WO2011032515A1 - 认证处理方法及装置 - Google Patents

认证处理方法及装置 Download PDF

Info

Publication number
WO2011032515A1
WO2011032515A1 PCT/CN2010/077085 CN2010077085W WO2011032515A1 WO 2011032515 A1 WO2011032515 A1 WO 2011032515A1 CN 2010077085 W CN2010077085 W CN 2010077085W WO 2011032515 A1 WO2011032515 A1 WO 2011032515A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
authentication
current service
authenticated
current
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2010/077085
Other languages
English (en)
French (fr)
Inventor
毕晓宇
张爱琴
张冬梅
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP18204267.1A priority Critical patent/EP3531731B1/en
Priority to EP17151314.6A priority patent/EP3242498B1/en
Priority to EP10816719.8A priority patent/EP2472928B1/en
Priority to BR112012006409-6A priority patent/BR112012006409B1/pt
Publication of WO2011032515A1 publication Critical patent/WO2011032515A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/90—Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/25—Maintenance of established connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/50—Connection management for emergency connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/02—Data link layer protocols

Definitions

  • the present invention claims the priority of the Chinese patent application filed on September 21, 2009, the Chinese Patent Office, the application number is 200910093828.5, and the invention name is "certification processing method and device", the entire contents of which are incorporated by reference.
  • the present invention relates to the field of communications, and in particular, to an authentication processing method and apparatus.
  • a Non-Access Stratum (NAS) count is part of a security context in a Long Term Evolution (LTE) system.
  • LTE Long Term Evolution
  • the NAS count can be used as the key life cycle to make the key fresh.
  • the NAS count can ensure the synchronization of the user equipment (User Equipment, UE) with the network side key.
  • UE User Equipment
  • Each Evolved Packet System (EPS) security context contains two independent NAS count values: the upstream NAS count value and the downstream NAS count value. The counters of these two NAS counts are independently maintained by the UE and the Mobility Management Entity (MME).
  • MME Mobility Management Entity
  • the NAS count has 32 bits and is mainly composed of two parts: the NAS serial number (SQN) and the NAS overflow value (OVERFLOW), where the NAS serial number is 8 bits and the NAS overflow value is 16 bits.
  • the NAS serial number is carried in each NAS message. When each new or retransmitted NAS message is sent, the sender will increase the NAS serial number by one; when the NAS serial number is increased to the maximum. Value, when the loop is over, the NAS overflow value is increased by 1.
  • the MME when the MME detects that the downlink NAS count value is about to wrap, that is, when the NAS count value is close to the maximum value 2 24 , the MME will trigger a new EPS authentication and key agreement (Authentication and Key Agreement). , abbreviation: AKA ) Flow, establishes a new security context, and initializes the NAS count value to 0 when the security context is activated.
  • AKA EPS authentication and key agreement
  • Embodiments of the present invention provide an authentication processing method and apparatus for saving resources.
  • An embodiment of the present invention provides another authentication processing method, including:
  • the wireless communication network side device determines whether the network policy supports the current service without authentication.
  • the current service is continued to be executed;
  • the current service is continued to be executed.
  • An embodiment of the present invention provides another authentication processing apparatus, including:
  • An execution module configured to perform an authentication and key agreement process
  • the processing module is located in the wireless communication network side device, and includes:
  • a first determining unit configured to determine, in a case where the authentication and the key agreement process are performed on the user equipment, whether the network policy supports the current service without authentication
  • a second determining unit configured to determine, according to the network policy, that the current service is not authenticated, whether the current service is a service that needs to be authenticated, or whether the user equipment has the capability of performing an authentication and a key negotiation process. Or the user equipment has an insertion card; the execution unit is configured to determine, in the second determining unit, that the current service is a service that does not need to be authenticated, or that the user equipment does not have performing authentication and key agreement Process capability, Or if the user equipment does not have a card inserted, the current service is continued to be executed.
  • the connection is not immediately released, but the connection is released or the current service is continued according to the local information and the network policy, thereby avoiding releasing the connection that is not necessary to be released, thereby saving resources.
  • FIG. 1 is a flowchart of an authentication processing method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for processing authentication according to Embodiment 2 of the present invention.
  • FIG. 3 is a flowchart of a method for processing authentication according to Embodiment 3 of the present invention.
  • FIG. 4 is a flowchart of a method for processing authentication according to Embodiment 4 of the present invention.
  • FIG. 5 is a flowchart of a method for processing authentication according to Embodiment 5 of the present invention.
  • FIG. 6 is a flowchart of a method for processing authentication according to Embodiment 6 of the present invention.
  • FIG. 7 is a flowchart of a method for processing authentication according to Embodiment 7 of the present invention.
  • Embodiment 8 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 8 of the present invention.
  • FIG. 9 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 9 of the present invention.
  • FIG. 10 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 10 of the present invention.
  • FIG. 11 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 11 of the present invention.
  • FIG. 12 is a schematic structural diagram of an apparatus for processing an authentication according to Embodiment 12 of the present invention.
  • FIG. 13 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 13 of the present invention.
  • FIG. 1 is a flowchart of an authentication processing method according to an embodiment of the present invention. As shown in FIG. 1 , this embodiment specifically includes the following steps: Step 101: When the non-access stratum count value is close to the maximum value, the local information is detected. Step 102: Determine, according to the local information, whether to trigger an authentication and key agreement process with the user equipment.
  • the NAS count value is close to the maximum value, that is, when the NAS count value is about to wrap, the authentication and key negotiation process can be the EPS AKA process.
  • the executor of the two steps may be the MME.
  • the MME detects the local information, and determines whether to trigger the EPS AKA process according to the detection result.
  • the MME receives the NAS message, and the MME receives the NAS message, and the NAS count value is incremented by one; the MME detects whether the NAS count value is close to the maximum value. Specifically, the MME can detect whether the NAS count value is equal to the threshold value, and the threshold value. It is a preset value close to the maximum value; if yes, it detects the local information, and determines whether to trigger the authentication and key agreement process according to the detection result; otherwise, it continues to receive the NAS message.
  • the MME does not trigger the EPS AKA process as soon as it detects that the NAS count value is about to wrap, which reduces the number of times the EPS AKA process is triggered, avoids the resource consumption caused by triggering the unnecessary EPS AKA process, and saves resources. .
  • the EPS security context can be divided into the current EPS security context and the non-current EPS security context.
  • the current EPS security context refers to the latest activated security context, which is the security context currently in use.
  • the security context currently in use above can coexist with a set of non-current native EPS security contexts.
  • the EPS security context can be divided into a mapped EPS security context and a native EPS security context.
  • the mapping EPS security context refers to the security context mapped from other systems, such as mapping from Universal Mobile Telecommunications System (UMTS) to LTE. system.
  • UMTS Universal Mobile Telecommunications System
  • the local EPS security context refers to the security context generated by the EPS AKA in the LTE system.
  • the local EPS security context is further divided into a partial native EPS security context and a full native EPS security context.
  • the main difference is that some local EPS security contexts do not pass a successful NAS security.
  • the mode process runs, so in the partial local EPS security context, only the root key K ASME , Key Set Identity (KSI), and the security capability of the UE that the UE accesses the LTE network are set and set to 0.
  • the full local EPS security context is the security context activated by a successful NAS Security Mode Command (SMC) process after the EPS AKA process, which contains a complete set of EPS NAS security contexts. Therefore, the complete local EPS security context will additionally include the NAS layer integrity key K NASmt , the encryption key K NASenc , and the selected NAS encryption algorithm and integrity algorithm identification.
  • FIG. 2 is a flowchart of a method for processing authentication according to Embodiment 2 of the present invention.
  • the local information is a locally saved security context
  • the following security contexts are local EPS security contexts.
  • the embodiment specifically includes the following steps:
  • Step 201 The MME receives the NAS message, and the NAS count value is incremented by one.
  • Step 202 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 203; otherwise, performs step 201.
  • a value close to the maximum value may be preset as a threshold value, and the MME detects whether the NAS count value is equal to the threshold value. If yes, step 203 is performed; otherwise, step 201 is performed.
  • Step 203 The MME detects whether the locally saved security context includes a non-current security context in addition to the current security context. If yes, step 204 is performed; otherwise, the EPS AKA process is triggered.
  • Step 204 Activate the non-current security context.
  • the above non-current security context can be activated by successfully running the NAS SMC process.
  • the successfully running NAS SMC process includes: The MME uses the security context to perform integrity protection on the NAS SMC message, and when the UE successfully authenticates the NAS SMC message integrity, sends the NAS to the MME. The Security Mode Complete message, the MME decrypts the NAS security mode completion message and performs integrity verification. The MME can then learn to share this security context with the UE and the security context is activated. Therefore, step 204 activates the non-current security context by successfully executing the NAS SMC process described above.
  • the MME triggers the EPS A A process.
  • the non-current local security context may include a non-current partial local security context or a non-current full local security context.
  • the foregoing step 204 may be: the MME activates a non-current partial local security context or a non-current complete local security context.
  • the non-current local security context shared by the MME and the UE is activated by successfully running the NAS SMC process triggered by the MME.
  • the MME does not receive the NAS security mode complete message returned by the UE, the MME triggers the EPS AKA procedure.
  • the MME learns that the MME and the UMTS Subscriber Identity Module Integrated Circuit Card (UICC) have saved a set of non-currents by detecting the security context.
  • the MME activates the non-current partial security context, at which point the NAS count value is initialized to 0, thus eliminating the EPS AKA procedure.
  • UICC UMTS Subscriber Identity Module Integrated Circuit Card
  • the MME does not immediately trigger the EPS AKA process in this scenario, which avoids the waste of non-current part of the security context resources, and also avoids the resource consumption caused by performing the unnecessary EPS AKA process.
  • the UE establishes the current security context in the process of accessing the EPS, and then the UE switches from the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) to the universal terrestrial radio access network.
  • E-UTRAN Evolved Universal Terrestrial Radio Access Network
  • GSMRAN GSM / EDGE Radio Access Network
  • the MME when the MME detects that the NAS count value is close to the maximum value, the MME learns that the non-current complete security context is saved locally by detecting the security context, and the MME activates the non-current complete security context, thus eliminating the EPS AA. Process.
  • the MME does not immediately trigger the EPS A A process in this scenario, which avoids the waste of the previously saved non-current complete security context resources, and also avoids the resource consumption caused by performing the unnecessary EPS AKA process.
  • the MME does not trigger the EPS AKA process as soon as it detects that the NAS count value is about to wrap, which reduces the number of times the EPS AKA process is triggered, avoids the resource consumption caused by triggering the unnecessary EPS AKA process, and saves resources. .
  • FIG. 3 is a flowchart of a method for processing authentication according to Embodiment 3 of the present invention.
  • the local information is a timer state.
  • a timer is preset on the MME, and the state of the timer may be running and stopping.
  • the count value of the NAS counter reaches the threshold and the EPS AKA process is successfully completed, the state of the timer is turned to run; when the timer time reaches the set time threshold, the state of the timer is stopped.
  • the embodiment specifically includes the following steps:
  • Step 301 The MME receives the NAS message, and the NAS count value is incremented by one.
  • Step 302 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 303; otherwise, performs step 301.
  • a value close to the maximum value is preset as a threshold value. If the value is 2 24 -100, the MME detects whether the NAS count value is equal to 2 24 -100. If yes, step 303 is performed; otherwise, the step is performed. 301.
  • Step 303 The MME detects whether the timer status is running, and if yes, performs step 304; otherwise, triggers the EPS AKA process.
  • Step 304 Activate a non-current security context.
  • the non-current security context is activated by a successful NAS SMC process run.
  • a successful NAS SMC process includes: The MME uses the security context to perform integrity protection on the NAS SMC message. When the UE successfully authenticates the NAS SMC message integrity, the NAS sends a NAS security mode complete message to the MME, and the MME decrypts the NAS security mode complete message and performs the message. Integrity verification. The MME can then learn to share this security context with the UE and the security context is activated. Thus step 304 activates the non-current local security context by successfully executing the NAS SMC process described above.
  • the MME triggers the EPS AKA process.
  • the downlink NAS count value and the uplink NAS count value are generally not much different.
  • the MME detects that the downlink NAS count value is about to wrap around, the uplink NAS count value will soon be detected to be around; and the MME triggers the EPS AKA process.
  • the MME triggers the NAS SMC process, and by executing the NAS SMC process, the NAS count value is initialized to zero. If the MME detects that the downlink NAS count value is about to wrap around, the MME triggers the EPS AKA procedure, and before detecting that the uplink NAS count value is about to wrap, the NAS SMC process is not triggered to activate the newly generated security context, and the NAS count value is not present.
  • the prior art detects that the upstream NAS count value is about to wrap and triggers the EPS AKA process again.
  • the time from the last successful completion of the EPS AKA process has reached the set time threshold, which is successfully completed according to the EPS AKA process to the triggering of the NAS SMC.
  • the MME triggers the NAS SMC process; when the current NAS count value is close to the maximum distance
  • the MME triggers the EPS AKA process.
  • FIG. 4 is a flowchart of a method for processing authentication according to Embodiment 4 of the present invention.
  • the local information is a state machine state.
  • the state machine needs to be preset in the MME, and the state of the state machine may be running and stopping. Specifically, the operation may be represented by 0, and the stop may be indicated by 1.
  • the operation indicates that the time from the last EPS AKA process is successfully completed is less than the set time threshold, and the stop indicates that the time from the last EPS AKA process is successfully completed is greater than or equal to the set time threshold.
  • the state machine can be triggered by a timer.
  • the embodiment specifically includes the following steps:
  • Step 401 The MME receives the NAS message, and the NAS count value is increased by 1.
  • Step 402 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 403; otherwise, performs step 401.
  • a value close to the maximum value is preset as a threshold value, and if it is set to 2 24 -100, the MME detects whether the NAS count value is equal to 2 24 -100, and if yes, performs step 403; otherwise, triggers EPS.
  • AKA process a value close to the maximum value is preset as a threshold value, and if it is set to 2 24 -100, the MME detects whether the NAS count value is equal to 2 24 -100, and if yes, performs step 403; otherwise, triggers EPS. AKA process.
  • Step 403 The MME detects whether the status of the status is 0. If yes, step 404 is performed; otherwise, the EPS A A process is triggered.
  • Step 404 Activate a non-current security context.
  • the non-current security context is activated by a successful NAS SMC process run.
  • a successful NAS SMC process includes: The MME uses the security context to perform integrity protection on the NAS SMC message.
  • the NAS sends a NAS security mode complete message to the MME, and the MME decrypts the NAS security mode completion message and performs Integrity verification.
  • the MME can learn to share this security context with the UE, and the security context is activated. Therefore, step 404 activates the non-current local security context by successfully executing the NAS SMC process described above.
  • the MME triggers the EPS AKA process.
  • the downlink NAS count value and the uplink NAS count value are generally not much different.
  • the MME detects that the downlink NAS count value is about to wrap around, the uplink will be detected soon.
  • the NAS count value is about to wrap around; and, after the MME triggers the EPS AKA process, the MME triggers the NAS SMC process, and the NAS count value is initialized to 0 by executing the NAS SMC process.
  • the MME detects that the downlink NAS count value is about to wrap around, the MME triggers the EPS AKA procedure, and before detecting that the uplink NAS count value is about to wrap, the NAS SMC is not triggered, and the NAS count value is not initialized, then the prior art It is detected that the upstream NAS count value is about to wrap, and the EPS AKA process is triggered again.
  • the state of the state it can be known whether the time from the last successful completion of the EPS AKA process has reached the set time threshold, which is successfully completed according to the EPS AKA process to the triggering of the NAS SMC.
  • the MME Time to determine, when the current NAS count value is close to the maximum distance from the last EPS AKA process successfully completed less than the set time threshold, the MME triggers the NAS SMC; when the current NAS count value is close to the maximum distance
  • the MME triggers the EPS AKA process. Therefore, in the scenario of the above-mentioned practical application, the embodiment avoids triggering the EPS AKA process again after detecting that the uplink NAS count value is about to wrap, and the EPS AKA process is triggered again, thereby reducing the number of EPS AKA processes and avoiding the cause.
  • the resource consumption caused by the unnecessary EPS AKA process is triggered, saving resources.
  • FIG. 5 is a flowchart of a method for processing authentication according to Embodiment 5 of the present invention.
  • the local information in this embodiment is the current service type, Quality of Service (QoS), or the ability of the user equipment to perform authentication.
  • QoS Quality of Service
  • the embodiment specifically includes the following steps:
  • Step 501 The MME receives the NAS message, and the NAS count value is incremented by one.
  • Step 502 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 503; otherwise, performs step 501.
  • a value close to the maximum value may be preset as a threshold value, and the MME detects whether the NAS count value is equal to the threshold value. If yes, step 503 is performed; otherwise, step 501 is performed.
  • Step 503 The MME detects, by detecting the current service type, whether the current service requested by the UE corresponding to the current service type is a service that needs to be authenticated; or, the MME detects the QoS. Detecting whether the current service requested by the UE corresponding to the QoS is a service that needs to be authenticated; or, the MME detects whether the UE has the capability of performing an EPS AKA process by detecting the capability of the UE to perform authentication;
  • step 504 is performed.
  • Step 504 Continue to use the current security context, or do not perform security protection on the current service, or interrupt the connection of the current service.
  • the present embodiment detects that the service requested by the UE is an emergency call (EMC) service, and detects that the service requested by the UE is not a service that needs to be authenticated, and the EPS AKA is no longer triggered.
  • EMC emergency call
  • the process while ignoring the detection result that the NAS count value is close to the maximum value, can continue to use the current security context, or not secure the current service, or interrupt the connection of the current service.
  • the MME receives the General Packet Radio Service (GPRS) service support node (Service GPRS).
  • GPRS General Packet Radio Service
  • Support Node abbreviation: SGSN
  • Kc security parameter
  • K ASME encryption key
  • IK Integrity Key
  • the NAS count value starts at 0.
  • the security protection of the UE in the LTE network is protected by the subkey derived from K ASME .
  • the MME may detect that the UE is a SIM card user according to Kc, and does not have the capability of performing the EPS AKA process, the MME does not trigger the EPS AKA process, and ignores the detection result that the NAS count value is close to the maximum value. You can continue to use the current security context, or do not secure the current service, or interrupt the connection of the current service.
  • the EPS AKA process when the service requested by the UE is not the service that needs to be authenticated or the UE does not have the capability of performing the authentication and key negotiation process, the EPS AKA process is not triggered, the number of EPS AKA processes is reduced, and the unnecessary triggering is avoided.
  • the resource consumption caused by the EPS AKA process saves resources.
  • FIG. 6 is a flowchart of a method for processing authentication according to Embodiment 6 of the present invention. As shown in Figure 6, this implementation The example specifically includes the following steps:
  • Step 601 The MME receives the NAS message, and the NAS count value is incremented by one.
  • Step 602 The MME detects whether the NAS count value is close to the maximum value. If yes, step 603 is performed; otherwise, step 601 is performed.
  • the NAS count value may be an uplink NAS count value or a downlink NAS count value.
  • a value close to the maximum value may be preset as a threshold value, and the MME detects whether the NAS count value is equal to the threshold value. If yes, step 603 is performed; otherwise, step 601 is performed.
  • Step 603 The MME triggers the EPS AKA process, and the MME triggers the NAS SMC to activate the security context generated by the AKA process, and the NAS count value is initialized to 0.
  • the EPS AKA process is bound to the execution of the NAS SMC, so that the NAS count value is about to wrap around in different directions (upstream direction and downlink direction), and the EPS AKA process is repeatedly triggered, and the number of EPS AKA processes is reduced. , avoiding resource consumption caused by triggering unnecessary EPS AKA process and saving resources.
  • FIG. 7 is a flowchart of a method for processing authentication according to Embodiment 7 of the present invention. As shown in FIG. 7, the embodiment specifically includes the following steps:
  • Step 801 The MME initiates an EPS AKA process.
  • Step 802 In case the failure of the EPS AKA process is performed, the connection is released or the current service is continued according to the local information and the network policy.
  • the MME initiates the EPS AKA process, which may be performed under various conditions, for example: when the NAS count value is close to the maximum value, the MME initiates the EPS AKA process; and the EPS AKA process may also be triggered by the operator's policy.
  • the operator may set a certain current policy, and the MME may trigger the EPS AKA of the UE under the UE, which may be a policy formulated by the operator based on a certain security policy or other requirements;
  • the EPS AKA procedure is triggered, specifically, when the UE switches from a network with a lower security level (such as a GSM or UMTS network) (including active state switching and idle state mobility) to a network with a higher security level (such as an LTE network).
  • the EPS AKA process is triggered by the network side.
  • the local information may include at least one of the following information: current service type, quality of service, The user device's ability to perform authentication, network policy, user identification module type, or information about whether the user device is plugged into the card.
  • the current service type indicates the type information of the current service, and the MME can determine whether the current service is a service that needs to be authenticated according to the current service type.
  • the QoS can identify services that do not need to be authenticated. Therefore, the MME can also determine whether the current service is a service that needs to be authenticated according to the quality of service.
  • the UE's ability to perform authentication indicates whether the UE has relevant information for performing the EP SAA, and the MME may determine whether the UE has the capability to perform EPS AKA according to the UE's ability to perform authentication.
  • the SIM card type also indicates whether the UE has relevant information for the ability to perform EPS AKA, and the MME can determine whether the UE has the capability to perform EPS AKA according to the SIM card type. Since the authentication needs to be performed when the UE inserts the card, for example, if the EPS AKA process fails after the UE inserts the card, the NAS signaling connection should be released; if the UE does not insert the card, it is determined according to the network policy whether to release the connection.
  • a network policy is a policy set by a network side device, which can support whether the current service is authenticated.
  • the foregoing step 802 may specifically include: if the MME determines that the network policy does not support the current service without authentication, the MME releases the connection of the current service;
  • the MME determines that the current service is not authenticated by the network policy, and the MME determines that the current service is a service that does not need to be authenticated according to the current service type or the quality of service in the local information, or if the MME performs authentication according to the user equipment in the local information.
  • the capability or the user identification module type determines that the user equipment does not have the capability to perform the authentication and key agreement process, or the user equipment does not insert the card, and then continues to execute the current service;
  • the MME determines whether the current service is a service that needs to be authenticated according to the current service type or the service quality in the local information, or the MME performs the authentication according to the user equipment in the local information. Or the user identification module type determines that the user equipment has the ability to perform the authentication and key agreement process, or if the user equipment has an insertion card, the connection of the current service is released.
  • the MME determines that the network policy supports the current service
  • the MME detects that the service requested by the UE is an EMC service or a public alarm service by detecting the current service type. Since the EMC service or public alarm service is not a service that requires authentication, and the network policy supports unauthenticated EMC or public alarm services, the MME and the UE continue to perform the current service.
  • the connection of the current service can be released by releasing the NAS signaling connection. If the NAS signaling connection carries multiple services and determines that the multiple current services need to be authenticated according to the current service type, the NAS signaling connection is released. If the service that requires authentication and the service that does not require authentication (such as EMC) are currently available, the EPS bearer corresponding to the service that needs to be authenticated is released, and the EPS bearer (such as EMC bearer) of the service that does not require authentication is maintained.
  • EMC EMC bearer
  • the authentication fails, the service requested by the UE is not the service that needs to be authenticated, or the UE does not have the capability to perform the EPS AKA process, or the user equipment does not insert the card, and the network policy supports the current service without authentication, and can continue to execute the current
  • the business avoids the interruption of the current business execution and saves the resources of the system.
  • FIG. 8 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 8 of the present invention.
  • the embodiment specifically includes a detection module 11 and a processing module 12.
  • the detecting module 11 is configured to detect local information when the non-access stratum count value is close to the maximum value
  • the processing module 12 is configured to determine, according to the detection result, whether to trigger an authentication and key agreement process with the UE.
  • the authentication processing apparatus provided in this embodiment can operate according to the method provided in the first embodiment.
  • FIG. 9 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 9 of the present invention.
  • the local information is a security context
  • the processing module 12 includes a first activation unit 21 and a first trigger unit 22.
  • the first activation unit 21 is configured to activate a non-current security context when the detection module 11 determines that the security context includes a non-current security context.
  • the first triggering unit 22 is configured to: when the detection module 11 determines that the security context does not include a non-current security context, The authentication and key negotiation process is triggered.
  • the processing module 12 of this embodiment may further include a transceiver unit 23, configured to send a NAS SMC to the UE, and receive a message that the NAS security mode is successfully executed, to the processing module.
  • the first activation unit 21 of 12 transmits information that triggers its action.
  • the first activation unit 21 activates the non-current security context according to the trigger information.
  • the transceiver unit 23 does not receive the message that the NAS security mode returned by the UE is successful, the first trigger unit 22 triggers the authentication and key agreement procedure.
  • the authentication processing apparatus provided in this embodiment can operate according to the method provided in the second embodiment.
  • FIG. 10 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 10 of the present invention.
  • the local information is a timer state
  • the processing module 12 specifically includes a second activation unit 31 and a second trigger unit 32.
  • the second activation unit 31 is configured to activate a non-current security context when the detection module 11 detects that the timer state is running.
  • the second triggering unit 32 is configured to trigger the authentication when the detection module 11 detects that the timer state is stopped. And key negotiation process.
  • the processing module 12 of the embodiment may further include a transceiver unit 33, configured to send a NAS SMC to the UE, and receive a message that the NAS security mode is successfully executed, and send the message to the second activation unit 31 in the processing module 12.
  • the second activation unit 31 activates the non-current security context based on the trigger information.
  • the transceiver unit 33 does not receive the message that the NAS security mode returned by the UE is successful, the second trigger unit 32 triggers the authentication and key agreement procedure.
  • the authentication processing apparatus provided in this embodiment can operate according to the method provided in the third embodiment.
  • FIG. 11 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 11 of the present invention.
  • the local information is a state state
  • the processing module 12 specifically includes a third activation unit 41 and a third trigger unit 42.
  • the third activation unit 41 is configured to activate a non-current security context when the detection module 11 detects that the state state is running.
  • the third triggering unit 42 is configured to trigger the authentication when the detection module 11 detects that the state state is stopped. And key negotiation process.
  • the processing module 12 of this embodiment may further include a transceiver unit 43 configured to send a NAS SMC to the UE, and receive a message that the NAS security mode is successfully executed.
  • the third activation unit 41 in the processing module 12 sends information triggering its action. Third activation unit
  • the third trigger unit 42 triggers the authentication and key agreement procedure.
  • the authentication processing apparatus provided in this embodiment can operate in accordance with the method provided in the fourth embodiment.
  • FIG. 12 is a schematic structural diagram of an apparatus for processing an authentication according to Embodiment 12 of the present invention.
  • the local information is the current service type, or the quality of service, or the capability of the user equipment to perform authentication
  • the processing module 12 specifically includes a fourth trigger unit 51 and processing. Unit 52.
  • the fourth triggering unit 51 is configured to: if the detecting module 11 determines that the service corresponding to the current service type is a service that needs to be authenticated, or determines that the service corresponding to the service quality is a service that needs to be authenticated, or determines that the capability of the user equipment to perform the authentication has performed.
  • the ability to authenticate and key negotiation processes triggers the authentication and key negotiation process.
  • the processing unit 52 is configured to: if the detecting module 11 determines that the service corresponding to the current service type is not the service that needs to be authenticated, or determines that the service corresponding to the service quality is not the service that needs to be authenticated, or determines that the capability of the user equipment to perform the authentication does not have the execution authentication and The ability of the key negotiation process continues to use the current security context, or does not protect the current service; or interrupts the connection of the current service.
  • the authentication processing apparatus provided in this embodiment can operate according to the method provided in the above fifth embodiment.
  • the EPS AKA process is triggered immediately upon detecting that the NAS count value is about to wrap, which reduces the number of times the EPS AKA process is triggered, avoids the resource consumption caused by triggering the unnecessary EPS AKA process, and saves resources. .
  • FIG. 13 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 13 of the present invention.
  • the embodiment specifically includes an execution module 61 and a processing module 62.
  • the execution module 61 is configured to perform an authentication and a key agreement process.
  • the processing module 62 is configured to: when the execution module 61 performs the authentication and the key negotiation process fails, decide to release the connection or continue to perform the current service according to the local information and the network policy.
  • the embodiment may further include a triggering module 63, where the triggering module 63 is configured to trigger the execution module 61 to execute under the trigger condition that the non-access stratum count value is close to the maximum value, the operator policy, or the user equipment performs inter-network handover. Authentication and key negotiation process.
  • the above processing module 62 may further include: a first determining unit 64, a first releasing unit 65, a second determining unit 66, a second releasing unit 67, and an executing unit 68.
  • the first determining unit 64 is configured to determine, in the case that the execution module 61 fails to perform the authentication and the key agreement process, whether the network policy supports the current service without authentication.
  • the first releasing unit 65 is configured to determine, by the first determining unit 64, that If no, the connection of the current service is released.
  • the second determining unit 66 is configured to determine, according to the current service type or the quality of service in the local information, whether the current service needs to be authenticated, if the first determining unit 64 determines that it is YES.
  • the second release unit 67 is used to release the connection of the current service when the second determination unit 66 determines YES; and the execution unit 68 is configured to continue to execute the current service if the second determination unit 66 determines to be NO.
  • the authentication processing apparatus provided in this embodiment can operate according to the method provided in the above-mentioned Embodiment 7.
  • the authentication fails, the service requested by the UE is not the service that needs to be authenticated, or the UE does not have the capability to perform the EPS AKA process, or the user equipment does not insert the card, and the network policy supports the current service without authentication, and can continue to execute the current
  • the business avoids the interruption of the current business execution and saves the resources of the system.
  • the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Communication Control (AREA)
  • Computer And Data Communications (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

i人证处理方法 置 本申请要求于 2009 年 9 月 21 日提交中国专利局、 申请号为 200910093828.5、发明名称为"认证处理方法及装置 "的中国专利申请的优先 权， 其全部内容通过引用结合在本申请中。 技术领域 本发明实施例涉及通信领域， 尤其涉及一种认证处理方法及装置。
背景技术 非接入层（Non-Access Stratum, 简称： NAS )计数（COUNT )是长期 演进（ Long Term Evolution， 简称： LTE ) 系统中安全上下文的一部分。 在 LTE系统中， NAS计数可作为密钥的生命周期， 使密钥具有新鲜性； 同时， NAS计数可以保证用户设备（ User Equipment， 简称： UE ) 与网络侧密钥 的同步， 具有抗重放攻击的作用。 每一套演进分组系统 （Evolved Packet System, 简称： EPS )安全上下文包含两个独立的 NAS计数值： 上行 NAS 计数值和下行 NAS计数值。这两个 NAS计数的计数器分别由 UE和移动管 理实体 （Mobility Management Entity, 简称： MME ) 来独立维护。
NAS计数有 32位，主要由两个部分组成： NAS序列号（ SQN )与 NAS 溢出值 （OVERFLOW ), 其中 NAS序列号为 8位， NAS溢出值为 16位。 NAS序列号承载于每条 NAS消息中， 当每一个新的或是重传的受到安全保 护的 NAS消息发出后， 发送端将会将 NAS序列号的值增加 1； 当 NAS序 列号增加到最大值， 循环一圏时， NAS溢出值增加 1。
现有技术中， 当 MME检测到下行的 NAS计数值即将环绕的时候， 也 就是 NAS计数值比较接近最大值 224时， MME将会触发一个新的 EPS认 证和密钥协商 ( Authentication and Key Agreement, 简称： AKA ) 流程， 建 立新的安全上下文，并且当安全上下文被激活时将 NAS计数值初始化为 0。 当 MME检测到 UE的上行 NAS计数值也接近到最大值时， 也就是即将环 绕时， MME会触发 EPS AKA流程。
现有技术如果执行 EPS AKA流程认证失败， 就立即释放连接。 这种安 全处理过程浪费了资源。
发明内容 本发明实施例提供了一种认证处理方法及装置， 用以节省资源。
本发明实施例提供了另一种认证处理方法， 包括：
在对用户设备执行认证和密钥协商流程失败的情况下， 无线通信网络 侧设备确定网络策略是否支持当前业务不认证，
若所述网络策略支持当前业务不认证， 且所述当前业务为不需要进行 认证的业务， 则继续执行所述当前业务； 或者
若所述网络策略支持当前业务不认证， 且所述用户设备不具有执行认 证和密钥协商流程的能力， 则继续执行所述当前业务； 或者
若所述网络策略支持当前业务不认证， 且所述用户设备无插入卡， 则 继续执行所述当前业务。
本发明实施例提供了另一种认证处理装置， 包括：
执行模块， 用于执行认证和密钥协商流程；
处理模块， 位于无线通信网络侧设备内， 包括：
第一判断单元， 用于在对用户设备执行认证和密钥协商流程失败的情 况下， 确定网络策略是否支持当前业务不认证，
第二判断单元， 用于在所述网络策略支持当前业务不认证的情况下， 确定所述当前业务是否是需要进行认证的业务， 或者所述用户设备是否具 有执行认证和密钥协商流程的能力， 或者所述用户设备是否具有插入卡； 执行单元， 用于在所述第二判断单元判断为所述当前业务是不需要进 行认证的业务， 或者所述用户设备不具有执行认证和密钥协商流程的能力， 或者所述用户设备不具有插入卡的情况下况下， 继续执行所述当前业务。 本发明实施例中， 如果执行 EPS AKA流程认证失败， 不会立即释放连 接， 而是根据本地信息及网络策略释放连接或者继续执行当前业务， 避免 了释放没有必要进行释放的连接， 节省了资源。
附图说明 图 1为本发明实施例一认证处理方法的流程图
图 2为本发明实施例二认证处理方法的流程图
图 3为本发明实施例三认证处理方法的流程图
图 4为本发明实施例四认证处理方法的流程图
图 5为本发明实施例五认证处理方法的流程图
图 6为本发明实施例六认证处理方法的流程图
图 7为本发明实施例七认证处理方法的流程图
图 8为本发明实施例八认证处理装置的结构示意图；
图 9为本发明实施例九认证处理装置的结构示意图；
图 10为本发明实施例十认证处理装置的结构示意图；
图 11为本发明实施例十一认证处理装置的结构示意图；
图 12为本发明实施例十二认证处理装置的结构示意图；
图 13为本发明实施例十三认证处理装置的结构示意图。
具体实施方式 下面通过附图和实施例， 对本发明实施例的技术方案做进一步的详细 描述。
图 1为本发明实施例一认证处理方法的流程图。 如图 1所示， 本实施 例具体包括如下步骤： 步骤 101、 当非接入层计数值接近最大值时， 对本地信息进行检测； 步骤 102、根据本地信息决定是否触发与用户设备之间的认证和密钥协 商流程。
其中 NAS计数值接近最大值即为 NAS计数值即将环绕的时候， 认证 和密钥协商流程可以为 EPS AKA流程。
上述两步骤的执行主体可以为 MME, 当下行或上行的 NAS计数值即 将环绕的时候， MME 对本地信息进行检测， 根据检测结果决定是否触发 EPS AKA流程。
以检测上行的 NAS计数值为例， MME接收 NAS消息， NAS计数值加 1； MME检测 NAS计数值是否接近最大值， 具体地， MME可以检测 NAS 计数值是否等于门限值， 该门限值为预先设定的接近最大值的数值； 若是， 则对本地信息进行检测， 根据检测结果决定是否触发认证和密钥协商流程； 否则， 继续接收 NAS消息。
本实施例中 MME不会一旦检测到 NAS计数值即将环绕， 就立即触发 EPS AKA流程， 减少了触发 EPS AKA流程的次数， 避免了因触发没有必 要的 EPS AKA流程导致的资源耗费， 节省了资源。
下面在描述实施例二之前， 预先介绍与实施例二相关的技术。
在 LTE系统中， EPS安全上下文有两种划分方式。按照使用状态， EPS 安全上下文可以分为当前 EPS安全上下文 ( current EPS security context )和 非当前 EPS安全上下文 （ non-current EPS security context )。 其中当前 EPS 安全上下文是指最新被激活的安全上下文， 即当前正在使用的安全上下文。 上述当前正在使用的安全上下文可以与一套非当前本地 EPS 安全上下文 ( non-current native EPS security context ) 同时存在。 按照生成方式， EPS 安全上下文可以分为映射 EPS安全上下文 ( mapped EPS security context ) 和本地 EPS安全上下文 ( native EPS security context )。 其中映射 EPS安全 上下文是指从其他系统映射过来的安全上下文， 如从通用移动通信系统 ( Universal Mobile Telecommunications System, 简称： UMTS )映射到 LTE 系统。 本地 EPS安全上下文是指在 LTE系统中 , 经过 EPS AKA生成的安 全上下文。 其中本地 EPS 安全上下文又分为部分本地 EPS 安全上下文 ( partial native EPS security context )和完整本地 EPS安全上下文（ full native EPS security context ). 其主要区别是部分本地 EPS安全上下文没有经过一 个成功的 NAS安全模式流程运行，因此在部分本地 EPS安全上下文中只包 含 UE接入 LTE网络中认证的根密钥 KASME 、密钥集标识（ Key Set Identity, 简称： KSI )、 UE的安全能力以及设置为 0的 NAS计数值； 而完整本地 EPS 安全上下文是经过 EPS AKA 流程之后由一个成功的 NAS 安全模式命令 ( Security Mode Command， 简称： SMC ) 流程激活的安全上下文， 其包含 一套完整 EPS NAS安全上下文， 因此完整本地 EPS安全上下文会额外包含 NAS层的完整性密钥 KNASmt 、加密密钥 KNASenc 以及所选的 NAS加密算法 和完整性算法标识。
图 2 为本发明实施例二认证处理方法的流程图。 本实施例中本地信息 为本地保存的安全上下文， 下述安全上下文均为本地 EPS安全上下文。
如图 2所示， 本实施例具体包括如下步骤：
步骤 201、 MME接收 NAS消息， NAS计数值加 1。
步骤 202、 MME检测 NAS计数值是否接近最大值， 若是， 则执行步 骤 203; 否则执行步骤 201。
具体地， 可以预先设定一接近最大值的数值作为门限值， MME检测 NAS计数值是否等于门限值， 若是， 则执行步骤 203 ; 否则执行步骤 201。
步骤 203、 MME检测本地保存的安全上下文除了当前安全上下文以外， 是否还包括非当前安全上下文， 若是， 则执行步骤 204; 否则触发 EPS AKA 流程。
步骤 204、 激活该非当前安全上下文。
上述非当前安全上下文可通过成功运行 NAS SMC流程来激活。 成功 运行的 NAS SMC流程包括： MME使用安全上下文对 NAS SMC消息进行 完整性保护， 当 UE对 NAS SMC消息完整性验证成功， 向 MME发送 NAS 安全模式完成（ Security Mode Complete ) 消息， MME解密 NAS安全模式 完成消息并进行完整性验证。 则 MME可以获知与 UE共享此安全上下文， 且该安全上下文被激活。 因此步骤 204通过成功执行上述 NAS SMC流程， 激活非当前安全上下文。
进一步的，如果上述 NAS SMC流程运行失败，则 MME触发 EPS A A 流程。
上述非当前本地安全上下文可以包括非当前部分本地安全上下文或非 当前完整本地安全上下文， 上述步骤 204可以为： MME激活非当前部分本 地安全上下文或非当前完整本地安全上下文。
本实施例中， 通过成功运行 MME触发的 NAS SMC流程， MME与 UE共享的非当前本地安全上下文被激活。当 MME没有收到 UE返回的 NAS 安全模式完成消息时， MME触发 EPS AKA流程。
下面通过两个具体的例子， 说明本实施例的应用场景。
( 1 )当 MME检测到 NAS计数值接近最大值时， MME通过检测安全 上下文获知 MME和 UMTS用户身份模块集成电路卡 （UMTS Subscriber Identity Module Integrated Circuit Card, 简称： UICC ) 中保存了一套非当前 部分安全上下文， MME激活该非当前部分安全上下文， 此时 NAS计数值 被初始化为 0， 这样省去了 EPS AKA流程。
与现有技术相比， 该场景中 MME没有立即触发 EPS AKA流程， 避免 了非当前部分安全上下文资源的浪费，同时也避免了因执行没有必要的 EPS AKA流程而造成的资源耗费。
( 2 ) UE在接入 EPS的过程中建立了当前安全上下文， 之后 UE在从 演进通用地面无线接入网络 ( Evolved Universal Terrestrial Radio Access Network， 简称： E-UTRAN ) 切换到通用地面无线接入网络 （ Universal Terrestrial Radio Access Network, 简称： UTRAN )或 GSM / EDGE 无线通 讯网络（GSM EDGE Radio Access Network, 简称： GERAN ) 的过程中保 存这套在 E-UTRAN中生成的本地安全上下文； 然后， 当该 UE再切换回到 E-UTRAN中时， 使用的是映射安全上下文， 该映射安全上下文成为当前安 全上下文，之前 UE和 MME保存的在 E-UTRAN网络中生成的安全上下文 成为非当前完整安全上下文。 在这种场景下， 当 MME检测到 NAS计数值 接近最大值时， MME通过检测安全上下文获知本地保存有该非当前完整安 全上下文， 则 MME激活该非当前完整安全上下文， 这样省去了 EPS A A 流程。
与现有技术相比， 该场景中 MME没有立即触发 EPS A A流程， 避免 了之前保存的非当前完整安全上下文资源的浪费， 同时也避免了因执行没 有必要的 EPS AKA流程而造成的资源耗费。
本实施例中 MME不会一旦检测到 NAS计数值即将环绕， 就立即触发 EPS AKA流程， 减少了触发 EPS AKA流程的次数， 避免了因触发没有必 要的 EPS AKA流程导致的资源耗费， 节省了资源。
图 3 为本发明实施例三认证处理方法的流程图。 本实施例中本地信息 为定时器状态。 本实施例中， MME上预先设置了一定时器， 该定时器的状 态可以为运行和停止。 当 NAS计数器的计数值到达门限值且 EPS AKA流 程成功完成时， 定时器的状态转为运行； 当定时器的定时时间到达设定的 时间门限值时， 定时器的状态转为停止。
如图 3所示， 本实施例具体包括如下步骤：
步骤 301、 MME接收 NAS消息， NAS计数值加 1。
步骤 302、 MME检测 NAS计数值是否接近最大值， 若是， 则执行步骤 303; 否则执行步骤 301。
具体地， 本实施例预先设定一接近最大值的数值作为门限值， 如设为 224-100, MME检测 NAS计数值是否等于 224-100， 若是， 则执行步骤 303; 否则执行步骤 301。
步骤 303、 MME检测定时器状态是否为运行， 若是， 则执行步骤 304; 否则触发 EPS AKA流程。
步骤 304、 激活非当前安全上下文。 所述该非当前安全上下文是由一个成功的 NAS SMC流程运行激活的。 一个成功的 NAS SMC流程包括： MME使用安全上下文对 NAS SMC消息 进行完整性保护， 当 UE对 NAS SMC消息完整性验证成功， 向 MME发送 NAS 安全模式完成消息， MME解密 NAS安全模式完成消息并进行完整性 验证。则 MME可以获知与 UE共享此安全上下文，且该安全上下文被激活。 因此步骤 304通过成功执行上述 NAS SMC流程，激活非当前本地安全上下 文。
进一步的，如果上述 NAS SMC流程运行失败，则 MME触发 EPS AKA 流程。
在实际应用中， 下行 NAS计数值和上行 NAS计数值一般相差不大， 当 MME检测到下行 NAS 计数值即将环绕时， 不久之后即将检测到上行 NAS计数值即将环绕； 并且， MME触发 EPS AKA流程之后隔一段时间， MME触发 NAS SMC流程， 通过执行 NAS SMC流程， NAS计数值被初始 化为 0。 如果当 MME检测到下行 NAS计数值即将环绕时， MME就触发 EPS AKA流程，而在检测到上行 NAS计数值即将环绕之前，没有触发 NAS SMC流程激活新产生的安全上下文，此时 NAS计数值没有被初始化，那么 现有技术检测到上行 NAS计数值即将环绕， 又会再次触发 EPS AKA流程。 本实施例通过检测定时器状态可以获知距离上次 EPS AKA流程成功完成的 时间是否已经到达设定的时间门限值， 该时间门限值是根据 EPS AKA流程 成功完成到触发 NAS SMC之间的时间来确定的， 当本次 NAS计数值接近 最大值距离上次 EPS AKA流程成功完成的时间小于设定的时间门限值时， MME触发 NAS SMC流程； 当本次 NAS计数值接近最大值距离上次 EP S A A流程成功完成的时间大于或等于设定的时间门限值时， MME触发 EPS AKA流程。 因此， 针对上述实际应用的场景， 本实施例避免了在检测到上 行 NAS计数值即将环绕之前， 没有触发 NAS SMC流程， 就又会再次触发 EPS AKA流程， 减少了 EPS AKA流程的次数， 避免了因触发没有必要的 EPS AKA流程导致的资源耗费， 节省了资源。 图 4 为本发明实施例四认证处理方法的流程图。 本实施例中本地信息 为状态器状态。 本实施例中， MME上需预先设置状态器， 该状态器的状态 可以为运行和停止， 具体地， 可以用 0来表示运行， 可以用 1来表示停止。 其中，运行表示距离上次 EPS AKA流程成功完成的时间小于设定的时间门 限值， 停止表示距离上次 EPS AKA流程成功完成的时间大于或等于设定的 时间门限值。 状态器可以由定时器来触发。
如图 4所示， 本实施例具体包括如下步骤：
步骤 401、 MME接收 NAS消息， NAS计数值加 1。
步骤 402、 MME检测 NAS计数值是否接近最大值， 若是， 则执行步骤 403; 否则执行步骤 401。
具体地， 本实施例预先设定一接近最大值的数值作为门限值， 如设为 224-100, MME检测 NAS计数值是否等于 224-100, 若是， 则执行步骤 403; 否则触发 EPS AKA流程。
步骤 403、 MME检测状态器状态是否为 0, 若是， 则执行步骤 404; 否 则触发 EPS A A流程。
步骤 404、 激活非当前安全上下文。
所述该非当前安全上下文是由一个成功的 NAS SMC流程运行激活的。 一个成功的 NAS SMC流程包括： MME使用安全上下文对 NAS SMC消息 进行完整性保护， 当 UE对 NAS SMC消息完整性验证成功， 向 MME发送 NAS 安全模式完成消息， MME解密 NAS 安全模式完成消息并进行完整性 验证。则 MME可以获知与 UE共享此安全上下文，且该安全上下文被激活。 因此步骤 404通过成功执行上述 NAS SMC流程，激活非当前本地安全上下 文。
进一步的，如果上述 NAS SMC流程运行失败，则 MME触发 EPS AKA 流程。
在实际应用中， 下行 NAS计数值和上行 NAS计数值一般相差不大， 当 MME检测到下行 NAS 计数值即将环绕时， 不久之后即将检测到上行 NAS计数值即将环绕； 并且， MME触发 EPS AKA流程之后隔一段时间 , MME触发 NAS SMC流程， 通过执行 NAS SMC流程， NAS计数值被初始 化为 0。 如果当 MME检测到下行 NAS计数值即将环绕时， MME就触发 EPS AKA流程，而在检测到上行 NAS计数值即将环绕之前，没有触发 NAS SMC, 此时 NAS计数值没有被初始化， 那么现有技术检测到上行 NAS计 数值即将环绕， 又会再次触发 EPS AKA流程。 本实施例通过检测状态器状 态可以获知距离上次 EPS AKA流程成功完成的时间是否已经到达设定的时 间门限值， 该时间门限值是根据 EPS AKA流程成功完成到触发 NAS SMC 之间的时间来确定的， 当本次 NAS计数值接近最大值距离上次 EPS AKA 流程成功完成的时间小于设定的时间门限值时， MME触发 NAS SMC； 当 本次 NAS计数值接近最大值距离上次 EPS AKA流程成功完成的时间大于 或等于设定的时间门限值时， MME触发 EPS AKA流程。 因此， 针对上述 实际应用的场景，本实施例避免了在检测到上行 NAS计数值即将环绕之前， 没有触发 NAS SMC, 就又会再次触发 EPS AKA流程， 减少了 EPS AKA流 程的次数， 避免了因触发没有必要的 EPS AKA流程导致的资源耗费， 节省 了资源。
图 5 为本发明实施例五认证处理方法的流程图。 本实施例中本地信息 为当前业务类型、 服务质量（Quality of Service, 简称： QoS )或用户设备 执行认证的能力。
如图 5所示， 本实施例具体包括如下步骤：
步骤 501、 MME接收 NAS消息， NAS计数值加 1。
步骤 502、 MME检测 NAS计数值是否接近最大值， 若是， 则执行步骤 503; 否则执行步骤 501。
具体地， 可以预先设定一接近最大值的数值作为门限值， MME检测 NAS计数值是否等于门限值， 若是， 则执行步骤 503 ; 否则执行步骤 501。
步骤 503、 MME通过检测当前业务类型，检测当前业务类型对应的 UE 请求的当前业务是否为需要进行认证的业务； 或者， MME通过检测 QoS, 检测 QoS对应的 UE请求的当前业务是否为需要进行认证的业务； 或者， MME通过检测 UE执行认证的能力，检测 UE是否具有执行 EPS AKA流程 的能力；
若是， 则触发 EPS AKA流程； 否则执行步骤 504。
步骤 504、 继续使用当前的安全上下文， 或者对当前业务不进行安全保 护， 或者中断当前业务的连接。
举例来说，本实施例通过检测当前业务类型获知 UE请求的业务为紧急 呼叫 （Emergency Call, 简称： EMC ) 业务， 则检测出 UE请求的业务不是 需要进行认证的业务， 则不再触发 EPS AKA流程， 而忽略 NAS计数值接 近最大值的检测结果， 可以继续使用当前的安全上下文， 或者对当前业务 不进行安全保护， 或者中断当前业务的连接。
当插入用户标识模块（ Subscriber Identity Module, 简称： SIM卡） 的 UE从 UMTS网络的紧急呼叫切换到 LTE 网络， MME从通用分组无线业 务（ General Packet Radio Service,简称： GPRS )服务支持节点（ Service GPRS Support Node, 简称： SGSN )得到安全参数 Kc， 并且进一步根据加密密钥 ( Cipher Key, 简称： CK ) 和完整性密钥 （ Integrity Key, 简称： IK )得到 KASME。 NAS计数值从 0开始。 此时， UE在 LTE 网络中的安全保护是由 KASME所派生的子密钥所保护的。 当 NAS计数值即将环绕时， MME可以 根据 Kc检测出 UE是 SIM卡用户， 不具有执行 EPS AKA流程的能力， 则 MME不再触发 EPS AKA流程，而忽略 NAS计数值接近最大值的检测结果， 可以继续使用当前的安全上下文， 或者对当前业务不进行安全保护， 或者 中断当前业务的连接。
本实施例在 UE请求的业务不是需要进行认证的业务或 UE不具有执行 认证和密钥协商流程的能力时， 不触发 EPS AKA流程， 减少了 EPS AKA 流程的次数， 避免了因触发没有必要的 EPS AKA流程导致的资源耗费， 节 省了资源。
图 6为本发明实施例六认证处理方法的流程图。 如图 6所示， 本实施 例具体包括如下步骤：
步骤 601、 MME接收 NAS消息， NAS计数值加 1。
步骤 602、 MME检测 NAS计数值是否接近最大值， 若是， 则执行步 骤 603; 否则执行步骤 601。 该 NAS计数值可以为上行 NAS计数值， 也可 以为下行 NAS计数值。
具体地， 可以预先设定一接近最大值的数值作为门限值， MME检测 NAS计数值是否等于门限值， 若是， 则执行步骤 603 ; 否则执行步骤 601。
步骤 603、 MME触发 EPS AKA流程， 同时 MME触发 NAS SMC， 激 活 AKA流程产生的安全上下文， NAS计数值被初始化为 0。
本实施例将 EPS AKA流程与 NAS SMC的执行绑定在一起， 避免了因 检测到不同方向 （上行方向和下行方向） NAS计数值即将环绕， 重复触发 EPS AKA流程， 减少了 EPS AKA流程的次数， 避免了因触发没有必要的 EPS AKA流程导致的资源耗费， 节省了资源。
图 7为本发明实施例七认证处理方法的流程图。 如图 7所示， 本实施 例具体包括如下步骤：
步骤 801、 MME发起 EPS AKA流程；
步骤 802、 在执行 EPS AKA流程失败的情况下， 根据本地信息及网络 策略决定释放连接或者继续执行当前业务。
进一步的， 上述步骤 801中 MME发起 EPS AKA流程可以在若干种条 件下进行， 例如： 可以当 NAS计数值接近最大值时， MME发起 EPS AKA 流程； 也可以由运营商的策略触发 EPS AKA流程， 具体地， 运营商可以设 置一定的本次策略， 由 MME来触发对其下 UE的 EPS AKA, 这可以是运 营商基于一定的安全策略或者其他需求而制定的策略；还可以当 UE进行网 络间切换时， 触发 EPS AKA流程， 具体地， 当 UE从安全级别较低的网络 (如 GSM或 UMTS 网络）切换（包括激活态的切换和空闲态移动） 到安 全级别较高的网络（如 LTE网络） 时， 由网络侧触发 EPS AKA流程。
本地信息可以包括以下信息的至少之一： 当前业务类型， 服务质量， 用户设备执行认证的能力， 网络策略， 用户识别模块类型或用户设备是否 插入卡的信息。 其中， 当前业务类型指明了当前业务的类型信息， MME可 以根据当前业务类型确定当前业务是否为需要进行认证的业务。 服务质量 能够标识无需进行认证的业务，所以 MME也可以根据服务质量确定当前业 务是否为需要进行认证的业务。 UE执行认证的能力指明了 UE是否具有执 行 EP S A A的能力的相关信息， MME可以根据 UE执行认证的能力确定 UE是否具有执行 EPS AKA的能力。 SIM卡类型也指明了 UE是否具有执 行 EPS AKA的能力的相关信息， MME可以根据 SIM卡类型确定 UE是否 具有执行 EPS AKA的能力。 由于认证需要在 UE插入卡的情况下进行， 如 杲 UE插入卡后执行 EPS AKA流程失败， 那么就应该释放 NAS信令连接； 如果 UE没有插入卡， 则根据网络策略确定是否释放连接。 网络策略是网络 侧设备设定的策略， 其可以支持当前业务是否进行认证。
根据以上本地信息及网络策略的内容， 上述步骤 802可以具体包括： MME 若确定网絡策略不支持当前业务不认证， 则释放当前业务的连 接；
MME若确定网络策略支持当前业务不认证， 且 MME若根据本地信息 中的当前业务类型或服务质量确定当前业务为不需要进行认证的业务， 或 者且 MME 若根据本地信息中的用户设备执行认证的能力或用户识别模块 类型确定用户设备不具有执行认证和密钥协商流程的能力， 或者且用户设 备无插入卡， 则继续执行当前业务；
MME若确定网络策略支持当前业务不认证， 且 MME若根据本地信息 中的当前业务类型或服务质量确定当前业务为需要进行认证的业务， 或者 且 MME 若根据本地信息中的用户设备执行认证的能力或用户识别模块类 型确定用户设备具有执行认证和密钥协商流程的能力， 或者且用户设备存 在插入卡， 则释放当前业务的连接。
举例来说，在 MME确定网絡策略支持当前业务不认证的场景下， MME 通过检测当前业务类型，获知 UE请求的业务为 EMC业务或公共报警业务， 由于 EMC业务或公共报警业务不是需要进行认证的业务，且网络策略支持 未认证的 EMC或公共报警业务， 则 MME和 UE继续执行当前业务。
如果当前业务为 NAS信令连接中的单一业务， 则可以通过释放 NAS 信令连接来实现释放当前业务的连接。 如果 NAS信令连接中承载了多个业 务，且根据当前业务类型确定该多个当前业务均需要进行认证，则释放 NAS 信令连接。 如果当前既包括需要认证的业务又包括不需要认证的业务（如 EMC ), 则释放上述需要认证的业务所对应的 EPS承载， 而保持不需要认证 的业务的 EPS 承载 （如 EMC承载）。 上述 EPS承载是建立在 NAS信令连 接基础上的。
本实施例在认证失败， UE请求的业务不是需要进行认证的业务或 UE 不具有执行 EPS AKA流程的能力或用户设备未插入卡， 且网络策略支持当 前业务不认证的情况下仍然能继续执行当前业务， 避免了当前业务执行中 断的问题， 节省了系统的资源。
图 8为本发明实施例八认证处理装置的结构示意图。 如图 8所示， 本 实施例具体包括检测模块 11和处理模块 12。 其中， 检测模块 11用于当非 接入层计数值接近最大值时， 对本地信息进行检测； 处理模块 12用于根据 检测结果决定是否触发与 UE之间的认证和密钥协商流程。
本实施例提供的认证处理装置可以按照上述实施例一提供的方法来工 作。
图 9为本发明实施例九认证处理装置的结构示意图。 如图 9所示， 本 实施例在上述实施例八的基础上， 本地信息为安全上下文， 处理模块 12具 体包括第一激活单元 21和第一触发单元 22。 其中， 第一激活单元 21用于 当检测模块 11确定安全上下文包括非当前安全上下文， 则激活非当前安全 上下文； 第一触发单元 22用于当检测模块 11确定安全上下文不包括非当 前安全上下文， 则触发认证和密钥协商流程。
本实施例处理模块 12还可以包括收发单元 23， 该收发单元 23用于向 UE发送 NAS SMC, 并接收 NAS安全模式执行成功的消息， 向处理模块 12中的第一激活单元 21发送触发其动作的信息。 第一激活单元 21根据触 发信息激活非当前安全上下文。 当收发单元 23没有接收到 UE返回的 NAS 安全模式执行成功的消息时， 第一触发单元 22触发认证和密钥协商流程。
本实施例提供的认证处理装置可以按照上述实施例二提供的方法来工 作。
图 10为本发明实施例十认证处理装置的结构示意图。 如图 10所示， 本实施例在上述实施例八的基础上， 本地信息为定时器状态， 处理模块 12 具体包括第二激活单元 31和第二触发单元 32。 其中， 第二激活单元 31用 于当检测模块 11检测出定时器状态为运行时， 激活非当前安全上下文； 第 二触发单元 32用于当检测模块 11检测出定时器状态为停止时， 触发认证 和密钥协商流程。
进一步的， 本实施例处理模块 12还可以包括收发单元 33 , 该收发单元 33用于向 UE发送 NAS SMC， 并接收 NAS安全模式执行成功的消息， 向 处理模块 12 中的第二激活单元 31发送触发其动作的信息。 第二激活单元 31根据触发信息激活非当前安全上下文。 当收发单元 33没有接收到 UE返 回的 NAS安全模式执行成功的消息时， 第二触发单元 32触发认证和密钥 协商流程。
本实施例提供的认证处理装置可以按照上述实施例三提供的方法来工 作。
图 11为本发明实施例十一认证处理装置的结构示意图。 如图 11所示， 本实施例在上述实施例八的基础上， 本地信息为状态器状态， 处理模块 12 具体包括第三激活单元 41和第三触发单元 42。 其中， 第三激活单元 41用 于当检测模块 11检测出状态器状态为运行时， 激活非当前安全上下文； 第 三触发单元 42用于当检测模块 11检测出状态器状态为停止时， 触发认证 和密钥协商流程。
进一步的， 本实施例处理模块 12还可以包括收发单元 43， 该收发单元 43用于向 UE发送 NAS SMC， 并接收 NAS安全模式执行成功的消息， 向 处理模块 12 中的第三激活单元 41发送触发其动作的信息。 第三激活单元
41根据触发信息激活非当前安全上下文。 当收发单元 43没有接收到 UE返 回的 NAS安全模式执行成功的消息时， 第三触发单元 42触发认证和密钥 协商流程。
本实施例提供的认证处理装置可以按照上述实施例四提供的方法来工 作。
图 12为本发明实施例十二认证处理装置的结构示意图。 如图 12所示， 本实施例在上述实施例八的基础上， 本地信息为当前的业务类型、 或服务 质量、 或用户设备执行认证的能力， 处理模块 12具体包括第四触发单元 51 和处理单元 52。 该第四触发单元 51用于如果检测模块 11确定当前业务类 型对应的业务为需要进行认证的业务， 或者确定服务质量对应的业务为需 要进行认证的业务， 或者确定用户设备执行认证的能力具有执行认证和密 钥协商流程的能力， 则触发认证和密钥协商流程。 处理单元 52用于如果检 测模块 11确定当前业务类型对应的业务不是需要进行认证的业务， 或者确 定服务质量对应的业务不是需要进行认证的业务， 或者确定用户设备执行 认证的能力不具有执行认证和密钥协商流程的能力， 则继续使用当前的安 全上下文， 或者对当前业务不进行安全保护； 或者中断当前业务的连接。
本实施例提供的认证处理装置可以按照上述实施例五提供的方法来工 作。
上述装置实施例中不会一旦检测到 NAS计数值即将环绕， 就立即触发 EPS AKA流程， 减少了触发 EPS AKA流程的次数， 避免了因触发没有必 要的 EPS AKA流程导致的资源耗费， 节省了资源。
图 13为本发明实施例十三认证处理装置的结构示意图。 如图 13所示， 本实施例具体包括执行模块 61和处理模块 62。 其中， 执行模块 61用于执 行认证和密钥协商流程； 处理模块 62用于在执行模块 61执行认证和密钥 协商流程失败的情况下， 根据本地信息及网络策略决定释放连接或者继续 执行当前业务。 进一步的， 本实施例还可以包括触发模块 63 , 该触发模块 63用于在非 接入层计数值接近最大值、 运营商策略或用户设备进行网络间切换的触发 条件下， 触发执行模块 61执行认证和密钥协商流程。
上述处理模块 62 可以进一步包括： 第一判断单元 64、 第一释放单元 65、 第二判断单元 66、 第二释放单元 67和执行单元 68。 其中， 第一判断 单元 64用于在执行模块 61执行认证和密钥协商流程失败的情况下， 判断 网络策略是否支持当前业务不认证； 第一释放单元 65用于在第一判断单元 64判断为否的情况下， 释放当前业务的连接； 第二判断单元 66用于在第一 判断单元 64判断为是的情况下， 根据本地信息中的当前业务类型或服务质 量判断当前业务是否为需要进行认证的业务， 或者， 根据本地信息中的用 户设备执行认证的能力或用户识别模块类型判断用户设备是否具有执行认 证和密钥协商流程的能力， 或者， 判断用户设备是否存在插入卡； 第二释 放单元 67用于在第二判断单元 66判断为是的情况下， 释放当前业务的连 接； 执行单元 68用于在第二判断单元 66判断为否的情况下， 继续执行当 前业务。
本实施例提供的认证处理装置可以按照上述实施例七提供的方法来工 作。
本实施例在认证失败， UE请求的业务不是需要进行认证的业务或 UE 不具有执行 EPS AKA流程的能力或用户设备未插入卡， 且网络策略支持当 前业务不认证的情况下仍然能继续执行当前业务， 避免了当前业务执行中 断的问题， 节省了系统的资源。
本领域普通技术人员可以理解： 实现上述方法实施例的全部或部分步 骤可以通过程序指令相关的硬件来完成， 前述的程序可以存储于一计算机 可读取存储介质中， 该程序在执行时， 执行包括上述方法实施例的步骤， 而前述的存储介质包括： ROM、 RAM、 磁碟或者光盘等各种可以存储程序 代码的介质。
最后应说明的是： 以上实施例仅用以说明本发明实施例的技术方案， 而非对其限制； 尽管参照前述实施例对本发明实施例进行了详细的说明， 本领域的普通技术人员应当理解： 其依然可以对前述各实施例所记载的技 术方案进行修改， 或者对其中部分技术特征进行等同替换； 而这些修改或 者替换， 并不使相应技术方案的本质脱离本发明实施例各实施例技术方案 的精神和范围。

Claims

权利要求
1. 一种认证处理方法， 其特征在于包括：
在对用户设备执行认证和密钥协商流程失败的情况下， 无线通信网络 侧设备确定网络策略是否支持当前业务不认证，
若所述网络策略支持当前业务不认证， 且所述当前业务为不需要进行 认证的业务， 则继续执行所述当前业务； 或者
若所述网络策略支持当前业务不认证， 且所述用户设备不具有执行认 证和密钥协商流程的能力， 则继续执行所述当前业务； 或者
若所述网络策略支持当前业务不认证， 且所述用户设备无插入卡， 则 继续执行所述当前业务。
2. 根据权利要求 1所述的方法， 其特征在于， 还包括：
若所述网络策略不支持当前业务不认证， 则释放所述当前业务的连接。
3. 根据权利要求 1或 2所述的方法， 其特征在于， 还包括：
若所述网络策略支持所述当前业务不认证， 且当所述前业务为需要进 行认证的业务， 则释放所述当前业务的连接； 或者
若所述网络策略支持所述当前业务不认证， 且所述用户设备具有执行 认证和密钥协商流程的能力， 则释放所述当前业务的连接； 或者
若所述网络策略支持所述当前业务不认证， 且所述用户设备存在插入 卡， 则释放所述当前业务的连接。
4. 根据权利要求 1至 3任意一项所述的方法， 其特征在于， 还包括根 据当前业务类型或服务质量确定当前业务是否为需要进行认证的业务。
5. 根据权利要求 1至 3任意一项所述的方法， 其特征在于， 还包括根 据用户设备执行认证的能力或用户识别模块类型确定用户设备是否具有执 行认证和密钥协商流程的能力。
6. 根据权利要求 2至 5任意一项所述的方法， 其特征在于， 所述释放 所述当前业务的连接包括： 如果所述当前业务为非接入层信令连接中的单一业务， 则释放非接入 层信令连接； 或者
如果非接入层信令连接中承载了多余一个业务， 且根据所述当前业务 类型确定所述多个当前业务均需要进行认证， 则释放非接入层信令连接。
7. 根据权利要求 2至 5任意一项所述的方法， 其特征在于， 所述释放 所述当前业务的连接包括：
如果非接入层信令连接中承载了多余一个业务， 且根据所述当前业务 类型确定所述当前业务既包括需要认证的业务又包括不需要认证的业务， 则释放所述需要认证的业务的演进的分组系统承载， 并且保持所述不需要 认证的业务的演进的分组系统承载。
8. 根据权利要求 1至 7任意一项所述的方法， 其特征在于， 执行认证 和密钥协商流程通过以下条件触发： 非接入层计数值达到计数门限值， 或 运营商策略， 或用户设备进行网络间切换。
9、 根据权利要求 1至 7任意一项所述的方法， 其特征在于， 所述当前 业务包括紧急呼叫业务， 和 /或公共报警业务。
10、 如权利要求 9所述的方法， 其特征在于，
所述紧急呼叫业务为不需要进行认证的紧急呼叫业务或需要进行认证 的紧急呼叫业务；
所述公共报警业务为不需要进行认证的公共报警业务或需要进行认证 的公共报警业务。
11、 如权利要求 1至 10任意一项所述的方法， 其特征在于， 所述无线 通信网络侧设备包括移动管理实体。
12. 一种认证处理装置， 其特征在于包括：
执行模块， 用于执行认证和密钥协商流程；
处理模块， 位于无线通信网络侧设备内， 包括：
第一判断单元， 用于在对用户设备执行认证和密钥协商流程失败的情 况下， 确定网络策略是否支持当前业务不认证，
第二判断单元， 用于在所述网络策略支持当前业务不认证的情况下， 确定所述当前业务是否是需要进行认证的业务， 或者所述用户设备是否具 有执行认证和密钥协商流程的能力， 或者所述用户设备是否具有插入卡； 执行单元， 用于在所述第二判断单元判断为所述当前业务是不需要进 行认证的业务， 或者所述用户设备不具有执行认证和密钥协商流程的能力， 或者所述用户设备不具有插入卡的情况下况下， 继续执行所述当前业务。
13. 根据权利要求 12所述的装置， 其特征在于， 所述处理模块还包括： 第一释放单元， 用于在所述第一判断单元判断为不支持当前业务不认 证的情况下， 释放所述当前业务的连接。
14. 根据权利要求 12或 13所述的装置， 其特征在于， 所述处理模块 还包括：
第二释放单元， 用于在所述第二判断单元判断为所述当前业务是需要 进行认证的业务， 或者所述用户设备具有执行认证和密钥协商流程的能力， 或者所述用户设备具有插入卡的情况下， 释放所述当前业务的连接。
15. 根据权利要求 12至 14任意一项所述的装置， 其特征在于， 所述 第二判断单元用于在所述网絡策略支持当前业务不认证的情况下， 根据当 前业务类型或服务质量确定当前业务是否为需要进行认证的业务， 或者所 述用户设备是否具有执行认证和密钥协商流程的能力， 或者所述用户设备 是否具有插入卡。
16. 根据权利要求 12至 14任意一项所述的装置， 其特征在于， 所述 第二判断单元用于在所述网络策略支持当前业务不认证的情况下， 确定当 前业务是否为需要进行认证的业务， 或者根据用户设备执行认证的能力或 用户识别模块类型确定用户设备是否具有执行认证和密钥协商流程的能 力， 或者所述用户设备是否具有插入卡。
17. 根据权利要求 13至 16任意一项所述的装置， 其特征在于， 所述 第一释放单元或第二释放单元用于：
如果所述当前业务为非接入层信令连接中的单一业务， 则释放非接入 层信令连接； 或者
如果非接入层信令连接中承载了多余一个业务， 且根据所述当前业务 类型确定所述多个当前业务均需要进行认证， 则释放非接入层信令连接。
18、 根据权利要求 13至 16任意一项所述的装置， 其特征在于， 所述第 一释放单元或第二释放单元用于：
如果非接入层信令连接中承载了多余一个业务， 且根据所述当前业务 类型确定所述当前业务既包括需要认证的业务又包括不需要认证的业务， 则释放所述需要认证的业务的演进的分组系统承载， 并且保持所述不需要 认证的业务的演进的分组系统承载。
19、 根据权利要求 12至 18任意一项所述的装置， 其特征在于， 还包 括：
触发模块， 用于在非接入层计数值达到计数门限值、 或运营商策略， 或用户设备进行网络间切换的触发条件下， 触发所述执行模块执行所述认 证和密钥协商流程。
20、 根据权利要求 12至 18任意一项所述的装置， 其特征在于， 所述 当前业务包括紧急呼叫业务， 和 /或公共报警业务。
21、 如权利要求 20所述的装置， 其特征在于，
所述紧急呼叫业务为不需要进行认证的紧急呼叫业务或需要进行认证 的紧急呼叫业务；
所述公共报警业务为不需要进行认证的公共报警业务或需要进行认证 的公共报警业务。
22、 如权利要求 12至 21任意一项所述的装置， 其特征在于， 所述无 线通信网络侧设备包括移动管理实体。
PCT/CN2010/077085 2009-09-21 2010-09-19 认证处理方法及装置 Ceased WO2011032515A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP18204267.1A EP3531731B1 (en) 2009-09-21 2010-09-19 Computer readable medium and apparatus for authentication
EP17151314.6A EP3242498B1 (en) 2009-09-21 2010-09-19 Method and apparatus for authentication
EP10816719.8A EP2472928B1 (en) 2009-09-21 2010-09-19 Method and device for authentication processing
BR112012006409-6A BR112012006409B1 (pt) 2009-09-21 2010-09-19 método e aparelho de autenticação

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910093828.5 2009-09-21
CN2009100938285A CN102025685B (zh) 2009-09-21 2009-09-21 认证处理方法及装置

Publications (1)

Publication Number Publication Date
WO2011032515A1 true WO2011032515A1 (zh) 2011-03-24

Family

ID=43757774

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/077085 Ceased WO2011032515A1 (zh) 2009-09-21 2010-09-19 认证处理方法及装置

Country Status (6)

Country Link
US (1) US9088616B2 (zh)
EP (3) EP3242498B1 (zh)
CN (1) CN102025685B (zh)
BR (1) BR112012006409B1 (zh)
TR (1) TR201902606T4 (zh)
WO (1) WO2011032515A1 (zh)

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9002357B2 (en) * 2009-06-26 2015-04-07 Qualcomm Incorporated Systems, apparatus and methods to facilitate handover security
EP2695477A1 (en) 2011-04-01 2014-02-12 InterDigital Patent Holdings, Inc. Method and apparatus for controlling connectivity to a network
CN102595369B (zh) * 2012-02-29 2015-02-25 大唐移动通信设备有限公司 一种nas算法的传输方法及装置
GB2500720A (en) * 2012-03-30 2013-10-02 Nec Corp Providing security information to establish secure communications over a device-to-device (D2D) communication link
GB2491047B (en) * 2012-06-07 2013-12-11 Renesas Mobile Corp Apparatus and methods for security context selection
US20140068098A1 (en) * 2012-09-04 2014-03-06 Qualcomm Incorporated Reducing network latency resulting from non-access stratum (nas) authentication for high performance content applications
US9519761B2 (en) * 2012-09-06 2016-12-13 Paypal, Inc. Systems and methods for authentication using low quality and high quality authentication information
CN103686651B (zh) * 2012-09-12 2018-05-11 中兴通讯股份有限公司 一种基于紧急呼叫的认证方法、设备和系统
CN104662863B (zh) * 2012-09-24 2019-03-01 阿尔卡特朗讯公司 触发通信网络中的用户认证
CN103906049B (zh) * 2012-12-28 2019-09-24 北京三星通信技术研究有限公司 一种同步辅小区和ue之间加密信息的方法
US9203835B2 (en) 2013-03-01 2015-12-01 Paypal, Inc. Systems and methods for authenticating a user based on a biometric model associated with the user
US11570161B2 (en) * 2013-07-31 2023-01-31 Nec Corporation Devices and method for MTC group key management
CN104270752B (zh) * 2014-09-30 2017-10-27 新华三技术有限公司 无线网络中的密钥协商方法及装置
KR102213885B1 (ko) * 2014-11-28 2021-02-08 삼성전자주식회사 무선 통신 시스템에서 보안 모드 제어 장치 및 방법
EP3873122A1 (en) 2016-01-05 2021-09-01 Huawei Technologies Co., Ltd. Avoiding a man-in-the-middle attack on an attach request message
CN105898894B (zh) * 2016-05-13 2021-08-20 华为技术有限公司 Rrc状态的控制方法和装置
US10462837B2 (en) * 2016-11-04 2019-10-29 Qualcomm Incorporated Method, apparatus, and system for reestablishing radio communication links due to radio link failure
CN109842881B (zh) * 2017-09-15 2021-08-31 华为技术有限公司 通信方法、相关设备以及系统
TWI717717B (zh) 2018-04-10 2021-02-01 新加坡商 聯發科技（新加坡）私人有限公司 行動通訊中錯誤ｋｓｉ處理的改進方法
US10805792B2 (en) * 2018-09-07 2020-10-13 Nokia Technologies Oy Method and apparatus for securing multiple NAS connections over 3GPP and non-3GPP access in 5G
CN110913393B (zh) * 2018-09-15 2021-09-07 华为技术有限公司 切换方法和终端设备
CN109982260B (zh) * 2019-03-08 2021-01-26 杭州迪普科技股份有限公司 信令的解密方法、装置、电子设备及机器可读存储介质
WO2020208616A1 (en) * 2019-04-11 2020-10-15 Telefonaktiebolaget Lm Ericsson (Publ) Methods for handling security of early mobile-terminated data transmissions
US11632695B2 (en) 2019-06-11 2023-04-18 Qualcomm Incorporated Evolved packet system (EPS) mobility configuration from wireless system
US11991525B2 (en) 2021-12-02 2024-05-21 T-Mobile Usa, Inc. Wireless device access and subsidy control

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101119381A (zh) * 2007-09-07 2008-02-06 中兴通讯股份有限公司 防止重放攻击的方法及系统
CN101237334A (zh) * 2007-01-31 2008-08-06 华为技术有限公司 微波接入全球互通系统及提供紧急业务的方法和设备
CN101272251A (zh) * 2007-03-22 2008-09-24 华为技术有限公司 鉴权和密钥协商方法、认证方法、系统及设备
US20090103728A1 (en) * 2007-10-09 2009-04-23 Sarvar Patel Secure wireless communication

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6125283A (en) * 1998-05-18 2000-09-26 Ericsson Inc. Multi-mode mobile terminal and methods for operating the same
US7587598B2 (en) * 2002-11-19 2009-09-08 Toshiba America Research, Inc. Interlayer fast authentication or re-authentication for network communication
US20050149440A1 (en) 2003-12-23 2005-07-07 Leslie Michelassi Systems and methods for routing requests for reconcilement information
TWI249316B (en) 2004-02-10 2006-02-11 Ind Tech Res Inst SIM-based authentication method for supporting inter-AP fast handover
US7372856B2 (en) 2004-05-27 2008-05-13 Avaya Technology Corp. Method for real-time transport protocol (RTP) packet authentication
JP2005352710A (ja) 2004-06-10 2005-12-22 Hitachi Ltd 個人認証装置
US7877787B2 (en) 2005-02-14 2011-01-25 Nokia Corporation Method and apparatus for optimal transfer of data in a wireless communications system
CN101056171A (zh) 2006-06-20 2007-10-17 华为技术有限公司 一种加密通信方法和装置
US8699711B2 (en) 2007-07-18 2014-04-15 Interdigital Technology Corporation Method and apparatus to implement security in a long term evolution wireless device
CN101400059B (zh) 2007-09-28 2010-12-08 华为技术有限公司 一种active状态下的密钥更新方法和设备
CN101470794A (zh) 2007-12-27 2009-07-01 华为技术有限公司 无线射频识别系统中的认证方法、设备和系统
CN101232736B (zh) * 2008-02-22 2012-02-29 中兴通讯股份有限公司 用于不同接入系统之间密钥生存计数器的初始化设置方法
US8179903B2 (en) * 2008-03-12 2012-05-15 Qualcomm Incorporated Providing multiple levels of service for wireless communication devices communicating with a small coverage access point
US8693642B2 (en) * 2009-04-16 2014-04-08 Alcatel Lucent Emergency call handling in accordance with authentication procedure in communication network

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101237334A (zh) * 2007-01-31 2008-08-06 华为技术有限公司 微波接入全球互通系统及提供紧急业务的方法和设备
CN101272251A (zh) * 2007-03-22 2008-09-24 华为技术有限公司 鉴权和密钥协商方法、认证方法、系统及设备
CN101119381A (zh) * 2007-09-07 2008-02-06 中兴通讯股份有限公司 防止重放攻击的方法及系统
US20090103728A1 (en) * 2007-10-09 2009-04-23 Sarvar Patel Secure wireless communication

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2472928A4 *

Also Published As

Publication number Publication date
CN102025685A (zh) 2011-04-20
BR112012006409A2 (pt) 2016-04-12
EP3242498A1 (en) 2017-11-08
CN102025685B (zh) 2013-09-11
BR112012006409B1 (pt) 2021-01-19
EP3531731A1 (en) 2019-08-28
EP3242498B1 (en) 2018-12-12
US20110072488A1 (en) 2011-03-24
EP2472928A4 (en) 2012-07-04
EP3531731B1 (en) 2020-08-19
US9088616B2 (en) 2015-07-21
TR201902606T4 (tr) 2019-03-21
EP2472928A1 (en) 2012-07-04
EP2472928B1 (en) 2017-03-08

Similar Documents

Publication Publication Date Title
WO2011032515A1 (zh) 认证处理方法及装置
US10404677B2 (en) Secure method for MTC device triggering
CN101610506B (zh) 防止网络安全失步的方法和装置
BR112020006242A2 (pt) método de proteção de segurança, aparelho, e sistema
WO2009030164A1 (en) A method, system and device for preventing the degradation attack while terminal is moving
KR20130054317A (ko) 보안 구성들의 동기화를 용이하게 하는 방법들 및 장치들
CN101925050B (zh) 一种安全上下文的生成方法及装置
CN101867931B (zh) 实现lte系统中的非接入层的装置和方法
CN108377494B (zh) 一种终端异常流程保护方法和装置
CN102638793B (zh) 认证处理方法及装置
WO2015081784A1 (zh) 一种验证安全能力的方法、设备及系统
CN103458410B (zh) 认证处理方法及装置
CN101841807B (zh) 一种安全过程的执行方法和系统
WO2019137250A1 (zh) 一种完整性保护密钥管理方法和设备
CN107086988A (zh) 数据包识别系统及方法
CN107086994A (zh) 数据包识别系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10816719

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 718/KOLNP/2012

Country of ref document: IN

REEP Request for entry into the european phase

Ref document number: 2010816719

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2010816719

Country of ref document: EP

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112012006409

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 112012006409

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20120321