Network authentication method for supporting multiple groups of authentication secret keys by single USIM (Universal Subscriber Identity Module) card

Abstract

The invention provides a network authentication method for supporting multiple groups of authentication secret keys by a single USIM (Universal Subscriber Identity Module) card, which comprises the following steps of: creating a plurality of transparent EF (Express Format) files on the USIM card, and respectively storing parameters required by network authentication of each device and SQN (Secure Quantum Number) parameters for network authentication of each device; before the USIM card leaves a factory, the authentication data are prefabricated in the USIM card; when the equipment needs to access a network, the equipment and the USIM card carry out authentication, and the USIM card receives a network authentication instruction with an equipment ID; searching authentication data matched with the device ID in the instruction, if the authentication data is found, reading the network authentication data, and calculating the index position, the SQN file and the offset of the current device ID; and executing a Milenage authentication algorithm according to the network authentication data, calculating and outputting an expected response value RES, an encryption key CK and a message integrity key IK, and returning an authentication result with a device ID. According to the invention, network authentication of thousands of groups of equipment can be supported on a single USIM card, the management cost is reduced, and the system expansibility and security are improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a network authentication method in which a single USIM card supports multiple groups of authentication keys. Background Art

[0002] In current communication systems, secure communication between devices and control centers is crucial. In order to ensure that the communication content is not illegally stolen or tampered with, it is usually necessary to establish a secure session between the device and the control center and use the session key to encrypt and decrypt the communication content.

[0003] The USIM card is a smart card used to store user personal information and encryption keys. Thousands of devices need to communicate with the control center. Traditionally, in order to protect user privacy and ensure communication security, the device will first perform two-way authentication with the USIM card (Universal Subscriber Identity Module) before communicating with the control center. After the two-way authentication is successful, the device can obtain the session key from the USIM card, and then use the session key to communicate securely with the control center.

[0004] However, existing USIM card technology has a significant limitation: each USIM card can usually only store one set of user information and keys. This means that if there are thousands of groups of users in a system that need to communicate with the security control center, thousands of USIM cards need to be prepared, each corresponding to one user. This approach not only increases the complexity of managing and distributing USIM cards, but also greatly increases costs, and also has serious limitations in scalability.

[0005] With the increasing number of IoT, large-scale sensor networks, and application scenarios that need to support a large number of users online at the same time, the demand for technology that can efficiently and economically support secure communication for a large number of users has become more urgent. Therefore, developing a technology that can store and manage thousands of sets of user information and keys on a single USIM card while achieving efficient and secure communication has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides a network authentication method in which a single USIM card supports multiple groups of authentication keys, so as to solve the problem in the prior art that a USIM card can only store one group of user information and keys, thereby supporting network authentication of thousands of groups of devices on a single USIM card, reducing management costs, and improving system scalability and security.

[0007] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0008] A network authentication method for supporting multiple groups of authentication keys with a single USIM card, comprising the following steps:

[0009] Create multiple transparent EF files on the USIM card, which are used to store the parameters required for network authentication of each device and the SQN parameters for network authentication of each device;

[0010] Before the USIM card leaves the factory, the authentication data is pre-made into the USIM card and stored according to the predetermined index and offset rules;

[0011] When the device needs to access the network, the device and the USIM card perform authentication and verification. At this time, the USIM card receives the network authentication instruction with the device ID;

[0012] Search for authentication data that matches the device ID in the instruction. If not found, terminate the authentication process. If found, read the network authentication data, calculate the index position of the current device ID, and synchronously calculate the SQN file and offset corresponding to the current device ID.

[0013] Execute the Milenage authentication algorithm according to the network authentication data, call the f function to perform mac comparison, if the comparison fails, terminate the authentication, if the comparison is successful and SQN is within the legal range, calculate and output the expected response value RES, encryption key CK and message integrity key IK, and return the authentication result with the device ID.

[0014] According to a network authentication method for supporting multiple groups of authentication keys on a single USIM card provided by the present invention, multiple transparent EF files are created on the USIM card to store parameters required for network authentication of each device, including:

[0015] Create multiple transparent EF files of size 0x7FFE on the USIM card to store the parameters required for authentication of each device; the data required to be stored for each device ID includes 1 byte of data length, 2 bytes of device ID and 126 bytes of authentication data. Each EF file is used to save 254 sets of data, that is, it supports authentication of 254 devices and USIM cards. By creating at least 16 EF files, the storage of at least 4000 sets of authentication data can be achieved.

[0016] According to a network authentication method for supporting multiple groups of authentication keys on a single USIM card provided by the present invention, multiple transparent EF files are created on the USIM card for storing SQN parameters for network authentication of each device, including:

[0017] Create multiple transparent EF files of size 0x7F80 on the USIM card to store the SQN data of each device during the authentication process; each SQN data occupies 6 bytes, and each device ID needs to save a total of 16 sets of SQN data. Therefore, the data required to be stored for each device ID is 192 bytes. Each EF file is used to save the SQN data of at least 170 devices, which matches the stored authentication data. At least 24 EF files of size 0x7F80 need to be created.

[0018] According to a network authentication method for supporting multiple groups of authentication keys on a single USIM card provided by the present invention, the storage is performed according to a predetermined index and offset rule, including:

[0019] Assign a unique index number to each authentication data set. The starting value of the index number is 1, which corresponds to the starting position of the first file.

[0020] For subsequent authentication data sets, the index position of the next authentication data set is determined by calculating the offset in the EF file corresponding to the previous index and skipping the specified length 0x81;

[0021] Repeat the above steps until all 4000 sets of authentication data are assigned corresponding index numbers, and ensure that these data are correctly prefabricated into multiple transparent EF files of the USIM card.

[0022] According to a network authentication method for supporting multiple groups of authentication keys with a single USIM card provided by the present invention, the calculating of the index position of the current device ID includes:

[0023] Step S41, setting the initial index value Index to 0, and initializing the file counter File_Count to 1, for tracking the file currently being searched;

[0024] Step S42, in the File_Count file, starting from the zero offset of the file, read the first two bytes as the current read ID;

[0025] Step S43, compare the current read ID with the target device ID, if they match, execute step S45; if they do not match, execute step S44;

[0026] Step S44, shift the file pointer to the starting position of the next data, that is, the current position plus 129 bytes, and then increase the index value Index by 1;

[0027] Step S45, checking whether the index value Index has reached or exceeded the upper limit of the number of groups stored in the file 254, if not reached, returning to step S42 to continue searching in the current file; if reached or exceeded, executing step S46;

[0028] Step S46, increase the file counter File_Count by 1, check whether File_Count has exceeded the total number of files 16, if not, return to step S42 to start searching in the next file; if it has exceeded, execute step S47;

[0029] Step S47, recording the current file name File_Name and the current index position Index as the index information of the found target device ID, and ending the search process;

[0030] Step S48: If no matching device ID is found in any file, FALSE is returned to terminate the authentication process.

[0031] According to a network authentication method for supporting multiple authentication keys with a single USIM card provided by the present invention, the calculation of the SQN file and offset corresponding to the current device ID includes:

[0032] According to the found index position Index and the number of groups that each SQN file can store, calculate the SQN file number corresponding to the current device ID. The calculation formula is: SQN file = index / number of groups stored in the SQN file = index / 170. The result is an integer value, which represents the SQN file number starting from zero.

[0033] Calculate the offset of the current device ID in the corresponding SQN file. The calculation formula is: SQN file offset = (index% number of groups stored in the SQN file) * length of each SQN data group = (index% 170) * 192, where % represents the modulo operation, and 192 is the byte length occupied by each group of SQN data.

[0034] According to a network authentication method for a single USIM card supporting multiple groups of authentication keys provided by the present invention, the execution of the Milenage authentication algorithm specifically includes:

[0035] After the USIM card receives the network authentication instruction containing RAND and AUTN parameters, it uses the pre-stored key Ki and the received RAND parameter to calculate the AK value through the f5k function; AK = f5k (RAND);

[0036] The USIM card uses the calculated AK value to decrypt the encrypted SQN in the received AUTN parameter to obtain the original SQN value: SQN = (SQN + AK) + AK;

[0037] The decrypted SQN value, the received RAND value and the AMF value are concatenated in sequence, and then the XMAC value is calculated through the f1k function: XMAC=f1k(SQN||RAND||AMF).

[0038] According to a network authentication method for supporting multiple authentication keys on a single USIM card provided by the present invention, the USIM card compares the calculated XMAC value with the MAC value derived from the AUTN parameter; if the XMAC value is different from the MAC value, the USIM card immediately returns an error message and terminates the authentication process;

[0039] If the XMAC value is the same as the MAC value, the USIM card verifies whether the decrypted SQN parameter is within the preset correct value range; if the SQN parameter does not meet the USIM requirements, the USIM card reports the synchronization failure to the AUTS of the SGSN / VLR and terminates the authentication process;

[0040] If the SQN parameter is within the correct range, the USIM card continues to calculate the RES, CK and IK values ​​using the RAND parameter through the f2k, f3k and f4k functions respectively: RES = f2 k (RAND),CK=f3 k (RAND),IK=f4 k (RAND);

[0041] The calculated RES, encryption key CK and message integrity key IK are returned to the network side as the authentication result.

[0042] According to a network authentication method for a single USIM card supporting multiple groups of authentication keys provided by the present invention, the method further includes a step of dynamically updating authentication data, specifically including:

[0043] Setting authentication data update policies, which include regular updates and / or updates triggered based on security requirements; triggering authentication data update processes when a preset update interval is reached or a security threat is detected;

[0044] Generate new authentication data of keys and algorithm parameters, and securely transmit the generated new authentication data to the USIM card according to the predetermined index and offset rules;

[0045] After receiving the new authentication data, the USIM card verifies and stores it, and updates the relevant index and offset information. After the update is completed, the USIM card uses the new authentication data to perform the network authentication process.

[0046] According to the present invention, a network authentication method for a single USIM card supporting multiple groups of authentication keys also includes a step of optimizing the data storage structure, specifically including:

[0047] Reconstruct multiple transparent EF files stored on the USIM card;

[0048] Design and implement an optimized indexing mechanism that is used to quickly locate authentication data that matches the device ID, reducing data search time;

[0049] Partition or tier storage of EF files based on the access frequency and usage patterns of authentication data, storing frequently used or critical data in areas with faster access speeds;

[0050] An efficient caching strategy is implemented in the USIM card to cache recently accessed authentication data or part of its content to reduce repeated access to EF files.

[0051] It can be seen that compared with the prior art, the present invention has the following beneficial effects:

[0052] 1. By enabling a single USIM card to support network authentication for thousands of devices, the present invention significantly reduces the number of USIM cards used, thereby reducing the cost of card procurement, distribution, management and maintenance. This is particularly economical for communication systems with large-scale user or device access.

[0053] 2. With the rapid development of emerging technologies such as the Internet of Things and the Internet of Vehicles, the number of devices that need to access the communication network has exploded. The present invention enables the system to easily cope with this growth trend without the need to increase the number of USIM cards due to the increase in the number of devices, thereby improving the scalability and flexibility of the system.

[0054] 3. The present invention effectively prevents illegal devices from accessing the communication network and ensures the safe transmission of communication data by realizing two-way authentication between USIM cards and multiple device IDs. At the same time, it supports dynamic updating of authentication data, including keys and algorithm parameters, further enhancing the security protection capability of the system and resisting potential security threats.

[0055] 4. By optimizing the data storage structure and indexing method, the present invention significantly improves the speed of data search and reading, thereby shortening the authentication time. This can significantly improve user experience and system response speed for devices that require frequent network authentication.

[0056] In summary, the present invention significantly reduces management costs, improves system scalability and security, and improves the efficiency of the authentication process by enabling a single USIM card to support network authentication of thousands of groups of devices, which has a positive role in promoting the development of the field of mobile communication technology.

[0057] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 The present invention is a flowchart of an embodiment of a network authentication method in which a single USIM card supports multiple groups of authentication keys.

[0059] Figure 2 It is a schematic diagram of the principle of step S1 in an embodiment of a network authentication method in which a single USIM card supports multiple groups of authentication keys according to the present invention.

[0060] Figure 3 It is a schematic diagram of the principles of calculating the index position, SQN file and offset of the current device ID in an embodiment of a network authentication method in which a single USIM card supports multiple groups of authentication keys of the present invention.

[0061] Figure 4 The present invention discloses a flow chart of network authentication in an embodiment of a network authentication method in which a single USIM card supports multiple groups of authentication keys.

[0062] Figure 5 The present invention discloses a flow chart of a Milenage authentication algorithm in an embodiment of a network authentication method in which a single USIM card supports multiple groups of authentication keys. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0065] See also Figures 1 to 5 This embodiment provides a network authentication method for a single USIM card supporting multiple authentication keys, the method comprising the following steps:

[0066] Step S1, creating multiple transparent EF files on the USIM card, which are used to store the parameters required for network authentication of each device and the SQN parameters for network authentication of each device;

[0067] Step S2, before the USIM card leaves the factory, the authentication data is prefabricated into the USIM card and stored according to a predetermined index and offset rule;

[0068] Step S3, when the device needs to access the network, the device and the USIM card perform authentication, and the USIM card receives the network authentication instruction with the device ID;

[0069] Step S4, searching for authentication data matching the device ID in the instruction, terminating the authentication process if not found, reading the network authentication data if found, calculating the index position of the current device ID, and synchronously calculating the SQN file and offset corresponding to the current device ID;

[0070] Step S5, execute the Milenage authentication algorithm according to the network authentication data, call the f function to perform MAC comparison, if the comparison fails, terminate the authentication, if the comparison is successful and SQN is within the legal range, calculate and output the expected response value RES, encryption key CK and message integrity key IK, and return the authentication result with the device ID.

[0071] like Figure 2 As shown, in the above step S1, multiple transparent EF files are created on the USIM card to store the parameters required for each device to perform network authentication, including:

[0072] Create multiple transparent EF files of size 0x7FFE on the USIM card to store the parameters required for authentication of each device; the data required to be stored for each device ID includes 1 byte of data length, 2 bytes of device ID and 126 bytes of authentication data. Each EF file is used to save 254 sets of data, that is, support 254 devices and USIM cards for authentication. By creating at least 16 EF files, at least 4000 sets of authentication data can be stored. It can be seen that the USIM card creates multiple transparent EF files of size 0x7FFE, which are used to store the parameters required for authentication of each device. The data required to be stored for each device ID is 129 bytes, including 1 byte of data length, 2 bytes of device ID, and 126 bytes of authentication data including authentication parameters such as Key and Opc. Therefore, each EF file created can save 254 sets of data, that is, support 254 devices and USIM cards for authentication. The USIM card currently creates 16 EF files, which can store 4000 sets of authentication data.

[0073] In the above step S1, multiple transparent EF files are created on the USIM card to store the SQN parameters for each device to perform network authentication, including:

[0074] Create multiple transparent EF files of size 0x7F80 on the USIM card to store the SQN data of each device during the authentication process; each SQN data occupies 6 bytes, and each device ID needs to save a total of 16 sets of SQN data, so the data required to be stored for each device ID is 192 bytes, and each EF file is used to save the SQN data of at least 170 devices, matching the stored authentication data, and at least 24 EF files of size 0x7F80 need to be created. It can be seen that the USIM card creates multiple transparent EF files of size 0x7F80 to store the SQN data of each device during the authentication process. Each SQN data is 6 bytes, and each device ID needs to save a total of 16 sets of data, so the data required to be stored for each device ID is 192 bytes, so one file can save the SQN data of 170 devices. As in step 1, 4000 sets of data are stored, and 24 files of size 0x7F80 need to be created.

[0075] Among them, by optimizing the data organization structure of EF files, each file can efficiently store and manage up to 254 sets of device authentication data. Therefore, in the 16 EF files created by the USIM card, a total of 4,000 sets of device authentication data can be stored and managed, improving the data storage density and the efficiency of authentication operations.

[0076] In the above step S2, storage is performed according to a predetermined index and offset rule, including:

[0077] Assign a unique index number to each authentication data set. The starting value of the index number is 1, which corresponds to the starting position of the first file. For subsequent authentication data sets, the index position of the next authentication data set is determined by calculating the offset in the EF file corresponding to the previous index and skipping the specified length 0x81. Repeat the above steps until all 4000 sets of authentication data are assigned corresponding index numbers, and ensure that these data are correctly prefabricated into multiple transparent EF files of the USIM card. It can be seen that the authentication data needs to be prefabricated into the USIM card before the USIM card leaves the factory. The index starts at 1 from the beginning of the first file, and the offset skips the length 0x81, which is the second index, and so on, until the last set of data, which is the 4000th index.

[0078] Among them, by adopting this index and offset storage strategy, not only the efficient organization and access of authentication data on the USIM card is achieved, but also the required data set can be quickly located when accessing a large amount of data, thereby improving the speed of data retrieval and the efficiency of authentication operations.

[0079] In this embodiment, if Figure 3 As shown, the steps of calculating the index position of the current device ID specifically include:

[0080] Step S41, setting the initial index value Index to 0, and initializing the file counter File_Count to 1, for tracking the file currently being searched;

[0081] Step S42, in the File_Count file, starting from the zero offset of the file, read the first two bytes as the current read ID;

[0082] Step S43, compare the current read ID with the target device ID, if they match, execute step S45; if they do not match, execute step S44;

[0083] Step S44, shift the file pointer to the starting position of the next data, that is, the current position plus 129 bytes, and then increase the index value Index by 1;

[0084] Step S45, checking whether the index value Index has reached or exceeded the upper limit of the number of groups stored in the file 254, if not reached, returning to step S42 to continue searching in the current file; if reached or exceeded, executing step S46;

[0085] Step S46, increase the file counter File_Count by 1, check whether File_Count has exceeded the total number of files 16, if not, return to step S42 to start searching in the next file; if it has exceeded, execute step S47;

[0086] Step S47, recording the current file name File_Name and the current index position Index as the index information of the found target device ID, and ending the search process;

[0087] Step S48: If no matching device ID is found in any file, FALSE is returned to terminate the authentication process.

[0088] In this embodiment, the step of calculating the SQN file and offset corresponding to the current device ID specifically includes:

[0089] According to the found index position Index and the number of groups that each SQN file can store, calculate the SQN file number corresponding to the current device ID. The calculation formula is: SQN file = index / number of groups stored in the SQN file = index / 170. The result is an integer value, which represents the SQN file number starting from zero.

[0090] Calculate the offset of the current device ID in the corresponding SQN file. The calculation formula is: SQN file offset = (index% number of groups stored in the SQN file) * length of each SQN data group = (index% 170) * 192, where % represents the modulo operation, and 192 is the byte length occupied by each group of SQN data.

[0091] Specifically, when calculating the index position of the current device ID, start searching from the first file that stores the authentication parameters, and find the last file in total, which is the 16th file. Start searching from the zero offset of the file, read the first two bytes and compare them with the ID. If they are inconsistent, offset to the length of a whole data line, which is 129 bytes. Read the first two bytes and compare them with the ID, and so on, until the number of groups stored in the loop file, which is 254 groups. If it is still not found, continue to search for the next file. If found, record the current file name and offset. Then directly read the parameters needed for authentication. If none of them are found in the end, return FALSE and terminate the authentication. After finding the ID, it is necessary to calculate the Index corresponding to the current ID to calculate the corresponding SQN file and offset. Index = (number of files * number of file groups) + the offset of the group when the ID is found (where the number of files and offset both start from zero)

[0092] When calculating the corresponding SQN file and offset, it is expressed as SQN file = index / number of groups stored in the SQN file = index / 170, and the rounded value is the number of SQN files, starting from 0. Among them, SQN file offset = (index% number of groups stored in the SQN file) * length of each SQN group of data = (index% 170) * 192.

[0093] In the above step S5, if Figure 5 As shown, the Milenage authentication algorithm is executed, including:

[0094] After the USIM card receives the network authentication instruction containing RAND and AUTN parameters, it uses the pre-stored key Ki and the received RAND parameter to calculate the AK value through the f5k function; AK = f5k (RAND);

[0095] The USIM card uses the calculated AK value to decrypt the encrypted SQN in the received AUTN parameter to obtain the original SQN value: SQN = (SQN + AK) + AK;

[0096] The decrypted SQN value, the received RAND value and the AMF value are concatenated in sequence, and then the XMAC value is calculated through the f1k function: XMAC=f1k(SQN||RAND||AMF).

[0097] The USIM card compares the calculated XMAC value with the MAC value derived from the AUTN parameter; if the XMAC value is different from the MAC value, the USIM card immediately returns an error message and terminates the authentication process;

[0098] If the XMAC value is the same as the MAC value, the USIM card verifies whether the decrypted SQN parameter is within the preset correct value range; if the SQN parameter does not meet the USIM requirements, the USIM card reports the synchronization failure to the AUTS of the SGSN / VLR and terminates the authentication process;

[0099] If the SQN parameter is within the correct range, the USIM card continues to calculate the RES, CK and IK values ​​using the RAND parameter through the f2k, f3k and f4k functions respectively: RES = f2 k (RAND),CK=f3 k (RAND),IK=f4 k (RAND);

[0100] The calculated RES, encryption key CK and message integrity key IK are returned to the network side as the authentication result.

[0101] Specifically, after the USIM card receives the network authentication instruction containing RAND and AUTN parameters, the USIM calculates AK=f5k(RAND) and extracts the SQN parameter: SQN=(SQN⊕AK)⊕AK. The USIM calculates XMAC=f1k(SQN||RAND||AMF) and compares it with the MAC derived from AUTN. If they are different, the card returns an error and the authentication process is terminated; if the MAC parameter is correct, the USIM verifies whether the SQN parameter is in the correct value range; if the SQN parameter does not meet the USIM requirements, the synchronization failure is reported to the AUTS of the SGSN / VLR; if the SQN parameter is in the correct range, the USIM calculates RES=f2k(RAND), CK=f3k(RAND), IK=f4k(RAND), and returns the calculation result.

[0102] In this embodiment, the step of dynamically updating the authentication data is also included, specifically including:

[0103] Setting authentication data update policies, which include regular updates and / or updates triggered based on security requirements; triggering authentication data update processes when a preset update interval is reached or a security threat is detected;

[0104] Generate new authentication data of keys and algorithm parameters, and securely transmit the generated new authentication data to the USIM card according to the predetermined index and offset rules;

[0105] After receiving the new authentication data, the USIM card verifies and stores it, and updates the relevant index and offset information. After the update is completed, the USIM card uses the new authentication data to perform the network authentication process.

[0106] In this embodiment, the step of optimizing the data storage structure is also included, specifically including:

[0107] Reconstruct multiple transparent EF files stored on the USIM card;

[0108] Design and implement an optimized indexing mechanism that is used to quickly locate authentication data that matches the device ID, reducing data search time;

[0109] Partition or tier storage of EF files based on the access frequency and usage patterns of authentication data, storing frequently used or critical data in areas with faster access speeds;

[0110] An efficient caching strategy is implemented in the USIM card to cache recently accessed authentication data or part of its content to reduce repeated access to EF files.

[0111] In summary, this embodiment significantly reduces management costs, improves system scalability and security, and improves the efficiency of the authentication process by enabling a single USIM card to support network authentication of thousands of groups of devices, which has a positive role in promoting the development of the field of mobile communication technology.

[0112] Furthermore, by enabling a single USIM card to support network authentication of thousands of devices, this embodiment significantly reduces the number of USIM cards used, thereby reducing the cost of card procurement, distribution, management and maintenance. This is particularly economical for communication systems with large-scale user or device access.

[0113] Furthermore, with the rapid development of emerging technologies such as the Internet of Things and the Internet of Vehicles, the number of devices that need to access the communication network has exploded. This embodiment enables the system to easily cope with this growth trend without adding a large number of USIM cards due to the increase in the number of devices, thereby improving the scalability and flexibility of the system.

[0114] Furthermore, this embodiment effectively prevents illegal devices from accessing the communication network and ensures the secure transmission of communication data by implementing two-way authentication between the USIM card and multiple device IDs. At the same time, it supports dynamic updating of authentication data, including keys and algorithm parameters, further enhancing the security protection capability of the system and resisting potential security threats.

[0115] Furthermore, by optimizing the data storage structure and indexing method, the present invention significantly improves the speed of data search and reading, thereby shortening the authentication time. This can significantly improve user experience and system response speed for devices that require frequent network authentication.

[0116] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above-mentioned embodiments are only preferred embodiments of the present invention and cannot be used to limit the scope of protection of the present invention. Any non-substantial changes and substitutions made by technicians in this field on the basis of the present invention shall fall within the scope of protection required by the present invention.

Claims

1. A network authentication method in which a single USIM card supports multiple sets of authentication keys, characterized in that: The following steps are involved: Create multiple transparent EF files on the USIM card, which are used to store the parameters required for network authentication of each device and the SQN parameters for network authentication of each device; Before the USIM card leaves the factory, the authentication data is pre-made into the USIM card and stored according to the predetermined index and offset rules; When the device needs to access the network, the device and the USIM card perform authentication and verification. At this time, the USIM card receives the network authentication instruction with the device ID; Search for authentication data that matches the device ID in the instruction. If not found, terminate the authentication process. If found, read the network authentication data, calculate the index position of the current device ID, and synchronously calculate the SQN file and offset corresponding to the current device ID. Execute the Milenage authentication algorithm according to the network authentication data, call the f function to perform mac comparison, if the comparison fails, terminate the authentication, if the comparison is successful and SQN is within the legal range, calculate and output the expected response value RES, encryption key CK and message integrity key IK, and return the authentication result with the device ID.

2. The method according to claim 1, characterized in that Create multiple transparent EF files on the USIM card to store the parameters required for network authentication of each device, including: Create multiple transparent EF files of size 0x7FFE on the USIM card to store the parameters required for authentication of each device; the data required to be stored for each device ID includes 1 byte of data length, 2 bytes of device ID and 126 bytes of authentication data. Each EF file is used to save 254 sets of data, that is, it supports authentication of 254 devices and USIM cards. By creating at least 16 EF files, the storage of at least 4000 sets of authentication data can be achieved.

3. The method according to claim 1, characterized in that Create multiple transparent EF files on the USIM card to store the SQN parameters for each device to perform network authentication, including: Create multiple transparent EF files of size 0x7F80 on the USIM card to store the SQN data of each device during the authentication process; each SQN data occupies 6 bytes, and each device ID needs to save a total of 16 sets of SQN data. Therefore, the data required to be stored for each device ID is 192 bytes. Each EF file is used to save the SQN data of at least 170 devices, which matches the stored authentication data. At least 24 EF files of size 0x7F80 need to be created.

4. The method according to claim 3, characterized in that The storing according to the predetermined index and offset rule includes: Assign a unique index number to each authentication data set. The starting value of the index number is 1, which corresponds to the starting position of the first file. For subsequent authentication data sets, the index position of the next authentication data set is determined by calculating the offset in the EF file corresponding to the previous index and skipping the specified length 0x81; Repeat the above steps until all 4000 sets of authentication data are assigned corresponding index numbers, and ensure that these data are correctly prefabricated into multiple transparent EF files of the USIM card.

5. The method according to claim 1, characterized in that The step of calculating the index position of the current device ID includes: Step S41, setting the initial index value Index to 0, and initializing the file counter File_Count to 1, for tracking the file currently being searched; Step S42, in the File_Count file, starting from the zero offset of the file, read the first two bytes as the current read ID; Step S43, compare the current read ID with the target device ID, if they match, execute step S45; if they do not match, execute step S44; Step S44, shift the file pointer to the starting position of the next data, that is, the current position plus 129 bytes, and then increase the index value Index by 1; Step S45, checking whether the index value Index has reached or exceeded the upper limit of the number of groups stored in the file 254, if not reached, returning to step S42 to continue searching in the current file; if reached or exceeded, executing step S46; Step S46, increase the file counter File_Count by 1, check whether File_Count has exceeded the total number of files 16, if not, return to step S42 to start searching in the next file; if it has exceeded, execute step S47; Step S47, recording the current file name File_Name and the current index position Index as the index information of the found target device ID, and ending the search process; Step S48: If no matching device ID is found in any file, FALSE is returned to terminate the authentication process.

6. The method according to claim 5, characterized in that The calculation of the SQN file and offset corresponding to the current device ID includes: According to the found index position Index and the number of groups that each SQN file can store, calculate the SQN file number corresponding to the current device ID. The calculation formula is: SQN file = index / number of groups stored in the SQN file = index / 170. The result is an integer value, which represents the SQN file number starting from zero. Calculate the offset of the current device ID in the corresponding SQN file. The calculation formula is: SQN file offset = (index% number of groups stored in the SQN file) * length of each SQN data group = (index% 170) * 192, where % represents the modulo operation, and 192 is the byte length occupied by each group of SQN data.

7. The method according to any one of claims 1 to 6, characterized in that: The execution of the Milenage authentication algorithm specifically includes: After the USIM card receives the network authentication instruction containing RAND and AUTN parameters, it uses the pre-stored key Ki and the received RAND parameter to calculate the AK value through the f5k function; AK = f5k (RAND); The USIM card uses the calculated AK value to decrypt the encrypted SQN in the received AUTN parameter to obtain the original SQN value: SQN = (SQN + AK) + AK; The decrypted SQN value, the received RAND value and the AMF value are concatenated in sequence, and then the XMAC value is calculated through the f1k function: XMAC=f1k(SQN||RAND||AMF).

8. The method according to claim 7, characterized in that: The USIM card compares the calculated XMAC value with the MAC value derived from the AUTN parameter; if the XMAC value is different from the MAC value, the USIM card immediately returns an error message and terminates the authentication process; If the XMAC value is the same as the MAC value, the USIM card verifies whether the decrypted SQN parameter is within the preset correct value range; if the SQN parameter does not meet the USIM requirements, the USIM card reports the synchronization failure to the AUTS of the SGSN / VLR and terminates the authentication process; If the SQN parameter is within the correct range, the USIM card continues to calculate the RES, CK and IK values ​​using the RAND parameter through the f2k, f3k and f4k functions respectively: RES = f2 k (RAND),CK=f3 k (RAND),IK=f4 k (RAND); The calculated RES, encryption key CK and message integrity key IK are returned to the network side as the authentication result.

9. The method according to any one of claims 1 to 8, characterized in that: The step of dynamically updating the authentication data is also included, specifically including: Setting authentication data update policies, which include regular updates and / or updates triggered based on security requirements; triggering authentication data update processes when a preset update interval is reached or a security threat is detected; Generate new authentication data of keys and algorithm parameters, and securely transmit the generated new authentication data to the USIM card according to the predetermined index and offset rules; After receiving the new authentication data, the USIM card verifies and stores it, and updates the relevant index and offset information. After the update is completed, the USIM card uses the new authentication data to perform the network authentication process.

10. The method according to any one of claims 1 to 8, characterized in that: It also includes steps to optimize the data storage structure, including: Reconstruct multiple transparent EF files stored on the USIM card; Design and implement an optimized indexing mechanism that is used to quickly locate authentication data that matches the device ID, reducing data search time; Partition or tier storage of EF files based on the access frequency and usage patterns of authentication data, storing frequently used or critical data in areas with faster access speeds; An efficient caching strategy is implemented in the USIM card to cache recently accessed authentication data or part of its content to reduce repeated access to EF files.

Images