Virtual terminal simulation device and network access test method thereof

Abstract

The invention belongs to the technical field of mobile communication networks. The invention provides a virtual terminal simulation device and a network access test method thereof. According to the embodiment of the invention, the virtual terminal simulation device based on the software radio platform is adopted, the authentication signaling between the MME and the HSS is utilized, and the bidirectional authentication between the virtual terminal simulation device and the LTE core network is broken through, so that the real network access and specific service test of the virtual terminal equipment without the SIM card are realized. Compared with the prior art, great flexibility is provided, protocol stacks and related business process algorithms are allowed to be realized and modified from a software level, customized development and testing are carried out for specific business scenes, and researchers can deeply explore security vulnerabilities in a network and test the effectiveness of various security measures.

Description

Technical Field

[0001] The disclosed embodiments relate to the technical field of mobile communication networks, and in particular to a virtual terminal simulation device and a network access test method thereof. Background Art

[0002] With the rapid development of operators' 4G and 5G mobile communication networks, there are many types of mobile terminals such as mobile phones, and the security requirements for communication networks are getting higher and higher. In response to the business needs of mobile communication network access security and terminal security testing, it is necessary to build a terminal simulation system to simulate user equipment to conduct relevant network security tests.

[0003] However, when faced with large-scale testing of specific network security scenarios, mobile terminal simulation systems that use commercial communication modules cannot meet the business needs of flexible and unconventional testing.

[0004] For testing of specific business scenarios, the use of simulation terminals with commercial communication modules has the following disadvantages: (1) Poor flexibility. The software and hardware of the module are fixed and difficult to change to meet specific business needs. (2) Lack of transparency. The specific implementation details within the module are often not disclosed to the outside world, which may affect debugging and troubleshooting.

[0005] (3) Weak customization. It is not easy to add new functions or modify the behavior of the protocol stack, and cannot meet the testing business needs in different scenarios and abnormal processes.

[0006] Therefore, it is necessary to improve one or more problems existing in the above-mentioned related technical solutions.

[0007] It should be noted that this section is intended to provide background or context for the technical solutions of the present disclosure stated in the claims. The description herein is not admitted to be prior art by virtue of being included in this section. Summary of the invention

[0008] The purpose of the embodiments of the present disclosure is to provide a virtual terminal simulation device and a network access test method thereof, thereby overcoming one or more problems caused by the limitations and defects of related technologies at least to a certain extent.

[0009] According to a first aspect of an embodiment of the present disclosure, a network access test method for a virtual terminal emulation device is provided, the method comprising: Initialize the virtual terminal emulation device, initiate a network attachment request to the LTE core network through the base station according to the set IMSI code, and send a subscription request to the authentication subscription platform; wherein the LTE core network includes MME and HSS, the attachment request includes the IMSI code, UE security capability and key set indication, and the subscription request includes IMSI, RAND and AUTN; The MME generates an authentication request according to the attachment request and sends it to the HSS; wherein the authentication request includes the IMSI code, the service network ID and the network type; The HSS queries the authentication key Ki corresponding to the IMSI code in the home HSS according to the service network ID, generates an authentication vector according to the IMSI code and the authentication key Ki, and sends it to the MME; wherein the authentication vector is a 4-element authentication vector, including RAND, AUTN, XRES and KASME; The MME stores the authentication vectors, randomly selects one of the authentication vectors, generates a user authentication request, and sends the user authentication request to the virtual terminal emulation device; wherein the user authentication request includes a random number RAND, an authentication token AUTN, and a key sequence indicator KSI; The authentication subscription platform parses the interface signaling between the MME and the HSS, generates an authentication data model, and extracts and returns the 4-element authentication vector corresponding to IMSI, RAND and AUTN according to the subscription request initiated by the virtual terminal emulation device; The virtual terminal emulation device obtains the authentication vector corresponding to the IMSI from the authentication subscription platform according to the RAND and AUTN in the user authentication request, extracts the XRES in the authentication vector to generate the RES of the user authentication response data, and sends it to the MME; The MME compares the authentication response RES carried in the user authentication response message with the XRES obtained by the HSS. If a match is successful, the identity of the virtual terminal emulation device is verified. After authentication, the MME returns an attachment reception message to the virtual terminal emulation device, and the network access is successful.

[0010] Furthermore, the method also includes: The virtual terminal emulation device sends a subscription request to the authentication subscription platform to obtain an authentication vector required for user authentication; The authentication subscription platform obtains the authentication authentication signaling through the interface between the MME and the HSS of the LTE core network, the authentication subscription platform parses the authentication authentication signaling to obtain the authentication vector, establishes a mapping relationship with different IMSI codes after obtaining the authentication vector, and constructs an authentication vector data model using the mapping relationship and its corresponding data; After the MME sends the user authentication request to the virtual terminal simulation device, the virtual terminal simulation device sends the received RAND and AUTN to the authentication vector data model in the authentication subscription platform through a subscription method. The authentication vector data model obtains the authentication vector corresponding to the IMSI code and sends it to the virtual terminal simulation device.

[0011] Furthermore, the method also includes: If the virtual terminal emulation device cannot obtain the authentication vector, the network access fails and the attachment request is resent.

[0012] Further, after the MME receives the user authentication response sent by the virtual terminal emulation device, the step of comparing the RES carried in the user authentication response with the XRES obtained by the HSS further includes: If the match fails, network access fails.

[0013] According to a second aspect of an embodiment of the present disclosure, a virtual terminal emulation device is provided, the device comprising: An antenna array unit, a software radio platform, an embedded PC unit and a network adapter, wherein the embedded PC unit interacts with the antenna array unit, the software radio platform and the network adapter respectively, and the antenna array unit interacts with the software radio platform; wherein, The network adapter is used to interact with the external system to obtain the IMSI code and authentication vector; The embedded PC unit is used for implementing UE service functions and LTE protocol stack, initiating a network attachment request according to the IMSI code, processing a received user authentication request based on the authentication vector, and generating a user authentication response to complete two-way authentication with the LTE core network; The software radio platform completes digital signal processing functions such as digital frequency conversion, channel filtering, modulation and demodulation, and is used to process the attachment request, the user authentication request and the user authentication response mobile communication signaling message; The antenna array unit is used for receiving and sending wireless signals, filtering, and noise reduction between the base station, and for receiving and sending the attachment request, the user authentication request, and the user authentication response message.

[0014] Furthermore, the embedded PC unit also includes: The radio frequency scheduling module includes a radio frequency transceiver hardware interface, an LTE wireless communication protocol stack interface and an FPGA hardware interface, wherein the radio frequency transceiver hardware interface is responsible for receiving and sending air interface data, tuning frequency, and controlling antenna switching; the LTE wireless communication protocol stack interface is used for sending and receiving protocol data; and the FPGA hardware interface is used for demodulating and modulating the sent and received protocol data to the FPGA; The base station search and synchronization module is used to select and lock the frequency point, search for the base station on the frequency point number, establish a link with the base station, perform cell search, selection and reselection, and complete channel synchronization; LTE wireless communication protocol module, used to implement the LTE protocol stack function of the user equipment based on the SRSUE software framework of OAI, complete the uplink and downlink message processing of the LTE protocol stack, and realize the communication interaction with the 4G base station and the core network; wherein, the LTE protocol stack includes the physical layer PHY, the media access control layer MAC, the radio link control layer RLC, the packet data convergence protocol layer PDCP, the radio resource control layer RRC and the non-access layer NAS; The network access simulation module is used to implement the network attachment signaling interaction process. Through the interface with the authentication subscription platform, it breaks through the two-way authentication between the LTE core network to achieve normal network access without a SIM card. The authentication service interface module is used to obtain the authentication vector corresponding to the specific IMSI code, RAND, and AUTN from the authentication subscription platform through message subscription, providing data support for the two-way authentication process between the core network; The terminal security context management module is used to access the LTE core network, build and maintain the security context, including security context initialization, key derivation, key update, encryption and integrity protection, security context storage and update, to ensure the normal communication of subsequent business application processes.

[0015] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects: In the embodiments of the present disclosure, through the above-mentioned virtual terminal simulation device and its network access test method, on the one hand, a virtual terminal simulation device based on software radio is adopted, and the authentication signaling between MME and HSS is used to break through the two-way authentication between the virtual terminal simulation device and the LTE core network (EPC), thereby realizing the real network access and specific service testing of virtual terminal devices without SIM cards. It provides great flexibility, allowing the implementation and modification of protocol stacks and related business process algorithms from the software level, and carrying out customized development and testing for specific business scenarios, so that researchers can deeply explore security vulnerabilities in the network and test the effectiveness of various security measures. On the other hand, a software radio hardware platform is used to build a virtual terminal simulation device. The software part is based on the SRSUE software framework of OAI to realize the radio frequency scheduling, base station connection, LTE wireless communication protocol stack and application business simulation functions of user equipment, which solves the problem that commercial communication modules cannot be flexibly customized and developed, and provides business customization services under abnormal processes. By utilizing the authentication signaling between MME and HSS, the network attachment signaling process of the virtual terminal simulation device is customized and developed, breaking through the two-way authentication between the virtual terminal simulation device and the LTE core network, thereby realizing the normal network access test of the virtual terminal simulation device in the scenario without SIM card. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0017] Figure 1 A step diagram showing a network access test method for a virtual terminal emulation device in an exemplary embodiment of the present disclosure; Figure 2 A specific flow chart showing a network access test method for a virtual terminal emulation device in an exemplary embodiment of the present disclosure; Figure 3 A schematic diagram showing the structure of a virtual terminal emulation device in an exemplary embodiment of the present disclosure is shown; Figure 4 A schematic diagram showing the structure of an embedded PC unit in an exemplary embodiment of the present disclosure is shown; Figure 5 A schematic diagram showing a framework of a network access test of a virtual terminal emulation device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0018] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0019] In addition, the accompanying drawings are only schematic illustrations of the embodiments of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0020] This example embodiment provides a network access test method for a virtual terminal emulation device. Figure 1 As shown in , the network access test method of the virtual terminal simulation device may include: steps S101 to S106.

[0021] Step S101: Initialize the virtual terminal emulation device, initiate a network attachment request to the LTE core network via the base station according to the set IMSI code, and send a subscription request to the authentication subscription platform; wherein the LTE core network includes MME and HSS, the attachment request includes the IMSI code, UE security capability and key set indication, and the subscription request includes IMSI, RAND and AUTN; Step S102: The MME generates an authentication request according to the attachment request and sends it to the HSS, wherein the authentication request includes the IMSI code, service network ID and network type; Step S103: The HSS queries the authentication key Ki corresponding to the IMSI code in the home HSS according to the service network ID, generates an authentication vector according to the IMSI code and the authentication key Ki, and sends it to the MME; wherein the authentication vector is a 4-element authentication vector, including RAND, AUTN, XRES and KASME; Step S104: the MME stores the authentication vectors, randomly selects one of the authentication vectors, generates a user authentication request, and sends the user authentication request to the virtual terminal emulation device; wherein the user authentication request includes a random number RAND, an authentication token AUTN, and a key sequence indicator KSI; Step S105: the authentication subscription platform parses the interface signaling between the MME and the HSS, generates an authentication data model, and extracts and returns the 4-element authentication vector corresponding to IMSI, RAND and AUTN according to the subscription request initiated by the virtual terminal emulation device; Step S106: the virtual terminal emulation device obtains the authentication vector corresponding to the IMSI from the authentication subscription platform according to the RAND and AUTN in the user authentication request, extracts the XRES in the authentication vector to generate the RES of the user authentication response data, and sends it to the MME; Step S106: The MME compares the authentication response RES carried in the user authentication response message with the XRES obtained by the HSS. If a match is successful, the identity of the virtual terminal emulation device is verified. After authentication, the MME returns an attachment reception message to the virtual terminal emulation device, and the network access is successful.

[0022] Through the above-mentioned virtual terminal simulation device and its network access test method, on the one hand, a virtual terminal simulation device based on software radio is adopted, and the authentication signaling between MME and HSS is used to break through the two-way authentication between the virtual terminal simulation device and the LTE core network (EPC), so as to realize the real network access and specific service testing of virtual terminal devices without SIM cards. It provides great flexibility, allowing the implementation and modification of protocol stacks and related business process algorithms from the software level, and carrying out customized development and testing for specific business scenarios, so that researchers can deeply explore security vulnerabilities in the network and test the effectiveness of various security measures. On the other hand, a software radio hardware platform is used to build a virtual terminal simulation device. The software part is based on the SRSUE software framework of OAI to realize the radio frequency scheduling, base station connection, LTE wireless communication protocol stack and application business simulation functions of user equipment, solves the problem that commercial communication modules cannot be flexibly customized and developed, and provides business customization services under abnormal processes. Using the authentication signaling between MME and HSS, the network attachment signaling process of the virtual terminal simulation device is customized and developed, breaking through the two-way authentication between the virtual terminal simulation device and the LTE core network, so as to realize the normal network access test of the virtual terminal simulation device without SIM card scenario.

[0023] Next, we will refer to Figure 1 to Figure 2 Each step of the network access test method of the virtual terminal emulation device in this example implementation is described in more detail.

[0024] In one embodiment, first, the two-way authentication mechanism between the user equipment and the LTE (Long Term Evolution) core network that needs to be broken through in the embodiment is analyzed. AKA authentication (Authentication and key agreement) is a symmetric key negotiation and two-way authentication algorithm. It is the most widely used access security mechanism in 3GPP's 4G / 5G system. Symmetric key negotiation is completed in the two-way authentication process between the user equipment and the core network, which not only realizes the network's authentication of the user equipment, but also realizes the user equipment's authentication of the network. It is a process of mutual verification of each other's identity to ensure that both parties in communication are legitimate.

[0025] See also Figure 2 , Figure 2 A schematic diagram of a two-way authentication process within an LTE network in an embodiment of the present application is shown.

[0026] 1. When the virtual terminal emulation device (i.e., user equipment (UE)) wants to access the LTE core network, it initiates a network attachment request, and the request message contains the International Mobile Subscriber Identity (IMSI), UE security capabilities, and the Key Set Identifier for Kasme (KSIasme). The LTE core network includes the MME (Mobility Management Entity) and the HSS (Home Subscriber Server).

[0027] 2. After receiving the attach request, the MME sends an authentication request to the HSS to obtain the authentication vector. The request message includes the international mobile subscriber identity code IMSI, the serving network ID (SN id) and the network type (Network Type).

[0028] 3. After receiving the authentication request, HSS queries the Ki library corresponding to the IMSI (the key library corresponding to the user equipment SIM) in the home HSS according to the service network ID, and uses the IMSI and the key Ki to generate an authentication vector. The authentication vector is a group of parameters used for authentication. This parameter group includes 4 parameters, namely: RAND (Random Challenge), which is an unpredictable random number provided by the network to the UE (User Equipment); AUTN (Authentication Token) is used to provide information to the UE so that the UE can use it to authenticate the network; XRES (Expected Response) is the expected UE authentication response parameter, which is used to compare with the authentication response data RES generated by the UE to determine whether the authentication is successful; KASME (Access Security Management Entity Key, the K value of the access security management entity), which is the root key derived from the PLMN ID of the encryption key CK or the integrity protection key IK and the top-level key ASME.

[0029] 4. The HSS returns an authentication vector for UE identity authentication to the MME, which includes one or more authentication vectors (up to five groups are sent down), and the MME stores the authentication vectors.

[0030] 5. The MME initiates a user authentication request to the UE, randomly selects an authentication vector including a random number RAND, an authentication token AUTN and a key sequence indicator KSI and sends it to the UE for identity verification.

[0031] 6. After receiving the user authentication request sent by MME, UE first checks the validity of the received AUTN to verify the identity of MME / EPC (Evolved Packet Core). AUTN contains SQN (Sequence Number), AMF (Anti-replay counter) and a MAC (Message Authentication Code). UE checks this information to confirm that EPC is not impersonated. Then, it uses the authentication key Ki corresponding to the IMSI stored inside it and the received RAND to calculate a response RES. This calculation is based on a security algorithm, such as the Milenage algorithm in AUC (Authentication Center).

[0032] 7. After the UE successfully authenticates the MME / EPC, it sends the calculated RES back to the MME.

[0033] 8. MME receives the RES in the user authentication response sent by the UE and compares it with the XRES previously obtained by the HSS. If the two match, the UE's identity is considered to be verified and the authentication is successful; otherwise, the authentication fails.

[0034] 9. After successful authentication, the MME returns an Attach Accepted message to the UE, confirming that the UE has successfully attached to the network.

[0035] From the analysis of the two-way authentication process of the LTE network, the first authentication parameter may include RAND, AUTN and KASME, and the second authentication parameter is XRES. The authentication user key Ki is stored in the USIM and HSS of the user equipment UE respectively.

[0036] In addition, the authentication signaling can be obtained from the interface between the MME and HSS of the LTE core network, and the interface signaling can be parsed to obtain the authentication vector. After the authentication vector is obtained, a mapping relationship is established with different user identification codes IMSI, and the mapping relationship and its corresponding data are used to construct an authentication vector data model.

[0037] When the MME extracts the first authentication parameters RAND, AUTN and KASME from the authentication vector and sends them to the UE, the UE sends the received RAND and AUTN to the authentication vector data model by subscription, obtains the 4-element authentication vector (can be multiple) corresponding to the IMSI, and then extracts XRES in the 4-element authentication vector as the RES of the authentication response data, and returns it to the MME, thus completing the two-way authentication process.

[0038] This example embodiment provides a virtual terminal emulation device. Figure 3 As shown in , the virtual terminal emulation device may include: an antenna array unit, a software radio platform, an embedded PC unit and a network adapter, wherein the embedded PC unit interacts with the antenna array unit, the software radio platform and the network adapter respectively, and the antenna array unit interacts with the software radio platform; wherein, The network adapter is used to interact with the external system to obtain the IMSI code and authentication vector; The embedded PC unit is used to implement UE service functions and LTE protocol stack, initiate a network attachment request according to the IMSI code, process the received user authentication request based on the authentication vector, and generate a user authentication response to complete two-way authentication with the core network; The software radio platform provides a flexible radio communication system, which completes digital signal processing functions such as digital frequency conversion, channel filtering, modulation and demodulation, and is used to process mobile communication signaling messages such as the attachment request and the user authentication request / response.

[0039] In one embodiment, Figure 3 The figure shows a structural block diagram of a virtual terminal emulation device.

[0040] The virtual terminal emulation device is a hardware framework based on a general software radio platform, which mainly includes an antenna array unit, a software radio platform, an embedded PC unit and a network adapter: (1) Antenna array unit: It is mainly composed of antenna array, transceiver filter, power amplifier and antenna control electronic switch, which completes the transmission, reception, filtering, noise reduction and RF scheduling of mobile communication wireless signals. The antenna array communication standard supports TDD (Time Division Duplexing) frequency bands: B34 / B38 / B39 / B40 / B41, FDD (Frequency Division Duplexing) frequency bands: B1 / B3 / B5 / B8, covering all domestic operators' mobile communication signal frequencies.

[0041] (2) General software radio platform: The SDR (Software Defined Radio) hardware platform uses AD9361 and XC6SLX150 FPGA (Field-Programmable Gate Array) to implement digital signal processing functions such as digital down-conversion, digital up-conversion, channel filtering, demodulation and modulation. The digital IQ data is sent to a high-performance embedded PC for processing via USB3.0.

[0042] (3) High-performance embedded PC: Intel i7 processor, 16GB memory, connected via USB3.0 and general software radio platform.

[0043] (4) Network adapter: Use Gigabit Ethernet switching module to interconnect with external devices.

[0044] The virtual terminal emulation device software is partially implemented based on the 4GUE software of OAI (Open Air Interface, open source wireless interface), such as Figure 4 As shown, the high-performance embedded PC mainly includes a radio frequency scheduling module, a base station search and synchronization module, an LTE wireless communication protocol module, a network access simulation module, an authentication service interface module and a terminal security context management module.

[0045] (1) RF scheduling module: including RF transceiver hardware interface, responsible for receiving and sending air interface data, tuning frequency, and controlling antenna switching; LTE wireless communication protocol stack interface, responsible for sending and receiving protocol data; FPGA hardware interface, responsible for demodulating and modulating the sent and received protocol data to FPGA.

[0046] (2) Base station search and synchronization module: After the virtual terminal selects and locks the frequency point, it searches for the base station on the frequency point number and establishes a link with the base station to perform cell search, selection and reselection to complete channel synchronization.

[0047] (3) LTE wireless communication protocol module: Based on the OAI SRSUE software framework, the 4G user equipment (UE) protocol stack functions are implemented. Including the physical layer (PHY), media access control layer (MAC), radio link control layer (RLC), packet data convergence protocol layer (PDCP), radio resource control layer (RRC) and non-access layer (NAS), complete the LTE protocol stack uplink and downlink message processing, and realize the communication interaction with the 4G base station and the core network.

[0048] (4) Network access simulation module: Application layer business process processing, mainly realizing the virtual terminal network attachment signaling interaction process. Through the interface between the authentication and subscription platform, it breaks through the two-way authentication between the LTE core network and realizes the normal network access of virtual terminals without SIM (Subscriber Identity Module) cards.

[0049] (5) Authentication service interface module: Obtains the 4-element authentication vector corresponding to the specific IMSI, RAND, and AUTN from the authentication subscription platform through message subscription, providing data support for the two-way authentication process between the virtual terminal and the core network.

[0050] (6) Terminal security context management module: When a virtual terminal accesses the LTE core network, it needs to build and maintain a security context, including security context initialization, key derivation, key update, encryption and integrity protection, and security context storage and update to ensure normal communication of subsequent business application processes.

[0051] In a specific embodiment, the operation scheduling process of the virtual terminal emulation device is as follows: (1) After the virtual terminal emulation device is started, it must first establish a connection with the business management terminal, establish a communication connection with the authentication subscription platform, and monitor the connection status; (2) According to the operator network type and wireless frequency band configured by the service management end, the virtual terminal automatically searches for base stations and synchronizes to establish a connection with the base station; (3) Based on the IMSI set by the service management end, the base station initiates an attachment request to the network, waits for core network authentication, and receives a user authentication request message from the core network; (4) Extract "AUTN, RAND" from the user authentication request message, search for the corresponding authentication vector in the authentication subscription platform, and complete the two-way authentication with the core network based on the matching result; (5) Receive the attachment acceptance response from the core network, build a security context based on the authentication information, and continue with subsequent SMS and other service tests.

[0052] In a specific embodiment, Figure 5 The figure shows a schematic diagram of the framework of the network access test of the virtual terminal emulation device.

[0053] In an embodiment, the virtual terminal simulation device includes an antenna array unit, a general software radio hardware platform and an embedded PC unit. The embedded PC unit runs a computer program that implements LTE user equipment (UE), including a radio frequency scheduling module, a base station search and synchronization module, an LTE wireless communication protocol module, a network access simulation module, an authentication service interface module and a terminal security context management module. The authentication subscription platform generates an authentication data model after parsing and restoring the optical mirror interface signaling between the MME and HSS of the LTE core network, and provides an authentication vector subscription service for the virtual terminal simulation network access device, which is not described in the embodiments of this application.

[0054] The virtual terminal simulation device implements the user equipment (UE) function in software mode. After establishing a connection with the base station, it initiates a network attachment request to the LTE core network according to the LTE standard protocol stack interface, and uses the authentication subscription platform to split the authentication signaling mirrored between the MME and the HSS to complete the two-way authentication process with the core network, thereby realizing the network access of the virtual terminal simulation device without a SIM card and the specific business process testing function.

[0055] This embodiment is applicable to a virtual terminal emulation scenario without a SIM card, and its network access test method can be executed by the virtual terminal emulation device provided in the embodiment of the present application.

[0056] The specific process of the method in this embodiment includes: After the virtual terminal emulation device is successfully initialized, it establishes an RRC connection with the locked base station, initiates a network attachment request to the LTE core network through the base station according to the set IMSI, and requests the authentication vector message of the IMSI from the authentication vector data model. The Attach Request message contains the set IMSI code, and other UE security capabilities and key set indication (KSIasme) parameters can be empty.

[0057] The authentication subscription platform generates an authentication data model by collecting, analyzing and restoring interface signaling, and stores the 4-element authentication vector (RAND, XRES, AUTN, KASME) and the IMSI corresponding to the vector. When the authentication vector data model receives a subscription message (including IMSI, RAND, AUTN) from the virtual terminal simulation device, it extracts the 4-element authentication vector (can be multiple) currently corresponding to the IMSI and pushes it to the virtual terminal simulation device.

[0058] If the virtual terminal emulation device obtains the 4-element authentication vector corresponding to the IMSI, RAND, and AUTN, it extracts XRES in the 4-element authentication vector as the RES of the authentication response data, and returns it to the MME through the user authentication response message; if the virtual terminal emulation device cannot obtain the 4-element authentication vector corresponding to RAND and AUTN, it will not send a user authentication response, and the network access will fail, and a new attachment request must be made.

[0059] After receiving the user authentication response from the virtual terminal emulation device, the MME compares the RES (same as XRES) carried in the response message with the XRES previously obtained by the HSS. If a match is successful, the MME returns an Attach Accept message to the virtual terminal emulation device, and the network access is successful. Otherwise, the network access fails.

[0060] Virtual terminal emulation technology based on software radio platform In this application, a software radio hardware platform is used to build a virtual terminal simulation device. The software part is based on OAI's SRSUE software framework to implement the RF scheduling, base station connection, LTE wireless communication protocol stack and application business simulation functions of 4G user equipment, which solves the problem that commercial communication modules cannot be flexibly customized and developed, and provides business customization services under abnormal processes. It is an essential device for user equipment simulation network access in scenarios without SIM cards.

[0061] A breakthrough technology of two-way authentication mechanism based on authentication data model By utilizing the authentication signaling between the 4G network MME and HSS, the UE's network attachment signaling process is customized and developed, breaking through the two-way authentication between the virtual terminal simulation device and the LTE core network, thereby realizing the normal network access test of the virtual terminal simulation device in the scenario without a SIM card.

[0062] Through the above-mentioned virtual terminal simulation device and its network access test method, on the one hand, a virtual terminal simulation device based on software radio is adopted, and the authentication signaling between MME and HSS is used to break through the two-way authentication between the virtual terminal simulation device and the LTE core network (EPC), so as to realize the real network access and specific service testing of virtual terminal devices without SIM cards. It provides great flexibility, allowing the implementation and modification of protocol stacks and related business process algorithms from the software level, and carrying out customized development and testing for specific business scenarios, so that researchers can deeply explore security vulnerabilities in the network and test the effectiveness of various security measures. On the other hand, a software radio hardware platform is used to build a virtual terminal simulation device. The software part is based on the SRSUE software framework of OAI to realize the radio frequency scheduling, base station connection, LTE wireless communication protocol stack and application business simulation functions of user equipment, solves the problem that commercial communication modules cannot be flexibly customized and developed, and provides business customization services under abnormal processes. Using the authentication signaling between MME and HSS, the network attachment signaling process of the virtual terminal simulation device is customized and developed, breaking through the two-way authentication between the virtual terminal simulation device and the LTE core network, so as to realize the normal network access test of the virtual terminal simulation device without SIM card scenario.

[0063] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0064] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0065] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A network access test method for a virtual terminal emulation device, characterized in that: The method includes: Initialize the virtual terminal emulation device, initiate a network attachment request to the LTE core network through the base station according to the set IMSI code, and send a subscription request to the authentication subscription platform; wherein the LTE core network includes MME and HSS, the attachment request includes the IMSI code, UE security capability and key set indication, and the subscription request includes IMSI, RAND and AUTN; The MME generates an authentication request according to the attachment request and sends it to the HSS; wherein the authentication request includes the IMSI code, the service network ID and the network type; The HSS queries the authentication key Ki corresponding to the IMSI code in the home HSS according to the service network ID, generates an authentication vector according to the IMSI code and the authentication key Ki, and sends it to the MME; wherein the authentication vector is a 4-element authentication vector, including RAND, AUTN, XRES and KASME; The MME stores the authentication vectors, randomly selects one of the authentication vectors, generates a user authentication request, and sends the user authentication request to the virtual terminal emulation device; wherein the user authentication request includes a random number RAND, an authentication token AUTN, and a key sequence indicator KSI; The authentication subscription platform parses the interface signaling between the MME and the HSS, generates an authentication data model, and extracts and returns the 4-element authentication vector corresponding to IMSI, RAND and AUTN according to the subscription request initiated by the virtual terminal emulation device; The virtual terminal emulation device obtains the authentication vector corresponding to the IMSI from the authentication subscription platform according to the RAND and AUTN in the user authentication request, extracts the XRES in the authentication vector to generate the RES of the user authentication response data, and sends it to the MME; The MME compares the authentication response RES carried in the user authentication response message with the XRES obtained by the HSS. If a match is successful, the identity of the virtual terminal emulation device is verified. After authentication, the MME returns an attachment reception message to the virtual terminal emulation device, and the network access is successful.

2. The network access test method of the virtual terminal emulation device according to claim 1, characterized in that: The method further includes: The virtual terminal emulation device sends a subscription request to the authentication subscription platform to obtain an authentication vector required for user authentication; The authentication subscription platform obtains the authentication authentication signaling through the interface between the MME and the HSS of the LTE core network, the authentication subscription platform parses the authentication authentication signaling to obtain the authentication vector, establishes a mapping relationship with different IMSI codes after obtaining the authentication vector, and constructs an authentication vector data model using the mapping relationship and its corresponding data; After the MME sends the user authentication request to the virtual terminal simulation device, the virtual terminal simulation device sends the received RAND and AUTN to the authentication vector data model in the authentication subscription platform through a subscription method. The authentication vector data model obtains the authentication vector corresponding to the IMSI code and sends it to the virtual terminal simulation device.

3. The network access test method of the virtual terminal emulation device according to claim 1, characterized in that: The method further includes: If the virtual terminal emulation device cannot obtain the authentication vector, the network access fails and the attachment request is resent.

4. The network access test method of the virtual terminal emulation device according to claim 1, characterized in that: After the MME receives the user authentication response sent by the virtual terminal emulation device, the step of comparing the RES carried in the user authentication response with the XRES obtained by the HSS further includes: If the match fails, network access fails.

5. A virtual terminal emulation device, characterized in that: The device includes: An antenna array unit, a software radio platform, an embedded PC unit and a network adapter, wherein the embedded PC unit interacts with the antenna array unit, the software radio platform and the network adapter respectively, and the antenna array unit interacts with the software radio platform; wherein, The network adapter is used to interact with the external system to obtain the IMSI code and authentication vector; The embedded PC unit is used for implementing UE service functions and LTE protocol stack, initiating a network attachment request according to the IMSI code, processing a received user authentication request based on the authentication vector, and generating a user authentication response to complete two-way authentication with the LTE core network; The software radio platform completes digital signal processing functions such as digital frequency conversion, channel filtering, modulation and demodulation, and is used to process the attachment request, the user authentication request and the user authentication response mobile communication signaling message; The antenna array unit is used for receiving and sending wireless signals, filtering, and noise reduction between the base station, and for receiving and sending the attachment request, the user authentication request, and the user authentication response message.

6. The virtual terminal emulation device according to claim 5, characterized in that: The embedded PC unit comprises: The radio frequency scheduling module includes a radio frequency transceiver hardware interface, an LTE wireless communication protocol stack interface and an FPGA hardware interface, wherein the radio frequency transceiver hardware interface is responsible for receiving and sending air interface data, tuning frequency, and controlling antenna switching; the LTE wireless communication protocol stack interface is used for sending and receiving protocol data; and the FPGA hardware interface is used for demodulating and modulating the sent and received protocol data to the FPGA; The base station search and synchronization module is used to select and lock the frequency point, search for the base station on the frequency point number, establish a link with the base station, perform cell search, selection and reselection, and complete channel synchronization; LTE wireless communication protocol module, used to implement the LTE protocol stack function of the user equipment based on the SRSUE software framework of OAI, complete the uplink and downlink message processing of the LTE protocol stack, and realize the communication interaction with the 4G base station and the core network; wherein, the LTE protocol stack includes the physical layer PHY, the media access control layer MAC, the radio link control layer RLC, the packet data convergence protocol layer PDCP, the radio resource control layer RRC and the non-access layer NAS; The network access simulation module is used to implement the network attachment signaling interaction process. Through the interface with the authentication subscription platform, it breaks through the two-way authentication between the LTE core network to achieve normal network access without a SIM card. The authentication service interface module is used to obtain the authentication vector corresponding to the specific IMSI code, RAND, and AUTN from the authentication subscription platform through message subscription, providing data support for the two-way authentication process between the core network.

7. The virtual terminal emulation device according to claim 6, characterized in that: The embedded PC unit also includes: The terminal security context management module is used to access the LTE core network, build and maintain the security context, including security context initialization, key derivation, key update, encryption and integrity protection, security context storage and update, to ensure the normal communication of subsequent business application processes.

Images