A virtual terminal simulation device and network access test method thereof

Abstract

The present application belongs to the field of mobile communication network technology. The present application provides a virtual terminal simulation device and a network access test method thereof. The disclosed embodiment adopts a virtual terminal simulation device based on a software radio platform, and utilizes the authentication signaling between the MME and the HSS to break through the two-way authentication between the virtual terminal simulation device and the LTE core network, thereby realizing the real network access and specific service testing of virtual terminal devices without SIM cards. It provides great flexibility, allowing the implementation and modification of protocol stacks and related business process algorithms at the software level, and carrying out customized development and testing for specific business scenarios, so that researchers can deeply explore security vulnerabilities in the network and test the effectiveness of various security measures.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the technical field of mobile communication networks, and in particular to a virtual terminal simulation device and a network access test method thereof. Background Art

[0002] With the rapid development of operators' 4G and 5G mobile communication networks, and the increasing variety of mobile terminals such as mobile phones, the security requirements for communication networks are becoming increasingly stringent. To meet the business needs of mobile communication network access security and terminal security testing, it is necessary to build a terminal emulation system to simulate user devices to conduct network security-related testing.

[0003] However, when faced with large-scale testing of specific network security scenarios, mobile terminal simulation systems using commercial communication modules cannot meet the business needs of flexible and unconventional testing.

[0004] For testing specific business scenarios, using commercial communication module simulation terminals has the following disadvantages:

[0005] (1) Poor flexibility. The software and hardware of the module are fixed and difficult to change to meet specific business needs.

[0006] (2) Lack of transparency. The specific implementation details within the module are often not disclosed to the outside world, which may affect debugging and troubleshooting.

[0007] (3) It has weak customization capabilities and cannot easily add new functions or modify the behavior of the protocol stack, and cannot meet the testing business needs in different scenarios and abnormal processes.

[0008] Therefore, it is necessary to improve one or more problems existing in the above-mentioned related technical solutions.

[0009] It should be noted that this section is intended to provide background or context for the technical solutions of the present disclosure stated in the claims. The description herein is not admitted to be prior art by virtue of being included in this section. Summary of the Invention

[0010] The purpose of the embodiments of the present disclosure is to provide a virtual terminal emulation device and a network access test method thereof, thereby overcoming one or more problems caused by the limitations and defects of related technologies, at least to a certain extent.

[0011] According to a first aspect of an embodiment of the present disclosure, a network access testing method for a virtual terminal emulation device is provided, the method comprising:

[0012] Initialize the virtual terminal emulation device, initiate a network attachment request to the LTE core network via the base station according to the set IMSI code, and send a subscription request to the authentication and subscription platform; wherein the LTE core network includes the MME and the HSS, the attachment request includes the IMSI code, the UE security capability and the key set indication, and the subscription request includes the IMSI, the RAND and the AUTN;

[0013] The MME generates an authentication request according to the attach request and sends it to the HSS; wherein the authentication request includes the IMSI code, serving network ID and network type;

[0014] The HSS queries the home HSS for the authentication key Ki corresponding to the IMSI code according to the service network ID, generates an authentication vector according to the IMSI code and the authentication key Ki, and sends the authentication vector to the MME; wherein the authentication vector is a 4-element authentication vector including RAND, AUTN, XRES, and KASME;

[0015] The MME stores the authentication vectors, randomly selects one of the authentication vectors, generates a user authentication request, and sends the user authentication request to the virtual terminal emulation device; wherein the user authentication request includes a random number RAND, an authentication token AUTN, and a key sequence indicator KSI;

[0016] The authentication subscription platform parses the interface signaling between the MME and the HSS, generates an authentication data model, and extracts and returns the four-element authentication vector corresponding to IMSI, RAND, and AUTN according to the subscription request initiated by the virtual terminal emulation device;

[0017] The virtual terminal emulation device obtains the authentication vector corresponding to the IMSI from the authentication subscription platform according to the RAND and AUTN in the user authentication request, extracts the XRES in the authentication vector, generates the RES of the user authentication response data, and sends it to the MME;

[0018] The MME compares the authentication response RES carried in the user authentication response message with the XRES obtained by the HSS. If a match is successful, the identity of the virtual terminal emulation device is verified. After authentication, the MME returns an attachment reception message to the virtual terminal emulation device, and the network access is successful.

[0019] Furthermore, the method further comprises:

[0020] The virtual terminal emulation device sends a subscription request to the authentication subscription platform to obtain an authentication vector required for user authentication;

[0021] The authentication subscription platform obtains the authentication signaling from the interface between the MME and the HSS of the LTE core network, parses the authentication signaling to obtain the authentication vector, establishes a mapping relationship between the obtained authentication vector and the different IMSI codes, and constructs an authentication vector data model using the mapping relationship and its corresponding data;

[0022] After the MME sends the user authentication request to the virtual terminal emulation device, the virtual terminal emulation device sends the received RAND and AUTN to the authentication vector data model in the authentication subscription platform through a subscription method. The authentication vector data model obtains the authentication vector corresponding to the IMSI code and sends it to the virtual terminal emulation device.

[0023] Furthermore, the method further comprises:

[0024] If the virtual terminal emulation device cannot obtain the authentication vector, the current network access fails and the attachment request is resent.

[0025] Furthermore, after the MME receives the user authentication response sent by the virtual terminal emulation device, the step of comparing the RES carried in the user authentication response with the XRES obtained by the HSS further includes:

[0026] If the match fails, network access fails.

[0027] According to a second aspect of an embodiment of the present disclosure, a virtual terminal emulation device is provided, the device comprising:

[0028] An antenna array unit, a software radio platform, an embedded PC unit and a network adapter, wherein the embedded PC unit interacts with the antenna array unit, the software radio platform and the network adapter respectively, and the antenna array unit interacts with the software radio platform; wherein,

[0029] The network adapter is used to interact with external systems to obtain IMSI codes and authentication vectors;

[0030] The embedded PC unit is used to implement UE service functions and the LTE protocol stack, initiates a network attachment request according to the IMSI code, processes the received user authentication request based on the authentication vector, and generates a user authentication response to complete bidirectional authentication with the LTE core network;

[0031] The software radio platform performs digital signal processing functions such as digital frequency conversion, channel filtering, modulation and demodulation, and is used to process the attachment request, the user authentication request, and the user authentication response mobile communication signaling message;

[0032] The antenna array unit is used for receiving and transmitting wireless signals between the base station, filtering, and noise reduction, and for receiving and transmitting the attachment request, the user authentication request, and the user authentication response message.

[0033] Furthermore, the embedded PC unit further includes:

[0034] The RF scheduling module includes an RF transceiver hardware interface, an LTE wireless communication protocol stack interface, and an FPGA hardware interface. The RF transceiver hardware interface is responsible for receiving and sending air interface data, tuning the frequency, and controlling antenna switching. The LTE wireless communication protocol stack interface is used for sending and receiving protocol data. The FPGA hardware interface is used to demodulate and modulate the sent and received protocol data to the FPGA.

[0035] The base station search and synchronization module is used to select and lock the frequency point, search for the base station on the frequency point number, establish a link with the base station, perform cell search, selection and reselection, and complete channel synchronization;

[0036] The LTE wireless communication protocol module is used to implement the LTE protocol stack functions of the user equipment based on the OAI SRSUE software framework, complete the LTE protocol stack uplink and downlink message processing, and realize communication interaction with the 4G base station and core network. The LTE protocol stack includes the physical layer PHY, the media access control layer MAC, the radio link control layer RLC, the packet data convergence protocol layer PDCP, the radio resource control layer RRC and the non-access layer NAS;

[0037] The network access simulation module is used to implement the network attachment signaling interaction process. Through the interface with the authentication and subscription platform, it breaks through the two-way authentication between the LTE core network to achieve normal network access without a SIM card.

[0038] The authentication service interface module is used to obtain the authentication vector corresponding to a specific IMSI code, RAND, and AUTN from the authentication subscription platform through message subscription, providing data support for the two-way authentication process with the core network;

[0039] The terminal security context management module is used to access the LTE core network, build and maintain the security context, including security context initialization, key derivation, key update, encryption and integrity protection, and security context storage and update to ensure normal communication of subsequent business application processes.

[0040] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0041] In the embodiments disclosed herein, the aforementioned virtual terminal emulation device and its network access testing method utilize, on the one hand, a software-defined radio (SDR)-based virtual terminal emulation device. This utilizes authentication signaling between the MME and HSS to overcome bidirectional authentication between the virtual terminal emulation device and the LTE core network (EPC), thereby enabling real network access and specific service testing for virtual terminal devices without SIM cards. This provides significant flexibility, allowing for the implementation and modification of protocol stacks and related service process algorithms at the software level, enabling customized development and testing for specific service scenarios. This allows researchers to deeply explore security vulnerabilities in the network and test the effectiveness of various security measures. Furthermore, a SDR hardware platform is used to construct the virtual terminal emulation device. The software portion, based on the OAI SRSUE software framework, implements user equipment RF scheduling, base station connection, LTE wireless communication protocol stack, and application service simulation functions. This addresses the issue of commercial communication modules being unable to be flexibly customized and developed, and provides customized service services under abnormal processes. By utilizing the authentication signaling between the MME and the HSS, the network attachment signaling process of the virtual terminal emulation device is customized and developed, breaking through the two-way authentication between the virtual terminal emulation device and the LTE core network, thereby realizing the normal network access test of the virtual terminal emulation device in the scenario without a SIM card. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0043] Figure 1 A diagram showing the steps of a network access testing method for a virtual terminal emulation device in an exemplary embodiment of the present disclosure;

[0044] Figure 2 A specific flow chart showing a network access test method for a virtual terminal emulation device in an exemplary embodiment of the present disclosure;

[0045] Figure 3 A schematic structural diagram of a virtual terminal emulation device in an exemplary embodiment of the present disclosure is shown;

[0046] Figure 4 A schematic structural diagram of an embedded PC unit in an exemplary embodiment of the present disclosure is shown;

[0047] Figure 5 A schematic diagram illustrating a framework for network access testing of a virtual terminal emulation device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0048] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0049] In addition, the accompanying drawings are merely schematic illustrations of embodiments of the present disclosure and are not necessarily drawn to scale. Like reference numerals in the figures represent like or similar parts, and thus repeated descriptions thereof will be omitted. Some of the blocks shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically separate entities.

[0050] This example embodiment provides a method for testing network access of a virtual terminal emulation device. Figure 1 As shown in , the network access test method of the virtual terminal emulation device may include: steps S101 to S106.

[0051] Step S101: Initialize the virtual terminal emulation device, initiate a network attachment request to the LTE core network via the base station according to the set IMSI code, and send a subscription request to the authentication and subscription platform; wherein the LTE core network includes the MME and HSS, the attachment request includes the IMSI code, UE security capabilities and key set indication, and the subscription request includes the IMSI, RAND and AUTN;

[0052] Step S102: The MME generates an authentication request according to the attach request and sends it to the HSS, wherein the authentication request includes the IMSI code, serving network ID, and network type;

[0053] Step S103: The HSS queries the home HSS for the authentication key Ki corresponding to the IMSI code according to the serving network ID, generates an authentication vector according to the IMSI code and the authentication key Ki, and sends it to the MME; wherein the authentication vector is a 4-element authentication vector including RAND, AUTN, XRES, and KASME;

[0054] Step S104: The MME stores the authentication vectors, randomly selects one of the authentication vectors, generates a user authentication request, and sends the user authentication request to the virtual terminal emulation device; wherein the user authentication request includes a random number RAND, an authentication token AUTN, and a key sequence indicator KSI;

[0055] Step S105: The authentication subscription platform parses the interface signaling between the MME and the HSS, generates an authentication data model, and extracts and returns the four-element authentication vector corresponding to IMSI, RAND, and AUTN according to the subscription request initiated by the virtual terminal emulation device;

[0056] Step S106: The virtual terminal emulation device obtains the authentication vector corresponding to the IMSI from the authentication subscription platform according to the RAND and AUTN in the user authentication request, extracts the XRES in the authentication vector, generates user authentication response data RES, and sends it to the MME;

[0057] Step S106: The MME compares the authentication response RES carried in the user authentication response message with the XRES obtained by the HSS. If a match is successful, the identity of the virtual terminal emulation device is verified. After authentication, the MME returns an attachment reception message to the virtual terminal emulation device, and the network access is successful.

[0058] The aforementioned virtual terminal emulation device and network access testing method utilize a software-defined radio (SDR)-based virtual terminal emulation device. By leveraging authentication signaling between the MME and HSS, the device overcomes bidirectional authentication between the device and the LTE core network (EPC), enabling real-world network access and specific service testing for virtual terminal devices without a SIM card. This provides significant flexibility, allowing for the implementation and modification of protocol stacks and related service flow algorithms at the software level, enabling customized development and testing for specific service scenarios. This allows researchers to deeply explore network security vulnerabilities and test the effectiveness of various security measures. Furthermore, the SDR hardware platform is used to construct the virtual terminal emulation device. The software, based on the Open Access Infrastructure (OAI) SRSUE software framework, implements user equipment (UE) radio frequency scheduling, base station connectivity, LTE wireless communication protocol stack, and application service emulation. This addresses the limitations of flexible customization of commercial communication modules and provides customized service support under abnormal conditions. Authentication signaling between the MME and HSS allows for customized development of the virtual terminal emulation device's network attachment signaling process, overcoming bidirectional authentication between the device and the LTE core network, enabling normal network access testing of the virtual terminal emulation device in SIM-free scenarios.

[0059] Below, we will refer to Figures 1 to 2 Each step of the network access test method of the virtual terminal emulation device in this exemplary embodiment is described in more detail.

[0060] In one embodiment, the bidirectional authentication mechanism between the user equipment (UE) and the LTE (Long Term Evolution) core network, which requires a breakthrough in this embodiment, is first analyzed. AKA (Authentication and Key Agreement) authentication is a symmetric key negotiation and bidirectional authentication algorithm, the most widely used access security mechanism in 3GPP's 4G / 5G systems. Symmetric key negotiation is performed during the bidirectional authentication process between the UE and the core network. This not only authenticates the UE from the network, but also the UE from the network. This is a mutual identity verification process, ensuring that both communicating parties are legitimate.

[0061] See Figure 2 , Figure 2 A schematic diagram of the two-way authentication process within the LTE network in an embodiment of the present application is shown.

[0062] 1. When a virtual terminal emulation device (i.e., user equipment (UE)) wishes to access the LTE core network, it initiates a network attach request. The request message includes the International Mobile Subscriber Identity (IMSI), UE security capabilities, and the Key Set Identifier for Kasme (KSIasme). The LTE core network includes the Mobility Management Entity (MME) and the Home Subscriber Server (HSS).

[0063] 2. After receiving the attach request, the MME sends an authentication request to the HSS to obtain the authentication vector. The request message includes the International Mobile Subscriber Identity (IMSI), the Serving Network ID (SN ID), and the Network Type.

[0064] 3. After receiving the authentication request, the HSS queries the Ki database (key database corresponding to the user equipment SIM) in the home HSS based on the serving network ID. It then uses the IMSI and the Ki key to generate an authentication vector. The authentication vector is a set of parameters used for authentication. This parameter group includes four parameters: RAND (Random Challenge), an unpredictable random number provided by the network to the UE (User Equipment); AUTN (Authentication Token), which provides information to the UE for network authentication; XRES (Expected Response), the expected UE authentication response parameter, which is compared with the UE-generated authentication response data (RES) to determine whether authentication is successful; and KASME (Access Security Management Entity Key), the root key derived from the cipher key CK or integrity protection key IK and the PLMN ID of the top-level key ASME.

[0065] 4. The HSS returns an authentication vector for UE identity authentication to the MME, which contains one or more authentication vectors (up to five groups are sent). The MME stores the authentication vectors.

[0066] 5. The MME initiates a user authentication request to the UE, randomly selects an authentication vector containing a random number RAND, an authentication token AUTN, and a key sequence indicator KSI and sends it to the UE for identity verification.

[0067] 6. After receiving the User Authentication Request from the MME, the UE first checks the validity of the received AUTN to verify the identity of the MME / EPC (Evolved Packet Core). The AUTN contains the SQN (Sequence Number), the AMF (Anti-replay Counter), and a MAC (Message Authentication Code). The UE verifies this information to confirm that the EPC is not being impersonated. It then calculates a response (RES) using the authentication key Ki stored for the IMSI and the received RAND. This calculation is based on a security algorithm, such as the Milenage algorithm in the AUC (Authentication Center).

[0068] 7. After the UE successfully authenticates the MME / EPC, it sends the calculated RES back to the MME.

[0069] 8. The MME receives the RES in the user authentication response sent by the UE and compares it with the XRES previously obtained by the HSS. If the two match, the UE's identity is considered to be verified and the authentication is successful; otherwise, the authentication fails.

[0070] 9. After successful authentication, the MME returns an Attach Accepted message to the UE, confirming that the UE has successfully attached to the network.

[0071] From the analysis of the bidirectional authentication process in the LTE network, the first authentication parameter can include RAND, AUTN and KASME, and the second authentication parameter is XRES. The user key Ki participating in the authentication is stored in the USIM of the user equipment UE and the HSS respectively.

[0072] In addition, the authentication signaling can be obtained from the interface between the MME and HSS of the LTE core network, and the interface signaling can be parsed to obtain the authentication vector. After obtaining the authentication vector, a mapping relationship is established with different user identification codes IMSI, and the mapping relationship and its corresponding data are used to construct an authentication vector data model.

[0073] After the MME extracts the first authentication parameters RAND, AUTN, and KASME from the authentication vector and sends them to the UE, the UE sends the received RAND and AUTN to the authentication vector data model via subscription, obtains the 4-element authentication vector (can be multiple) corresponding to the IMSI, and then extracts XRES from the 4-element authentication vector as the RES of the authentication response data and returns it to the MME, thus completing the two-way authentication process.

[0074] This example embodiment provides a virtual terminal emulation device. Figure 3 As shown in , the virtual terminal emulation device may include: an antenna array unit, a software radio platform, an embedded PC unit and a network adapter, wherein the embedded PC unit interacts with the antenna array unit, the software radio platform and the network adapter respectively, and the antenna array unit interacts with the software radio platform; wherein,

[0075] The network adapter is used to interact with external systems to obtain IMSI codes and authentication vectors;

[0076] The embedded PC unit is used to implement UE service functions and the LTE protocol stack, initiates a network attachment request according to the IMSI code, processes the received user authentication request based on the authentication vector, and generates a user authentication response to complete bidirectional authentication with the core network;

[0077] The software radio platform provides a flexible radio communication system that completes digital signal processing functions such as digital frequency conversion, channel filtering, modulation and demodulation, and is used to process mobile communication signaling messages such as the attachment request and the user authentication request / response.

[0078] In one embodiment, Figure 3 The figure shows a structural block diagram of a virtual terminal emulation device.

[0079] The virtual terminal emulation device is a hardware framework based on a general software radio platform, mainly including an antenna array unit, a software radio platform, an embedded PC unit, and a network adapter:

[0080] (1) Antenna array unit: It mainly consists of an antenna array, a transceiver filter, a power amplifier, and an antenna control electronic switch. It completes the transmission and reception, filtering, noise reduction, and RF scheduling of mobile communication wireless signals. The antenna array communication standard supports TDD (Time Division Duplexing) frequency bands: B34 / B38 / B39 / B40 / B41, and FDD (Frequency Division Duplexing) frequency bands: B1 / B3 / B5 / B8, covering all domestic operators' mobile communication signal frequencies.

[0081] (2) General software radio platform: The SDR (Software Defined Radio) hardware platform uses AD9361 and XC6SLX150 FPGA (Field-Programmable Gate Array) to implement digital signal processing functions such as digital down-conversion, digital up-conversion, channel filtering, demodulation and modulation. The digital IQ data is sent to a high-performance embedded PC for processing via USB3.0.

[0082] (3) High-performance embedded PC: Intel i7 processor, 16GB memory. Connected via USB 3.0 and general software radio platform.

[0083] (4) Network adapter: uses Gigabit Ethernet switching module to interconnect with external devices.

[0084] The virtual terminal emulation device software is based on the 4GUE software of OAI (Open Air Interface, open source wireless interface), such as Figure 4 As shown in FIG, the high-performance embedded PC mainly includes a radio frequency scheduling module, a base station search and synchronization module, an LTE wireless communication protocol module, a network access simulation module, an authentication service interface module, and a terminal security context management module.

[0085] (1) RF scheduling module: including RF transceiver hardware interface, responsible for receiving and sending air interface data, tuning frequency, and controlling antenna switching; LTE wireless communication protocol stack interface, responsible for sending and receiving protocol data; FPGA hardware interface, responsible for demodulating and modulating the sent and received protocol data to the FPGA.

[0086] (2) Base station search and synchronization module: After the virtual terminal selects and locks the frequency point, it searches for the base station on the frequency point number and establishes a link with the base station to perform cell search, selection and reselection to complete channel synchronization.

[0087] (3) LTE wireless communication protocol module: Based on the OAI SRSUE software framework, it implements the 4G user equipment (UE) protocol stack functions. This includes the physical layer (PHY), media access control layer (MAC), radio link control layer (RLC), packet data convergence protocol layer (PDCP), radio resource control layer (RRC), and non-access layer (NAS). It completes the LTE protocol stack uplink and downlink message processing and realizes communication interaction with the 4G base station and core network.

[0088] (4) Network access simulation module: Application layer business process processing, mainly realizing the virtual terminal network attachment signaling interaction process, through the interface between the authentication and subscription platform, breaking through the two-way authentication between the LTE core network, and realizing the normal network access of virtual terminals without SIM (Subscriber Identity Module) cards.

[0089] (5) Authentication service interface module: obtains the 4-element authentication vector corresponding to the specific IMSI, RAND, and AUTN from the authentication subscription platform through message subscription, providing data support for the two-way authentication process between the virtual terminal and the core network.

[0090] (6) Terminal security context management module: When a virtual terminal accesses the LTE core network, it needs to build and maintain a security context, including security context initialization, key derivation, key update, encryption and integrity protection, and security context storage and update to ensure normal communication of subsequent business application processes.

[0091] In a specific embodiment, the operation scheduling process of the virtual terminal emulation device is as follows:

[0092] (1) After the virtual terminal emulation device is started, it must first establish a connection with the business management terminal, establish a communication connection with the authentication subscription platform, and monitor the connection status;

[0093] (2) According to the operator network type and wireless frequency band configured by the service management terminal, the virtual terminal automatically searches for the base station and synchronizes, and establishes a connection with the base station;

[0094] (3) Based on the IMSI set by the service management terminal, the user initiates an attachment request to the network via the base station, waits for core network authentication, and receives a user authentication request message from the core network;

[0095] (4) Extract "AUTN, RAND" from the user authentication request message, search for the corresponding authentication vector in the authentication subscription platform, and complete the two-way authentication with the core network based on the matching result;

[0096] (5) Receive the attachment acceptance response from the core network, build a security context based on the authentication information, and continue subsequent SMS and other service tests.

[0097] In a specific embodiment, Figure 5 The figure shows a schematic diagram of the framework for network access testing of a virtual terminal emulation device.

[0098] In an embodiment, a virtual terminal emulation device includes an antenna array unit, a general-purpose software radio hardware platform, and an embedded PC unit. The embedded PC unit runs a computer program that implements LTE user equipment (UE), including a radio frequency scheduling module, a base station search and synchronization module, an LTE wireless communication protocol module, a network access emulation module, an authentication service interface module, and a terminal security context management module. The authentication subscription platform extracts the mirrored interface signaling between the MME and HSS of the LTE core network, parses and restores it, and generates an authentication data model. This platform provides authentication vector subscription services for the virtual terminal emulation network access device, which is not described in this embodiment.

[0099] The virtual terminal emulation device implements the user equipment (UE) functions in software. After establishing a connection with the base station, it initiates a network attachment request to the LTE core network according to the LTE standard protocol stack interface. It uses the authentication subscription platform to split the mirrored authentication signaling between the MME and HSS to complete the two-way authentication process with the core network, realizing the network access of the virtual terminal emulation device without a SIM card and the specific business process testing function.

[0100] This embodiment is applicable to a virtual terminal emulation scenario without a SIM card, and its network access test method can be executed by the virtual terminal emulation device provided in the embodiment of the present application.

[0101] The specific process of the method in this embodiment includes:

[0102] After successful initialization, the virtual terminal emulation device establishes an RRC connection with the locked base station. It then initiates a network attach request to the LTE core network via the base station based on the configured IMSI, and simultaneously requests an authentication vector message for the IMSI from the authentication vector data model. The Attach Request message includes the configured IMSI code, while other UE security capabilities and the Key Set Indication (KSIasme) parameter can be left blank.

[0103] The authentication subscription platform collects, analyzes, and restores interface signaling to generate an authentication data model. This model stores the four-element authentication vector (RAND, XRES, AUTN, KASME) and the IMSI corresponding to that vector. When the authentication vector data model receives a subscription message (containing IMSI, RAND, and AUTN) from a virtual terminal emulation device, it extracts the four-element authentication vector (or multiple vectors) corresponding to the IMSI and pushes it to the virtual terminal emulation device.

[0104] If the virtual terminal emulation device obtains the 4-element authentication vector corresponding to the IMSI, RAND, and AUTN, it extracts XRES from the 4-element authentication vector as the RES of the authentication response data and returns it to the MME through the user authentication response message; if the virtual terminal emulation device cannot obtain the 4-element authentication vector corresponding to RAND and AUTN, it will not send a user authentication response, the network access fails, and a new attachment request must be made.

[0105] After receiving the user authentication response from the virtual terminal emulation device, the MME compares the RES (same as XRES) carried in the response message with the XRES previously obtained by the HSS. If a match is successful, the MME returns an Attach Accept message to the virtual terminal emulation device, and the network access is successful. Otherwise, the network access fails.

[0106] Virtual terminal emulation technology based on software radio platform

[0107] In this application, a software radio hardware platform is used to build a virtual terminal simulation device. The software part is based on OAI's SRSUE software framework to implement the radio frequency scheduling, base station connection, LTE wireless communication protocol stack and application business simulation functions of 4G user equipment, solving the problem that commercial communication modules cannot be flexibly customized and developed, and providing business customization services under abnormal processes. It is an essential device for user equipment simulation network access in scenarios without SIM cards.

[0108] Breakthrough technology of two-way authentication mechanism based on authentication data model

[0109] By utilizing the authentication signaling between the 4G network MME and HSS, we customized the UE's network attachment signaling process, breaking through the two-way authentication between the virtual terminal emulation device and the LTE core network, thereby realizing normal network access testing of the virtual terminal emulation device in scenarios without a SIM card.

[0110] The aforementioned virtual terminal emulation device and network access testing method utilize a software-defined radio (SDR)-based virtual terminal emulation device. By leveraging authentication signaling between the MME and HSS, the device overcomes bidirectional authentication between the device and the LTE core network (EPC), enabling real-world network access and specific service testing for virtual terminal devices without a SIM card. This provides significant flexibility, allowing for the implementation and modification of protocol stacks and related service flow algorithms at the software level, enabling customized development and testing for specific service scenarios. This allows researchers to deeply explore network security vulnerabilities and test the effectiveness of various security measures. Furthermore, the SDR hardware platform is used to construct the virtual terminal emulation device. The software, based on the Open Access Infrastructure (OAI) SRSUE software framework, implements user equipment (UE) radio frequency scheduling, base station connectivity, LTE wireless communication protocol stack, and application service emulation. This addresses the limitations of flexible customization of commercial communication modules and provides customized service support under abnormal conditions. Authentication signaling between the MME and HSS allows for customized development of the virtual terminal emulation device's network attachment signaling process, overcoming bidirectional authentication between the device and the LTE core network, enabling normal network access testing of the virtual terminal emulation device in SIM-free scenarios.

[0111] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly indicate the number of the technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0112] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0113] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

Claims

1. A network access test method for a virtual terminal emulation device, characterized in that: The method includes: Initialize the virtual terminal emulation device, initiate a network attachment request to the LTE core network via the base station according to the set IMSI code, and send a subscription request to the authentication and subscription platform; wherein the LTE core network includes the MME and the HSS, the attachment request includes the IMSI code, the UE security capability and the key set indication, and the subscription request includes the IMSI, the RAND and the AUTN; The MME generates an authentication request according to the attach request and sends it to the HSS; wherein the authentication request includes the IMSI code, serving network ID and network type; The HSS queries the home HSS for the authentication key Ki corresponding to the IMSI code according to the service network ID, generates an authentication vector according to the IMSI code and the authentication key Ki, and sends the authentication vector to the MME; wherein the authentication vector is a 4-element authentication vector including RAND, AUTN, XRES, and KASME; The MME stores the authentication vectors, randomly selects one of the authentication vectors, generates a user authentication request, and sends the user authentication request to the virtual terminal emulation device; wherein the user authentication request includes a random number RAND, an authentication token AUTN, and a key sequence indicator KSI; The authentication subscription platform parses the interface signaling between the MME and the HSS, generates an authentication data model, and extracts and returns the four-element authentication vector corresponding to IMSI, RAND, and AUTN according to the subscription request initiated by the virtual terminal emulation device; The virtual terminal emulation device obtains the authentication vector corresponding to the IMSI from the authentication subscription platform according to the RAND and AUTN in the user authentication request, extracts the XRES in the authentication vector, generates the RES of the user authentication response data, and sends it to the MME; The MME compares the RES carried in the user authentication response data with the XRES obtained by the HSS. If a match is successful, the identity of the virtual terminal emulation device is verified. After authentication, the MME returns an attachment acceptance message to the virtual terminal emulation device, and the network access is successful.

2. The network access testing method of the virtual terminal emulation device according to claim 1, characterized in that: The method further includes: The virtual terminal emulation device sends a subscription request to the authentication subscription platform to obtain an authentication vector required for user authentication; The authentication subscription platform obtains the authentication signaling from the interface between the MME and the HSS of the LTE core network, parses the authentication signaling to obtain the authentication vector, establishes a mapping relationship between the obtained authentication vector and the different IMSI codes, and constructs an authentication vector data model using the mapping relationship and its corresponding data; After the MME sends the user authentication request to the virtual terminal emulation device, the virtual terminal emulation device sends the received RAND and AUTN to the authentication vector data model in the authentication subscription platform through a subscription method. The authentication vector data model obtains the authentication vector corresponding to the IMSI code and sends it to the virtual terminal emulation device.

3. The network access testing method of the virtual terminal emulation device according to claim 1, characterized in that: The method further includes: If the virtual terminal emulation device cannot obtain the authentication vector, the current network access fails and the attachment request is resent.

4. The network access testing method of the virtual terminal emulation device according to claim 1, characterized in that: The step of the MME comparing the RES carried in the user authentication response data with the XRES obtained by the HSS further includes: If the match fails, network access fails.

5. A virtual terminal emulation device, characterized in that: A method for performing a network access test of a virtual terminal emulation device according to any one of claims 1 to 4, the device comprising: An antenna array unit, a software radio platform, an embedded PC unit and a network adapter, wherein the embedded PC unit interacts with the antenna array unit, the software radio platform and the network adapter respectively, and the antenna array unit interacts with the software radio platform; wherein, The network adapter is used to interact with external systems to obtain IMSI codes and authentication vectors; The embedded PC unit is used to implement UE service functions and the LTE protocol stack, initiates a network attachment request according to the IMSI code, processes the received user authentication request based on the authentication vector, and generates user authentication response data to complete bidirectional authentication with the LTE core network; The software radio platform completes the digital signal processing functions of digital frequency conversion, channel filtering and modulation and demodulation, and is used to process the attachment request, the user authentication request and the user authentication response data mobile communication signaling message; The antenna array unit is used for receiving and transmitting wireless signals to and from the base station, filtering and reducing noise, and transmitting and receiving the attachment request, the user authentication request and the user authentication response data.

6. The virtual terminal emulation device according to claim 5, characterized in that: The embedded PC unit comprises: The RF scheduling module includes an RF transceiver hardware interface, an LTE wireless communication protocol stack interface, and an FPGA hardware interface. The RF transceiver hardware interface is responsible for receiving and sending air interface data, tuning the frequency, and controlling antenna switching. The LTE wireless communication protocol stack interface is used for sending and receiving protocol data. The FPGA hardware interface is used to demodulate and modulate the sent and received protocol data to the FPGA. The base station search and synchronization module is used to select and lock the frequency point, search for the base station on the frequency point number, establish a link with the base station, perform cell search, selection and reselection, and complete channel synchronization; The LTE wireless communication protocol module is used to implement the LTE protocol stack functions of the user equipment based on the OAI SRSUE software framework, complete the LTE protocol stack uplink and downlink message processing, and realize communication interaction with the 4G base station and core network. The LTE protocol stack includes the physical layer PHY, the media access control layer MAC, the radio link control layer RLC, the packet data convergence protocol layer PDCP, the radio resource control layer RRC and the non-access layer NAS; The network access simulation module is used to implement the network attachment signaling interaction process. Through the interface with the authentication and subscription platform, it breaks through the two-way authentication between the LTE core network to achieve normal network access without a SIM card. The authentication service interface module is used to obtain the authentication vector corresponding to a specific IMSI code, RAND, and AUTN from the authentication subscription platform through message subscription, providing data support for the two-way authentication process with the core network.

7. The virtual terminal emulation device according to claim 6, characterized in that: The embedded PC unit further comprises: The terminal security context management module is used to access the LTE core network, build and maintain the security context, including security context initialization, key derivation, key update, encryption and integrity protection, and security context storage and update to ensure normal communication of subsequent business application processes.

Images