CN101631309B - Method, device and system for authenticating terminal based on home base station network - Google Patents

Abstract

The invention discloses a method, device and system for authenticating a terminal based on a home base station network, including: generating a random number; sending the random number to the terminal through a home base station access point; receiving the portable authentication sent by the terminal; Authorization response parameters and the request for the random number; check whether the random number carried in the request is the same as the random number sent to the terminal above, and if so, send an authentication request message to the location register or authentication center , starting the terminal authentication process and corresponding equipment and systems. In the present invention, the random number required for terminal authentication is generated by a network side entity with guaranteed security, which prevents an attacker from using a home base station access point to implement an attack on authentication, thereby preventing the attacker from obtaining corresponding communication content.

Description

Method, device and system for terminal authentication based on home base station network

technical field

The present invention relates to the technical field of network communication, in particular to a method, device and system for authenticating a terminal based on a home base station network.

Background technique

Home base station is a small cellular base station, also known as Femto Cell or Home NodeB, which is the cutting-edge technology in the 3G field. The Femto Cell allows residential mobile users to connect to the 3G network through a wired broadband network to obtain enhanced mobile voice, video and data services, and can be seamlessly connected to the operator's original macrocell The user's existing broadband access resources finally provide users with fixed mobile and fixed network convergence (FMC, Fixed Mobile Convergence) services. Through 3G home base stations, a large number of mobile services are absorbed by indoor Femto Cells, which can greatly reduce the number of operators' macro cells, save operators a lot of equipment investment costs and maintenance costs, and can also improve indoor coverage and increase indoor broadband access. Speed, reduce delay, to meet the user experience of various multimedia applications.

See Figure 1, the structure diagram of Femto Cell network, including mobile station/access terminal (MS, MobileStation/AT, Access Terminal), access point, security gateway, macro network, macro network base station controller (BSC, Base Station Controller ) and macro base stations. Femto Cell access points and Femto Cell security gateways are network entities, and Femto Cell completes functions such as base stations and BSCs in the original macro network. FemtoCell accesses the core network of the macro network through a wired network such as asymmetric digital subscriber line (ADSL, Asymmetric Digital Subscriber Line) or cable modem (CM, Cable Modem). Since data and signaling need to pass through an unsafe network, such as an ordinary In the IP network, in order to ensure security, the entity of the Femto Cell security gateway is added, and a secure tunnel is established between the Femto Cell access point and the Femto Cell security gateway to ensure the security of data and signaling. The Femto Cell access point can support the access of different types of terminals, such as 3G network terminals and traditional wireless terminals. In order to ensure the access of MSs of Code Division Multiple Access (CDMA, Code Division Multiple Access) 20001x, the Femto The Cell access point needs to complete various functions of the CDMA2000 1x network, including access authentication.

Referring to Fig. 2, the authentication flowchart of CDMA2000 1x circuit domain in the prior art. Include the following steps:

1. The BSC broadcasts the generated random number (RAND, Random Variable) to the MS on the access control channel.

2. The MS calculates an authentication response parameter (AUTHR, Authentication Response) according to the shared secret key, the RAND and other parameters, and sends an origination message to the BSC.

3. The BSC sends a service request message to a mobile switching center (MSC, Mobile Switching Center), and the message carries the RAND and the AUTHR.

4. The MSC finds that the RAND and the AUTHR are included in the message, so it sends an authentication request message to the Home Location Register or Authentication Center (HLR/AC, Home Location Register/Authentication Center), and the message includes the AUTHR. RAND and the AUTHR.

5. According to the obtained RAND, the HLR/AC calculates the AUTHR using the same method used by the MS to calculate the AUTHR. If the calculation result is the same as the AUTHR received from the MSC, the authentication is successful, indicating that the MS has a valid shared key. Described HLR/AC sends back authentication success message to described MSC, and the encryption key of air interface signaling and voice is carried in the message, namely signaling message encryption key (SENKEY, Signaling Message Encrypting Key) and special-purpose long code mask (PLCM, Private Long Code Mask).

6. The MSC receives the authentication success message, so it sends an air interface resource assignment message to the BSC, and the message carries the SENKEY and PLCM.

7. The BSC saves the SENKEY and PLCM, and sends a channel assignment message to the MS, that is, allocates air interface resources, and the MS establishes an air interface connection with the BSC. The subsequent signaling uses the SENKEY for protection, and the voice uses the The above PLCM is protected.

For the Femto Cell network, since the Femto Cell access point assumes the function of CDMA20001x BSC, it is necessary to generate the random number RAND and send it to the MS, so that the MS performs the subsequent authentication process. However, during the process of creating the present invention, the inventor found that there are at least the following problems in the prior art: there is a certain security risk in the generation of RAND by the Femto Cell access point, because the Femto Cell access point is located in the home or office and is vulnerable to attacks, or exploited by malicious users. For example, if an attacker records the RAND and AUTHR in the original authentication process of a certain MS, and saves the data packets between the MS and the network; then the attacker modifies the program of the Femto Cell access point or invades the Femto Cell Inside the access point, let the Femto Cell access point send an authentication message, and the authentication message carries the previously recorded RAND and AUTHR, then the network side passes the verification and finds that the AUTHR value is correct, so the corresponding information is generated. Token and voice key, and sent to the Femto Cell access point. Since the signaling and voice keys are the same as the previous values, the Femto Cell access point uses the obtained key to decrypt the previously stored communication data packets, thereby knowing the previous communication content. If the content of the MS communication is confidential or very sensitive, this is very disadvantageous to both the user and the communicating party.

Contents of the invention

Embodiments of the present invention provide a method, device, and system for authenticating a terminal based on a home base station network, which prevents an attacker from using a Femto Cell access point to implement an attack on authentication, thereby preventing the attacker from obtaining corresponding communication content.

An embodiment of the present invention provides a method for authenticating a terminal based on a home base station network, including: generating a random number; sending the random number to the terminal through a home base station access point; receiving an authentication response parameter sent by the terminal and the request for the random number; when checking that the random number carried in the request is consistent with the random number sent to the terminal, send an authentication request message to the location register or authentication center, and calculate the authentication If the response parameter is the same as the authentication response parameter carried in the received authentication request message, the authentication is successful.

An embodiment of the present invention also provides a home base station network device, including: a generating unit, configured to generate a random number; a first sending unit, configured to send the random number to a terminal through a home base station access point; a receiving unit, configured to receive The request carrying the authentication response parameter and the random number sent by the terminal; the checking unit, configured to check that the random number carried in the request is the same as the random number sent to the home base station access point, and notify the first Two sending unit: the second sending unit is used to send the authentication request to the location register or the authentication center.

The embodiment of the present invention also provides a system for authenticating a terminal based on a home base station network, including: an entity generating a random number, a terminal, a home base station access point, a home location register, or an authentication center; the entity generating a random number, It is used to generate the random number and send the random number to the home base station access point; the home base station access point is used to broadcast the random number to the terminal; the terminal is used to send the portable authentication Responding to the request for parameters and the random number; the entity that generates the random number receives the request; checks whether the random number carried in the request is the same as the random number sent to the home base station access point, and if so , then send an authentication request to the location register or the authentication center; the location register or the authentication center is used to calculate the authentication response parameters and compare them with the authentication information carried in the received authentication request message When the response parameters are the same, the authentication is successful.

In the above technical solution, the random number required for terminal authentication is generated by the security-guaranteed network-side entity, and the network-side entity sends the random number to the Femto Cell access point, and the network-side entity checks the random number carried in the service request information. The number is the same as the random number sent, and if they are the same, the terminal access process will be started. Since the random number is not generated by the Femto Cell access point, the security is guaranteed, and the attacker is prevented from using the Femto Cell access point to implement an attack on authentication, thereby preventing the attacker from obtaining the corresponding communication content.

Description of drawings

Figure 1 is a structural diagram of the Femto Cell network;

Fig. 2 is the authentication flowchart of CDMA2000 1x circuit domain in the prior art;

Fig. 3 is a flow chart of the method based on the first embodiment of the present invention;

Fig. 4 is a flow chart of a method based on the second embodiment of the present invention;

Fig. 5 is a flow chart of a method based on the third embodiment of the present invention;

Fig. 6 is a flow chart of a method based on the fourth embodiment of the present invention;

Fig. 7 is a flow chart of a method based on the fifth embodiment of the present invention;

Fig. 8a and Fig. 8b are schematic diagrams of authentication access devices based on the embodiment of the present invention;

FIG. 9 is a structural diagram of a network terminal authentication access system according to an embodiment of the present invention;

Fig. 10 is a structural diagram of the first embodiment of the system based on the present invention;

Fig. 11 is a structural diagram of the second embodiment of the system based on the present invention;

Fig. 12 is a structural diagram based on the third embodiment of the system of the present invention;

Fig. 13 is a structural diagram of the fourth embodiment of the system based on the present invention.

Detailed ways

First, the embodiment of the present invention implements a method for authenticating a terminal based on a home base station network, including:

Generate a random number; send the random number to the terminal through the access point of the home base station; receive the request carrying the authentication response parameter and the random number sent by the terminal; check that the random number carried in the request is consistent with the above-mentioned When the random number to the terminal is consistent, send an authentication request message to a location register or an authentication center, calculate the authentication response parameter, and compare it with the authentication response parameter carried in the received authentication request message If they are the same, the authentication is successful.

Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

Embodiment one:

Referring to FIG. 3 , it is a flowchart of a method based on the first embodiment of the present invention.

In the network structure of this embodiment, the external interface of the Femto Cell access point is the BSC and MSC interface, that is, the A1/A1p interface, and the terminal is the MS. In this embodiment, the random number RAND is generated by the Femto Cell security gateway, and this method needs to expand the Internet Key Exchange message (IKE, Internet KeyExchange).

101. In order to ensure the security of the Femto network signaling and user data transmitted by the Femto Cell access point and the Femto Cell security gateway, the Femto Cell access point first negotiates with the Femto Cell security gateway through the IKE protocol for an IPsec security association (SA, Security Association), and use the SA to protect signaling and user data.

102. The Femto Cell access point requests the random number RAND from the Femto Cell security gateway through the IKE message.

103. The Femto Cell security gateway generates RAND, and sends the RAND and the lifetime of the RAND to the Femto Cell access point through an IKE message.

104. The Femto Cell access point broadcasts the RAND to the MS.

105. The MS sends a call initiation message of CDMA2000 1x circuit domain to the Femto Cell access point, and the call initiation message includes the RAND, and all calculated according to the RAND, MS device identifier, and identity identifier described AUTHR.

106. The Femto Cell access point receives the calling message, and initiates a service request message to the MSC. The service request message carries the RAND and AUTHR; the service request message is sent between the FemtoCell access point and the Femto Cell security gateway transmitted within the established IPsec secure tunnel.

107. The Femto Cell security gateway receives the service request message, checks whether the RAND carried in the message is the same as the RAND sent to the Femto Cell access point in step 103, if yes, enters step 108, otherwise discards the RAND Business request message.

108. The Femto Cell security gateway sends the service request message to the MSC.

109. The MSC checks whether the service request message contains the RAND and AUTHR, and if so, sends an authentication request message to the HLR/AC.

110. According to the obtained authentication request, the HLR/AC queries the shared key of the corresponding MS, calculates the AUTHR on the network side, and judges whether it is the same as the received AUTHR. The key of the key, namely SMEKEY and PLCM, sends an authentication response message containing the key to the MSC.

111. After receiving the authentication response message, the MSC sends an assignment message containing the SMEKEY and PLCM to the access point, and forwards it through the Femto Cell security gateway, instructing the Femto Cell access point to allocate an air interface for the MS resource.

112. The Femto Cell security gateway forwards the assignment message to the Femto Cell access point.

113. The Femto Cell access point saves the SMEKEY and PLCM in the assignment message, sends the assignment message to the MS, and allocates air interface resources for the MS.

The IKE message in this embodiment is preferably an IKE information exchange message, and of course other types of IKE messages can also be selected to implement this method.

In step 103 in this embodiment, the Femto Cell security gateway sends the lifetime of RAND to the Femto Cell access point, which can be changed to periodically send RAND to the Femto Cell access point by the Femto Cell security gateway, and the effects of the two are the same Yes, that is, RAND is time-sensitive and is only valid for a certain period of time. This effectively guarantees the security of terminal access, avoids malicious attackers from stealing RAND in the middle, and accesses the network through authentication.

Embodiment two:

Referring to FIG. 4 , it is a flowchart of a method based on the second embodiment of the present invention.

Embodiment 2 is the processing flow when the RAND is different when the step 107 in the embodiment 1 checks, wherein the steps 201-206 are the same as the steps 101-106 in the embodiment 1, and will not be repeated here, only the subsequent processing flow is described. as follows:

207. The Femto Cell security gateway sends the updated RAND to the Femto Cell access point through the IKE message.

208. After receiving the RAND, the Femto Cell access point broadcasts it to the MS. The MS can resend the origination message, using the updated RAND. Its work flow is the same as that of Embodiment 1.

The IKE message in this embodiment is preferably an IKE information exchange message, and of course other types of IKE messages can also be selected to implement this method.

Embodiment three:

Referring to FIG. 5 , it is a flowchart of a method based on the third embodiment of the present invention.

Same as Embodiment 1, in the network structure of this embodiment, the external interface of the Femto Cell access point is the BSC and MSC interface, that is, the A1/A1p interface, and the terminal is the MS. Different from Embodiment 1, in this embodiment, the random number RAND is generated by the MSC, and this method needs to extend A1/A1p.

Step 301 is the same as step 101 in Embodiment 1, and will not be repeated here.

302. The Femto Cell access point requests the MSC for a random number RAND through an A1/A1p message, and the A1/A1p message carries an identifier (FAP ID, Femto Access PointIdentifier) of the Femto Cell access point.

303. The MSC generates a RAND, and sends the RAND and the lifetime of the RAND to the Femto Cell access point through an A1/A1p message.

Steps 304-305 are the same as steps 104-105 in Embodiment 1, and will not be repeated here.

306. The Femto Cell access point receives the calling message, and initiates a service request message to the MSC, and the service request message carries the RAND, AUTHR, and FAP ID; the service request message is sent between the Femto Cell access point and Femto Cell security gateway established IPsec security tunnel transmission.

307. The Femto Cell security gateway sends the service request message to the MSC.

308, MSC receives service request message, finds that RAND, AUHTR, FAPID are included in the message, therefore check whether described RAND is identical with the RAND that sends to this Femto Cell access point in step 103, if yes, then continue execution, Otherwise, the service request message is discarded.

309. The MSC sends an authentication request message to the HLR/AC.

Steps 310-313 are the same as steps 110-113 in Embodiment 1, and will not be repeated here.

The FAP ID may not be carried in the A1/A1p message in this embodiment, and the FAP ID is added to enable the MSC to identify the access point more effectively, because the random number generated by the MSC for each access point is different .

Embodiment four:

Referring to FIG. 6 , it is a flowchart of a method based on the fourth embodiment of the present invention.

Different from Embodiment 1, in the network structure of the present embodiment, the Femto Cell access point is used as a client of the IP Multimedia Subsystem (IMS, IP Multimedia Subsystem) network, and the external interface uses the Session Initiation Protocol (SIP, Session Initiation Protocol) For signaling, a signaling conversion entity is added in the network to complete the conversion of the MAP, Mobile Application Part (MAP, Mobile Application Part) signaling and SIP signaling of the CDMA20001x. Same as Embodiment 1, in this embodiment, the terminal is the MS; the random number RAND is generated by the Femto Cell security gateway.

Step 401 is the same as step 101 in Embodiment 1, and will not be repeated here.

402. The Femto Cell access point accesses the IMS network as an IMS client, that is, the IMS registration process. The Femto Cell access point is registered with the Serving Call Session Control Function (S-CSCF, Serving Call Session Control Function).

403. The Femto Cell access point requests the random number RAND from the Femto Cell security gateway through the IKE message.

404. The Femto Cell security gateway generates RAND, and sends the RAND and the lifetime of the RAND to the Femto Cell access point through an IKE message.

405. The Femto Cell access point broadcasts the RAND to the MS.

406. The MS sends a call initiation message of CDMA2000 1x circuit domain to the Femto Cell access point, where the call initiation message includes the RAND, and all calculated according to the RAND, MS device identifier, and identity identifier described AUTHR.

407. The Femto Cell access point converts the calling message into a SIP message, sends the SIP message to the IMS network, and transmits the SIP message in the IPsec security tunnel established by the Femto Cell access point and the Femto Cell security gateway .

408. The Femto Cell security gateway decrypts the received SIP message, checks whether the RAND of the SIP message is the same as the RAND sent to the Femto Cell access point in step 4, if yes, executes step 409, otherwise discards the message.

409. The Femto Cell security gateway forwards the SIP message, and is routed to the signaling conversion entity.

410. The signaling conversion entity converts the received SIP message into CDMA2000 1x MAP signaling, the signaling includes RAND and AUTHR, and the signaling conversion entity sends an authentication request message to the HLR/AC.

411. The HLR/AC queries the shared key of the corresponding MS according to the obtained authentication request message, calculates the AUTHR on the network side, and judges whether it is the same as the received AUTHR. The required key, namely SMEKEY and PLCM, sends an authentication response message containing the key to the signaling conversion entity.

412. After receiving the authentication response message, the signaling conversion entity sends a SIP message containing the SMEKEY and PLCM to the access point, during which it is forwarded by the security gateway, instructing the Femto Cell access point to assign the MS air interface resources.

413. The Femto Cell security gateway forwards the SIP signaling to the Femto Cell.

414. The Femto Cell access point saves the SMEKEY and PLCM in the SIP signaling, sends the SIP signaling to the MS, and allocates air interface resources for the MS.

The IKE message in this embodiment is preferably an IKE information exchange message, and of course other types of IKE messages can also be selected to implement this method.

Embodiment five:

Referring to FIG. 7 , it is a flowchart of a method based on the fifth embodiment of the present invention.

This embodiment has the same network structure as Embodiment 4, that is, the Femto Cell access point is used as a client of the IMS network, and the external interface uses SIP signaling, and a signaling conversion entity is added in the network to complete the implementation of the CDMA2000 1x Conversion of MAP signaling and SIP signaling; the terminal is the MS. Different from Embodiment 4, in this embodiment, the random number RAND is generated by the signaling conversion entity.

Steps 501-502 are the same as steps 401-402 in Embodiment 4, and will not be repeated here.

503. The Femto Cell access point requests the random number RAND from the signaling conversion entity through a SIP message.

504. The signaling conversion entity generates RAND, and sends the RAND and the lifetime of the RAND to the Femto Cell access point through SIP information.

Steps 505-507 are the same as Steps 405-407 in Embodiment 4, and will not be repeated here.

508. The Femto Cell security gateway decrypts the received SIP message, forwards the SIP message, and routes the SIP message to the signaling conversion entity.

509. The signaling conversion entity checks whether the RAND in the SIP information is the same as the RAND sent to the Femto Cell access point in step 4, if yes, execute step 510, otherwise discard the information.

Steps 510-514 are the same as steps 410-414 in Embodiment 4, and will not be repeated here.

It should be noted that, when the authentication fails, the method described in Embodiment 3 to Embodiment 5 is similar to the subsequent processing flow of Embodiment 2, that is, the updated RAND is sent, and the terminal resends the calling message according to the new RAND .

It should be noted that, in Embodiments 1 to 5, the lifetime of the random number is sent to the FemtoCell access point, that is, the random number has timeliness and is only valid for a period of time, thus ensuring the security of terminal access; It is also possible to periodically send RAND to the Femto Cell access point, and the effects of the two are the same, that is, RAND is time-sensitive and is only valid within a certain period of time. This effectively guarantees the security of terminal access, avoids malicious attackers from stealing RAND in the middle, and accesses the network through authentication. The random number generated by the entity sending the random number can be requested by the Femto Cell access point before sending, and the request of the Femto Cell access point can also include a FAP ID; it can also be sent to the Femto Cell actively Access Point.

An embodiment of the present invention provides a Femto Cell network terminal access device, see FIG. 8a, which is a schematic diagram of an authentication access device according to an embodiment of the present invention.

A generating unit 801, configured to generate a time-sensitive RAND required for terminal authentication;

The first sending unit 802 sends the RAND and the lifetime of the RAND to the Femto Cell access point, and the Femto Cell access point broadcasts the RAND to the terminal; the terminal can be a mobile station, or for the access terminal. The Femto Cell access point first requests the RAND from the first sending unit 802.

The receiving unit 803 receives the service request information carrying the authentication response parameter and the RAND sent by the terminal;

The checking unit 804 checks whether the RAND carried in the service request information is the same as the RAND sent to the FemtoCell access point, and if yes, the authentication is passed;

The second sending unit 805 is configured to send the service request information to the location register or the authentication center.

When the checking unit 804 checks that the RAND carried in the service request information is different from the RAND sent to the Femto Cell access point, the device further includes a discarding unit 806 in FIG. 8b, configured to discard the service request information. This prevents attackers from accessing the Femto Cell network and stealing communication content.

The invention also provides a Femto network terminal access system. Referring to FIG. 9 , it is a structural diagram of a network terminal access system according to an embodiment of the present invention. It includes an entity 901 that generates random numbers, a home location register/authentication center HLR/AC902, a Femto Cell access point 903, and a terminal 904.

The Femto Cell access point 903 requests RAND from the entity 901 that generates RAND;

The entity 901 that generates the random number generates the RAND, sends the lifetime of the RAND and the RAND to the Femto Cell access point 903;

The Femto Cell access point 903 broadcasts the RAND to the terminal 904;

The terminal 904 sends the service request information carrying the authentication response parameter and the RAND to the random number generating entity 901;

The entity 901 that generates the random number checks whether the RAND carried by the service request information is the same as the RAND sent to the Femto Cell access point above; if yes, the authentication is passed, and the service request information is sent to the said location register or authentication authority 902;

The location register or authentication center 902 starts the terminal access process.

The present invention provides a Femto network terminal access system, which is divided into three embodiments according to different entities that generate random numbers, that is, the RAND is generated by a Femto Cell security gateway, an MSC, or a signaling conversion entity.

The first embodiment of the system:

The Femto Cell security gateway generates the RAND, and the system also includes the MSC. Referring to FIG. 10 , it is a structural diagram of the first embodiment of the system based on the present invention. Including Femto Cell Security Gateway 1001, MS1002, Femto Cell Access Point 1003, HLR/AC1004, MSC1005.

The Femto Cell access point 1003 requests RAND from the Femto Cell security gateway 1001;

The Femto Cell security gateway 1001 generates the RAND, sends the RAND and the lifetime of the RAND to the Femto Cell access point 1003;

The Femto Cell access point 1003 broadcasts the RAND to the MS 1002;

The MS 1002 sends the service request information carrying the authentication response parameter and the RAND to the Femto Cell security gateway 1001;

The security gateway 1001 checks whether the RAND carried by the service request information is the same as the RAND sent to the Femto Cell access point 1003 above; if yes, the authentication is passed, and the service request information is sent to the HLR /AC1004;

The HLR/AC 1004 starts the terminal access process.

In the above system, the external interface of the Femto Cell access point is the BSC and MSC interface.

The second embodiment of the system:

Different from the first embodiment of the system, the MSC generates the random number. Referring to FIG. 11 , it is a structural diagram of the second embodiment of the system based on the present invention. Including FemtoCell security gateway 1101, MS 1102, FemtoCell access point 1103, HLR/AC1104, MSC1105.

The function of each part is the same as that of the system embodiment 1, and will not be repeated here; the difference is that the MSC generates the random number, so finally the MSC checks whether the RAND is the same as the one originally sent.

The third embodiment of the system:

In this embodiment, the Femto Cell access point acts as a client of the IMS network, and the Femto Cell security gateway generates random numbers. Referring to FIG. 12 , it is a structural diagram of the third embodiment of the system based on the present invention. Including Femto Cell Security Gateway 1201, MS 1202, Femto Cell Access Point 1203, Signaling Conversion Entity 1204, HLR/AC1205, S-CSCF1206.

The Femto Cell access point 1203, as an IMS client, needs to register with the S-CSCF 1206 to access the IMS network.

The Femto Cell access point 1203 requests RAND from the Femto Cell security gateway 1201.

The Femto Cell security gateway 1201 generates the RAND, and sends the RAND and the lifetime of the RAND to the Femto Cell access point 1203.

The Femto Cell access point 1203 sends the RAND to the MS 1202.

The MS1202 sends a paging response to the Femto Cell access point 1203, and the Femto Cell access point 1203 converts the paging response into a SIP message and sends it to the Femto Cell security gateway 1201.

The Femto Cell security gateway 1201 checks whether the RAND carried in the SIP message is the same as that sent to the Femto Cell access point 1203, if yes, the Femto Cell security gateway 1201 forwards the SIP message, and the SIP message is routed to The signaling conversion entity 1204 .

The signaling conversion entity 1204 sends an authentication request message to the HLR/AC 1205 .

The HLR/AC 1205 checks whether the authentication response parameter carried in the authentication request message is correct, and if yes, sends an authentication response message to the signaling conversion entity 1204 .

The signaling conversion entity 1204 sends a SIP message to the FemtoCell access point 1203 through the FemtoCell security gateway 1201, instructing the FemtoCell access point 1203 to allocate air interface resources for the MS. The signaling conversion entity may be integrated with the home location register.

The fourth embodiment of the system:

This embodiment is different from the third system embodiment in that the random number is generated by the signaling conversion entity. Referring to FIG. 13 , it is a structural diagram of the fourth embodiment of the system based on the present invention. Including Femto Cell Security Gateway 1301, MS

1302, Femto Cell access point 1303, signaling conversion entity 1304, HLR/AC1305, S-CSCF1306.

In this embodiment, the random number is generated by the signaling conversion entity 1304, so the signaling conversion entity 1304 checks whether the random number in the SIP message is the same as the random number sent to the Femto Cell access point 1303. Parts are the same as those in Embodiment 3, and will not be repeated here.

Those of ordinary skill in the art can understand that all or part of the steps in the implementation of the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed , may include the contents of the foregoing communication method implementations. The storage medium referred to here, such as: ROM/RAM, magnetic disk, optical disk, etc.

To sum up, in the method for authenticating a terminal based on the home base station network provided by the embodiment of the present invention, the random number required for terminal authentication is generated by a security-guaranteed network-side entity, and the network-side entity sends The random number is sent to the Femto Cell access point, and the network side entity checks whether the random number carried in the service request information is the same as the random number sent, and if they are the same, the terminal access process is started. Since the random number is not generated by the Femto Cell access point, the security is guaranteed, and the attacker is prevented from using the Femto Cell access point to implement an attack on authentication, thereby preventing the attacker from obtaining the corresponding communication content.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the program can be executed during execution , including the following steps: generating a random number; sending the random number to the terminal through the access point of the home base station; receiving the request carrying the authentication response parameter and the random number sent by the terminal; when checking that the request carries When the random number is consistent with the random number sent to the terminal, send an authentication request message to the location register or authentication center, calculate the authentication response parameter, and compare it with the received authentication request message When the carried authentication response parameters are the same, the authentication is successful.

Claims (11)

1. Based on home base station network terminal is carried out the method for authentication, it is characterized in that, comprising:

   Generate random number;

   By home base station access point described random number is sent to terminal;

   Receive the request of carrying Authentication Response parameter and described random number that described terminal sends;

   When checking that random number that described request is carried is consistent with the above-mentioned described random number that is sent to described terminal, send authentication request message to location register or authentication center, calculate described Authentication Response parameter, when the Authentication Response parameter of relatively carrying with the described authentication request message of receiving is identical, the authentication success;

   The entity that generates described random number is mobile switching centre, and described random number is sent to described home base station access point by interoperability standard A1 or A1p interface message;

   Perhaps, the entity that generates described random number is the home base station network security gateway, and described random number is sent to described home base station access point by the Internet Key Exchange message;

   Perhaps, the entity that generates described random number is the signaling conversion entity, and described random number is sent to described home base station access point by conversation initiating protocol message.
2. 2. method according to claim 1 is characterized in that, the described Authentication Response parameter of described calculating when the Authentication Response parameter of relatively carrying with the described authentication request message of receiving is identical, is finished by described location register or authentication center.
3. 3. method according to claim 1, it is characterized in that, further comprise: when checking that random number that described request is carried is not identical with the above-mentioned described random number that is sent to described terminal, abandon described request, resend described random number to home base station access point.
4. 4. method according to claim 1 is characterized in that, the external interface of described home base station access point is the interface of base station controller and mobile switching centre.
5. 5. method according to claim 1 is characterized in that, described home base station access point is as a client of IP Multimedia System network, and external interface uses conversation initiating protocol message.
6. 6. method according to claim 1 is characterized in that, comprises that also the lifetime that sends described random number is to described home base station access point.
7. 7. method according to claim 1 is characterized in that, comprises that also sending described random number sends described random number to described home base station access point or after receiving the home base station access point request.
8. 8. method according to claim 7 is characterized in that, the random number request that described home base station access point sends comprises the identify label of described home base station access point.
9. 9. a home base station network equipment is characterized in that, this equipment is positioned at described home base station network security gateway, mobile switching centre or signaling conversion entity; Comprise:

   Generation unit is used for generating random number;

   The first transmitting element is used for by home base station access point described random number being sent to terminal;

   Receiving element receives the request of carrying Authentication Response parameter and described random number that described terminal sends;

   Inspection unit be used for to check when random number that described request carries is identical with the above-mentioned described random number that is sent to home base station access point, notifies the second transmitting element;

   The second transmitting element is used for sending authentication request to described location register or authentication center.
10. 10. equipment according to claim 9 is characterized in that, also comprises discarding unit, when checking random number that described request is carried and the above-mentioned described random number that is sent to home base station access point not simultaneously, abandons described service requesting information.
11. 11. based on home base station network terminal is carried out the system of authentication, it is characterized in that, comprising: the entity, terminal, home base station access point, attaching position register or the authentication center that generate random number;

    The entity of described generation random number is used for generating described random number, sends described random number to home base station access point;

    Described home base station access point is used for broadcasting described random number to described terminal;

    Described terminal is used for sending the request of carrying Authentication Response parameter and described random number;

    The entity of described generation random number receives described request; Check that whether random number that described request carries is identical with the above-mentioned described random number that is sent to home base station access point, if so, then sends authentication request extremely described location register or authentication center;

    Described location register or authentication center are used for calculating described Authentication Response parameter, when the Authentication Response parameter of relatively carrying with the described authentication request message of receiving is identical, and the authentication success;

    When the entity of described generation random number was the home base station network security gateway, described system also comprised mobile switching centre, and being used at the described access point of described terminal access process indicating is the terminal distribution interface-free resources;

    Perhaps, when the entity of described generation random number was mobile switching centre, described system also comprised the home base station network security gateway, was used for transmitting described business request information to described mobile switching centre;

    Perhaps, when the entity of described generation random number is the signaling switching entity, also comprise the entity that endpoint registration is provided, be used to terminal to provide to be registered to the service of network.

Images