A user authentication method, UDM, message forwarding equipment and device

Abstract

The embodiment of the present invention provides a user authentication method, UDM, message forwarding equipment and device, which relates to the field of network technology and is applied to UDM. The method includes: after receiving an authentication message sent by a message forwarding device, based on the SUPI of the user equipment to be authenticated carried in the authentication message, searching for the SQN, root key K and preset AMF corresponding to the user equipment; updating the found SQN; based on the updated SQN, random number, root key K, AMF, calculating the basic authentication information for user authentication of the user equipment; based on the basic authentication information, calculating the authentication parameters using the user authentication method indicated by the authentication message; sending the authentication parameters to the message forwarding device so that the message forwarding device continues to complete the user authentication process based on the authentication parameters. The scheme provided by the embodiment of the present invention can reduce the complexity of the user authentication process.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a user authentication method, a UDM, and a message forwarding device and apparatus. Background Art

[0002] In order to determine whether the user equipment accessing the network can use the network for communication, the core network equipment needs to authenticate the user equipment. In the prior art, for 5G user equipment, the user equipment can be authenticated by UDM (Unified Data Management), AUSF (Authentication Server Function), and SEAF (Security Anchor Function) in the core network. For 4G user equipment, the user equipment can be authenticated by HSS (Home Subscriber Server) in the core network.

[0003] There are 4G user devices and 5G user devices in the current application scenarios. In order to perform user authentication for different user devices, the core network needs to configure different devices in the core network and use different methods to perform user authentication for different user devices. Therefore, the user authentication process in the existing technology is relatively complicated. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a user authentication method, UDM, message forwarding equipment and device to reduce the complexity of the user authentication process. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present invention provides a user authentication method, which is applied to UDM, and the method includes:

[0006] After receiving the authentication message sent by the message forwarding device, based on the SUPI of the user equipment to be authenticated carried in the authentication message, searching for the SQN, K and preset AMF corresponding to the user equipment;

[0007] Update the found SQN;

[0008] Calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF;

[0009] Based on the basic authentication information, calculating the authentication parameters using the user authentication method indicated by the authentication message;

[0010] The authentication parameter is sent to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

[0011] In a second aspect, an embodiment of the present invention provides a user authentication method, which is applied to a message forwarding device, and the method includes:

[0012] After acquiring the SUPI of the user equipment to be authenticated, sending an authentication message carrying the SUPI to the UDM, so that the UDM calculates an authentication parameter based on the SUPI, and sends the authentication parameter to the message forwarding device;

[0013] After receiving the authentication parameters sent by the UDM, the user authentication process is completed based on the authentication parameters.

[0014] In a third aspect, an embodiment of the present invention provides a UDM, including a memory, a transceiver, and a processor:

[0015] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0016] After receiving the authentication message sent by the message forwarding device, based on the SUPI of the user equipment to be authenticated carried in the authentication message, searching for the SQN, K and preset AMF corresponding to the user equipment;

[0017] Update the found SQN;

[0018] Calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF;

[0019] Based on the basic authentication information, calculating the authentication parameters using the user authentication method indicated by the authentication message;

[0020] The authentication parameter is sent to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

[0021] In a fourth aspect, an embodiment of the present invention provides a message forwarding device, including a memory, a transceiver, and a processor:

[0022] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0023] After acquiring the subscription permanent identity SUPI of the user equipment to be authenticated, sending an authentication message carrying the SUPI to a unified data management UDM, so that the UDM calculates an authentication parameter based on the SUPI, and sends the authentication parameter to the message forwarding device;

[0024] After receiving the authentication parameters sent by the UDM, the user authentication process is completed based on the authentication parameters.

[0025] In a fifth aspect, an embodiment of the present invention provides a user authentication device, applied to UDM, the device comprising:

[0026] An SQN search module is configured to search, after receiving an authentication message sent by a message forwarding device, an SQN, K and a preset AMF corresponding to the user equipment based on the SUPI of the user equipment to be authenticated carried in the authentication message;

[0027] SQN update module, used to update the found SQN;

[0028] An information calculation module, used to calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF;

[0029] A parameter calculation module, configured to calculate an authentication parameter based on the basic authentication information and using the user authentication method indicated by the authentication message;

[0030] The parameter sending module is used to send the authentication parameter to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

[0031] In a sixth aspect, an embodiment of the present invention provides a user authentication device, which is applied to a message forwarding device, and the device includes:

[0032] a message sending module, configured to, after acquiring a subscription permanent identity SUPI of the user equipment to be authenticated, send an authentication message carrying the SUPI to a unified data management UDM, so that the UDM calculates an authentication parameter based on the SUPI, and sends the authentication parameter to the message forwarding device;

[0033] The authentication module is used to complete the user authentication process based on the authentication parameters after receiving the authentication parameters sent by the UDM.

[0034] In a seventh aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of the first aspect or the second aspect are implemented.

[0035] In an eighth aspect, an embodiment of the present invention further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method steps described in any one of the first aspect or the second aspect.

[0036] Beneficial effects of the embodiments of the present invention:

[0037] The embodiment of the present invention provides a user authentication method, which is applied to UDM. After receiving the authentication message sent by the message forwarding device, the UDM searches for the SQN, root key K and preset AMF corresponding to the user device based on the SUPI of the user device to be authenticated carried in the authentication message, updates the found SQN, and then calculates the basic authentication message containing CK and IK based on the updated SQN, random number, root key K and AMF. Based on the basic authentication message, the authentication parameters are calculated using the user authentication method indicated by the authentication message, and the authentication parameters are sent to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameters.

[0038] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and a person skilled in the art can also obtain other drawings based on these drawings.

[0040] Figure 1 A schematic diagram of a flow chart of a first user authentication method provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of a flow chart of a second user authentication method provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of a flow chart of a third user authentication method provided by an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of a fourth user authentication method provided by an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of a fifth user authentication method provided by an embodiment of the present invention;

[0045] Figure 6 A schematic diagram of a sixth user authentication method provided by an embodiment of the present invention;

[0046] Figure 7 A schematic diagram of the structure of a UDM provided in an embodiment of the present invention;

[0047] Figure 8 A schematic diagram of the structure of a message forwarding device provided by an embodiment of the present invention;

[0048] Fig. 9 A schematic diagram of the structure of a first user authentication device provided by an embodiment of the present invention;

[0049] Fig.10 A schematic diagram of the structure of a second user authentication device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0051] In the embodiments of the present invention, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention belong to the scope of protection of the present invention.

[0053] Since the process of user authentication in the prior art is relatively complicated, in order to solve this problem, the embodiments of the present invention provide a user authentication method, UDM, and a message forwarding device and apparatus.

[0054] The embodiment of the present invention provides a user authentication method, which is applied to UDM. The method includes:

[0055] After receiving the authentication message sent by the message forwarding device, based on the SUPI of the user equipment to be authenticated carried in the authentication message, searching for the SQN, the root key K and the preset AMF corresponding to the user equipment;

[0056] Update the found SQN;

[0057] Based on the updated SQN, the random number, the root key K, and the AMF, calculate basic authentication information for user authentication of the user equipment;

[0058] Based on the above basic authentication information, the authentication parameters are calculated using the user authentication method indicated by the above authentication message;

[0059] The authentication parameters are sent to the message forwarding device so that the message forwarding device continues to complete the user authentication process based on the authentication parameters.

[0060] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0061] See also Figure 1 , which is a flow chart of a first user authentication method provided in an embodiment of the present invention, applied to UDM, and the method includes the following steps S101-S105.

[0062] S101: After receiving an authentication message sent by a message forwarding device, based on the SUPI of the user equipment to be authenticated carried in the authentication message, searching for the SQN, the root key K and the preset AMF corresponding to the user equipment.

[0063] The UDM and message forwarding device are both network-side devices included in the core network for user authentication. The SUPI (Subscription Permanent Identifier) ​​is a unique identifier of the user device, and different user devices have different SUPIs. Based on the unique SUPI of the user device, the SQN (Sequence Number) corresponding to the user device can be found from the correspondence table between the recorded SUPI and SQN.

[0064] In addition, the user equipment may send a user authentication request carrying its own SUPI to the message forwarding device to start the user authentication process. After extracting the SUPI from the user authentication request, the message forwarding device may send an authentication message carrying the SUPI to the UDM, so that the UDM continues to perform user authentication.

[0065] Furthermore, if the embodiment of the present invention is applied in a 5G core network, the message forwarding device may be a SEAF. If the embodiment of the present invention is applied in a 4G core network, the message forwarding device may be an MME (Mobility Management Entity).

[0066] In one embodiment of the present invention, if the user equipment is a 4G user equipment, the authentication message sent by the MME to the UDM may be a Diameter message sent based on the Diameter protocol. If the user equipment is a 5G user equipment, the authentication message sent by the SEAF to the UDM is a service-based message based on SBA (Service-based Architecture).

[0067] In addition, no matter what protocol the user equipment uses for data transmission, the authentication message sent by the message forwarding device to the UDM can be a service message. The UDM only needs to process the authentication message in a unified format to complete the user authentication process, thereby reducing the complexity of UDM in performing user authentication.

[0068] S102: Update the found SQN.

[0069] Among them, SQN is composed of an array value SEQ and an index number IND. Specifically, SQN=SEQ||IND, where || represents a series connection.

[0070] Specifically, the update of SQN may refer to 3GPP (3rd Generation Partnership Project) standards, which will not be described in detail here.

[0071] S103: Based on the updated SQN, the random number, the root key K, and the AMF, calculate basic authentication information for user authentication of the user equipment.

[0072] Among them, the above-mentioned basic authentication information may include: CK (Cipher Key) and IK (Integrity Key). In addition, the above-mentioned basic authentication information may also include: AUTN (Authentication token), Xres (Expected Response), MAC (Message Authentication Code), and AK (Anonymity Key).

[0073] Specifically, AUTN contains the information required for user authentication, which is used to transmit user authentication information to the user device during the subsequent user authentication process. Xres is the parameter expected to be responded by the user device, which is used to determine whether the user authentication is successful. CK is a 128-bit encryption key, IK is a 128-bit integrity key, and AK is a 48-bit anonymous key.

[0074] In addition, the above-mentioned AMF (Authentication Management Field) is a 16-bit identity authentication management field, K is a preset root key corresponding to the above-mentioned user equipment, which is a 128-bit user key, and the K corresponding to different user equipment may be the same or different.

[0075] Specifically, OPC can be calculated based on the preset configurable field OP and the above K, and the above basic authentication information can be calculated based on K and OPC. The above OP is a 128-bit field, and OPC can be calculated based on OPC and K through existing technology, which will not be repeated here.

[0076] In one embodiment of the present invention, the basic authentication information can be obtained by calculating through the MILENAGE algorithm.

[0077] The MAC may be calculated based on the K, AMF, the updated SQN and RAND (Random Challenge, random number). Specifically, the RAND is a random number generated by the UDM and unknown to the user equipment.

[0078] Xres, CK, IK and AK can be calculated based on the above K, OPC and RAND.

[0079] In addition, after calculating MAC, SQN and AK can be ANDed or ORed to obtain the calculation result, which is then connected in series with AMF and MAC to form AUTN.

[0080] Specifically, the above-mentioned MILENAGE algorithm belongs to the prior art and will not be described in detail here.

[0081] Furthermore, the obtained RAND, Xres, CK, IK and AUTN may be sequentially connected in series to form an authentication vector as basic authentication information.

[0082] S104: Based on the basic authentication information, the authentication parameters are calculated using the user authentication method indicated by the authentication message.

[0083] Specifically, different user authentication methods may be used for different user equipments, and the above user authentication method is an authentication method pre-agreed between the core network and the user equipment.

[0084] Among them, for 4G user equipment, the above-mentioned user authentication method can be 4G AKA (4G Authentication and Key Agreement, 4G authentication and key agreement mechanism) authentication method, etc., for 5G user equipment, the above-mentioned user authentication method can be 5G-AKA (5G Authentication and Key Agreement, 5G authentication and key agreement mechanism) authentication method or EAP-AKA' (Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement, improved third-generation mobile communication network authentication and key agreement mechanism) authentication method, etc., different user authentication methods.

[0085] In addition, the above user authentication method may also be various user authentication methods in the prior art, and this embodiment does not limit this.

[0086] Specifically, when the user device initiates the user authentication process, the user authentication request sent to the message forwarding device may carry the user authentication method requested by itself. After the message forwarding device sends the authentication message to the UDM, before executing the embodiment of the present invention, the UDM can determine whether the user authentication method requested by the user device is the same as the pre-agreed user authentication method. If they are the same, the user authentication process of the embodiment of the present invention continues; otherwise, the user authentication process can be terminated.

[0087] S105: Sending the authentication parameters to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameters.

[0088] Specifically, after receiving the above authentication parameters, the message forwarding device can continue to interact with the user device based on the above user authentication method to complete the user authentication process. The process of the message forwarding device continuing to perform user authentication in different user authentication methods is different. In the case where the user authentication method used in the embodiment of the present invention belongs to the prior art, the process of the message forwarding device subsequently performing user authentication also belongs to the prior art and will not be repeated here.

[0089] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0090] See also Figure 2 , is a flow chart of a second user authentication method provided by an embodiment of the present invention, which is similar to the aforementioned Figure 1 Compared with the embodiment shown, if the above-mentioned user authentication method is a 5G-AKA authentication method for a 5G user equipment, the above-mentioned step S104 can be implemented by the following steps S104A-S104B.

[0091] S104A: Calculate a first key and a first expected response based on the CK and IK included in the basic authentication information.

[0092] The first expected response indicates: a parameter that the user equipment is expected to respond to during the user authentication process. The first key may be represented by Kausf, and the first expected response may be represented by Xres*.

[0093] In one embodiment of the present invention, Xres included in the basic authentication information can be further deduced based on a KDF (Key Derivation Function) to calculate Xres*, where the KDF can be a HAMCSHA256 function.

[0094] Specifically, the above CK and IK can be combined in series as the key used in the process of calculating Xres*. The string to be encrypted contains P0, P1 and P2. Among them, P0 = service network name, the length of P0 L0 = the length of the above service network name, P1 = the above random number, the length of P1 L1 = the length of the above random number, P2 = Xres, and the length of P2 L2 = the length of Xres. The above Xres* can be obtained by encrypting the string to be encrypted using the above key.

[0095] In addition, the above CK and IK can be combined in series as the key used in the process of calculating Kausf. The string to be encrypted includes P3 and P4. Among them, P3 = service network name, the length of P3 L3 = the length of the above service network name, P4 = the result of the AND or operation between the above updated SQN and the AK included in the basic authentication information, and the length of P4 L4 = the length of the above AND or operation result. The above Kausf can be obtained by encrypting the string to be encrypted using the above key.

[0096] S104B: Calculate a second expected response based on the first expected response, and calculate a second key based on the first key, and use the calculated second expected response and the second key as authentication parameters.

[0097] Among them, the above-mentioned second expected response can be represented by Hxres*, and the second key can be represented by Kseaf.

[0098] In one embodiment of the present invention, Xres* and the above-mentioned random number can be used as parameters to obtain a calculation result based on the algorithm of the 5G-AKA authentication method in the prior art, and the lower 128 bits of the calculation result are determined as Hxres*.

[0099] Furthermore, the service network name is encrypted with Kausf as the key to obtain Kseaf.

[0100] Specifically, the above steps S104A-S104C can be implemented based on the algorithm of the 5G-AKA authentication method in the prior art, Hxres* and the above Kseaf can be calculated, and after Hxres* and the above Kseaf are sent to SEAF as authentication parameters, SEAF can also continue to perform the user authentication process based on the algorithm of the 5G-AKA authentication method, which will not be repeated in the embodiments of the present invention.

[0101] It can be seen from the above that for 5G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the 5G-AKA authentication method. The above-mentioned message forwarding device is SEAF, and UDM can directly interact with SEAF for data. The core network only needs to configure UDM without configuring AUSF to complete the 5G-AKA authentication of the user equipment. The equipment configured in the core network is relatively simple, and the complexity of the user authentication process can be reduced. In addition, since the user authentication process does not require data processing by AUSF, when the embodiment of the present invention is applied to perform user authentication based on the 5G-AKA authentication method, there is no risk of information leakage during the data interaction between UDM and AUSF.

[0102] See also Figure 3 , is a flow chart of a third user authentication method provided by an embodiment of the present invention, which is similar to the aforementioned Figure 1 Compared with the embodiment shown, if the above-mentioned user authentication method is an EAP-AKA' authentication method for a 5G user equipment, the above-mentioned step S104 can be implemented by the following steps S104C-S104E.

[0103] S104C: Based on the CK and IK included in the basic authentication information, the CK and IK are updated.

[0104] In one embodiment of the present invention, CK' may represent the updated CK, and IK' may represent the updated IK. CK' and IK' may be calculated based on the HAMCSHA256 algorithm.

[0105] Specifically, the above CK and IK can be combined in series as the key used in the process of calculating CK' and IK'. The string to be encrypted contains P5 and P6, where P5 = service network name, the length of P5 L5 = the length of the service network name, P6 = the result of the AND or operation between the above updated SQN and the above AK, and the length of P6 L6 = the length of the above AND or operation result. The above key is used to encrypt the string to be encrypted to obtain the encryption result, the high 128 bits of the encryption result are CK', and the low 128 bits of the encryption result are IK'.

[0106] S104D: Calculate the first key based on the updated CK and IK.

[0107] Specifically, the above CK' and IK' can be combined in series as the key used in the process of calculating the first key Kausf. The string to be encrypted includes P7 and P8, where P7 = preset fixed value EAP-AKA', P8 = SUPI, and the HAMCSHA256 algorithm is used cyclically to encrypt the strings P7 and P8 to be encrypted to obtain the encryption result, and the preset bits in the encryption result are extracted as Kausf.

[0108] S104E: Based on the first key, calculate the second key, further calculate the EAP-payload, and use the second key and the EAP-payload as authentication parameters.

[0109] Specifically, the first key Kausf may be used as the key used in the process of calculating the second key Kseaf, the parameter to be encrypted is the service network name, and Kseaf may be obtained by encrypting the service network name with the key.

[0110] In addition, the random number, AUTN, KDF input parameter KDF_INPUT, and the third key Kaut can be used as parameters, and EAP-payload (Improved Extensible Authentication Protocol Method for 3rd Generation Authentication payload) can be calculated based on RFC4186 and RFC4187 algorithms as an authentication parameter.

[0111] Specifically, the above steps S104D-S104F can be implemented based on the algorithm of the EAP-AKA' authentication method in the prior art, and the second key Kseaf and EAP-payload can be calculated. After Kseaf and EAP-payload are sent to SEAF as authentication parameters, SEAF can also continue the user authentication process based on the algorithm of the EAP-AKA' authentication method, and the embodiments of the present invention will not go into details.

[0112] It can be seen from the above that for 5G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the EAP-AKA' authentication method. The above-mentioned message forwarding device is SEAF, and UDM can directly interact with SEAF for data. The core network only needs to configure UDM without configuring AUSF to complete the EAP-AKA' authentication of the user equipment. The equipment configured in the core network is relatively simple, and the complexity of the user authentication process can be reduced. In addition, since the user authentication process does not require data processing by AUSF, when the embodiment of the present invention is applied to perform user authentication based on the EAP-AKA' authentication method, there is no risk of information leakage during the data interaction between UDM and AUSF.

[0113] See also Figure 4 , is a flow chart of a fourth user authentication method provided by an embodiment of the present invention, which is similar to the aforementioned Figure 1 Compared with the embodiment shown, if the user authentication method is a 4G AKA authentication method for a 4G user equipment, the step S104 can be implemented by the following step S104F.

[0114] S104F: Based on the CK and IK included in the above basic authentication information, calculate the third key as the authentication parameter.

[0115] Specifically, the above-mentioned third key can be represented by Kasme, and the above-mentioned CK and IK can be combined in series as the key used in the process of calculating Kasme. The parameters to be encrypted include P9 and P10, wherein P9=SN id (Serving Network identity), the length of P9 L9=the length of SN id, P10=the result of the AND or operation between the above-mentioned updated SQN and the above-mentioned AK, the length of P10 L10=the length of the above-mentioned AND or operation result, the above-mentioned key is used to encrypt the parameters to be encrypted, and the encryption result is determined as Kasme.

[0116] In addition, step S104G can be implemented based on the algorithm of the 4G AKA authentication method in the prior art to calculate Kasme, and after sending Kasme as an authentication parameter to the MME, the MME can also continue the user authentication process based on the algorithm of the 4G AKA authentication method, which will not be elaborated in the embodiments of the present invention.

[0117] As can be seen from the above, for 4G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the 4G AKA authentication method, and the UDM configured in the core network can replace the function of HSS to complete the user authentication process. In addition, since the embodiment of the present invention only involves the interaction between UDM and MME, the complexity of the user authentication process is relatively low.

[0118] Corresponding to the aforementioned user authentication method applied to the UDM, an embodiment of the present invention further provides a user authentication method applied to a message forwarding device.

[0119] See also Figure 5 , which is a flow chart of a fifth user authentication method provided in an embodiment of the present invention, applied to a message forwarding device, and the method includes the following steps S501-S502.

[0120] S501: After obtaining the SUPI of the user equipment to be authenticated, sending an authentication message carrying the SUPI to the UDM, so that the UDM calculates authentication parameters based on the SUPI, and sends the authentication parameters to the message forwarding device.

[0121] Specifically, if the user equipment is a 4G user equipment, the message forwarding device is an MME, and if the user equipment is a 5G user equipment, the message forwarding device is a SEAF. The SUPI may be sent by the user equipment to the message forwarding device. The method for calculating the authentication parameters based on the SUPI by the UDM can refer to the aforementioned Figure 1 The embodiments shown will not be described in detail here.

[0122] In one embodiment of the present invention, an authentication message may be sent to the UDM through the following steps A.

[0123] Step A: Send a service-oriented message carrying the above SUPI to the UDM as an authentication message.

[0124] That is, no matter what protocol the above-mentioned user equipment is based on for data transmission, the authentication message sent by the message forwarding device to UDM is always a service message based on SBA. UDM only needs to process messages in a single format to complete the user authentication process, thereby simplifying the interaction between the message forwarding device and UDM and the processing process of UDM.

[0125] S502: After receiving the authentication parameters sent by the UDM, the user authentication process is completed based on the authentication parameters.

[0126] Specifically, SEAF may adopt a user authentication method pre-agreed with the user equipment to complete the user authentication process. The user authentication method may be various methods in the prior art, which will not be described in detail herein.

[0127] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0128] See also Figure 6 , which is a flow chart of a sixth user authentication method provided in an embodiment of the present invention, involving a UDM and a message forwarding device, and the method includes the following steps S601-S607.

[0129] S601: After obtaining the SUPI of the user equipment to be authenticated, the message forwarding device sends a service-oriented message carrying the user SUPI to the UDM.

[0130] S602: The UDM searches for the SQN corresponding to the user equipment based on the SUPI carried in the authentication message.

[0131] S603: UDM updates the found SQN.

[0132] S604: UDM calculates basic authentication information including CK and IK based on the updated SQN, random number, K, and preset AMF.

[0133] S605: For the 5G-AKA authentication method, UDM calculates Xres* and Kausf based on CK and IK, calculates Hxres* based on Xres*, calculates Kseaf based on Kausf, and uses Hxres* and Kseaf as authentication parameters;

[0134] For EAP-AKA' authentication method, UDM calculates CK' and IK' based on CK and IK, calculates Kausf based on CK' and IK', calculates Kseaf based on Kausf, and further calculates EAP-payload. The above Kseaf and EAP-payload are used as authentication parameters;

[0135] For the 4G AKA authentication method, UDM calculates Kasme based on CK and IK as the authentication parameter.

[0136] S606: The UDM sends authentication parameters to the message forwarding device.

[0137] S607: The message forwarding device continues to complete the user authentication process using the user authentication method based on the authentication parameters.

[0138] Specifically, Figure 6 The illustrated embodiment describes the process of user authentication of the user device based on the 5G-AKA authentication method or the EAP-AKA' authentication method or the 4G AKA authentication method between the message forwarding device and the UDM. For details, please refer to the aforementioned Figure 1-Figure 5 The content shown will not be described in detail here.

[0139] Corresponding to the aforementioned user authentication method applied to UDM, an embodiment of the present invention further provides a UDM.

[0140] See also Figure 7 , is a schematic diagram of a structure of a UDM provided by an embodiment of the present invention. The above-mentioned UDM includes a memory 701, a transceiver 702, and a processor 703:

[0141] The memory 701 is used to store computer programs; the transceiver 702 is used to send and receive data under the control of the processor; the processor 703 is used to read the computer program in the memory and perform the following operations:

[0142] After receiving the authentication message sent by the message forwarding device, based on the SUPI of the user equipment to be authenticated carried in the authentication message, searching for the SQN, K and preset AMF corresponding to the user equipment;

[0143] Update the found SQN;

[0144] Calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF;

[0145] Based on the basic authentication information, calculating the authentication parameters using the user authentication method indicated by the authentication message;

[0146] The authentication parameter is sent to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

[0147] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0148] In one embodiment of the present invention, if the user authentication method is a 5G-AKA authentication method for a 5G user equipment, the calculation of the authentication parameter based on the basic authentication information and the user authentication method indicated by the authentication message specifically includes:

[0149] Based on the CK and IK included in the basic authentication information, a first key and a first expected response are calculated, wherein the first expected response represents: a parameter to which the user equipment is expected to respond during the user authentication process;

[0150] A second expected response is calculated based on the first expected response, and a second key is calculated based on the first key, and the calculated second expected response and the second key are used as authentication parameters, wherein the second expected response represents: a parameter that the user device is expected to respond to during the user authentication process.

[0151] It can be seen from the above that for 5G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the 5G-AKA authentication method. The above-mentioned message forwarding device is SEAF, and UDM can directly interact with SEAF for data. The core network only needs to configure UDM without configuring AUSF to complete the 5G-AKA authentication of the user equipment. The equipment configured in the core network is relatively simple, and the complexity of the user authentication process can be reduced. In addition, since the user authentication process does not require data processing by AUSF, when the embodiment of the present invention is applied to perform user authentication based on the 5G-AKA authentication method, there is no risk of information leakage during the data interaction between UDM and AUSF.

[0152] In one embodiment of the present invention, if the user authentication method is an EAP-AKA' authentication method for a 5G user equipment, the calculation of the authentication parameter based on the basic authentication information and the user authentication method indicated by the authentication message specifically includes:

[0153] Based on the CK and IK included in the basic authentication information, updating the CK and IK;

[0154] Calculate the first key based on the updated CK and IK;

[0155] Based on the first key, a second key is calculated, and EAP-payload is further calculated, and the second key and EAP-payload are used as authentication parameters.

[0156] It can be seen from the above that for 5G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the EAP-AKA' authentication method. The above-mentioned message forwarding device is SEAF, and UDM can directly interact with SEAF for data. The core network only needs to configure UDM without configuring AUSF to complete the EAP-AKA' authentication of the user equipment. The equipment configured in the core network is relatively simple, and the complexity of the user authentication process can be reduced. In addition, since the user authentication process does not require data processing by AUSF, when the embodiment of the present invention is applied to perform user authentication based on the EAP-AKA' authentication method, there is no risk of information leakage during the data interaction between UDM and AUSF.

[0157] In one embodiment of the present invention, if the user authentication method is a 4G AKA authentication method for a 4G user equipment, the calculation of the authentication parameter based on the basic authentication information and the user authentication method indicated by the authentication message specifically includes:

[0158] Based on the CK and IK included in the basic authentication information, a third key is calculated as an authentication parameter.

[0159] As can be seen from the above, for 4G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the 4G AKA authentication method, and the UDM configured in the core network can replace the function of HSS to complete the user authentication process. In addition, since the embodiment of the present invention only involves the interaction between UDM and MME, the complexity of the user authentication process is relatively low.

[0160] In one embodiment of the present invention, the authentication message sent by the message forwarding device is a service-based message based on SBA.

[0161] From the above, it can be seen that no matter what protocol the user equipment is based on for data transmission, the authentication message sent by the message forwarding device to the UDM can be a service message. The UDM only needs to process the authentication message in a unified format to complete the user authentication process, thereby reducing the complexity of UDM in performing user authentication.

[0162] Corresponding to the aforementioned user authentication method applied to a message forwarding device, an embodiment of the present invention further provides a message forwarding device.

[0163] See also Figure 8 , is a schematic diagram of the structure of a message forwarding device provided by an embodiment of the present invention. The message forwarding device includes a memory 801, a transceiver 802, and a processor 803:

[0164] The memory 801 is used to store computer programs; the transceiver 802 is used to send and receive data under the control of the processor; the processor 803 is used to read the computer program in the memory and perform the following operations:

[0165] After acquiring the subscription permanent identity SUPI of the user equipment to be authenticated, sending an authentication message carrying the SUPI to a unified data management UDM, so that the UDM calculates an authentication parameter based on the SUPI, and sends the authentication parameter to the message forwarding device;

[0166] After receiving the authentication parameters sent by the UDM, the user authentication process is completed based on the authentication parameters.

[0167] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication. The core network only needs to configure UDM to complete user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to perform user authentication on different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to perform user authentication on a 5G user equipment, the above-mentioned message forwarding device is SEAF, and UDM can interact directly with SEAF. The user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage during data interaction between UDM and AUSF in the embodiment of the present invention.

[0168] In one embodiment of the present invention, sending the authentication message carrying the SUPI to the unified UDM specifically includes:

[0169] Send an SBA-based service-oriented message carrying the SUPI to the UDM as an authentication message.

[0170] From the above, it can be seen that no matter what protocol the above-mentioned user equipment is based on for data transmission, the authentication message sent by the message forwarding device to the UDM is always a service message. The UDM only needs to process messages in a single format to complete the user authentication process, thereby simplifying the interaction between the message forwarding device and the UDM and the processing process of the UDM.

[0171] Corresponding to the aforementioned user authentication method applied to UDM, an embodiment of the present invention further provides a user authentication device applied to UDM.

[0172] See also Fig. 9 , is a schematic diagram of the structure of a first user authentication device provided by an embodiment of the present invention, which is applied to UDM, and the device includes:

[0173] The SQN search module 901 is configured to search the SQN, K and preset AMF corresponding to the user equipment based on the SUPI of the user equipment to be authenticated carried in the authentication message after receiving the authentication message sent by the message forwarding device;

[0174] An SQN updating module 902, used to update the found SQN;

[0175] An information calculation module 903, configured to calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF;

[0176] A parameter calculation module 904, configured to calculate an authentication parameter based on the basic authentication information and using the user authentication method indicated by the authentication message;

[0177] The parameter sending module 905 is used to send the authentication parameter to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

[0178] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0179] In one embodiment of the present invention, if the user authentication method is a 5G-AKA authentication method for a 5G user equipment, the parameter calculation module 904 is specifically used to:

[0180] Based on the encryption key CK and the integrity protection key IK included in the basic authentication information, a first key and a first expected response are calculated, wherein the first expected response represents: a parameter to which the user equipment is expected to respond during the user authentication process;

[0181] A second expected response is calculated based on the first expected response, and a second key is calculated based on the first key, and the calculated second expected response and the second key are used as authentication parameters, wherein the second expected response represents: a parameter that the user device is expected to respond to during the user authentication process.

[0182] It can be seen from the above that for 5G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the 5G-AKA authentication method. The above-mentioned message forwarding device is SEAF, and UDM can directly interact with SEAF for data. The core network only needs to configure UDM without configuring AUSF to complete the 5G-AKA authentication of the user equipment. The equipment configured in the core network is relatively simple, and the complexity of the user authentication process can be reduced. In addition, since the user authentication process does not require data processing by AUSF, when the embodiment of the present invention is applied to perform user authentication based on the 5G-AKA authentication method, there is no risk of information leakage during the data interaction between UDM and AUSF.

[0183] In one embodiment of the present invention, if the user authentication method is an EAP-AKA' authentication method for a 5G user equipment, the parameter calculation module 904 is specifically used to:

[0184] Based on the CK and IK included in the basic authentication information, updating the CK and IK;

[0185] Calculate the first key based on the updated CK and IK;

[0186] Based on the first key, a second key is calculated, and an authentication payload EAP-payload of the third generation mobile communication network is further calculated, and the second key and EAP-payload are used as authentication parameters.

[0187] It can be seen from the above that for 5G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the EAP-AKA' authentication method. The above-mentioned message forwarding device is SEAF, and UDM can directly interact with SEAF for data. The core network only needs to configure UDM without configuring AUSF to complete the EAP-AKA' authentication of the user equipment. The equipment configured in the core network is relatively simple, and the complexity of the user authentication process can be reduced. In addition, since the user authentication process does not require data processing by AUSF, when the embodiment of the present invention is applied to perform user authentication based on the EAP-AKA' authentication method, there is no risk of information leakage during the data interaction between UDM and AUSF.

[0188] In one embodiment of the present invention, if the user authentication method is a 4G AKA authentication method for a 4G user equipment, the parameter calculation module 904 is specifically used to:

[0189] Based on the CK and IK included in the basic authentication information, a third key is calculated as an authentication parameter.

[0190] As can be seen from the above, for 4G user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used to perform user authentication based on the 4G AKA authentication method, and the UDM configured in the core network can replace the function of HSS to complete the user authentication process. In addition, since the embodiment of the present invention only involves the interaction between UDM and MME, the complexity of the user authentication process is relatively low.

[0191] In one embodiment of the present invention, the authentication message sent by the message forwarding device is a service-based message based on SBA.

[0192] From the above, it can be seen that no matter what protocol the user equipment is based on for data transmission, the authentication message sent by the message forwarding device to the UDM can be a service message. The UDM only needs to process the authentication message in a unified format to complete the user authentication process, thereby reducing the complexity of UDM in performing user authentication.

[0193] Corresponding to the aforementioned user authentication method applied to a message forwarding device, an embodiment of the present invention further provides a user authentication device applied to a message forwarding device.

[0194] See also Fig.10 , is a structural diagram of a second user authentication device provided by an embodiment of the present invention, which is applied to a message forwarding device, and the device includes:

[0195] The message sending module 1001 is configured to, after acquiring the subscription permanent identity SUPI of the user equipment to be authenticated, send an authentication message carrying the SUPI to the unified data management UDM, so that the UDM calculates an authentication parameter based on the SUPI, and sends the authentication parameter to the message forwarding device;

[0196] The authentication module 1002 is used to complete the user authentication process based on the authentication parameters after receiving the authentication parameters sent by the UDM.

[0197] As can be seen from the above, for any user equipment, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user equipment, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user equipment. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user equipment, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0198] In one embodiment of the present invention, the message sending module 1001 is specifically used for:

[0199] After acquiring the SUPI of the user equipment to be authenticated, sending an SBA-based service-based message carrying the SUPI to the UDM as an authentication message, so that the UDM calculates an authentication parameter based on the SUPI, and sends the authentication parameter to the message forwarding device.

[0200] From the above, it can be seen that no matter what protocol the above-mentioned user equipment is based on for data transmission, the authentication message sent by the message forwarding device to the UDM is always a service message. The UDM only needs to process messages in a single format to complete the user authentication process, thereby simplifying the interaction between the message forwarding device and the UDM and the processing process of the UDM.

[0201] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned user authentication methods applied to UDM are implemented.

[0202] When the computer-readable storage medium provided in the embodiment of the present invention is used for user authentication, for any user device, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user device, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user devices, and the embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user device, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0203] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned user authentication methods applied to a message forwarding device are implemented.

[0204] When the computer-readable storage medium provided in the embodiment of the present invention is used for user authentication, for any user device, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user device, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate users of different user devices, and the embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user device, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0205] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer executes any one of the user authentication methods applied to the UDM in the above embodiments.

[0206] When the computer program product provided by the embodiment of the present invention is used for user authentication, for any user device, the user authentication method applied to UDM provided by the embodiment of the present invention can be used for user authentication. The core network only needs to configure UDM to complete the user authentication of the user device, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate different user devices. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user device, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0207] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer executes any user authentication method applied to a message forwarding device in the above embodiments.

[0208] When the computer program product provided in the embodiment of the present invention is used for user authentication, the user authentication method applied to UDM provided in the embodiment of the present invention can be used for user authentication for any user device. The core network only needs to configure UDM to complete the user authentication of the user device, and the equipment configured in the core network is relatively simple. And the same process can be used to authenticate different user devices. The embodiment of the present invention can reduce the complexity of the user authentication process. In addition, when the embodiment of the present invention is used to authenticate the user of the 5G user device, the above-mentioned message forwarding device is SEAF. In the prior art, the data processed by UDM needs to be sent to AUSF, which is further processed by AUSF and then sent to SEAF. However, in the embodiment of the present invention, UDM can interact directly with SEAF, and the user authentication process can be completed without data processing through AUSF, and the user authentication process is further simplified. In addition, since the user authentication process does not require data processing through AUSF, there is no risk of information leakage in the process of data interaction between UDM and AUSF in the embodiment of the present invention.

[0209] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0210] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0211] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the UDM, message forwarding device, apparatus, storage medium and computer program embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0212] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0213] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0214] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0215] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0216] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the embodiments of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A user authentication method, characterized in that: Applied to unified data management (UDM), the method includes: After receiving the authentication message sent by the message forwarding device, based on the subscription permanent identification SUPI of the user equipment to be authenticated carried in the authentication message, the serial number SQN, the root key K and the preset authentication management domain AMF corresponding to the user equipment are searched; wherein, when the user equipment is a 5G user equipment, the message forwarding device is a security anchor function SEAF, and the UDM interacts directly with the SEAF without processing data through the authentication service function AUSF; when the user equipment is a 4G user equipment, the message forwarding device is a mobile node management function MME, and the UDM replaces the function of the home subscription user server HSS to complete the user authentication, which only involves the interaction between the UDM and the MME; Update the found SQN; Calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF; Based on the basic authentication information, an authentication parameter is calculated using a user authentication method indicated by the authentication message, where the user authentication method is an authentication method pre-agreed between the core network and the user equipment; The authentication parameter is sent to the message forwarding device so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

2. The method according to claim 1, characterized in that If the user authentication method is a 5G authentication and key agreement mechanism 5G-AKA authentication method for a 5G user equipment, the calculating of the authentication parameters based on the basic authentication information and using the user authentication method indicated by the authentication message includes: Based on the encryption key CK and the integrity protection key IK included in the basic authentication information, a first key and a first expected response are calculated, wherein the first expected response represents: a parameter to which the user equipment is expected to respond during the user authentication process; A second expected response is calculated based on the first expected response, and a second key is calculated based on the first key, and the calculated second expected response and the second key are used as authentication parameters, wherein the second expected response represents: a parameter that the user device is expected to respond to during the user authentication process.

3. The method according to claim 1, characterized in that If the user authentication method is an improved third generation mobile communication network authentication and key agreement mechanism EAP-AKA' authentication method for 5G user equipment, the calculation of the authentication parameters based on the basic authentication information and the user authentication method indicated by the authentication message includes: Based on the CK and IK included in the basic authentication information, updating the CK and IK; Calculate the first key based on the updated CK and IK; Based on the first key, a second key is calculated, and an authentication payload EAP-payload of the third generation mobile communication network is further calculated, and the second key and EAP-payload are used as authentication parameters.

4. The method according to claim 1, characterized in that: If the user authentication method is a 4G authentication and key agreement mechanism 4G AKA authentication method for a 4G user equipment, the calculating of the authentication parameters based on the basic authentication information and using the user authentication method indicated by the authentication message includes: Based on the CK and IK included in the basic authentication information, a third key is calculated as an authentication parameter.

5. The method according to any one of claims 1 to 4, characterized in that The authentication message sent by the message forwarding device is a service-based message based on the service-based framework SBA.

6. A user authentication method, characterized in that: Applied to a message forwarding device, the method comprises: After obtaining the subscription permanent identification SUPI of the user equipment to be authenticated, an authentication message carrying the SUPI is sent to the unified data management UDM, so that the UDM searches for the serial number SQN, the root key K and the preset authentication management domain AMF corresponding to the user equipment based on the subscription permanent identification SUPI of the user equipment to be authenticated carried in the authentication message; updates the found SQN; calculates basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K and the AMF; and adopts the user authentication indicated by the authentication message based on the basic authentication information. The method calculates the authentication parameters and sends the authentication parameters to the message forwarding device; wherein, when the user equipment is a 5G user equipment, the message forwarding device is a security anchor function SEAF, the UDM interacts directly with the SEAF, and does not process data through the authentication service function AUSF; when the user equipment is a 4G user equipment, the message forwarding device is a mobile node management function MME, the UDM replaces the function of the home subscriber server HSS to complete the user authentication, and only involves the interaction between the UDM and the MME, and the user authentication method is the authentication method pre-agreed between the core network and the user equipment; After receiving the authentication parameters sent by the UDM, the user authentication process is completed based on the authentication parameters.

7. The method according to claim 6, characterized in that The sending an authentication message carrying the SUPI to a unified data management (UDM) includes: A service-based message carrying the SUPI and based on the service-based framework SBA is sent to the UDM as an authentication message.

8. A UDM, characterized in that: Including memory, transceiver, processor: A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: After receiving the authentication message sent by the message forwarding device, based on the subscription permanent identification SUPI of the user equipment to be authenticated carried in the authentication message, the serial number SQN, the root key K and the preset authentication management domain AMF corresponding to the user equipment are searched; wherein, when the user equipment is a 5G user equipment, the message forwarding device is a security anchor function SEAF, and the UDM interacts directly with the SEAF without processing data through the authentication service function AUSF; when the user equipment is a 4G user equipment, the message forwarding device is a mobile node management function MME, and the UDM replaces the function of the home subscription user server HSS to complete the user authentication, which only involves the interaction between the UDM and the MME; Update the found SQN; Calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF; Based on the basic authentication information, an authentication parameter is calculated using a user authentication method indicated by the authentication message, where the user authentication method is an authentication method pre-agreed between the core network and the user equipment; The authentication parameter is sent to the message forwarding device so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

9. The UDM according to claim 8, characterized in that: If the user authentication method is a 5G authentication and key agreement mechanism 5G-AKA authentication method for a 5G user equipment, the calculation of the authentication parameters based on the basic authentication information and the user authentication method indicated by the authentication message specifically includes: Based on the encryption key CK and the integrity protection key IK included in the basic authentication information, a first key and a first expected response are calculated, wherein the first expected response represents: a parameter to which the user equipment is expected to respond during the user authentication process; A second expected response is calculated based on the first expected response, and a second key is calculated based on the first key, and the calculated second expected response and the second key are used as authentication parameters, wherein the second expected response represents: a parameter that the user device is expected to respond to during the user authentication process.

10. The UDM according to claim 8, wherein: If the user authentication method is an improved third generation mobile communication network authentication and key agreement mechanism EAP-AKA' authentication method for 5G user equipment, the calculation of the authentication parameters based on the basic authentication information and the user authentication method indicated by the authentication message specifically includes: Based on the CK and IK included in the basic authentication information, updating the CK and IK; Calculate the first key based on the updated CK and IK; Based on the first key, a second key is calculated, and an authentication payload EAP-payload of the third generation mobile communication network is further calculated, and the second key and EAP-payload are used as authentication parameters.

11. The UDM according to claim 8, characterized in that: If the user authentication method is a 4G authentication and key agreement mechanism 4G AKA authentication method for a 4G user equipment, the calculating of the authentication parameters based on the basic authentication information and using the user authentication method indicated by the authentication message specifically includes: Based on the CK and IK included in the basic authentication information, a third key is calculated as an authentication parameter.

12. The UDM according to any one of claims 8 to 11, characterized in that: The authentication message sent by the message forwarding device is a service-based message based on the service-based framework SBA.

13. A message forwarding device, characterized in that: Including memory, transceiver, processor: A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: After obtaining the subscription permanent identification SUPI of the user equipment to be authenticated, an authentication message carrying the SUPI is sent to the unified data management UDM, so that the UDM searches for the serial number SQN, the root key K and the preset authentication management domain AMF corresponding to the user equipment based on the subscription permanent identification SUPI of the user equipment to be authenticated carried in the authentication message; updates the found SQN; calculates basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K and the AMF; and adopts the user authentication indicated by the authentication message based on the basic authentication information. The method comprises the following steps: receiving an authentication parameter in an authentication mode and sending the authentication parameter to the message forwarding device; wherein, when the user equipment is a 5G user equipment, the message forwarding device is a security anchor function SEAF, the UDM interacts directly with the SEAF, and does not process data via the authentication service function AUSF; when the user equipment is a 4G user equipment, the message forwarding device is a mobile node management function MME, the UDM replaces the function of the home subscriber server HSS to complete user authentication, and only involves interaction between the UDM and the MME, and the user authentication mode is an authentication mode pre-agreed upon by the core network and the user equipment; After receiving the authentication parameters sent by the UDM, the user authentication process is completed based on the authentication parameters.

14. The message forwarding device according to claim 13, characterized in that: The sending the authentication message carrying the SUPI to the unified data management UDM specifically includes: A service-based message carrying the SUPI and based on the service-based framework SBA is sent to the UDM as an authentication message.

15. A user authentication device, characterized in that: Applied to unified data management (UDM), the device comprises: An SQN search module is used to search for the serial number SQN, root key K and preset authentication management domain AMF corresponding to the user equipment based on the subscription permanent identification SUPI of the user equipment to be authenticated carried in the authentication message after receiving the authentication message sent by the message forwarding device; wherein, when the user equipment is a 5G user equipment, the message forwarding device is a security anchor function SEAF, and the UDM interacts directly with the SEAF without processing data through the authentication service function AUSF; when the user equipment is a 4G user equipment, the message forwarding device is a mobile node management function MME, and the UDM completes user authentication instead of the function of the home subscription user server HSS, which only involves the interaction between the UDM and the MME; SQN update module, used to update the found SQN; An information calculation module, used to calculate basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K, and the AMF; A parameter calculation module, configured to calculate an authentication parameter based on the basic authentication information and using a user authentication method indicated by the authentication message, wherein the user authentication method is an authentication method pre-agreed between the core network and the user equipment; The parameter sending module is used to send the authentication parameter to the message forwarding device, so that the message forwarding device continues to complete the user authentication process based on the authentication parameter.

16. A user authentication device, characterized in that: Applied to a message forwarding device, the device comprises: a message sending module, configured to, after acquiring the subscription permanent identification SUPI of the user equipment to be authenticated, send an authentication message carrying the SUPI to the unified data management UDM, so that the UDM searches for the serial number SQN, the root key K and the preset authentication management domain AMF corresponding to the user equipment based on the subscription permanent identification SUPI of the user equipment to be authenticated carried in the authentication message; updates the found SQN; calculates basic authentication information for user authentication of the user equipment based on the updated SQN, the random number, the root key K and the AMF; and based on the basic authentication information, uses the authentication message indication The user authentication method calculates the authentication parameters and sends the authentication parameters to the message forwarding device; wherein, when the user equipment is a 5G user equipment, the message forwarding device is a security anchor function SEAF, the UDM interacts directly with the SEAF, and does not process data through the authentication service function AUSF; when the user equipment is a 4G user equipment, the message forwarding device is a mobile node management function MME, the UDM replaces the function of the home subscriber server HSS to complete the user authentication, and only involves the interaction between the UDM and the MME, and the user authentication method is the authentication method pre-agreed between the core network and the user equipment; The authentication module is used to complete the user authentication process based on the authentication parameters after receiving the authentication parameters sent by the UDM.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1-5 or 6-7 are implemented.

Images