Base station access authentication method and device, security gateway, base station and storage medium

Abstract

The invention relates to a base station access authentication method and device, a security gateway, a base station and a storage medium, and the method comprises the steps that the security gateway responds to a received IKEAUTH request message sent by the base station, and obtains a first MAC address carried by the IKEAUTH request message, and the first MAC address is an encrypted security load; packaging based on the first MAC address to obtain an access request message; sending the access request message to an authentication server for MAC authentication; and under the condition that a feedback message of the authentication server is received, the feedback message is sent to the base station, so that the base station is accessed to the security gateway, and the feedback message is sent under the condition that MAC authentication performed by the authentication server is passed. By adopting the scheme of the invention, even if the authentication information is acquired by a third party, the third party cannot acquire the real MAC address, so that the authentication information forged by the third party cannot pass the MAC authentication of the authentication server, the access of a pseudo base station is prevented, the access security of the base station is improved, and the communication security of the base station and a core network is ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a base station access authentication method, device, security gateway, base station and storage medium. Background Art

[0002] In order to ensure the security of communication between the base station and the core network, the base station needs to first establish a secure tunnel with the security gateway, and then connect to the core network through the security gateway to ensure communication security. The secure tunnel is usually established through negotiation using the IPsec IKEv2 protocol, which includes authentication methods such as pre-shared key PSK, extensible authentication and key negotiation EAP-AKA, and digital certificate PUBLIC-KEY. However, no matter which authentication method is used, there is a risk of authentication information leakage or cracking. After obtaining the authentication information, a third party can forge a base station to access it, thereby causing information security issues. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a base station access authentication method, device, security gateway, base station and storage medium.

[0004] In a first aspect, the present disclosure provides a base station access authentication method, which is applied to a security gateway, and the method includes:

[0005] In response to receiving an Internet Key Exchange-Authentication IKE_AUTH request message sent by the base station, acquiring a first media access control MAC address carried by the IKE_AUTH request message, wherein the first MAC address is an encrypted security payload;

[0006] Encapsulating the first MAC address to obtain an access request message;

[0007] Sending the access request message to an authentication server for MAC authentication;

[0008] When a feedback message from the authentication server is received, the feedback message is sent to the base station so that the base station accesses the security gateway, wherein the feedback message is sent when MAC authentication is passed by the authentication server.

[0009] In a second aspect, the present disclosure provides a base station access authentication method, which is applied to a base station, and the method includes:

[0010] Obtain a first media access control MAC address for requesting access to a gateway;

[0011] adding the first MAC address as notification information in an Internet Key Exchange-Authentication IKE_AUTH request message, wherein the first MAC address is an encrypted security payload;

[0012] Sending an IKE_AUTH request message carrying the first MAC address to a security gateway, so that the security gateway encapsulates an access request message based on the first MAC address and sends it to an authentication server for MAC authentication;

[0013] In case of receiving a feedback message sent by the security gateway, accessing the security gateway based on the feedback message, wherein the feedback message is sent by the authentication server when MAC authentication is passed.

[0014] In a third aspect, the present disclosure provides a base station access authentication device, which is applied to a security gateway, including:

[0015] A first acquisition module, configured to, in response to receiving an Internet Key Exchange-Authentication IKE_AUTH request message sent by a base station, acquire a first media access control MAC address carried in the IKE_AUTH request message, wherein the first MAC address is an encrypted security payload;

[0016] A message encapsulation module, used for encapsulating the access request message based on the first MAC address;

[0017] A first sending module, used to send the access request message to an authentication server for MAC authentication;

[0018] The second sending module is used to send the feedback message to the base station when receiving the feedback message from the authentication server, so that the base station can access the security gateway, wherein the feedback message is sent when the authentication server passes the MAC authentication.

[0019] In a fourth aspect, the present disclosure provides a base station access authentication device, applied to a base station, including:

[0020] A second acquisition module, used to acquire a first media access control MAC address for requesting access to the gateway;

[0021] An information adding module, configured to add the first MAC address as notification information in an Internet Key Exchange-Authentication IKE_AUTH request message, wherein the first MAC address is an encrypted security payload;

[0022] A third sending module, configured to send an IKE_AUTH request message carrying the first MAC address to a security gateway, so that the security gateway encapsulates an access request message based on the first MAC address and sends it to an authentication server for MAC authentication;

[0023] The network access module is used to access the security gateway based on the feedback message sent by the security gateway when the feedback message is received, wherein the feedback message is sent by the authentication server when MAC authentication is passed.

[0024] In a fifth aspect, the present disclosure provides a security gateway, including a processor and a memory; the processor is used to execute the base station access authentication method as described in the first aspect by calling a program or instruction stored in the memory.

[0025] In a sixth aspect, the present disclosure provides a base station, comprising a processor and a memory; the processor is used to execute the base station access authentication method as described in the second aspect by calling a program or instruction stored in the memory.

[0026] In a seventh aspect, the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, the base station access authentication method as described in the first aspect is implemented, or the base station access authentication method as described in the second aspect is implemented.

[0027] In an eighth aspect, the present disclosure provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the base station access authentication method as described in the first aspect, or implements the base station access authentication method as described in the second aspect.

[0028] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0029] In this solution, when the security gateway receives the IKE_AUTH request message sent by the base station, it obtains the first MAC address carried in the IKE_AUTH request message, and encapsulates the first MAC address to obtain an access request message, and sends the access request message to the authentication server for MAC authentication. When the authentication server passes the MAC authentication, it sends a feedback message to the security gateway. Then, when the security gateway receives the feedback message from the authentication server, it sends the feedback message to the base station, so that the base station can access the security gateway. With the solution disclosed in the present invention, by carrying the MAC address in the IKE_AUTH request message, the security gateway obtains the MAC address from the IKE_AUTH request message and sends it to the authentication server for MAC authentication. Only after the authentication is passed, the base station is allowed to access. Since the IKE_AUTH request message is encrypted and transmitted, the MAC address carried is an encrypted security payload. Therefore, even if the authentication information is obtained by a third party, the third party cannot obtain the real MAC address, so that the authentication information forged by the third party cannot pass the MAC authentication of the authentication server, preventing the access of a fake base station, improving the security of base station access, and ensuring the communication security between the base station and the core network. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0032] Figure 1 A flowchart of a base station access authentication method provided by an exemplary embodiment of the present disclosure;

[0033] Figure 2 A flowchart of a base station access authentication method provided by another exemplary embodiment of the present disclosure;

[0034] Figure 3 A flowchart of a base station access authentication method provided for yet another exemplary embodiment of the present disclosure;

[0035] Figure 4 A flowchart of a base station access authentication method provided by another exemplary embodiment of the present disclosure;

[0036] Figure 5 A schematic diagram of the architecture of base station access authentication according to an exemplary embodiment of the present disclosure is shown;

[0037] Figure 6 A schematic diagram showing a flow chart of a base station access authentication method according to an exemplary embodiment of the present disclosure;

[0038] Figure 7 A schematic diagram of the structure of a base station access authentication device provided by an embodiment of the present disclosure;

[0039] Figure 8 A schematic diagram of the structure of a base station access authentication device provided in another embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0041] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0042] Small low-power base stations (also known as small base stations or home base stations) are usually placed in public places, such as stadiums and airports, or directly at home to enhance indoor coverage. Due to the diversity of home base station deployment locations, it is easy to bring security risks when home base stations are connected to the operator's core network. It is necessary to consider the secure communication between home base stations and the core network to prevent communication data leakage.

[0043] At present, when the home base station communicates with the core network, it first establishes a secure tunnel with the security gateway, and then connects to the core network through the security gateway to ensure communication security. The IPsec IKEv2 (Internet Key Exchange version 2) protocol is usually used to negotiate and establish a secure tunnel.

[0044] Internet Key Exchange (IKE) is a key management protocol used to establish and manage secure connections between the two ends of an IPsec tunnel, including the IKE_SA_INIT (Internet Key Exchange-Security Association-initiator) phase and the IKE-AUTH (Internet Key Exchange-authentication) phase. In the IKE_SA_INIT phase, the initiator sends an IKE_SA_INIT request message to the responder, which generally contains information such as the initiator's cookie, proposal, and nonce; the IKE_SA_INIT response message is the responder's response to the IKE_SA_INIT request message. The IKE_SA_INIT request message process includes: (1) The initiator sends an IKE_SA_INIT request message, which contains the initiator's cookie, proposal, nonce and other information; (2) The responder receives the request message and verifies the initiator's cookie; (3) The responder generates its own nonce and creates an IKE_SA_INIT response message, which contains the responder's cookie, proposal acceptance status, nonce, etc.; (4) The responder calculates the DH key and includes it in the IKE_SA_INIT response message; (5) The initiator receives the response message and verifies the responder's cookie; (6) The initiator and responder use the nonce and DH keys of both parties to generate the key material of IKESA. In the IKE-AUTH phase, the initiator sends an IKE-AUTH request message to the responder. This message is a subsequent message in the first phase of IKE and is used to complete identity authentication and ultimately establish an IKE Security Association (SA). It contains: (1) Initiator Nonce: the random value provided in the IKE_SA_INIT request message; (2) Responder Nonce: the responder random value obtained from the IKE_SA_INIT response message; Authentication Data: authentication data, which can be a hash value of a pre-shared key (PSK), a digital signature, or other authentication data; (4) Certificate Data: if public / private key certificates are used for authentication, certificate data will be included; (5) Notification Data: if there is an error or notification message that needs to be sent, this field may be included.

[0045] However, when using the IPsec IKEv2 protocol to negotiate and establish a secure tunnel, the authentication method used has the risk of authentication information being leaked or cracked. Once a third party obtains the authentication information, it can forge a base station to access, thereby causing information security issues.

[0046] In view of the above problems, the present disclosure proposes a base station access authentication scheme. When the base station uses the IPsecEAP-AKA authentication method to access the network, the media access control (MAC) address of the gateway to be accessed is obtained, and the IKE-AUTH request message carrying the MAC address is sent to the security gateway by carrying the MAC address information in the IKE-AUTH stage of IKEv2. After receiving the IKE-AUTH request message, the security gateway parses the message, obtains the MAC address carried by the base station, and encapsulates the access request message to send it to the authentication server, and the authentication server performs MAC authentication. If the MAC authentication fails, the base station is not allowed to access. In this scheme, the MAC address information is carried in the IKE-AUTH stage of IKEv2, which is an encrypted security payload, and it is not easy for a third party to discover, obtain and guess its purpose. Therefore, even if the IPsecEAP-AKA authentication information is obtained or cracked by a third party, the third party cannot obtain the real MAC address and the purpose of obtaining the MAC address, so that the authentication information forged by the third party cannot pass the MAC authentication of the authentication server, so that the security gateway can identify whether the base station requesting access is a fake base station, thereby effectively restricting the access of the fake base station, achieving the purpose of rejecting the access of the fake base station and ensuring the security of communication.

[0047] The implementation of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0048] Figure 1 A flow chart of a base station access authentication method provided for an exemplary embodiment of the present disclosure. The method can be executed by a base station access authentication device provided for an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can be integrated in a security gateway.

[0049] like Figure 1 As shown, the base station access authentication method may include the following steps:

[0050] Step 101: in response to receiving an Internet Key Exchange-Authentication IKE_AUTH request message sent by a base station, obtaining a first media access control MAC address carried in the IKE_AUTH request message, wherein the first MAC address is an encrypted security payload.

[0051] Among them, the IKE_AUTH request message is a request message sent by the base station in the IKE-AUTH phase of IKEv2 when establishing a secure tunnel with the security gateway. The IKE-AUTH phase is an important step in the IKE negotiation process, which occurs after the IKE_SA_INIT phase. In the IKE-AUTH phase, the communicating parties (initiator and responder) complete the identity authentication process and finally establish the IKE SA.

[0052] Different from the traditional authentication method, in this embodiment, in the IKE-AUTH stage of IKEv2, the base station obtains the MAC address of the gateway to be accessed, and carries the MAC address in the IKE-AUTH request message and sends it to the security gateway. Among them, the IKE-AUTH request message can be sent by the base station after receiving the IKE_SA_INIT response message from the security gateway, or it can be sent by the base station after receiving the IKE_AUTH response message from the security gateway. It can be understood that the information carried in the two IKE-AUTH request messages is different, but both need to encapsulate the obtained MAC address in the message and then send it. The security gateway receives the IKE_AUTH request message sent by the base station, and parses the IKE_AUTH request message to obtain the MAC address carried in the message (for ease of description and distinction, referred to as the first MAC address).

[0053] Step 102: obtain an access request message based on the first MAC address encapsulation.

[0054] In the disclosed embodiment, after the security gateway obtains the first MAC address, the first MAC address can be encapsulated in a request message of a preset authentication protocol to obtain an access request message. For example, the preset authentication protocol can be a Remote Authentication Dial In User Service (RADIUS) protocol, and the first MAC address can be encapsulated in a Vendor-Specific Attributes (VSA) of the RADIUS protocol to obtain an access request message.

[0055] Step 103: Send the access request message to the authentication server for MAC authentication.

[0056] The authentication server is used to perform MAC authentication based on the access request message. The authentication server can be an independent server or an authentication module integrated in the core network. The present disclosure does not limit the form of the authentication server. For example, an authentication-authorization-accounting (AAA) scheme can be configured on the core network so that the core network has the function of performing MAC authentication on the base station.

[0057] In the disclosed embodiment, the security gateway sends an access request message to the authentication server. After receiving the access request message, the authentication server can complete MAC authentication based on the access request message.

[0058] As some examples, after receiving the access request message, the authentication server can parse the access request message. If the MAC address is parsed out, it can be determined that the MAC authentication is successful, and a feedback message is replied to the security gateway. If the MAC address is not parsed out from the access request message, it is considered that the MAC authentication has failed, the authentication server does not respond to the security gateway, and the base station access authentication process cannot be executed, thereby effectively limiting the access of fake base stations and ensuring communication security.

[0059] As another example, the MAC address of a legitimate security gateway can be pre-registered in the authentication server. After receiving the access request message, the authentication server can parse the access request message. If the MAC address is parsed, the parsed MAC address can be further compared with the MAC address of the registered security gateway. If the parsed MAC address exists in the registered MAC address, it is determined that the MAC authentication is passed, and a feedback message is sent to the security gateway. If the MAC address is not parsed from the access request message, or the parsed MAC address does not exist in the registered MAC address, it is considered that the MAC authentication has failed, the authentication server does not respond to the security gateway, and the base station access authentication process cannot be executed, thereby effectively limiting the access of fake base stations and ensuring communication security. By comparing the parsed MAC address with the registered MAC address, it is possible to prevent third parties from forging MAC addresses to access, more accurately identify fake base stations, and ensure communication security.

[0060] Step 104: upon receiving a feedback message from the authentication server, the feedback message is sent to the base station so that the base station can access the security gateway, wherein the feedback message is sent by the authentication server when MAC authentication is passed.

[0061] In the disclosed embodiment, after the security gateway sends an access request message to the authentication server, it waits for a reply from the authentication server. If the security gateway receives a feedback message from the authentication server, it can be determined that the base station requesting access has passed the MAC authentication of the authentication server, and then the feedback message is sent to the base station as a response to the IKE_AUTH request message, so that the base station accesses the security gateway after receiving the response and establishes a secure tunnel with the security gateway.

[0062] It should be noted that, in this embodiment, the feedback message replied by the authentication server is different for different timings when the base station sends the IKE_AUTH request message. If the IKE_AUTH request message is sent by the base station after receiving the security response message (IKE_SA_INIT response message) from the security gateway, the feedback message replied by the authentication server can be the International Mobile Subscriber Identity (IMSI) for requesting the base station. After the security gateway sends the feedback message to the base station, the base station obtains the IMSI information and sends the IKE_AUTH request message to the security gateway again. After that, the security gateway can feedback the IKE_AUTH response message to the base station. The message may include the authentication vector required to establish a secure tunnel (for example, RAND, AUTN and other authentication vectors). The security gateway and the base station both perform calculations according to the IMSI information, the authentication vector, etc., according to the preset protocol algorithm to obtain the authentication result, the integrity key IK, the encryption key CK, etc.; if the IKE_AUTH request message is sent by the base station after receiving the IKE_AUTH response message from the security gateway, the feedback message replied by the authentication server may include the required authentication vector, and the security gateway sends the feedback message to the base station as a response to the IKE_AUTH request message. The base station performs calculations according to the preset protocol algorithm based on the feedback message. In addition, the security gateway also performs calculations according to the preset protocol algorithm based on the corresponding data, so as to establish a secure tunnel between the base station and the security gateway.

[0063] In an optional implementation of the present disclosure, if the security gateway does not receive a feedback message sent by the authentication server within a preset time, it can be determined that the base station requesting access has not passed the MAC authentication, and the security gateway does not reply to the base station, and the number of authentication failures of the base station is accumulated by 1. For the base station, after the base station sends an IKE_AUTH request message, it waits for the reply of the security gateway. If no response message is received from the security gateway within a certain period of time, the base station resends the IKE_AUTH request message and continues to wait for the response of the security gateway. For the IKE_AUTH request message newly received by the security gateway, it continues to obtain the MAC address and request the authentication server to perform MAC authentication, and waits for the reply of the authentication server. If the security gateway does not receive a feedback message sent by the authentication server within the preset time, the number of authentication failures of the base station is accumulated by 1 again, and the above process is repeated until the number of authentication failures is greater than the preset value, and it is determined that the base station requesting access is a pseudo base station, and the base station access is denied; or, until the security gateway receives a feedback message from the authentication server, it is determined that the base station has passed the MAC authentication, and the number of authentication failures corresponding to the base station is cleared to zero. As a result, the base station is given multiple opportunities to request access, ensuring that legitimate base stations can access smoothly, effectively avoiding the situation where legitimate base stations are mistakenly identified as fake base stations, and ensuring the accuracy of base station access authentication.

[0064] In the base station access authentication method of the embodiment of the present disclosure, when the security gateway receives the IKE_AUTH request message sent by the base station, it obtains the first MAC address carried in the IKE_AUTH request message, and encapsulates the access request message based on the first MAC address, and sends the access request message to the authentication server for MAC authentication. When the authentication server passes the MAC authentication, it sends a feedback message to the security gateway. Then, when the security gateway receives the feedback message from the authentication server, it sends the feedback message to the base station, so that the base station accesses the security gateway. With the scheme of the present disclosure, by carrying the MAC address in the IKE_AUTH request message, the security gateway obtains the MAC address from the IKE_AUTH request message and sends it to the authentication server for MAC authentication. Only after the authentication passes, the base station is allowed to access. Since the IKE_AUTH request message is encrypted and transmitted, the carried MAC address is an encrypted security payload. Therefore, even if the authentication information is obtained by a third party, the third party cannot obtain the real MAC address, so that the authentication information forged by the third party cannot pass the MAC authentication of the authentication server, thereby preventing the access of a fake base station, improving the security of base station access, and ensuring the communication security between the base station and the core network.

[0065] In an optional implementation of the present disclosure, when obtaining the first MAC address carried by the IKE_AUTH request message, the IKE_AUTH request message can be parsed to determine the target payload of the target type, and then obtain the data field value of the target payload as the first MAC address.

[0066] The target type is a private usage segment type defined in the IKE_AUTH phase of the IKE interaction, and its value range is 40960-65536. When the value of the load type of a load falls within this range, the load type of the load is determined to be the target type, and the load is determined to be the target load.

[0067] In this embodiment, a load is pre-configured to carry the MAC of the security gateway, and the value of the load type of the load is set within the value range of the private use segment to indicate that the load carries an additional notification message, so that after receiving the IKE_AUTH request message, the security gateway can identify which part of the load is the MAC address information through the load type of the load, laying the foundation for the implementation of this solution.

[0068] In an optional implementation manner of the present disclosure, the IKE_AUTH request message is a message sent by the base station after receiving the security response message fed back by the security gateway (for ease of description and distinction, referred to as the first IKE_AUTH request message), such as Figure 2 As shown, in Figure 1 Based on the illustrated embodiment, step 102 may include the following sub-steps:

[0069] Step 201, obtaining the supplier identification and attribute code.

[0070] The vendor identifier can apply for a number from the Internet Assigned Numbers Authority (IANA) as the vendor identifier, or a custom number can be used as the vendor identifier (for example, the number 0x00000213 is used to indicate private use). The attribute code can be customized, and the attribute code is used to indicate the MAC address attribute, that is, the value of the corresponding Value field is the MAC address. For example, 0x01 (attribute code) can be defined to indicate "MAC Address".

[0071] Step 202: construct a supplier custom attribute VSA structure based on the supplier identifier and the attribute code. The VSA structure includes a Value field.

[0072] In this embodiment, after obtaining the vendor identification and attribute code, a VSA structure may be further constructed, the VSA structure including a Value field for storing MAC address information. For example, the constructed VSA structure may be expressed in the form of "vendor identification_attribute code_Value field".

[0073] Step 203: Add the first MAC address to the Value field to obtain the vendor extended attribute.

[0074] In the embodiment of the present disclosure, after the VSA structure is constructed, the first MAC address obtained can be added to the Value field of the VSA structure to obtain the vendor extended attribute. The first MAC address can be converted into a binary format and then added to the Value field of the VSA structure.

[0075] Step 204: Generate an access request message based on the vendor extended attribute.

[0076] Exemplarily, after obtaining the vendor extended attribute, the vendor extended attribute may be added to a RADIUS request message to obtain an access request message.

[0077] The base station access authentication method of this embodiment obtains the vendor identifier and attribute code, and constructs a VSA structure based on the vendor identifier and attribute code. The VSA structure includes a Value field, and the first MAC address is added to the Value field to obtain the vendor extended attribute, and then an access request message is generated based on the vendor extended attribute. As a result, the security gateway can encapsulate the obtained MAC address in the authentication protocol message through the extended attribute to perform MAC authentication, which provides conditions for identifying fake base stations.

[0078] Furthermore, if Figure 3 As shown, in Figure 2 Based on the illustrated embodiment, step 104 may include the following sub-steps:

[0079] Step 301: upon receiving a feedback message from an authentication server, the feedback message is sent to a base station as a first IKE_AUTH response message, wherein the feedback message is an IMSI request message sent by the authentication server when MAC authentication based on an access request message is successful.

[0080] In the disclosed embodiment, after the security gateway receives the first IKE_AUTH request message sent by the base station (the message carries the MAC address information of the security gateway to be accessed in addition to the basic information such as E

[46] , Idi

[35] , and N

[41] (INIT_CONTACT), etc.), the first MAC address is obtained from the first IKE_AUTH request message and an access request message is generated and sent to the authentication server for MAC authentication. If the MAC authentication is successful, the authentication server returns an IMSI request message to the security gateway to request the IMSI information of the base station. After receiving the IMSI request message, the security gateway replies to the base station with the IMSI request message as a response to the first IKE_AUTH request message (referred to as the first IKE_AUTH response message). After receiving the first IKE_AUTH response message, the base station obtains the required IMSI information and the MAC address of the security gateway to be accessed, and encapsulates the obtained IMSI information and MAC address in a second IKE_AUTH request message and sends it to the security gateway, wherein the second IKE_AUTH request message also contains the basic information such as E

[46] and Idr

[36] .

[0081] Step 302: Receive a second IKE_AUTH request message sent by the base station. The second IKE_AUTH request message is sent by the base station after receiving the IMSI request message.

[0082] Step 303: Obtain the IMSI information and the second MAC address carried in the second IKE_AUTH request message.

[0083] Step 304: Generate an access request message based on the IMSI information and the second MAC address.

[0084] In this embodiment, after receiving the second IKE_AUTH request message sent by the base station, the security gateway can parse the second IKE_AUTH request message to obtain the IMSI information and the second MAC address carried in the second IKE_AUTH request message, and then generate an access request message based on the IMSI information and the second MAC address.

[0085] It should be noted that, in this embodiment, the implementation process of generating the access request message is similar to the implementation process of generating the access request message based on the first MAC address, and will not be repeated here.

[0086] Step 305: Send the access request message to the authentication server for MAC authentication.

[0087] Step 306: When the challenge access information fed back by the authentication server is received, the challenge access information is sent to the base station as a second IKE_AUTH response message, so that the base station can access the security gateway.

[0088] In this embodiment, the security gateway sends the generated request access message to the authentication server for MAC authentication, wherein the authentication process of the authentication server performing MAC authentication based on the request access message is similar to the MAC authentication process described in step 103 in the aforementioned embodiment, and will not be repeated here. If the authentication server passes the MAC authentication, the challenge access information is fed back to the security gateway, and the challenge access information includes authentication vectors such as RAND and AUTN. After the security gateway receives the challenge access information from the authentication server, the challenge access information is fed back to the base station as a response to the second IKE_AUTH request message (i.e., the second IKE_AUTH response message). After the base station receives the second IKE_AUTH response message, the authentication vectors such as RAND and AUTN can be parsed from the second IKE_AUTH response message, and the authentication result, integrity key IK, encryption key CK, etc. are calculated according to the preset protocol algorithm, and the security tunnel with the security gateway is established, and the security gateway is successfully accessed. If the authentication server fails to pass the MAC authentication based on the request access message, the security gateway is not responded to, and the security gateway determines that the authentication fails, so that the base station access can be rejected.

[0089] In an optional implementation of the present disclosure, if the base station does not receive the challenge access information from the authentication server within a preset time, it can be determined that the base station requesting access has not passed the MAC authentication, and the security gateway does not reply to the base station, and the number of authentication failures of the base station is accumulated by 1. For the base station, after the base station sends the second IKE_AUTH request message, it waits for the reply of the security gateway. If the response message from the security gateway is not received within a certain period of time, the base station resends the second IKE_AUTH request message and continues to wait for the response of the security gateway. For the second IKE_AUTH request message newly received by the security gateway, continue to obtain the MAC address and request the authentication server to perform MAC authentication, and wait for the reply of the authentication server. If the security gateway does not receive the feedback message sent by the authentication server within the preset time, the number of authentication failures of the base station is accumulated by 1 again, and the above process is repeated until the number of authentication failures is greater than the preset value, and it is determined that the base station requesting access is a pseudo base station, and the base station access is denied; or, until the security gateway receives the challenge access information from the authentication server, it is determined that the base station passes the MAC authentication, and the number of authentication failures corresponding to the base station is cleared to zero. As a result, the base station is given multiple opportunities to request access, ensuring that legitimate base stations can access smoothly, effectively avoiding the situation where legitimate base stations are mistakenly identified as fake base stations, and ensuring the accuracy of base station access authentication.

[0090] The base station access authentication method of this embodiment, when receiving a feedback message from an authentication server, sends the feedback message as a first IKE_AUTH response message to the base station, wherein the feedback message is an IMSI request message sent by the authentication server when MAC authentication is passed based on an access request message, receives a second IKE_AUTH request message sent by the base station, and the second IKE_AUTH request message is sent by the base station after receiving the IMSI request message; obtains the IMSI information and the second MAC address carried in the second IKE_AUTH request message, and generates a request access message based on the IMSI information and the second MAC address, and then sends the request access message to the authentication server for MAC authentication, and when receiving the challenge access information fed back by the authentication server, sends the challenge access information as a second IKE_AUTH response message to the base station, so that the base station accesses the security gateway, thereby, when the base station feeds back the IMSI information, the MAC address of the gateway is also carried in the IKE_AUTH request message for MAC verification, thereby realizing double MAC authentication in the process of establishing a security tunnel, ensuring the accuracy of MAC authentication, thereby being able to accurately identify whether the base station is a pseudo base station, and ensuring communication security.

[0091] Corresponding to the above embodiments, the present disclosure also provides a base station access authentication method, which is applied to a base station. The method can be executed by a base station access authentication device provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can be integrated in a base station, for example, in a home base station.

[0092] Figure 4 A flow chart of a base station access authentication method provided by another exemplary embodiment of the present disclosure is as follows: Figure 4 As shown, the base station access authentication method may include the following steps:

[0093] Step 401: Obtain a first media access control MAC address for requesting access to a gateway.

[0094] For the base station, it is known which security gateway it needs to access. For example, the MAC address of the gateway that the base station needs to access can be configured in the configuration file. Thus, the base station can obtain the MAC address of the gateway requested to access (called the first MAC address) by reading the configuration file.

[0095] Step 402: Add the first MAC address as notification information in an Internet Key Exchange-Authentication IKE_AUTH request message, wherein the first MAC address is an encrypted security payload.

[0096] In this embodiment, for the acquired first MAC address, the base station may carry the first MAC address as an additional notification message in the IKE_AUTH request message.

[0097] In an optional implementation of the present disclosure, when adding the first MAC address to the IKE_AUTH request message, the last payload of the IKE_AUTH request message can be determined first. Generally, the payload header field is defined as follows: Next payload (1 byte) - identifies the type of the next payload in the message. If the current payload is the last one in the message, this field is 0. This field provides a "linking" capability so that the additional payload can be appended to the end of the message and the "next payload" field of the previous payload is set to indicate the type of the next payload. Therefore, in this embodiment, the last payload in the IKE_AUTH request message can be identified by detecting whether the next payload field of each payload in the IKE_AUTH request message is 0. If the next payload field of a payload is 0, it is determined that the payload is the last payload. Then, the next payload field of the last payload is set to the value corresponding to the target type to set the payload type of the next payload to the target type, wherein the target type refers to the type that the user can use privately. For example, if the value range corresponding to the target type is 40960-65536, the next payload field of the last payload can be set to 40961. Finally, the first MAC address may be added to the data field of the next payload of the last payload, thereby achieving the addition of the acquired first MAC address to the IKE_AUTH request message, providing conditions for MAC authentication.

[0098] Step 403: Send an IKE_AUTH request message carrying the first MAC address to the security gateway, so that the security gateway encapsulates an access request message based on the first MAC address and sends it to the authentication server for MAC authentication.

[0099] In this embodiment, after the base station adds the first MAC address to the IKE_AUTH request message, it can send the IKE_AUTH request message carrying the first MAC address to the security gateway. The security gateway parses the first MAC address from the IKE_AUTH request message, and encapsulates the access request message based on the first MAC address and sends it to the authentication server for MAC authentication. If the authentication is successful, the authentication server returns a feedback message to the security gateway, and the security gateway sends the feedback message to the base station. If the authentication fails, the authentication server does not reply to the security gateway, and the security gateway does not reply to the base station, then the base station cannot access the security gateway, effectively preventing the access of fake base stations.

[0100] Step 404: upon receiving a feedback message sent by the security gateway, access the security gateway based on the feedback message, wherein the feedback message is sent by the authentication server after MAC authentication is passed.

[0101] In this embodiment, if the base station receives a feedback message sent by the security gateway, the base station may access the security gateway based on the feedback message.

[0102] The base station access authentication method of this embodiment obtains the first MAC address of the gateway for requesting access, adds the first MAC address as notification information in the IKE_AUTH request message, and then sends the IKE_AUTH request message carrying the first MAC address to the security gateway, so that the security gateway encapsulates the access request message based on the first MAC address and sends it to the authentication server for MAC authentication. When receiving the feedback message sent by the security gateway, the security gateway is accessed based on the feedback message, wherein the feedback message is sent by the authentication server when the MAC authentication is passed. With the scheme disclosed in the present invention, by carrying the MAC address in the IKE_AUTH request message, the security gateway obtains the MAC address from the IKE_AUTH request message and sends it to the authentication server for MAC authentication. The base station is allowed to access only after the authentication is passed. Since the IKE_AUTH request message is encrypted and transmitted, the carried MAC address is an encrypted security payload. Therefore, even if the authentication information is obtained by a third party, the third party cannot obtain the real MAC address, so that the authentication information forged by the third party cannot pass the MAC authentication of the authentication server, thereby preventing the access of fake base stations, improving the security of base station access, and ensuring the communication security between the base station and the core network.

[0103] Take the base station as a home base station as an example. Figure 5 A schematic diagram of the architecture of base station access authentication according to an exemplary embodiment of the present disclosure is shown. Figure 5 As shown, the home base station runs an IPsec program for establishing a secure tunnel with the security gateway. The core network is configured with an AAA solution for implementing the MAC authentication function, and the AAA solution can be implemented through the RADIUS protocol.

[0104] Figure 6 FIG. 1 is a flow chart showing a base station access authentication method according to an exemplary embodiment of the present disclosure. Figure 6 As shown:

[0105] Step S1: The home base station sends an IKE_SA_INIT request message to a security gateway.

[0106] Step S2: The security gateway replies to the home base station with an IKE_SA_INIT response message.

[0107] In step S3, the home base station sends an IKE_AUTH request message to the security gateway. In addition to carrying basic information such as Encrypted (E

[46] ), Identification-Initiator (Idi

[35] ), and Notify (N

[41] ), the message also carries the MAC address information of the gateway. After receiving the IKE_SA_INIT response message, the home base station obtains the MAC address of the security gateway to be accessed. In the IKE_AUTH stage of the IKE interaction in the IPSec protocol, the next payload of the last payload carries an additional notification message. The payload type of the next payload is set to 40961 (40960-65536 is a private use segment), and the data field is a 6-byte MAC address, thereby encapsulating the MAC address into the security payload.

[0108] Step S4: After receiving the IKE_AUTH request message of step S3, the security gateway parses it, obtains the MAC address carried therein and encapsulates it into the VSA of the RADIUS protocol, obtains an access request message, and sends the access request message to AAA for MAC authentication.

[0109] Step S5, after receiving the access request message, AAA performs MAC authentication. If the authentication succeeds, a RADIUS Challenge Access Information Request is sent to the security gateway to request the IMSI. If the authentication fails, AAA does not respond, and the base station authentication access process cannot proceed.

[0110] Step S6: After receiving the RADIUS challenge access information in step S5, the security gateway sends an IKE_AUTH response message to the home base station. The message includes the RADIUS challenge access information and basic Encrypted (E

[46] ) and Identification-Responder (Idr

[36] ).

[0111] In step S7, after receiving the IKE_AUTH response message sent by the security gateway, the home base station obtains the required IMSI information and the MAC address information of the gateway, and sends an IKE_AUTH request message to the security gateway. In addition to basic information such as Encrypted (E

[46] ), Extensible Authentication (EAP

[48] ), and Notify (N

[41] ), the home base station also includes IMSI information and MAC address information.

[0112] Step S8, after receiving the IKE_AUTH request message from the home base station, the security gateway parses and encapsulates it to obtain an access request message, and sends the access request message to AAA for MAC authentication. The access request message encapsulates an EAP response message, and the EAP response message includes IMSI information and MAC address information.

[0113] Step S9, after receiving the access request message, AAA performs MAC authentication. If the authentication is successful, a RADIUS challenge access message is sent to the security gateway. The RADIUS challenge access message includes authentication vectors such as RAND and AUTN. If the authentication fails, AAA does not respond, and the base station authentication access process cannot be executed further.

[0114] Step S10: After receiving the RADIUS challenge access information, the security gateway sends an IKE_AUTH response message to the home base station. The response message includes the RADIUS challenge access information and basic Encrypted (E

[46] ) and Extensible Authentication (EAP

[48] ) information.

[0115] Finally, after receiving the IKE_AUTH response message, the home base station parses it to obtain RAND and AUTN, takes them as input parameters, and calculates the authentication result, integrity key IK, encryption key CK, etc. according to the preset protocol algorithm.

[0116] The disclosed solution is based on the IPsecEAP-AKA authentication method. Even if the authentication information is obtained by a third party, it is still possible to identify whether it is a fake base station, thereby refusing access to the fake base station and ensuring communication security.

[0117] In order to implement the above embodiment, the present disclosure also provides a base station access authentication device.

[0118] Figure 7 This is a schematic diagram of the structure of a base station access authentication device provided in an embodiment of the present disclosure. The device is implemented in software and / or hardware and can be integrated in a security gateway.

[0119] like Figure 7 As shown, the base station access authentication device 50 may include: a first acquisition module 510 , a message encapsulation module 520 , a first sending module 530 and a second sending module 540 .

[0120] The first acquisition module 510 is configured to acquire a first media access control MAC address carried in the IKE_AUTH request message in response to receiving an Internet Key Exchange-Authentication IKE_AUTH request message sent by the base station, wherein the first MAC address is an encrypted security payload;

[0121] A message encapsulation module 520, configured to obtain an access request message by encapsulating the first MAC address;

[0122] A first sending module 530, configured to send an access request message to an authentication server for MAC authentication;

[0123] The second sending module 540 is used to send the feedback message to the base station when receiving the feedback message from the authentication server, so that the base station can access the security gateway, wherein the feedback message is sent when the authentication server passes the MAC authentication.

[0124] Optionally, the first acquisition module 510 is further configured to:

[0125] Parse the IKE_AUTH request message and determine that the payload type is a target payload of the target type;

[0126] The data field value of the target payload is obtained as the first MAC address.

[0127] Optionally, the IKE_AUTH request message is a first IKE_AUTH request message sent by the base station after receiving a security response message fed back by the security gateway. The message encapsulation module 520 is further configured to:

[0128] Get the supplier ID and attribute code;

[0129] Based on the supplier ID and attribute code, a supplier custom attribute VSA structure is constructed, and the VSA structure includes a Value field;

[0130] Add the first MAC address to the Value field to obtain the vendor extended attribute;

[0131] Generate an access request message based on the vendor extended attributes.

[0132] Further optionally, the second sending module 540 is further configured to:

[0133] When receiving a feedback message from the authentication server, sending the feedback message as a first IKE_AUTH response message to the base station, wherein the feedback message is an IMSI request message sent by the authentication server when MAC authentication is successful based on the access request message;

[0134] receiving a second IKE_AUTH request message sent by the base station, where the second IKE_AUTH request message is sent by the base station after receiving the IMSI request message;

[0135] Obtain the IMSI information and the second MAC address carried in the second IKE_AUTH request message;

[0136] Generate an access request message based on the IMSI information and the second MAC address;

[0137] Sending the access request message to the authentication server for MAC authentication;

[0138] When the challenge access information fed back by the authentication server is received, the challenge access information is sent to the base station as a second IKE_AUTH response message, so that the base station accesses the security gateway.

[0139] Optionally, the base station access authentication device 50 further includes:

[0140] A statistics module, configured to add 1 to the number of authentication failures of the base station if no feedback message or challenge access information sent by the authentication server is received within a preset time period;

[0141] The access rejection module is used to reject base station access when the number of authentication failures is greater than a preset value.

[0142] The base station access authentication device applied to the security gateway provided in the embodiment of the present disclosure can execute the base station access authentication method applied to the security gateway provided in the embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method. The contents not described in detail in the embodiment of the device of the present disclosure can refer to the description in any method embodiment of the present disclosure.

[0143] Figure 8 This is a schematic diagram of the structure of a base station access authentication device provided in another embodiment of the present disclosure. The device is implemented in software and / or hardware and can be integrated in a base station.

[0144] like Figure 8 As shown, the base station access authentication device 60 may include: a second acquisition module 610 , an information adding module 620 , a third sending module 630 and a network access module 640 .

[0145] The second acquisition module 610 is used to acquire a first media access control MAC address for requesting access to the gateway;

[0146] An information adding module 620, configured to add the first MAC address as notification information in an Internet Key Exchange-Authentication IKE_AUTH request message, wherein the first MAC address is an encrypted security payload;

[0147] The third sending module 630 is used to send the IKE_AUTH request message carrying the first MAC address to the security gateway, so that the security gateway encapsulates the access request message obtained based on the first MAC address and sends it to the authentication server for MAC authentication;

[0148] The network access module 640 is used to access the security gateway based on the feedback message when receiving the feedback message sent by the security gateway, wherein the feedback message is sent when the MAC authentication is passed by the authentication server.

[0149] Optionally, the information adding module 620 is further used to:

[0150] Determine the last payload of the IKE_AUTH request message;

[0151] Set the next payload field of the last payload to the value corresponding to the target type;

[0152] The first MAC address is added to the data field of the next payload of the last payload.

[0153] The base station access authentication device applied to the base station provided in the embodiment of the present disclosure can execute the base station access authentication method applied to the base station provided in the embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method. Contents not fully described in the embodiment of the device of the present disclosure can refer to the description in any method embodiment of the present disclosure.

[0154] The embodiment of the present disclosure also provides a security gateway, including a processor and a memory; the processor calls the program or instructions stored in the memory to execute the steps of each embodiment of the base station access authentication method as described in the above embodiments. To avoid repeated description, they are not repeated here.

[0155] The embodiment of the present disclosure also provides a base station, including a processor and a memory; the processor calls the program or instructions stored in the memory to execute the steps of each embodiment of the base station access authentication method as described in the above embodiments. To avoid repeated description, they are not repeated here.

[0156] The embodiment of the present disclosure also provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, the steps of each embodiment of the base station access authentication method as described in the above embodiments are implemented. To avoid repeated description, they are not repeated here.

[0157] The embodiments of the present disclosure also provide a computer program product, including a computer program. When the computer program is executed by a processor, the steps of each embodiment of the base station access authentication method as described in the above embodiments are implemented. To avoid repeated description, they are not repeated here.

[0158] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0159] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0160] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0161] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A base station access authentication method, characterized in that: Applied to a security gateway, the method comprises: In response to receiving an Internet Key Exchange-Authentication IKE_AUTH request message sent by the base station, acquiring a first media access control MAC address carried by the IKE_AUTH request message, wherein the first MAC address is an encrypted security payload; Encapsulating the first MAC address to obtain an access request message; Sending the access request message to an authentication server for MAC authentication; When a feedback message from the authentication server is received, the feedback message is sent to the base station so that the base station accesses the security gateway, wherein the feedback message is sent when MAC authentication is passed by the authentication server.

2. The method according to claim 1, characterized in that The obtaining the first MAC address carried by the IKE_AUTH request message includes: Parsing the IKE_AUTH request message to determine that the payload type is a target payload of a target type; A data field value of the target payload is obtained as the first MAC address.

3. The method according to claim 1, characterized in that The IKE_AUTH request message is a first IKE_AUTH request message sent by the base station after receiving the security response message fed back by the security gateway, and the access request message obtained by encapsulating based on the first MAC address includes: Get the supplier ID and attribute code; Based on the supplier identifier and the attribute code, construct a supplier custom attribute VSA structure, wherein the VSA structure includes a Value field; Adding the first MAC address to the Value field to obtain a vendor extended attribute; The access request message is generated based on the vendor extended attribute.

4. The method according to claim 3, characterized in that The step of sending the feedback message to the base station upon receiving the feedback message from the authentication server so that the base station can access the security gateway includes: When receiving a feedback message from the authentication server, sending the feedback message as a first IKE_AUTH response message to the base station, wherein the feedback message is an IMSI request message sent by the authentication server when MAC authentication is successful based on the access request message; receiving a second IKE_AUTH request message sent by the base station, where the second IKE_AUTH request message is sent by the base station after receiving the IMSI request message; Obtain the IMSI information and the second MAC address carried in the second IKE_AUTH request message; Generate an access request message based on the IMSI information and the second MAC address; Sending the access request message to the authentication server for MAC authentication; When the challenge access information fed back by the authentication server is received, the challenge access information is sent to the base station as a second IKE_AUTH response message, so that the base station accesses the security gateway.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the feedback message or the challenge access information sent by the authentication server is not received within a preset time period, the number of authentication failures of the base station is accumulated by 1; When the number of authentication failures is greater than a preset value, the base station access is denied.

6. A base station access authentication method, characterized in that: Applied to a base station, the method comprises: Obtain a first media access control MAC address for requesting access to a gateway; adding the first MAC address as notification information in an Internet Key Exchange-Authentication IKE_AUTH request message, wherein the first MAC address is an encrypted security payload; Sending an IKE_AUTH request message carrying the first MAC address to a security gateway, so that the security gateway encapsulates an access request message based on the first MAC address and sends it to an authentication server for MAC authentication; In case of receiving a feedback message sent by the security gateway, accessing the security gateway based on the feedback message, wherein the feedback message is sent by the authentication server when MAC authentication is passed.

7. The method according to claim 6, characterized in that The adding the first MAC address as notification information to the IKE_AUTH request message includes: Determine the last payload of the IKE_AUTH request message; Setting the next payload field of the last payload to a value corresponding to the target type; The first MAC address is added to a data field of a next payload of the last payload.

8. A base station access authentication device, characterized in that: Applied to security gateways, including: A first acquisition module, configured to, in response to receiving an Internet Key Exchange-Authentication IKE_AUTH request message sent by a base station, acquire a first media access control MAC address carried in the IKE_AUTH request message, wherein the first MAC address is an encrypted security payload; A message encapsulation module, used for encapsulating the access request message based on the first MAC address; A first sending module, used to send the access request message to an authentication server for MAC authentication; The second sending module is used to send the feedback message to the base station when receiving the feedback message from the authentication server, so that the base station can access the security gateway, wherein the feedback message is sent when the authentication server passes the MAC authentication.

9. A base station access authentication device, characterized in that: Applied to base stations, including: A second acquisition module, used to acquire a first media access control MAC address for requesting access to the gateway; An information adding module, configured to add the first MAC address as notification information in an Internet Key Exchange-Authentication IKE_AUTH request message, wherein the first MAC address is an encrypted security payload; A third sending module, configured to send an IKE_AUTH request message carrying the first MAC address to a security gateway, so that the security gateway encapsulates an access request message based on the first MAC address and sends it to an authentication server for MAC authentication; The network access module is used to access the security gateway based on the feedback message sent by the security gateway when the feedback message is received, wherein the feedback message is sent by the authentication server when MAC authentication is passed.

10. A security gateway, characterized in that: including a processor and a memory; The processor is used to execute the base station access authentication method as described in any one of claims 1-5 by calling the program or instruction stored in the memory.

11. A base station, characterized in that: including a processor and a memory; The processor is used to execute the base station access authentication method as described in any one of claims 6-7 by calling the program or instruction stored in the memory.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the base station access authentication method according to any one of claims 1 to 7 is implemented.

Images