CN114554489A - An authentication method and related equipment - Google Patents

Abstract

The application provides an authentication method and related equipment. First, the network device receives a session request sent by the terminal device on an uplink common channel, and the network device can confirm that the terminal device passes authentication according to the session request. Then, the network device sends a session response to the terminal device on the downlink common channel, wherein the session response is used for indicating the terminal device to authenticate the network device. Under the scene that the RRC connection is not established between the terminal equipment and the network equipment, the information required by the authentication can be transmitted between the terminal equipment and the network equipment through a common channel, and the authentication between the terminal equipment and the network equipment is further realized.

Description

An authentication method and related equipment

technical field

The embodiments of the present application relate to the field of communications, and in particular, to an authentication method and related devices.

Background technique

The protocol standard of the fifth generation cellular mobile communication system formulated by the third generation partnership project (3GPP) standard organization, compared with the long term evolution (LTE) system, the new radio (New Radio, NR) ) system supports larger transmission bandwidth, more transceiver antenna arrays, higher transmission rate and more flexible scheduling mechanism with smaller granularity. The above characteristics of NR system provide more applicable scope.

Network security is an important function in the fifth generation mobile communication technology (5th generation, 5G). For the process of radio resource control (RRC) connection in the 2C scenario, 5G defines a unique authentication and key agreement (AKA) in 5G, and two-way authentication is performed through 5G AKA. and data encryption. Two-way authentication means that the network device authenticates the terminal device, and the terminal device also authenticates the network device.

However, in some scenarios, such as 2B scenarios, in order to reduce the power consumption on the terminal device side, RRC connection is usually not required between the terminal device and the network device. For scenarios without RRC connection, authentication between the terminal device and the network device cannot be performed. right.

SUMMARY OF THE INVENTION

The present application provides an authentication method and related equipment. In the scenario where no RRC connection is established between the terminal equipment and the network equipment, the information required for authentication can be transmitted between the terminal equipment and the network equipment through a common channel, and further Realize authentication between terminal equipment and network equipment.

A first aspect of the present application provides an authentication method, in which: a network device receives a session request sent by a terminal device on an uplink common channel, where the session request is used to request the network device to authenticate the terminal device ; the network device confirms that the terminal device has passed the authentication according to the session request; the network device sends a session response to the terminal device on the downlink common channel, and the session response is used to instruct the terminal device to Describe the network device authentication.

The present application provides an authentication method. First, the network device receives the session request sent by the terminal device on the uplink common channel, and the network device can confirm that the terminal device has passed the authentication according to the session request. Then, the network device sends a session response to the terminal device on the downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device. In a scenario where no RRC connection is established between the terminal device and the network device, the terminal device and the network device can transmit information required for authentication through a common channel, thereby realizing authentication between the terminal device and the network device.

In a possible implementation manner of the first aspect, the session request includes a user hidden identifier SUCI and a first response parameter.

In this possible implementation manner, the types of parameters that may be included in the session request are provided, which improves the implementability of the solution.

In a possible implementation manner of the first aspect, the network device includes an access and mobility management function AMF and an authentication service function AUSF; the network device confirms that the terminal device has passed the authentication according to the session request , including: the AMF sends a first authentication request to the AUSF, where the first authentication request includes the SUCI, the first response parameter, and the first random parameter received by the terminal device; the AUSF Confirm that the terminal device has passed the authentication according to the first authentication request; the AUSF sends a first authentication response to the AMF, where the first authentication response includes a second random parameter, a second response parameter, an authentication The right token AUTN and the security anchor function key Kseaf; the AMF confirms that the terminal device has passed the authentication according to the first authentication response.

In this possible implementation manner, the network device uses a two-step method to authenticate the terminal device, embeds the authentication process into the session establishment process, and uses a pair of messages used by the session establishment over the air interface to complete the authentication and exchange information. less, the authentication process is simple, and it is more conducive to the power saving of terminal equipment.

In a possible implementation manner of the first aspect, the network device includes a unified data management function UDM, and the AUSF confirms that the terminal device has passed the authentication according to the first authentication request, including: the AUSF according to The first authentication request sends first request information to the UDM, where the first request information includes a first random parameter and SUCI, and the first request information is used to instruct the UDM to send authentication to the AUSF vector; the AUSF receives the authentication vector sent by the UDM, and the authentication vector includes the second random parameter, the third response parameter, the encryption key CK, the integrity key IK, and the AUTN; The AUSF determines that the terminal device has passed the authentication according to the authentication vector.

In this possible implementation manner, the network device uses a two-step method to authenticate the terminal device, embeds the authentication process into the session establishment process, and uses a pair of messages used by the session establishment over the air interface to complete the authentication and exchange information. less, the authentication process is simple, and it is more conducive to the power saving of terminal equipment.

In a possible implementation manner of the first aspect, the session response includes the second random parameter, the AUTN, and configuration information, where the configuration information is used to instruct the terminal device to configure a session between the network device.

In this possible implementation manner, the types of parameters that may be included in the session response are provided, which improves the implementability of the solution.

In a possible implementation manner of the first aspect, the session request includes the SUCI.

In this possible implementation manner, the types of parameters that may be included in the session request are provided, which improves the implementability of the solution.

In a possible implementation manner of the first aspect, confirming, by the network device, that the terminal device has passed the authentication according to the session request includes: the network device sending a second message to the terminal device according to the session request. an authentication request, where the second authentication request is used to instruct the terminal device to authenticate the network device; the network device receives the second authentication response sent by the terminal device; The authentication response confirms that the terminal device has passed the authentication.

In this possible implementation manner, the authentication process between the terminal device and the network device can be implemented only by simply modifying or not modifying the algorithms or processes of the existing UDM and AUSF. The changes to the existing network equipment are small, and the impact on the 2C network is small.

A second aspect of the present application provides an authentication method, in which: a terminal device sends a session request to a network device on an uplink common channel, where the session request is used to request the network device to authenticate the terminal device; The terminal device receives a session response sent by the network device on the downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device.

The present application provides an authentication method. In the scenario where no RRC connection is established between the terminal device and the network device, the terminal device and the network device can transmit the information required for authentication through a common channel, thereby realizing the terminal device and the network device. Authentication with network devices.

In a possible implementation manner of the second aspect, the session response includes configuration information, where the configuration information is used to instruct the terminal device to configure a session between the network device.

In a possible implementation manner of the second aspect, the session response further includes an authentication parameter, and the method further includes: the terminal device authenticates the network device according to the authentication parameter.

A third aspect of the present application provides a network device, the network device includes a processor, the processor is coupled with a memory, the memory is used for storing computer programs or instructions, and the processor is used for executing the memory in the memory. A computer program or instructions to cause the method of the first aspect or any possible implementation of the first aspect to be performed.

A fourth aspect of the present application provides a terminal device, the device includes a processor, the processor is coupled with a memory, the memory is used for storing computer programs or instructions, and the processor is used for executing the computer in the memory. Programs or instructions to cause the method of the second aspect or any possible implementation of the second aspect to be performed.

A fifth aspect of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a program, and the program causes the method in the first aspect or any possible implementation manner of the first aspect to be executed.

A sixth aspect of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a program, and the program causes the method in the second aspect or any possible implementation manner of the second aspect to be executed.

A seventh aspect of the present application provides a computer program product that stores one or more computer-executable instructions, which, when the computer-executable instructions are executed by the processor, enable the first aspect or any one of the possible implementations of the first aspect method is executed.

An eighth aspect of the present application provides a computer program product that stores one or more computer-executable instructions. When the computer-executable instructions are executed by the processor, the second aspect or any one of the possible implementation manners of the second aspect is enabled. method is executed.

A ninth aspect of the present application provides a chip system, where the chip system includes a processor for supporting a terminal device or a network device to implement the functions involved in the above aspects, such as sending or processing the data involved in the above method and/or information. In a possible design, the chip system further includes a memory for storing necessary program instructions and data. The chip system may be composed of chips, or may include chips and other discrete devices.

As can be seen from the above technical solutions, the embodiments of the present application have the following advantages:

The present application provides an authentication method and related equipment. First, the network device receives the session request sent by the terminal device on the uplink common channel, and the network device can confirm that the terminal device has passed the authentication according to the session request. Then, the network device sends a session response to the terminal device on the downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device. In a scenario where no RRC connection is established between the terminal device and the network device, the terminal device and the network device can transmit information required for authentication through a common channel, thereby realizing authentication between the terminal device and the network device.

Description of drawings

1 is a schematic diagram of an embodiment of an RRC connection-based authentication method provided by the present application;

2 is a schematic diagram of an application scenario of the authentication system provided by the present application;

3 is a schematic diagram of an embodiment of an authentication method provided by the present application;

4 is a schematic diagram of another embodiment of the authentication method provided by the present application;

5 is a schematic diagram of another embodiment of the authentication method provided by the present application;

6 is a schematic structural diagram of a network device provided by the present application;

7 is a schematic structural diagram of a terminal device provided by the present application;

8 is a schematic structural diagram of a communication device provided by the present application;

FIG. 9 is another schematic structural diagram of the communication device provided by the present application.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by those skilled in the art fall within the protection scope of the present invention.

The terms "first", "second", "third", "fourth", etc. (if present) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances such that the embodiments described herein can be practiced in sequences other than those illustrated or described herein.

In the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as "exemplary" or "such as" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present the related concepts in a specific manner to facilitate understanding.

In this application, "and/or" is only an association relationship to describe associated objects, indicating that there can be three kinds of relationships, for example, A and/or B, it can mean that A exists alone, A and B exist simultaneously, and there are independent The three cases of B, where A and B can be singular or plural. Also, in the description of the present application, unless stated otherwise, "plurality" means two or more than two. "At least one item(s) below" or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .

The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD), fifth generation (5th generation, 5G) systems, namely new radio (new radio, NR) and future mobile communication systems, etc.

The protocol standard of the fifth generation cellular mobile communication system formulated by the third generation partnership project (3GPP) standard organization, compared with the long term evolution (LTE) system, the new radio (New Radio, NR) ) system supports larger transmission bandwidth, more transceiver antenna arrays, higher transmission rate and more flexible scheduling mechanism with smaller granularity. The above characteristics of NR system provide more applicable scope.

Cybersecurity is an important function in 5G. For the process of radio resource control (RRC) connection in the 2C scenario, 5G defines the unique authentication and key agreement (AKA) in 5G, and the two-way authentication and key agreement (AKA) are carried out through 5G AKA. data encryption. Two-way authentication means that the network device authenticates the terminal device, and the terminal device also authenticates the network device.

FIG. 1 is a schematic diagram of an embodiment of an authentication method based on an RRC connection provided by the present application.

In the embodiment of the present application, the process of establishing communication between the terminal device and the network device consists of three parts, and the three parts are the RACH access process, the RRC establishment process, and the 5G AKA authentication process, respectively. First, the terminal device initiates a random access request to the access network device, and the terminal device receives a random access response sent by the access network device. After the terminal device confirms that the random access is successful according to the random access response, the terminal device sends an RRC establishment request to the access network device. The terminal device receives the RRC establishment response sent by the access network device, and the terminal device starts to perform the 5G AKA authentication process after confirming that the RRC establishment is successful according to the RRC establishment response. The 5G AKA authentication process is described in detail below.

In this application, after the RRC connection is established between the terminal device and the access network device, subsequent air interface information is passed through the uplink physical uplink shared channel (PUSCH) and the downlink physical downlink shared channel (physical downlink shared channel). , PDSCH) to transmit. Only the authentication process is described here.

In this application, the network device may be a core network device, and the network device may include an access and mobility management function (AMF), an authentication server function (AUSF), and a unified data management function (unified data management function). data management, UDM). The terminal device sends a registration request to the AMF through the access network device, and the registration request includes a subscription concealed identifier (SUCI). After the AMF finds that the registration request is an initial registration request, the AMF requests the AUSF for authentication. After receiving the authentication request, the AUSF requests an authentication vector from the UDM, and the UDM generates the authentication vector and returns it to the AUSF. The AUSF converts the 5-tuple authentication vector into a 4-tuple authentication vector and sends it to the AMF. The AMF generates a random number (RANDom number, RAND) and an authentication token (AUthentication Token, AUTN) according to the 4-tuple authentication vector, and sends the generated RAND and AUTN to the terminal device, where the AUTN includes MAC data. The terminal device obtains the MAC data according to the AUTN, and calculates whether the XMAC data is consistent with the MAC data. If they are consistent, the network device is considered to have passed the authentication. If they are inconsistent, the network device is considered to have failed the authentication. After the authentication is passed, the response parameter (RES*) is calculated, and the response parameter (RES*) is sent to the AMF in the authentication response. The AMF calculates the hash response parameter (HRES*) through RES*, determines whether the HRES* is consistent with the expected hash response parameter (HXRES*), and authenticates the terminal device. If they are consistent, the authentication is passed; if they are inconsistent, the authentication is not passed. After the AMF authenticates the terminal device, the AMF sends the authentication information including the RES* to the AUSF for secondary authentication. The AUSF compares whether the RES* is consistent with the expected response (XRES*) so as to authenticate the terminal device twice. After the AUSF authenticates the terminal device, the AUSF returns the authentication success information to the AMF.

However, in some scenarios, such as 2B scenarios, in order to reduce the power consumption on the terminal device side, RRC connection is usually not required between the terminal device and the network device. For scenarios without RRC connection, authentication between the terminal device and the network device cannot be performed. right.

In a scenario where a terminal device and a network device have no RRC connection, the present application provides an authentication method and related devices. First, the network device receives the session request sent by the terminal device on the uplink common channel, and the network device can confirm that the terminal device has passed the authentication according to the session request. Then, the network device sends a session response to the terminal device on the downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device. In a scenario where no RRC connection is established between the terminal device and the network device, the terminal device and the network device can transmit information required for authentication through a common channel, thereby realizing authentication between the terminal device and the network device.

FIG. 2 is a schematic diagram of an application scenario of the authentication system provided by the present application.

Referring to FIG. 2 , in this embodiment of the present application, a network device, a wireless access network, and a terminal device constitute an authentication system.

The authentication system provided by this application includes: a network device 101 , a radio access network (RAN) 102 , RAN 103 and RAN 104 , and a terminal device 105 , a terminal device 106 , a terminal device 107 and a terminal device 108 . Wherein, the network device 101 includes AMF109, AUSF110 and UDM111,

The terminal device 105 and the terminal device 106 conduct data interaction with the AMF 109 included in the network device 101 through the RAN 102 , the terminal device 107 conducts data interaction with the AMF 109 included in the network device 101 through the RAN 103 , and the terminal device 108 communicates with the network device 101 through the RAN 104 . The included AMF109 performs data interaction, AMF109 performs data interaction with AUSF110, and AUSF110 performs data interaction with UDM111.

In the embodiments of the present application, only one network device, three RANs, and four terminal devices are used as examples for schematic illustration. In practical applications, optionally, the application scenarios of the embodiments of the present application may include more or less RANs and terminal devices than those provided in the embodiment shown in FIG. 2 . The embodiments of the present application do not limit the number of network devices, RANs, and terminal devices.

The network device 101 in this embodiment of the present application may be a core network device. Optionally, AMF, AUSF, and UDM may be integrated on the same device, and AMF, AUSF, and UDM may be integrated on different devices, which are not specifically limited here.

In this application, the RAN is used to transmit the information exchanged between the network device and the terminal device, and the role in the authentication process is basically to transmit the information transparently.

In this application, the AMF is used to initiate the authentication process inside the network device, process the authentication message of the terminal device, obtain the authentication vector from the AUSF, authenticate the terminal device, and generate an encryption key.

In this application, the AUSF is used to communicate with the UDM, obtain the authentication vector from the UDM, process the authentication vector and transfer it to the AMF, and authenticate the terminal device.

In this application, UDM is used to store account opening information and user key, and to generate an authentication vector.

The terminal device in this embodiment of the present application may be a device that provides voice and/or data connectivity to a user, a handheld device with a wireless connection function, or other processing device connected to a wireless modem. Terminal devices may be mobile terminals, such as mobile phones (or "cellular" phones) and computers with mobile terminals, for example, may be portable, pocket-sized, hand-held, computer-built, or vehicle-mounted mobile devices, which are connected to a network Devices exchange language and/or data. For example, personal communication service (PCS) phones, cordless phones, Session Initiation Protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs) and other devices . A terminal device may also be referred to as a system, subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, Remote terminal (remote terminal), access terminal (access terminal), user agent (user agent), user equipment (user device), or user equipment (user equipment), user station, remote station, user terminal (terminal equipment, TE), Terminals, wireless communication devices, and user agents or user equipment. In addition, the terminal device may also be a chip system for implementing UE functions. There is no specific limitation here.

Based on the authentication system described in FIG. 2 , the authentication method provided by this application is described.

FIG. 3 is a schematic diagram of an embodiment of an authentication method provided by the present application. Please refer to FIG. 3 , the authentication method includes steps 201 to 203 .

201. The network device receives the session request sent by the terminal device on the uplink common channel, and correspondingly, the terminal device sends the session request to the network device on the uplink common channel.

In this application, no RRC connection is established between the terminal device and the network device, and information exchange between the terminal device and the network device cannot be achieved through a dedicated channel. Therefore, the terminal device sends a session request to the network device through the uplink common channel, and the session request is used to request the network device to authenticate the terminal device.

202. The network device confirms that the terminal device has passed the authentication according to the session request.

In this application, the session request includes authentication parameters, and the network device can authenticate the terminal device according to the authentication parameters included in the session request.

203. The network device sends a session response to the terminal device on the downlink common channel, and correspondingly, the terminal device receives the session response sent by the network device on the downlink common channel.

In this application, no RRC connection is established between the terminal device and the network device, and information exchange between the terminal device and the network device cannot be achieved through a dedicated channel. Therefore, the network device sends a session response to the terminal device through the downlink common channel, and the session response is used to instruct the terminal device to authenticate the network device.

In the present application, step 202 in the embodiment shown in FIG. 3 has a specific implementation manner, and the specific implementation manner will be described in detail below.

Method 1: Two-step authentication method

FIG. 4 is a schematic diagram of another embodiment of the authentication method provided by the present application. Referring to FIG. 4 , in this embodiment, the network device may be a core network device, the network device includes AMF, AUSF, and UDM, and the session request includes SUCI and a first response parameter (RES*).

The AMF sends the first authentication request to the AUSF.

In this embodiment, the first authentication request includes SUCI, RES*, and R0 received by the terminal device. R0 is generated by a network device, and the network device periodically updates R0. After the terminal device receives the R0, the terminal device can calculate the RES* according to the R0 and the account opening key, and then include the RES* and the SUCI in the session request and send it to the AMF through the RAN.

The AUSF sends the first request information to the UDM according to the first authentication request.

In this embodiment, the first request information includes R0 and SUCI, and the first request information is used to instruct the UDM to send an authentication vector to the AUSF.

The AUSF receives the authentication vector sent by the UDM.

In this application, the authentication vector includes a second random parameter (R1), an expected response (eXspected RESponse, XRES), an encryption key (encryption key, CK), an integrity key (integrity key, IK) and an authentication token (aUthentication TokeN, AUTN). The UDM receives the first request information, and the first request information includes R0 and SUCI. The UDM generates an authentication vector according to data such as R0, R1 and the key for opening an account of the terminal, and sends the authentication vector to the AUSF. The algorithm is similar to 5G AKA. When the terminal device calculates RES* and other related parameters, it uses R0 to calculate it. When UDM calculates XRES, it uses R0, and it calculates CK, IK, and AUTN. It uses R1.

The AUSF determines that the terminal device has passed the authentication according to the authentication vector.

In this application, the AUSF determines the consistency of RES* and XRES to authenticate the terminal device. If RES* and XRES are consistent, the AUSF confirms that the terminal device has passed the authentication. If the RES* and XRES are inconsistent, it confirms that the terminal device has not passed the authentication. . The AUSF confirms that the terminal device sends a first authentication response to the AMF after passing the authentication.

The AUSF sends the first authentication response to the AMF.

In this application, the first authentication response includes a second random parameter (R1), a hash expected response (hash eXpectedRESponse, HXRES*), AUTN and a security anchor function key (key for SEAF, Kseaf).

The AMF confirms that the terminal device has passed the authentication according to the first authentication response.

In this application, AMF calculates HRES* through RES*, determines whether HRES* and HXRES* are consistent, and authenticates the terminal device. If the AMF confirms that HRES* is consistent with HXRES*, the AMF confirms that the terminal device has passed the authentication. If the AMF confirms that HRES* and HXRES* are inconsistent, the AMF confirms that the terminal device has not passed the authentication. After passing the authentication, the AMF allocates a session ID, allocates uplink traffic channel resources, and calculates a NAS encryption key (key for NAS encryption, Knasenc) and a NAS integrity key (key for NAS integrity, Knasint). The assigned session ID and uplink traffic channel resource data are encrypted and integrity protected using the key, and the encrypted data (session ID and traffic channel resource) and R1, AUTN are sent to the terminal device through the RAN.

In this application, after the network device confirms that the terminal device has passed the authentication, in the process of conducting business between the network device and the terminal device, the session ID (Session Id) is used to identify the user instead of using the Subscription Permanent Identifier (SUPI).

In this application, the encrypted data of the service includes a message sequence number, and the AMF needs to determine whether the message sequence number is incremented to prevent service data replay attacks. In order to prevent session request replay attacks, in addition to the periodic update of R0, AMF also needs to save the assigned Session Id and SUCI, as well as the corresponding RES* and key information. The UDM requests the authentication vector process, and directly encrypts the previously allocated data and sends it to the terminal.

In this application, in order to prevent the Session Id from not being updated for a long time and thus reducing the security of the system, a field may be added to the broadcast system message to indicate whether the terminal performs authentication again and establishes a session.

In this application, if the network device fails in the authentication process, the subsequent process is terminated, and the network elements included in the network device may send a failure notification message, but the air interface does not send a message and does not notify the terminal. Likewise, if the terminal device fails to authenticate, it will not notify the core network.

Method 2: Four-step authentication method

FIG. 5 is a schematic diagram of another embodiment of the authentication method provided by the present application. Referring to FIG. 5 , in this embodiment, the session request includes SUCI. Network equipment includes AMF, AUSF and UDM.

The network device sends a second authentication request to the terminal device according to the session request.

In this application, after the AMF included in the network device receives the session request, the AMF requests the AUSF for authentication. After receiving the authentication request, the AUSF requests an authentication vector from the UDM, and the UDM generates the authentication vector and returns it to the AUSF. The AMF generates a random number (RANDom number, RAND) and an authentication token (AUthentication Token, AUTN) according to the 4-tuple authentication vector, and sends the generated RAND and AUTN in the second authentication request to the terminal device. The second authentication request is used to instruct the terminal device to authenticate the network device.

The network device receives the second authentication response sent by the terminal device.

In this application, the terminal device obtains the AUTN according to the second authentication request, and the AUTN includes MAC data. The terminal device obtains the MAC data according to the AUTN, and calculates whether the XMAC data is consistent with the MAC data. If they are consistent, the network device is considered to have passed the authentication. If they are inconsistent, the network device is considered to have failed the authentication. After the authentication is passed, the terminal device calculates the response parameter (RES*), and sends the response parameter (RES*) to the AMF in the second authentication response.

The network device confirms that the terminal device has passed the authentication according to the second authentication response.

In this application, the network device obtains the response parameter (RES*) according to the second authentication response, the AMF calculates the hash response parameter (HRES*) through the RES*, and judges whether the HRES* and the expected hash response parameter (HXRES*) are consistent so as to Authenticate the terminal device. If they are consistent, the authentication is passed; if they are inconsistent, the authentication is not passed. After the AMF authenticates the terminal device, the AMF sends the authentication information including the RES* to the AUSF for secondary authentication. The AUSF compares whether the RES* is consistent with the expected response (XRES*) so as to authenticate the terminal device twice. If they are consistent, the authentication passes. If they are inconsistent, the authentication fails. After the AUSF authenticates the terminal device, the AUSF returns an authentication success message to the AMF.

In this embodiment, in a scenario where there is no RRC connection between the terminal device and the network device, the information exchanged between the terminal device and the network device does not pass through a physical uplink shared channel (PUSCH) and a physical downlink shared channel (physical downlink shared channel). uplink shared channel, PDSCH) transmission, but transmitted through the uplink access channel and the downlink common control channel.

The present application provides an authentication method and related equipment. First, the network device receives the session request sent by the terminal device on the uplink common channel, and the network device can confirm that the terminal device has passed the authentication according to the session request. Then, the network device sends a session response to the terminal device on the downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device. In a scenario where no RRC connection is established between the terminal device and the network device, the information required for authentication can be transmitted between the terminal device and the network device through a common channel, thereby realizing authentication between the terminal device and the network device.

The foregoing embodiments provide different implementations of an authentication method. The following provides a network device 30. As shown in FIG. 6, the network device 30 is configured to perform the steps performed by the network device in the foregoing embodiments. The steps and the corresponding beneficial effects can be understood with reference to the above-mentioned corresponding embodiments, which will not be repeated here. The network device 30 includes:

a receiving unit 301, configured to receive a session request sent by a terminal device on an uplink common channel, where the session request is used to request the network device to authenticate the terminal device;

a processing unit 302, configured to confirm that the terminal device has passed the authentication according to the session request;

The sending unit 303 is configured to send a session response to the terminal device on the downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device.

In a possible implementation, the session request includes a user hidden identifier SUCI and a first response parameter,

In a possible implementation manner, the network device includes an access and mobility management function AMF and an authentication service function AUSF;

The AMF sends a first authentication request to the AUSF, where the first authentication request includes the SUCI, the first response parameter, and the first random parameter received by the terminal device;

confirming, by the AUSF, that the terminal device has passed the authentication according to the first authentication request;

The AUSF sends a first authentication response to the AMF, where the first authentication response includes a second random parameter, a second response parameter, an authentication token AUTN and a security anchor function key Kseaf;

The AMF confirms that the terminal device has passed the authentication according to the first authentication response.

In a possible implementation manner, the network device includes a unified data management function UDM;

The AUSF sends first request information to the UDM according to the first authentication request, where the first request information includes a first random parameter and SUCI, and the first request information is used to instruct the UDM to send the UDM to the UDM. AUSF sends the authentication vector;

The AUSF receives the authentication vector sent by the UDM, where the authentication vector includes the second random parameter, the third response parameter, the encryption key CK, the integrity key IK, and the AUTN;

The AUSF determines that the terminal device has passed the authentication according to the authentication vector.

In a possible implementation manner, the session response includes the second random parameter, the AUTN, and configuration information, where the configuration information is used to instruct the terminal device to configure a session between the network device.

In a possible implementation manner, the session request includes the SUCI.

In one possible implementation,

The sending unit 303 is further configured to send a second authentication request to the terminal device according to the session request, where the second authentication request is used to instruct the terminal device to authenticate the network device;

The receiving unit 301 is further configured to receive a second authentication response sent by the terminal device;

The processing unit 302 is further configured to confirm that the terminal device has passed the authentication according to the second authentication response.

It should be noted that the information exchange, execution process and other contents between the modules of the above network device 30 are based on the same concept as the method embodiments of the present application, and the technical effects brought by them are the same as those of the method embodiments of the present invention. The specific content Reference may be made to the descriptions in the method embodiments shown above in this application, and details are not repeated here.

The above embodiments provide different implementations of a network device 30. The following provides a terminal device 40. As shown in FIG. 7, the terminal device 40 is configured to perform the steps performed by the terminal device in the above embodiments. The steps and the corresponding beneficial effects can be understood with reference to the above-mentioned corresponding embodiments, which will not be repeated here. The terminal device 40 includes:

a sending unit 401, configured to send a session request to a network device on an uplink common channel, where the session request is used to request the network device to authenticate the terminal device;

The receiving unit 402 is configured to receive, on the downlink common channel, a session response sent by the network device, where the session response is used to instruct the terminal device to authenticate the network device.

In a possible implementation manner, the session response includes configuration information, where the configuration information is used to instruct the terminal device to configure a session between the network device.

In a possible implementation manner, the session response further includes an authentication parameter; and a processing unit is configured to authenticate the network device according to the authentication parameter.

It should be noted that the information exchange, execution process and other contents between the modules of the above-mentioned terminal device 40 are based on the same concept as the method embodiments of the present application, and the technical effects brought by them are the same as those of the method embodiments of the present invention. Reference may be made to the descriptions in the method embodiments shown above in this application, and details are not repeated here.

Referring to FIG. 8 , a schematic structural diagram of a communication device 50 is provided according to an embodiment of the present application. The communication device 50 includes a processor 502 , a communication interface 503 , a memory 501 and a bus 504 . Wherein, the communication interface 503, the processor 502 and the memory 501 are connected to each other through a bus 504; the bus 504 may be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an extended industry standard architecture (extended industry standard architecture, EISA) bus or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 8, but it does not mean that there is only one bus or one type of bus. The communication device 50 may implement the function of the network device in the embodiment shown in FIG. 6 or the function of the terminal device in the embodiment shown in FIG. 7 . The communication interface 503 can perform corresponding functions corresponding to the receiving unit and the sending unit in the network device or terminal device in the above method examples, and the processor 502 can perform the functions performed by the processing units included in the network device or terminal device in the above method embodiments.

Each component of the communication device 50 will be specifically introduced below with reference to FIG. 7 :

The processor 502 is the control center of the controller, which may be a central processing unit (CPU), a specific integrated circuit (application specific integrated circuit, ASIC), or one configured to implement the embodiments of the present application. or multiple integrated circuits, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

The communication interface 503 is used to communicate with other devices.

The processor 502 may perform the operations performed by the network device 30 in the aforementioned embodiment shown in FIG. 6 , and the processor 502 may perform the operations performed by the terminal device 40 in the aforementioned embodiment shown in FIG. 7 , and details will not be repeated here. .

The embodiment of the present application further provides a communication apparatus 60, where the communication apparatus 60 may be a terminal device or a chip. The communication apparatus 60 may be configured to perform the operations performed by the terminal device in the foregoing method embodiments. When the communication apparatus 60 is a terminal device, FIG. 9 shows a schematic structural diagram of a simplified terminal device. For the convenience of understanding and illustration, in FIG. 9 , the terminal device takes a mobile phone as an example. As shown in FIG. 9 , the terminal device includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device. The processor is mainly used to process communication protocols and communication data, control terminal equipment, execute software programs, and process data of software programs. The memory is mainly used to store software programs and data. The radio frequency circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal. Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal equipment may not have input and output devices.

When data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit. The radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal through the antenna in the form of electromagnetic waves. When data is sent to the terminal device, the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, which converts the baseband signal into data and processes the data. For the convenience of description, only one memory and one processor are shown in FIG. 9 , in an actual terminal device product, there may be one or more processors and one or more memories. The memory may also be referred to as a storage medium or a storage device or the like. The memory may be set independently of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.

In the embodiments of the present application, the antenna and the radio frequency circuit with a transceiver function may be regarded as a transceiver unit of the terminal device, and the processor with a processing function may be regarded as a processing unit of the terminal device.

The terminal device includes a transceiver unit 601 and a processing unit 602 . The transceiver unit 601 may also be referred to as a transceiver, a transceiver, a transceiver, or the like. The processing unit 602 may also be referred to as a processor, a processing board, a processing module, a processing device, or the like.

Optionally, the device for implementing the receiving function in the transceiver unit 601 may be regarded as a receiving unit, and the device for implementing the transmitting function in the transceiver unit 601 may be regarded as a transmitting unit, that is, the transceiver unit 601 includes a receiving unit and a transmitting unit. The transceiver unit may also sometimes be referred to as a transceiver, a transceiver, or a transceiver circuit. The receiving unit may also sometimes be referred to as a receiver, receiver, or receiving circuit, or the like. The transmitting unit may also sometimes be referred to as a transmitter, a transmitter, or a transmitting circuit, or the like.

For example, in an implementation manner, the transceiver unit 601 is configured to perform a receiving operation of a terminal device. The processing unit 602 is configured to perform processing actions on the terminal device side.

It should be understood that FIG. 9 is only an example and not a limitation, and the above-mentioned terminal device including a transceiver unit and a processing unit may not depend on the structure shown in FIG. 9 .

When the communication device 60 is a chip, the chip includes a transceiver unit and a processing unit. Wherein, the transceiver unit may be an input/output circuit or a communication interface; the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip. The input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a flip-flop, and various logic circuits. The input signal received by the input circuit may be received and input by, for example, but not limited to, a receiver, the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by a transmitter, and the input circuit and output The circuits can be different circuits or the same circuit, in which case the circuit is used as an input circuit and an output circuit respectively at different times.

It should be noted that the information exchange, execution process and other contents between the modules of the device 60 provided in the above embodiments are based on the same concept as the method embodiments of the present application, and the technical effects brought by them are the same as those of the method embodiments of the present invention. , and the specific content may refer to the description in the method embodiments shown in the foregoing application, and details are not repeated here.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, removable hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disk and other media that can store program codes.

Claims (22)

1. An authentication method, comprising:

receiving a session request sent by a terminal device on an uplink common channel by a network device, wherein the session request is used for requesting the network device to authenticate the terminal device;

the network equipment confirms that the terminal equipment passes authentication according to the session request;

and the network equipment sends a session response to the terminal equipment on a downlink common channel, wherein the session response is used for indicating the terminal equipment to authenticate the network equipment.

2. The authentication method according to claim 1, wherein the session request comprises a user hidden identity, SUCI, and a first response parameter.

3. The authentication method according to claim 2, characterized in that said network equipment comprises an access and mobility management function AMF and an authentication service function AUSF;

the network device confirms that the terminal device passes the authentication according to the session request, and the method comprises the following steps:

the AMF sends a first authentication request to an AUSF, wherein the first authentication request comprises the SUCI, the first response parameter and a first random parameter received by the terminal equipment;

the AUSF confirms that the terminal equipment passes authentication according to the first authentication request;

the AUSF sends a first authentication response to the AMF, wherein the first authentication response comprises a second random parameter, a second response parameter, an authentication token AUTN and a security anchor point function key Kseaf;

and the AMF confirms that the terminal equipment passes the authentication according to the first authentication response.

4. The authentication method according to claim 3, wherein the network device comprises a unified data management function (UDM), and the AUSF confirms that the terminal device passes the authentication according to the first authentication request, comprising:

the AUSF sends first request information to the UDM according to the first authentication request, wherein the first request information comprises first random parameters and SUCI, and the first request information is used for indicating the UDM to send authentication vectors to the AUSF;

the AUSF receives the authentication vector sent by the UDM, wherein the authentication vector comprises the second random parameter, a third response parameter, an encryption key CK, an integrity key IK and the AUTN;

and the AUSF determines that the terminal equipment passes the authentication according to the authentication vector.

5. The authentication method according to claims 2 to 4, wherein the session response includes the second random parameter, AUTN, and configuration information, and the configuration information is used to indicate that the terminal device configures a session with a network device.

6. The authentication method of claim 1, wherein the session request comprises the SUCI.

7. The authentication method as claimed in claim 6, wherein the network device confirms that the terminal device passes the authentication according to the session request, comprising:

the network equipment sends a second authentication request to the terminal equipment according to the session request, wherein the second authentication request is used for indicating the terminal equipment to authenticate the network equipment;

the network equipment receives a second authentication response sent by the terminal equipment;

and the network equipment confirms that the terminal equipment passes the authentication according to the second authentication response.

8. An authentication method, comprising:

a terminal device sends a session request to a network device on an uplink common channel, wherein the session request is used for requesting the network device to authenticate the terminal device;

and the terminal equipment receives a session response sent by the network equipment on a downlink common channel, wherein the session response is used for indicating the terminal equipment to authenticate the network equipment.

9. The authentication method according to claim 8, wherein the session response comprises configuration information indicating that the terminal device configures a session with a network device.

10. The authentication method according to claim 8 or 9, wherein the session response further comprises authentication parameters, the method further comprising:

and the terminal equipment authenticates the network equipment according to the authentication parameters.

11. A network device, comprising:

a receiving unit, configured to receive, on an uplink common channel, a session request sent by a terminal device, where the session request is used to request the network device to authenticate the terminal device;

the processing unit is used for confirming that the terminal equipment passes the authentication according to the session request;

a sending unit, configured to send a session response to the terminal device on a downlink common channel, where the session response is used to instruct the terminal device to authenticate the network device.

12. The network device of claim 11, wherein the session request comprises a user hidden identity (SUCI) and a first response parameter.

13. Network device according to claim 12, characterized in that it comprises an access and mobility management function AMF and an authentication service function AUSF;

the AMF sends a first authentication request to an AUSF, wherein the first authentication request comprises the SUCI, the first response parameter and a first random parameter received by the terminal equipment;

the AUSF confirms that the terminal equipment passes authentication according to the first authentication request;

the AUSF sends a first authentication response to the AMF, wherein the first authentication response comprises a second random parameter, a second response parameter, an authentication token AUTN and a security anchor point function key Kseaf;

and the AMF confirms that the terminal equipment passes the authentication according to the first authentication response.

14. The network device of claim 13, wherein the network device comprises a unified data management function (UDM);

the AUSF sends first request information to the UDM according to the first authentication request, wherein the first request information comprises first random parameters and SUCI, and the first request information is used for indicating the UDM to send authentication vectors to the AUSF;

the AUSF receives the authentication vector sent by the UDM, wherein the authentication vector comprises the second random parameter, a third response parameter, an encryption key CK, an integrity key IK and the AUTN;

and the AUSF determines that the terminal equipment passes the authentication according to the authentication vector.

15. The network device according to claims 12 to 14, wherein the session response comprises the second random parameter, AUTN, and configuration information, and the configuration information is used to indicate that the terminal device configures a session with a network device.

16. The network device of claim 11, wherein the session request comprises the SUCI.

17. The network device of claim 16,

the sending unit is further configured to send a second authentication request to the terminal device according to the session request, where the second authentication request is used to instruct the terminal device to authenticate the network device;

the receiving unit is further configured to receive a second authentication response sent by the terminal device;

and the processing unit is further used for confirming that the terminal equipment passes the authentication according to the second authentication response.

18. A terminal device, comprising:

a sending unit, configured to send a session request to a network device on an uplink common channel, where the session request is used to request the network device to authenticate the terminal device;

a receiving unit, configured to receive, on a downlink common channel, a session response sent by the network device, where the session response is used to indicate that the terminal device authenticates the network device.

19. The terminal device of claim 18, wherein the session response comprises configuration information indicating that the terminal device is configured to configure a session with a network device.

20. A terminal device according to claim 18 or 19, characterised in that the session response further comprises authentication parameters;

and the processing unit is used for authenticating the network equipment according to the authentication parameters.

21. A communications apparatus comprising a processor coupled with a memory, the memory to store a computer program or instructions, the processor to execute the computer program or instructions in memory such that:

the method of any one of claims 1 to 7 is performed; or

The method of any of claims 8 to 10 being performed.

22. A computer-readable storage medium having stored therein instructions that, when executed on a computer, cause:

the method of any one of claims 1 to 7 is performed; or

The method of any of claims 8 to 10 being performed.

Images