An improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency

Abstract

The present invention discloses an improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency. In this mechanism, the UE and HSS share key generation functions f3, f4 and f5 and message authentication function H1; the UE and S-CSCF share key generation functions f3', f4' and message authentication function H2; the HSS and S-CSCF share key K HS The UE and HSS each generate random numbers; the system clock is synchronized; the UE trusts its own HSS; and based on this, UE registration authentication and key negotiation, as well as service authentication and key negotiation, are implemented. This prevents fake base station attacks, fake user access, replay attacks, man-in-the-middle attacks, shared key leaks, and fake users gaining access to encrypted communications, saving network overhead.

Description

Technical Field

[0001] The present invention belongs to the field of emerging information technology, and specifically relates to an improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency. Background Art

[0002] The IMS access security mechanism in the 5G messaging service has two major tasks: one is to authenticate the access user; the other is to establish an IPSec security association (IPSecSA) between the UE and the P-CSCF after the authentication is completed to provide security protection for subsequent SIP signaling interactions.

[0003] The IMS-AKA mechanism is primarily used for user authentication and session key distribution. During IMS registration, SIP signaling carrying AKA parameters is exchanged between the UE and the IMS network authentication entity. AKA parameters are transmitted and negotiated according to the AKA mechanism, thereby enabling access authentication and key negotiation.

[0004] In actual applications, the IMS-AKA mechanism exposes the following security vulnerabilities:

[0005] (1) Although the security keys negotiated between the UE and the P-CSCF through the AKA mechanism can be used to encrypt and protect the integrity of SIP signaling, the initial registration request message is sent before the security keys have been negotiated. An attacker can easily obtain the user's registration information, thereby leaking user privacy.

[0006] (2) When registering with the IMS network, at least two registration requests must be sent. The SIP interaction between the user and the network is too cumbersome, and the authentication header field carried by the SIP message contains numerous AKA parameters, which significantly increases the length of the SIP message. Due to network bandwidth limitations, transmission delays will be very significant, and the time it takes for users to access the network through registration will be relatively long, affecting the user experience.

[0007] (3) During the AKA-based access authentication process, the UE does not authenticate the identity of the P-CSCF, the access point of the IMS core network, which provides attackers with an opportunity to impersonate a middleman and launch an attack.

[0008] To address the above issues, it is necessary to study an improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to address the shortcomings of the above-mentioned existing technologies and, based on the system architecture of international standard 5G message terminal access authentication, provide an improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency.

[0010] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0011] An improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency. In this mechanism,

[0012] (1) The UE and HSS share key generation functions f3, f4, and f5 and message authentication function H1; the UE and S-CSCF share key generation functions f3', f4' and message authentication function H2; the HSS and S-CSCF share key K HS ;

[0013] (2) The UE and HSS each generate a random number;

[0014] (3) System clock synchronization;

[0015] (4) UE trusts its own HSS;

[0016] Wherein, f3 is the key generation function for calculating the encryption key CK; f4 is the key generation function for calculating the integrity protection key IK; f5 is the key generation function for calculating the anonymity key AK;

[0017] H1 is the UE's authentication function for the registration message; H2 is the S-CSCF's authentication function for the response message;

[0018] f3' is the generation function of the iterative encryption key CK; f4' is the generation function of the iterative integrity protection key IK;

[0019] Based on the above (1)-(4), UE registration authentication and key negotiation as well as service authentication and key negotiation are implemented.

[0020] To optimize the above technical solutions, specific measures taken also include:

[0021] The above-mentioned UE registration authentication and key agreement apply Hash function chain and timestamp to implement registration authentication and key agreement.

[0022] The above UE registration authentication and key agreement process is as follows:

[0023] (1)UE initiates registration, ME sends registration message MSG U and message authentication code MAC U ;

[0024] MSG U =E(K i-l ,R U )||TMPI i-1 ||f n (R U)||A1{A1,A2,...,Ar}

[0025] MAC U =H l (K i-l ,IMPI||MSG U )

[0026] Where E is a single-key encryption function;

[0027] R U The old shared key K i-l Encrypted random number;

[0028] TMPI i-1 For the old temporary user ID;

[0029] f n (R U ) is an n-order Hash function, where n is the maximum number of times a service can be applied for after a successful registration;

[0030] {A1,A2,...,Ar} and A1 are the set of r alternative encryption algorithms and the algorithm selected by the user respectively.

[0031] (2) S-CSCF receives the UE's registration information and leaves f n (R U ), according to TMPI i-l MSG U Add timestampV1 and MAC at the end U Forwarded together to the UE's home network HSS;

[0032] (3)HSS receives MSG U and MAC U , according to TMPI i-l Get the stored IMPI and decrypt it to get R U ;

[0033] Calculate XMAC U , check XMAC U and MAC U If they are consistent, check whether timestampV1 is valid. If it is valid, HSS authenticates UE successfully. If not, resynchronize the system clock and re-initiate registration.

[0034] After successful registration, HSS will select a random number R H , decide whether to agree with the encryption algorithm A1 selected by the UE, if not agree, select an encryption algorithm A from the given alternative encryption algorithms as the encryption algorithm A used for this registration i ; Generate new TMPI i , generate a new key Ki =E(K i-1 ,R U R H ), and use R H and K i Generate CK, IK and AK; use the shared key K of HSS and S-CSCF HS Encryption E(Ki,R U ); then register the response message MSG H Send back to S-CSCF;

[0035] MSG H =R H ||AK||TMPI i ||A i ||E(K HS ,E(K i ,R U ))||CK||IK||E(K i ,R H ))

[0036] (4) S-CSCF receives the response information returned by HSS and decrypts it to obtain E(K i ,R U )、E(K i ,R H ), leaving AK, E (K i ,R H ), TMPI i , generate a random number R S , calculate f n (R S ); put MSG S , MAC S Send to UE;

[0037] MSG S =R H ||TMPI i ||A i ||f n (R S )||E(K i ,R U )||CK||IK||timestampV2

[0038] MAC S =H2(AK,MSG S )

[0039] (5) S-CSCF sends MSG S , MAC S Sent to the I-CSCF in the SIP response, which forwards it to the P-CSCF;

[0040] After receiving the SIP response, the P-CSCF saves the CK and IK and forwards the rest to the UE;

[0041] MSG P =R H ||TMPI i ||A i ||f n (R S )||E(K i ,R U )timestampV2

[0042] MAC P =H2(AK,MSG P )

[0043] (6)UE receives MSG P , MAC P , using R H and K i Generate CK, IK, AK, and calculate XMAC S and E(K i ,R H );

[0044] Verification and MAC S Is it consistent? Use K i Decryption E(K i ,R H ), test R U Check whether it is the random number selected at the beginning; check the legitimacy of the timestamp. If all pass, the UE successfully authenticates the S-CSCF and the UE leaves the TMPI i As the temporary user identity for this registration, accept the algorithm A selected by HSS i Used as encryption algorithm for business data transmission;

[0045] At the same time, RES is sent to S-CSCF;

[0046] RES=E(K i ,R H )

[0047] (7) Check XRES=E(K i ,R H ) is consistent with RES. If they are consistent, the S-CSCF authenticates the UE successfully.

[0048] The above service authentication and key negotiation process is as follows:

[0049] After the registration and authentication is successful, when the UE needs to carry out the i-th service communication, the S-CSCF sends f n-i (R S), ME checks f(f n-i (R S )) Is it the same as the last f stored previously? n-(i-1) (R S ) are the same, if they are the same, the identity of the S-CSCF is confirmed, the S-CSCF is legal, and f is sent to the S-CSCF. n-i (R U );

[0050] The S-CSCF also verifies the legitimacy of the UE. If it is legitimate, two-way authentication is achieved, a success flag is sent to the UE, and the encryption and integrity keys CK required for this service communication are generated. i , IK i ;

[0051] After receiving the success flag, UE also starts to generate CK i , IK i , ready for business communications.

[0052] CK i =f3'(CK,f n-i (R U ));

[0053] IK i =f4'(IK,f n-i (R U )).

[0054] When the number of services reaches the upper limit n of the Hash function chain, the user needs to re-register and authenticate with the S-CSCF and HSS when applying for services, and update the key shared with the HSS.

[0055] The present invention has the following beneficial effects:

[0056] (1) Implement HSS authentication of UE and bidirectional authentication of UE and S-CSCF, thus avoiding fake base station attacks and fake users entering the network. Hash function chain and timestamp are applied in the authentication process to avoid replay attacks; IMPI and random number R used to generate encryption key are not transmitted in plain text. U , avoiding man-in-the-middle attacks.

[0057] (2) The shared key between UE and HSS is updated every time the user registers, which avoids the leakage of the shared key; the encryption algorithm is determined by free negotiation, which covers the encryption algorithm selection function.

[0058] (3) CK and IK are not transmitted in plain text, preventing fake users from enjoying encrypted communications.

[0059] (4) After each user successfully registers and authenticates for network access, service authentication does not require the participation of the HSS, saving network overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a registration and authentication flow chart of the present invention;

[0061] Figure 2 This is a flow chart of service authentication and key negotiation in the present invention. DETAILED DESCRIPTION

[0062] The embodiments of the present invention are described in further detail below with reference to the accompanying drawings.

[0063] The present invention provides an improved 5G message RCS access authentication IMS-AKA mechanism that balances security and efficiency, and its prerequisites include:

[0064] (1) The UE and HSS share key generation functions f3, f4, and f5, and message authentication function H1;

[0065] The UE and S-CSCF share key generation functions f3', f4' and message authentication function H2;

[0066] HSS and S-CSCF share the key K HS .

[0067] (2) The UE and HSS each generate a random number.

[0068] (3) System clock synchronization;

[0069] (4) The UE trusts its own HSS.

[0070] Wherein, f3 is the key generation function for calculating the encryption key CK; f4 is the key generation function for calculating the integrity protection key IK; f5 is the key generation function for calculating the anonymity key AK;

[0071] H1 is the UE's authentication function for the registration message; H2 is the S-CSCF's authentication function for the response message;

[0072] f3' is the generation function of the iterative encryption key CK; f4' is the generation function of the iterative integrity protection key IK;

[0073] Based on the above (1)-(4), UE registration authentication and key negotiation as well as service authentication and key negotiation can be realized.

[0074] UE registration authentication and key negotiation:

[0075] The introduced f is an iterable Hash function with a maximum number of iterations of n; E is a single-key encryption function.

[0076] The specific process is as follows Figure 1 As shown:

[0077] (1) UE initiates registration and generates a registration message MSG U ,

[0078] MSG U include:

[0079] Use the old shared key K i-l Encrypted random number R U , old temporary user identity TMPI i-1 ;

[0080] Hash function f n (R U ), where n is the maximum number of times you can apply for services after a successful registration, which may depend on the specific situation of the system;

[0081] A set of r alternative encryption algorithms {A1, A2, ..., Ar} and the algorithm A1 selected by the user.

[0082] Specifically:

[0083] ME sends MSG U and message authentication code MAC U .

[0084] Among them, MSG U =E(K i-l ,R U )||TMPI i-1 ||f n (R U )||A1{A1,A2,...,Ar}

[0085] MAC U =H l (K i-l ,IMPI||MSG U )

[0086] (2) S-CSCF receives the UE's registration information and leaves f n (R U ), according to TMPI i-l MSG U Add timestampV1 and MAC at the end U Forward it to its home network HSS;

[0087] (3)HSS receives MSG U and MAC U , according to TMPI i-l Get the stored IMPI and decrypt it to get R U ;

[0088] Calculate XMAC U, check XMAC U and MAC U If the timestamp is valid, the HSS will authenticate the UE successfully. If it is not valid, the system clock will be resynchronized and registration will be initiated again.

[0089] After successful registration, HSS will select a random number R H , decide whether to agree with the encryption algorithm A1 selected by the UE, if not agree, select an encryption algorithm A from the given alternative encryption algorithms as the encryption algorithm A used for this registration i ; Generate new TMPI i , generate a new key K i =E(K i-1 ,R U R H ), and use R H and K i Generate CK, IK and AK; use the shared key K of HSS and S-CSCF HS Encryption E(Ki,R U ); then register the response message MSG H Send back to S-CSCF;

[0090] MSG H =R H ||AK||TMPI i ||A i ||E(K HS ,E(K i ,R U ))||CK||IK||E(K i ,R H ))

[0091] (4) S-CSCF receives the response information returned by HSS and decrypts it to obtain E(K i ,R U )、E(K i ,R H ), leaving AK, E (K i ,R H ), TMPI i , generate a random number R S , calculate f n (R S ); put MSG S , MAC S Send to UE;

[0092] MSG S =R H ||TMPI i ||A i ||f n(R S )||E(K i ,R U )||CK||IK||timestampV2

[0093] MAC S =H2(AK,MSG S )

[0094] (5) S-CSCF sends MSG S , MAC S Sent to the I-CSCF in the SIP response, which forwards it to the P-CSCF;

[0095] After receiving the SIP response, the P-CSCF saves the CK and IK and forwards the rest to the UE.

[0096] MSG P =R H ||TMPI i ||A i ||f n (R S )||E(K i ,R U )timestampV2

[0097] MAC P =H2(AK,MSG P )

[0098] (6)UE receives MSG P , MAC P , using R H and K i Generate CK, IK, AK, and calculate XMAC S and E(K i ,R H );

[0099] Verification and MAC S Is it consistent? Use K i Decryption E(K i ,R H ), test R U Check whether it is the random number selected at the beginning; check the legitimacy of the timestamp. If all pass, the UE successfully authenticates the S-CSCF and the UE leaves the TMPI i As the temporary user identity for this registration, accept the algorithm A selected by HSS i Used as encryption algorithm for business data transmission.

[0100] At the same time, RES is sent to S-CSCF.

[0101] RES=E(Ki ,R H )

[0102] (7) Check XRES=E(K i ,R H ) is consistent with RES. If they are consistent, the S-CSCF authenticates the UE successfully.

[0103] Service authentication and key negotiation:

[0104] After the registration and authentication is successful, when the UE needs to carry out the i-th service communication, the S-CSCF will send f n-i (R S ); ME needs to check f(f n-i (R S )) Is it the same as the last f stored previously? n-(i-1) (R S ) are the same, if they are the same, the identity of the S-CSCF is confirmed and f is sent to the S-CSCF n-i (R U ).

[0105] The S-CSCF also verifies the legitimacy of the UE. If it is legitimate, two-way authentication is achieved, a success flag is sent to the UE, and the encryption and integrity keys CK required for this service communication are generated. i , IK i ;

[0106] After receiving the success flag, UE also starts to generate CK i , IK i , ready for business communications. Figure 2 shown.

[0107] CK i =f3'(CK,f n-i (R U ));

[0108] IK i =f4'(IK,f n-i (R U )).

[0109] When the number of services reaches the upper limit n of the Hash function chain, the user needs to re-register and authenticate with the S-CSCF and HSS when applying for services, and update the key shared with the HSS.

[0110] Some abbreviations in the present invention are explained as follows:

[0111] UE: user;

[0112] P-CSCF: unified entry point for IMS visited networks;

[0113] I-CSCF: entry point to the IMS home network;

[0114] S-CSCF: IMS signaling plane core node location;

[0115] HSS: Home Subscriber Server, home subscriber server;

[0116] ME: Mobile device.

[0117] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. An improved 5G message RCS access authentication IMS-AKA method implements UE registration authentication and key negotiation as well as service authentication and key negotiation. UE registration authentication and key negotiation are implemented using a hash function chain and timestamp, including: (1) Synchronize system clock; The UE trusts its HSS; UE generates a random number, initiates registration, and sends a registration message MSG U and message authentication code MAC U ; <h2 style=";text-align:left;direction:ltr">MSG<h2 style=";text-align:left;direction:ltr"> U <h2 style=";text-align:left;direction:ltr"> (E(K<h2 style=";text-align:left;direction:ltr"> i-l <h2 style=";text-align:left;direction:ltr"> ,R<h2 style=";text-align:left;direction:ltr"> U <h2 style=";text-align:left;direction:ltr"> )||TMPI<h2 style=";text-align:left;direction:ltr"> i-1 <h2 style=";text-align:left;direction:ltr"> ||f<h2 style=";text-align:left;direction:ltr"> n <h2 style=";text-align:left;direction:ltr"> (R<h2 style=";text-align:left;direction:ltr"> U <h2 style=";text-align:left;direction:ltr"> )||A1{A1,A2,...,Ar} MAC U =H l (K i-l ,IMPI||MSG U ) Among them, E is the encryption function, using the old shared key K i-l Encrypted random number R U ; H1 is the UE's authentication function for the registration message; TMPI i-1 It is the old temporary user ID, and IMPI is the user's private ID; f n () is an n-order Hash function, where n is the maximum number of times a service can be applied for after a successful registration; {A1,A2,...,A r } and A1 are the set of r alternative encryption algorithms and the algorithm selected by the user, respectively; (2) S-CSCF receives the UE's registration message and leaves f n (R U ), according to TMPI i-l MSG U Add timestampV1 and MAC at the end U Forwarded together to the UE's home network HSS; (3)HSS receives MSG U and MAC U , according to TMPI i-l Get the stored IMPI and decrypt it to get R U ; Calculate XMAC U , check XMAC U and MAC U If they are consistent, check whether timestampV1 is valid. If it is valid, HSS authenticates UE successfully. If not, resynchronize the system clock and re-initiate registration. After successful registration, HSS selects a random number R H , decide whether to agree with the encryption algorithm A1 selected by the UE, if not agree, select an encryption algorithm A from the given alternative encryption algorithms as the encryption algorithm A used for this registration i , A i ∈{A1,A2,...,A r Generate a new TMPI i , generate a new key K i =E(K i-1 ,R U R H ), and use R H and K i Generate encryption key CK, integrity key IK and anonymity key AK; use the shared key K of HSS and S-CSCF HS Encryption E(Ki,R U ); then register the response message MSG H Send back to S-CSCF; MSG H =R H ||AK||TMPI i ||A i ||E(K HS ,E(K i ,R U ))||CK||IK||E(K i ,R H )) (4) S-CSCF receives the response information returned by HSS and decrypts it to obtain E(K i ,R U )、E(K i ,R H ), leaving AK, E (K i ,R H ), TMPI i , generate a random number R S , calculate f n (R S ); put MSG S , MAC S Send to UE; MSG S =R H ||TMPI i ||A i ||f n (R S )||E(K i ,R U )||CK||IK||timestampV2 MAC S =H2(AK,MSG S ), H2 is the authentication function of the S-CSCF for the response message; Where timestampV2 is the timestamp; (5) S-CSCF sends MSG S , MAC S Sent in a Session Initiation Protocol (SIP) response to the I-CSCF, which forwards it to the P-CSCF. After receiving the SIP response, the P-CSCF saves the CK and IK and forwards the rest to the UE; MSG P =R H ||TMPI i ||A i ||f n (R S )||E(K i ,R U )timestampV2 MAC P =H2(AK,MSG P ) (6)UE receives MSG P , MAC P , using R H and K i Generate CK, IK, AK, and calculate XMAC S and E(K i ,R H ); Verification and MAC S Is it consistent? Use K i Decryption E(K i ,R H ), test R U Check whether it is the random number selected at the beginning; check the legitimacy of the timestamp. If all pass, the UE successfully authenticates the S-CSCF and the UE leaves the TMPI i As the temporary user identity for this registration, accept the algorithm A selected by HSS i Used as encryption algorithm for business data transmission; At the same time, RES is sent to S-CSCF; RES=E(K i ,R H ) (7) S-CSCF checks XRES = E(K i ,R H ) is consistent with RES. If they are consistent, the S-CSCF authenticates the UE successfully.

2. An improved 5G message RCS access authentication IMS-AKA method according to claim 1, characterized in that: The service authentication and key negotiation process is as follows: After the registration and authentication is successful, when the UE needs to carry out the i-th service communication, the S-CSCF sends f n-i (R S ), UE checks f(f n-i (R S )) Is it the same as the last f stored previously? n-(i-1) (R S ) are the same, if they are the same, the identity of the S-CSCF is confirmed, the S-CSCF is legal, and f is sent to the S-CSCF. n-i (R U ); The S-CSCF also verifies the legitimacy of the UE. If it is legitimate, two-way authentication is achieved, a success flag is sent to the UE, and the encryption and integrity keys CK required for this service communication are generated. i , IK i ; After receiving the success flag, UE also starts to generate CK i , IK i , ready for business communications.

3. An improved 5G message RCS access authentication IMS-AKA method according to claim 2, characterized in that: CK i =f3 ’ (CK,f n-i (R U )), IK i =f4 ’ (IK,f n-i (R U )), where f3' is the generation function of the iterative encryption key CK; f4' is the generation function of the iterative integrity protection key IK.

4. The improved 5G message RCS access authentication IMS-AKA method according to claim 1, characterized in that: When the number of services reaches the upper limit n of the Hash function chain, the user needs to re-register and authenticate with the S-CSCF and HSS when applying for services, and update the key shared with the HSS.

Images