Method, system and device for mutual authentication

Abstract

The invention provides a method, a system and a device for mutual authentication. The method comprises: a network entity obtains the new triplet vector of mobile equipment (ME); according to the triplet vector, the network entity generates an output parameter and sends the output parameter to the ME, wherein the output parameter is formed by encrypting random number RAND and authentication execution time CNR; the ME decrypts the output parameter and authenticates the network according to a decrypting result; meanwhile, the a subscriber identity module (SIM) card of the ME generates an RES and sends the generated RES to the network entity; and the network entity authenticates the ME according to the received RES. The invention can realize mutual authentication between ME and the network side and can judge that ME authenticates the network not to pass when suffering replay attack.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method, system and device for two-way authentication. Background technique [0002] In the 2G (second generation) communication era, the GSM (Global System for Mobile Communications) standard and technology widely used in China and even the world can only realize the function of one-way authentication, that is, it can only realize the network authentication of mobile phones, The mobile phone cannot authenticate the network. In layman's terms, only the network can judge whether the mobile phone user is a legitimate user, but the user cannot judge whether the network is a legal network, so there is a danger of being attacked by a fake base station. Based on this, 3GPP (3 rd Generation Partnership Project (3rd Generation Partnership Project) absorbed the above deficiencies when formulating 3G (including WCDMA, TD-SCDMA) security standards, enhanced from 3-tuple to 5-tuple...

AI Technical Summary

Problems solved by technology

[0016] (1) This method is limited to the realization of ME authentication network WCDMA when the SIM card uses WCDMA ME or GSM / WCDMA dual-mode ME, but for the GSMSIM cards that will be popularized in China, use TD-SCDMA ME or GSM / TD-SCDMA dual-mode In the case of multi-mode ME or even multi-mode ME, this method cannot achieve two-way authentication

[0017] (2) This method cannot resist replay attacks

[0018] (3) This method only gives an abstract description of the cryptographic algorithm. In the actual implementation, the implementer also needs to design the cryptographic algorithm separately, which brings inconvenience to the implementer

[0030] (2) Another major defect of this method is: Since the HLR / AuC cannot distinguish whether the GSMSIM uses 2GME or 3G ME, it is necessary to generate RES1 according to RES1=A3(Ki, R1||R1), and to generate RES1 according to Kc1 =A8(Ki, R1||R1); R2=Kc1; RAND=R1||R2; the generated RAND is passed to ME, and for a large number of users who still use 2G ME, follow RES1=A3(Ki, RAND) to generate RES1, so that the RES1 generated by ME is not equal to the RES1 generated by the network, which will cause the problem of passing the authentication, which will have a huge impact on the large number of existing users who still use 2G ME;

[0031] (3) Since RAND changes at any time, and ME is difficult to store a large amount of challenge information due to the limitation of storage space, it is difficult to resist replay attacks

Images