CN100466803C - A method for realizing terminal-to-network authentication in a code division multiple access network - Google Patents

Abstract

The invention discloses a method for realizing network authentication by a mobile terminal in a CDMA network. In this method, when the mobile terminal initiates a call, receives a called party, or sends and receives a short message, the mobile terminal generates a random number, then independently initiates a base station query process, and sends a base station query request to the MSC/VLR in the CDMA network through the base station message, and the base station request message carries the random number. The MSC/VLR returns the authentication calculation result obtained according to the random number to the mobile terminal through the base station inquiry response message. The mobile terminal compares the authentication calculation result received from the MSC/VLR with the authentication calculation result obtained by itself based on the random number, and if the two are consistent, it determines that the network is legal; otherwise, it determines that the network is illegal. The invention can realize the authentication of the mobile terminal to the network in the existing CDMA network, thereby greatly improving the security of the mobile terminal.

Description

A method for realizing terminal-to-network authentication in a code division multiple access network

technical field

The invention relates to an authentication technology in a code division multiple access (CDMA) communication system, in particular to a method for realizing terminal-to-network authentication in a CDMA network.

Background technique

Along with the progress of science and technology and the development of society, mobile communication becomes more and more popular, and mobile phone has become an indispensable part in people's daily life and work. Correspondingly, the security of mobile terminals has also attracted more and more attention.

At present, in the CDMA network, in order to ensure the security of the mobile terminal, an authentication technology is proposed. That is, when a mobile terminal accesses the network, the network authenticates the mobile terminal to verify whether the mobile terminal is a legitimate mobile terminal, and the network only provides services to legal mobile terminals. Through this authentication, if an illegal user uses a legitimate user's information to log in to the network, for example, the illegal user steals the International Mobile Subscriber Identity (IMSI) information and Electronic Serial Number (ESN) information of the legal user's User Identity Module (UIM) card , and then burn the information to an illegal UIM card, and use the illegal UIM card to access the network. At this time, the CDMA network will recognize the UIM card as an illegal user card after authentication, and reject the UIM card access, thereby improving the terminal security of legitimate users and protecting the interests of legitimate users.

Existing CDMA networks, such as the network entities involved in the authentication of CDMA IS-95A and CDMA 2000 1X networks in the circuit domain include: Base Station Subsystem (BSS), Mobile Switching Center (MSC)/Visitor Location Register (VLR), Home Location Register (HLR)/Authentication Center (AC), etc. Existing authentication procedures include broadcast authentication, unique inquiry, shared encrypted data (SSD) update, call history count (COUNT) update, etc. In all these authentication processes, most of them are the authentication of the UIM card by the network, and only the terminal/UIM card authenticates the network during the SSD update process. However, this authentication of the terminal/UIM card to the network must be performed during the SSD update process, and the SSD update process is actually controlled and executed by the network. Therefore, in the prior art, there is no strict terminal-to-network authentication. authentication operation.

The direct result of no authentication operation of the terminal to the network is that the security of the mobile terminal is greatly reduced. First of all, illegal personnel can deceive users through a fake network, for example, setting a terminal with increased power as a fake base station, and then shielding the existing CDMA network in a local area, so that the terminals in the area are connected to the fake base station. After these terminals access the fake base station, illegal users can obtain user terminal information and modify user terminal information, so that users cannot use the mobile terminal normally. In addition, illegal users can even send viruses to user terminals. , so as to perform some illegal operations on the user's terminal, causing greater damage to the user.

Moreover, if the user's terminal is lost, since there is no authentication of the terminal to the network, the illegal user who may steal the terminal can use the terminal normally in the network in other regions, which is not conducive to the anti-theft of the terminal, and thus also damages the mobile network. Terminal security.

In view of this, it is an urgent problem to be solved to realize the authentication of the mobile terminal to the network in the CDMA network, especially for military networks or networks with relatively high security requirements.

Contents of the invention

The main purpose of the present invention is to provide a method for implementing mobile terminal authentication on the network in a CDMA network, so as to improve the security of the mobile terminal in the CDMA network.

Above-mentioned purpose of the present invention is achieved by following technical scheme:

A method for realizing mobile terminal network authentication in a CDMA network, at least comprising:

a. When the mobile terminal initiates a calling, receives a called or sends and receives a short message, the mobile terminal generates a random number, then initiates the base station query process, and sends it to the mobile switching center/visitor location register MSC/VLR in the CDMA network through the base station A base station query request message, where the base station request message carries the random number;

b. MSC/VLR returns the authentication calculation result obtained according to the random number to the mobile terminal through the base station inquiry response message;

c. The mobile terminal compares the authentication calculation result received from the MSC/VLR with the authentication calculation result obtained by itself based on the random number. If the two are consistent, it determines that the network is legal; otherwise, it determines that the network is illegal.

Wherein, the authentication calculation result obtained according to the random number is an authentication calculation result obtained by calculating the random number and SSD data.

Preferably, said calculation is a CAVE calculation.

Before the MSC/VLR returns the authentication calculation result to the mobile terminal in step b, it can further include:

MSC/VLR calculates the authentication calculation result according to the random number and the SSD data saved by itself.

Or, before the MSC/VLR returns the authentication calculation result to the mobile terminal in step b, it further includes:

MSC/VLR transparently transmits the random number from the mobile terminal to the home location register/authentication center HLR/AC;

HLR/AC calculates the authentication calculation result according to the random number and the SSD data saved by itself;

HLR/AC returns the authentication calculation result to MSC/VLR.

The method further includes, when the mobile terminal connects to the network, performing an operation in which the mobile terminal generates a random number and then independently initiates a base station inquiry process.

In the method of the present invention, the step of the mobile terminal generating the authentication calculation result according to the random number may be included in step a or step c

The method of the present invention may further include the step of configuring authentication parameters in the mobile terminal. Specifically, configuring the authentication parameters is to configure whether to allow the mobile terminal to authenticate the network, to configure whether to allow the network authentication when accessing the network, to configure whether to allow the network authentication when calling , Configure any one or any combination of whether to allow network authentication parameters when being called, configure whether to allow network authentication parameters when sending and receiving short messages, and configure the maximum number of network authentication failures.

Preferably, after it is determined that the network is illegal, the mobile terminal further includes shutting down, restarting or disconnecting the call.

In the present invention, the mobile terminal generates the random number and compares the authentication calculation result by the mobile terminal program generating the random number and comparing the authentication calculation result, or the user identification module UIM card in the mobile terminal generates the random number and compares the authentication calculation result.

It can be seen from the technical scheme of the present invention that the mobile terminal generates a random number in the present invention, and then sends the random number to the MSC/VLR on the network side. The MSC/VLR at the network side returns the result calculated according to the random number to the mobile terminal. Then the mobile terminal compares whether the result returned by the MSC/VLR is consistent with the calculation result obtained by itself according to the random number. If they are consistent, it determines that the network is legal, otherwise it determines that the network is illegal. In this way, through the authentication process initiated by the mobile terminal, the authentication of the mobile terminal to the network can be realized. Here, the comparison by the mobile terminal may be performed by the mobile terminal program itself, or the mobile terminal may send relevant information to the UIM card, and then the UIM card will perform the comparison.

Since the authentication of the mobile terminal to the network is realized, the present invention can prevent the security problem of mobile terminal data leakage or modification caused by network deception, thereby greatly improving the security of the mobile terminal. Moreover, through the authentication of the current network, the phenomenon that the lost mobile terminal is used by an illegal user in a network in other regions or other networks is avoided, and the mobile terminal is prevented from being stolen from the motive, and the security of the mobile terminal is further improved .

Further, the present invention borrows from the existing terminal query process, and the changes to network equipment are small, so that the network upgrade cost of the application of the present invention is very small, thus facilitating the practical application of the present invention.

Description of drawings

Fig. 1 is the general flowchart of the present invention.

Fig. 2 is an authentication flowchart according to the first embodiment of the present invention.

Fig. 3 is an authentication flowchart according to the second embodiment of the present invention.

Fig. 4 is a flow chart of message interaction of authentication processing when the MS accesses the network.

Fig. 5 is a flow chart of message interaction of authentication processing when the MS performs communication operations.

Detailed ways

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments.

The present invention uses the existing base station inquiry process to realize the authentication of the mobile terminal (MS) to the network, so as to be compatible with the existing communication protocol to the greatest extent, so as to facilitate the practical application of the scheme of the present invention.

According to the present invention, it is necessary to improve the existing CDMA terminal, specifically including requiring the terminal to independently initiate the base station inquiry process in the control channel and the traffic channel, and the terminal to be able to configure various data required for network authentication. For existing base stations, it is required to be able to receive and process independent base station inquiry messages. For the existing HLR/AC, no modification is required.

The overall process of the present invention will be described below with reference to FIG. 1 .

In step 101, the MS generates a random number RANDB, and generates an authentication calculation result MS_AUTHR by using the RANDB and the SSD parameters saved by the MS.

Here, the MS can generate the RANDB through its own random number generator, or can use the authentication random number broadcasted by the mobile communication network as the RANDB. The SSD parameters are saved on the MS during the SSD update process, which is well known to those skilled in the art and will not be described in detail here. The MS can use the CAVE algorithm to obtain MS_AUTHR according to the RANDB and SSD parameters, that is, perform CAVE calculation on the RANDB and SSD parameters to obtain MS_AUTHR.

In step 102, the MS initiates a base station query process, and sends a base station query request message to the MSC/VLR through the base station, and the request message carries RANDB.

In step 103, the MSC/VLR obtains the authentication calculation result AC_AUTHR calculated according to the RANDB and SSD parameters stored on the network side, and then sends it to the MS through the base station inquiry response message. Of course, the AC_AUTHR here is also calculated by CAVE for RANDB and the SSD parameters saved on the network side.

In step 104, the MS compares whether the authentication calculation result AC_AUTHR received from the MSC/VLR is the same as the authentication calculation result MS_AUTHR generated by itself, if yes, in step 105, the MS determines that the network is legal; otherwise, in step 106, the MS determines that the network is illegal .

In this way, by actively initiating the base station inquiry process by the MS, the MS can authenticate the network.

Certainly, in the present invention, the MS_AUTHR may not be calculated according to the random number and SSD parameters in step 101, but in step 104, the MS performs the calculation after receiving the AC_AUTHR from the MSC/VLR, and the same effect can also be achieved . The same is true for the following specific embodiments, which will not be described again in the following.

In addition, the determination by the MS in the present invention may be that the MS program itself generates random numbers, generates authentication results, and performs judgment operations, or may use the UIM card in the MS to generate random numbers and generate authentication results. and make judgments. In the latter case, the UIM card sends the random number to the MSC/VLR and receives the authentication calculation result from the MSC/VLR, which needs to be transparently transmitted through the MS program.

After the MS determines that the network is legal, the MS can normally use the network to make calls, send and receive short messages, and other operations. After the MS determines that the network is illegal, the MS can directly close the terminal, thereby preventing itself from being violated by the illegal network.

In the above step 103, if the MSC/VLR shares SSD data, the MSC/VLR directly calculates AC_AUTHR according to the RANDB and the SSD parameters saved by itself, and its specific processing flow is shown in FIG. 2 . If the MSC/VLR does not share SSD data, the MSC/VLR transparently transmits the base station query request message to the HLR/AC, and then the HLR/AC generates AC_AUTHR, and the MSC/VLR transparently transmits the AC_AUTHR from the HLR/AC to the MS. The processing flow is shown in Figure 3.

Fig. 2 shows the authentication process according to the first embodiment of the present invention, wherein MSC/VLR share SSD data. As shown in FIG. 2, in step 201, the MS generates a random number RANDB, and uses the RANDB and SSD parameters saved by the MS to generate an authentication calculation result MS_AUTHR through CAVE calculation.

In step 202, the MS initiates a base station query process, and sends a base station query request message to the MSC/VLR through the base station, and the request message carries RANDB.

In step 203, after receiving the base station query request message from the MS, the MSC/VLR uses the RANDB carried in the message and the SSD data saved by itself to calculate the authentication calculation result AC_AUTHR through the same CAVE calculation.

In step 204, the MSC/VLR sends the calculated AC_AUTHR to the MS through a base station inquiry response message.

In step 205, the MS compares whether the authentication calculation result AC_AUTHR received from the MSC/VLR is the same as the authentication calculation result MS_AUTHR generated by itself, if yes, in step 206, the MS determines that the network is legal; otherwise, in step 207, the MS determines that the network is illegal .

Fig. 3 shows the authentication process according to the second embodiment of the present invention, wherein MSC/VLR does not share SSD data, that is, MSC/VLR does not save SSD data corresponding to MS. As shown in FIG. 3 , in step 301, the MS generates a random number RANDB, and uses the RANDB and SSD parameters saved by the MS to generate an authentication calculation result MS_AUTHR through CAVE calculation.

In step 302, the MS initiates a base station query process, and sends a base station query request message to the MSC/VLR through the base station, and the request message carries RANDB.

In step 303, after receiving the base station query request message from the MS, the MSC/VLR transparently transmits the message to the HLR/AC.

In step 304, the HLR/AC uses the RANDB carried in the message and the SSD data stored by itself to obtain the authentication calculation result AC_AUTHR through the same CAVE calculation.

In step 305, the HLR/AC sends AC_AUTHR to the MSC/VLR through a base station inquiry response message.

In step 306, the MSC/VLR transparently transmits the base station query response message from the HLR/AC to the MS.

In step 307, the MS compares whether the authentication calculation result AC_AUTHR received from the MSC/VLR is the same as the authentication calculation result MS_AUTHR generated by itself, if yes, in step 308, the MS determines that the network is legal; otherwise, in step 309, the MS determines that the network is illegal .

In actual use, the terminal can initiate network authentication when the MS accesses the network, or the terminal can perform network authentication before the MS initiates a call, receives a called party, or sends and receives short messages. The following will discuss this Describe in detail.

Fig. 4 is a message flow chart of authentication of the network by the terminal when the MS accesses the network, where it is assumed that the MSC/VLR does not share SSD data. As shown in Figure 4, in step 401, after the MS is turned on, it sends a location update request to the MSC/VLR.

In step 402, the MSC/VLR sends a location update request to the HLR/AC.

In step 403, the HLR/AC performs a location update operation, and returns a location update response message to the MSC/VLR.

In step 404, the MSC/VLR returns a location update accept message to the MS.

The above steps 401 to 404 are the same as the existing location update operation, through this operation, the location registration operation of the MS and the authentication of the MS by the network are completed.

Then, in step 405, after receiving the location registration response indicating that the location registration is successful, the MS generates a random number RANDB, and uses RANDB and the SSD parameters saved by itself to generate the authentication calculation result MS_AUTHR through CAVE calculation, and then the MS sends MSC/VLR A base station query request message is sent, and the request message carries a random number RANDB.

In step 406, after receiving the base station query request message from the MS, the MSC/VLR transparently transmits the message to the HLR/AC.

In step 407, the HLR/AC uses the RANDB carried in the message and the SSD data saved by itself to calculate the authentication calculation result AC_AUTHR through the same CAVE, and then sends AC_AUTHR to the MSC/VLR through the base station query response message.

In step 408, the MSC/VLR transparently transmits the base station query response message from the HLR/AC to the MS.

In step 409, the MS compares the authentication calculation result AC_AUTHR received from the MSC/VLR with the authentication calculation result MS_AUTHR generated by itself. If yes, the MS determines that the network is legal; otherwise, the MS determines that the network is illegal.

Fig. 5 is a message flow diagram of the terminal authenticating the network when the MS initiates a call, receives a called party, or sends and receives a short message. Here, it is also assumed that the MSC/VLR does not share SSD data. As shown in Figure 5, in step 501, when the MS initiates a call, receives a call, or sends and receives a short message, it first generates a random number RANDB, and uses RANDB and the SSD parameters saved by itself to generate the authentication calculation result MS_AUTHR through CAVE calculation , and then the MS sends a base station query request to the MSC/VLR, and the request carries a random number RANDB.

When initiating a calling here means before the MS initiates a calling, when receiving a called means that after the MS receives the called page, when sending a short message means before the MS sends a short message, and when receiving a short message means receiving After paging. In addition, the calling and called here include not only the calling and called of the voice service, but also the calling and called of the data service.

In step 502, after receiving the base station query request message from the MS, the MSC/VLR transparently transmits the message to the HLR/AC.

In step 503, the HLR/AC uses the RANDB carried in the message and the SSD data stored by itself to calculate the authentication calculation result AC_AUTHR through the same CAVE, and then sends AC_AUTHR to the MSC/VLR through the base station query response message.

In step 504, the MSC/VLR transparently transmits the base station query response message from the HLR/AC to the MS.

In step 505, the MS compares the authentication calculation result AC_AUTHR received from the MSC/VLR with the authentication calculation result MS_AUTHR generated by itself. message process; otherwise, it is determined that the network is illegal, and the subsequent process of calling, called, and sending and receiving short messages will not be executed.

In the present invention, if it is determined that the network is illegal, the verification operation can be resent, that is, the MS regenerates MS_AUTHR, and then initiates a base station query process to the network side. Of course, the number of repetitions can be set. For example, if the network cannot be successfully authenticated after repeated 3 times, it is determined that the network is illegal, and the next authentication operation will not be performed.

After the final determination that the network is illegal, the MS can shut down the computer, disconnect the call, restart the MS, and so on. Of course, other operations such as alarming can also be performed, which is not limited in the present invention.

In addition, the authentication operation to the network can be set on the MS. For example, it can be set whether to authenticate the network. In this way, after the MS starts up and completes the location registration operation, it first reads the set value to determine whether authentication to the network is set, and if so, executes the processing of the present invention, otherwise directly executes the processing of the prior art.

In addition to setting whether to authenticate the network, you can also set whether to allow network authentication when accessing the network, whether to allow network authentication when calling, whether to allow network authentication when being called, whether to Allows authentication of the network when sending and receiving short messages. In addition, you can also set the maximum number of network authentication failures, and set further operations after network authentication failures, such as shutting down, restarting, or disconnecting the call. All these settings can be provided by the MS program and displayed on the MS screen, and the user can select the setting options displayed on the screen by operating the keyboard, so as to add, delete or modify different settings in the MS.

In addition to initiating the authentication to the network in the situations shown in FIG. 4 and FIG. 5 , it can also be set to be initiated by the user. The user actively initiates authentication to the network at any time by operating the screen, and the MS can feed back the authentication result to the user through the screen display.

It can be understood that the above is only a demonstration of the spirit of the present invention, rather than a limitation.

Claims (11)

1. A method for realizing mobile terminal network authentication in a CDMA network, comprising at least: a. When the mobile terminal initiates a call, receives a called party, or sends and receives a short message, the mobile terminal generates a random number, and then independently initiates a base station query process, through the base station to the mobile switching center/visitor location register MSC/VLR in the CDMA network sending a base station query request message, the base station query request message carrying the random number; b. MSC/VLR returns the authentication calculation result obtained according to the random number to the mobile terminal through the base station inquiry response message; c. The mobile terminal compares the authentication calculation result received from the MSC/VLR with the authentication calculation result obtained by itself based on the random number. If the two are consistent, it determines that the network is legal; otherwise, it determines that the network is illegal. 2. The method according to claim 1, wherein the authentication calculation result obtained according to the random number is an authentication calculation result obtained by calculating the random number and SSD data. 3. The method of claim 2, wherein the calculation is a CAVE calculation. 4. method according to claim 2, it is characterized in that, MSC/VLR in the step b further comprises before authentication calculation result is returned to mobile terminal: MSC/VLR calculates the authentication calculation result according to the random number and the SSD data saved by itself. 5. The method according to claim 2, characterized in that MSC/VLR further includes before the authentication calculation result is returned to the mobile terminal in the step b: MSC/VLR transparently transmits the random number from the mobile terminal to the home location register/authentication center HLR/AC; HLR/AC calculates the authentication calculation result according to the random number and the SSD data saved by itself; HLR/AC returns the authentication calculation result to MSC/VLR. 6. The method according to any one of claims 1 to 5, characterized in that the method further comprises: when the mobile terminal connects to the network, execute the mobile terminal to generate a random number, and then independently initiate the base station query process operate. 7. The method according to any one of claims 1 to 5, further comprising the step of generating the authentication calculation result by the mobile terminal according to the random number in step a or step c. 8. The method according to any one of claims 1 to 5, further comprising the step of configuring authentication parameters in the mobile terminal. 9. The method according to claim 8, wherein the configuration authentication parameter is a parameter for configuring whether to allow the mobile terminal to authenticate the network, a parameter for configuring whether to allow the network to authenticate when accessing the network, Configure whether to allow network authentication parameters when calling, configure whether to allow network authentication parameters when called, configure whether to allow network authentication parameters when sending and receiving short messages, and configure network authentication parameters Any one or any combination of the maximum number of failures. 10. The method according to claim 1, characterized in that, after determining that the network is illegal, the method further comprises shutting down the mobile terminal, restarting it, or disconnecting the call. 11. The method according to claim 1, characterized in that, the random number generated by the mobile terminal and the comparison of the authentication calculation results are generated by the mobile terminal program and the comparison of the authentication calculation results, or by a program in the mobile terminal The UIM card generates random numbers and compares the authentication calculation results.

Images