Communication network authentication method and device, equipment, storage medium and program product

Abstract

The invention provides a communication network authentication method and device, equipment, a storage medium and a program product, and relates to the technical field of network security, the method is applied to a first network element, and the method comprises the following steps: determining a target key identifier according to a first random number and the number of keys of a first module; generating an authentication vector according to the first random number and a target key corresponding to the target key identifier; wherein the authentication vector is used for authentication between the first network element and the first module. According to the invention, when the first network element and the first module carry out authentication authentication, the secret keys used for authentication authentication can be alternated, so that the security risk caused by only one secret key for authentication is reduced, and the security of communication network authentication is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a communication network authentication method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase, and the threat challenges are becoming increasingly severe. Password security is an important basis for information security and can be used to effectively protect the data security of network information systems. Password technology is the core technology and important means for protecting network information systems.

[0003] At present, the network authentication protocol of the communication network, such as the Authentication and Key Agreement (AKA) protocol, is implemented based on the MILENAGE algorithm, which is used to complete the authentication and key agreement between the Universal Subscriber Identity Module (USIM) and the Unified Data Management (UDM). The underlying algorithm of the MILENAGE algorithm is AES-128, and the shared key K between the USIM and the UDM is 128 bits. However, the existing single key authentication has security risks, such as: with the emergence of quantum computers, the cracking ability of encryption algorithms is becoming stronger, and long-term use of 128-bit keys for AKA authentication may be cracked, and if the unique key on the USIM card is cracked, the key cannot be updated according to security needs. SUMMARY

[0004] Embodiments of the present application provide a communication network authentication method, device, equipment, storage medium and program product, which solve the problem of security risks in the existing single key authentication.

[0005] In a first aspect, to achieve the above object, the embodiments of the present application provide a communication network authentication method applied to a first network element, and the method comprises the following steps:

[0006] determining a target key identifier according to a first random number and the number of keys of a first module;

[0007] generating an authentication vector according to a target key corresponding to the first random number and the target key identifier; wherein the authentication vector is used for authentication between the first network element and the first module.

[0008] In a first aspect, to achieve the above object, the embodiments of the present application provide a communication network authentication method applied to a first network element, and the method comprises the following steps:

[0009] obtaining a first key identifier by taking modulo of the first random number and the key quantity;

[0010] determining the target key identifier according to the first key identifier.

[0011] wherein determining the target key identifier according to the first key identifier comprises:

[0012] obtaining a blacklist of security policy, the blacklist comprising disabled key identifiers;

[0013] in a case where the disabled key identifiers do not comprise the first key identifier, determining the target key identifier according to the first key identifier;

[0014] in a case where the disabled key identifiers comprise the first key identifier, updating the first random number, and performing the step of obtaining the first key identifier by taking modulo of the updated first random number and the key quantity until the first key identifier obtained at present does not belong to the disabled key identifiers.

[0015] wherein determining the target key identifier according to the first key identifier comprises:

[0016] obtaining a second key identifier specified by security policy;

[0017] in a case where the first key identifier is identical to the second key identifier, taking the first key identifier as the target key identifier;

[0018] in a case where the first key identifier is different from the second key identifier, updating the first random number according to the second key identifier and the key quantity; wherein a result of taking modulo of the updated first random number and the key quantity is identical to the second key identifier, and taking the second key identifier as the target key identifier.

[0019] wherein determining the target key identifier according to the first key identifier comprises:

[0020] obtaining an identifier interval specified by security policy; wherein a key identifier used in this time authentication of the first network element and the first module is allowed to be located in the identifier interval;

[0021] in a case where the first key identifier is located in the identifier interval, taking the first key identifier as the target key identifier; or,

[0022] in a case where the first key identifier is located outside the identifier interval, randomly selecting a third key identifier in the identifier interval;

[0023] update the first random number according to the third key identity and the key quantity, wherein a result of the updated first random number modulo the key quantity is the same as the third key identity, and the third key identity is taken as the target key identity.

[0024] wherein the third key identity is randomly selected within the identity interval, comprising:

[0025] in a case where the security policy specifies a blacklist, an identity subset is obtained within the identity interval; wherein the blacklist comprises disabled key identities, and the identity subset does not include the disabled key identities;

[0026] the third key identity is randomly selected in the identity subset.

[0027] wherein the method further comprises:

[0028] obtaining first information, wherein the first information comprises the first random number and an authentication token service (AUTS);

[0029] determining the target key identity according to the first random number;

[0030] verifying the first random number and the AUTS for validity and / or legality by using a target key corresponding to the target key identity;

[0031] in a case where the first random number and the AUTS pass the verification, synchronizing a sequence number (SQN) parameter.

[0032] In a second aspect, to achieve the above object, an embodiment of the present application provides a communication network authentication method, applied to a first module, and the method comprises:

[0033] obtaining a first random number and an authentication token (AUTN);

[0034] obtaining a target key identity from key data written at initialization according to the first random number and a key quantity corresponding to the key data;

[0035] verifying the AUTN by using a target key corresponding to the target key identity.

[0036] wherein the target key identity is obtained from the key data according to the first random number and a key quantity corresponding to the key data written at initialization, comprising:

[0037] obtaining the target key identity by taking the first random number modulo the key quantity.

[0038] wherein after the AUTN is verified by using the target key corresponding to the target key identity, the method further comprises:

[0039] In a case that the corresponding target key is identified by using the target key identifier, and the SQN generated by the AUTN is verified to be out of synchronization, the AUTS is calculated according to the target key identifier;

[0040] The AUTS is sent.

[0041] In a third aspect, to achieve the above object, an embodiment of the present application provides a communication network authentication device, applied to a first network element, and the device comprises:

[0042] A first determination module is configured to determine a target key identifier according to a first random number and a number of keys of a first module;

[0043] A generation module is configured to generate an authentication vector according to the first random number and a corresponding target key of the target key identifier; and the authentication vector is used for authentication between the first network element and the first module.

[0044] In a fourth aspect, to achieve the above object, an embodiment of the present application provides a communication network authentication device, applied to a first module, and the device comprises:

[0045] A first acquisition module is configured to acquire a first random number and an authentication token AUTN;

[0046] A second acquisition module is configured to acquire a target key identifier from key data according to the first random number and a number of keys corresponding to the key data written in initialization;

[0047] A verification module is configured to verify the AUTN by using a corresponding target key of the target key identifier.

[0048] In a fifth aspect, to achieve the above object, an embodiment of the present application provides a communication network authentication device, comprising a transceiver, a processor, a memory, and a program stored in the memory and executable on the processor; when the processor executes the program, the communication network authentication method of the first aspect is implemented, or the communication network authentication method of the second aspect is implemented.

[0049] In a sixth aspect, to achieve the above object, an embodiment of the present application provides a readable storage medium, having a program or instruction stored thereon; when the program or instruction is executed by a processor, the communication network authentication method of the first aspect is implemented, or the communication network authentication method of the second aspect is implemented.

[0050] In a seventh aspect, to achieve the above object, embodiments of the present application provide a computer program product comprising computer instructions which, when executed by a processor, implement the communication network authentication method of the first aspect, or implement the communication network authentication method of the second aspect.

[0051] The beneficial effects of the above technical solutions of the present application are as follows:

[0052] In embodiments of the present application, first, the first network element determines a target key identifier according to the first random number and the number of keys of the first module; second, the first network element generates an authentication vector according to the first random number and a target key corresponding to the target key identifier; wherein the authentication vector is used for authentication between the first network element and the first module. In this way, first, the first network element can rotate the key used for authentication when performing authentication with the first module, reducing the security risk brought by using only one key for authentication; second, after the currently used key is cracked, the key can be updated according to security needs, i.e., a new key is selected in the key data; in this way, the security of communication network authentication can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 One of the flowcharts of the communication network authentication method of embodiments of the present application;

[0054] Figure 2 The second flowchart of the communication network authentication method of embodiments of the present application;

[0055] Figure 3 The third flowchart of the communication network authentication method of embodiments of the present application;

[0056] Figure 4 The fourth flowchart of the communication network authentication method of embodiments of the present application;

[0057] Figure 5 One of the structural diagrams of the communication network authentication device of embodiments of the present application;

[0058] Figure 6 The second structural diagram of the communication network authentication device of embodiments of the present application;

[0059] Figure 7 The structural diagram of the communication network authentication equipment of embodiments of the present application. DETAILED DESCRIPTION

[0060] To make the technical problems, technical solutions and advantages of the present application clearer, specific embodiments will be described in detail below with reference to the accompanying drawings.

[0061] It should be understood that the term "one embodiment" or "an embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0062] In various embodiments of the present application, it should be understood that the size of the serial number of the following processes does not mean the order of execution, the execution order of the processes should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0063] In addition, the terms "system" and "network" are often used interchangeably herein.

[0064] In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that the determination of B according to A does not mean that B is determined only according to A, but B can also be determined according to A and / or other information.

[0065] Before the embodiments of the present application are described, the related terms and definitions are first described:

[0066] USIM: save user core key and identifier data.

[0067] Mobile equipment (ME): complete network authentication with USIM.

[0068] User equipment (UE): the collective term of ME and USIM, that is, UE is composed of ME and USIM.

[0069] Security anchor function (SEAF) network element: access network implements authentication of UE.

[0070] Authentication server function (AUSF) network element: home network implements authentication of UE.

[0071] UDM network element / authentication credential repository and processing function (ARPF) network element: store user's subscription information, authentication data, etc.

[0072] Home Network (HN).

[0073] Service Network (SN).

[0074] Symmetric encryption function: C = E(K, M), symmetrically encrypts M using symmetric key K, and E is a quantum-secure symmetric encryption algorithm.

[0075] Symmetric decryption function: M = D(K, C), symmetrically decrypts C using symmetric key K, and D is a quantum-secure symmetric decryption algorithm.

[0076] Asymmetric encryption function: C = E_PUB(PK, M), asymmetrically encrypts M using public key PK, and E_PUB is a quantum-secure public key encryption algorithm.

[0077] Asymmetric decryption function: M = D_PUB(SK, C), asymmetrically decrypts C using private key SK, and D_PUB is a quantum-secure public key decryption algorithm.

[0078] Signature function: S = SIGN(K, M), signs M using private key K.

[0079] Verification function: VERIFY(K, M, S), verifies S using public key K.

[0080] Digest function: H = HASH(M), calculates the digest value of M using a quantum-secure digest algorithm.

[0081] Embodiments of the present application provide a communication network authentication method, applied to a first network element, for example, the first network element is a UDM entity, such as Figure 1 As shown in the figure, the method comprises:

[0082] Step 101, determining a target key identifier according to a first random number and a key quantity of a first module. Here, one, the first random number is a RAND randomly generated by the first network element; two, the first module is, for example, a USIM or a user; three, the key quantity of the first module is the number of keys included in the key data written into the first module when the first module is initialized.

[0083] It should be noted that when the first module is initialized, the relevant department of the operator, such as the management department, writes a plurality of keys into the first module according to the security policy, each key has a corresponding key identifier, such as a key index value or a unique ID value, and on this basis, the relevant department of the operator synchronizes the key data written into the first module to the network operation department, that is, to the first network element, so that the first network element can obtain the synchronized key data of the first module from the local, thereby obtaining the number of keys written into the first module when the first module is initialized.

[0084] Since the first random number is randomly generated data, the target key identifier determined in step 101 based on the randomly generated first random number and the number of keys of the first module is also random, that is, the target key determined in different authentication processes is random, so that different authentication processes of the first network element and the first module can not use a single key, solving the risk of key cracking in the existing single key authentication mode, thereby improving the security of authentication.

[0085] In step 102, an authentication vector is generated according to the first random number and the target key corresponding to the target key identifier; wherein the authentication vector is used for authentication between the first network element and the first module.

[0086] The authentication vector is represented as (Authentication Vector, AV). In 5G AKA, the authentication vector in step 102 is, for example, 5G HE AV=(RAND, AUTN, XRES*, K AUSF ), wherein RAND is the first random number, AUTN is the authentication token, XRES* is the expected response value, K AUSF is the anchor key.

[0087] In the communication network authentication of the embodiment of the application, first, the first network element determines the target key identifier according to the first random number and the number of keys of the first module; second, the first network element generates an authentication vector according to the first random number and the target key corresponding to the target key identifier; wherein the authentication vector is used for authentication between the first network element and the first module. In this way, first, the first network element can rotate the key used for authentication when performing authentication with the first module, reducing the security risk caused by using only one key for authentication; second, the key can be updated according to security needs after the currently used key is cracked, that is, a new key is selected in the key data; in this way, the security of the communication network authentication can be improved.

[0088] As an optional implementation, step 101 includes:

[0089] modularly taking the first random number and the number of keys, a first key identification is obtained; here, the first random number is denoted as RAND, and the number of keys is denoted as n, then the first key identification can be expressed as: KIDi = RAND % n; wherein "%" represents a modulo operation.

[0090] According to the first key identification, the target key identification is determined.

[0091] In the optional implementation, a first specific implementation of determining the target key identification according to the first key identification includes:

[0092] The first key identification is taken as the target key identification.

[0093] In the optional implementation, a second specific implementation of determining the target key identification according to the first key identification includes:

[0094] 1) A blacklist of a security policy is obtained, and the blacklist includes disabled key identifications; here, the disabled key identification is a key identification that cannot be used in this authentication based on the security policy, for example, an identification of a key that has been cracked, an identification of a key that has been leaked, an identification of a key that has security risks, an identification of a key that is too short, an identification of a key used in a previous authentication process adjacent to the first network element and the first module, etc.

[0095] 2-1) In a case where the disabled key identification does not include the first key identification, the target key identification is determined according to the first key identification.

[0096] That is, in a case where the first key identification obtained by modularly taking the first random number and the number of keys is not a key identification that is prohibited to be used in this authentication, that is, the first key identification can be used in this authentication process, the target key identification can be determined based on the first key identification. In a case where there is no other restriction condition, the first key identification is the target key identification, as in the first specific implementation; in a case where there is another relevant restriction condition, the target key identification is finally determined based on the other relevant restriction condition and the first key identification. The specific implementation process in the case where there is another relevant restriction condition will be described later.

[0097] 2-2) in case that the forbidden key identifier includes the first key identifier, updating the first random number, and performing the step of "obtaining a first key identifier by taking modulus of the first random number and the key quantity" based on the updated first random number, until the currently obtained first key identifier does not belong to the forbidden key identifier, at which time the first key identifier is the target key identifier.

[0098] That is, in case that the first key identifier obtained based on taking modulus of the first random number and the key quantity is the identifier of the key forbidden to be used in the current authentication and certification, that is, the first key identifier cannot be used in the current authentication and certification process, the currently generated first random number needs to be updated, that is, the first random number is regenerated, so as to obtain the first key identifier corresponding to the regenerated first random number by using the regenerated first random number and the key quantity (e.g., taking modulus of the two). Until the currently obtained first key identifier can be used in the current authentication and certification process, that is, the currently obtained first key identifier does not belong to the key identifier forbidden to be used in the current authentication and certification, at which time the first key identifier is the target key identifier.

[0099] In the second specific implementation manner, the key blacklist mechanism is introduced based on the security policy, so as to avoid that the target key identifier determined by the first network element corresponds to a key that has been leaked, cracked, has security risks, or has too short length, thereby improving the security of the authentication and certification of the communication network.

[0100] On the basis of the foregoing optional implementation manner and / or the second specific implementation manner, in the foregoing optional implementation manner, the third specific implementation manner of determining the target key identifier according to the first key identifier includes:

[0101] 1) obtaining a second key identifier specified by the security policy; here, the second key identifier is specified by the security policy and corresponds to the identifier of the key that can be used in the current authentication and certification process, and the second key identifier can be one or more. Therefore, this step can also be described as: obtaining a key whitelist corresponding to the current authentication and certification specified by the security policy.

[0102] 2-1) in case that the first key identifier is the same as the second key identifier, taking the first key identifier as the target key identifier. Here, in case that the second key identifier includes multiple identifiers, this step is described as: in case that the first key identifier is any one of the second key identifiers, taking the first key identifier as the target key identifier.

[0103] 2-2) in the case that the first key identity is different from the second key identity, updating the first random number according to the second key identity and the number of keys; wherein the updated first random number and the result of the modulo operation of the number of keys are the same as the second key identity, and the second key identity is taken as the target key identity.

[0104] Here, it should be noted that in the case that the second key identity includes multiple identities, this step is described as: in the case that the first key identity does not belong to any of the second key identities, randomly selecting one identity from the second key identities as the target key identity, and updating the first random number based on the randomly selected key identity.

[0105] Here, taking the case that the second key identity includes one identity as an example, the process of updating the first random number according to the second key identity and the number of keys is described. Wherein the updated first random number is represented as: RAND 更 new = RAND updated before + (n - RAND updated before n + KIDt), wherein KIDt represents the second key identity. Wherein in the case that the second key identity includes multiple identities, KIDt represents a randomly selected identity from the multiple second key identities.

[0106] Further, taking the number of keys as 15 as an example, the updating of the first random number according to the second key identity and the number of keys in the third specific implementation manner is described.

[0107] Suppose the first random number RAND randomly selected by the first network element is 20, then the first key identity KIDi corresponding to the first random number RAND is 20%15 = 5; and the key identity KIDt required to be used according to the security policy is 2, then the new RAND is recalculated as 20 + (15 - 20%15 + 2) = 32. On this basis, the first module calculates KIDi = RAND n = 32%15 = 2 according to the obtained first random number (updated / recomputed first random number), which is consistent with the key identity specified by the first network element.

[0108] In the third specific implementation manner, the security policy specifies the key that can be used for authentication and authorization, which realizes that the network side (specifically the first network element) can rotate the key according to the policy, thereby preventing the security risk caused by using only one key for authentication and authorization, and improving the security of authentication and authorization.

[0109] On the basis of the foregoing optional implementation manner and / or the second specific implementation manner, the fourth specific implementation manner of the foregoing optional implementation manner includes:

[0110] 1) obtaining an identity interval specified by the security policy; wherein the key identity used by the first network element and the first module in the current authentication is located in the identity interval. That is, the identity interval can be the interval in which the key identity allocated to the service corresponding to the current authentication is located.

[0111] 2-1) in the case where the first key identity is located in the identity interval, taking the first key identity as the target key identity; that is, in the case where the first key identity corresponding to the first random number generated by the first network element is located in the identity interval specified by the security policy and capable of being used in the current authentication, the key corresponding to the first key identity can be used in the current authentication, and thus the first key identity is determined as the target key identity used in the current authentication.

[0112] Alternatively,

[0113] 2-2-1) in the case where the first key identity is located outside the identity interval, randomly selecting a third key identity within the identity interval; at this time, it is determined that the key corresponding to the first key identity cannot be used in the current authentication process, and thus a key identity (the third key identity) needs to be selected within the identity interval specified by the security policy and capable of being used in the current authentication as the target key identity used in the current authentication.

[0114] 2-2-2) updating the first random number according to the third key identity and the number of keys, wherein the updated first random number and the result of the modulo operation of the number of keys are the same as the third key identity, and the third key identity is taken as the target key identity.

[0115] Exemplarily, the updated first random number is expressed as:

[0116] RAND 更新后 = RAND 更新前 + (n-RAND 更新前 n+KIDm), wherein KIDm represents the third key identity.

[0117] In the fourth specific implementation mode, by limiting the determined target key identity within a specific identity interval (the identity allocated to the service corresponding to the current authentication), the key isolation between different services in a true sense is realized, the problem that the key in the signaling plane and the user plane is derived based on the key in the first module according to AKA negotiation, and even the key in the service layer is also derived based on the key, and the key isolation between different services has not been realized in a true sense is solved, and the security of the authentication is improved.

[0118] As a more specific implementation, the "randomly selecting the third key identifier within the identifier interval" in the fourth specific implementation above comprises:

[0119] In the case that the security policy specifies a blacklist, obtaining an identifier subset within the identifier interval; wherein the blacklist comprises disabled key identifiers, and the identifier subset does not include the disabled key identifiers; that is, the identifier subset includes identifiers in the identifier interval except the disabled key identifiers in the blacklist.

[0120] Randomly selecting the third key identifier in the identifier subset.

[0121] In the more specific implementation above, by randomly selecting a key identifier outside the blacklist within the identifier interval allocated for a service for authentication, on the one hand, the isolation of keys between different services in the true sense is realized, and on the other hand, the use of leaked, cracked or risky keys is avoided, so that the risk of key cracking is reduced and the security of authentication is improved.

[0122] Further, as an optional implementation, the method further comprises:

[0123] Obtaining first information, wherein the first information comprises the first random number and an authentication token service (AUTS).

[0124] Here, the first network element (such as UDM) in the HN receives a synchronization failure / authentication failure message sent by the SEAF network element in the SN, wherein the synchronization failure / authentication failure message comprises the first information, and the SEAF network element obtains the AUTS based on an authentication failure message sent by the ME (constituting a UE with the first module (such as USIM)), and the ME obtains the AUTS from the first module.

[0125] Determining the target key identifier according to the first random number; this step can be represented by the formula KIDi = RANDn, wherein KIDi represents the target key identifier, RAND represents the first random number, and n represents the number of keys written at the initialization of the first module, i.e., the aforementioned number of keys.

[0126] Verifying the effectiveness and / or legality of the first random number and the AUTS using the target key corresponding to the target key identifier; this step can include: first verifying the effectiveness of the AUTS using the target key, and then verifying the legality of the first random number and the AUTS.

[0127] In the case that the first random number and the AUTS pass the verification, synchronizing a sequence number (SQN) parameter.

[0128] Embodiments of the present application also provide a communication network authentication method, applied to a first module, for example, the first module is a USIM or a user, such as Figure 2 As shown in the figure, the method comprises:

[0129] Step 201, obtaining a first random number and an authentication token (AUTN).

[0130] Here, the transmission process of the first random number and the AUTN is explained: first, an authentication vector is sent from a UDM / AUSF network element (the aforementioned first network element) in the HN to a SEAF network element, wherein the authentication vector comprises the first random number and the AUTN; second, the SEAF network element sends a non-access layer (NAS) message (specifically, an authentication request (Authentication Request)) to the ME (which constitutes a UE together with the first module), wherein the Authentication Request comprises the first random number and the AUTN; third, the ME forwards the first random number and the AUTN in the NAS message to the first module.

[0131] Step 202, obtaining a target key identifier from the key data according to the number of keys corresponding to the key data written at initialization and the first random number.

[0132] Step 203, verifying the AUTN by using a target key corresponding to the target key identifier. This step is used to verify the validity of the AUTN, so as to verify whether the authentication vector associated with the AUTN is the latest vector.

[0133] In the communication network authentication method of the embodiments of the present application, first, a first random number and an authentication token AUTN are obtained; second, a target key identifier is obtained from the key data according to the number of keys corresponding to the key data written at initialization and the first random number; then, the AUTN is verified by using a target key corresponding to the target key identifier. In this way, one of the multiple keys written at initialization is used to implement this authentication, which solves the security risk caused by using only one key for authentication and improves the security of authentication.

[0134] Here, it should be noted that before step 201, the method further comprises:

[0135] The first module is initialized, wherein when the first module is initialized, a related department of an operator writes a plurality of keys into the first module. Specifically, firstly, n keys (K1, K2, …, Kn) are written according to a pre-configured / defined security policy, wherein n>=1 is the maximum number of the written keys; secondly, a corresponding key identification KID is generated for each key, which can be an index value of the key or a unique ID value, for example, the KIDs corresponding to K1, K2, …, Kn are 0, 1, …, n-1.

[0136] As an optional implementation, step 202 comprises:

[0137] The first random number is taken modulo the number of keys to obtain the target key identification. That is, this step can be expressed by the formula KIDi=RAND%n, wherein KIDi represents the target key identification, RAND represents the first random number, and n represents the number of keys written into the first module when the first module is initialized, that is, the aforementioned number of keys.

[0138] Further, as an optional implementation, after step 203, the method further comprises:

[0139] In the case where the target key identification corresponding to the target key is used to verify that the SQN generated by the AUTN is not synchronized, the AUTS is calculated according to the target key identification;

[0140] The AUTS is sent.

[0141] In the above steps, the first module specifically sends the AUTS to the ME, so that the ME sends authentication failure information to the SEAF network element in the SN, wherein the authentication failure information comprises the AUTS; then, the SEAF network element sends the first random number and the AUTS to the UDM / ARPF (the aforementioned first network element) in the HN, so that the first network element can synchronize the sequence number (SQN) parameter in the case where the AUTS is verified to be legal.

[0142] Next, taking 5G AKA, the first network element as UDM / ARPF, and the first module as USIM as an example, the above-mentioned implementation process of the communication network authentication method of the embodiments of the present application is described in combination with the following description of the implementation process of the communication network authentication method of the embodiments of the present application. Figure 3 The implementation process of the communication network authentication method of the above-mentioned embodiments of the present application is described. The implementation process comprises:

[0143] Firstly, the UDM / ARPF in the HN performs the following steps:

[0144] 1) The UDM randomly generates RAND; wherein RAND corresponds to the first random number in the aforementioned step 102;

[0145] 2) Calculate KIDi = RAND%n; where KIDi corresponds to the aforementioned first key identity, n corresponds to the aforementioned number of keys, and "%" denotes modulo;

[0146] 3) CASE 1 (Case One, Optional) If a key blacklist mechanism needs to be introduced, then KIDi blacklist check is performed. That is, if a key blacklist mechanism needs to be introduced according to a security policy: determine whether KIDi is in the blacklist of the key security policy (keys in the blacklist can be in the following states: already leaked, cracked, have security risks, key length is too short, etc.). Wherein, if KIDi is in the blacklist, then jump to step 1) to reselect RAND; if KIDi is not in the blacklist, then perform subsequent step 3) or step 5).

[0147] 4) CASE 2 (Case Two, Optional) If the specified key KIDt is required for this authentication, then a new RAND is recalculated as RAND = RAND + (n - RAND%n + KIDt); where the RAND on the left side of the equal sign represents the first random number after recalculation, and the RAND on the right side of the equal sign represents the first random number before recalculation. That is, if the specified key KIDt is required for this authentication according to the security policy: recalculate a new RAND = RAND + (n - RAND%n + KIDt), and set KIDi = KIDt. For example, the number of keys n = 15; the RAND randomly selected by the UDM is 20, and the specified key KIDi = 2 is required, then a new RAND is recalculated as 20 + (15 - 20%15 + 2) = 32. The USIM calculates KIDi = RAND%n = 32%15 = 2, which is consistent with the key identity specified by the UDM.

[0148] 5) CASE 3 (Case Three, Optional) If the key in the specified interval is required for this authentication, then KIDt is randomly selected in the top interval, a new RAND is recalculated as RAND = RAND + (n - RAND%n + KIDt), and KIDi = KIDt is set. Wherein, the RAND on the left side of the equal sign represents the first random number after recalculation, and the RAND on the right side of the equal sign represents the first random number before recalculation. That is, if the key in the specified interval is required for this authentication according to the security policy (such as the key interval KID_i1-KID_i2 is assigned to service A, then any key in the interval is selected), then KIDt is randomly selected in the specified interval and is not in the key blacklist (such as randomly selecting any KID in KID_i1-KID_i2), and then a new RAND is recalculated as RAND = RAND + (n - RAND%n + KIDt), and KIDi = KIDt is set.

[0149] 6) Select the corresponding key Ki from the key list according to KIDi.

[0150] 7) The 5G HE AV = (RAND, AUTN, XRES, CK, IK) is computed; where CK denotes the cipher key and IK denotes the integrity key.

[0151] Second, the UDM returns the requested 5G HE AV to the AUSF in the Nudm_UEAuthentication_Get Response message and indicates that the 5G HE AV is for 5G AKA. If the Nudm_UEAuthentication_Get request contains a Subscription Concealed Identifier (SUCI), the UDM shall include the Subscription Permanent Identity (SUPI) in the Nudm_UEAuthentication_Get response.

[0152] Third, the AUSF shall temporarily save XRES* and the received SUCI or SUPI. The AUSF can save K AUSF .

[0153] Fourth, the AUSF shall generate a 5G AV based on the 5G HE AV received from the UDM / ARPF. HXRES* is computed from RAND and XRES*, and K AUSF is derived from K SEAF . SEAF HXRES* and K AUSF are then used to replace XRES* and K SEAF in the 5G HE AV, respectively.

[0154] Fifth, the AUSF shall remove K SEAF and send the 5G SE AV (RAND, AUTN, HXRES*) to the SEAF via the Nausf_UEAuthentication_Authenticate response.

[0155] The “second” step to the “fifth” step are not shown in Figure 3 , these steps correspond to Figure 3The UDM in the network sends the RAND and AUTN to the SEAF. In addition, based on the above-mentioned "second" step to the "fifth" step, it can be known that before the execution of the present example, the identity submission process can also be optionally executed, specifically including: when the network side needs the UE to send SUCI for network authentication, first, the UE sends an initial registration request (Initial Registration Request) to the network side, second, the ME reads the SUPI of the USIM, encrypts the SUPI by using an Elliptic Curve Integrated Encryption Scheme (ECIES) based on elliptic curve cryptography to obtain SUCI, and the SUCI is forwarded to the home network UDM through a related network element. After that, the UDM receives the Nudm_Authenticate_Get Request, and if the SUCI is received, the SUPI should be obtained from the SUCI by using ECIES decryption.

[0156] Sixth, the SEAF sends an authentication request to the ME, wherein the authentication request includes the RAND and AUTN; that is, the SEAF should send the RAND and AUTN to the UE through a NAS message (Auth-Req). The message should also include the ngKSI used by the UE and an Access and Mobility management Function (AMF) to identify K AMF and part of the original security context. The message should also include the ABBA parameter.

[0157] Seventh, the ME should forward the RAND and AUTN in the NAS message (Auth-Req) to the first USIM.

[0158] Eighth, after the first USIM receives the RAND and AUTN, the USIM should check whether the AUTN is accepted, so as to verify whether the authentication vector is the latest. If the verification is passed, the first USIM should calculate the response RES and return the RES, CK and IK to the ME. Specifically: first, the USIM calculates the key identifier KIDi = RAND n according to the RAND; second, the first USIM selects the corresponding key Ki from the key list according to the KIDi; third, the first USIM verifies the validity of the AUTN according to the Ki; finally, the first USIM checks whether the MAC is equal to the XMAC and whether the SQN and the like are the latest; if the verification is passed, the USIM should calculate the response RES and return the RES, CK and IK to the ME.

[0159] Ninth, the ME should calculate RES* from the RES. The ME should derive K AUSF from the CK||IK. The ME should derive K AUSF from the KSEAF The ME accessing 5G shall check during authentication if the AMF field "separation bit" of the AUTN is set to 1. The "separation bit" is the 0th bit of the AMF field of the AUTN. Amongst others, this "separation bit" in the AMF of the AUTN can no longer be used for operator specific purposes.

[0160] Tenth, the UE shall return RES* to the SEAF in the NAS message authentication response.

[0161] Eleventh, the SEAF shall compute HRES* from RAND and RES* and compare HRES* and HXRES*. If the two values are identical, the SEAF shall consider the authentication successful from the serving network perspective. If not, the SEAF shall consider the authentication failed and indicate the failure to the AUSF.

[0162] Twelfth, the SEAF shall send the corresponding SUCI or SUPI from the UE to the AUSF via the Nausf_UEAuthentication_Authenticate Request message.

[0163] Thirteenth, upon receiving the Nausf_UEAuthentication_Authenticate Request message containing RES*, the AUSF can verify if the AV has expired. If the AV has expired, the AUSF can consider the authentication unsuccessful from the home network perspective. Amongst others, the AUSF shall compare the received RES* with the stored XRES*. If RES* and XRES* are identical, the AUSF shall consider the authentication successful from the home network perspective.

[0164] Fourteenth, the AUSF shall indicate to the SEAF whether the authentication was successful or not via the Nausf_UEAuthentication_Authenticate Response. If the authentication was successful, the K SEAF shall be sent to the SEAF via the Nausf_UEAuthentication_Authenticate Response. If the AUSF received a SUCI from the SEAF when starting the authentication and the authentication was successful, the AUSF shall also include the SUPI in the Nausf_UEAuthentication_Authenticate Response.

[0165] If the authentication was successful, the SEAF shall take the received key K SEAF from the Nausf_UEAuthentication_Authenticate Response message as the anchor key. The SEAF shall then derive the keys from KSEAF ABBA parameters and SUPI derive K AMF and provide ngKSI and K to AMF AMF .

[0166] If SUCI is used for this authentication, SEAF shall only provide ngKSI and KAMF to AMF after receiving Nausf_UEAuthentication_Authenticate Response message containing SUPI; no communication services will be provided to the UE until the serving network learns the SUPI.

[0167] Wherein, the above-mentioned "twelfth" step to "fourteenth" step is the common step of 5G AKA authentication, and is not embodied in Figure 3 .

[0168] Next, another case (verification failure case) of the above-mentioned "eighth" step in the embodiment and the subsequent process will be described in combination with Figure 4 .

[0169] First, when the first USIM verifies AUTN to generate SQN synchronization problem, 1) AUTS parameters are calculated according to Ki;

[0170] Secondly, the first USIM returns the AUTS parameters to the ME.

[0171] Thirdly, the ME sends the AUTS parameters to the service network SEAF; specifically, the ME sends an authentication failure / synchronization failure message to the SEAF, and the message carries the AUTS parameters.

[0172] After that, the SEAF sends RAND and AUTS to the UDM of the home network.

[0173] Finally, the UDM verifies the legality of AUTS and synchronizes the SQN parameters. Specifically, the UDM calculates the key identifier KIDi = RAND n according to RAND; the UDM selects the corresponding key Ki from the key list according to KIDi; the USIM verifies the validity of AUTS according to Ki; the UDM verifies the legality of (RAND, AUTS) and synchronizes the SQN parameters.

[0174] In the communication network authentication method of the embodiment of the application, the UE (specifically, a first module (such as a USIM)) and the HN (specifically, a first network element (such as a UDM)) perform multi-key authentication based on the transmission of the key identifier of the RAND, so that the network side can perform key rotation or selection according to the policy and the RAND, thereby achieving the following effects: 1. The security risk caused by authentication using a single key is prevented, and the security of AKA authentication is improved; 2. The key can be replaced according to the security policy, and the key can be replaced according to the policy after a key is cracked, thereby achieving risk dispersion; 3. Different key identifiers corresponding to different services are set based on the security policy, and key isolation based on services can be achieved. Different keys can be allocated to different services according to the policy, and the services can be authenticated, key derivation and key replacement independently, thereby achieving true key isolation; 4. The embodiment does not need to modify the MILENAGE algorithm, does not need to modify the AUTN, and has high compatibility; and does not need to modify the service network SN; and 5. The embodiment is compatible with the existing technology, and compared with the original authentication technology, only the first module (such as the USIM) and the first network element (such as the UDM) need to be modified, other network elements and related interfaces do not need to be modified, the modification cost is low, and the compatibility with the original protocol is high.

[0175] The embodiment of the application further provides a communication network authentication device, which is applied to a first network element, such as a UDM. Figure 5 As shown in the figure, the device comprises:

[0176] A first determination module 501 is configured to determine a target key identifier according to a first random number and a key quantity of a first module.

[0177] A generation module 502 is configured to generate an authentication vector according to a target key corresponding to the first random number and the target key identifier; and the authentication vector is used for authentication between the first network element and the first module.

[0178] The first determination module 501 comprises:

[0179] A first acquisition sub-module is configured to obtain a first key identifier by taking the first random number and the key quantity as a modulus.

[0180] A determination sub-module is configured to determine the target key identifier according to the first key identifier.

[0181] The determination sub-module comprises:

[0182] A first acquisition unit is configured to acquire a blacklist of a security policy, and the blacklist comprises disabled key identifiers.

[0183] determining, by a determining unit, the target key identifier according to the first key identifier in a case that the disabled key identifiers do not include the first key identifier;

[0184] updating, by an updating unit, the first random number in a case that the disabled key identifiers include the first key identifier, and performing the step of "obtaining a first key identifier by taking a modulus of the first random number and the key quantity" based on the updated first random number until the first key identifier currently obtained does not belong to the disabled key identifiers.

[0185] The determining sub-module or the determining unit can be specifically used for:

[0186] obtaining a second key identifier specified by a security policy;

[0187] in a case that the first key identifier is the same as the second key identifier, taking the first key identifier as the target key identifier;

[0188] in a case that the first key identifier is different from the second key identifier, updating the first random number according to the second key identifier and the key quantity, wherein a result of taking a modulus of the updated first random number and the key quantity is the same as the second key identifier, and taking the second key identifier as the target key identifier.

[0189] The determining sub-module or the determining unit can be specifically used for:

[0190] obtaining an identifier interval specified by a security policy, wherein a key identifier used by the first network element and the first module in this authentication and certification is allowed to be located in the identifier interval;

[0191] in a case that the first key identifier is located in the identifier interval, taking the first key identifier as the target key identifier; or

[0192] in a case that the first key identifier is located outside the identifier interval, randomly selecting a third key identifier in the identifier interval;

[0193] updating the first random number according to the third key identifier and the key quantity, wherein a result of taking a modulus of the updated first random number and the key quantity is the same as the third key identifier, and taking the third key identifier as the target key identifier.

[0194] The determining sub-module or the determining unit, when used for randomly selecting a third key identifier in the identifier interval, can be specifically used for:

[0195] In a case where the security policy specifies a blacklist, a subset of identities is obtained within the identity interval; wherein the blacklist comprises disabled key identities, and the subset of identities does not comprise the disabled key identities;

[0196] In the subset of identities, the third key identity is randomly selected.

[0197] Further, the apparatus further comprises:

[0198] The first obtaining module is configured to obtain first information, wherein the first information comprises the first random number and an authentication token service (AUTS);

[0199] The second determining module is configured to determine the target key identity according to the first random number;

[0200] The verification module is configured to verify the first random number and the AUTS for validity and / or legality by using a target key corresponding to the target key identity;

[0201] The synchronization module is configured to synchronize a sequence number (SQN) parameter in a case where the first random number and the AUTS pass verification.

[0202] It should be noted that the above communication network authentication apparatus provided by the embodiments of the present application can implement the steps of the above communication network authentication method applied to the first network element, and achieve the same technical effects. Therefore, the same parts and beneficial effects of the method embodiments in the embodiments will not be described in detail.

[0203] The embodiments of the present application also provide a communication network authentication apparatus applied to a first module, as shown in the following table: Figure 6 The apparatus comprises:

[0204] The first obtaining module 601 is configured to obtain a first random number and an authentication token (AUTN);

[0205] The second obtaining module 602 is configured to obtain a target key identity from key data written at initialization according to a key number corresponding to the first random number and the key data;

[0206] The verification module 603 is configured to verify the AUTN by using a target key corresponding to the target key identity.

[0207] The second obtaining module 602 comprises:

[0208] The obtaining submodule is configured to obtain the target key identity by taking the first random number and the key number as a modulus.

[0209] The apparatus further comprises:

[0210] a calculation module, configured to calculate an AUTS according to the target key identifier in a case that the AUTN generated SQN is not synchronized and the target key identifier is used to identify a corresponding target key;

[0211] a sending module, configured to send the AUTS.

[0212] It should be noted that the above communication network authentication device provided by the embodiments of the present application can realize the steps of the above communication network authentication method applied to the first module, and achieve the same technical effects. Therefore, the same parts and beneficial effects of the method embodiments are not described in detail herein.

[0213] The embodiments of the present application also provide a communication network authentication device, which comprises a transceiver 710, a processor 700, a memory 720, and a program stored in the memory 720 and executable on the processor 700; wherein the processor 700 implements the above communication network authentication method applied to the first network element or the first module when executing the program.

[0214] The transceiver 710 is configured to receive and send data under the control of the processor 700.

[0215] In the above communication network authentication method applied to the first module, Figure 7 The bus architecture can comprise any number of interconnecting buses and bridges, and the various circuitry representative of the processor 700 and the memory 720 is linked together by the bus architecture. The bus architecture can also link various other circuitry, such as peripheral devices, voltage regulators, and power management circuitry, which are well known in the art, and therefore, will not be described further. The bus interface provides an interface to the bus architecture. The transceiver 710 can be a plurality of elements, i.e., comprising a transmitter and a receiver, and provides a means for communicating with various other apparatuses over a transmission medium. The processor 700 is responsible for managing the bus architecture and general processing, and the memory 720 can store data used by the processor 700 in performing operations.

[0216] The embodiments of the present application also provide a readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to implement the above communication network authentication method applied to the first network element or the first module, and achieve the same technical effects. To avoid repetition, the same parts and beneficial effects are not described herein.

[0217] The processor is the processor in the communication network authentication device in the above embodiments. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0218] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platforms, and of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. According to such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for executing the methods described in the embodiments of the present application.

[0219] Therefore, the embodiments of the present application also provide a computer program product, which includes computer instructions executed by a processor to implement the communication network authentication method applied to the first network element or applied to the first module as described above, and can achieve the same technical effects. To avoid repetition, this will not be described here.

[0220] In the embodiments of the present application, the modules can be implemented by software to be executed by various types of processors. For example, an identified executable code module can include one or more physical or logical blocks of computer instructions. For example, it can be constructed as an object, a procedure, or a function. However, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different bits, which logically combine together to form a module and achieve the specified purpose of the module.

[0221] In fact, the executable code module can be a single instruction or many instructions, and can even be distributed on multiple different code segments, in different programs, and across multiple memory devices. Similarly, the operation data can be identified within the module, and can be implemented in any appropriate form and organized in any appropriate type of data structure. The operation data can be collected as a single data set, or can be distributed in different locations (including different storage devices), and can exist at least partially as an electronic signal on a system or network.

[0222] When the modules can be implemented in software, hardware, or a combination of software and / or hardware, the modules can be stored in any type of computer-readable medium or memory, for example, in a RAM, ROM, EEPROM, CD-ROM, or hard disk, etc. The computer-readable medium or memory can be a computer program product that comprises a computer program that can be executed by one or more processors to implement the techniques. The computer-readable medium or memory can also include a computer program product that has a plurality of program elements that can be used in carrying out the techniques. The computer-readable medium or memory can also include a plurality of program elements that are downloaded from a website, such as a manufacturer's website.

[0223] The foregoing exemplary embodiments are described with reference made to the drawings which are provided for the purpose of explanation and illustration and are not intended to limit the scope of the application. The exemplary embodiments are described in detail so that those skilled in the art can easily carry out the application. The exemplary embodiments are provided so that the application will be thorough, complete and fully convey the scope of the application to those skilled in the art. In the drawings, the size and relative sizes of components can be exaggerated for clarity. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, components, and / or groups thereof, but do not preclude the presence or addition of one or more other features, integers, steps, operations, components, and / or groups thereof. Unless otherwise indicated, a range of values includes the upper and lower limits of the range and any sub-ranges therebetween.

[0224] The above description is the preferred embodiment of the present application. It is obvious that for those skilled in the art, without departing from the principles of the present application, can make some improvements and refinements, which should be considered as the protection scope of the present application.

Claims

1. A method for authenticating a communication network, characterized by, The method applied to a first network element comprises: determining a target key identifier according to a first random number and a key quantity of a first module; generating an authentication vector according to a target key corresponding to the first random number and the target key identifier; wherein the authentication vector is used for authentication between the first network element and the first module.

2. The method of claim 1, wherein, Determining a target key identifier according to a first random number and a key quantity of a first module comprises: taking modulo of the first random number and the key quantity to obtain a first key identifier; determining the target key identifier according to the first key identifier.

3. The method of claim 2, wherein, Determining the target key identifier according to the first key identifier comprises: obtaining a blacklist of a security policy, wherein the blacklist comprises disabled key identifiers; in a case where the disabled key identifiers do not include the first key identifier, determining the target key identifier according to the first key identifier; in a case where the disabled key identifiers include the first key identifier, updating the first random number, and performing the step of "taking modulo of the first random number and the key quantity to obtain a first key identifier" based on the updated first random number until the first key identifier obtained at present does not belong to the disabled key identifiers.

4. The method according to claim 2 or 3, characterized in that, Determining the target key identifier according to the first key identifier comprises: obtaining a second key identifier specified by a security policy; in a case where the first key identifier is the same as the second key identifier, taking the first key identifier as the target key identifier; in a case where the first key identifier is different from the second key identifier, updating the first random number according to the second key identifier and the key quantity; wherein a result of taking modulo of the updated first random number and the key quantity is the same as the second key identifier, and taking the second key identifier as the target key identifier.

5. The method according to claim 2 or 3, characterized in that, Determining the target key identifier according to the first key identifier comprises: obtaining an identifier interval specified by a security policy; wherein a key identifier used for this time authentication between the first network element and the first module is allowed to be located in the identifier interval; in a case where the first key identifier is located in the identifier interval, taking the first key identifier as the target key identifier; or in a case where the first key identifier is located outside the identifier interval, randomly selecting a third key identifier in the identifier interval; updating the first random number according to the third key identifier and the key quantity, wherein a result of taking modulo of the updated first random number and the key quantity is the same as the third key identifier, and taking the third key identifier as the target key identifier.

6. The method of claim 5, wherein, Randomly selecting a third key identifier in the identifier interval comprises: in a case where the security policy specifies a blacklist, obtaining an identifier subset in the identifier interval; wherein the blacklist comprises disabled key identifiers, and the identifier subset does not include the disabled key identifiers; randomly selecting the third key identifier in the identifier subset.

7. The method of claim 1, wherein, The method further comprises: obtaining first information, the first information comprising the first random number and an authentication token service AUTS; determining the target key identifier according to the first random number; verifying the first random number and the AUTS by using a target key corresponding to the target key identifier; synchronizing a sequence number SQN parameter in case that the first random number and the AUTS are verified successfully.

8. A method for authenticating a communication network, characterized by, The method applied to the first module comprises: obtaining a first random number and an authentication token AUTN; obtaining a target key identifier from key data written at initialization according to a key number corresponding to the first random number and the key data; verifying the AUTN by using a target key corresponding to the target key identifier.

9. The method of claim 8, wherein, The method applied to the first module comprises: obtaining a first random number and an authentication token AUTN; 10. The method of claim 8, wherein, obtaining a target key identifier from key data written at initialization according to a key number corresponding to the first random number and the key data; verifying the AUTN by using a target key corresponding to the target key identifier. The method applied to the first module comprises:

11. A communication network authentication apparatus characterized by comprising: obtaining a first random number and an authentication token AUTN; obtaining a target key identifier from key data written at initialization according to a key number corresponding to the first random number and the key data; verifying the AUTN by using a target key corresponding to the target key identifier.

12. A communication network authentication apparatus characterized by comprising: The method applied to the first module comprises: obtaining a first random number and an authentication token AUTN; obtaining a target key identifier from key data written at initialization according to a key number corresponding to the first random number and the key data; verifying the AUTN by using a target key corresponding to the target key identifier.

13. A communication network authentication device comprising a transceiver, a processor, a memory, and a program stored on the memory and executable on the processor; wherein, The method applied to the first module comprises:

14. A readable storage medium, on which a program or instructions are stored, characterized in that, obtaining a first random number and an authentication token AUTN; 15. A computer program product, characterised in that, obtaining a target key identifier from key data written at initialization according to a key number corresponding to the first random number and the key data; verifying the AUTN by using a target key corresponding to the target key identifier. The processor implements the communication network authentication method in any one of claims 1 to 7 when executing the program, or implements the communication network authentication method in any one of claims 8 to 10. The program or the instruction implements the communication network authentication method in any one of claims 1 to 7 when executed by the processor, or implements the communication network authentication method in any one of claims 8 to 10. The program or the instruction implements the communication network authentication method in any one of claims 1 to 7 when executed by the processor, or implements the communication network authentication method in any one of claims 8 to 10.

Images