Authentication method and device for communication system

Abstract

The present application discloses an authentication method and device for a communication system. The authentication method of the present application includes: when SIM card access authentication, judging whether the KI value stored on the SIM card side needs to be updated according to the IMEI of the terminal bound to the SIM card; if the KI value needs to be updated, updating the KI value according to the IMEI of the terminal that the SIM card was once bound to obtain the KI value to be verified; verifying the KI value to be verified according to the authentication parameters received from the network side; determining the SIM card status according to the verification result, and completing the final authentication according to the SIM card status. The technical solution of the present application can improve the access authentication of the SIM card by updating the KI value, and avoid illegal access to the network by illegal SIM cards.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to an authentication method and device for a communication system. Background Art

[0002] As the coverage of mobile systems becomes larger and larger, the number of users accessing the systems increases, and the services provided by service providers become more diversified, the network load continues to increase. How to ensure the security of network and business information is an urgent problem that needs to be solved.

[0003] In a mobile communication system, in order to ensure the security of operating services, the network side needs to authenticate the accessed user equipment (UE) so that illegal UE cannot obtain the services provided by the network side and protect the interests of the operator; at the same time, the UE also needs to verify whether the authentication information sent by the network side is valid, that is, the UE authenticates the network side to prevent the illegal network side from using the authentication information that has been used by the legitimate network side to replay the UE, so that the UE believes that the illegal network side is legitimate.

[0004] In the existing Long Term Evolved (LTE) network system, the air interface link between the UE and the evolved base station (E-UTRAN Node B, eNB) is a single hop, and the Evolved Packet System (EPS) authentication and key agreement (AKA) protocol is used to complete the authentication process between the user and the network side, that is, including the processing of identity authentication and key agreement, and its implementation is based on the user and the network side pre-sharing a permanent symmetric key. The entire authentication process is included in an authentication process, and the authentication is performed in the form of an authentication tuple. The authentication tuple includes: random number (RAND), expected response (Expected user Response, XRES), encryption key (Cipher Key, CK), integrity key (Integrity Key, IK) and authentication token (Authenticationtoken, AUTN), where XRES, CK and IK are derived from the authentication key (Key Identifier, KI) corresponding to the user permanent identification (SUbscription PermanentIdentifier, SUPI), and AUTN further includes three parts: authentication sequence number (Sequence Number, SQN), authentication management field (Authentication Management Field, AMF) and message authentication code (Message Authentication Code, MAC).

[0005] In the authentication process of SIM card access to the network side, the relevant technology needs to use the KI value to complete the two-way authentication between the SIM and the network side. However, when the manufacturer makes the SIM card, the authentication information including KI, Operator Variant Algorithm Configuration Field (OP), International Mobile Subscriber Identity (IMSI) will be written into the network side and the SIM card respectively, and these authentication information will not be updated after being written. Then, once the SIM card is illegally cloned, the KI value may be cracked, and the cloned card can complete the access authentication, thereby infringing on the user's personal privacy and property, and affecting the service quality of the operator. Summary of the invention

[0006] The purpose of this application is to solve at least one of the above-mentioned technical defects, and the following technical solution is proposed to improve the access authentication of the SIM card by updating the KI value to prevent illegal SIM cards from illegally accessing the network.

[0007] The present application embodiment adopts the following technical solutions:

[0008] In one aspect of the present application, a communication system authentication method is provided, which is applied to a SIM card side. The authentication method includes: when the SIM card is accessed for authentication, judging whether a KI value stored on the SIM card side needs to be updated according to the IMEI of a terminal bound to the SIM card; if the KI value needs to be updated, updating the KI value according to the IMEI of the terminal that was once bound to the SIM card to obtain a KI value to be verified; verifying the KI value to be verified according to an authentication parameter received from a network side; determining a SIM card status according to the verification result, and completing final authentication according to the SIM card status.

[0009] In another aspect of the present application, an authentication method for a communication system is provided, which is applied to a network side. The authentication method includes: after a SIM card passes access authentication, judging whether a KI value stored on the network side needs to be updated according to the IMEI of a terminal bound to the SIM card; if the KI value needs to be updated, updating the KI value according to the IMEI of the terminal that was once bound to the SIM card to obtain a KI value to be verified; verifying the KI value to be verified according to an authentication parameter received from the SIM card side; and completing final authentication of SIM card access according to the verification result and the SIM card status received from the SIM card side.

[0010] In another aspect of the present application, an authentication device of a communication system is provided, which is applied to a SIM card side, and the authentication device includes: a first judgment unit, which is used to judge whether a KI value stored on the SIM card side needs to be updated according to the IMEI of the terminal bound to the SIM card when the SIM card is accessed for authentication; a first updating unit, which is used to update the KI value according to the IMEI of the terminal that was once bound to the SIM card if the KI value needs to be updated, so as to obtain a KI value to be verified; a first verification unit, which is used to verify the KI value to be verified according to the authentication parameters received from the network side; and the first authentication unit, which is used to determine the SIM card status according to the verification result, and complete the final authentication according to the SIM card status.

[0011] In another aspect of the present application, an authentication device of a communication system is provided, which is applied to a network side, and the authentication device includes: a second judgment unit, which is used to judge whether a KI value stored on the network side needs to be updated according to the IMEI of the terminal bound to the SIM card after the SIM card passes the access authentication; a second updating unit, which is used to update the KI value according to the IMEI of the terminal that was once bound to the SIM card if the KI value needs to be updated, to obtain a KI value to be verified; a second verification unit, which is used to verify the KI value to be verified according to the authentication parameters received from the SIM card side; and the second authentication unit, which is used to complete the final authentication of SIM card access according to the verification result and the SIM card status received from the SIM card side.

[0012] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0013] In the embodiment of the present application, after the SIM card passes the access authentication, it is further determined whether the KI value needs to be updated. When it is determined that the KI value needs to be updated, the KI value is updated according to the IMEI of the terminal that was once bound to the SIM card. Since the IMEI of the terminal that was once bound to the SIM card cannot be obtained by illegal means, the current valid KI value cannot be known, which can fundamentally prevent the access authentication of cloned cards. In addition, the embodiment of the present application also performs consistency judgment on the updated KI value, and further eliminates the possibility of illegal network access by cloned cards through consistency judgment. The access authentication of the SIM card is improved based on the KI value update and the KI value consistency judgment, so that illegal SIM cards cannot access the network, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0015] Figure 1 This is a flow chart of the authentication method applied to the SIM card side shown in an embodiment of the present application;

[0016] Figure 2 Flowchart of the authentication method applied to the network side shown in the embodiment of the present application

[0017] Figure 3 A schematic diagram of the SIM card access authentication process shown in an embodiment of the present application;

[0018] Figure 4 A schematic diagram of a process for updating a KI value according to an embodiment of the present application;

[0019] Figure 5 This is a structural block diagram of an authentication device applied to a SIM card according to an embodiment of the present application;

[0020] Figure 6 This is a structural block diagram of an authentication device applied to the network side according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0022] In view of the hidden dangers in the authentication process of the SIM card after leaving the factory based on the unmodifiable KI value in the related art, the embodiment of the present application completes the binding of the SIM card and the terminal by storing the IMEI queue in the SIM card. Once the SIM card updates the terminal, the update of the KI value is triggered. The update of the KI value depends on the IMEI stored in the IMEI queue. Even if the cloned card obtains the initial KI value, it cannot obtain the IMEI queue, and thus cannot obtain the current KI value to complete the authentication of the cloned card. The technical solution provided by the embodiment of the present application is described in detail below in conjunction with the accompanying drawings.

[0023] Figure 1 The flowchart of the authentication method applied to the SIM card side is shown in the embodiment of the present application. Figure 1 As shown, the method of this embodiment includes the following steps:

[0024] Step S110: during SIM card access authentication, it is determined whether the KI value stored on the SIM card side needs to be updated according to the IMEI of the terminal bound to the SIM card.

[0025] Generally, when the terminal with the SIM card inserted is restarted, the service area is switched, or the SIM card is inserted into the terminal, the access authentication of the SIM card will be started. The access authentication started at this time is to perform the authentication processing on the SIM card side based on the KI value stored locally on the SIM card. It can be understood that the KI value used for the first access authentication after the SIM card leaves the factory is the initial KI value. After the initial KI value is updated, the KI value used for subsequent access authentications is the updated KI value.

[0026] It should be understood that when determining whether the KI value needs to be updated during SIM card access authentication, the determination can be made before the SIM card access authentication, or during the access authentication process. Obviously, the determination can also be made after the access authentication is passed.

[0027] Step S120: If the KI value needs to be updated, the KI value is updated according to the IMEI of the terminal that the SIM card was previously bound to, to obtain the KI value to be verified.

[0028] The method for updating the KI value in this embodiment is basically the same as the method for generating the initial KI value in the prior art, except that when updating the KI value, the IMEI of the terminal that the SIM card was once bound to is used as the keyword to update the KI value in this embodiment. In this way, the update of the KI value depends on the IMEI of the terminal that the SIM card was once bound to, and the cloned card cannot obtain the IMEI of the terminal that the SIM card was once bound to, so the cloned card cannot complete the access authentication.

[0029] Step S130: verify the KI value to be verified according to the authentication parameters received from the network side.

[0030] Since the KI value cannot be sent down or uploaded, this embodiment uses an indirect method to verify the consistency of the KI value, for example, using the consistency verification method of the initial KI value in the prior art to verify the KI value to be verified.

[0031] Step S140, determining the SIM card status according to the verification result, and completing the final authentication according to the SIM card status.

[0032] If the consistency verification passes, it means that the SIM card is in normal state. If the consistency verification fails, it means that the SIM card is in abnormal state and may be in cloned state. At this time, the SIM card can be prohibited from accessing the network and disabled.

[0033] Depend on Figure 1 As shown, during the SIM card access authentication, it is also determined whether the KI value needs to be updated. When it is determined that the KI value needs to be updated, the KI value is updated according to the IMEI of the terminal that was once bound to the SIM card. Since the IMEI of the terminal that was once bound to the SIM card cannot be obtained by illegal means, the current valid KI value cannot be known, which can fundamentally prevent the cloned card from passing the access authentication. In addition, this embodiment also performs consistency judgment on the updated KI value, and further eliminates the possibility of illegal access to the network by the cloned card through the consistency judgment. The access authentication of the SIM card is improved based on the KI value update and the KI value consistency judgment, so that the illegal SIM card cannot access the network, thereby improving the user experience.

[0034] Figure 2 The flowchart of the authentication method applied to the SIM card side is shown in the embodiment of the present application. Figure 2 As shown, the method of this embodiment includes the following steps:

[0035] Step S210: After the SIM card passes the access authentication, it is determined whether the KI value stored on the network side needs to be updated according to the IMEI of the terminal bound to the SIM card.

[0036] Generally, when the terminal with the SIM card inserted is restarted, the service area is switched, or the SIM card is inserted into the terminal, the access authentication of the SIM card will be started. The access authentication started at this time is to perform the authentication processing on the network side based on the KI value stored locally on the network side. It can be understood that the KI value used for the first access authentication after the SIM card leaves the factory is the initial KI value. After the initial KI value is updated, the KI value used for subsequent access authentications is the updated KI value.

[0037] In this embodiment, the update judgment operation of the KI value is performed only after the SIM card passes the access authentication. Therefore, only after the access authentication is passed, the network side can obtain the relevant data of the terminal bound to the SIM card. If the access authentication fails, the network side cannot obtain the relevant data of the terminal bound to the SIM card, and the update processing of the KI value cannot be performed.

[0038] Step S220: If the KI value needs to be updated, the KI value is updated according to the IMEI of the terminal that the SIM card was previously bound to, to obtain the KI value to be verified.

[0039] Step S230: verify the KI value to be verified according to the authentication parameters received from the SIM card side.

[0040] Since the KI value cannot be sent down or uploaded, this embodiment uses an indirect method to verify the consistency of the KI value, for example, using the consistency verification method of the initial KI value in the prior art to verify the KI value to be verified.

[0041] Step S240, completing the final authentication of SIM card access according to the verification result and the SIM card status received from the SIM card side.

[0042] If the consistency verification passes and the SIM card received from the SIM card side is in a normal state, the terminal bound to the SIM card is allowed to access the network and obtain network services. If the consistency verification fails, or the SIM card received from the SIM card side is in an abnormal state, the terminal bound to the SIM card is not allowed to access the network and obtain network services, and the SIM card is disabled.

[0043] Depend on Figure 2As shown, after the SIM card passes the access authentication, it is also determined whether the KI value stored on the network side needs to be updated. When it is determined that the KI value needs to be updated, the KI value is updated according to the IMEI of the terminal that the SIM card was once bound to, and the consistency of the updated KI value is judged. Based on the KI value update and the KI value consistency judgment, the access authentication of the SIM card is improved, so that the terminal bound to the illegal SIM card cannot access the network, thereby improving the user experience. In some embodiments, an IMEI sequence is stored in the SIM card, and the IMEI of the terminal that was once bound to the SIM card is stored through the IMEI sequence. Similarly, an IMEI sequence is stored on the network side. In this embodiment, the IMEI sequence is stored in the ARPF on the network side, and the IMEI of the terminal that was once bound to the SIM card is stored through the sequence. The two IMEI sequences have the same storage method for the IMEI of the terminal that was once bound to the SIM card, so that the KI value obtained by the SIM card side based on the IMEI update in the IMEI-1 sequence and the KI value obtained by the network side based on the IMEI update in the IMEI-2 sequence can meet the consistency requirement. Here, in order to distinguish the two IMEI sequences, the IMEI sequence stored in the SIM card is abbreviated as the IMEI-1 sequence, and the IMEI sequence stored on the network side is abbreviated as the IMEI-2 sequence.

[0044] Therefore, this embodiment matches the IMEI of the terminal bound to the SIM card with the IMEI-1 sequence stored in the SIM card, that is, determines whether the IMEI of the terminal bound to the SIM card exists in the IMEI-1 sequence. If so, the match is successful. At this time, it is determined that the KI value stored on the SIM card side does not need to be updated. If not, the match is unsuccessful. At this time, it is determined that the KI value stored on the SIM card side needs to be updated.

[0045] Similarly, the IMEI of the bound terminal is matched with the IMEI-2 sequence stored on the network side, that is, it is determined whether the IMEI of the terminal bound to the SIM card exists in the IMEI-2 sequence. If so, the match is successful, and at this time, it is determined that the KI value stored on the network side does not need to be updated; if not, the match is unsuccessful, and at this time, it is determined that the KI value stored on the network side needs to be updated.

[0046] It should be noted that this embodiment considers that the first terminal bound to the SIM card after leaving the factory is legal. After the SIM card is bound to the first terminal and the authentication process is completed based on the initial KI value, the IMEI of the first terminal is written into the IMEI-1 sequence and the IMEI-2 sequence respectively. In this way, after the SIM card is replaced with a terminal, the KI value can be updated based on the IMEI sequence.

[0047] As mentioned above, the access authentication of the SIM card is based on the current KI value, that is, the first access authorization of the SIM card after leaving the factory is based on the initial KI value. Each subsequent legal replacement of the terminal will update the KI value, and the access authentication of the SIM card thereafter will be based on the updated KI value. Figure 3 , Figure 3 The UE is the SIM card side, AMF (Access and Mobility Management Function, Access and Mobility Management Function) / SEAF (Security Anchor Function, Security Anchor Function), AUSF (Authentication Server Function, Authentication Service Function), UDM (Unified Data Management, Unified Data Management) / ARPF (Authentication credential Repository and Processing Function, Authentication credential repository and processing function) is the network side, and the access authentication process of the SIM card is as follows:

[0048] UE initiates an Initial Registration Request to the gNB to request access to the network. The Initial Registration Request carries SUCI (Subscription Concealed Identifier) ​​or GUTI (Globally Unique Temporary UE Identity). The gNB forwards the received Initial Registration Request to the SEAF of the core network. After receiving the request, SEAF parses it to obtain GUTI or SUCI. If it is GUTI, it matches the corresponding SUPI (Subscription Permanent Identifier). If it is SUCI, it is not decrypted and continues to initiate an authentication application Nudm_UEAuthenticate_Get Request to AUSF. The Nudm_UEAuthenticate_Get Request carries the corresponding network service information SN-Name, which facilitates AUSF to call the corresponding AV (Authentication Vector). AUSF determines whether the UE is within the network service range by analyzing the SN-Name and saves the network service information required by the UE. Then, it continues to forward the SUCI or SUPI and SN-Name to UDM. SIDF (Subscription Permanent Identifier) ​​is called in UDM. The SUCI is decrypted by the user identifier de-concealing function to obtain the SUPI, and then the AV required by the terminal is configured through the SUPI.

[0049] The generation process of AV includes: UDM / ARPF generates RAND, uses KI corresponding to SUPI to generate XRES, CK, IK, generates MAC-A according to RAND, SQNHE, KI and AMF (Access and Mobility Management Function, Authentication Management Field), and obtains AUTN according to MAC-A, SQNHE, AK and AMF (Authentication Management Field, Authentication Management Field). RAND, XRES, CK, IK and AUTN form an authentication quintuple, and UDM / ARPF returns a response Nudm_UEAuthenticate_Get Response to AUSF, which carries the authentication quintuple. AUSF saves the authentication quintuple and calculates the secret key parameters, generates an authentication response Nausf_UEAuthenticate_Authentication Response carrying the secret key parameters and sends it to AMF, and AUSF also calculates the secret key parameters XRES according to AV.

[0050] AMF generates an authentication request and sends it to the UE. The UE parses the key parameters RAND and AUTN from the received Authentication Request, and performs verification based on RAND and AUTN. Specifically, MAC-A is calculated based on the KI value stored locally in the UE and the SQN in the parsed RAND and AUTN, and the MAC-A is compared with the MAC-A extracted from the received AUTN for consistency. If they are consistent, the UE passes the network side authentication. At this time, a RES value is calculated using RAND and KI, and an Authentication Response carrying the RES value is sent to AMF. After performing the corresponding operation, AMF sends Nausf_UEAuthentication_Authentication Request to AUSF. AUSF will verify the consistency between the received RES and the previously calculated XRES. If they are consistent, the network side authentication is passed.

[0051] After the bilateral authentication is passed, if it is determined that the KI value needs to be updated, the IMEI of the previous terminal bound to the SIM card is obtained from the IMEI-1 sequence, and the KI value is updated with the IMEI of the previous terminal as the keyword to obtain the KI value to be verified on the SIM card side, and the IMEI of the previous terminal bound to the SIM card is obtained from the IMEI-2 sequence, and the KI value is updated with the IMEI of the previous terminal as the keyword to obtain the KI value to be verified on the network side. Here, the digest algorithm can be used to calculate the KI value to be verified.

[0052] It should be noted that in this embodiment, the IMEI of the previous terminal bound to the SIM card is used as the keyword to update the KI value. In some scenarios, the IMEI of any terminal to which the SIM card has been bound or a combination of the IMEIs of multiple terminals can obviously be used as the keyword to update the KI value, as long as the IMEI of the terminal to which the SIM card has been bound is used as the keyword to update the KI value.

[0053] After obtaining the KI value to be verified, the consistency verification process on the SIM card side includes: calculating a message authentication code based on the KI value to be verified on the SIM card side and the authentication parameters received from the network side, and performing consistency verification on the message authentication code and the message authentication code parsed from the authentication parameters received from the network side. If the two message authentication codes are equal, the SIM card side passes the consistency verification, and if the two message authentication codes are not equal, the SIM card side fails the consistency verification. After the KI value to be verified on the SIM card side passes the consistency verification, it is determined that the SIM card is in a normal state, and at this time, the KI value stored on the SIM card side is updated to the KI value to be verified, and the IMEI of the terminal bound to the SIM card is written into the IMEI-1 sequence.

[0054] The consistency verification process on the network side includes: calculating the message check code based on the KI value to be verified on the network side, and performing consistency verification on the message check code and the message check code obtained from the authentication parameters received from the SIM card side. If the two message check codes are equal, the network side passes the consistency verification; if the two message check codes are not equal, the network side fails the consistency verification.

[0055] If the KI value to be verified on the network side passes the consistency verification, and the SIM card received from the SIM card side is in a normal state, the KI value stored on the network side is updated to the KI value to be verified, the IMEI of the terminal bound to the SIM card obtained by the network side is written into the IMEI-2 sequence, and the terminal bound to the SIM card is allowed to access the network; if the KI value to be verified on the network side fails to pass the consistency verification, or the SIM card received from the SIM card side is in an abnormal state, the KI value stored on the network side is not updated, the IMEI of the terminal bound to the SIM card obtained is not written into the IMEI-2 sequence, the terminal bound to the SIM card is prohibited from accessing the network, and the SIM card is locked.

[0056] The following combination Figure 4 The consistency verification process of the KI value to be verified in this embodiment is described in detail:

[0057] After passing the access authentication, the UE side obtains the IMEI of the terminal currently bound to the SIM card. If the IMEI exists in the IMEI-1 queue, the SIM card status is recorded as not updated. If the IMEI does not exist in the IMEI-1 queue, the SIM card status is recorded as updated.

[0058] Next execute Figure 4 The consistency verification process shown is as follows: the AMF / SEAF on the network side initiates the user equipment representation request identity request to obtain the terminal's IMEI. The UE side, i.e., the SIM card side, returns the IMEI of the terminal currently bound to the SIM to the UDM / ARPF on the network side. The UDM / ARPF compares whether the IMEI is stored in the IMEI-2 queue. If not, the KI is updated with the received IMEI as the keyword to obtain the KI value to be verified, and an authentication quintuple is generated based on the KI value to be verified. An AV is generated based on the authentication quintuple. The AV includes RAND, AUTX, XRES, and Kause. The UDM / ARPF sends the authentication information of the KI value to be verified to the UE side. Parameters, the UE side reads the SIM card status. If the SIM card status is updated, the IMEI of the terminal currently bound to the SIM card is used as the keyword to update the KI value. The updated KI, the received authentication parameter RAND and the SQNHE in AUTN are used to generate MAC-A. Then, the MAC-A generated by itself is compared with the MAC-A parsed from AUTN. If they are equal, the consistency verification on the UE side is completed. At this time, the IMEI of the currently bound terminal can be written into the IMEI-1 queue, and the original KI value stored in the SIM card is replaced with the temporarily stored KI value to be verified.

[0059] The UE side also returns the authentication result to the UDM / ARPF on the network side. The authentication result carries the authentication parameter RES. The UDM / ARPF compares the XRES generated by itself with the received RES. If they are equal, the consistency verification on the network side is completed. At this time, the received IMEI is written into the IMEI-2 queue, and the temporary stored KI value to be verified is used to replace the original KI value stored on the network side. If they are not equal, the temporary stored IMEI and the KI value to be verified are cleared, the UE's network connection is disconnected, and the SIM card is locked to make it unavailable.

[0060] It should be noted that the above-mentioned embodiment of the present application is that after the consistency verification of the KI value to be verified is completed on the SIM card side, the KI value stored on the SIM card side is updated to the KI value to be verified, and the IMEI of the currently bound terminal is written into the IMEI-1 sequence, and the above-mentioned embodiment is that after the consistency verification of the KI value to be verified is completed on the network side, the KI value stored on the network side is updated to the KI value to be verified, and the IMEI of the currently bound terminal is written into the IMEI-2 sequence.

[0061] In some embodiments, after both the SIM card side and the network side complete the consistency verification of the KI value to be verified, that is, after both the SIM card side and the network side pass the consistency verification, the KI value stored on the SIM card side may be updated to the KI value to be verified, the KI value stored on the network side may be updated to the KI value to be verified, and the IMEI of the currently bound terminal may be written into the IMEI-1 sequence, and the IMEI of the currently bound terminal may be written into the IMEI-2 sequence.

[0062] In summary, the method of this embodiment has at least the following advantages:

[0063] First, an IMEI sequence is stored in advance on the SIM card side and the network side respectively. Both sides decide whether to update the KI value based on whether the IMEI already exists in the IMEI queue. This allows the KI value to be automatically updated without manual intervention.

[0064] Second, the actual binding between the SIM card and the actual terminal is completed by storing the IMEI queue in the SIM card. Once the SIM terminal is replaced, the KI value update is triggered, and the KI value update requires the IMEI of the bound terminal as a keyword. Even if the cloned card obtains the initial KI, it cannot obtain the IMEI sequence, and the normal update of the KI value cannot be completed, and the terminal cannot be connected to the network, avoiding the cloned card network access affecting the operator's service quality and user experience.

[0065] Third, the signaling used in the KI value update process of this embodiment, such as Registration Request, Authentication Request, Authentication Response, identity request and other signaling, are all existing signaling in the existing communication system and do not involve changes to the terminal and base station services. In other words, the method of this embodiment is easier to implement, has a low implementation cost, and a simple implementation method.

[0066] Figure 5 The structural block diagram of the authentication device applied to the SIM card side shown in the embodiment of the present application is as follows: Figure 5 As shown, the authentication device 500 of this embodiment includes:

[0067] The first judgment unit 510 is used to judge whether the KI value stored on the SIM card side needs to be updated according to the IMEI of the terminal bound to the SIM card during SIM card access authentication;

[0068] The first updating unit 520 is used to update the KI value according to the IMEI of the terminal that the SIM card was once bound to if the KI value needs to be updated, so as to obtain the KI value to be verified;

[0069] A first verification unit 530, configured to verify the KI value to be verified according to the authentication parameters received from the network side;

[0070] The first authentication unit 540 is used to determine the SIM card status according to the verification result and complete the final authentication according to the SIM card status.

[0071] In some embodiments, the first judgment unit 510 is also used to match the IMEI of the bound terminal with the IMEI sequence stored in the SIM card. If the match is successful, it is determined that the KI value stored on the SIM card side does not need to be updated; if the match is unsuccessful, it is determined that the KI value stored on the SIM card side needs to be updated.

[0072] In some embodiments, if the KI value needs to be updated, the first updating unit 520 is further configured to obtain the IMEI of the previous terminal bound to the SIM card from the IMEI sequence, update the KI value using the IMEI of the previous terminal as a keyword, and obtain the KI value to be verified.

[0073] In some embodiments, the first verification unit 530 is also used to calculate a message authentication code based on the KI value to be verified and the authentication parameters; perform consistency verification on the message authentication code and the message authentication code parsed from the authentication parameters; if the two message authentication codes are equal, the consistency verification passes; if the two message authentication codes are not equal, the consistency verification fails.

[0074] In some embodiments, the first authentication unit 540 is also used to, if the consistency verification is passed, determine that the SIM card is in a normal state, update the KI value stored on the SIM card side to the KI value to be verified, and write the IMEI of the terminal bound to the SIM card into the IMEI sequence; if the consistency verification is not passed, determine that the SIM card is in an abnormal state, do not update the KI value stored on the SIM card side to the KI value to be verified, and do not write the IMEI of the terminal bound to the SIM card into the IMEI sequence; send the SIM card status to the network side.

[0075] Figure 6 The structural block diagram of the authentication device applied to the network side is shown in the embodiment of the present application, such as Figure 6 As shown, the authentication device 600 of this embodiment includes:

[0076] The second judgment unit 610 is used to judge whether the KI value stored on the network side needs to be updated according to the IMEI of the terminal bound to the SIM card after the SIM card passes the access authentication;

[0077] The second updating unit 620 is used to update the KI value according to the IMEI of the terminal that the SIM card was once bound to if the KI value needs to be updated, so as to obtain the KI value to be verified;

[0078] The second verification unit 630 is used to verify the KI value to be verified according to the authentication parameters received from the SIM card side;

[0079] The second authentication unit 640 is used to complete the final authentication of SIM card access according to the verification result and the SIM card status received from the SIM card side.

[0080] In some embodiments, the second judgment unit 610 is also used to obtain the IMEI of the terminal bound to the SIM card, and match the obtained IMEI with the IMEI sequence stored on the network side. If the match is successful, it is determined that the KI value stored on the network side does not need to be updated; if the match is unsuccessful, it is determined that the KI value stored on the network side needs to be updated.

[0081] In some embodiments, if the KI value needs to be updated, the second updating unit 620 is further configured to obtain the IMEI of the previous terminal bound to the SIM card from the IMEI sequence, update the KI value using the IMEI of the previous terminal as a keyword, and obtain the KI value to be verified.

[0082] In some embodiments, the second verification unit 630 is also used on the network side to calculate a message check code based on the KI value to be verified, and to perform consistency verification on the message check code and the message check code obtained from the authentication parameters. If the two message check codes are equal, the consistency verification passes; if the two message check codes are not equal, the consistency verification fails.

[0083] In some embodiments, if the verification passes and the SIM card is received from the SIM card side and is in a normal state, the second authentication unit 640 is also used to update the KI value stored on the network side to the KI value to be verified, write the IMEI of the terminal bound to the acquired SIM card into the IMEI sequence, and allow the terminal bound to the SIM card to access the network; if the verification fails, or the SIM card is received from the SIM card side and is in an abnormal state, the KI value stored on the network side is not updated, the IMEI of the terminal bound to the acquired SIM card is not written into the IMEI sequence, the terminal bound to the SIM card is prohibited from accessing the network, and the SIM card is locked.

[0084] It can be understood that the above-mentioned authentication device can implement each step of the authentication method provided in the above-mentioned embodiment, and the relevant explanations about the authentication method are applicable to the authentication device and will not be repeated here.

[0085] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, devices, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0090] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0091] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0093] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0094] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An authentication method for a communication system, characterized in that: Applied to the SIM card side, the SIM card stores an IMEI sequence, and the IMEI of the terminal that the SIM card has been bound to is stored through the IMEI sequence. The method includes: During SIM card access authentication, it is determined whether the KI value stored on the SIM card side needs to be updated according to the IMEI of the terminal bound to the SIM card. Specifically, the IMEI of the bound terminal is matched with the IMEI sequence stored in the SIM card. If the match is successful, it is determined that the KI value stored on the SIM card side does not need to be updated. If the match is unsuccessful, it is determined that the KI value stored on the SIM card side needs to be updated. If the KI value needs to be updated, update the KI value according to the IMEI of the terminal that the SIM card was previously bound to, and obtain the KI value to be verified; Verify the KI value to be verified based on the authentication parameters received from the network side; The SIM card status is determined based on the verification result, and the final authentication is completed based on the SIM card status.

2. The method according to claim 1, characterized in that: If the KI value needs to be updated, update the KI value according to the IMEI of the terminal that the SIM card was previously bound to, and obtain the KI value to be verified, including: The IMEI of the last terminal bound to the SIM card is obtained from the IMEI sequence, and the KI value is updated by taking the IMEI of the last terminal as a keyword to obtain the KI value to be verified.

3. The method according to claim 2, characterized in that: Verify the KI value to be verified based on the authentication parameters received from the network side, including: Calculate a message authentication code based on the KI value to be verified and the authentication parameters; Performing consistency verification on the message authentication code and the message authentication code parsed from the authentication parameters; If the two message authentication codes are equal, the consistency verification is passed. If the two message authentication codes are not equal, the consistency verification is failed.

4. The method according to claim 3, characterized in that: Determine the SIM card status based on the verification result, and complete the final authentication based on the SIM card status, including: If the consistency verification is passed, it is determined that the SIM card is in a normal state, the KI value stored on the SIM card side is updated to the KI value to be verified, and the IMEI of the terminal bound to the SIM card is written into the IMEI sequence; If the consistency verification fails, it is determined that the SIM card is in an abnormal state, the KI value stored on the SIM card side is not updated to the KI value to be verified, and the IMEI of the terminal bound to the SIM card is not written into the IMEI sequence; The SIM card status is sent to the network side.

5. An authentication method for a communication system, characterized in that: Applied to the network side, the network side stores an IMEI sequence, and uses the sequence to store the IMEI of the terminal that the SIM card has been bound to. The method includes: After the SIM card passes the access authentication, it is determined whether the KI value stored on the network side needs to be updated according to the IMEI of the terminal bound to the SIM card. Specifically, the IMEI of the terminal bound to the SIM card is obtained, and the obtained IMEI is matched with the IMEI sequence stored on the network side. If the match is successful, it is determined that the KI value stored on the network side does not need to be updated. If the match is unsuccessful, it is determined that the KI value stored on the network side needs to be updated. If the KI value needs to be updated, update the KI value according to the IMEI of the terminal that the SIM card was previously bound to, and obtain the KI value to be verified; Verify the KI value to be verified based on the authentication parameters received from the SIM card side; According to the verification result and the SIM card status received from the SIM card side, the final authentication of SIM card access is completed.

6. The method according to claim 5, characterized in that If the KI value needs to be updated, update the KI value according to the IMEI of the terminal that the SIM card was previously bound to, and obtain the KI value to be verified, including: The IMEI of the last terminal bound to the SIM card is obtained from the IMEI sequence, and the KI value is updated by taking the IMEI of the last terminal as a keyword to obtain the KI value to be verified.

7. The method according to claim 6, characterized in that Verify the KI value to be verified based on the authentication parameters received from the SIM card side, including: The network side calculates the message check code based on the KI value to be verified; Verify the consistency of the message check code with the message check code obtained from the authentication parameters; If the two message check codes are equal, the consistency verification is passed. If the two message check codes are not equal, the consistency verification fails.

8. The method according to claim 7, characterized in that: According to the verification result and the SIM card status received from the SIM card side, the final authentication of SIM card access is completed, including: If the verification is successful and the SIM card received from the SIM card side is in normal state, the KI value stored on the network side is updated to the KI value to be verified, the IMEI of the terminal bound to the obtained SIM card is written into the IMEI sequence, and the terminal bound to the SIM card is allowed to access the network; If the verification fails, or the SIM card is in an abnormal state, the KI value stored on the network side will not be updated, the IMEI of the terminal bound to the SIM card will not be written into the IMEI sequence, the terminal bound to the SIM card will be prohibited from accessing the network, and the SIM card will be locked.

9. An authentication device for a communication system, characterized in that: Applied to the SIM card side, the SIM card stores an IMEI sequence, and the IMEI of the terminal that the SIM card has been bound to is stored through the IMEI sequence. The device includes: The first judgment unit is used to judge whether the KI value stored on the SIM card side needs to be updated according to the IMEI of the terminal bound to the SIM card when the SIM card is accessed and authenticated; it is also used to match the IMEI of the bound terminal with the IMEI sequence stored in the SIM card, if the match is successful, it is judged that the KI value stored on the SIM card side does not need to be updated, if the match is unsuccessful, it is judged that the KI value stored on the SIM card side needs to be updated' The first updating unit is used to update the KI value according to the IMEI of the terminal that the SIM card was once bound to if the KI value needs to be updated, so as to obtain the KI value to be verified; A first verification unit, configured to verify the KI value to be verified according to the authentication parameters received from the network side; The first authentication unit is used to determine the SIM card status according to the verification result and complete the final authentication according to the SIM card status.

10. An authentication device for a communication system, characterized in that: Applied to the network side, the network side stores an IMEI sequence, and uses the sequence to store the IMEI of the terminal that the SIM card has been bound to. The device includes: The second judgment unit is used to judge whether the KI value stored on the network side needs to be updated according to the IMEI of the terminal bound to the SIM card after the SIM card passes the access authentication; it is also used to obtain the IMEI of the terminal bound to the SIM card, and match the obtained IMEI with the IMEI sequence stored on the network side. If the match is successful, it is judged that the KI value stored on the network side does not need to be updated; if the match is unsuccessful, it is judged that the KI value stored on the network side needs to be updated; The second updating unit is used to update the KI value according to the IMEI of the terminal that the SIM card was once bound to if the KI value needs to be updated, so as to obtain the KI value to be verified; A second verification unit, used to verify the KI value to be verified according to the authentication parameters received from the SIM card side; The second authentication unit is used to complete the final authentication of the SIM card access according to the verification result and the SIM card status received from the SIM card side.

Images