Communication network authentication method and device, related equipment, storage medium and computer program product

Abstract

The invention discloses a communication network authentication method and device, related equipment, a storage medium and a computer program product, and the method comprises the steps that a terminal receives first information and / or a first identifier sent by a first network function; wherein the first information is obtained by encrypting a first random number and / or a first parameter of the HN by the HN of the terminal by using a shared key of the terminal, or the first information is obtained by encrypting the first random number and / or the first parameter of the HN by the HN by using the shared key of the terminal and performing integrity protection on the first random number and / or the first parameter of the HN; the first identifier indicates whether the HN supports the SUPI protection enhancement capability or not.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication network authentication method, apparatus, related equipment, storage medium and computer program product. Background Art

[0002] In the related art, the communication network uses the Authentication and Key Agreement (AKA) protocol to complete the two-way authentication between the terminal and the network. The network can authenticate the terminal based on the terminal's Subscription Permanent Identifier (SUPI) or Subscription Concealed Identifier (SUCI), but there is a problem of leaking user location information. Summary of the invention

[0003] To solve the related technical problems, the embodiments of the present application provide a communication network authentication method, apparatus, related equipment, storage medium and computer program product.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides a communication network authentication method, which is applied to a terminal, and the method includes:

[0006] Receiving first information and / or a first identifier sent by a first network function; wherein,

[0007] The first information is obtained by encrypting a first random number and / or a first parameter of the HN using a shared key with the terminal by a home network (HN) of the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; the first identifier indicates whether the HN supports SUPI protection enhancement capability.

[0008] In the above scheme, the method further comprises:

[0009] Compare the first parameter with the second parameter to obtain a comparison result;

[0010] Execute a setting operation that matches the comparison result; wherein,

[0011] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0012] In the above scheme, the method further includes one or more of the following:

[0013] Based on a comparison result between the first parameter and the second parameter, determining whether the first information is new first information or replayed first information;

[0014] When the first parameter is greater than the second parameter, updating the second parameter to the first parameter;

[0015] In a case where the first parameter is greater than the second parameter, determining a third parameter based on the shared key, the first random number and / or the first parameter, wherein the third parameter is used to verify the legitimacy of the first authentication token sent by the first network function;

[0016] When the first parameter is less than or equal to the second parameter, a second random number is generated, where the second random number is used to trigger a universal subscriber identity module (USIM) to feedback an authentication error message; wherein,

[0017] The first parameter and / or the first random number is determined based on the shared key and the first information; or, the first parameter and / or the first random number is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0018] In the above solution, when the first parameter is greater than the second parameter, the first information is new first information; or

[0019] In a case where the first parameter is less than or equal to the second parameter, the first information is the reproduced first information.

[0020] In the above scheme, the method further includes:

[0021] When the first parameter is zero, determining a second random number, and / or sending a new SUCI to the first network function; wherein,

[0022] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability;

[0023] The second random number is used to trigger the USIM to feed back an authentication error message.

[0024] In the above solution, the shared key is stored locally during the process of the terminal submitting SUCI to the first network function; and / or

[0025] The second parameter is configured in the process of the terminal submitting the SUCI to the first network function, and the initial value of the second parameter is zero.

[0026] In the above solution, the first identifier is carried in the authentication management field AMF in the first authentication token; and / or

[0027] The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0028] The embodiment of the present application also provides a communication network authentication method, which is applied to a first network function, and the method includes:

[0029] Sending first information and / or a first identifier to the terminal and / or the second network function; wherein,

[0030] The first information is obtained by encrypting a first random number and / or a first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0031] In the above solution, before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes:

[0032] In a case where the SUCI of the terminal is decrypted using the shared key to obtain the SUPI, the shared key is saved; and / or the first parameter is set to 1.

[0033] In the above solution, before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes one or more of the following:

[0034] generating a first random number;

[0035] When the first condition is met, generating the first random number;

[0036] Determine a fourth parameter based on the shared key, the first random number and the first parameter, wherein the fourth parameter is used to calculate an authentication vector (AV);

[0037] Encrypt the first random number and / or the first parameter using the shared key to obtain the first information;

[0038] The first random number and / or the first parameter are encrypted and / or integrity protected using the shared key to obtain the first information.

[0039] In the above solution, the first condition includes one or more of the following:

[0040] The terminal supports SUPI protection enhancement capability;

[0041] The SUCI of the terminal indicates that the terminal supports SUPI protection enhancement capability;

[0042] The SUCI of the terminal carries a second identifier, and the second identifier indicates that the terminal supports SUPI protection enhanced capability;

[0043] The home network of the terminal supports SUPI protection enhancement capability;

[0044] The first identifier indicates that the home network of the terminal supports SUPI protection enhancement capability;

[0045] The shared key exists;

[0046] The first parameter exists.

[0047] In the above solution, before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes one or more of the following:

[0048] When the first parameter is at a maximum value, setting the first parameter to zero;

[0049] In case the first parameter is zero or a maximum value, instructing the terminal to resubmit the SUCI;

[0050] When the first parameter is greater than zero and less than a maximum value, the first parameter is incremented.

[0051] In the above solution, after sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes:

[0052] receiving the first information and / or the second authentication token sent by the second network function;

[0053] Verify the legitimacy of the first information and / or the second authentication token.

[0054] In the above solution, verifying the legitimacy of the first information and / or the second authentication token includes:

[0055] Decrypting the first information using the shared key to obtain second information;

[0056] Determine a fifth parameter based on the shared key and the second information;

[0057] When the fifth parameter is the same as the fourth parameter, the first information is determined to be legal, and / or the legitimacy of the second authentication token is verified based on the fifth parameter or the first random number; the fourth parameter is determined based on the shared key, the first random number and / or the first parameter.

[0058] In the above solution, the use of the shared key to decrypt the second information to obtain the third information includes:

[0059] In the case where the shared key and the first parameter exist, the first information is decrypted using the shared key to obtain second information.

[0060] In the above solution, the first identifier is carried in the authentication management field AMF (Authentication Management Field) in the first authentication token; and / or

[0061] The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0062] The embodiment of the present application also provides a communication network authentication device, including:

[0063] A first receiving unit, configured to receive first information and / or a first identifier sent by a first network function;

[0064] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0065] The present application also provides a communication network authentication device, comprising:

[0066] A first sending unit, configured to send first information and / or a first identifier to a terminal and / or a second network function;

[0067] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0068] The embodiment of the present application also provides a terminal, comprising: a first processor and a first communication interface; wherein,

[0069] The first communication interface is used to receive the first information and / or the first identifier sent by the first network function;

[0070] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0071] The embodiment of the present application further provides a network function, including: a second processor and a second communication interface; wherein,

[0072] The second communication interface is used to send the first information and / or the first identifier to the terminal and / or the second network function;

[0073] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0074] The embodiment of the present application further provides a terminal, comprising a first processor and a first memory for storing a computer program that can be run on the first processor.

[0075] Wherein, the first processor is used to execute the steps of any method on the terminal side when running the computer program.

[0076] The embodiment of the present application further provides a network function, including a second processor and a second memory for storing a computer program that can be run on the second processor.

[0077] The second processor is used to execute the steps of any method of the first network function when running the computer program.

[0078] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any method on the terminal side are implemented, or the steps of any method on the first network function side are implemented.

[0079] An embodiment of the present application further provides a computer program product, including a computer program, characterized in that the computer program implements the steps of any of the above methods when executed by a processor.

[0080] In the communication network authentication method, apparatus, related equipment, storage medium and computer program product provided in the embodiments of the present application, the first network function sends the first information and / or the first identification to the terminal and / or the second network function, where the first information is obtained by the HN of the terminal using a shared key with the terminal to encrypt the first random number and / or the first parameter of the HN, or the first information is obtained by the HN using a shared key with the terminal to encrypt and integrity protect the first random number and / or the first parameter of the HN, and the first identification indicates whether the HN supports SUPI protection enhancement capability; the terminal receives the first information and / or the first identification sent by the first network function. In the above scheme, the first information is obtained by encrypting the first random number and / or the first parameter of the HN using at least the shared key of the terminal. The first random number is the authentication data. It is not easy for an attacker to obtain the authentication data, and the existing tracking attack on the terminal's location information by broadcasting authentication data through a pseudo base station can be resisted; the terminal's home network can support SUPI protection enhancement capability, and enhance the protection of the terminal's SUPI and / or SUCI during the network authentication process, which can resist the existing pseudo base station's tracking attack on the terminal's location information based on SUCI, thereby reducing the risk of leakage of the terminal's location information. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 A schematic diagram of a communication network authentication method flow in accordance with an embodiment of the present application;

[0082] Figure 2 This is an example diagram of the SUCI structure of an embodiment of the present application;

[0083] Figure 3 A schematic diagram of a communication network authentication method flow in accordance with an embodiment of the present application;

[0084] Figure 4 A schematic diagram of an identity submission process of a communication network authentication method according to an embodiment of the present application;

[0085] Figure 5 This is a schematic diagram of the main authentication process of the communication network authentication method according to an embodiment of the present application;

[0086] Figure 6 A schematic diagram of an authentication synchronization failure recovery process of a communication network authentication method according to an embodiment of the present application;

[0087] Figure 7 This is a schematic diagram of the structure of a communication network authentication device according to an embodiment of the present application;

[0088] Figure 8 This is a schematic diagram of the structure of a communication network authentication device according to an embodiment of the present application;

[0089] Fig. 9 This is a schematic diagram of the terminal structure of an embodiment of the present application;

[0090] Fig.10 This is a schematic diagram of the first network function structure of an embodiment of the present application. DETAILED DESCRIPTION

[0091] With the rapid development of Internet technology, the network security risks of information systems continue to increase, and the threat challenges are becoming increasingly severe. Cryptographic security is an important foundation for information security and can be used to effectively protect the data security of network information systems. Cryptographic technology is the core technology and important means to protect network information systems.

[0092] At present, the communication network uses the AKA protocol to complete the two-way authentication between the terminal and the network. At the same time, in order to improve the security of SUPI on the air interface, when it is necessary to transmit SUPI through the air interface, the terminal uses the public key of the home network (HN) to encrypt and encapsulate SUPI using the elliptic curve integrated encryption scheme (ECIES) algorithm to generate SUCI, and uses SUCI as an identity identifier to transmit on the air interface, thereby ensuring the privacy security of the terminal user.

[0093] Existing technical solutions have the risk of being tracked, mainly due to the following problems:

[0094] Attack scenario 1: replaying authentication messages leads to leakage of user location information.

[0095] In the eavesdropping phase, the attacker uses a sniffing tool to perform air interface eavesdropping near the target user equipment (UE) and saves the authentication data (RAND, AUTN) of the target UE. RAND is a random number and AUTN is an authentication token.

[0096] In the active attack phase, if the attacker wants to determine whether the target UE is in a certain area, the attacker will broadcast authentication data (RAND, AUTN) through a fake base station in the area where the target UE may appear. The UE that receives the authentication request near the fake base station will process the authentication data and return an error message indicating a synchronization failure (Sync_failure), or a message authentication code (MAC, Message authentication code) verification failure (Mac_failure) error message; the attacker determines whether the target UE is nearby based on the error type of the message returned by the UE. Among them, after the target UE receives the authentication data, since the K used to generate the authentication data is consistent with the K of the target UE, it can pass the MAC verification of AUTN, but because the authentication data is old, the sequence number (SQN_HN) of the home network in AUTN is less than the sequence number (SQN_UE) of the target UE, so the target UE will return an error message indicating a synchronization failure (Sync_failure), and SQN is the sequence number (Sequence Number). After other UEs (non-target UEs) receive the authentication data, they cannot pass the MAC verification of AUTN because the K used to generate the authentication data is inconsistent with the K of the UE, and a MAC verification failure (Mac_failure) error message is returned.

[0097] Attack scenario 2: replaying SUCI leads to leakage of user location information.

[0098] In the eavesdropping phase, the attacker uses a sniffing tool to perform air interface eavesdropping near the target UE and saves the SUCI sent by the target UE during the initial registration process.

[0099] In the active attack phase, if the attacker wants to determine whether the target UE is in a certain area, he will send a strong signal through a fake base station in the area where the target UE may appear, so that the nearby UE will attach to the fake base station, and initiate a deregistration request to the nearby UE, so that the UE will re-initiate a registration request, thereby sending a new SUCI (SUCI_new) to the network side. After receiving SUCI_new, the fake base station replaces SUCI_new with the old SUCI and submits it to the nearby normal base station. After receiving SUCI, the network side will return an authentication message (RAND, AUTN), and the fake base station forwards the authentication message to the nearby UE. The UE that receives the authentication request near the fake base station will process the authentication data and return an authentication success message or a Mac_failure error message. The attacker determines whether the target UE is nearby based on the type of message returned by the UE. Among them, after the target UE receives the authentication data, since the K that generates the authentication data is consistent with the K of the target UE, it can pass the MAC verification of AUTN, so the SQN_HN in AUTN is greater than SQN_UE, so the target UE will return RES* and an authentication success message. After other UEs (non-target UEs) receive the authentication data, they cannot pass the MAC verification of AUTN because the K used to generate the authentication data is inconsistent with the K of the UE, and a Mac_failure error message is returned.

[0100] In summary, existing network authentication schemes have the problem of leaking user location information.

[0101] Based on this, in various embodiments of the present application, the first network function sends the first information and / or the first identifier to the terminal and / or the second network function, the first information is obtained by the HN of the terminal using the shared key with the terminal to encrypt the first random number and / or the first parameter of the HN, or the first information is obtained by the HN using the shared key with the terminal to encrypt and integrity protect the first random number and / or the first parameter of the HN, and the first identifier indicates whether the HN supports the SUPI protection enhancement capability; the terminal receives the first information and / or the first identifier sent by the first network function. In the above scheme, the first information is at least encrypted and obtained by using the shared key of the terminal to encrypt and obtain the first random number and / or the first parameter of the HN, the first random number is the authentication data, the attacker is not easy to obtain the authentication data, and can resist the existing tracking attack on the terminal's location information through the broadcast authentication data of the pseudo base station; the terminal's home network can support the SUPI protection enhancement capability, and enhance the protection of the terminal's SUPI and / or SUCI during the network authentication process, which can resist the existing pseudo base station tracking attack on the terminal's location information based on SUCI, reducing the risk of leakage of the terminal's location information.

[0102] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0103] The embodiment of the present application provides a communication network authentication method, which is applied to a terminal, wherein the terminal includes a user equipment (UE) and / or a mobile equipment (ME). UE is a general term for ME and USIM, and ME and USIM cooperate to complete network authentication. Figure 1 As shown, the method includes:

[0104] Step 101: Receive first information and / or a first identifier sent by a first network function.

[0105] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0106] Here, after the terminal sends the SUCI of the terminal to the first network function, the terminal receives the first information and / or the first identifier sent by the first network function. The first information can be understood as an authentication parameter or authentication data; if the home network of the terminal supports the SUPI protection enhancement capability, the first network function sends the first information and / or the first identifier to the terminal, and the first identifier indicates that the home network of the terminal supports the SUPI protection enhancement capability; if the home network of the terminal does not support the SUPI protection enhancement capability, the first network function sends the first identifier to the terminal, and the first identifier indicates that the home network of the terminal does not support the SUPI protection enhancement capability.

[0107] SUCI is obtained by encrypting the SUPI of the terminal. For example, SUCI is obtained by encrypting SUPI using a shared key between the terminal and the HN, and the shared key may be a temporary symmetric key. SUCI may carry a first key, and the first key may be obtained by encrypting the shared key between the terminal and the HN using the public key of the HN. The shared key may be generated by the terminal based on the public key of the HN using a key encapsulation mechanism (KEM) or other cryptographic algorithms. The shared key may also be derived by the terminal based on a second key through a key derivation function (KDF). The second key may be generated using KEM or other cryptographic algorithms, and the second key may be a temporary symmetric key. Other cryptographic algorithms include but are not limited to a post-quantum cryptography algorithm (PQC), an elliptic curve encryption scheme (ECIES), PQC_KEM, and ECIES_KEM.

[0108] When the first network function receives the SUCI sent by the terminal, the first network function may use the private key of the home network or the private key of the first network function to decrypt the first key to obtain a shared key between the terminal and the HN; and use the shared key to decrypt the SUCI to obtain the SUPI of the terminal. The decryption algorithm used by the first network function to decrypt the first key and / or SUCI corresponds to the encryption algorithm used by the terminal to encrypt the shared key and / or SUPI.

[0109] It should be noted that the first network function includes one or more of the following: unified data management (UDM), unified data repository (UDR), subscriber data management (SDM), authentication credential storage and processing function (ARPF). The first random number is a random number randomly generated by the first network function. The first parameter of HN can be understood as the RAND increment value of the home network set by the first network function for the terminal, which can be expressed as R_HN; one terminal corresponds to one first parameter, and R_HN is stored on the first network function side; the first parameter is used for the terminal to determine the freshness of the first information, that is, to determine whether the first information is newly generated first information (fresh first information) or replayed first information. The first information can be expressed as RAND*. The shared key between HN and the terminal can be expressed as K_KEM.

[0110] On the basis of the first network function sending the first identifier, in order to save signaling overhead, in one embodiment, the first identifier is carried in the AMF in the first authentication token.

[0111] Here, after the terminal sends the SUCI of the terminal to the first network function, the first network function may send a first authentication token to the terminal, and the AMF of the first authentication token carries the first identifier.

[0112] In order to facilitate the network side to learn the support status of the terminal for the SUPI protection enhancement solution, in one embodiment, the SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0113] Here, the second identifier may be carried in available bits of an existing field in the SUCI, or a new field may be added in the SUCI to specifically carry the second identifier, for example, Figure 2 As shown, the second identifier is carried in a newly added SPE field, and the SPE field is a SUPI protection enhancement support bit (SUPI Protection Enhancement Support). Optionally, a new SPE field may also be added in the uplink interface for the terminal to interact with the first network function.

[0114] in, Figure 2The SUCI includes a SUPI type field, a Home Network Identifier field, a Routing Indicator field, an SPE field, a Protection Scheme Identifier field, a Home Network Public Key Identifier field, and a Protection Scheme Output field.

[0115] The SUPI Type field indicates the SUPI type hidden in the SUCI. The Home Network Identifier field is used to carry the Home Network Identifier, indicating the user's home network; when the SUPI type is the International Mobile Subscriber Identity (IMSI), the Home Network Identifier consists of the Mobile Country Code (MCC) and the Mobile Network Code (MNC); when the SUPI type is the Network Access Identifier (NAI), the Home Network Identifier consists of a string of characters of variable length, which represent a domain name. The Routing Indicator field carries the Routing Indicator, which is allocated by the Home Network Operator and provided in the USIM. The Protection Scheme Identifier field is used to carry the Protection Scheme Identifier, indicating whether the SUPI protection scheme is used. The Home Network Public Key Identifier field is used to carry the Home Network Public Key Identifier, which represents a public key provided by the Home Public Land Mobile Network (HPLMN), and is used to indicate which public key is used in the SUPI protection scheme. The value of the Protection Scheme Output field depends on the SUPI protection scheme used.

[0116] It should be noted that, when the first network function learns that the terminal supports the SUPI protection enhancement capability, the first network function may save or secretly save the temporary encryption key of the terminal, the first network function sets the first parameter of the HN of the terminal to 1, or randomly generates the first parameter of the HN of the terminal, and the first network function sends the first information to the terminal, and may also send the first identifier; for example, when the first parameter of the HN of the terminal is represented as R_HN, the first network function sets R_HN=1, or randomly generates R_HN, and the randomly generated R_HN is greater than or equal to 1. When the first network function learns that the terminal does not support the SUPI protection enhancement capability, it indicates that there is no need to enhance the protection of SUPI in the future, and network authentication is performed according to the existing solution.

[0117] In one embodiment, during the process of submitting or sending the SUCI to the first network function, the terminal may also locally save a shared key between the terminal and the HN; and / or locally configure a second parameter, where an initial value of the second parameter is zero.

[0118] Here, the terminal may locally or secretly store the shared key, and / or locally configure the second parameter, when encrypting the SUPI of the terminal with the shared key of the terminal and the HN to obtain the SUCI.

[0119] It should be noted that locally configuring the second parameter can be understood as initializing the second parameter, and setting the second parameter on the terminal side to 0. The second parameter can be understood as a RAND increment value on the terminal side, which can be expressed as R_UE.

[0120] In this embodiment, the terminal can directly use the locally stored shared key between the terminal and the HN to decrypt the first information, without having to calculate the shared key between the terminal and the HN again, saving computing resources and improving decryption efficiency; the terminal configures the second parameter this time so that it can subsequently determine whether the first information is fresh first information or replayed first information based on the first parameter and the second parameter, thereby performing an operation matching the judgment result to resist the tracking attack of the pseudo base station on the terminal's location information in the existing solution, thereby reducing the risk of leaking the terminal's location information.

[0121] On the basis that the first information is at least encrypted using the shared key of the terminal and the HN to encrypt the first parameter (or the first random number and the first parameter) of the HN of the terminal, the terminal can obtain the first parameter based on decryption from the first information, and judge whether the first information is fresh first information or replayed first information based on the first parameter, thereby performing an operation matching the judgment result to resist the tracking attack of the pseudo base station on the location information of the terminal in the existing solution. Based on this, in one embodiment, the method further includes:

[0122] Compare the first parameter with the second parameter to obtain a comparison result;

[0123] Execute a setting operation that matches the comparison result; wherein,

[0124] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0125] Here, the terminal uses the shared key between the terminal and the HN to decrypt the first information to obtain a decryption result, and determines the first random number and / or the first parameter from the decryption result. For example, it can be determined whether the decryption result contains the first parameter based on the length of the decryption result, and / or the first random number and / or the first parameter can be determined in the decryption result; when the first parameter is obtained, the first parameter is compared with the second parameter locally stored in the terminal to obtain a comparison result, and a setting operation matching the comparison result is performed to resist the tracking attack of the pseudo base station on the terminal's location information.

[0126] When the first information is obtained by encrypting at least the first parameter of HN using the shared key between the terminal and HN, the terminal decrypts the first information using the shared key to obtain the first parameter. When the first information is obtained by encrypting at least the first random number and the first parameter of HN using the shared key, the first information is decrypted using the shared key, and the first random number and the first parameter are determined from the decryption result. For example, when the first information is obtained by encrypting R1||R_HN using K_KEM (a shared key between the terminal and HN), that is, RAND*(first information)=E(K_KEM, R1||R_HN), E represents a symmetric encryption algorithm, R1 is a first random number, and R_HN is a first parameter of HN, then the terminal uses K_KEM to decrypt RAND* to obtain R1||R_HN; since R1||R_HN is obtained by splicing or concatenating R1 and R_HN, and the length of R1 and the length of R_HN are fixed, the terminal can determine R1 and R_HN in R1||R_HN based on the length of R1 and the length of R_HN; the terminal can determine R1 and R_HN based on the comparison result of R_HN and R_UE (second parameter). In actual application, the length of R1||R_HN is 128 bits, the length of the first random number R1 is 96 bits, and the length of R_HN is 32 bits.

[0127] On the basis that the first information is obtained by encrypting at least the first parameter of the HN (or the first random number and the first parameter) using the shared key of the terminal and the HN, in order to resist the tracking attack of the pseudo base station on the location information of the terminal in the existing solution, in one embodiment, the method further includes one or more of the following:

[0128] Based on a comparison result between the first parameter and the second parameter, determining whether the first information is new first information or replayed first information;

[0129] When the first parameter is greater than the second parameter, updating the second parameter to the first parameter;

[0130] In a case where the first parameter is greater than the second parameter, determining a third parameter based on the shared key, the first random number and / or the first parameter, wherein the third parameter is used to verify the legitimacy of the first authentication token sent by the first network function;

[0131] When the first parameter is less than or equal to the second parameter, a second random number is generated, where the second random number is used to trigger the USIM to feedback an authentication error message; wherein,

[0132] The first parameter and / or the first random number is determined based on the shared key and the first information; or, the first parameter and / or the first random number is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0133] In one embodiment, when the first parameter is greater than the second parameter, the first information is new first information; or, when the first parameter is less than or equal to the second parameter, the first information is replayed first information.

[0134] Here, the terminal determines the first parameter and / or the first random number based on the shared key between the terminal and the HN and the first information. For the specific implementation process, please refer to the relevant description above, which will not be repeated here.

[0135] When the terminal determines the first parameter from the first information, one or more of the following may be performed:

[0136] Based on the comparison result of the first parameter and the second parameter, determining whether the first information is new first information or replayed first information; wherein if the first parameter is greater than the second parameter, then the first information is new first information, and if the first parameter is less than or equal to the second parameter, then the first information is replayed first information;

[0137] When the first parameter is greater than the second parameter, the second parameter is updated to the first parameter;

[0138] In the case where the first parameter is greater than the second parameter, a third parameter is determined based on the shared key between the terminal and the HN and the first parameter, and the third parameter is used to verify the legitimacy of the first authentication token (AUTN) sent by the first network function. For example, the third parameter is used to verify the legitimacy of the first authentication token (AUTN) sent by the first network function based on the third parameter and the key in the USIM in the terminal, thereby authenticating the network side; the third parameter may be a hash value obtained by performing a hash operation on the shared key between the terminal and the HN and the first parameter, and the hash value may be described as a digest value;

[0139] When the first parameter is less than or equal to the second parameter, a second random number is generated, and the second random number is used to trigger the USIM to feedback an authentication error message; the second random number is used for the ME to input an incorrect random number to the USIM, causing the USIM to make a calculation error and thus return an authentication error message, or the second random number can be understood as an incorrect random number. Since the second random number is incorrect, the USIM will return an authentication error message in subsequent steps, such as MAC_failure.

[0140] When the terminal determines the first random number and the first parameter from the first information, one or more of the following is performed:

[0141] Based on the comparison result of the first parameter and the second parameter, determining whether the first information is new first information or replayed first information;

[0142] When the first parameter is greater than the second parameter, the second parameter is updated to the first parameter;

[0143] When the first parameter is greater than the second parameter, a third parameter is determined based on the shared key between the terminal and the HN, the first random number and / or the first parameter; wherein the third parameter may be a hash value obtained by performing a hash operation on the shared key between the terminal and the HN and the first parameter of the HN, or may be a hash value obtained by performing a hash operation on the shared key between the terminal and the HN and the first random number, or may be a hash value obtained by performing a hash operation on the shared key between the terminal and the HN, the first random number and the first parameter of the HN, for example, the third parameter=HASH(K_KEM, R1||R_HN);

[0144] When the first parameter is less than or equal to the second parameter, a second random number is generated.

[0145] On the basis that the first information is obtained by encrypting and / or integrity protecting the first parameter of the HN (or the first random number and the first parameter) using the shared key between the terminal and the HN, in one embodiment, the method further includes:

[0146] When the first parameter is zero, determining a second random number, and / or sending a new SUCI to the first network function; wherein,

[0147] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability; the second random number is used to trigger the USIM to feedback an authentication error message.

[0148] Here, when the first parameter is zero, it means that the home network or the first network function indicates that the terminal should re-initiate the identity submission process or the initial registration process. At this time, the terminal can determine the second random number, for example, randomly generate the second random number, and the ME in the terminal sends the second random number to the USIM. Since the second random number is wrong, the USIM will return an authentication error message to the ME in a subsequent step; after the terminal submits the authentication error message returned by the USIM to the network side, it actively initiates the identity submission process or the initial registration process, that is, encrypts the SUPI and submits the newly encrypted SUCI.

[0149] Correspondingly, the embodiment of the present application also provides a communication network authentication method, which is applied to a first network function, and the first network function includes but is not limited to UDM, UDR, SDM, and ARPF. Figure 3 As shown, the method includes:

[0150] Step 301: Send first information and / or a first identifier to a terminal and / or a second network function.

[0151] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0152] Here, the first network function can directly or indirectly send the first information and / or the first identification to the terminal. For example, the first network function can directly send the first information and / or the first identification to the terminal, and the first network function can also send the first information and / or the first identification to the terminal through the second network function; the second network function includes but is not limited to: authentication service function / authentication service function (AUSF, Authentication Server Function) and / or security anchor function (SEAF, Secure Anchor Function). The first network function is located in the terminal's home network, and the second network function is located in the terminal's service network (SN, Server Network); when the terminal's home network provides services for the terminal, the first network function can directly send the first information and / or the first identification to the terminal.

[0153] For example, after receiving the SUCI sent by the terminal, the first network function may use the private key of the home network to decrypt the first key to obtain the shared key between the terminal and the HN, because the SUCI carries the first key, and the first key is obtained by encrypting the shared key between the terminal and the HN using the private key of the home network; and decrypt the SUCI using the shared key to obtain the SUPI of the terminal. The first network function may use the shared key to encrypt the first random number and / or the first parameter of the HN to obtain the first information, or use the shared key to encrypt and integrity protect the first random number and / or the first parameter of the HN to obtain the first information, if the home network of the terminal supports the SUPI protection enhancement capability; then, directly send the first information and / or the first identifier to the terminal, or send the first identifier to the terminal through the second network function, the first identifier indicating that the home network of the terminal supports the SUPI protection enhancement capability. If the home network of the terminal does not support the SUPI protection enhancement capability, after receiving the SUCI sent by the terminal, the first network function sends the first identifier to the terminal, the first identifier indicating that the home network of the terminal does not support the SUPI protection enhancement capability, and at this time, the first network function performs network authentication according to the existing solution.

[0154] In order to save signaling overhead, in one embodiment, the first identifier is carried in the AMF in the first authentication token, and / or the SUCI sent by the terminal carries a second identifier, and the second identifier indicates whether the terminal supports SUPI protection enhancement capability.

[0155] Here, bits 1-7 and bits 8-15 of the AMF in the first authentication token (AUTN) are reserved bits, the default is 0, and a fixed position in the reserved bits can be selected to carry or bear the first identifier.

[0156] In one embodiment, before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes:

[0157] In a case where the SUCI of the terminal is decrypted using the shared key to obtain the SUPI, the shared key is saved; and / or the first parameter is set to 1.

[0158] Here, saving the shared key can be described as password saving the shared key between the terminal and the HN. The first network function can set the first parameter of the HN to 1, or randomly generate the first parameter, and the first parameter is greater than or equal to 1; for example, set R_HN to 1, or randomly generate R_HN and R_HN≥1.

[0159] It should be noted that the length of the first parameter can be greater than or equal to 24 bits and less than or equal to 64 bits; in actual application, the length of the first parameter is 32 bits.

[0160] In this embodiment, the first network function locally stores the shared key between the HN and each terminal so that the shared key between the HN and the terminal can be directly used to encrypt the authentication parameters that need to be sent to the terminal in the future, so as to resist the tracking attack of the pseudo base station on the terminal's location information in the existing scheme; the first network function sets the first parameter so that the terminal determines whether the received authentication parameter is newly generated or replayed based on the first parameter, and thus performs corresponding operations to resist the tracking attack of the pseudo base station on the terminal's location information in the existing scheme, thereby reducing the risk of leakage of the terminal's location information.

[0161] In order to implement network authentication to ensure the privacy security of the terminal, in one embodiment, before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes one or more of the following:

[0162] generating a first random number;

[0163] When the first condition is met, generating the first random number;

[0164] Determine a fourth parameter based on the shared key, the first random number and the first parameter, wherein the fourth parameter is used to calculate the AV;

[0165] Encrypt the first random number and / or the first parameter of the terminal using the shared key to obtain the first information;

[0166] The first random number and / or the first parameter of the terminal are encrypted and integrity protected using the shared key to obtain the first information.

[0167] In one embodiment, the first condition includes one or more of the following:

[0168] The terminal supports SUPI protection enhancement capability;

[0169] The SUCI of the terminal indicates that the terminal supports SUPI protection enhancement capability;

[0170] The SUCI of the terminal carries a second identifier, and the second identifier indicates that the terminal supports SUPI protection enhanced capability;

[0171] The home network of the terminal supports SUPI protection enhancement capability;

[0172] The first identifier indicates that the home network of the terminal supports SUPI protection enhancement capability;

[0173] The shared key exists;

[0174] The first parameter exists.

[0175] Here, the first network function may randomly generate a first random number, and the length of the first random number may be 96 bits.

[0176] The first network function may determine a fourth parameter based on a shared key between the HN and the terminal, a first random number, and a first parameter of the HN. The fourth parameter may be a hash value obtained by performing a hash operation on the shared key, the first random number, and the first parameter of the HN. For example, the fourth parameter = HASH (K_KEM, R1||R_HN). Considering compatibility, the length of the fourth parameter is 128 bits. K_KEM and R1||R_HN may be combined in a set combination manner and then hashed. The set combination manner may be, for example, K_KEM||R1||R_HN, or an exclusive OR (xor) operation may be performed on K_KEM and R1||R_HN, etc., expressed as K_KEM xorR1||R_HN.

[0177] The first network function can calculate AV, which can be expressed as AV = (fourth parameter RAND, first authentication token AUTN, XRES, CK, IK), that is, AV can include these five parameters. Among them, XRES is the expected response (expectedResponse), which indicates the expected correct result of running the identity authentication algorithm and the expected UE authentication response parameters. CK is the encryption key (Cipher Key), CK is an optional parameter; IK is the integrity key (Integrity Key), IK is the integrity key of the subsequent session.

[0178] The first network function uses the shared key K_KEM of HN and the terminal to encrypt R1||R_HN to obtain the first information, for example, RAND*=E(K_KEM, R1||R_HN); since the length of R1||R_HN is 128 bits, the output packet length of the symmetric encryption algorithm E can be 128 bits to be compatible with the original protocol.

[0179] In order to resist tracking attacks on the location information of the terminal and reduce the risk of leaking the location information of the terminal, in one embodiment, before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes one or more of the following:

[0180] When the first parameter is at a maximum value, setting the first parameter to zero;

[0181] In case the first parameter is zero or a maximum value, instructing the terminal to resubmit the SUCI;

[0182] When the first parameter is greater than zero and less than a maximum value, the first parameter is incremented.

[0183] Here, the first network function determines whether the first parameter has reached the maximum value, for example, whether R_HN has reached the maximum value; when the first parameter is the maximum value, the first parameter is set to zero, for example, when R_HN=0 or (R_HN+1)≥R_HN_MAX, it indicates that R_HN has reached the maximum value, and R_HN is set to 0. When the length of R_HN is 32 bits, R_HN_MAX=2 32 =4294967296. If it is used once per second, it can be used for about 136 years. That is, between two identity submission processes, R_HN will hardly reach the maximum value.

[0184] Instructing the terminal to resubmit the SUCI may be understood as instructing the terminal to re-initiate an identity submission process or an initial registration process.

[0185] The first parameter is incremented, which can be expressed as R_HN=R_HN+1. When the length of R_HN is long enough, for example, the length of R_HN is greater than or equal to 32 bits, determining whether the first parameter has reached the maximum value can be an optional step, and R_HN=R_HN+1 can be directly set.

[0186] When the terminal receives the first authentication token sent by the first network function, and the USIM in the terminal verifies the first authentication token (AUTN) and generates an SQN out-of-sync problem, the USIM generates a second authentication token and returns it to the ME in the terminal, and the terminal sends a resynchronization mark AUTS (Resynchronisation Token) to the second network function, thereby synchronizing the SQN with the network side. Based on this, in one embodiment, after sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes:

[0187] receiving the first information and / or the second authentication token sent by the second network function;

[0188] Verify the legitimacy of the first information and / or the second authentication token.

[0189] Here, when the terminal receives the first authentication token sent by the first network function, and the USIM in the terminal verifies the first authentication token (AUTN) and generates an SQN asynchronization problem, the USIM generates a second authentication token and returns it to the ME in the terminal. The terminal sends the second authentication token to the second network function. The second authentication token can be understood as a resynchronization mark AUTS (Authentication Token for Re-Synchronization, Re-Synchronization Token). AUTS is formed by concatenating the result obtained by XORing the SQN_UE on the terminal side with the authentication key AK with the MAC, for example, The second network function receives the second authentication token sent by the terminal, and sends the second authentication token and / or the first information to the first network function. The first network function receives the second authentication token and / or the first information sent by the second network function, and verifies the legitimacy of the first information and / or the second authentication token; if the first information and / or the second authentication token are legitimate, the SQN_HN on the home network side is updated based on SQN_UE to achieve SQN synchronization. Among them, the first network function can verify the legitimacy of the first information and / or the second authentication token in the presence of a shared key between the HN and the terminal and / or a first parameter of the HN. In the absence of a shared key between the HN and the terminal and / or the absence of the first parameter of the HN, it indicates that the terminal does not need to perform enhanced protection on the SUPI, and network authentication is performed according to the existing protocol.

[0190] In one embodiment, the verifying the legitimacy of the first information and / or the second authentication token includes:

[0191] Decrypting the first information using the shared key to obtain second information;

[0192] Determine a fifth parameter based on the shared key and the second information;

[0193] When the fifth parameter is the same as the fourth parameter, the first information is determined to be legal, and / or the legitimacy of the second authentication token is verified based on the fifth parameter or the first random number; the fourth parameter is determined based on the shared key, the first random number and / or the first parameter.

[0194] Here, a hash function can be used to perform a hash operation on the second information and a shared key between the HN and the terminal to obtain a fifth parameter; a hash function can be used to perform a hash operation on the shared key and the decryption result of the first information to obtain a fourth parameter, and the decryption result of the first information includes a first random number and / or a first parameter; the legitimacy of the first information is verified based on the fourth parameter and the fifth parameter, wherein when the fifth parameter is the same as the fourth parameter, the first information is legal, and when the fifth parameter is different from the fourth parameter, the first information is illegal.

[0195] In the case where the fifth parameter is the same as the fourth parameter, if the fifth parameter includes the first random number, then the legitimacy of the second authentication token (AUTS) is verified based on the first random number. In the case of, the first network function can calculate the authentication key AK based on the first random number, based on AK and The SQN_UE is determined, and the MAC in the AUTS is determined based on the SQN_UE, the first random number and the authentication key AK; when the MAC in the AUTS is the same as the MAC on the network side, the AUTS is legal, and the SQN_HN on the home network side is updated based on the SQN_UE.

[0196] In order to reduce unnecessary computational waste, the first network function may decrypt the first information when confirming that enhanced protection of the terminal SUPI is required. Based on this, in one embodiment, the use of the shared key to decrypt the second information to obtain the third information includes:

[0197] In the case where the shared key and the first parameter exist, the first information is decrypted using the shared key to obtain second information.

[0198] The present application is described in further detail below in conjunction with application examples.

[0199] The communication network authentication method provided in the embodiment of the present application mainly consists of an identity submission process, a main authentication process and an authentication synchronization fault recovery process. The following takes the terminal as UE, the first network function as UDM, and the second network function as SEAF as an example, and introduces these three processes in sequence in combination with the accompanying drawings.

[0200] Figure 4 The identity submission process is shown in Figure 4 As shown, the identity submission process includes the following steps:

[0201] Step 1: When the network side requires the UE to send SUCI for network authentication, the ME in the UE reads the SUPI of the USIM. The ME in the UE generates a shared key K_KEM between the HN and the UE based on the key encapsulation encryption mechanism (KEM_ENC) using the public key of the UE's home network, and uses K_KEM to encrypt the UE's SUPI to obtain SUCI, and secretly saves K_KEM, and sets the second parameter R_UE=0.

[0202] K_KEM may be a temporary symmetric key sk generated by using the public key of the home network based on the KEM technology, or may be derived from the temporary symmetric key sk through a function such as KDF. The second parameter may be understood as a RAND increment value on the UE side.

[0203] SUCI carries a second identifier and an encrypted K_KEM, where the second identifier indicates whether the UE supports SUPI protection enhancement capability. The second identifier can be carried in Figure 2 For example, when the value of the second identifier is 1, it indicates that the UE supports the SUPI protection enhancement capability; when the value of the second identifier is 0, it indicates that the UE does not support the SUPI protection enhancement capability.

[0204] It should be noted that since the Elliptic Curve Integrated Encryption Scheme (ECIES) currently uses the Elliptic Curve Cryptography (ECC) algorithm based on elliptic curves, in order to cope with quantum attacks, PQC can be used to replace ECC in ECIES. Therefore, KEM_ENC or KEM_DEC in the scheme description can also support ECIES_KEM or PQC_KEM and other algorithms.

[0205] Step 2: The ME in the UE sends an Initial Registration Request to the SEAF of the service network SN, carrying the SUCI.

[0206] Step 3: The SEAF of the SN sends the SUCI to the UDM of the home network HN. The SUCI may be carried in the authentication information acquisition request (Nudm_Authenticate_Get Request).

[0207] Step 4: The UDM of HN receives SUCI, decrypts SUPI based on KEM_DNC, saves K_KEM secretly, and sets R_HN=1.

[0208] Here, the UDM of the HN is based on KEM_DNC, uses the private key of the home network to determine the shared key K_KEM between the HN and the UE, uses K_KEM to decrypt the SUCI to obtain the SUPI, and detects whether the SUCI carries the second identifier.

[0209] When the second identifier is carried in the SUCI and the second identifier indicates that the UE supports the SUPI protection enhancement capability, it means that the ME supports the SUPI protection enhancement, the UDM of the HN secretly saves K_KEM locally, sets R_HN=1, or randomly generates R_HN (R_HN≥1). R_HN is the first parameter of the HN, which can be understood as the RAND increment value on the HN side. The length of R_HN is 24bit-64bit, for example, the length of R_HN is 32bit, and the length of R_HN in the following description is 32bit.

[0210] When the second identifier is carried in the SUCI and the second identifier indicates that the UE does not support the SUPI protection enhancement capability, it means that the ME does not support the SUPI protection enhancement, and the UDM of the HN performs network authentication in the existing manner.

[0211] After the UE and the network complete the identity submission process, the main authentication process is executed. Figure 5 The main authentication process is shown as Figure 5 As shown, the main authentication process includes the following steps:

[0212] Step 1: After receiving SUCI, the UDM of the HN determines whether the current user supports SUPI enhanced protection.

[0213] Here, the UDM of the HN decrypts the SUCI carried in each Nudm_Authenticate_Get Request to obtain the SUPI. For the specific implementation process, please refer to the relevant description above.

[0214] The method for the UDM of the HN to determine whether the current user supports SUPI enhanced protection may be: determining whether the second identifier carried by the SUCI indicates that the UE supports SUPI enhanced protection capability, and determining whether the HN supports SUPI enhanced protection, that is, determining whether K_KEM and R_HN are stored in the UDM. If K_KEM and R_HN exist in the UDM, the HN supports SUPI enhanced protection; if K_KEM and / or R_HN do not exist in the UDM, the HN does not support SUPI enhanced protection.

[0215] If the UE supports the SUPI enhanced protection capability and the HN supports the SUPI enhanced protection, indicating that the SUPI needs to be enhanced protected later, then execute step 2 to step 5. If the UE does not support the SUPI enhanced protection capability and / or the HN does not support the SUPI enhanced protection, indicating that the SUPI does not need to be enhanced protected later, then the UDM of the HN is executed according to the original standard protocol, that is, the UDM of the HN performs network authentication according to the existing method.

[0216] Step 2: The UDM of HN generates the first random number R1 and calculates RAND=HASH(K_KEM, R1||R_HN).

[0217] Here, the UDM of HN can randomly generate a first random number R1, and the length of R1 is 96 bits; RAND=HASH(K_KEM, R1||R_HN) is calculated, and RAND is used to calculate AV.

[0218] Considering compatibility, the length of RAND is 128 bits. K_KEM and R1||R_HN can be combined in a set combination and then hashed, such as K_KEM||R1||R_HN, or an exclusive OR (xor) operation can be performed on K_KEM and R1||R_HN, expressed as K_KEM xor R1||R_HN.

[0219] Step 3: The UDM of HN sets the AMF of the first authentication token (AUTN) and calculates AV = (RAND, AUTN, XRES, CK, IK).

[0220] Here, the UDM of the HN sets a first flag in the reserved bit of the AMF of the first authentication token, and the first flag indicates whether the HN of the UE supports the SUPI protection enhancement capability; since K_KEM and R_HN exist in the UDM, the first flag indicates that the HN of the UE supports the SUPI protection enhancement capability.

[0221] Step 4: The UDM of HN uses K_KEM to encrypt R1||R_HN to obtain the first information RAND*, that is, RAND*=E(K_KEM, R1||R_HN).

[0222] Here, since the length of R1||R_HN is 128 bits, the length of the output data of the symmetric encryption algorithm E is 128 bits to be compatible with the original protocol.

[0223] Step 5: The UDM of HN determines whether R_HN is 0 or has reached the maximum value; if so, set R_HN=0; if not, set R_HN=R_HN+1.

[0224] Here, if R_HN = 0 or (R_HN + 1) ≥ R_HN_MAX, it means that R_HN has reached the maximum value. The UDM of HN sets R_HN to 0 to indicate that the UE should re-initiate the identity submission process.

[0225] If R_HN is not 0 and (R_HN + 1) < R_HN_MAX, it means that R_HN is still within the normal range. Then increment R_HN and save it, R_HN = R_HN + R_DELTA; here R_DELTA can be 1 or some other smaller value, and it is recommended to be 1.

[0226] It should be noted that when the length of R_HN is 32 bits, R_HN_MAX = 2 32 = 4294967296. If it is used once per second, it can be used for about 136 years. That is, between two identity submission processes, R_HN hardly reaches the maximum value. When the length of R_HN is large enough, that is, the length of R_HN is greater than or equal to 32 bit, step 5 can be an optional step, and R_HN = R_HN + 1 can be directly set.

[0227] Step 6: The UDM of HN sends RAND* (the first message) and AUTN (the first authentication token) to the SEAF of SN.

[0228] Here, the UDM of HN uses RAND*, XRES, CK, and IK to derive K AUSF and XRES* through the KDF one-way function, and sends the 5G HE AV containing RAND*, AUTN, XRES*, and K AUSF to the AUSF. Among them, 5G HE AV is the 5G Home Environment Authentication Vector. XRES* represents the expected response parameter, and K AUSF is the intermediate key, which can be understood as the AUSF key.

[0229] The UDM returns the requested 5G HE AV to the SEAF or AUSF in the Authentication Information Acquisition Response (Nudm_UEAuthentication_Get Response) and indicates that the 5G HE AV is used for 5G AKA. If the Authentication Information Acquisition Request (Nudm_UEAuthentication_Get) contains SUCI, the UDM of HN will include SUPI in the Nudm_UEAuthentication_Get.

[0230] The AUSF should temporarily save XRES* and the received SUCI or SUPI. The AUSF can save KAUSF .

[0231] AUSF generates a 5G AV based on the 5G HE AV received from UDM. HXRES* is calculated from RAND* and XRES*, and K AUSF Derived K SEAF Then use HXRES* and K SEAF Replace XRES* and K in 5G HE AV respectively AUSF . K SEAF It is the anchor key, which is bound to the service network SN.

[0232] AUSF should then remove K SEAF , send the 5G SE AV (RAND*, AUTN, HXRES*) to the SEAF of SN through the authentication response (Nausf_UEAuthentication_Authenticate).

[0233] The SEAF of the SN sends RAND* and AUTN to the UE via the Non-Access-Stratum (NAS) message (Auth-Req). The message should also contain the K used by the UE and AMF to identify AMF and ngKSI of a partial native security context, the message shall also include the ABBA parameter. AMF UE and SEAF from K SEAF The derived key. ngKSI (NAS key set identifier) ​​is the NAS key set identifier.

[0234] Step 7: The SEAF of the SN sends an authentication request to the UE, and the authentication request carries RAND* and AUTN.

[0235] Step 8: The ME in the UE obtains the first identifier from the AMF of the AUTN.

[0236] Here, the first identifier is obtained from the AMF of AUTN in the ME in the UE. If the first identifier indicates that the HN supports the SUPI protection enhancement capability, it indicates that the authentication request is SUPI protection enhanced, and step 9 is performed; if the first identifier indicates that the HN does not support the SUPI protection enhancement capability, it indicates that the authentication request has no SUPI protection enhancement, and network authentication is performed in the existing manner.

[0237] Step 9: The ME in the UE decrypts and obtains R1||R_HN=D(K_KEM, RAND*).

[0238] Here, the ME in the UE uses K_KEM to decrypt RAND* to obtain R1||R_HN, that is, R1||R_HN=D(K_KEM, RAND*). The ME in the UE determines R_HN and R1 based on R1||R_HN.

[0239] The ME in the UE compares R_HN with the locally stored R_UE; if R_HN>R_UE, then execute step 10; if R_HN=0, then execute step 11; if R_HN≤R_UE, then execute step 12.

[0240] Step 10: If R_HN>R_UE, then RAND* is the new RAND*, the ME in the UE sets R_UE=R_HN, and calculates RAND=HASH(K_KEM||R1||R_HN).

[0241] Here, if R_HN>R_UE, it indicates that the RAND* received by the UE is a new RAND*, that is, a fresh RAND*, then the ME in the UE updates the second parameter R_UE to the first parameter R_HN; and based on K_KEM, the first random number R1 and the first parameter R_HN, calculates the third parameter RAND; for example, the third parameter RAND=HASH(K_KEM||R1||R_HN).

[0242] Among them, K_KEM and R1||R_HN can be combined in the same way as HN on the network side and then HASH is performed.

[0243] Step 11: If R_HN=0, the ME in the UE generates a second random number and actively initiates the initial registration process or the identity submission process, that is, encrypts the SUPI and submits the newly encrypted SUCI.

[0244] Here, if R_HN=0, the ME in the UE generates an erroneous random number and obtains a second random number. For example, the second random number is randomly generated. Since the second random number is an erroneous random number, the USIM will make a calculation error based on the second random number in subsequent steps and return an authentication error message, such as MAC_failure.

[0245] Step 12: If R_HN<=R_UE, RAND* is the replayed RAND*, and the ME in the UE generates a second random number.

[0246] Here, if R_HN<=R_UE, it indicates that the RAND* received by the UE is the replayed RAND*, then the ME in the UE generates an erroneous random number to obtain a second random number. For example, the second random number is randomly generated, or an erroneous random number, i.e., the second random number, is calculated based on K_KEM and the second parameter R_UE, such as the second random number RAND=HASH(K_KEM, R_UE).

[0247] Since the second random number RAND is an incorrect random number, the USIM will return an authentication error message, such as MAC_failure, in a subsequent step.

[0248] Step 13: The ME of the UE sends the second random number and AUTN to the USIM of the UE.

[0249] Step 14: The UE's USIM verifies the AUTN.

[0250] Here, after the USIM of the UE receives the second random number and the AUTN, the USIM of the UE checks whether the AUTN is accepted, so as to verify whether the AV is the latest AV. If the AUTN verification is successful, then step 15 is executed.

[0251] Step 15: The UE's USIM calculates RES, CK and IK.

[0252] Here, the USIM of the UE calculates the response RES, CK and IK. RES represents the authentication response parameter.

[0253] Step 16: The UE's USIM returns RES, CK, and IK to the UE's ME.

[0254] Step 17: UE's ME calculates RES* from RES and derives K from CK||IK AUSF , from K AUSF Derived K SEAF .

[0255] Here, RES* represents an authentication response parameter.

[0256] It should be noted that the ME accessing 5G checks whether the "separation bit" of the AMF field of AUTN is set to 1 during authentication. The "separation bit" is the 0th bit of the AMF field of AUTN. The value of the "separation bit" is 1, indicating that the generated AV is used for 5G AKA authentication. This "separation bit" in the AMF of AUTN can no longer be used for operator-specific purposes.

[0257] Step 18: The ME of the UE sends an authentication response to the SEAF of the SN, and the authentication response carries RES*.

[0258] After that, the SEAF of the SN calculates HRES* based on RAND* and RES*, and compares HRES* with HXRES*. If HRES* and HXRES* are the same or consistent, then the SEAF of the SN considers the authentication successful from the perspective of the service network. If HRES* and HXRES* are inconsistent, then the SEAF of the SN considers the authentication failed and indicates the failure to the AUSF.

[0259] The SEAF of the SN sends the SUCI or SUPI from the UE to the AUSF. For example, the SEAF sends the SUCI or SUPI from the UE to the AUSF via a Nausf_UEAuthentication_Authenticate Request message.

[0260] In case the AUSF receives a Nausf_UEAuthentication_Authenticate Request message containing a RES*, the AUSF may verify whether the AV has expired. If the AV has expired, the AUSF may consider the authentication unsuccessful from the perspective of the home network. The AUSF compares the received RES* with the stored XRES*. If the RES* and XRES* are consistent, the AUSF considers the authentication successful from the perspective of the home network.

[0261] The AUSF shall indicate to the SN's SEAF whether the authentication is successful via Nausf_UEAuthentication_Authenticate Response. If the authentication is successful, then K SEAF If the AUSF receives SUCI from SEAF when starting authentication and the authentication is successful, the AUSF shall also include the SUPI in the Nausf_UEAuthentication_Authenticate Response.

[0262] If the authentication is successful, the SN's SEAF receives the K received from the Nausf_UEAuthentication_AuthenticateResponse message. SEAF As the anchor key. SEAF should then SEAF , ABBA parameters and SUPI to derive K AMF and provide ngKSI and K AMF .

[0263] If SUCI is used for this authentication, SEAF shall provide ngKSI and K to AMF only after receiving Nausf_UEAuthentication_Authenticate Response message containing SUPI. AMF ; No communication service will be provided to the UE until the serving network learns the SUPI.

[0264] After the UE and the network complete the main authentication process, they execute the authentication synchronization fault recovery process. Figure 6 shows authentication synchronization failure recovery, such as Figure 6 As shown, authentication synchronization failure recovery includes the following steps:

[0265] Step 1: The USIM of the UE receives the second random number and AUTN sent by the ME of the UE, and the USIM of the UE verifies the AUTN to determine whether there is an SQN asynchronization problem.

[0266] Step 2: When the UE's USIM verifies AUTN and finds that the SQN is out of sync, the UE's USIM generates a second authentication token AUTS.

[0267] Here, the second authentication token AUTS is formed by concatenating the result obtained by XORing the SQN_UE on the UE side with the authentication key AK and MAC, for example,

[0268] Step 3: The USIM of the UE sends an AUTS to the ME of the UE.

[0269] Step 4: The ME of the UE sends an authentication failure message to the SEAF of the SN. The authentication failure message carries AUTS and Sync_failure.

[0270] Here, the authentication failure message may be an Authentication Failure message. Sync_failure indicates that the SQN synchronization fails.

[0271] Step 5: The SEAF of the SN sends the first information RAND*, AUTS and Sync_failure to the UDM of the HN.

[0272] Step 6: The UDM of the HN receives the first information RAND*, AUTS and Sync_failure, and determines whether the current user supports SUPI enhanced protection.

[0273] Here, the UDM of the HN determines whether the K_KEM and R_HN of the current UE exist locally; if the K_KEM and R_HN of the current UE exist locally, it means that the current user supports SUPI enhanced protection, and step 7 is executed; if the K_KEM and / or R_HN of the current UE do not exist locally, it means that the current user does not need SUPI enhanced protection, and authentication synchronization failure recovery is performed according to the existing method.

[0274] Step 7: HN's UDM decrypts RAND* to obtain the second information R1||R_HN, R1||R_HN=D(K_KEM, RAND*).

[0275] Here, the UDM of HN uses K_KEM to decrypt RAND* to obtain the second information R1||R_HN.

[0276] Step 8: The UDM of HN calculates the fifth parameter RAND, and the fifth parameter RAND=HASH(K_KEM, R1||R_HN).

[0277] Here, the UDM of HN performs a hash operation on K_KEM and the second information to obtain the fifth parameter

[0278] Step 9: HN's UDM verifies the legitimacy of RAND* and AUTS, and synchronizes SQN parameters.

[0279] Here, when the UDM of HN determines the fifth parameter, it compares the fifth parameter with the fourth parameter. When the fifth parameter is the same as the fourth parameter, the first information RAND* is legal; when the fifth parameter is different from the fourth parameter, the first information RAND* is illegal. The fourth parameter is a hash value obtained by performing a hash operation on K_KEM, the first random number R1 and the first parameter R_HN.

[0280] When the fifth parameter is the same as the fourth parameter, the legitimacy of AUTS is verified based on the first random number R1. In the case of, the UDM of HN can calculate the authentication key AK based on the first random number R1, and the authentication key AK based on AK and Determine the SQN_UE, and determine the MAC in AUTS based on the SQN_UE, the first random number R1 and the authentication key AK; when the MAC in AUTS is the same as the MAC on the network side, AUTS is legal, and the SQN_HN on the home network side is updated based on the SQN_UE.

[0281] In order to implement the method on the terminal side of the embodiment of the present application, the embodiment of the present application also provides a communication network authentication device, which is set on the terminal, such as Figure 7 As shown, the device comprises:

[0282] The first receiving unit 701 is configured to receive first information and / or a first identifier sent by a first network function;

[0283] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0284] In one embodiment, the device further comprises:

[0285] A comparing unit, used for comparing the first parameter with the second parameter to obtain a comparison result;

[0286] The first processing unit is used to execute a setting operation matching the comparison result; wherein,

[0287] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0288] In one embodiment, the first processing unit is further configured to:

[0289] Based on a comparison result between the first parameter and the second parameter, determining whether the first information is new first information or replayed first information;

[0290] When the first parameter is greater than the second parameter, updating the second parameter to the first parameter;

[0291] In a case where the first parameter is greater than the second parameter, determining a third parameter based on the shared key, the first random number and / or the first parameter, wherein the third parameter is used to verify the legitimacy of the first authentication token sent by the first network function;

[0292] When the first parameter is less than or equal to the second parameter, a second random number is generated, where the second random number is used to trigger the USIM to feedback an authentication error message; wherein,

[0293] The first parameter and / or the first random number is determined based on the shared key and the first information; or, the first parameter and / or the first random number is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0294] In one embodiment, when the first parameter is greater than the second parameter, the first information is new first information; or

[0295] In a case where the first parameter is less than or equal to the second parameter, the first information is the reproduced first information.

[0296] In one embodiment, the first processing unit is further configured to determine a second random number and / or send a new SUCI to the first network function when the first parameter is zero; wherein,

[0297] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability;

[0298] The second random number is used to trigger the USIM to feed back an authentication error message.

[0299] In one embodiment, the shared key is stored locally during the process of the terminal submitting the SUCI to the first network function; and / or

[0300] The second parameter is configured in the process of the terminal submitting the SUCI to the first network function, and the initial value of the second parameter is zero.

[0301] In one embodiment, the first identifier is carried in the AMF in the first authentication token; and / or

[0302] The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0303] In actual application, the first receiving unit 701 and the first processing unit can be implemented by a processor in the communication network authentication device in combination with a communication interface, and the comparison unit can be implemented by a processor in the communication network authentication device.

[0304] In order to implement the method on the first network function side of the embodiment of the present application, the embodiment of the present application also provides a communication network authentication device, which is arranged on the first network function, such as Figure 8 As shown, the device comprises:

[0305] A first sending unit 801 is configured to send first information and / or a first identifier to a terminal and / or a second network function;

[0306] The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

[0307] In one embodiment, the device further comprises:

[0308] The second processing unit is configured to, when using the shared key to decrypt the SUCI of the terminal to obtain the SUPI, save the shared key; and / or set the first parameter to 1.

[0309] In one embodiment, the second processing unit is further configured to:

[0310] generating a first random number;

[0311] When the first condition is met, generating the first random number;

[0312] Determine a fourth parameter based on the shared key, the first random number and the first parameter, wherein the fourth parameter is used to calculate the AV;

[0313] Encrypt the first random number and / or the first parameter of the terminal using the shared key to obtain the first information;

[0314] The first random number and / or the first parameter of the terminal are encrypted and integrity protected using the shared key to obtain the first information.

[0315] In one embodiment, the first condition includes one or more of the following:

[0316] The terminal supports SUPI protection enhancement capability;

[0317] The SUCI of the terminal indicates that the terminal supports SUPI protection enhancement capability;

[0318] The SUCI of the terminal carries a second identifier, and the second identifier indicates that the terminal supports SUPI protection enhanced capability;

[0319] The home network of the terminal supports SUPI protection enhancement capability;

[0320] The first identifier indicates that the home network of the terminal supports SUPI protection enhancement capability;

[0321] The shared key exists;

[0322] The first parameter exists.

[0323] In one embodiment, the second processing unit is further configured to:

[0324] When the first parameter is at a maximum value, setting the first parameter to zero;

[0325] In case the first parameter is zero or a maximum value, instructing the terminal to resubmit the SUCI;

[0326] When the first parameter is greater than zero and less than a maximum value, the first parameter is incremented.

[0327] In one embodiment, the device further comprises:

[0328] A second receiving unit, configured to receive the first information and / or a second authentication token sent by the second network function;

[0329] A verification unit, used to verify the legitimacy of the first information and / or the second authentication token.

[0330] In one embodiment, the verification unit is specifically used for one or more of the following:

[0331] Decrypting the first information using the shared key to obtain second information;

[0332] Determine a fifth parameter based on the shared key and the second information;

[0333] When the fifth parameter is the same as the fourth parameter, the first information is determined to be legal, and / or the legitimacy of the second authentication token is verified based on the fifth parameter or the first random number; the fourth parameter is determined based on the shared key, the first random number and / or the first parameter.

[0334] In one embodiment, the verification unit is specifically configured to, in the presence of the shared key and the first parameter, decrypt the first information using the shared key to obtain the second information.

[0335] In one embodiment, the first identifier is carried in the AMF in the first authentication token; and / or

[0336] The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0337] In actual application, the first sending unit 801 and the second receiving unit can be implemented by a processor in the communication network authentication device in combination with a communication interface, and the verification unit and the second processing unit can be implemented by a processor in the communication network authentication device.

[0338] It should be noted that: the above embodiment provides a communication network authentication device, and only uses the division of the above program modules as an example to illustrate when performing communication network authentication. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the communication network authentication device and the communication network authentication method embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0339] Based on the hardware implementation of the above program modules, and in order to implement the method on the terminal side of the embodiment of the present application, the embodiment of the present application also provides a terminal, such as Fig. 9 As shown, the terminal 900 includes:

[0340] The first communication interface 901 is capable of exchanging information with other network nodes;

[0341] The first processor 902 is connected to the first communication interface 901 to implement information exchange with other network nodes, and is used to execute the method provided by one or more technical solutions of the terminal side when running a computer program. The computer program is stored in the first memory 903.

[0342] Specifically, the first communication interface 901 is used to receive the first information and / or the first identifier sent by the first network function; wherein the first information is obtained by the HN of the terminal using a shared key with the terminal to encrypt the first random number and / or the first parameter of the HN, or the first information is obtained by the HN using a shared key with the terminal to encrypt and integrity protect the first random number and / or the first parameter of the HN; the first identifier indicates whether the HN supports SUPI protection enhancement capability.

[0343] In one embodiment, the first processor 902 is used to compare the first parameter with the second parameter to obtain a comparison result; and to perform a setting operation matching the comparison result; wherein,

[0344] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0345] In one embodiment, the first processor 902 is further configured to:

[0346] Based on a comparison result between the first parameter and the second parameter, determining whether the first information is new first information or replayed first information;

[0347] When the first parameter is greater than the second parameter, updating the second parameter to the first parameter;

[0348] In a case where the first parameter is greater than the second parameter, determining a third parameter based on the shared key, the first random number and / or the first parameter, wherein the third parameter is used to verify the legitimacy of the first authentication token sent by the first network function;

[0349] When the first parameter is less than or equal to the second parameter, a second random number is generated, where the second random number is used to trigger the USIM to feedback an authentication error message; wherein,

[0350] The first parameter and / or the first random number is determined based on the shared key and the first information; or, the first parameter and / or the first random number is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

[0351] In one embodiment, when the first parameter is greater than the second parameter, the first information is new first information; or

[0352] In a case where the first parameter is less than or equal to the second parameter, the first information is the reproduced first information.

[0353] In one embodiment, the first processor 902 is further configured to determine a second random number when the first parameter is zero, and / or the first communication interface 901 is further configured to send a new SUCI to the first network function; wherein,

[0354] The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability;

[0355] The second random number is used to trigger the USIM to feed back an authentication error message.

[0356] In one embodiment, the shared key is stored locally during the process of the terminal submitting the SUCI to the first network function; and / or

[0357] The second parameter is configured in the process of the terminal submitting the SUCI to the first network function, and the initial value of the second parameter is zero.

[0358] In one embodiment, the first identifier is carried in the AMF in the first authentication token; and / or

[0359] The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0360] It should be noted that the specific processing process of the first processor 902 and the first communication interface 901 can be understood by referring to the above method.

[0361] Of course, in actual application, the various components in the terminal 900 are coupled together through the bus system 904. It can be understood that the bus system 904 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig. 9 Various buses are labeled as bus system 904.

[0362] The first memory 903 in the embodiment of the present application is used to store various types of data to support the operation of the terminal 900. Examples of such data include: any computer program used to operate on the terminal 900.

[0363] The method disclosed in the above embodiment of the present application can be applied to the first processor 902, or implemented by the first processor 902. The first processor 902 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware or software instructions in the first processor 902. The above-mentioned first processor 902 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 902 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 903, and the first processor 902 reads the information in the first memory 903, and completes the steps of the above method in combination with its hardware.

[0364] In an exemplary embodiment, the terminal 900 may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0365] Based on the hardware implementation of the above program module, and in order to implement the method of the first network function side of the embodiment of the present application, the embodiment of the present application also provides a first network function. Fig.10 As shown, the first network function 1000 includes:

[0366] The second communication interface 1001 is capable of exchanging information with other network nodes;

[0367] The second processor 1002 is connected to the second communication interface 1001 to implement information exchange with other network nodes, and is used to execute the method provided by one or more technical solutions of the first network function side when running a computer program. The computer program is stored in the second memory 1003.

[0368] Specifically, the second communication interface 1001 is used to send the first information and / or the first identifier to the terminal and / or the second network function; wherein the first information is obtained by the HN of the terminal using a shared key with the terminal to encrypt the first random number and / or the first parameter of the HN, or the first information is obtained by the HN using a shared key with the terminal to encrypt and integrity protect the first random number and / or the first parameter of the HN; the first identifier indicates whether the HN supports SUPI protection enhancement capability.

[0369] In one embodiment, the second processor 1002 is configured to, when using the shared key to decrypt the SUCI of the terminal to obtain the SUPI, save the shared key; and / or set the first parameter to 1.

[0370] In one embodiment, the second processor 1002 is further configured to:

[0371] generating a first random number;

[0372] When the first condition is met, generating the first random number;

[0373] Determine a fourth parameter based on the shared key, the first random number and the first parameter, wherein the fourth parameter is used to calculate the AV;

[0374] Encrypt the first random number and / or the first parameter of the terminal using the shared key to obtain the first information;

[0375] The first random number and / or the first parameter of the terminal are encrypted and integrity protected using the shared key to obtain the first information.

[0376] In one embodiment, the first condition includes one or more of the following:

[0377] The terminal supports SUPI protection enhancement capability;

[0378] The SUCI of the terminal indicates that the terminal supports SUPI protection enhancement capability;

[0379] The SUCI of the terminal carries a second identifier, and the second identifier indicates that the terminal supports SUPI protection enhanced capability;

[0380] The home network of the terminal supports SUPI protection enhancement capability;

[0381] The first identifier indicates that the home network of the terminal supports SUPI protection enhancement capability;

[0382] The shared key exists;

[0383] The first parameter exists.

[0384] In one embodiment, the second processor 1002 is further configured to:

[0385] When the first parameter is at a maximum value, setting the first parameter to zero;

[0386] In case the first parameter is zero or a maximum value, instructing the terminal to resubmit the SUCI;

[0387] When the first parameter is greater than zero and less than a maximum value, the first parameter is incremented.

[0388] In one embodiment, the second communication interface 1001 is further used to receive the first information and / or the second authentication token sent by the second network function; and / or

[0389] The second processor 1002 is further configured to verify the legitimacy of the first information and / or the second authentication token.

[0390] In one embodiment, the second processor 1002 is specifically configured to:

[0391] Decrypting the first information using the shared key to obtain second information;

[0392] Determine a fifth parameter based on the shared key and the second information;

[0393] When the fifth parameter is the same as the fourth parameter, the first information is determined to be legal, and / or the legitimacy of the second authentication token is verified based on the fifth parameter or the first random number; the fourth parameter is determined based on the shared key, the first random number and / or the first parameter.

[0394] In one embodiment, the second processor 1002 is specifically configured to, in the presence of the shared key and the first parameter, decrypt the first information using the shared key to obtain the second information.

[0395] In one embodiment, the first identifier is carried in the AMF in the first authentication token; and / or

[0396] The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

[0397] It should be noted that the specific processing process of the second processor 1002 and the second communication interface 1001 can be understood by referring to the above method.

[0398] Of course, in actual application, the various components in the first network function 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1004 .

[0399] The second memory 1003 in the embodiment of the present application is used to store various types of data to support the operation of the first network function 1000. Examples of such data include: any computer program used to operate on the first network function 1000.

[0400] The method disclosed in the above embodiment of the present application can be applied to the second processor 1002, or implemented by the second processor 1002. The second processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 1002. The above-mentioned second processor 1002 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1002 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1003, and the second processor 1002 reads the information in the second memory 1003 and completes the steps of the above method in combination with its hardware.

[0401] In an exemplary embodiment, the first network function 1000 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned method.

[0402] It can be understood that the memory (first memory 903 and second memory 1003) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0403] In an exemplary embodiment, the embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 903 storing a computer program, and the computer program can be executed by the first processor 902 of the terminal 900 to complete the steps of the aforementioned terminal side method. For another example, a second memory 1003 storing a computer program can be executed by the second processor 1002 of the first network function 1000 to complete the steps of the aforementioned first network function side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

[0404] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, which can be executed by the first processor 902 of the terminal 900 to complete the steps of the aforementioned terminal side method. The computer program can be executed by the second processor 1002 of the first network function 1000 to complete the steps of the aforementioned first network function side method.

[0405] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. Multi-items can be two or more items, and a plurality can be two or more. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "one or more" in this article means any combination of at least two of any one or more of a plurality. For example, including one or more of A, B, and C can mean including any one or at least two or more elements selected from the set consisting of A, B, and C.

[0406] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0407] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A communication network authentication method, characterized in that: Applied to a terminal, the method comprises: Receiving first information and / or a first identifier sent by a first network function; wherein, The first information is obtained by encrypting a first random number and / or a first parameter of the HN using a shared key with the terminal by the home network HN of the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; the first identifier indicates whether the HN of the terminal supports a user permanent identity SUPI protection enhanced capability.

2. The method according to claim 1, characterized in that The method further comprises: Compare the first parameter with the second parameter to obtain a comparison result; Execute a setting operation that matches the comparison result; wherein, The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

3. The method according to claim 1, characterized in that: The method may further comprise one or more of the following: Based on a comparison result between the first parameter and the second parameter, determining whether the first information is new first information or replayed first information; When the first parameter is greater than the second parameter, updating the second parameter to the first parameter; In a case where the first parameter is greater than the second parameter, determining a third parameter based on the shared key, the first random number and / or the first parameter, wherein the third parameter is used to verify the legitimacy of the first authentication token sent by the first network function; When the first parameter is less than or equal to the second parameter, a second random number is generated, where the second random number is used to trigger the universal user identity module USIM to feedback an authentication error message; wherein, The first parameter and / or the first random number is determined based on the shared key and the first information; or, the first parameter and / or the first random number is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability.

4. The method according to claim 3, characterized in that When the first parameter is greater than the second parameter, the first information is new first information; or In a case where the first parameter is less than or equal to the second parameter, the first information is the reproduced first information.

5. The method according to claim 1, characterized in that The method further comprises: When the first parameter is zero, determine a second random number, and / or send a new hidden user identity SUCI to the first network function; wherein, The first parameter is determined based on the shared key and the first information; or, the first parameter is determined based on the shared key and the first information when the terminal supports SUPI protection enhanced capability; The second random number is used to trigger the USIM to feed back an authentication error message.

6. The method according to any one of claims 1 to 5, characterized in that: The shared key is stored locally during the process of the terminal submitting SUCI to the first network function; and / or The second parameter is configured in the process of the terminal submitting the SUCI to the first network function, and the initial value of the second parameter is zero.

7. The method according to any one of claims 1 to 5, characterized in that: The first identifier is carried in the authentication management field AMF in the first authentication token; and / or The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

8. A communication network authentication method, characterized in that: Applied to a first network function, the method comprises: Sending first information and / or a first identifier to the terminal and / or the second network function; wherein, The first information is obtained by encrypting a first random number and / or a first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; the first identifier indicates whether the HN supports SUPI protection enhanced capability.

9. The method according to claim 8, characterized in that Before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes: When the shared key is used to decrypt the SUCI of the terminal to obtain the SUPI, the shared key is saved; and / or the first parameter is set to 1.

10. The method according to claim 8 or 9, characterized in that: Before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes one or more of the following: generating a first random number; When the first condition is met, generating the first random number; Determine a fourth parameter based on the shared key, the first random number and the first parameter, wherein the fourth parameter is used to calculate an authentication vector AV; Encrypt the first random number and / or the first parameter using the shared key to obtain the first information; The first random number and / or the first parameter are encrypted and integrity protected using the shared key to obtain the first information.

11. The method according to claim 10, characterized in that The first condition includes one or more of the following: The terminal supports SUPI protection enhancement capability; The SUCI of the terminal indicates that the terminal supports SUPI protection enhancement capability; The SUCI of the terminal carries a second identifier, and the second identifier indicates that the terminal supports SUPI protection enhanced capability; The HN of the terminal supports SUPI protection enhancement capability; The first identifier indicates that the home network of the terminal supports SUPI protection enhancement capability; The shared key exists; The first parameter exists.

12. The method according to claim 8 or 9, characterized in that: Before sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes one or more of the following: When the first parameter is at a maximum value, setting the first parameter to zero; In case the first parameter is zero or a maximum value, instructing the terminal to resubmit the SUCI; When the first parameter is greater than zero and less than a maximum value, the first parameter is incremented.

13. The method according to claim 8 or 9, characterized in that: After sending the first information and / or the first identifier to the terminal and / or the second network function, the method further includes: receiving the first information and / or the second authentication token sent by the second network function; Verify the legitimacy of the first information and / or the second authentication token.

14. The method according to claim 13, characterized in that The verifying the legitimacy of the first information and / or the second authentication token includes: Decrypting the first information using the shared key to obtain second information; Determine a fifth parameter based on the shared key and the second information; When the fifth parameter is the same as the fourth parameter, the first information is determined to be legal, and / or the legitimacy of the second authentication token is verified based on the fifth parameter or the first random number; the fourth parameter is determined based on the shared key, the first random number and / or the first parameter.

15. The method according to claim 14, characterized in that The using the shared key to decrypt the second information to obtain third information includes: In the case where the shared key and the first parameter exist, the first information is decrypted using the shared key to obtain second information.

16. The method according to any one of claims 8, 9, 11, 14 to 15, characterized in that: The first identifier is carried in the AMF in the first authentication token; and / or The SUCI sent by the terminal carries a second identifier, where the second identifier indicates whether the terminal supports the SUPI protection enhancement capability.

17. A communication network authentication device, characterized in that: include: A first receiving unit, configured to receive first information and / or a first identifier sent by a first network function; The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

18. A communication network authentication device, characterized in that: include A first sending unit, configured to send first information and / or a first identifier to a terminal and / or a second network function; The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

19. A terminal, characterized in that: include: A first processor and a first communication interface; wherein, The first communication interface is used to receive the first information and / or the first identifier sent by the first network function; The first information is obtained by encrypting the first random number and / or the first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting the first random number and / or the first parameter of the HN using a shared key with the terminal; and the first identifier indicates whether the HN supports SUPI protection enhanced capability.

20. A network function, characterized in that: include: A second processor and a second communication interface; wherein, The second communication interface is used to send the first information and / or the first identifier to the terminal and / or the second network function; The first information is obtained by encrypting a first random number and / or a first parameter of the HN using a shared key with the terminal, or the first information is obtained by encrypting and integrity protecting a first random number and / or a first parameter of the HN using a shared key with the terminal. The first identifier indicates whether the HN supports SUPI protection enhanced capability.

21. A terminal, characterized in that: comprising a first processor and a first memory for storing a computer program capable of being executed on the first processor, Wherein, when the first processor is used to run the computer program, the steps of the method described in any one of claims 1 to 7 are executed.

22. A network function, characterized in that: comprising a second processor and a second memory for storing a computer program executable on the second processor, Wherein, when the second processor is used to run the computer program, the steps of the method described in any one of claims 8 to 16 are executed.

23. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented, or the steps of the method according to any one of claims 8 to 16 are implemented.

24. A computer program product comprising a computer program, characterized in that The computer program implements the steps of the method according to any one of claims 1 to 16 when executed by a processor.

Images