WO2011038620A1

WO2011038620A1 - Access authentication method, apparatus and system in mobile communication network

Info

Publication number: WO2011038620A1
Application number: PCT/CN2010/076174
Authority: WO
Inventors: 张世伟; 符涛; 吴强
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-09-29
Filing date: 2010-08-20
Publication date: 2011-04-07
Also published as: CN102036242B; CN102036242A

Abstract

An access authentication method in a mobile communication network is provided by the present invention. The method comprises an access authentication process for a user terminal performed by an identification location register in the mobile communication network. The present invention also provides a corresponding system. The system comprises a user terminal, an access server and an identification location register. The present invention also provides a corresponding apparatus. The present invention effectively avoids man-in-the-middle attack caused by passing through unreliable networks, ensures the access point to be a real access point of the user by binding the route information of the access point with the authentication result.

Description

181001752 Method, device and system for access authentication in mobile communication network

Technical field

The present invention relates to the field of mobile communications, and in particular, to a method, device and system for access authentication in a mobile communication network. Background technique

Access authentication is a basic requirement for the safe and normal operation of a communication network. With access authentication, the network can correctly identify the user's identity and give the legitimate user the contracted service capability, prevent other users from stealing the service, and ensure the correctness of the charging. .

Currently, the Authentication and Key Agreement (AKA) authentication method adopted by Wideband Code Division Multiple Access (WCDMA) is one of the more complete authentication methods. WCDMA authentication uses a shared key. In this manner, a shared key K exists between the Universal Subscriber Identity Module (USIM) card and the Home Location Register (HLR) of the user terminal, and the random number RAND is generated by the HLR, and then A proprietary algorithm that generates an authentication token (AUTN), an expected response value (XRES), an encryption key (CK), and an integrity protection key (IK). These four parameters, along with the random number RAND, generate an authentication five-element. The group vector, then the HLR passes the XRES, AUTN, RAND to the Serving GPRS Support Node (SGSN), the SGSN saves the XRES, and passes the random numbers RAND and AUTN to the User Equipment (UE), and the UE utilizes RAND and shared key K calculate AUTN, and then compare the calculated AUTN with the transmitted AUTN, such as If they are consistent, it indicates that the terminal is accessing a legitimate network. If the inconsistency is a fake network.

After the UE determines that the accessed network is a legitimate network, it will calculate an authentication response (RES) according to the random number RAND and the key K, and then the UE returns the RES to the SGSN, and the SGSN determines whether the RES sent by the UE and the XRES sent by the HLR are Consistently, if the consistent description is that the terminal UE is a legitimate user, if it is inconsistent, it is considered that the UE is an illegal user. It can be seen that the AKA algorithm adopts two-way authentication, which solves the problems of access authentication, encryption and integrity verification, and becomes a classic authentication method and is widely used by 3G networks. In the AKA authentication method of WCDMA, the authentication parameters are transmitted through the plaintext between the HLR and the SGSN. This method is established in the case where each SGSN node is trusted and the message path of the SGSN to the HLR is strictly reliable. However, if this authentication is used in an IP-based network, since there may be multiple paths between the two networks of the IP network, if one intermediate node of one path is not secure enough, such as an intermediate forwarding node in the path Passing the authentication parameters may form a man-in-the-middle attack, as shown in Figure 1.

In FIG. 1, if an IP network transmission is used between the SGSN and the HLR, in the process of transmission, if one of the intermediate nodes, such as a router (MN), is a malicious node, the intermediate node MN intercepts the authentication message sent by the SGSN to the HLR. The SGSN routing information in the UE registration message sent by the SGSN to the HLR is changed to the routing of the malicious node SGSN-mal, so that after the intermediate node MN is modified, although the user registration can still succeed, the user access location recorded by the HLR is SGSN-mal instead of SGSN, so if other users send data to this UE, the access server of other users needs to query the HLR for the current location of the UE, but the routing information of the UE access point returned by the HLR is the malicious node SGSN-mal. The information, such that the packet that should have been sent to the SGSN for forwarding to the UE, is sent to the SGSN-Mal, resulting in a typical man-in-the-middle attack.

It can be seen from the above that under the WCDMA authentication mechanism, since the ASG authentication does not protect the access point SGSN routing information, the HLR and the terminal and even the ASN do not know whether there is a man-in-the-middle attack, and therefore cannot be reasonably prevented. Summary of the invention

The technical problem to be solved by the present invention is to provide a method and system for access authentication in a mobile communication network, which can prevent man-in-the-middle attacks, and is particularly suitable for an IP-based mobile communication network.

In order to solve the above problems, the present invention provides a method for access authentication in a mobile communication network, the method comprising:

When the user terminal needs to perform authentication, a random number RA DUE is generated, and a route identifier (RID) of the access server in the network and a random number RA DJLR generated by the ILR are obtained;

The user terminal uses the pre-shared key K1 to pass the second message integrity check algorithm to the second The authentication parameter calculates the authentication result RES ₂ IL _R , and sends the authentication result RES ₂ IL _R to the access server;

After receiving the authentication result RES ₂ IL _R , the access server generates a random number RA DASN, and sends the authentication result RES _2ILR and the random number RANDASN to the ILR; and the ILR utilizes the The pre-shared key K1 is calculated by the second message integrity check algorithm for the second authentication parameter to obtain the authentication result XRES ₂ IL _R , and the authentication result XRES ₂ IL _{R is} compared with the received authentication result RES ₂ IL _R If the authentication result XRES ₂ IL _{R is} consistent with the authentication result ES ₂ JL _R , the access authentication passes; if not, the access authentication fails;

The pre-shared key K1 is a pre-shared key of the user terminal and the ILR; the second authentication parameter includes the random number RANDUE, the random number RANDIL _R , and a user identity identifier (SID) And the RID.

After the access server generates the random number RAND _ASN , the step of sending the authentication result 1 £81 ₁ and the random number RA D _ASN to the ILR further includes:

The access server encrypts the authentication result RES _] ^ random number RAND _ASN with the public key of the ILR by using an asymmetric encryption algorithm to generate encrypted data E2; the access server sends the encrypted data E2 to the ILR;

Before the ILR calculates the authentication result XRES ₂ ILR, the method further includes:

The ILR decrypts the encrypted data E2 with the private key of the ILR, and obtains the authentication result RES _2ILR and the random number RA D _ASN .

The step of the access server sending the encrypted data E2 to the ILR includes: the access server digitally signing the encrypted data E2 with the private key of the access server, SIGN _ASN ; Transmitting the encrypted data E2 and the digital signature SIGN _ASN to the ILR;

Before the ILR decrypts the encrypted data E2, the method further includes:

The ILR checks the correctness of the digital signature SIGN _ASN with the public key K _{ASN of} the access server, and if correct, proceeds to the step of the ILR decrypting the encrypted data E2 with the private key of the ILR.

Before the access authentication process of the user terminal to the user terminal, the method further includes: The authentication of the ILR by the user terminal, and the authentication of the ILR by the user terminal includes:

When the user terminal needs to access the authentication, the SID and the random number RA DUE are sent to the access server;

The access server sends the received SID and random number RA DUE to the ILR along with the public key K _{ASN of} the access server and the RID;

The ILR uses the pre-shared key K1 to calculate the authentication result RES _2UE for the first authentication parameter by using the first message integrity check algorithm, and uses the above! After the first encryption parameter is encrypted by the asymmetric encryption algorithm, the encrypted data E1 is sent to the access server; wherein the first authentication parameter includes the random number RA DUE and the random number

The first encryption parameter includes the authentication result RES _2UE and a random number RA DILR;

After the access server decrypts the encrypted data E1 by using the private key K _A of the access server, the obtained authentication result RES _2UE and the random number RAKDJLR are sent to the user terminal;

After receiving the authentication result RES _2UE and the random number RA DILR, the user terminal uses the pre-shared key K1 to calculate the authentication result XRES _2UE and the first authentication parameter by using the first message integrity check algorithm. The authentication result RES _2UE is compared. If the authentication is successful, the user terminal passes the authentication of the authentication server. If not, the user terminal fails to authenticate the authentication server.

After the authentication of the user terminal is performed by the ILR, the method further includes: the access server, the authentication of the ILR, and the authentication of the ILR by the access server includes:

Using the authentication key KM shared by the ILR and the access server, the ILR calculates an authentication result RES _2ASN for the third authentication parameter by using a third message integrity check algorithm, and uses the public key of the access server. The K _ASI ^† second encryption parameter is encrypted to obtain the encrypted data E3, and the encrypted data E3 is sent to the access server; wherein the third authentication parameter includes a network of RAND _ASN , RANDUE, RA Dn^RID, ILR An identifier (IID) and a SID; the second encryption parameter includes the authentication result RES _2ASN ;

After receiving the encrypted data E3, the access server decrypts the encrypted data E3 with the private key K _{A of} the access server, extracts the RES _2ASN , and passes the third message with the authentication key KAJ. The integrity check algorithm calculates the authentication result RES _2ASN for the third authentication parameter; The access server compares the XRES _2ASN and the RES _2ASN . If they are consistent, the access server passes the authentication of the ILR; if not, the access server fails to authenticate the ILR. .

The first encryption parameter further includes a public key KJLR and an IID of the ILR;

The second encryption parameter further comprises data encryption keys K _ENC access or access data integrity check key _¾Ν Τ;

The access data encryption key is used by the authentication server to utilize the shared encrypted root key K2 between the user terminal and the authentication server, and the RA D _UE , RANDILR, SID, and RID. Calculated by using an encryption key generation algorithm as a parameter; the access data integrity verification key KJNT is an integrity key K3 shared by the authentication server between the user terminal and the authentication server, In the stated

And RID is a parameter, which is calculated by using an integrity check key generation algorithm.

The step of the ILR transmitting the encrypted data E3 to the access server includes: the ILR generating a digital signature SIGNIL _{R of} the encrypted data E3 with a private key of the ILR, and the digital signature 81& ₁₁ The encrypted data E3 is sent to the access server together; before the access server decrypts the encrypted data E3, the method further includes: the access server first verifying the correctness of the digital signature SIGNILR by using the KIL _R If yes, the step of decrypting the encrypted data E3 by the access server using the private key of the access server is continued.

The access server is a serving GPRS support node, a gateway GPRS support node, a packet data support node, a service gateway packet data gateway, or an external proxy.

The mobile communication network is an IP-based mobile communication network.

The ILR is a home location register, a home subscriber server, an authorization/authentication/accounting server, or an authentication server.

In order to solve the above problems, the present invention also provides a system for access authentication in a mobile communication network, including a user terminal, an access server, and an identity location register (ILR), where: The user terminal is configured to: generate the random number RA DUE when authentication is required, obtain a route identifier (RID) of the access server in the network, and a random number RANDIL _R generated by the ILR, and use the pre- The shared key K1 is obtained by the second message integrity check algorithm, and the authentication result RES _{2ILR is} calculated, and the authentication result RES ₂ IL _{R is} sent to the access server;

The access server is configured to: after receiving the authentication result RES _2ILR , generate a random number RA D _ASN , and send the authentication result RES ₂ IL _R and the random number RA D _ASN to the ILR;

The ILR is configured to: after receiving the authentication result RES _2ILR sent by the access server and the random number RAND _ASN , using the pre-shared key K1, by using a second message integrity check algorithm The second authentication parameter calculates an authentication result XRES ₂ IL _R and compares the authentication result XRES ₂ IL _R with the received authentication result RES ₂ IL _R if the authentication result XRES ₂ IL _R and the authentication result RES ₂ IL _{R is} the same as the access authentication; if not, the access authentication fails;

The pre-shared key K1 is a pre-shared key of the user terminal and the ILR; the second authentication parameter includes the random number RANDUE, the random number RANDue, and a user identity identifier (SID) And the RID.

The user terminal is further configured to: send the SID and the random number RA DUE to the access server when access authentication is required; and receive a random number RES 2 _UE and random number sent by the access server After the RANDue, the first shared authentication key is used to calculate the authentication result XRES _2UE by using the first message integrity check algorithm, and then compare with the authentication result RES _2UE . The authentication of the authentication server passes, and if not, the authentication of the authentication server by the user terminal fails;

The access server is further configured to: send the received SID and the random number RA DUE, and send the public key KASN of the access server and the RID to the ILR;

The ILR is further configured to: use the pre-shared key K1 to calculate an authentication result RES _2UE for the first authentication parameter by using a first message integrity check algorithm, and use the above! After the first encryption parameter is encrypted by the asymmetric encryption algorithm, the encrypted data E1 is sent to the access server; wherein the first authentication parameter includes the authentication result RA DUE and the random number RA Due; the first The encryption parameter includes the authentication result RES _2UE and a random number RA DILR;

The access server is further configured to: after decrypting the encrypted data E1 by using the private key of the access server, send the obtained authentication result RES _2UE and the random number RANDILR to the user terminal.

The ILR is further configured to: use the authentication key K shared by the ILR with the access server, calculate an authentication result RES _2ASN for the third authentication parameter by using a third message integrity check algorithm, and use the access The public key K _ASI ^ † of the server is encrypted to obtain the encrypted data E3 , and the encrypted data E3 is sent to the access server; wherein the third authentication parameter includes RA DASN, RANDUE, RANDIL _R , RID a network identifier (IID) and an SID of the IL; the second encryption parameter includes the authentication result RES _2ASN ;

The access server is further configured to: after receiving the encrypted data E3, decrypt the encrypted data E3 with the private key of the access server, extract the RES _2ASN , and pass the authentication key KAJ The third message integrity check algorithm calculates an authentication result RES _2ASN for the third authentication parameter, and compares the authentication result XRES _2ASN with the authentication result RES _2ASN . If they are consistent, the access server pairs the The authentication of the ILR is passed; if not, the authentication of the ILR by the access server fails.

A device comprising an identity location register (ILR), the ILR being set to:

After receiving the authentication result RESi _R and the random number RAND _ASN sent by the access server, using the pre-shared key κΐ, the second message integrity check algorithm calculates the authentication result XRES ₂ IL _R by using the second message integrity check algorithm, and the authentication result XRES ₂ IL _R and the received authentication result RES ₂ IL _R is compared, if the authentication result} ¾ £ 3 ₂ 1 ^ with the authentication result RES ₂ IL _R - induced access, user terminal The authentication is passed; if they are inconsistent, the access authentication fails;

The pre-shared key K1 is a pre-shared key of the user terminal and the ILR; the second authentication parameter includes the random number RANDUE, the random number RANDue, and a user identity identifier (SID) And the RID;

The random number RA D _ASN is generated by the access server and sent to the ILR; the authentication result RES ₂ ILR is generated by the user terminal when the authentication needs to be performed, and the random access number RANDUE is obtained, and the access server is obtained. a route identifier (RID) in the network and a random number generated by the ILR The RA DJLR, and using the pre-shared key K1, calculates the authentication result RES _2:LR for the second authentication parameter by using the second message integrity check algorithm, and sends the authentication result RES ₂ IL _R to the access server. And then sent by the access server to the ILR.

The ILR is further configured to: use the pre-shared key K1 to calculate an authentication result RES _2UE for the first authentication parameter by using a first message integrity check algorithm, and use! After the first encryption parameter is encrypted by the asymmetric encryption algorithm, the encrypted data E1 is sent to the access server; wherein the first authentication parameter includes the authentication result RA DUE and the random number RA DILR; The first encryption parameter includes the authentication result RES _2UE and a random number RANDILR;

Among them, said! ^^ is the public key of the access server, the access server sends the public key K _{ASN of} the access server and the RID to the ILR; the SID is sent by the user terminal to the connection Into the server.

The ILR is further configured to: use the authentication key K shared by the ILR with the access server, calculate an authentication result RES _2ASN for the third authentication parameter by using a third message integrity check algorithm, and use the access The public key K _{AS1 of the} server is encrypted, and the encrypted data E3 is obtained by encrypting the second encryption parameter, and the encrypted data E3 is sent to the access server;

The third authentication parameter includes RAND _ASN , RANDUE, RA DIL _R , ID, network identifier (IID) and SID of the ILR; the second encryption parameter includes the authentication result RES _2ASN ; After receiving the encrypted data E3, the server decrypts the encrypted data E3 with the private key K _{a of} the access server, extracts the RES _2ASN , and passes the third message integrity check with the authentication key. The algorithm calculates an authentication result RES _2ASN for the third authentication parameter, and compares the authentication result XRES _2ASN with the authentication result RES _2ASN . If they are consistent, the access server passes the authentication of the ILR; The authentication of the ILR by the access server fails.

The above method and system effectively avoids man-in-the-middle attacks caused by unreliable networks, and ensures that the access point is the user's real access point by binding the access point routing information with the authentication result. In an embodiment, the following advantages can also be obtained:

First: The above methods and systems are in the Identity Location Register (ILR Identity Location Register, When IL or UE calculates the authentication result, the random numbers RA DILR, RA D _ASN and RA DUE generated by the respective nodes are used. This can prevent the middleman from changing the random number to a non-random number, and let the UE or ILR generate the authentication result. Crack the shared key.

Second: The above method and system interpolate the process of distributing the ASN and ILR public keys K _ASN and 3⁄4L _R to each other to the UE for ILR authentication and ILR to UE authentication, ensuring that the public keys K _ASN and IQLR are correct. The arrival of the destination server, to avoid the interception or replacement of the public key K _ASi ^ K! L _{R by the} middleman, to ensure the security of subsequent data transmission.

Third: Through the three certification processes, the guarantee ensures that all parties on the network cannot be counterfeited, ensuring the security of the entire network authentication system.

Fourth: Through the digital signature, it is ensured that the keys K _ENC and KM generated in the ILR can correctly reach the ASN through the unsecure network, and the security of the data transmission on the access side from the UE to the ASN is ensured. BRIEF abstract

FIG. 2 is a schematic diagram of an authentication mechanism used in an embodiment of the present invention. Preferred embodiment of the invention

Specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

When accessing the network, the UE must first authenticate through an Access Service Node (ASN). Since the mobile user UE often roams from one access point to another, the ASN and the user access the UE. The ILR Identity Location Register (IRR), which stores user identity information and location information, is often not in the same place. When the two are located in different areas connected by IP network or other data network, the background technology described in Figure 1 may appear. The middleman attacked.

The authentication method in this embodiment includes at least the authentication of the UE by the ILR, and may further include the authentication of the ILR by the UE and the authentication of the ISN by the ASN.

The authentication of the UE by the ILR can ensure that the UE is a legitimate user of the network; the UE can ensure that the network accessed by the ILR authentication is a legitimate network, preventing the fake network from spoofing the UE; The certificate can guarantee that the ILR is a legitimate authentication server, preventing the fake ILR and the fake UE from uniting to deceive the ASN and stealing the valuable wireless resources of the ASN. The use of these three mutually integrated authentications completely avoids the insecure path between ASN and ILR and is attacked by a middleman, making the authentication process of the mobile network more secure and reliable.

Among them, ASN can be SGSN, gateway GPRS support node ( Gateway GPRS Support

Node, GGSN), Packet Data Support Node (PDSN), Serving Gateway (SGW) or Packet Data Gateway (PGW Gateway, PGW), Foreign Agency (FA), etc.

The ILR is a logical identifier. In a specific application scenario, it may be an HLR, a Home Subscriber Server (HSS), an Authorization, Authentication, Accounting (AAA), or other authentication server.

At the same time, the identifiers defining the UE, ASN and ILR are respectively the Subscriber Identification (SID), the Route Identification (RID) and the Route Identification (IID) of the ILR in the network; between the UE and the ILR. There are shared keys K1, Κ2, and Κ3; wherein, K1 is a UE and an ILR pre-shared key, and is mainly responsible for UE-to-ILR authentication and ILR-to-UE authentication, Κ2 is a root key for generating an encryption key, and Κ3 is used for generating The root key of the integrity check key, Κ2 and Κ3, may be pre-agreed by the UE and the ILR, or may be derived by K1. The UE and the ILR also have authentication algorithms fl, £2, f4, and f5, respectively. In addition, there is a shared key KAI between the ASN and the ILR, and each has an authentication algorithm 8.

The implementation process of this embodiment is specifically described below:

Step 201: When the UE roams to a new access point, the SID is sent to the ASN of the new access point.

The SID may be sent by sending an "access request" message, or may directly initiate a data packet, where the identity identifier SID of the UE is carried.

Step 202: After receiving the SID, the ASN checks whether the SID has passed the authentication. If the ASN does not pass the authentication, sends an RID to the UE, and instructs the UE to perform authentication.

The ASN may send the RID by sending a "require access authentication" message to the UE and instruct the UE to perform authentication, or may transmit the SID to the UE by using a broadcast manner. Step 203: After receiving the indication that the UE needs to be authenticated, the UE generates a random number RA DUE, and sends the RA DUE and the SID to the ASN through an "authentication network request" message.

In addition, in order to simplify the processing after the ASN receives the "authentication network request" message, the UE may directly send the RA DUE, the SID together, and the RID to the ASN;

The random numbers in this paper can all be generated by the pseudo-random number algorithm in the computer programming language; Step 204: The ASN will receive the RA DUE and SID, together with the RID and the ASN public key K _ASN four parameters "RAKDUE, SID, RID , KASN "sends the message to the ILR via the "Authentication Network Request"message;

If the "required access authentication" sent in step 203 includes the RID, the ASN only needs to add the public key K _{ASN of the ASN} ;

The ASN's public key K _ASN can have multiple groups or can be generated temporarily, as long as it remains unchanged during the authentication process of a user.

Step 205: The ILR receives the "authentication network request" message sent by the ASN, first generates a random number RA Due, and uses the shared authentication key K1 corresponding to the SID, and uses the RANDue RA Due SID, RID as a parameter, and calculates by the fl algorithm. Obtain RES _2UE , ie RES _2UE = fl _K1 ( RANDUE, RA DILR, SID, RID ), and encrypt the public key Κ _{2UE of} the RES _2UE , RA Due ILR, and the network identifier IID of the ILR with the ASN public key K _ASN to obtain El And then send the encrypted data E1 to the ASN through the "authentication network response"message;

Preferably, the public key of the RES _2UE , the RA DILR. ILR, and the network identifier IID of the ILR may be combined into one long data string (

), then ILR encrypts the long data string (RESZUEIRA DILRIKILRIIID) with the ASN public key K _ASN , and then obtains E Eio^RESzuElRA Dn^lKn^lIID] and sends it to the ASN through the "authentication network response"message; _2UE , RA Dn^ KILR and IID can be merged in any order when growing the data string, as long as ASN can correctly identify these four parameters; for example, RES _2UE , RA DILR. KILR. HD can adopt the agreed length, The agreed order facilitates the separation of these four parameters in sequence after ASN reception;

Wherein, E _KASN [] indicates that the data in the ASN public key K _AS1 ^ † square brackets is used for encryption, and the encryption algorithm herein may be RSA or Digital Signature Algorithm (DSA), etc. Any asymmetric encryption algorithm;

RES _2UE indicates an authentication calculation result sent to the UE;

Fl is a message integrity authentication algorithm. The specific algorithm can use MD5 or SHA-1 and other custom message digest algorithms. The present invention does not specify a specific algorithm of fl. Which algorithm can be used by the operator according to the actual operation. Security requirements determination, for UE authentication of ILR (network) and IL authentication of UE, calculation of RES _2UE and XRES _2UE in ILR and UE, present in UE and ILR, fl _K i ( RA DUE, RA DILR , SID, RID) indicates the result of using the RA DUE, RA DILR, SID and RID as input parameters, and using the pre-shared key K1 to perform the operation of the fl algorithm; Step 206: After receiving the "authentication network response" message sent by the ILR, the ASN receives the message Decrypting E^EKA^RESZUEIRA DJLRIKJLRIIID] using the private key K _A of the ASN, obtaining RES _2UE and RA DILR, and transmitting to the UE;

At this time, the ASN may further record the KM and the IID, and after the ASN receives the ILR and transmits the UE's data encryption key K _ENC integrity key KINT to the ASN, the data flow between the UE and the ASN needs to be encrypted and Used in the integrity check; if only the shared security key required for the service such as encryption and data integrity check is not required between the UE and the ASN, the steps 205 and 206 may not include the KM and the IID. .

Step 207: After the UE receives the RES _2UE and RAKDJLR, fl algorithm using XRES _2UE, i.e. after XRES _2UE = _{fl K1 (RANDUE, RANDILR, SID} , RID) compared with the RES _2UE, for ILR authentication:

If not, then notify ASN authentication fails; if consistent, UE certification of the ILR through; if the UE is consistent comparison XRES _2UE and ES _2UE, you can continue to authenticate the UE ILR at this time, UE further sends ASN " The authentication terminal requests a message carrying the authentication result RES ₂ IL _R returned to the ILR using the pre-shared key K1 and using the pre-shared key K1 with the RANDue RANDILR, SID, and RID as parameters.

( RANDUE , RANDILR, SID, RID );

Among them, if the UE by comparing XRES _2UE and RES _2UE, the result is both inconsistent, then the network is illegal, or suffered a middleman attacks;

The fl algorithm of the terminal is the same as the fl algorithm on the ILR; 1^8 ₂ 1^ indicates the result of the authentication calculation sent to the ILR;

G _K1 ( RA DUE, RA DILR, SID , RID ) indicates the result of using the RA DUE, RA DILR, SID, RID as input parameters, and using the shared authentication key K1 to perform the β algorithm operation;

It should be pointed out that this paper does not specify the specific algorithm of G. As long as RA Due RA DILR. SID. RID is used as the input parameter, the shared authentication key K1 can be used to pass the algorithm, such as MD5 or SHA-1. Algorithm, or other custom algorithm;

Step 208: After receiving the "Authentication Terminal Request" message sent by the terminal, the _ASN generates a random number RAND _ASN , encrypts the RESIR and the RAND _ASN with the public key KJLR, obtains E2, and encrypts the data by using the private key K _a of the ASN. E2 performs digital signature SIGN _ASN , and then sends the encrypted data E2 and the digital signature SIGN _ASN to the authentication server ILR through the "authentication terminal request";

The ASN may combine the generated random numbers RA DASN and RES _R into a data string RES ₂ JL _R | RAND _asn according to the agreed order and length, that is, the data string RA D _A SN| ES ₂ ILR may also be used. As long as the order and length are agreed, the order of the parameters in the data string below is also in the order and length. The ASN then encrypts the string using the ILR public key 3⁄4^ to form the encrypted data E2, such as

E _KLTR [] represents the result obtained by encrypting the data in the parentheses [] of the public key 10^ of the authentication server ILR, and the encryption algorithm here may also be an asymmetric encryption algorithm such as RSA or DSA;

Step 209: After receiving the "Authentication Terminal Request" message sent by the ASN, the ILR checks the correctness of the digital signature SIGN _ASN with the public key K _{ASN of the} _ASN . If correct, encrypts the data E2 with the private key of the ILR (such as E _KLTR [RES _2ILR |RA D _ASN ] ) Decrypt, get RES _2ILR and RANDASN, then calculate with £2 algorithm

(RANDUE, RANDILR, SID, RID), and compare the XRES ₂ IL _R with the decrypted RES ₂ IL _R (ie, RES ₂ IL _R sent by the UE), if not, notify the ASN authentication failure; , the certification is passed;

After the ILR passes the authentication of the UE, the ASN authentication process can be further started. At this time, the ILR uses the shared key with the ASN to calculate RES _2ASN = B _KAI ( RANDASN, RANDUE, RANDILR, RID using the β algorithm. , IID, SID); simultaneously using the f4 algorithm and the shared encrypted root key K2 between the UE and the ILR to calculate the access data encryption key KENC (RA DUE, RA DILR, SID, RID) between the UE and the ASN; And through the f5 algorithm and between the UE and the ILR Shared integrity check root key K3 calculates the access data integrity check key between the UE and the ASN

(RANDUE, RANDIL _R , SID, RID), calculate the integrity key 3⁄4Ν _Τ, etc.; then use ASN's public key K _ASI ^ RES RES _2ASN , K _ENC and KINT to obtain an encrypted data, and generate it with the private key of ILR The encrypted data is digitally signed by SIGNIL _R and the encrypted data and SIGNIL _{R are} sent to the ASN via the "Authentication Pass" message.

Wherein, if the result of comparing 1 £8 ₂ 11^ with RES ₂ IL _R is inconsistent, it indicates that the terminal UE is impersonated or has a man-in-the-middle attack;

This paper also does not specifically define the β algorithm;

This paper also does not define the specific algorithm of f4, f5.

You can combine RES _2ASN , K _ENC and 3⁄4N _T (in any agreed order and length) into a long data string, such as RES _2ASN |K _ENC |KIN _T , and then use ASN's public key K _AST ^† The long data string encrypted after the connection is E3, that is,

And digitally sign the encrypted data E3 with the private key of the ILR.

In addition, the "authentication pass" of this step may further include other keys or parameters that need to be sent from the ILR to the ASN, such as the UE's handover key may also be included and passed to the ASN.

ΐΙ, η, Β are all message integrity check algorithms, which can be MD5 or SHA-1 or other custom message digest algorithms, etc., can be the same or different message integrity check algorithm, f4 is the encryption key The algorithm is generated, and f5 is an integrity check key generation algorithm. The two algorithms are generally different from the previous ones. The above algorithms can all be set by the operator. The present invention does not specify a specific algorithm. For the distribution and storage location of these algorithms, the terminal is usually burned in the SIM/USIM/UIM card or integrated in the terminal software. For the authentication server, it is generally stored in the ILR database in an encrypted manner for all users. The f5 algorithm is the same, the only difference is the shared key Kl, Κ2, Κ3. In actual operation, operators generally keep fl ~ f5 secret to the outside world to ensure better security.

Step 210: After ASN receive an "authentication" message sent by the ILR, the first public key ¾L _R examines the digital signature of the correctness of ILR, then the private key K _A ASN decrypting the encrypted data E3, extraction _RES 2ASN, K _ENC and KINT, then ASN is calculated using the key and the beta algorithm

IID, SID), and compare XRES _2ASN and RES _2ASN . If they are inconsistent, the authentication fails. If they are consistent, send the message to the UE. Pass the message ";

The ASN may further store K _ENC and ΚΐΝτ for subsequent encryption and integrity verification of data transmitted between the UE and the ASN;

When the ASN is compared with XRES _2AS1 ^o RES _2ASN , if it is inconsistent, it means that the user UE and the ILR are combined to spoof the ASN.

Step 211: After receiving the "authentication pass" message, the terminal UE separately calculates K _ENC and ΚΪΝΤ. In the subsequent data interaction with the ASN, the data between the UE and the ASN may be used by the two keys according to system requirements. Encryption and integrity check.

Where K _{ENC =} f4K2 ( RA DUE, RA DIL _R , SID, RID);

( RA DUE, RANDILR, SID, RID).

By the present invention the ASN KASN RID and public key a public key K0 and ILR as parameters _[mu] and IL UE mutual authentication using the authentication key K1 shared between the UE and the ILR to calculate a plurality of parameters, and by a plurality of After the parameter mixing operation, the authentication result is obtained, thereby realizing the ILR authentication to the UE and the UE to the ILR two-way authentication, and also ensuring that the RID and the public key KASN of the access server ASN can be correctly transmitted from the ASN to the ILR, and also ensure The public key KJLR of the ILR can be correctly transferred from the IL to the ASN, and the encryption key K _ENC and the integrity check key KIN _T generated in the ILR can be correctly transmitted from the ILR to the ASN.

In addition, the present invention also adds the ASN authentication to the ILR, which avoids the situation that the UE and the ILR simultaneously spoof to defraud the ASN and use the network.

In the above embodiment, there are several means to detect whether a man-in-the-middle attack has occurred:

First, after receiving the authentication network response message sent by the ILR, the UE sends the authentication certificate XRES _2UE and ILR calculated by using the shared key K1 and the access point identifier RID, the user identity identifier SID, and the related random numbers RA DUE and RA DILR. The _incoming RES _{2UE is} inconsistent and it is believed that a man-in-the-middle attack has _occurred

Similarly, if the ILR receives the authentication terminal request message sent by the UE, the authentication result XRES ₂ in^ ILR calculated by using the shared key K1 and the access point identification RID, the user identity SID, and the associated random numbers RANDUE and RA Due The RES ₂ IL _R came inconsistently and thought that a middleman was created. Attack.

In addition, if the ASN receives the RES _2ASN sent by the ILR and the XRES _2ASN calculated by the ASN itself, the two digital signatures SIGN _ASN and SIGNINR are considered to have occurred as a man-in-the-middle attack if the result of the transmission is inconsistent with the calculation result.

Through the above process, it is realized:

1. The terminal UE authenticates the authentication server ILR to prevent counterfeit network attacks.

2. Authentication server The authentication of the terminal UE by the ILR prevents the fake terminal from accessing.

3. Access server The ASN authenticates the authentication server ILR, preventing the fake terminal and the authentication server from simultaneously spoofing the ASN.

4. The RID and K _{ASN are} correctly passed from the _ASN to the ILR. The IID and KILR ^'J ASN are correctly transmitted from the ILR, and a secure channel is established between the ASN and the ILR to facilitate the shared key for the UE generated by other ILRs. Transfer to the ASN through this secure channel.

5. The K _ENC and KINT are correctly transmitted from the ILR to the ASN, and a secure data transmission channel is established on the access side between the UE and the ASN.

Correspondingly, this embodiment also provides a system for implementing the foregoing method, including a user terminal, an access server, and an authentication server, where:

a user terminal, configured to generate a random number when the user terminal needs to access authentication

RA DUE, and sending a user identity identifier (SID) and a random number RANDUE to the access server; and after receiving the RES _2UE and RA Due sent by the access server, the user terminal obtains the XRES 2 _UE by using the fl algorithm and performs the RES 2 _UE If the authentication is consistent, the user terminal passes the authentication of the authentication server. If the authentication is inconsistent, the authentication of the authentication server by the user terminal fails.

An access server, configured to send the received SID and the random number RANDUE, together with the public key of the access server (K _ASN ) and the routing identifier (RID ) of the access server in the network to the authentication server; and use the private After the key K _A decrypts the encrypted data E1 sent by the authentication server, The obtained RES _2UE and RA DM are sent to the user terminal

An authentication server, configured to generate RA DIL _R by using the RID and the K _ASN , and using the shared authentication key K1 corresponding to the SID, using RANDUE and RA Dn^ as parameters, calculating RES _2UE by using the fl algorithm, and using the K _ASN to calculate the RES _2UE and RA DILR are encrypted, and the encrypted encrypted data E1 is sent to the access server;

The fl algorithm is an authentication algorithm used for authentication of the authentication server by the user terminal, and exists in the user terminal and the authentication server.

The encrypted data E1 further includes a public key (KJLR) of the authentication server encrypted by the K _ASN and a network identifier (IID) of the authentication server;

Fl user terminal uses the algorithm XRES _2UE _2UE after comparing the RES, a user terminal, the access server and the authentication server is further configured to:

The user terminal is further configured to notify the access server that the authentication fails if not consistent; if the user terminal is consistent, the user terminal sends an authentication terminal request message to the access server, where the K1 is carried, and the RANDue RA DILR, SID, and RID are used as parameters.认证 The authentication result RES ₂ IL _R returned to the authentication server calculated by the G algorithm;

The access server is configured to: after receiving the authentication terminal request message, generate a random number RA D _ASN , and encrypt the RES ₂ ILR and the RA D _{ASN to} send the encrypted data E2 to the authentication server; and the authentication server is configured to use the authentication The private key of the server decrypts the encrypted data E2 sent by the access server to obtain RESIR and RA D _ASN , and then uses K1, takes RANDue RA Due SID and RID as parameters, calculates XRES _R by the £2 algorithm, and calculates the ^8 ₂ 1^ is compared with the decrypted RES ₂ IL _R. If they are consistent, the authentication server passes the authentication of the user terminal; if not, the authentication server fails the authentication of the user terminal.

The Ώ is an authentication algorithm that exists in both the user terminal and the authentication server.

After the authentication server passes the authentication of the user terminal, the access server and the authentication server are further used to:

Authentication server, used to share the shared key KA with the access server! Using RAND _ASN , RANDUE, RA DIL _R , RID, IID and SID as parameters, calculate RES _2ASN with β algorithm, and use The public key K _ASi ^ † RES _{2ASN of the} access server is encrypted to obtain an encrypted data E3, and the encrypted data E3 is sent to the access server;

The access server, after receiving the encrypted data E3, decrypts the encrypted data E3 with the private key K _{a of the} access server, extracts the RES _2ASN , and compares the XRES _2ASN and the RES _2ASN . If not, the access server authenticates The authentication of the server fails. If they are consistent, the authentication of the authentication server is passed by the access server.

The beta algorithm is an authentication algorithm that exists between the access server and the authentication server.

In summary, the method has the following advantages:

First, the present invention adds the route identifier RID to the access server when both the UE and the ILR calculate the authentication result, and the route identifier of the ASN seen by the UE and the route identifier of the ASN seen by the ILR are obtained from the mechanism. Consistently, the RID of the user registered in the ILR is consistent with the actual access, which avoids the man-in-the-middle attack caused by the intermediary modifying the RID of the access server. Second, the solution calculates the authentication result in the authentication server ILR or the terminal UE. At the same time, the random numbers RA Dn^ RA D _ASN and RA DUE generated by the respective nodes are used, which can prevent the middleman from changing the random number to a non-random number, such as an all-zero string, allowing the UE or ILR to generate an authentication result to guess. Shared key.

For example, if the random number is generated by the other party, if the signaling is intercepted by the intermediary, the middleman can modify the random number to a non-random value, such as 00000000, and then submit the result to the UE, thus having the parameter 00000000 and The authentication response RESUE - a comparison result. Then the middleman changes the random number to 00000001, and then the UE calculates the comparison result. After repeated multiple times, the middle person may have broken the shared key of the UE.

In WCDMA, only the HLR server generates random numbers, and the UE does not generate random numbers. Therefore, in WCDMA, the above possibility of attacking the UE cannot be excluded. In the solution of the present invention, since the UE, the ILR, and the ASN each generate a random number, the possibility that the middleman modifies the random number to form an attack is eliminated, thereby ensuring the security of the shared key in the access authentication.

Third, the scheme subtly interpolates the process of distributing the ASN and ILR public keys K _ASN and KILR to each other to the UE for ILR authentication and ILR to UE authentication, ensuring the public key K _ASN and IQLR It can reach the destination server correctly and avoid the interception or replacement of the public key 1^^ and 3⁄4^ by the middleman, which ensures the security of subsequent data transmission.

Fourth, the three authentication processes used in this paper ensure that all parties on the network cannot be impersonated, which ensures the security of the entire network authentication system.

Fifth, through the digital signature, it is ensured that the keys K _ENC and KJNT generated in the ILR can correctly reach the ASN through the unsecure network, and the security of the data transmission on the access side from the UE to the ASN is ensured.

In addition, the abbreviations referred to in the present invention are as follows:

The result of the encryption of the data in the parentheses [] of the key K _ASN

E _KlLR [] asymmetric encryption algorithm, representing the public key of the authentication server ILR

3⁄4L _R results obtained by encrypting the data in the parentheses []

fl one kind of message integrity check algorithm, authentication for the UE ILR (network), and the UE calculates RES _2UE ILR and XRES _2UE, exist in the UE and ILR. Fl _K i ( ) using the key K1 with the data in parentheses ( ) as the parameter, using fl

The result of the algorithm calculation, which is used for terminal authentication of the network.

n A message integrity check algorithm for ILR authentication of the UE, calculating RES _2:LR and XRES ₂ IL _R in the UE and ILR, and present in both the UE and the ILR.

£2KI uses the key K1 with the data in parentheses ( ) as the parameter, using £2

The result of the algorithm calculation, which is used for network-to-terminal authentication.

β A message integrity check algorithm for ASN authentication of ILR. RES _2ASN and XRES _2ASN are calculated in ILR and ASN, and exist in UE and ILR. β _Κ Λ. ( ) Take the data in parentheses ( ) as the parameter, use the β algorithm, and use the key ΚΑΙ to calculate the result. This algorithm is used for ASN to authenticate the ILR.

F4 An encryption key generation algorithm for generating an encryption key used for data transmission between a UE and an ASN. The algorithm is respectively calculated between the UE and the ILR. When the authentication is successful, the ILR generates an encryption key generated by the algorithm. The key K _{ENC is} passed to the ASN. f4K2 ( ) takes the data in parentheses ( ) as the parameter, uses the f4 algorithm, and uses the root key K ₂ to calculate the result. This algorithm is used to generate the data encryption key K _ENC between the UE and the ASN. F5 An integrity check key generation algorithm for generating an integrity check key used for data transmission between the UE and the ASN. The algorithm calculates f5 _K3 ( ) between the UE and the ILR in parentheses ( ) data in the parameter using the algorithm f5, with the result root key K ₃ calculated, the algorithm for generating the data between the UE and the ASN _¾Ν Τ the integrity check key.

The IID ILR routing identifier in the network, usually in the IP address format, can be directly addressed to the ILR through the IID.

ILR is the Identity Location Register. The ILR is a logical identifier. It can be other authentication servers such as HLR, HSS or AAA in specific application scenarios.

K _A ASN private key, paired with ASN public key KASN

Shared authentication key between KAI ASN and ILR

The public key of the KASN ASN is paired with the private key K _{A of the} ASN.

KENC is used for the encryption of the data stream between the UE and the ASN, and is generated by the algorithm f4 and the key K2.

IL private key, public key and ILR paired _Κ Μ

KiNT is used for the data integrity check key between the UE and the ASN, and is generated by the algorithm f5 and the key K3.

The public key of the KILR ILR, paired with the private key of the ILR

A pre-shared key between the K1 UE and the ILR, used for access authentication of the UE.

The encrypted root key shared between the K2 UE and the ILR can be shared independently or generated by K1 through a certain algorithm.

The integrity check shared between the K3 UE and the ILR is the key, which can be shared independently or generated by K1 through a certain algorithm. AD _ASN random number generated by ASN RA DUE Random number generated by the UE

A DJLR random number generated by ILR

RES ₂ ASN The result of the certification generated by the ILR according to the requirements of the ASN,

RES诵= ΒΚΛ, ( RAND RANDUE, RA DIL _R , RID, IID , SID )

RES2ILR Authentication result generated by the UE, RES ₂ IL _R = G _K1

( RANDUE,

SID, RID)

RES2UE Authentication result generated by ILR, RES _2UE = fl _K i( A DUE,

RA DJLR, SID, RID), transmitted to the ASN, separated by the ASN and transmitted to the UE.

RID ASN Routing identifier in the network ( Route

IDentification ) , which can be an IP address format or other identifier that can be routed to the ASN in the communication network.

SID User ID (Subscriber IDentification)

SIGNASN digitally signs the relevant data with the ASN private key K _A

SIGNER digitally signs the relevant data with the private key of the ILR

UE User Equipment Terminal ( User Equipment )

XRES ₂ ASN Authentication result generated by ASN, XRES _2ASN = β

( RAND RANDUE, RANDIL _R , RID, IID, SID), used for ASN to authenticate ILR, that is, compared with the authentication result RES _2ASN generated by ILR, to determine whether ILR is a legal ILR

XRES21LR Authentication result generated by ILR, XRES ₂ IL _R = f2 _K1

( RANDUE, RAKDILR, SID, RID ), used to authenticate the UE, that is, compared with the authentication result RES ₂ IL _R generated by the UE, to determine whether the terminal is a legitimate terminal. 42 XRES ₂ UE passes XRES _2UE = fl _K i ( RA DUE, in the UE

RA DILR, SID, RID) calculated authentication result, used for

The ILR is authenticated, that is, compared with the RES _2UE sent by the ILR to determine if the network is a legitimate network.

Industrial applicability

The invention effectively avoids the man-in-the-middle attack caused by the unreliable network, and ensures that the access point is the real access point of the user by binding the access point routing information and the authentication result.

Claims

Claim

A method for access authentication in a mobile communication network, the method comprising:

When the user terminal needs to perform authentication, generate a random number RANDUE, and obtain a route identifier (RID) of the access server in the network and a random number A DJLR generated by the identity location register (ILR);

The user terminal uses the pre-shared key K1 to calculate the authentication result RES _2ILR for the second authentication parameter by using the second message integrity check algorithm, and sends the authentication result RES _2ILR to the access server;

After receiving the authentication result RES _2ILR , the access server generates a random number RAND _ASN , and sends the authentication result RES ₂ IL _R and the random number RAND _ASN to the ILR; and the ILR utilization station Calculating the pre-shared key K1, calculating the authentication result XRESIR for the second authentication parameter by using the second message integrity check algorithm, and comparing the authentication result XRES ₂ IL _R with the received authentication result RES ₂ IL _R The authentication result XRES ₂ ILR is consistent with the authentication result RES ₂ IL _R , the access authentication is passed; if not, the access authentication fails; wherein the pre-shared key K1 is the user a pre-shared key of the terminal and the ILR; the second authentication parameter includes the random number RAKDUE, the random number RANDue user identity identifier (SID), and the RID.

2. The method of claim 1 wherein

After the access server generates the random number A DASN, the step of sending the authentication result RES ₂ IL _R and the random number RANDASN to the ILR further includes:

The access server encrypts the authentication result RES ₂ IL _R and the random number RAND _ASN with the public key of the ILR by using an asymmetric encryption algorithm to generate encrypted data E2; the access server sends the encrypted data E2 Giving the ILR;

Before the ILR calculates the authentication result XRES ₂ IL _R , the method further includes:

The ILR decrypts the encrypted data E2 with the private key of the ILR, and obtains the authentication result RES ₂ IL _R and the random number RANDASN

3. The method of claim 2, wherein the access server will encrypt the data The steps of sending E2 to the ILR include:

Said access server with a private key of the access server the encrypted data E2 ^ digitally sign SIGN _ASN; the access server, the encrypted data E2 and the digital signature SIGN _ASN transmitted to the ILR ;

Before the ILR decrypts the encrypted data E2, the method further includes:

The method of claim 1, wherein before the accessing the authentication process of the user terminal to the user terminal, the method further includes: authenticating, by the user terminal, the ILR, where the user terminal is The ILR certification includes:

Sending the SID and the random number RAKDUE to the access server when the user terminal needs to access the authentication;

After the access server decrypts the encrypted data E1 by using the private key K _A of the access server, the obtained authentication result RES _2UE and the random number RANDJLR are sent to the user terminal; and the user terminal receives the After the authentication result RES _2UE and the random number RA DILR, the authentication result XRES _{2UE is} calculated by using the pre-shared key K1 to the first authentication parameter by using the first message integrity check algorithm, and then compared with the authentication result RES _2UE , If the authentication of the authentication server is passed, if the user terminal fails to authenticate, the authentication of the authentication server by the user terminal fails.

The method according to claim 4, wherein the ILR authenticates the user terminal After the method, the method further includes: authenticating, by the access server, the identifier of the ILR, where the authentication of the ILR by the access server includes:

Using the authentication key KM shared by the ILR and the access server, the ILR calculates an authentication result RES _2ASN for the third authentication parameter by using a third message integrity check algorithm, and uses the public key of the access server. The K _ASN encrypts the second encryption parameter to obtain the encrypted data E3, and sends the encrypted data E3 to the access server. The third authentication parameter includes a network of RAND _ASN , RA DUE, RA Dn^RID, and ILR. An identifier (IID) and a SID; the second encryption parameter includes the authentication result RES _2ASN ;

After receiving the encrypted data E3, the access server decrypts the encrypted data E3 by using the private key K _{a of} the access server, extracts the RES _2ASN , and completes the third message by using the authentication key. The verification algorithm calculates an authentication result RES _2ASN for the third authentication parameter; and the access server compares the XRES _2ASN with the RES _2ASN , and if they are consistent, the access server authenticates the ILR Passing; If not, the access server fails to authenticate the ILR.

6. The method of claim 5, wherein

The first encryption parameter further includes a public key 3⁄4^ and an IID of the ILR;

The second encryption parameter further includes an access data encryption key K _ENC or an access data integrity check key KJNT;

The access data encryption key K _ENC is an encrypted root key K2 shared by the authentication server between the user terminal and the authentication server, and the RA DUE, RAKDILR, SID, and RID are The parameter is calculated by using an encryption key generation algorithm; the access data integrity verification key KJNT is an integrity key K3 shared by the authentication server between the user terminal and the authentication server, The RA Du^RA Dn^SID and RID are parameters, which are calculated by the integrity check key generation algorithm.

7. The method according to claim 5 or 6, wherein the step of the ILR transmitting the encrypted data E3 to the access server comprises:

The ILR generates a digital signature SIGNIL _{R of} the encrypted data E3 by using a private key of the ILR, and sends the digital signature 81> to the access server together with the encrypted data E3; Before the access server decrypts the encrypted data E3, the method further includes: the access server first checking the correctness of the digital signature SIGNILR by using the KIL _R , and if yes, continuing to perform the access server utilization. The private key of the access server ^ is a step of decrypting the encrypted data E3.

8. The method of claim 1, wherein

9. The method of claim 1, wherein the mobile communication network is an IP based mobile communication network.

10. The method of claim 1, wherein

11. A system for access authentication in a mobile communication network, the system comprising a user terminal, an access server and an identity location register (ILR);

The user terminal is configured to: generate the random number RA DUE when authentication is required, obtain a route identifier (RID) of the access server in the network, and a random number RANDn^ generated by the ILR and use pre-shared The key K1 is calculated by the second message integrity check algorithm for the second authentication parameter to obtain the authentication result RES _2:LR , and the authentication result RES _{2ILR is} sent to the access server;

The access server is configured to: generate a random number after receiving the authentication result RES ₂ ILR

RA DASN. and transmitting the authentication result RES _2ILR and the random number RA D _ASN to the IL;

The ILR is configured to: after receiving the authentication result RES _2ILR sent by the access server and the random number RAND _ASN , using the pre-shared key K1, by using a second message integrity check algorithm The second authentication parameter calculates an authentication result XRES ₂ ILR, and compares the authentication result XRESi _R with the received authentication result RESIR, if the authentication result XRESi _{R is} consistent with the authentication result RES ₂ IL _R The access authentication is passed; if not, the access authentication fails; The pre-shared key K1 is a pre-shared key of the user terminal and the ILR; the second authentication parameter includes the random number RANDUE, the random number RANDIL _R , and a user identity identifier (SID) And the RID.

12. The system of claim 11 wherein:

The user terminal is further configured to: when the access authentication is required, the SID and the random number

And sending, by the RA DUE, the access server; and after receiving the random number RES 2 _UE and the random number RA Due sent by the access server, using the pre-shared key K1 to pass the first message integrity check algorithm a first authentication parameter XRES calculated authentication result and the authentication result after _2UE _2UE compares the RES, if they are consistent, the terminal user authentication by the authentication server, and if not, then the user terminal to the authentication server Certification failed;

The access server is further configured to: send the received SID and random number RA DUE, send the public key KASN of the access server, and the RID to the ILR;

The ILR is further configured to: use the pre-shared key K1 to calculate an authentication result RES _2UE for the first authentication parameter by using a first message integrity check algorithm, and use the above! After the first encryption parameter is encrypted by the asymmetric encryption algorithm, the encrypted data E1 is sent to the access server; wherein the first authentication parameter includes the authentication result RA DUE and the random number RA Due; The first encryption parameter includes the authentication result RES _2UE and a random number RA DILR;

The access server is further configured to: after decrypting the encrypted data E1 by using a private key of the access server, send the obtained authentication result RES _2UE and the random number RANDue to the user terminal.

13. The system of claim 11 or 12, wherein

The ILR is further configured to: use the authentication key KM shared by the ILR and the access server, calculate an authentication result RES _2ASN for the third authentication parameter by using a third message integrity check algorithm, and use the access The public key K _{AS1 of the} server is encrypted, and the encrypted data E3 is obtained by encrypting the second encryption parameter, and the encrypted data E3 is sent to the access server; wherein the third authentication parameter includes RA DASN, RANDUE, RA DILR, RID a network identifier (IID) and an SID of the IL; the second encryption parameter includes the authentication result RES _2ASN ;

The access server is further configured to: after receiving the encrypted data E3, using the access service The private key of the server decrypts the encrypted data E3, extracts the RES _2ASN , and uses the authentication key KAJ to calculate the authentication result RES ₂ ASN for the third authentication parameter by using the third message integrity check algorithm, and The authentication result XRES _2AS1 ^o is compared with the authentication result RES _2ASN . If they are consistent, the access server passes the authentication of the ILR; if not, the authentication of the ILR by the access server fails.

14. An apparatus, comprising: an identity location register (ILR), wherein the ILR is set to: after receiving an authentication result RES ₂ IL _R and a random number RA D _ASN sent by an access server, using a pre-shared key K1, Calculating the authentication result XRES ₂ IL _R for the second authentication parameter by the second message integrity check algorithm, and comparing the authentication result XRES ₂ IL _R with the received authentication result RES ₂ IL _R if the authentication result ^8 ₂ 1^According to the authentication result RES ₂ IL _R , the access authentication of the user terminal passes; if not, the access authentication fails;

The pre-shared key K1 is a pre-shared key of the user terminal and the ILR; the second authentication parameter includes the random number RAKDUE, the random number RANDIL _R , and a user identity identifier (SID) And the RID;

The random number RA DASN is generated by the access server and sent to the ILR; the authentication result RES _{R is} generated by the user terminal when the authentication needs to be performed, and the access server is obtained in the network. a route identifier (RID) and a random number RA DTLR generated by the ILR, and using the pre-shared key K1, the second message authentication check algorithm calculates the authentication result RESi _R by using the second message integrity check algorithm, The authentication result RES ₂ IL _{R is} sent to the access server, which is then sent by the access server to the ILR.

The device according to claim 14, wherein the ILR is further configured to: calculate, by using the pre-shared key K1, the authentication result RES _2UE by using the first message integrity check algorithm on the first authentication parameter, and use After the K _ASN encrypts the first encryption parameter by using an asymmetric encryption algorithm, the encrypted data E1 is sent to the access server; wherein the first authentication parameter includes the authentication result RA DUE and a random number RANDue; An encryption parameter includes the authentication result RES _2UE and a random number RA Due;

The K _ASN is a public key of the access server, and the access server sends the public key KASN of the access server and the RID to the ILR; the SID is sent by the user terminal to The access server.

16. The apparatus of claim 14, wherein the ILR is further configured to: utilize a third message integrity check algorithm for a third authentication using an authentication key KAJ shared by the ILR with the access server The parameter is calculated to obtain the authentication result RES _2ASN , and the second encryption parameter is encrypted by using the public key K _ASN of the access server to obtain the encrypted data E3, and the encrypted data E3 is sent to the access service to cry '

The third authentication parameter includes a RAND _ASN , a RANDUE, an RA DIL _R , a RID, a network identifier (IID) and an SID of the ILR; the second encryption parameter includes the authentication result RES _2ASN ;

After receiving the encrypted data E3, the access server decrypts the encrypted data E3 with the private key K _{A of} the access server, extracts the RES _2ASN , and uses the authentication key K to pass the first The third message integrity check algorithm calculates an authentication result RES _2ASN for the third authentication parameter, and compares the authentication result XRES _2ASN with the authentication result RES _2ASN . If they are consistent, the access server pairs the ILR. If the authentication is inconsistent, the authentication of the ILR by the access server fails.