CN1297155C - Authentication method for user of global mobile communication system when roaming to CDMA network - Google Patents

Abstract

The present invention discloses an authentication method for roaming a code division multiple access (CDMA) network in a global system for mobile communication (GSM) for users. An intercommunication and interoperation functional entity (IIF) stores the identity cipher keys (Ki) of GSM user mobile stations (MS) needing to roam the CDMA network. CDMA authentication parameters and GSM authentication parameters are mutually converted through a certain algorithm for adaptation. The present invention utilizes CDMA authentication process and GSM authentication algorithm for authentication. The present invention authenticates the SIM cards of original GSM users when the present invention develops new service for GSM users to roam the CDMA network, avoids operators to send new user identification modules to the GSM users, does not need to modify the existing GSM network apparatuses and CDMA network apparatuses simultaneously, enhances service operability, and is simple and convenient to realize.

Description

Authentication Method for Global System for Mobile Communications Users Roaming to Code Division Multiple Access Network

technical field

The invention relates to an authentication technology of a mobile communication system, in particular to an authentication method for a global system for mobile communication (GSM) user roaming to a code division multiple access (CDMA) network.

Background technique

In a mobile communication system, to access the system, a mobile station must first perform authentication, and only legitimate users who pass the authentication can access the network.

Among them, the GSM network authentication to GSM users includes the general authentication algorithm A3/A8 and the unique parameter identity key (Ki) to the MS and the network; when the SIM card is generated, Ki will be generated and written in the card; When opening an account for a GSM user in the HLR/AuC, it is necessary to save the same Ki as that saved in the SIM card; the Ki cannot be transmitted through the air interface.

The network side authenticates the MS through the following steps:

1. HLR/AuC will generate random number RAND, and calculate symbol response (SRES) and key C (Kc) according to Ki and RAND through A3/A8 algorithm;

2. The network example sends the random number RAND to the MS through the authentication request message;

3. After MS receives RAND, it also calculates SRES and Kc through A3/A8 algorithm according to RAND and Ki, and returns SRES to the network side, and Kc does not need to be transmitted over the air interface;

SRES=A3(RAND, Ki); Kc=A8(RAND, Ki);

Wherein SRES is 32 bits (bit), Kc is 64 bits (bit), RAND is 128 bits (bit), and Ki is 32 bits (bit).

4. After receiving the SRES sent by the MS, the network side compares it with the SRES calculated by itself. If they are the same, the MS is a legal user, otherwise, it is illegal.

In addition, the method for CDMA user authentication by the CDMA network includes a general user authentication and voice encryption algorithm (CAVE) and a unique parameter authentication key (AKey) for the mobile station (MS) and the network; when R-UIM When the card is generated, an AKey is generated and written in the card; when opening an account for a CDMA user in the HLR/AC, the same AKey as that saved in the R-UIM card needs to be saved; through the update process of the shared encrypted data (SSD), the AKey and Authentication random number (RANDSSD) generates SSD, and SSD is one of the most important parameters of CDMA authentication, which can only be generated dynamically. AKey and SSD cannot be passed over the air interface.

When the user accesses the system for the first time, the SSD must be updated first to ensure that the HLR/AC is consistent with the SSD in the R-UIM card; otherwise, the authentication will not succeed;

After the SSD update is successful, when the user accesses the system again, the network needs to authenticate the user; since the authentication parameters in the HLR/AC and the R-UIM card are completely consistent, the same algorithm should be able to calculate the same result ; Otherwise, it indicates that the user is an illegal user.

There are two ways for the network to authenticate users:

One is broadcast query authentication, which requires the base station (BS) system to support broadcast query authentication, and the process of authenticating the MS is as follows:

1. The network side periodically broadcasts RAND to all MSs in the cell through the control/paging channel.

2. When the MS needs to access the system, such as location registration, call initiation, and paging response, etc., use the RAND on the current control/paging channel to calculate the authentication result (AUTHR), and send it to the network side in the initial access message.

3. The network side calculates the AUTHR according to the RAND, and compares it with the AUTHR sent by the MS. If they are the same, the MS is a legal user; otherwise, it is illegal.

The algorithm for calculating the AUTHR on the network side is the same as that used by the MS, which is:

AUTHR＝CAVE(RAND, SSD_A, ESN, AUTHDATA); AUTHR is 18 bits (bit), RAND is 32 bits (bit), SSD_A is the first 64 bits (bit) of SSD, ESN is electronic serial number, AUTHDATA is authentication Data, the data used when the access type is different is also different, for example, it is calculated based on the mobile identification number (MIN) and the called number when calling, and it is only calculated based on the MIN during location registration or paging response.

The other is the unique query authentication method, and the process of authenticating the MS in this method is as follows:

1. The network side generates a unique query random number (RANDU), and uses the RANDU to calculate the user's authentication result (AUTHU); and sends the unique query random number (RANDU) to the MS.

2. After receiving the RANDU, the MS also calculates the AUTHU according to the RANDU and returns it to the network side.

3. Finally, the network side compares the AUTHU calculated by itself with the AUTHU sent by the MS. If they are the same, the MS is a legal user; otherwise, it is illegal.

This authentication method can be initiated by the MSC on the control channel or traffic channel; its algorithm is as follows:

AUTHU=CAVE(RANDU, SSD_A, ESN, MIN); AUTHU is 18 bits (bit), RANDU is 32 bits (bit), SSD_A is the first 64 bits (bit) of SSD, ESN is electronic serial number, MIN is mobile identification Number.

At present, adding an Interworking and Interoperability Functional Entity (IIF) on the network side can support GSM registered users to use the services in the CDMA network and CDMA registered users to use the services in the GSM network. The IIF mainly completes the interworking between the GSM network and the CDMA network. And interoperability function; see Fig. 1, Fig. 1 is the connection structure diagram of IIF and GSM network and CDMA network.

Among them, in the American National Standards Institute 41 series protocol (ANSI-41) core network 110 of CDMA, the CDMA authentication center (AC) 111 is connected with the home location register (HLR) 113 through the H interface, and the short message center (MC) 112 is connected through the H interface. N interface is connected with HLR, MC112, HLR113, visitor location register (VLR) 114, mobile switching center (MSC) 115 are respectively connected with IIF through Q interface, D interface, D interface and E interface.

In GSM mobile application part (MAP) core network 130, GSM short message service center (SMS-SC) 132 and GSM short message service-interworking MSC (SMS-IWMSC) 131, GSM short message service-gateway MSC (SMS-GMSC) 133 are connected respectively, GSM authentication center (AuC) 135 is connected with HLR134 through H interface, SMS-IWMS131, CSMS-GMSC133, HLR134, VLR136, MSC137, serving GPRS support node (SGSN) 138 are respectively through E interface, E interface, D Interface, D interface, E interface, Gr interface are connected with IIF.

The IIF120 is located between the GSM MAP core network and the ANSI-41 core network, and performs conversion between ANSI-41 signaling and GSM MAP signaling.

When a GSM registered user uses a dual-mode terminal to roam to the CDMA network, it is said that the GSM registered user is in the CDMA foreign mode; at this time, for the CDMA network, the IIF can be regarded as the CDMA HLR of the GSM registered user; and for the GSM network, the IIF can be regarded as GSM VLR serving this GSM registered user.

A GSM user in the CDMA foreign mode needs to be authenticated by the CDMA network. After the authentication is successful, the GSM user is allowed to access the CDMA network and obtain the right to use network resources. For services that allow GSM users to use CDMA network resources, authentication is one of the most critical designs.

The above-mentioned GSM network authentication method and CDMA network authentication method, when the GSM network is connected to the CDMA network through the IIF, cannot authenticate the GSM user roaming to the CDMA network. Therefore, there has been an authentication method for a GSM user to roam to a CDMA network, the method is:

Since the IIF has the function of CDMA HLR, it is necessary to register the CDMA authentication subscription data A-Key of the GSM user on the IIF or the AC. Generally, a standard CDMA R-UIM card is inserted into the GSM terminal, or it can be stored at the same time when used in the terminal. Ki and A-Key's new type of dual-mode card to achieve. In this way, GSM users in the CDMA foreign mode use the CDMA standard authentication process, including SSD update and authentication; the authentication process does not need to participate in the interaction with the home network GSM HLR.

Referring to FIG. 2 , FIG. 2 is a schematic flow diagram of authentication for a GSM user roaming to a CDMA network in the prior art. The CDMA R-UIM card is inserted into the GSM user terminal, and the user is also a CDMA user. When opening an account for a CDMA user in the HLR/AC, save the same AKey as that saved in the R-UIM card; through the SSD update process, the SSD can be generated according to the AKey and RAND. When the user accesses the system for the first time, the SSD must be updated first to ensure that the HLR/AC is consistent with the SSD in the R-UIM card. In this way, the basic flow of authentication when a GSM user roams to a CDMA network includes the following steps:

Step 201, MS calculates AUTHR according to SSD and RAND;

Step 202, the MS sends the AUTHR to the MSC/VLR of the CDMA network;

Step 203, MSC/VLR sends authentication request (AUTHREQ) message to IIF;

Step 204, after receiving the authentication request message, the IIF forwards the authentication request to the AC of the CDMA network;

Step 205, the AC of the CDMA network calculates the AUTHR according to SSD and RAND, and compares it with the AUTHR sent by the IIF; if not the same, it indicates that it is an illegal user, otherwise it is a legal user;

Step 206, the AC of the CDMA network returns an authentication response (authreq) message comprising the authentication result to the IIF;

Step 207, the IIF forwards the authentication result to the MSC/VLR of the CDMA network;

In step 208, the MSC/VLR performs processing according to the authentication result, and accesses legal users and clears illegal users.

In the authentication method for the above-mentioned GSM user roaming to the CDMA network, a new user identification module needs to be issued on the GSM terminal, generally by inserting a standard CDMA R-UIM card on the GSM terminal, or using a terminal that can store Ki and A-Key at the same time A new type of dual-mode card is implemented. Therefore, the operator needs to reissue the user identification module to the GSM users who have applied for the function of roaming to the CDMA network. This kind of service distribution method that enables users to enjoy new services is relatively complicated, requires the cooperation of users, and is not conducive to the promotion of services.

Contents of the invention

In view of this, the object of the present invention is to provide a kind of authentication method that the global system for mobile communication (GSM) user roams to code division multiple access (CDMA) network, when carrying out the new business of GSM user roaming to CDMA network, avoid operating Providers issue new subscriber identification modules to GSM users to enhance service operability.

In order to achieve the above object, the technical solution of the present invention is specifically realized in the following way:

A kind of authentication method that the global system for mobile communication (GSM) user roams to code division multiple access (CDMA) network, this method comprises:

1) The interworking and interoperability functional entity (IIF) saves the identity key (Ki) of the GSM user mobile station (MS) that needs to roam to the CDMA network; the authentication methods of the CDMA network for the GSM user include: broadcast query authentication and unique Query authentication, where,

2) broadcast query authentication process, including the following steps:

21) The MS receives the CDMA authentication random number (C-RAND) broadcast by the CDMA base station controller (BSC), converts the authentication random number (C-RAND) into a GSM authentication random number (G-RAND), and then Calculate the symbol response (SRES) and key C (Kc) according to the Ki stored in G-RAND and MS; then convert the SRES into a CDMA authentication result and send it to the BSC;

22) BSC sends authentication random number (C-RAND) and CDMA authentication result to mobile switching center (MSC)/visitor location register (VLR) of CDMA;

23) MSC/VLR sends an authentication request including authentication random number (C-RAND) and CDMA authentication result to IIF;

24) The IIF converts the received authentication random number (C-RAND) into a GSM authentication random number (G-RAND), and then calculates SRES and Kc according to the Ki of the MS stored in G-RAND and IIF; and then Convert the SRES to the CDMA authentication result, compare the converted CDMA authentication result with the received CDMA authentication result, and complete the broadcast query authentication;

3) The unique query authentication process includes the following steps:

31) The MSC/VLR of CDMA sends an authentication request to the IIF for an MS without GSM with authentication parameters;

32) The IIF generates an authentication random number (C-RAND) according to the authentication request, and converts it into a GSM authentication random number (G-RAND), and then calculates the SRES based on the Ki of the MS stored in G-RAND and IIF and Kc; then convert SRES to CDMA authentication result;

33) The IIF returns an authentication response including the authentication random number (C-RAND) and the CDMA authentication result to the MSC/VLR;

34) MSC/VLR saves the CDMA authentication result, and sends a unique inquiry authentication request including authentication random number (C-RAND) to MS through BSC;

35) MS converts the received authentication random number (C-RAND) into GSM authentication random number (G-RAND), and then calculates SRES and Kc according to G-RAND and Ki stored in MS; then converts SRES It is the CDMA authentication result, and returns the authentication result to the MSC/VLR through the BSC along with the authentication response;

36) The MSC/VLR compares the received CDMA authentication result with the CDMA authentication result saved in step 34), and completes the unique query authentication.

Wherein, the step 34) may further include: after receiving the authentication response returned by the IIF, the MSC/VLR first assigns a traffic channel through the BSC, and after the traffic channel assignment is successful, sends a unique query authentication request.

The method for assigning traffic channels may be as follows: MSC/VLR sends an assignment request to BSC; BSC assigns traffic channels according to the assignment request; and returns an assignment response to MSC/VLR.

The CDMA authentication random number described in step 21)-step 24) may be a broadcast authentication random number; the CDMA authentication random number described in step 32)-step 36) may be a unique query authentication random number.

The described method of converting C-RAND into G-RAND can be as follows: fill in G-RAND after performing operations on C-RAND; or use C-RAND and International Mobile Subscriber Identity (IMSI) or/and electronic serial number (ESN) fill in G-RAND after calculation. For example, the method can be: fill C-RAND into the fixed position of G-RAND, fill the remaining position of G-RAND with predetermined numbers or/and International Mobile Subscriber Identity (IMSI); or fill the remaining position of G-RAND The slots are filled with predetermined numbers or/and an Electronic Serial Number (ESN).

The method for calculating RES and Kc based on the Ki stored in G-RAND and MS can be the same as the method for calculating SRES and Kc based on the Ki stored in G-RAND and IIF, which is: SRES and Kc were calculated by A3/A8 algorithm using G-RAND and Ki.

The described method of converting SRES into a CDMA authentication result can be: taking out the CDMA authentication result at a fixed position of the SRES; or taking out the CDMA authentication result at a fixed position after the SRES is operated; After performing operations with the International Mobile Subscriber Identity (IMSI) or/and the Electronic Serial Number (ESN), the CDMA authentication result is taken out at a fixed location.

As can be seen from the technical scheme of the present invention, the authentication method of this Global System for Mobile Communications (GSM) user of the present invention roaming to the code division multiple access (CDMA) network is when carrying out the new business of the GSM user roaming to the CDMA network, using the original The authentication of the SIM card of the GSM user avoids the operator issuing a new user identification module to the GSM user. At the same time, it does not need to modify the existing GSM network equipment and CDMA network equipment, which is easy to implement and enhances the operability of the service.

Description of drawings

Fig. 1 is the connection structural diagram of IIF and GSM network and CDMA network;

Fig. 2 is the schematic flow chart of prior art GSM user roaming to CDMA network authentication;

FIG. 3 is a schematic diagram of the broadcast authentication flow in the first preferred embodiment of the present invention;

Fig. 4 is a schematic diagram of MS generating AUTHR in the embodiment shown in Fig. 3;

Fig. 5 is a schematic diagram of a unique query authentication process in the second preferred embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the embodiments and accompanying drawings.

According to the result of comparing the GSM network authentication parameters with the CDMA network authentication parameters, the invention performs adaptation through a certain algorithm, converts the CDMA authentication parameters and the GSM authentication parameters to each other, and performs authentication.

See Table 1, which compares the GSM network authentication parameters with the CDMA network authentication parameters. GSM CDMA random number logo RAND RANDU length 128 bits (bit) 32 bits Authentication result logo SRES, Note: Kc does not need to be passed AUTHU length 32 bits 18 bits

Table I

It can be seen from Table 1 that if the CDMA authentication process is used, the GSM authentication parameters cannot be fully carried; therefore, a certain algorithm can be considered for adaptation, and the CDMA 32-bit RAND or RANDU (C-RAND for short) can be converted into 128bitRAND (abbreviated as G-RAND); and the 32bitSRES of GSM is converted into the AUTHR or AUTHU of 18bit of CDMA (abbreviated as C-AUTH) by algorithm Fb; the corresponding relationship is expressed as follows:

G-RAND=Fa(C-RAND)

C-AUTH=Fb(SRES)

Algorithms Fa and Fb can also use user information as input parameters, such as MIN, ESN, certain bytes in the called number (when there is no called number, it can be represented by all 1), but not limited to these parameters;

Among them, the algorithm Fa can calculate C-RAND and fill it into G-RAND; or calculate C-RAND and International Mobile Subscriber Identity (IMSI) or/and Electronic Serial Number (ESN) and fill it into G-RAND.

For example: fill C-RAND into the fixed position of G-RAND, fill the remaining position of G-RAND with predetermined numbers or/and International Mobile Subscriber Identity (IMSI); or fill the remaining positions of G-RAND with predetermined numbers or / and Electronic Serial Number (ESN) filled.

Algorithm Fb can take out the CDMA authentication result at the fixed position of SRES; Or take out the CDMA authentication result at the fixed position after SRES is operated; Or combine SRES and Kc or/and International Mobile Subscriber Identity (IMSI) or/and After the Electronic Serial Number (ESN) is calculated, the CDMA authentication result is taken out at a fixed location.

In the present invention, the IIF is used as the HLR/AC of the GSM registered user in the CDMA foreign mode, wherein Ki and the authentication algorithm A3/A8 are saved. When opening an account for a GSM user who needs to roam to a CDMA network in the IIF, the relationship between the International Mobile Subscriber Identity (IMSI) and Ki is stored in the database of the IIF.

The authentication method of the invention includes: a broadcast query authentication process and a unique query authentication process. A preferred embodiment of the two authentication processes will be described in detail below.

The first preferred embodiment is a call-initiating procedure for broadcast inquiry and authentication. In this embodiment, the authentication flow is the same as that of the common CDMA broadcast authentication flow, but the authentication algorithm of GSM is adopted in the authentication algorithm, and two functions Fa and Fb are newly added. Referring to FIG. 3, FIG. 3 is a schematic diagram of a broadcast authentication flow in the first preferred embodiment of the present invention; the flow includes the following steps:

In step 301, the BSC broadcasts the authentication random number C-RAND through the paging/control channel.

In step 302, the MS converts the received C-RAND into G-RAND through the algorithm Fa, and calculates SRES and Kc through the A3/A8 algorithm in the SIM card of the MS using the G-RAND and the Ki saved by the MS. Then use algorithm Fb to convert SRES into authentication result AUTHR.

In step 303, the MS sends a call origination request including AUTHR to the BSC.

Step 304, after receiving the origination request, the BSC sends a service request (CM ServiceRequest) to the MSC/VLR, which includes C-RAND and AUTHR.

Step 305: After receiving the service request, the MSC/VLR sends an authentication request AUTHREQ to the IIF, which includes C-RAND and AUTHR.

Step 306, after the IIF receives the authentication request message, it first converts C-RAND to G-RAND through the Fa algorithm, and calculates SRES and Kc through the A3/A8 algorithm using G-RAND and the Ki of the MS stored in the IIF, Then convert SRES to AUTHR through algorithm Fb, and compare whether the calculated AUTHR is equal to the AUTHR sent by MSC/VLR in the authentication request; if they are equal, it indicates that it is a legal user and allows access; otherwise, it is an illegal user , access is denied.

In step 307, the IIF returns to the MSC/VLR an authentication response (authreq) containing information on whether to allow user access.

Step 308, after receiving the authentication response message, the MSC/VLR continues call processing or clears the call according to whether the user is allowed to access the information.

Wherein, step 302 is a process for the MS to generate the AUTHR; step 306 includes the process for the IIF to generate the AUTHR. Fig. 4 is the schematic diagram that MS generates AUTHR in the embodiment shown in Fig. 3; It comprises three algorithms: First, convert 32-bit C-RAND into 128-bit G-RAND by algorithm Fa in the mobile equipment (ME) in MS RAND, then use the G-RAND and Ki to calculate the 32-bit and Kc through the algorithm A3/A8 in the SIM card, and finally convert the 32-bit SRES to the 18-bit AUTHR through the algorithm Fb in the ME. The algorithm for generating AUTHR in the IIF is the same as that shown in Figure 4, except that the used Ki and A3/A8 algorithms are pre-stored in the IIF.

In this embodiment, Fa adopts a relatively simple algorithm: fill C-RAND into the first 32 bits of G-RAND, and fill other bits of G-RAND with all 1s. The algorithm of Fb is also relatively simple: take out the first 18 bits from the 32-bit SRES as AUTHR. In practical applications, the algorithms Fa and Fb can take MIN, ESN, and some bytes in the called number (if there is no called number, it can be represented by all 1s) as input parameters, and use more complex algorithms to convert.

This embodiment is a call initiation flow, and the authentication processing flow of location registration and paging response is similar to this.

The second preferred embodiment is a unique query authentication origination flow. In this embodiment, the authentication flow is the same as that of the common CDMA unique authentication flow, but the authentication algorithm of GSM is adopted, and two functions Fa and Fb are newly added. Referring to FIG. 5, FIG. 5 is a schematic diagram of a unique authentication process in a second preferred embodiment of the present invention; the process includes the following steps:

Step 501, MS accesses without authentication parameters, and MSC/VLR sends an authentication request (AUTHREQ) to IIF for the MS.

Step 502, after the IIF receives the authentication request message and finds that there is no authentication parameter, it generates a random number RANDU (C-RAND), and converts C-RAND to G-RAND through the Fa algorithm, and uses G-RAND and IIF The saved Ki of the MS calculates the SRES and Kc through the A3/A8 algorithm; then converts the SRES into the CDMA authentication result (AUTHU) through the Fb algorithm.

Step 503, the IIF returns an authentication response (authreq) to the MSC/VLR, which includes RANDU and AUTHU, indicating that the MSC/VLR initiates a unique query authentication;

Step 504, after receiving the authentication response message, the MSC/VLR finds that RANDU and AUTHU are included, and saves the AUTHU.

Step 505, MSC/VLR sends assignment request (Assignment Request) to BSC to assign traffic channel

Step 506, after receiving the assignment request, the BSC assigns a traffic channel and returns an assignment response (Assignment Response);

Step 507, after the traffic channel assignment is successful, the MSC/VLR sends a unique query authentication request (Authentication Request) to the BSC, which includes RANDU.

In step 508, the BSC sends the received unique query authentication request (Authentication Request) to the MS.

Step 509, after the MS receives the unique query authentication request message, it obtains the random number RANDU (C-RAND), converts the C-RAND to G-RAND through the algorithm Fa, and calculates the SRES through the A3/A8 algorithm in the SIM card and Kc, then convert SRES to AUTHU by algorithm Fb.

In step 510, the MS returns a unique authentication response to the BSC, which includes AUTHU.

In step 511, the BSC returns the received unique query authentication response containing AUTHU to the MSC/VLR.

Step 512, MSC/VLR obtains the AUTHU after receiving the unique query authentication request response, and compares with the AUTHU preserved in step 504), and judges whether the result is consistent, if consistent, then shows that it is a legal user; otherwise, it is an illegal user .

In step 513, the MSC/VLR reports the judgment result to the IIF through an authentication status report (ASREPORT).

Step 514, after receiving the authentication status report, the IIF decides whether to allow the user to access according to the judgment result, and returns the authentication status report response (asreport) containing the access information to the MSC/VLR.

Step 515, after receiving the authentication status report response message, the MSC/VLR continues access processing or clears user access according to the access information.

Among them, step 502 is the process of IIF generating AUTHU; step 509 is the process of MS generating AUTHU. In this embodiment, the process of MS generating AUTHU in step 509 is the same as the process of MS generating AUTHR in step 302 in FIG. 3; the process of IIF generating AUTHU in step 502 is the same as the process of generating AUTHR in step 306 in FIG. ; Algorithms Fa and Fb can also be the same as the first preferred embodiment.

This embodiment is an initial call flow, and the authentication processing flow of a paging response is similar to this.

In the above two embodiments, for the GSM users roaming to the CDMA network, the IIF prohibits the SSD update operation.

In addition, the present invention can also have the following implementation methods: the same as the above two embodiments, at first, the identity key (Ki) of the GSM user mobile station (MS) that needs to roam to the CDMA network is stored in the IIF, and the IIF also has the ability to execute GSM A3/A8 algorithm computing capability. Then, in the SSD update process, use Ki to generate SSD. Finally, in the flow of broadcast inquiry authentication and unique inquiry authentication, GSM MS is authenticated by CMSC or AuC like a common CDMA terminal.

Wherein, the method of using Ki to generate SSD is similar to the method of using Ki to generate AUTHR or AUTHU in the above two authentication processes.

The process of using Ki to generate SSD includes the following steps:

1. IIF generates random number RANDSSD, and converts it into G-RAND through Fa algorithm, uses G-RAND and Ki of GSM MS stored in IIF for SSD update, calculates SRES and Kc through A3/A8 algorithm; then through Fb Algorithm converts SRES to SSD.

2. The IIF sends the RANDSSD to the MS of GSM through the MSC/VLR of CDMA.

3. The MS of GSM converts RANDSSD to G-RAND through the algorithm Fa, and calculates SRES and Kc through the A3/A8 algorithm in the SIM card, and then converts SRES into SSD through the algorithm Fb.

4. The GSM MS generates a confirmation SSD update information and sends it to the IIF through the CDMA MSC/VLR.

In this way, the MS of GSM can be authenticated by CMSC or AuC by using SSD parameters like a common CDMA terminal.

Visible by above-mentioned three embodiments, this Global System for Mobile Communications (GSM) user of the present invention roams to the authentication method of Code Division Multiple Access (CDMA) network when carrying out this new business of GSM user roaming to CDMA network, does not aim at GSM non-local mode users add a new authentication process, do not replace or modify the GSM subscriber identification module SIM, use the original GSM user SIM card for authentication, avoiding the operator to issue a new subscriber identification module to GSM users, and at the same time, do not need Modify the existing GSM network equipment and CDMA network equipment, easy to implement, and enhance the operability of the business.

Claims (8)

1, a kind of global system for mobile communications GSM user roams into the method for authenticating of Code Division Multiple Access (CDMA) network, it is characterized in that, this method comprises:

1) intercommunication and interoperability functional entity IIF preserve the identity key Ki of GSM user's mobile station MS that need roam into cdma network; Cdma network comprises GSM user's authentication mode: broadcast query authentication and unique challenge authentication, wherein,

2) broadcast query authentication process may further comprise the steps:

21) MS receives the CDMA authentication random number C-RAND of the base station controller BSC broadcasting of CDMA, and C-RAND is converted to GSM authentication random number G-RAND, calculates symbol response SRES and ciphering key Kc according to the Ki that preserves among G-RAND and the MS again; Again SRES is converted to the CDMA authenticating result, sends to BSC;

22) BSC sends to C-RAND and CDMA authenticating result moving exchanging center MSC/VLR Visitor Location Register VLR of CDMA;

23) MSC/VLR sends the authentication request that comprises C-RAND and CDMA authenticating result to IIF;

24) IIF is converted to G-RAND with the C-RAND that receives, the Ki according to this MS that preserves among G-RAND and the IIF calculates SRES and Kc again; Again SRES is converted to the CDMA authenticating result, CDMA authenticating result of changing out and the CDMA authenticating result of receiving are compared, finish the broadcast query authentication;

3) unique challenge authentication process may further comprise the steps:

31) MSC/VLR of CDMA sends authentication request for the MS with the GSM of authentication parameter not to IIF;

32) IIF generates C-RAND, and is converted to G-RAND according to authentication request, and the Ki according to this MS that preserves among G-RAND and the IIF calculates SRES and Kc again; Again SRES is converted to the CDMA authenticating result;

33) IIF returns the Authentication Response that comprises C-RAND and CDMA authenticating result to MSC/VLR;

34) MSC/VLR preserves the CDMA authenticating result, and sends the unique challenge authentication request that comprises C-RAND to MS by BSC;

35) MS is converted to G-RAND with the C-RAND that receives, calculates SRES and Kc according to the Ki that preserves among G-RAND and the MS again; Again SRES is converted to the CDMA authenticating result, and authenticating result is returned to MSC/VLR with Authentication Response by BSC;

36) MSC/VLR is with CDMA authenticating result and the step 34 received) in the CDMA authenticating result of preserving compare, finish the unique challenge authentication.

2, method for authenticating as claimed in claim 1, it is characterized in that described step 34) further comprise: after MSC/VLR receives the Authentication Response that IIF returns, earlier by BSC assignment Traffic Channel, after the Traffic Channel Assignment success, send the unique challenge authentication request again.

3, method for authenticating as claimed in claim 2 is characterized in that, the method for described assignment Traffic Channel is: MSC/VLR sends the assignment request to BSC; BSC is according to this assignment request assignment Traffic Channel; And return assignment response to MSC/VLR.

4, method for authenticating as claimed in claim 1 is characterized in that: step 21)-step 24) described in the CDMA authentication random number be the global challenge random number; Step 32)-step 36) described in the CDMA authentication random number be the unique challenge authentication random number.

5, method for authenticating as claimed in claim 1 is characterized in that: the described method that C-RAND is converted to G-RAND is: C-RAND is carried out inserting G-RAND after the computing; Or with C-RAND and international mobile subscriber identity IMSI or/and Electronic Serial Number ESN carry out inserting G-RAND after the computing.

6, method for authenticating as claimed in claim 5 is characterized in that: the described method that C-RAND is converted to G-RAND is: C-RAND is inserted the fixed position of G-RAND, with the G-RAND rest position with predetermined number or/and IMSI fill up; Or with the rest position of G-RAND with predetermined number or/and ESN fill up.

7, method for authenticating as claimed in claim 1, it is characterized in that: the described method that calculates SRES and Kc according to the Ki that preserves among G-RAND and the MS, the method that calculates SRES and Kc with described Ki according to this MS that preserves among G-RAND and the IIF is identical, for: go out SRES and Kc with G-RAND and Ki by the A3/A8 algorithm computation.

8, method for authenticating as claimed in claim 1 is characterized in that: the described method that SRES is converted to the CDMA authenticating result is: will take out the CDMA authenticating result in the fixed position of SRES; Or after SRES carried out computing, take out the CDMA authenticating result in the fixed position; Or with SRES and Kc or/and IMSI or/and after ESN carries out computing, take out the CDMA authenticating result in the fixed position.

Images