、装置及系统
WO2016085001A1 (ko) * 2014-11-27 2016-06-02 엘지전자 주식회사 스몰셀 환경을 지원하는 무선 접속 시스템에서 위치 비밀성 보호를 지원하는 방법 및 장치
EP3256981B1 (en) * 2015-01-14 2021-03-03 Hewlett-Packard Enterprise Development LP System, apparatus and method for anonymizing data prior to threat detection analysis
CN106330442B (zh) * 2015-06-17 2020-04-28 中兴通讯股份有限公司 身份认证方法、装置及系统
WO2017035699A1 (zh) * 2015-08-28 2017-03-09 华为技术有限公司 接入网络和获取客户识别模块信息的方法、终端及核心网
KR101625037B1 (ko) * 2015-11-23 2016-05-27 주식회사 엘앤제이테크 Lte 망 초기 접속 구간에서 ue 식별 파라미터의 암호화 방법
WO2018052409A1 (en) * 2016-09-14 2018-03-22 Nokia Solutions And Networks Oy Methods and apparatuses for protecting privacy of international mobile subscriber identity
US11212676B2 (en) * 2016-11-23 2021-12-28 Telefonaktiebolaget Lm Ericsson (Publ) User identity privacy protection in public wireless local access network, WLAN, access
WO2019028698A1 (en) * 2017-08-09 2019-02-14 Apple Inc. PROTECTION OF THE CONFIDENTIALITY OF A SUBSCRIBER IDENTITY
EP4284049A3 (en) * 2017-09-29 2024-02-28 Huawei Technologies Co., Ltd. Method and device for accessing device identifiers
GB2569993B (en) * 2018-01-08 2021-01-06 British Telecomm Data processing method
CN108882233B (zh) * 2018-07-17 2021-05-25 中国联合网络通信集团有限公司 一种imsi的加密方法、核心网和用户终端
KR102118259B1 (ko) * 2018-09-13 2020-06-09 한국과학기술원 이동성 관리 및 프라이버시 보호를 동시에 제공하는 방법 및 장치
EP3664310A1 (en) * 2018-12-05 2020-06-10 INTEL Corporation Methods and devices for wireless communications in device-to-device networks
US11388179B2 (en) * 2020-05-06 2022-07-12 Wells Fargo Bank, N.A. Centralized threat intelligence
US11956219B2 (en) * 2021-06-24 2024-04-09 Citrix Systems, Inc. Systems and methods to detect and prevent bots from random access by randomized HTTP URLs in real time in distributed systems

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026174A (zh) * 2009-09-17 2011-04-20 中兴通讯股份有限公司 一种寻呼过程中用户标识的保密方法及装置
JP2016111660A (ja) * 2014-11-27 2016-06-20 パナソニックＩｐマネジメント株式会社 認証サーバ、端末及び認証方法
CN104754581A (zh) * 2015-03-24 2015-07-01 河海大学 一种基于公钥密码体制的lte无线网络的安全认证方法
CN107820244A (zh) * 2016-09-12 2018-03-20 中兴通讯股份有限公司 入网认证方法及装置
CN108809637A (zh) * 2018-05-02 2018-11-13 西南交通大学 基于混合密码的lte-r车-地通信非接入层认证密钥协商方法
CN108632817A (zh) * 2018-07-27 2018-10-09 中国电子科技集团公司第三十研究所 一种5g高安全终端内部imsi隐私保护的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3972307A4 *

Also Published As

Publication number Publication date
US20220247727A1 (en) 2022-08-04
EP3972307A4 (en) 2022-07-27
CN112134831B (zh) 2023-02-21
CN112134831A (zh) 2020-12-25
EP3972307A1 (en) 2022-03-23

Similar Documents

Publication Publication Date Title
Jover et al. Security and protocol exploit analysis of the 5G specifications
JP6492115B2 (ja) 暗号鍵の生成
WO2020177768A1 (zh) 一种网络验证方法、装置及系统
US10057053B2 (en) Key agreement for wireless communication
US9060270B2 (en) Method and device for establishing a security mechanism for an air interface link
US9088408B2 (en) Key agreement using a key derivation key
CN107018676A (zh) 用户设备与演进分组核心之间的相互认证
US11368841B2 (en) Network access authentication method and device
CN112291780A (zh) 用于无线站点的身份混淆
Saeed et al. A comprehensive review on the users’ identity privacy for 5G networks
WO2019023825A1 (zh) 隐私保护的方法及设备
CN107205208B (zh) 鉴权的方法、终端和服务器
CN110519052B (zh) 基于物联网操作系统的数据交互方法和装置
WO2020258988A1 (zh) 接入请求的发送、处理方法及装置
WO2020147856A1 (zh) 认证处理方法、装置、存储介质及电子装置
EP3637815B1 (en) Data transmission method, and device and system related thereto
EP4187954A1 (en) Safe communication method and apparatus
Kumar et al. A robust and secure user authentication scheme based on multifactor and multi‐gateway in IoT enabled sensor networks
CN106535178B (zh) 接入层和非接入层密钥安全隔离装置及其方法
CN105828330A (zh) 一种接入方法及装置
CN112423300A (zh) 无线网络接入认证方法及装置
CN109155913B (zh) 网络连接方法、安全节点的确定方法及装置
WO2017118269A1 (zh) 一种空口标识的保护方法及装置
KR101785382B1 (ko) 클라이언트 인증 방법, 클라이언트의 동작 방법, 서버, 및 통신 소프트웨어
US20230048689A1 (en) Network access authentication processing method and device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20832833

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020832833

Country of ref document: EP

Effective date: 20211217

NENP Non-entry into the national phase

Ref country code: DE