WO2023131044A1 - Procédé et dispositif d'authentification et de sécurité, et support de stockage - Google Patents

Procédé et dispositif d'authentification et de sécurité, et support de stockage Download PDF

Info

Publication number
WO2023131044A1
WO2023131044A1 PCT/CN2022/143302 CN2022143302W WO2023131044A1 WO 2023131044 A1 WO2023131044 A1 WO 2023131044A1 CN 2022143302 W CN2022143302 W CN 2022143302W WO 2023131044 A1 WO2023131044 A1 WO 2023131044A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
key
supi
request message
network element
Prior art date
Application number
PCT/CN2022/143302
Other languages
English (en)
Chinese (zh)
Inventor
周巍
徐晖
Original Assignee
大唐移动通信设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 大唐移动通信设备有限公司 filed Critical 大唐移动通信设备有限公司
Publication of WO2023131044A1 publication Critical patent/WO2023131044A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present disclosure relates to the technical field of communications, and in particular to an authentication and security method, device and storage medium.
  • the 5th generation mobile communication (5G) system can not only be applied to ordinary commercial applications, but also can be used as a dedicated system in a dedicated system with high security requirements. In the field of high security applications, there are special security standards for system software and hardware.
  • each network element handles the key management and the cryptographic operation separately.
  • the 5G core network is composed of many network elements (servers) that implement various functions.
  • servers network elements
  • All software and hardware in the core network must meet the corresponding security standards. Adopting the existing solution will greatly increase the system security. complexity, thereby increasing system cost.
  • Embodiments of the present disclosure provide an authentication and security method, device, and storage medium to solve the technical problem of high system complexity in the prior art.
  • the embodiment of the present disclosure provides an authentication and security method, which is applied to an authentication cryptographic system, including:
  • the first request message includes the hidden user identifier SUCI of the target terminal UE, and the first request message is used to request the authentication and cryptographic system to perform an operation on the SUCI decryption;
  • the second request message includes the SUPI and the service network name, and the second request message is that the UDM network element checks the target UE according to the SUPI sent after the signing information of
  • the first authentication instance is created in the authentication server function AUSF functional area for this UE authentication process, and the first authentication instance includes the authentication vector;
  • the target UE When the target UE passes the authentication, receive a fourth request message sent by the AUSF network element, where the fourth request message includes the SUPI or the AuthID;
  • the second authentication instance is created in the security anchor function SEAF functional area for this UE authentication process, and the second authentication instance includes the key Kseaf;
  • the target UE When the target UE passes the authentication, receive a fifth request message sent by the SEAF network element, where the fifth request message includes the SUPI and the anti-dimensionality reduction attack ABBA;
  • the third authentication instance is created in the access and mobility management function AMF functional area for this UE authentication process, and the third authentication instance contains the key Kamf .
  • the second request message further includes AuthID
  • the AuthID is a unique identifier generated by the UDM network element for this UE authentication process.
  • the first NAS security context includes the key KNASenc and the key KNASint ;
  • the sixth request message further includes a 5G key set identifier ngKSI; the ngKSI is used to identify the first NAS security context.
  • the SUPI, the ngKSI, the key KNASenc, and the key KNASint are used for the communication cryptosystem to establish a second NAS security context
  • the second NAS security context includes the The SUPI, the ngKSI, the key KNASenc and the key KNASint.
  • the SUPI, the key KNASenc, and the key KNASint are used for the communication cryptographic system to establish a second NAS security context
  • the second NAS security context includes the SUPI, the The key KNASenc and the key KNASint.
  • an embodiment of the present disclosure provides a network device, including a memory, a transceiver, and a processor;
  • the memory is used to store computer programs; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer programs in the memory and perform the following operations:
  • the second request message includes the SUPI and the service network name, and the second request message is that the UDM network element checks the target UE according to the SUPI sent after the signing information of
  • the first authentication instance is created in the authentication server function AUSF functional area for this UE authentication process, and the first authentication instance includes the authentication vector;
  • the target UE When the target UE passes the authentication, receive a fourth request message sent by the AUSF network element, where the fourth request message includes the SUPI or the AuthID;
  • the second authentication instance is created in the security anchor function SEAF functional area for this UE authentication process, and the second authentication instance includes the key Kseaf;
  • the target UE When the target UE passes the authentication, receive a fifth request message sent by the SEAF network element, where the fifth request message includes the SUPI and the anti-dimensionality reduction attack ABBA;
  • the third authentication instance is created in the access and mobility management function AMF functional area for this UE authentication process, and the third authentication instance contains the key Kamf .
  • the second request message further includes AuthID
  • the AuthID is a unique identifier generated by the UDM network element for this UE authentication process.
  • the first NAS security context includes the key KNASenc and the key KNASint ;
  • the sixth request message further includes a 5G key set identifier ngKSI; the ngKSI is used to identify the first NAS security context.
  • the SUPI, the ngKSI, the key KNASenc, and the key KNASint are used for the communication cryptosystem to establish a second NAS security context
  • the second NAS security context includes the The SUPI, the ngKSI, the key KNASenc and the key KNASint.
  • the SUPI, the key KNASenc, and the key KNASint are used for the communication cryptographic system to establish a second NAS security context
  • the second NAS security context includes the SUPI, the The key KNASenc and the key KNASint.
  • an embodiment of the present disclosure provides a communication device system, including an authentication password system and a communication password system;
  • the authentication cryptosystem sends SUPI, the key KNASenc and the key KNASint to the communication cryptosystem;
  • the communication cryptosystem performs a NAS security process according to the SUPI, the key KNASenc and the key KNASint.
  • an authentication and security device including:
  • the first receiving module is configured to receive a first request message sent by a unified data management UDM network element, the first request message includes the user concealed identifier SUCI of the target terminal UE, and the first request message is used to request the authentication
  • the cryptographic system decrypts the SUCI
  • a decryption module configured to decrypt the SUCI to obtain the user permanent identification SUPI
  • a first sending module configured to send the SUPI to the UDM network element
  • the second receiving module is configured to receive a second request message sent by the UDM network element, the second request message includes the SUPI and the service network name, and the second request message is the UDM network element according to the specified It is sent after the SUPI checks the subscription information of the target UE;
  • a first determining module configured to determine the authentication root key of the target UE according to the SUPI, generate an authentication vector according to the authentication root key and the service network name, and use a unique identifier AuthID to identify the authentication vector .
  • This UE authentication process and a first authentication instance the first authentication instance is created in the authentication server function AUSF functional area for this UE authentication process, and the first authentication instance includes the authentication vector;
  • a second sending module configured to send the part of the authentication vector that needs to be provided to the target UE to the UDM network element
  • a third receiving module configured to receive a third request message sent by an AUSF network element, where the third request message includes an authentication response RES* and the AuthID;
  • An authentication module configured to authenticate the target UE according to the RES* and the AuthID included in the third request message.
  • it also includes a third sending module, a fourth receiving module, a second determining module and a fourth sending module;
  • the third sending module is used to send the authentication result to the AUSF network element
  • the fourth receiving module is configured to receive a fourth request message sent by the AUSF network element, where the fourth request message includes the SUPI or the AuthID;
  • the second determination module is configured to determine the first authentication instance by using the SUPI or the AuthID, and calculate the key Kseaf by using the key Kausf and the service network name in the authentication vector; and use the SUPI to identify A second authentication instance, the second authentication instance is created in the security anchor function SEAF functional area, the second authentication instance is created for this UE authentication process, and the second authentication instance contains the key Kseaf;
  • the fourth sending module is configured to send the result of whether the key Kseaf is successfully generated to the AUSF network element.
  • a fifth receiving module and a first searching module are also included;
  • the fifth receiving module is configured to receive a fifth request message sent by a SEAF network element, where the fifth request message includes the SUPI and the anti-dimensionality reduction attack ABBA;
  • the first search module is configured to use the SUPI to find the second authentication instance, and use the key Kseaf, the SUPI and the ABBA to calculate a key Kamf.
  • an identification module is also included;
  • the identification module is configured to use the SUPI to identify a third authentication instance, the third authentication instance is created in the access and mobility management function AMF functional area, and the third authentication instance is created for this UE authentication process , the third authentication instance includes the key Kamf.
  • a fifth sending module is also included.
  • the fifth sending module is used to send the result of whether the key Kamf is successfully generated to the SEAF network element.
  • a generating module is also included;
  • the generating module is used to generate an AuthID for this UE authentication process.
  • the second request message further includes AuthID
  • the AuthID is a unique identifier generated by the UDM network element for this UE authentication process.
  • a sixth receiving module, a second searching module and a sixth sending module are also included;
  • the sixth receiving module is configured to receive a sixth request message sent by an AMF network element, the sixth request message includes the SUPI, and the sixth request message is used to request establishment of a security context;
  • the second search module is configured to use the SUPI to search for the third authentication instance in the AMF functional area, and use the key Kamf to establish a first non-access stratum NAS security context, in the first NAS security context Contains key KNASenc and key KNASint;
  • the sixth sending module is configured to send the SUPI, the key KNASenc and the key KNASint to a communication cryptographic system.
  • the sixth request message further includes a 5G key set identifier ngKSI; the ngKSI is used to identify the first NAS security context.
  • the SUPI, the ngKSI, the key KNASenc, and the key KNASint are used for the communication cryptosystem to establish a second NAS security context
  • the second NAS security context includes the The SUPI, the ngKSI, the key KNASenc and the key KNASint.
  • the SUPI, the key KNASenc, and the key KNASint are used for the communication cryptographic system to establish a second NAS security context
  • the second NAS security context includes the SUPI, the The key KNASenc and the key KNASint.
  • a seventh receiving module and a seventh sending module are also included;
  • the seventh receiving module is configured to receive the result of establishing the second NAS security context sent by the communication encryption system
  • the seventh sending module is configured to send the result of establishing the second NAS security context to the AMF network element.
  • the embodiments of the present disclosure further provide a processor-readable storage medium, the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the above-mentioned first aspect. Steps of the described authentication and security method.
  • the embodiments of the present disclosure further provide a computer-readable storage medium, the computer-readable storage medium stores a computer program, and the computer program is used to make the computer perform the authentication and authentication described in the first aspect. Steps of the security method.
  • the embodiments of the present disclosure further provide a communication device-readable storage medium, where the communication device-readable storage medium stores a computer program, and the computer program is used to enable the communication device to perform the above-mentioned first aspect. steps in the authentication and security method.
  • the embodiments of the present disclosure further provide a chip product-readable storage medium, the chip product-readable storage medium stores a computer program, and the computer program is used to make the chip product perform the above-mentioned first aspect. steps in the authentication and security method.
  • the authentication and security method, device, and storage medium provided by the embodiments of the present disclosure concentrate the security capabilities of the 5G core network in a limited computing system by separating the security functions of the core network system, and the network elements that require security services pass through the interface of the security system Invoking relevant safety functions, thus greatly reducing the number of software and hardware systems that need to pass safety level certification.
  • FIG. 1 is a schematic diagram of a core network high security system architecture provided by an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of an authentication and security method provided by an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of signaling interaction of a UE authentication process provided by an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of signaling interaction of a NAS security process provided by an embodiment of the present disclosure
  • FIG. 5 is a schematic structural diagram of a network device provided by an embodiment of the present disclosure.
  • Fig. 6 is a schematic structural diagram of an authentication and security device provided by an embodiment of the present disclosure.
  • FIG. 1 is a schematic diagram of the core network high security system architecture provided by the embodiment of the present disclosure.
  • the embodiment of the present disclosure provides a communication equipment system (a high-security encryption system), including an authentication encryption system and a communication encryption system.
  • the authentication cryptosystem sends SUPI, the key KNASenc and the key KNASint to the communication cryptosystem.
  • the communication cryptosystem performs NAS security process according to SUPI, key KNASenc and key KNASint.
  • the authentication cryptosystem is a network element in a high-security cryptosystem, and is used for operations related to cryptographic operations during user authentication.
  • Operations related to cryptographic operations specifically include: storing the authentication key of the subscriber, performing related cryptographic operations, storing the key and related data generated during the authentication process, and providing the key and related parameters generated during the authentication process to other ciphers computing device.
  • Other cryptographic computing devices include communication cryptosystems.
  • the communication cryptographic system is also a network element in a high-security cryptographic system, which is used to achieve data transmission security, for example, to store keys used to achieve data communication security, and to perform related cryptographic operations to achieve the confidentiality and integrity of data communication Protect.
  • the authentication encryption system and the communication encryption system are newly added network elements, and these two newly added network elements are high security level network elements, which are used to transfer the capabilities related to cryptographic operations from the 5G core network elements Separation from the core network, thereby avoiding turning the entire core network into a high-level security network, thus reducing the complexity and cost of the entire system.
  • the authentication password system consists of the following functional areas:
  • Unified Data Management (Unified Data Management, UDM) functional area UDM network elements in the 5G core network can access the functions and data in the UDM functional area of the authentication cryptographic system through the interface of the authentication cryptographic system, but cannot access the functions and data in other functional areas. functions and data.
  • the UDM functional area can write the security information required by the authentication server function (Authentication Server Function, AUSF) network element in the terminal/user equipment (User Equipment, UE) authentication process into the AUSF functional area.
  • AUSF Authentication Server Function
  • UE User Equipment
  • AUSF functional area AUSF network elements in the 5G core network can access the functions and data in the AUSF functional area in the authentication cryptography system through the interface of the authentication cryptography system, but cannot access the functions and data in other functional areas.
  • the AUSF functional area can write the security information required by the security anchor function (SEcurity Anchor Function, SEAF) network element in the UE authentication process into the SEAF functional area.
  • SEAF Security Anchor Function
  • SEAF functional area SEAF network elements in the 5G core network can access the functions and data in the SEAF functional area of the authentication cryptographic system through the interface of the authentication cryptographic system, but cannot access the functions and data in other functional areas.
  • the SEAF functional area can write the security information required by the access and mobility management function (Access and Mobility Management Function, AMF) network element in the UE authentication process into the AMF functional area.
  • AMF Access and Mobility Management Function
  • AMF network elements in the 5G core network can access the functions and data in the AMF functional area in the authentication cryptosystem through the interface of the authentication cryptographic system, but cannot access the functions and data in other functional areas.
  • the AMF functional area can provide security information for realizing UE data communication security to the communication cryptographic system.
  • Fig. 2 is a schematic flow diagram of the authentication and security method provided by the embodiment of the present disclosure.
  • the embodiment of the disclosure provides an authentication and security method, the execution subject of which may be an authentication cryptographic system, and the method includes:
  • Step 201 receiving the first request message sent by the UDM network element, the first request message includes the user concealed identifier (Subscription Concealed Identifier, SUCI) of the target UE, and the first request message is used to request the authentication cryptographic system for the SUCI to decrypt;
  • the user concealed identifier Subscribescription Concealed Identifier, SUCI
  • Step 202 decrypt the SUCI to obtain a permanent user identification (Subscription Permanent Identifier, SUPI);
  • Step 203 sending the SUPI to the UDM network element
  • Step 204 receive the second request message sent by the UDM network element, the second request message includes the SUPI and the service network name (serving network name, SN name), the second request message is the UDM network element according to the SUPI Sent after checking the subscription information of the target UE;
  • Step 205 Determine the authentication root key of the target UE according to the SUPI, generate an authentication vector according to the authentication root key and the service network name, and use the unique identifier AuthID to identify the authentication vector, the current UE authentication process, and the first An authentication instance, the first authentication instance is created in the authentication server function AUSF functional area, the first authentication instance is created for this UE authentication process, and the first authentication instance includes the authentication vector;
  • Step 206 sending the part of the authentication vector that needs to be provided to the target UE to the UDM network element;
  • Step 207 receiving a third request message sent by the AUSF network element, the third request message includes an authentication response (RESponse, RES*) and the AuthID;
  • Step 208 Authenticate the target UE according to the RES* and the AuthID contained in the third request message.
  • the target UE When the target UE is authenticated, receive a fourth request message sent by the AUSF network element, where the fourth request message includes the SUPI or the AuthID;
  • the target UE When the target UE passes the authentication, receive the fifth request message sent by the SEAF network element, the fifth request message includes the SUPI and anti-dimension reduction attacks (Anti-Bidding down Between Architectures, ABBA);
  • the SUPI is used to identify the third authentication instance.
  • the third authentication instance is created in the access and mobility management function AMF functional area.
  • the third authentication instance is created for this UE authentication process.
  • the third authentication instance includes The key Kamf.
  • the second request message further includes AuthID, which is a unique identifier generated by the UDM network element for this UE authentication process.
  • the sixth request message includes the SUPI, and the sixth request message is used to request the establishment of a security context
  • Non-Access Stratum Non-Access Stratum, NAS
  • KNASint Key KNASint
  • the SUPI, the key KNASenc and the key KNASint are sent to the communication cryptosystem.
  • the SUPI, the key KNASenc, and the key KNASint are used for the communication cryptographic system to establish a second NAS security context, and the second NAS security context includes the SUPI, the key KNASenc, and the encryption key. Key KNASint.
  • the sixth request message further includes a 5G key set identifier ngKSI; the ngKSI is used to identify the first NAS security context.
  • the SUPI, the ngKSI, the key KNASenc, and the key KNASint are used for the communication cryptosystem to establish a second NAS security context
  • the second NAS security context includes the The SUPI, the ngKSI, the key KNASenc and the key KNASint.
  • FIG. 3 is a schematic diagram of signaling interaction of the UE authentication process provided by the embodiment of the present disclosure.
  • the UE authentication process provided by the embodiment of the present disclosure includes the following steps:
  • the UE sends a registration request to the SEAF network element, and the request contains the UE's SUCI or 5G Globally Unique Temporary UE Identity (GUTI).
  • GUI Globally Unique Temporary UE Identity
  • the SEAF network element sends a UE authentication request to the AUSF network element, and the request includes the SUCI or SUPI of the UE and the serving network name (serving network name, SN name).
  • the AUSF network element sends a UE authentication request to the UDM network element, and the request includes the SUCI or SUPI of the UE, and the serving network name.
  • the UDM network element sends a SUCI decryption request (first request) to the authentication cryptographic system, and the request includes the SUCI of the UE.
  • the authentication cryptosystem decrypts the UE's SUCI to obtain the UE's SUPI.
  • the authentication password system returns the UE's SUPI to the UDM network element.
  • the UDM network element uses the SUPI of the UE to check the subscription information of the UE. If the UE is allowed to continue to authenticate, the UDM network element sends a request (second request) for generating the UE authentication vector to the authentication cryptographic system, and the request includes SUPI and serving network name.
  • the UDM network element may provide a unique identifier AuthID (Authentication ID) for this UE authentication process.
  • AuthID Authentication ID
  • the authentication password system may also provide a unique identifier AuthID for this UE authentication process.
  • the request should also include the AuthID.
  • the UDM network element and the AUSF network element use AuthID to interact with the authentication cryptosystem, so that the security capabilities distributed in different entities work as a whole.
  • the authentication cryptosystem stores the generated authentication vector, which uses the AuthID as the identifier.
  • the authentication cryptographic system determines the authentication root key of the UE according to the SUPI of the UE.
  • the authentication cryptographic system generates an authentication vector for authenticating the UE by using information such as the authentication root key of the UE and the serving network name.
  • the format of the 5G authentication vector is: (RAND, AUTN, XRES*, key Kausf).
  • RAND Random challenge
  • AUTN AUthentication TokeN
  • XRES* eXpected RESponse
  • the key Kausf is a key.
  • the authentication cryptosystem if the AuthID is provided by the authentication cryptosystem, the authentication cryptosystem generates an AuthID, otherwise, the UDM network element provides the AuthID.
  • the authentication cryptographic system uses the AuthID to identify the generated authentication vector and the current UE authentication process.
  • the authentication cryptographic system creates an authentication instance (the first authentication instance) in the AUSF functional area for the UE authentication process by using the UE's SUPI as the identifier, and the authentication instance includes the UE authentication vector using the AuthID as the identifier.
  • the authentication cryptographic system only returns the part of the authentication vector that needs to be provided to the UE to the UDM network element, that is, (RAND, AUTN). If the AuthID is provided by the authentication password system, the AuthID should also be returned to the UDM network element.
  • the UDM network element returns (RAND, AUTN) and AuthID to the AUSF network element.
  • the UDM network element When the AUSF network element provides the UE's SUCI to the UDM network element, the UDM network element also needs to return the SUPI.
  • the AUSF network element sends (RAND, AUTN) to the SEAF network element.
  • the SEAF network element generates the 5G key set identifier (Key Set Identifier in 5G, ngKSI), and then sends (RAND, AUTN), ngKSI and ABBA to the UE.
  • 5G key set identifier Key Set Identifier in 5G, ngKSI
  • the UE verifies the AUTN, confirms that the authentication vector is correct, and then uses the UE's authentication root key and RAND to calculate RES*.
  • the UE sends the RES* to the SEAF network element.
  • the SEAF network element sends the RES* to the AUSF network element.
  • the AUSF network element sends a UE authentication request (third request) to the authentication cryptographic system, the request includes AuthID and RES*, and may also include SUPI of the UE.
  • the authentication password system uses SUPI and AuthID to find the authentication vector in the AUSF functional area, and then verifies whether RES* is the same as XRES* in the authentication vector.
  • the authentication cryptographic system identifies in the UE authentication instance that the UE has passed the authentication, and stores the key Kausf.
  • the authentication password system returns the authentication result (success/failure) to the AUSF network element.
  • the AUSF network element requests the authentication cryptographic system to calculate the key Kseaf.
  • the request (the fourth request) includes: SUPI or AuthID, and the request may also include: serving network name.
  • the authentication cryptographic system uses SUPI to determine the UE's authentication instance, and then uses the key Kausf and SN to calculate the key Kseaf.
  • the authentication cryptographic system uses the UE's SUPI as an identifier to create an authentication instance (second authentication instance) in the SEAF functional area for this UE authentication process, and the authentication instance contains information: the key Kseaf.
  • the authentication cryptographic system returns the result (success/failure) of whether the key is successfully generated to the AUSF network element.
  • the AUSF network element returns the authentication result to the SEAF network element.
  • the AUSF network element should also send the SUPI to the SEAF network element.
  • the SEAF network element requests the authentication and authorization system to generate a key Kamf, and the request (fifth request) includes: SUPI and ABBA.
  • the authentication and authorization system uses SUPI to find the UE authentication instance in the SEAF functional area, and then uses the key Kseaf and related parameters to calculate the key Kamf.
  • the authentication cryptographic system uses the UE's SUPI as an identifier to create an authentication instance (the third authentication instance) in the AMF functional area for the UE authentication process.
  • the authentication instance contains information: the key Kamf.
  • the authentication cryptographic system returns the result (success/failure) of whether the key is successfully generated to the SEAF network element.
  • the SEAF network element returns the authentication result to the AMF network element.
  • the SEAF network element provides the ngKSI and SUPI to the AMF network element.
  • FIG. 4 is a schematic diagram of signaling interaction of the NAS security process provided by the embodiment of the present disclosure.
  • the NAS security process provided by the embodiment of the present disclosure includes the following steps:
  • the AMF network element When the AMF network element has not established the NAS security context of the UE, the AMF network element sends a security context establishment request (sixth request) to the authentication and encryption system.
  • the request includes: SUPI, and the request can also include: ngKSI .
  • the authentication cryptographic system uses SUPI to find the UE authentication security context in the AMF functional area, and then uses Kamf to establish the UE NAS security context (the first NAS security context).
  • the NAS security context has the keys to realize NAS security: KNASenc and KNASint.
  • the above-mentioned security context request also includes ngKSI
  • use Kamf to establish UE NAS security context with ngKSI in UE security context
  • the NAS security context has keys to realize NAS security: KNASenc and KNASint.
  • the authentication cryptosystem sends the key material used to realize NAS security to the communication cryptosystem through a message, which includes: SUPI, key KNASenc, and key KNASint.
  • the message may also include: ngKSI.
  • the communication encryption system uses SUPI as an identifier to establish a NAS security context (second NAS security context) of the UE, and the NAS security context includes: SUPI, a key KNASenc, and a key KNASint.
  • the communication encryption system uses SUPI and ngKSI as identifiers to establish the NAS security context of the UE, and the NAS security context may also include: ngKSI.
  • the communication encryption system will return the result (Success/Failure) of establishing the UE NAS security context to the authentication encryption system.
  • the authentication cryptosystem returns the result (Success/Failure) of establishing the NAS security context by the communication cryptosystem to the AMF network element.
  • the AMF network element When the AMF network element needs to send a NAS message to the UE, the AMF network element generates a NAS plaintext message.
  • the AMF network element sends a NAS message cryptographic operation request to the communication cryptographic system.
  • the request includes: SUPI, message plaintext, and parameters required for secure calculation, such as algorithm identification, COUNT, BEARER, DIRECTION, and LENGTH.
  • the NAS message cryptographic operation request may also include ngKSI.
  • the communication encryption system uses SUPI to obtain the security context of the UE, calculates the NAS ciphertext, and then returns the NAS ciphertext to the AMF network element.
  • the AMF network element sends a NAS message to the UE.
  • the UE sends a NAS message to the AMF network element.
  • the AMF network element sends a NAS message cryptographic operation request to the communication cryptographic system.
  • the request includes: SUPI, message ciphertext, and parameters required for secure calculation, such as algorithm identification, COUNT, BEARER, DIRECTION, and LENGTH.
  • the NAS message cryptographic operation request may also include ngKSI.
  • the communication encryption system decrypts and verifies the NAS ciphertext, and then returns the message plaintext to the AMF network element.
  • the authentication and security method provided by the embodiments of the present disclosure concentrates the security capabilities of the 5G core network in a limited computing system by separating the security functions of the core network system, and the network elements that need security services call related security functions through the interface of the security system , thereby greatly reducing the number of software and hardware systems that need to pass security level certification.
  • Fig. 5 is a schematic structural diagram of a network device provided by an embodiment of the present disclosure. As shown in Fig. 5, the network device includes a memory 520, a transceiver 500, and a processor 510, wherein:
  • the memory 520 is used to store computer programs; the transceiver 500 is used to send and receive data under the control of the processor 510; the processor 510 is used to read the computer programs in the memory 520 and perform the following operations:
  • the first request message includes the hidden user identifier SUCI of the target terminal UE, and the first request message is used to request the authentication and cryptographic system to perform an operation on the SUCI decryption;
  • the second request message includes the SUPI and the service network name, and the second request message is that the UDM network element checks the target UE according to the SUPI sent after the signing information of
  • the first authentication instance the first authentication instance is created in the authentication server function AUSF functional area, the first authentication instance is created for this UE authentication process, and the authentication vector is included in the first authentication instance ;
  • the transceiver 500 is configured to receive and send data under the control of the processor 510 .
  • the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by the processor 510 and various circuits of the memory represented by the memory 520 are linked together.
  • the bus architecture can also link together various other circuits such as peripherals, voltage regulators, and power management circuits, etc., which are well known in the art and therefore will not be further described herein.
  • the bus interface provides the interface.
  • the transceiver 500 may be a plurality of elements, including a transmitter and a receiver, providing a unit for communicating with various other devices over transmission media, including wireless channels, wired channels, optical cables, and other transmission media.
  • the processor 510 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 510 when performing operations.
  • the processor 510 can be a central processing unit (CPU), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field-Programmable Gate Array, FPGA) or a complex programmable logic device (Complex Programmable Logic Device, CPLD), the processor can also adopt a multi-core architecture.
  • CPU central processing unit
  • ASIC Application Specific Integrated Circuit
  • FPGA field programmable gate array
  • CPLD Complex Programmable Logic Device
  • the target UE When the target UE passes the authentication, receive a fourth request message sent by the AUSF network element, where the fourth request message includes the SUPI or the AuthID;
  • the second authentication instance is created in the security anchor function SEAF functional area, the second authentication instance is created for this UE authentication process, and the second authentication instance includes the key Kseaf;
  • the target UE When the target UE passes the authentication, receive a fifth request message sent by the SEAF network element, where the fifth request message includes the SUPI and the anti-dimensionality reduction attack ABBA;
  • the third authentication instance is created in the access and mobility management function AMF functional area, the third authentication instance is created for this UE authentication process, the third authentication instance
  • the authentication instance includes the key Kamf.
  • the second request message further includes AuthID
  • the AuthID is a unique identifier generated by the UDM network element for this UE authentication process.
  • the first NAS security context includes the key KNASenc and the key KNASint ;
  • the sixth request message further includes a 5G key set identifier ngKSI; the ngKSI is used to identify the first NAS security context.
  • the SUPI, the ngKSI, the key KNASenc, and the key KNASint are used for the communication cryptosystem to establish a second NAS security context
  • the second NAS security context includes the The SUPI, the ngKSI, the key KNASenc and the key KNASint.
  • the SUPI, the key KNASenc, and the key KNASint are used for the communication cryptographic system to establish a second NAS security context
  • the second NAS security context includes the SUPI, the The key KNASenc and the key KNASint.
  • the above-mentioned network equipment provided by the embodiments of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiment in which the execution subject is the authentication cryptographic system, and can achieve the same technical effect.
  • the same parts and beneficial effects of the method embodiments are described in detail.
  • Fig. 6 is a schematic structural diagram of an authentication and safety device provided by an embodiment of the present disclosure. As shown in Fig. 6, an embodiment of the present disclosure provides an authentication and safety device, including
  • the first receiving module 601 is configured to receive a first request message sent by a unified data management (UDM) network element, the first request message includes the user hidden identity SUCI of the target terminal UE, and the first request message is used to request the authentication
  • the cryptographic system decrypts the SUCI
  • the decryption module 602 is used to decrypt the SUCI to obtain the SUPI;
  • the first sending module 603 is configured to send the SUPI to the UDM network element
  • the second receiving module 604 is configured to receive a second request message sent by the UDM network element, the second request message includes the SUPI and the service network name, and the second request message is the UDM network element according to the It is sent after the SUPI checks the subscription information of the target UE;
  • the first determination module 605 is configured to determine the authentication root key of the target UE according to the SUPI, and generate an authentication vector according to the authentication root key and the service network name, and use a unique identifier AuthID to identify the authentication vector , this UE authentication process and a first authentication instance, the first authentication instance is created in the authentication server function AUSF functional area, the first authentication instance is created for this UE authentication process, the first authentication
  • the authentication vector is included in the example;
  • the second sending module 606 is configured to send the part of the authentication vector that needs to be provided to the target UE to the UDM network element;
  • the third receiving module 607 is configured to receive a third request message sent by an AUSF network element, where the third request message includes an authentication response RES* and the AuthID;
  • the authentication module 608 is configured to authenticate the target UE according to the RES* and the AuthID included in the third request message.
  • it also includes a third sending module, a fourth receiving module, a second determining module and a fourth sending module;
  • the third sending module is used to send the authentication result to the AUSF network element
  • the fourth receiving module is configured to receive a fourth request message sent by the AUSF network element, where the fourth request message includes the SUPI or the AuthID;
  • the second determination module is configured to determine the first authentication instance by using the SUPI or the AuthID, and calculate the key Kseaf by using the key Kausf and the service network name in the authentication vector; and use the SUPI to identify A second authentication instance, the second authentication instance is created in the security anchor function SEAF functional area, the second authentication instance is created for this UE authentication process, and the second authentication instance contains the key Kseaf;
  • the fourth sending module is configured to send the result of whether the key Kseaf is successfully generated to the AUSF network element.
  • a fifth receiving module and a first searching module are also included;
  • the fifth receiving module is configured to receive a fifth request message sent by a SEAF network element, where the fifth request message includes the SUPI and the anti-dimensionality reduction attack ABBA;
  • the first search module is configured to use the SUPI to find the second authentication instance, and use the key Kseaf, the SUPI and the ABBA to calculate a key Kamf.
  • an identification module is also included;
  • the identification module is configured to use the SUPI to identify a third authentication instance, the third authentication instance is created in the access and mobility management function AMF functional area, and the third authentication instance is created for this UE authentication process , the third authentication instance includes the key Kamf.
  • a fifth sending module is also included.
  • the fifth sending module is used to send the result of whether the key Kamf is successfully generated to the SEAF network element.
  • a generating module is also included;
  • the generating module is used to generate an AuthID for this UE authentication process.
  • the second request message further includes AuthID
  • the AuthID is a unique identifier generated by the UDM network element for this UE authentication process.
  • a sixth receiving module, a second searching module and a sixth sending module are also included;
  • the sixth receiving module is configured to receive a sixth request message sent by an AMF network element, the sixth request message includes the SUPI, and the sixth request message is used to request establishment of a security context;
  • the second search module is configured to use the SUPI to search for the third authentication instance in the AMF functional area, and use the key Kamf to establish a first non-access stratum NAS security context, in the first NAS security context Contains key KNASenc and key KNASint;
  • the sixth sending module is configured to send the SUPI, the key KNASenc and the key KNASint to a communication cryptographic system.
  • the sixth request message further includes a 5G key set identifier ngKSI; the ngKSI is used to identify the first NAS security context.
  • the SUPI, the ngKSI, the key KNASenc, and the key KNASint are used for the communication cryptosystem to establish a second NAS security context
  • the second NAS security context includes the The SUPI, the ngKSI, the key KNASenc and the key KNASint.
  • the SUPI, the key KNASenc, and the key KNASint are used for the communication cryptographic system to establish a second NAS security context
  • the second NAS security context includes the SUPI, the The key KNASenc and the key KNASint.
  • a seventh receiving module and a seventh sending module are also included;
  • the seventh receiving module is configured to receive the result of establishing the second NAS security context sent by the communication encryption system
  • the seventh sending module is configured to send the result of establishing the second NAS security context to the AMF network element.
  • the above-mentioned authentication and security device provided by the embodiment of the present disclosure can realize all the method steps implemented by the above-mentioned method embodiment in which the execution subject is the authentication and encryption system, and can achieve the same technical effect.
  • the same parts and beneficial effects as those in the method embodiment will be described in detail.
  • each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a processor-readable storage medium.
  • the technical solution of the present disclosure is essentially or part of the contribution to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (processor) execute all or part of the steps of the methods described in various embodiments of the present disclosure.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .
  • a computer-readable storage medium stores a computer program, and the computer program is used to make a computer execute the steps of the authentication and security method provided by the above method embodiments .
  • the above-mentioned computer-readable storage medium provided by the embodiments of the present disclosure can realize all the method steps realized by the above-mentioned method embodiments, and can achieve the same technical effect.
  • the same parts and beneficial effects are described in detail.
  • the computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), Optical memory (such as CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state hard disk (SSD)), etc.
  • magnetic storage such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.
  • Optical memory such as CD, DVD, BD, HVD, etc.
  • semiconductor memory such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state hard disk (SSD)
  • first and second in the embodiments of the present disclosure are used to distinguish similar objects, and are not used to describe a specific order or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the present disclosure are capable of practice in sequences other than those illustrated or described herein and that "first" and “second” distinguish objects. It is usually one category, and the number of objects is not limited. For example, there may be one or more first objects.
  • the applicable system may be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet Wireless business (general packet radio service, GPRS) system, long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD) system, Long term evolution advanced (LTE-A) system, universal mobile telecommunications system (UMTS), worldwide interoperability for microwave access (WiMAX) system, 5G new air interface (New Radio, NR) system, etc.
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • GPRS general packet Wireless business
  • long term evolution long term evolution
  • LTE long term evolution
  • LTE frequency division duplex frequency division duplex
  • FDD frequency division duplex
  • TDD time division duplex
  • LTE-A Long term evolution advanced
  • the terminal device involved in the embodiments of the present disclosure may be a device that provides voice and/or data connectivity to users, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem.
  • the name of the terminal equipment may be different.
  • the terminal equipment may be called User Equipment (User Equipment, UE).
  • the wireless terminal equipment can communicate with one or more core networks (Core Network, CN) via the radio access network (Radio Access Network, RAN), and the wireless terminal equipment can be a mobile terminal equipment, such as a mobile phone (or called a "cellular "telephones) and computers with mobile terminal equipment, such as portable, pocket, hand-held, computer built-in or vehicle-mounted mobile devices, which exchange language and/or data with the radio access network.
  • a mobile terminal equipment such as a mobile phone (or called a "cellular "telephones) and computers with mobile terminal equipment, such as portable, pocket, hand-held, computer built-in or vehicle-mounted mobile devices, which exchange language and/or data with the radio access network.
  • PCS Personal Communication Service
  • SIP Session Initiated Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • Wireless terminal equipment can also be called system, subscriber unit, subscriber station, mobile station, mobile station, remote station, access point , remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user agent (user agent), and user device (user device), which are not limited in the embodiments of the present disclosure.
  • the network device involved in the embodiments of the present disclosure may be a base station, and the base station may include multiple cells that provide services for terminals.
  • the base station can also be called an access point, or it can be a device in the access network that communicates with the wireless terminal device through one or more sectors on the air interface, or other names.
  • the network device can be used to interchange received over-the-air frames with Internet Protocol (IP) packets and act as a router between the wireless terminal device and the rest of the access network, which can include the Internet Protocol (IP) communication network.
  • IP Internet Protocol
  • Network devices may also coordinate attribute management for the air interface.
  • the network equipment involved in the embodiments of the present disclosure may be a network equipment (Base Transceiver Station, BTS) in Global System for Mobile communications (GSM) or Code Division Multiple Access (Code Division Multiple Access, CDMA) ), it can also be a network device (NodeB) in Wide-band Code Division Multiple Access (WCDMA), or it can be an evolved network device in a long term evolution (long term evolution, LTE) system (evolutional Node B, eNB or e-NodeB), 5G base station (gNB) in the 5G network architecture (next generation system), can also be a home evolved base station (Home evolved Node B, HeNB), relay node (relay node) , a home base station (femto), a pico base station (pico), etc., are not limited in this embodiment of the present disclosure.
  • a network device may include a centralized unit (centralized unit, CU) node and a distributed unit (distributed unit, DU) node,
  • MIMO transmission can be Single User MIMO (Single User MIMO, SU-MIMO) or Multi-User MIMO (Multiple User MIMO, MU-MIMO).
  • MIMO transmission can be 2D-MIMO, 3D-MIMO, FD-MIMO, or massive-MIMO, or diversity transmission, precoding transmission, or beamforming transmission, etc.
  • the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Accordingly, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) having computer-usable program code embodied therein.
  • processor-executable instructions may also be stored in a processor-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, such that the instructions stored in the processor-readable memory produce a manufacturing product, the instruction device realizes the functions specified in one or more procedures of the flow chart and/or one or more blocks of the block diagram.
  • processor-executable instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented
  • the executed instructions provide steps for implementing the functions specified in the procedure or procedures of the flowchart and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Des modes de réalisation de la présente divulgation concernent un procédé et un dispositif d'authentification et de sécurité, ainsi qu'un support de stockage. Le procédé consiste à : déterminer une clé racine d'authentification d'un UE selon un SUPI ; générer un vecteur d'authentification selon la clé racine d'authentification et un nom de réseau de service ; et utiliser un identifiant unique AuthID pour identifier le vecteur d'authentification, le processus d'authentification d'UE actuel et une première instance d'authentification. La première instance d'authentification est créée dans une zone de fonction de serveur d'authentification (AUSF), la première instance d'authentification est créée pour le processus d'authentification d'UE actuel, et la première instance d'authentification comprend le vecteur d'authentification. Selon le procédé et le dispositif d'authentification et de sécurité et le support de stockage fournis par les modes de réalisation de la présente divulgation, la fonction de sécurité du système de réseau central est séparée, la capacité de sécurité du réseau central 5G est concentrée dans un système informatique limité, et un élément de réseau ayant besoin d'un service de sécurité appelle la fonction de sécurité pertinente par le biais de l'interface du système de sécurité, ce qui permet de réduire considérablement le nombre de systèmes logiciels et matériels à soumettre à une authentification de niveau de sécurité.
PCT/CN2022/143302 2022-01-05 2022-12-29 Procédé et dispositif d'authentification et de sécurité, et support de stockage WO2023131044A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210006344.8A CN116419218A (zh) 2022-01-05 2022-01-05 认证与安全方法、装置及存储介质
CN202210006344.8 2022-01-05

Publications (1)

Publication Number Publication Date
WO2023131044A1 true WO2023131044A1 (fr) 2023-07-13

Family

ID=87050259

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/143302 WO2023131044A1 (fr) 2022-01-05 2022-12-29 Procédé et dispositif d'authentification et de sécurité, et support de stockage

Country Status (2)

Country Link
CN (1) CN116419218A (fr)
WO (1) WO2023131044A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020007461A1 (fr) * 2018-07-04 2020-01-09 Telefonaktiebolaget Lm Ericsson (Publ) Authentification et accord de clé entre un réseau et un équipement utilisateur
CN110933027A (zh) * 2019-10-23 2020-03-27 南京瑞思其智能科技有限公司 一种基于5g网络的照明系统aka认证方法
CN111147421A (zh) * 2018-11-02 2020-05-12 中兴通讯股份有限公司 一种基于通用引导架构gba的认证方法及相关设备
CN112672345A (zh) * 2019-09-30 2021-04-16 华为技术有限公司 通信认证方法和相关设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020007461A1 (fr) * 2018-07-04 2020-01-09 Telefonaktiebolaget Lm Ericsson (Publ) Authentification et accord de clé entre un réseau et un équipement utilisateur
CN111147421A (zh) * 2018-11-02 2020-05-12 中兴通讯股份有限公司 一种基于通用引导架构gba的认证方法及相关设备
CN112672345A (zh) * 2019-09-30 2021-04-16 华为技术有限公司 通信认证方法和相关设备
CN110933027A (zh) * 2019-10-23 2020-03-27 南京瑞思其智能科技有限公司 一种基于5g网络的照明系统aka认证方法

Also Published As

Publication number Publication date
CN116419218A (zh) 2023-07-11

Similar Documents

Publication Publication Date Title
US11856402B2 (en) Identity-based message integrity protection and verification for wireless communication
US11297492B2 (en) Subscriber identity privacy protection and network key management
EP3820198B1 (fr) Système, dispositif et procédé de protection de sécurité
KR101287309B1 (ko) 홈 노드-ｂ 장치 및 보안 프로토콜
US20210112406A1 (en) Communication method and communications apparatus
TWI332345B (en) Security considerations for the lte of umts
CN110891271B (zh) 一种鉴权方法及装置
AU2019206665A1 (en) Method and apparatus for multiple registrations
US11082843B2 (en) Communication method and communications apparatus
US20190253403A1 (en) Network Authentication Triggering Method and Related Device
WO2020248624A1 (fr) Procédé de communication, dispositif de réseau, équipement utilisateur et dispositif de réseau d'accès
CN108012264A (zh) 用于802.1x载体热点和Wi-Fi呼叫认证的基于经加密的IMSI的方案
JP2012217207A (ja) 鍵マテリアルの交換
US11751160B2 (en) Method and apparatus for mobility registration
Ouaissa et al. An improved privacy authentication protocol for 5G mobile networks
US20190149326A1 (en) Key obtaining method and apparatus
WO2020063540A1 (fr) Procédé de communication sécurisée et procédé et appareil pour déterminer des informations de chiffrement
WO2022151917A1 (fr) Procédé et appareil de traitement de message, terminal et dispositif côté réseau
US20240089728A1 (en) Communication method and apparatus
WO2022134089A1 (fr) Procédé et appareil de génération de contexte de sécurite, et support de stockage lisible par ordinateur
EP4184860A1 (fr) Procédé de gestion de clés et appareil de communication
WO2023071836A1 (fr) Procédé et appareil de communication
WO2022237421A1 (fr) Procédé et appareil de transmission de clé pour un groupe temporaire, terminal et dispositif côté réseau
WO2023131044A1 (fr) Procédé et dispositif d'authentification et de sécurité, et support de stockage
WO2022048265A1 (fr) Procédé de détermination de clé de couche application, terminal, dispositif côté réseau et appareil

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22918485

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE