5G User Equipment Access Authentication Method and System

Abstract

This invention discloses a 5G user equipment access authentication method and system. The method includes: obtaining a public key for terminal equipment authentication, the public key being based on a system master key public-private key pair generated by a key distribution management center; for a terminal equipment issuing an attach request, after successful AKA authentication, sending a device identifier request / device authentication request message containing a random number and a device authentication indication to the terminal equipment; receiving a device identifier response / device authentication response message from the terminal equipment, the device identifier response / device authentication response message including: terminal equipment identifier, freshness factor, timestamp, random number, and user equipment signature SIGue; signing the terminal equipment identifier with the random number, freshness factor, and timestamp using the public key to obtain the user equipment signature SIGue'; and verifying the signature of the terminal equipment by comparing the user equipment signature SIGue' with the user equipment signature SIGue'. This invention can prevent unauthorized user terminal equipment from accessing the mobile network.

Description

Technical Field

[0001] This invention relates to the field of mobile communication network security technology, and in particular to a 5G user equipment access authentication method and system. Background Technology

[0002] Mobile communication network services have become widely used in people's daily lives due to their mobility and convenience. With the large-scale deployment of mobile communication networks, more and more people are starting to use 4G / 5G network services. While enjoying the convenience brought by mobile communication networks, the design flaws in the air interface security of mobile networks have led to increasingly serious risks of unauthorized terminal devices accessing the network or fake networks luring legitimate users into accessing it.

[0003] Hostile attackers use unauthorized terminal devices to impersonate legitimate devices and access the mobile network, launching denial-of-service attacks or stealing sensitive information. This can render normal network services unusable or lead to the leakage of sensitive / confidential user information. These attacks can pose a serious threat to users and network services with high security levels, making defense a critical issue. Currently, 4G / 5G mobile networks only authenticate users (USIM cards) and lack access authentication mechanisms for terminal devices, relying on simple access control mechanisms. During network access, the core network requires the terminal device to report its IMEI, and the core network determines network access eligibility by checking if the IMEI number is on a blacklist / whitelist. However, 4G / 5G mobile networks' access control based on IMEI blacklists and whitelists has serious security vulnerabilities. Attackers can alter the IMEI number of an unauthorized terminal device to that of a legitimate one, impersonating a legitimate device to access the private network for network attacks or sensitive information theft. This also disrupts network audits and causes problems for legitimate users. Existing 4G / 5G mobile networks require user authentication during terminal access. The security credentials needed for authentication are stored in the USIM card, thus establishing authentication between the USIM card and the core network. However, regarding the authentication between the USIM card and the network, attackers can steal / copy the USIM card of a legitimate terminal, insert it into an unauthorized terminal device, and then use that unauthorized device to access the network. Therefore, it is difficult to defend against attacks from unauthorized terminal devices. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a 5G user equipment access authentication method and system that can prevent unauthorized user terminal devices from accessing the mobile network. This method introduces a Key Distribution Management Center (KMC) based on the user equipment identifier into the mobile network to generate a system master key public-private key pair, PUBkmc and PRIkmc. Based on the user terminal device identifier (IMEI) and PRIkmc, a device signature key, PRIue, is generated for the user terminal device. During the network access process, the user terminal device uses the signature key to sign the device identifier. Upon receiving the device identifier signature, the network side verifies the signature using PUBkmc, thereby completing the authentication of the user terminal device.

[0005] This invention enhances terminal functionality by pre-configuring a device signature key, PRIue, for each user terminal device offline before it attaches to the network. During network access, the user terminal device uses its signature key PRIue to sign parameters in the device identification response / device authentication response message based on the SM9 algorithm. The core network uses the public key PUBkmc from the system master key pair provided by the Key Distribution Management Center (KMC) to verify the validity of the terminal device's signature, thereby authenticating the user terminal device. If authentication fails, the core network rejects the terminal device's access, terminates the relevant access process for that terminal device, and generates an authentication failure alarm.

[0006] The technical solution of the present invention includes:

[0007] A 5G user equipment access authentication method, applied to the core network, includes the following steps:

[0008] Obtain the public key used for terminal device authentication, the public key being obtained based on the system master key public-private key pair generated by the key distribution management center;

[0009] For a terminal device that issues an attach request, after AKA authentication is successful, a device identifier request / device authentication request message containing a random number and a device authentication indicator is sent to the terminal device.

[0010] The system receives a device identification response / device authentication response message from the terminal device, wherein the device identification response / device authentication response message includes: a terminal device identifier, a freshness factor, a timestamp, the random number, and a user equipment signature SIGue. The user equipment signature SIGue is obtained by the terminal device signing the terminal device identifier, timestamp, and random number using a signature key and the public key. The signature key is obtained based on the private key in the system master key public-private key pair and the terminal device identifier and freshness factor.

[0011] The terminal device identifier is signed with a random number, a freshness factor, and a timestamp using the public key to obtain the user device signature SIGue'.

[0012] The terminal device is verified by comparing the user equipment signature SIGue with the user equipment signature SIGue'.

[0013] Furthermore, obtaining the public key used for terminal device authentication includes:

[0014] A public key request message is sent to the key distribution management center via the interface between the core network and the key distribution management center. The public key request message contains the PLMN ID to which the core network equipment belongs.

[0015] The system receives a public key response message from the key distribution management center via the interface between the core network and the key distribution management center. The public key response message contains the public key corresponding to the PLMN ID.

[0016] or,

[0017] Through the indirect interface of the network operation and maintenance management system, a public key request message is sent to the key distribution management center. The public key request message contains the PLMN ID to which the core network device belongs.

[0018] The system receives a public key response message from the key distribution management center via an indirect interface of the network operation and maintenance management system. The public key response message contains the public key corresponding to the operation identifier PLMN ID.

[0019] Furthermore, the method for generating the system master key public-private key pair includes the SM9 key generation algorithm.

[0020] Furthermore, the signing key is obtained based on the private key in the system master key public-private key pair, the terminal device identifier, and the freshness factor, including:

[0021] Through a secure channel between the terminal device and the key distribution management center, the terminal device sends a terminal device signature key request message to the key distribution management center. The terminal device signature key request message includes: terminal device identifier, operator's public land mobile network ID, and freshness factor.

[0022] The key distribution management center determines whether the terminal device is legitimate based on a pre-configured list of legitimate device identifiers.

[0023] If valid, the SM9 key derivation algorithm is used to generate the signature key based on the terminal device identifier, freshness factor, and private key;

[0024] If illegal, then refuse to generate the signature key for the terminal device;

[0025] or,

[0026] The terminal device sends a terminal device signature key request message to the business operation support system. The terminal device signature key request message includes: terminal device identifier, operator's public land mobile network ID and freshness factor.

[0027] The business operation support system sends the terminal device signature key request message to the key distribution management center;

[0028] The key distribution management center determines whether the terminal device is legitimate based on a pre-configured list of legitimate device identifiers.

[0029] If valid, the SM9 key derivation algorithm is used to generate the signature key based on the terminal device identifier, freshness factor, and private key;

[0030] If illegal, the generation of the signature key for the terminal device will be refused.

[0031] Furthermore, the method for generating the list of legitimate device identifiers includes: the network operation and maintenance management system generating it based on all legitimate terminal devices in the network.

[0032] Furthermore, the random number is generated by the core network or cluster core network control plane element MME / AMF / SMF.

[0033] Furthermore, the public key is stored in the core network or cluster core network control plane element MME / AMF / SMF or the mobile device identification register EIR.

[0034] Further, the step of using the public key to sign the terminal device identifier, freshness factor, random number, and timestamp to obtain the user equipment signature SIGue' includes:

[0035] The cluster core network control plane element MME / AMF / SMF, based on the SM9 digital signature generation algorithm, uses the public key to sign the terminal device identifier, freshness factor, random number and timestamp to obtain the user equipment signature SIGue';

[0036] or,

[0037] The cluster core network control plane element MME / AMF / SMF sends a device identifier check / authentication request message to the mobile device identification register EIR. The device identifier check / authentication request message includes: terminal device identifier, freshness factor, random number, timestamp, and user equipment signature SIGue.

[0038] The Mobile Device Identification Register (EIR) uses the public key to sign the terminal device identifier, freshness factor, timestamp, and random number based on the SM9 digital signature generation algorithm to obtain the user device signature SIGue'.

[0039] Furthermore, the terminal device is verified by comparing SIGue' with SIGue, including:

[0040] If the signature verification of the terminal device is successful, the terminal device is allowed to access the core network;

[0041] or,

[0042] If the signature verification for the terminal device fails, the session establishment process is terminated, an alarm is generated, and an attach rejection message is sent back to the terminal device.

[0043] A 5G user equipment access authentication system includes:

[0044] The key distribution management center is used to generate a system master key public-private key pair; send the public key in the system master key public-private key pair to the core network; generate a signature key based on the private key in the system master key public-private key pair, the terminal device identifier, and the freshness factor, and send the signature key and the public key in the system master key public-private key pair to the corresponding terminal device;

[0045] The terminal device is used to determine whether the network side requires device authentication based on a device identifier request / device authentication request message containing a random number and a device authentication indicator. If device authentication is required, the terminal device identifier IMEI and the random number are signed using the signature key, the public key in the system master key public-private key pair, and the timestamp to obtain the user equipment signature SIGue; and the terminal device identifier response / device authentication response message is sent to the core network. The device identifier response / device authentication response message includes: terminal device identifier, freshness factor, the random number, timestamp, and user equipment signature SIGue.

[0046] The core network is used to obtain the public key for terminal device authentication, which is the public key in the public-private key pair of the system master key generated by the key distribution management center; to authenticate terminal devices; to send device identifier request / device authentication request messages to terminal devices that have passed AKA user authentication, the device identifier request / device authentication request messages including a random number and a device authentication indicator; and to receive device identifier response / device authentication response messages from the terminal devices, wherein the device identifier request / authentication response messages include: terminal device identifier, freshness factor, the random number, timestamp, and user equipment signature SI. Gue, the user equipment signature SIGue is obtained by the terminal device signing the terminal device identifier, timestamp, and random number using a signature key and the public key from the system master key public-private key pair. The signature key is obtained based on the private key, freshness factor, and terminal device identifier from the system master key public-private key pair. The user equipment signature SIGue' is obtained by signing the terminal device identifier, freshness factor, timestamp, and random number using the public key. The terminal device signature SIGue' is verified by comparing the user equipment signature SIGue with the user equipment signature SIGue'.

[0047] Compared with the prior art, the present invention has at least the following advantages:

[0048] 1. This invention introduces device identifier access authentication on the basis of existing user identifier authentication, which can prevent unauthorized terminal devices from accessing the network;

[0049] 2. This invention combines and fully utilizes the signaling process in the existing terminal device access process, which can shorten the terminal device network access time;

[0050] 3. This invention avoids the certificate management mechanism and CA system in traditional certificate-based asymmetric key systems, resulting in lower implementation costs;

[0051] 4. During the network access process of the terminal device of the present invention, it is not necessary to provide its own device certificate information for legality verification, which can reduce air interface signaling overhead. Attached Figure Description

[0052] Figure 1 Framework diagram of user terminal device access authentication system based on identifier.

[0053] Figure 2 A flowchart of the offline process of this invention.

[0054] Figure 3 A flowchart of the online process of this invention. Detailed Implementation

[0055] The technical solutions in the embodiments of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely specific embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] The system framework diagram of the present invention is as follows: Figure 1 As shown, a Key Distribution Management Center (KMC) is introduced into the mobile network. This system uses algorithm SM9 to generate a signature key PRIue for mobile terminal devices based on the user terminal identifier (IMEI). Before the user terminal device accesses the mobile network, the UE and KMC interact offline via an interface protocol to securely issue the signature key PRIue. The existing functionality of the mobile network user terminal device is enhanced by pre-setting the terminal signature key PRIue in the user terminal. The KMC pre-generates a public-private key pair for terminal device access authentication. Before the terminal device accesses the network, the KMC and the trunking core network control plane elements MME / EIR / AMF / SMF distribute the public key PUBkmc from the system master key pair to the mobile core network via an interface protocol. After the user completes user-level AKA authentication with the core network, the core network MME / AMF and SMF generate a random number RAND to challenge the terminal. The core network MME / AMF sends a backup identifier request / device authentication request message to the terminal device, adding the random number generated by the core network and the device authentication indication to the existing parameters. The user terminal device uses the signature key PRIue and public key PUBkmc to generate a terminal device signature SIGue using the SM9 signature algorithm, along with the device identifier IMEI, timestamp (current time), and random number RAND. The user terminal device replies to the core network with a device identifier response / device authentication response message, adding the terminal device signature SIGue, freshness factor, and timestamp (current time) to the existing parameters (device identifier IMEI). The core network MME / AMF / SMF sends a device identifier check request message to the EIR, which includes the random number RAND, timestamp (current time), user terminal device identifier IMEI, freshness factor, and terminal signature SIGue. The EIR / MME / AMF / SMF uses the SM9 digital signature verification algorithm and the public key PUBkmc from the system master key pair to verify the terminal device signature, generating a terminal device identifier authentication result. The EIR replies to the core network MME / AMF / SMF with a device identifier check response message, containing the terminal device identifier authentication result. If terminal device authentication fails, the MME / AMF / SMF will refuse terminal access, terminate the relevant session establishment process, and generate a terminal device authentication failure alarm.

[0057] In one example, the main steps of this invention are divided into two parts: offline (before the user terminal device attaches to the mobile network) and online (after the user terminal device attaches to the mobile network), including:

[0058] Offline process, such as Figure 2 As shown:

[0059] (1) The Business Operation Support System (BOSS) configures the list of IMEIs of all legitimate devices in the network to the Key Distribution Management Center (KMC) of the mobile network.

[0060] (2) KMC uses the SM9 key generation algorithm to generate a public-private key pair PUBkmc and PRIkmc for the core network to authenticate user terminal equipment.

[0061] (3) Through the secure channel established between the terminal device UE and KMC, the UE sends a terminal device signature key request message to the KMC. The message contains the terminal device identifier IMEI, freshness factor (current time), and related operator PLMN ID.

[0062] (4) KMC determines whether the device is legitimate based on the pre-configured list of legitimate device identifiers. If the device is illegitimate, it refuses to generate a signature key for the device. Otherwise, KMC uses the SM9 key derivation algorithm to generate the terminal device signature key PRIue based on the user terminal device identifier IMEI, freshness factor, and PRIkmc.

[0063] (5) KMC replies to the user terminal equipment (UE) with a signature key response message, which includes the terminal equipment signature key PRIue and the system public key PRIkmc.

[0064] (6) Through the secure channel established with KMC, the core network EIR or MME / AMF / SMF sends a public key request message to KMC through the interface between KMC and the network management system OAM, which includes the PLMN ID of the core network equipment.

[0065] (7) The KMC responds to the core network EIR or MME / AMF / SMF directly or through the network management system OAM, with the KMC public key information PUBkmc corresponding to the PLMN ID.

[0066] (8) The core network EIR or MME / AMF / SMF securely stores the KMC public key information PUBkmc.

[0067] Online process, such as Figure 3 As shown:

[0068] (9) After completing AKA authentication with the user, the core network function MME / AMF / SMF generates a random number RAND.

[0069] (10) The core network function MME / AMF / SMF sends device identification request / device authentication request messages to terminal devices, adding parameters such as random number RAND and device authentication indication on the basis of existing parameters.

[0070] (11) The user terminal device uses its own signature key PRIue, system public key PRIkmc, and SM9 digital signature algorithm to sign the device identifier IMEI, timestamp (current time), and random number RAND to generate the device signature SIGue.

[0071] (12) The user terminal equipment replies to the control plane network element MME / AMF / SMF of the cluster core network with the device identification response / device authentication response message. The new parameters added on the basis of the existing parameters of the message include: device identifier IMEI, freshness factor, timestamp, random number RAND, and user equipment signature SIGue.

[0072] (13) MME / AMF / SMF verify the validity of the signature SIGue of the terminal device and generate the verification result. Specific procedure: Use the KMC public key PUBkmc and the SM9 digital signature verification algorithm to recalculate the signature information SIGue' based on IMEI, freshness factor, timestamp, and RAND, and compare it with the original signature information contained in the message. If they match, the verification is successful; otherwise, the verification fails.

[0073] In another example, this step can also be achieved through the following sub-steps:

[0074] a) The control plane network element MME / AMF / SMF of the cluster core network sends a device identifier check / authentication request message (a new interface message or an extension of an existing message) to the core network EIR. This message includes the device identifier IMEI, freshness factor, timestamp, random number RAND, and user equipment signature SIGue;

[0075] b) The EIR verifies the validity of the terminal device's signature SIGue and generates a verification result. Specifically, the KMC public key PUBkmc and the SM9 digital signature verification algorithm are used to recalculate the signature information SIGue' using the IMEI, freshness factor, timestamp, and RAND. This recalculation is then compared with the original signature information contained in the message. If they match, the verification is successful; otherwise, it fails.

[0076] c) The EIR replies to the MME / AMF / SMF with a backup identifier check / authentication request response message, which includes the terminal device authentication result.

[0077] (14) MME / AMF / SMF determine whether the terminal device has been successfully authenticated.

[0078] (15) If authentication fails, the MME terminates the session establishment process, generates an alarm, and replies to the terminal with an attach rejection message containing a new reason for rejection, and the terminal device fails to authenticate.

[0079] In summary, the user terminal device access authentication method and a specific implementation scheme disclosed in this invention are applicable to 4G / 5G mobile network systems and have the following characteristics:

[0080] Introducing a Key Distribution Management Center (KMC) into the existing 4G / 5G network architecture, this function generates public and private key pairs PUBkmc and PRIkmc for the mobile network system master key based on the SM9 master key generation algorithm.

[0081] KMC sends the public key PUBkmc from the system master key pair to the relevant core network function either through a direct interface with the core network function AMF / SMF / MME / EIR or through the network management system OAM.

[0082] The Business Operation and Maintenance Support System (BOSS) sends the list of legitimate user terminal device IDs (IMEIs) in the network to the KMC through the interface protocol between the two.

[0083] Before a user terminal equipment (UE) attaches to a mobile network, it sends a registration request to the KMC, which includes the IMEI (User Terminal Equipment Identifier). The KMC determines whether the device is a legitimate device in the network based on a pre-configured list of legitimate terminal equipment. If it is legitimate, the KMC generates a PRIue (User Terminal Equipment Generated Signature Key) for the terminal equipment and sends it to the terminal equipment.

[0084] KMC uses the SM9 digital signature algorithm to generate a user terminal device signature key PRIue from PRIkmc and the user terminal device identifier IMEI.

[0085] KMC sends the user terminal device's signature key PRIue, key lifespan, and system public key PUBkmc to the user terminal device.

[0086] During the process of user terminal equipment accessing the network, after completing the two-way AKA authentication with the network, the core network terminal equipment AMF / SMF / MME generates a random number RAND and sends a device identifier / device authentication request message containing the random number RAND to the terminal equipment.

[0087] Upon receiving the device identification / authentication request from the core network AMF / SMF / MME, the user terminal device uses the terminal device signature key PRIue, the system public key PUBkmc, the SM9 digital signature algorithm, the device identifier IMEI, and the random number RAND to generate the signature information SIGue.

[0088] The user terminal equipment replies to the core network with a device identification / authentication response message, which provides the terminal equipment identification information IMEI, freshness factor, and device signature information SIGue.

[0089] The core network AMF / SMF / MME sends a device identification check request message to the EIR, which includes the terminal device signature information SIGue, random number RAND, device identifier IMEI, and freshness factor.

[0090] EIR / AMF / SMF / MME uses PUBkmc and employs the SM9 digital signature verification algorithm. It regenerates the terminal signature SIGue' using a random number RAND, the user terminal device identifier IMEI, and a freshness factor. Authentication of the terminal device is achieved by comparing this SIGue' with the signature information provided by the terminal device. If they match, authentication succeeds; otherwise, authentication fails.

[0091] The core network EIR replies to the AMF / SMF / MME with a device identification check response message, which includes the authentication result of the terminal device.

[0092] If user terminal authentication fails, the AMF / SMF / MME generates a terminal device authentication failure alarm, terminates the session establishment process, and notifies the terminal of the authentication failure via an attach rejection message. The existing attach rejection message is extended to add a new reason: device authentication failure.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A 5G user equipment access authentication method applied to a core network, comprising the steps of: obtaining a public key for terminal equipment authentication, the public key being obtained based on a system master key public-private key pair generated by a key distribution management center; after AKA authentication of a terminal equipment sending a device identification request / device authentication request message containing a random number and a device authentication indication to the terminal equipment; receiving a device identification response / device authentication response message of the terminal equipment, wherein the device identification response / device authentication response message comprises a terminal equipment identifier, a freshness factor, a timestamp, the random number and a user equipment signature SIGue, the user equipment signature SIGue being obtained by signing the terminal equipment identifier, the timestamp and the random number using a signature key and the public key, the signature key being obtained based on a private key in the system master key public-private key pair and the terminal equipment identifier and the freshness factor; obtaining a user equipment signature SIGue' by signing the terminal equipment identifier and the random number, the freshness factor and the timestamp using the public key; verifying the terminal equipment by comparing the user equipment signature SIGue and the user equipment signature SIGue'.

2. The method of claim 1, wherein, The step of obtaining the public key for terminal equipment authentication comprises: sending a public key request message to the key distribution management center via an interface between the core network and the key distribution management center, the public key request message containing an operating identifier PLMN ID to which a core network device belongs; receiving a public key response message of the key distribution management center via the interface between the core network and the key distribution management center, the public key response message containing a public key corresponding to the operating identifier PLMN ID; alternatively, sending a public key request message to the key distribution management center via an indirect interface of a network operation and management system, the public key request message containing an operating identifier PLMN ID to which a core network device belongs; receiving a public key response message of the key distribution management center via the indirect interface of the network operation and management system, the public key response message containing a public key corresponding to the operating identifier PLMN ID.

3. The method of claim 1, wherein, The method of generating the system master key public-private key pair comprises an SM9 key generation algorithm.

4. The method of claim 1, wherein, The signature key is obtained based on a private key in the system master key public-private key pair and the terminal equipment identifier and the freshness factor, comprising: sending a terminal equipment signature key request message to the key distribution management center by the terminal equipment via a secure channel between the terminal equipment and the key distribution management center, the terminal equipment signature key request message containing a terminal equipment identifier, a public land mobile network ID of an operator and a freshness factor; judging whether the terminal equipment is legal based on preconfigured legal equipment identifier list information by the key distribution management center: if legal, generating the signature key based on the terminal equipment identifier, the freshness factor and the private key using an SM9 key derivation algorithm; if illegal, refusing to generate the signature key for the terminal equipment; alternatively, The terminal device sends a terminal device signature key request message to a service operation support system, the terminal device signature key request message containing: a terminal device identifier, a public land mobile network ID of an operator, and a freshness factor; The service operation support system sends the terminal device signature key request message to the key distribution management center; The key distribution management center judges whether the terminal device is legal based on preconfigured legal device identifier list information: If legal, the SM9 key derivation algorithm is used to generate the signature key based on the terminal device identifier, the freshness factor, and the private key; If illegal, the signature key is not generated for the terminal device.

5. The method of claim 4, wherein, The method for generating the legal device identifier list information includes that the service operation support system generates based on all legal terminal devices in the network.

6. The method of claim 1, wherein, The random number is generated by the core network or the cluster core network control plane network element MME / AMF / SMF.

7. The method of claim 1, wherein, The public key is stored in the core network or the cluster core network control plane network element MME / AMF / SMF or the mobile device identification register EIR.

8. The method of claim 7, wherein, The terminal device identifier, the freshness factor, the random number, and the timestamp are signed using the public key to obtain the user equipment signature SIGue'. The cluster core network control plane network element MME / AMF / SMF signs the terminal device identifier, the freshness factor, the random number, and the timestamp using the public key based on the SM9 digital signature generation algorithm to obtain the user equipment signature SIGue'; or, The cluster core network control plane network element MME / AMF / SMF sends a device identifier check / verification request message to the mobile device identification register EIR, the device identifier check / verification request message including: the terminal device identifier, the freshness factor, the random number, the timestamp, and the user equipment signature SIGue. The mobile device identification register EIR signs the terminal device identifier, the freshness factor, the timestamp, and the random number using the public key based on the SM9 digital signature generation algorithm to obtain the user equipment signature SIGue'.

9. The method of claim 1, wherein, The terminal device is verified, including: If the terminal device is successfully verified, the terminal device is allowed to access the core network; Or, If the terminal device fails to be verified, the session establishment process is terminated, an alarm is generated, and an attach rejection message is returned to the terminal device.

10. A 5G user equipment access authentication system, comprising: A key distribution management center for generating a system master key public-private key pair; The public key in the system master key public-private key pair is sent to the core network; Based on the private key in the system master key public-private key pair and the terminal device identifier IMEI, a freshness factor, a signature key is generated, and the signature key, the public key in the system master key public-private key pair is sent to the corresponding terminal device; The terminal device is used for judging whether the network side requires device authentication according to a device identification request / device authentication request message containing a random number and device authentication indication, if device authentication is required, signing the terminal device identification IMEI, the random number using the signature key, the public key in the system master key public-private key pair, and the timestamp, to obtain the user equipment signature SIGue; The device identification response / device authentication response message is sent to the core network, and the device identification response / device authentication response message includes: the terminal device identification, the freshness factor, the random number, the timestamp, and the user equipment signature SIGue; The core network is used for obtaining the public key for terminal device authentication, the public key being the public key in the system master key public-private key pair generated by the key distribution management center; performing device authentication on the terminal device; sending a device identification request / device authentication request message to the terminal device authenticated through AKA user authentication, the device identification request / device authentication request message including a random number; receiving the device identification response / device authentication response message of the terminal device, wherein the device identification response / device authentication response message includes: the terminal device identification IMEI, the freshness factor, the random number, the timestamp, and the user equipment signature SIGue, the user equipment signature SIGue being obtained by signing the terminal device identification IMEI, the timestamp, and the random number using the signature key, the public key in the system master key public-private key pair, and the terminal device identification IMEI, the signature key being obtained based on the private key in the system master key public-private key pair, the freshness factor, and the terminal device identification IMEI; signing the terminal device identification IMEI, the freshness factor, the timestamp, and the random number using the public key to obtain the user equipment signature SIGue'; and verifying the signature of the terminal device by comparing the user equipment signature SIGue with the user equipment signature SIGue'.

Images