United identity authentication method and system for power distribution communication wireless private network

Abstract

The invention relates to a united identity authentication method and system for a power distribution communication wireless private network. The method comprises the following steps of acquiring a network access attachment request initiated by a terminal through a core network of the power distribution communication wireless private network, wherein the network access attachment request contains united identity authentication parameters of the terminal; transmitting an access request to a secondary authentication gateway by the core network after the terminal passes authentication certification; receiving a secondary authentication result of the secondary authentication gateway for the terminal according to the united identity authentication parameters by the core network; transmitting network access success information and carrying information to a base station and the terminal by the core network if the secondary authentication result is passing authentication; transmitting network access failure information to the terminal by the core network if the secondary authentication result is failing in authentication. Secondary authentication is performed when the terminal accesses the network, the safety performance of the power distribution communication wireless private network is effectively improved, and distribution communication wireless private network application requiring high real-time performance can be met.

Description

technical field [0001] The invention relates to the field of wireless private network communication security, in particular to a joint identity authentication method and system for a wireless private network of power distribution communication. Background technique [0002] As an authentication and key agreement scheme proposed by 3GPP in its standard documents, EPS-AKA (Evolved Packet System-Authentication and Key Agreement) is the core and foundation of LTE network security. EPS-AKA is evolved from the 3G-AKA scheme in the 3G network. It continues the "challenge / response" process of the previous authentication scheme, and completes the mutual authentication process between the LTE user terminal (UE, User End) and the network. The negotiation of the session key is used to encrypt the subsequent communication and provide communication security. [0003] However, in the application of LTE wireless private network for power distribution communication, the following serious se...

AI Technical Summary

Problems solved by technology

Since the IMSI is transmitted in the wireless channel in clear text, it may be intercepted by the attacker, so it is easy to leak the IMSI to the attacker, so that the user is easily tracked or attacked by a fake base station, which in turn causes the UE to be located and tracking, and may even lead to dangerous events such as illegal network active attacks and denial of service attacks caused by the theft of user identity information;

[0005] (2) Key information such as SNID (Service Network Identity) and AV (Authentication Vector Set) transmitted between HSS (Home Subscriber Server) and MME are not protected

The SNID and AV transmitted in plain text are likely to be eavesdropped and intercepted, and the important data such as identification information contained in it will become the basis for the attacker's next attack;

[0006] (3) Since LTE uses a symmetric encryption system, the transmission and distribution of keys will become complicated as the number of devices in the network increases, and security is difficult to maintain, which cannot meet the high reliability and flexibility requirements of the next generation network. requirements

[0008] (1) Each business data packet needs to be encrypted and decrypted by the terminal and the network, which will significantly increase the transmission delay and cannot be applied to application scenarios that require high real-time performance;

[0009] (2) All business data needs to be encrypted and decrypted by confidential equipment, which can easily become the bottleneck of the network;

[0010] (3) The end-to-end information encryption scheme is only for business data encryption, and does not solve the problem of secure access to the LTE wireless private network, that is, counterfeit terminals can still access the LTE network, and after access, they can still pose an attack threat to network equipment. For example, attacking confidential equipment;

[0011] (4) There are many implementation schemes for end-to-end business information encryption, hardware and software transformation is required for the terminal, and there may also be a workload for transformation of the core network, which is not universal and poor in promotion

Once the encryption scheme and algorithm are disclosed, they will face the same risk of cracking as the 3GPP security architecture

Images