CN1867164A - Method for user terminal obtaining BSF as distributed conversation affair mark - Google Patents

Abstract

The invention discloses a method for a user terminal to obtain a session transaction identifier assigned by a BSF. The text is sent to the user terminal; the user terminal obtains the complete B-TID after decryption and saves it. In this way, it prevents the attacker from directly intercepting the B-TID, and also prevents the attacker from obtaining the corresponding relationship between the IMPI of the UE and the B-TID applied thereto, thereby avoiding the attacker from tracking the user, thereby ensuring that the user Information Security.

Description

A method for a user terminal to obtain a session transaction identifier assigned to it by BSF

technical field

The present invention relates to the technical field of the third generation wireless communication, and in particular refers to a method for a user terminal to obtain a session transaction identifier assigned to it by a verification entity (BSF) that performs an initial user identity check.

Background technique

In the third-generation wireless communication standard, the general authentication framework is a general structure used by various application business entities to complete the verification of user identities. The application of the general authentication framework can realize the inspection and verification of users of application services identity. The various application services mentioned above may be multicast/broadcast services, user certificate services, instant information provision services, etc., or proxy services.

Figure 1 is a schematic structural diagram of a general authentication framework. The general authentication framework usually consists of a user terminal (UE) 101 , an entity (BSF) 102 that performs initial user identity check and verification, a user home network server (HSS) 103 and a network application entity (NAF) 104 . BSF102 is used for mutually verifying identity with user terminal 101, and generates the shared secret key of BSF102 and user terminal 101 at the same time; HSS103 is stored with the description (Profile) file that is used to describe user information, includes user's identification mark etc. Related description information, and HSS103 also has the function of generating authentication information.

When a user needs to use a certain service, if he knows that he needs to perform mutual authentication with BSF first, he will directly contact the BSF for mutual authentication; otherwise, the user will first contact the NAF corresponding to the service. If the NAF uses general authentication If it finds that the requesting UE has not performed mutual authentication with the BSF, it will notify the requesting UE to perform mutual authentication with the BSF to verify its identity.

The process of mutual authentication between the UE and the BSF is: the UE sends an authentication request to the BSF, which includes the permanent identity (IMPI) of the UE or the IMPI converted from the International Mobile Subscriber Identity (IMSI), and the BSF receives After the authentication request from the UE, first request the UE's authentication information to the HSS, which contains the permanent identity of the UE, and the HSS finds the attribute information of the UE according to the permanent identity of the UE and generates an authentication vector ( AV) is returned to the BSF. The authentication vector is a five-tuple information, including integrity key IK, encryption key CK, authentication random number RAND, authentication attribute value AUTN and expected return value XRES. The authentication attribute value AUTN is a composite value composed of a serial number, a digest value and an authentication method.

After receiving the authentication vector, the BSF reserves IK, CK and XRES, and sends RAND and AUTN to the UE in plain text, and the user equipment (ME) in the UE sends the received RAND and AUTN to the user identification card (UICC) ), the UICC calculates the IK, CK and response value RES required for user authentication based on the received information. At this time, the user end has two processing modes, one is that the UICC sends the calculated IK, CK and RES to the ME, the ME saves the IK and CK, and then returns the RES to the BSF in the response message; the other is The UICC only sends the RES to the ME, and the ME returns the RES to the BSF in response information. BSF checks whether the received RES matches the XRES stored by itself, and if they match, the authentication is passed, otherwise, the authentication is not passed.

After successful authentication, UE and BSF authenticate each other and share keys IK and CK. BSF generates a communication key Ks according to the keys IK and CK, and defines a validity period for the communication key Ks so that the encryption The key Ks is updated. Afterwards, BSF generates a session transaction identifier (B-TID) for allocation to UE. The B-TID is in the form of user name plus BSF domain name, where the user name is the authentication random number RAND used in the authentication process, namely The format of the B-TID is: RAND+BSF domain name, and the BSF locally associates and saves the B-TID, the user's permanent identity, the key Ks and the validity period of the key Ks, and then sends an instruction authentication to the UE. A successful message, the message contains the B-TID in plain text, and the message contains the validity period of the key Ks. The key Ks is usually used as the root key and generally does not leave UE and BSF. When the user communicates with NAF, the key Ks_NAF derived from Ks will be used for communication.

If the UE adopts the first processing mode, that is, the ME stores IK and CK information, then when the UE receives a message from the BSF indicating that the authentication is successful, the ME in the UE directly obtains the B-TID from the message, Then ME uses the IK and CK stored by itself to generate the key Ks, and then uses the key Ks_NAF derived from Ks as the protection key when communicating with NAF; if the client adopts another processing mode, that is, there is no IK, CK information, when the UE receives a message from the BSF indicating that the authentication is successful, the ME in the UE also directly obtains the B-TID from the message, and then the ME sends a request including RAND to the UICC, and the UICC finds the B-TID according to the RAND Corresponding IK, CK, and apply the IK, CK to calculate the key Ks required by ME, and then calculate the key Ks_NAF derived from Ks, and return Ks_NAF to ME, and then ME uses the Ks_NAF and NAF to perform communication.

When the user finds that the key Ks is about to expire, or the NAF requires the UE to re-authenticate with the BSF, the UE will repeat the above steps to re-authenticate with the BSF to obtain a new Ks and B-TID.

It can be seen from the above communication process that the existing way for the ME to obtain the B-TID allocated by the BSF is very simple, that is, it can be obtained directly from the message indicating successful authentication from the BSF. The defect is also here: because the B-TID sent by the BSF to the ME is transmitted in plain text after successful authentication, it is easy for an attacker to intercept the B-TID. In addition, the IMPI used by the UE when sending the authentication request to the BSF is also transmitted in plain text. Therefore, it is easy for the attacker to obtain the corresponding relationship between the IMPI of the UE and the B-TID it is applied to, and perform an attack on the user. Tracking, in this way, when the UE communicates with the NAF, the attacker can know what business the user is doing, so as to find opportunities to attack the user's business.

Contents of the invention

In view of this, the purpose of the present invention is to provide a method for a user terminal to obtain a session transaction identifier allocated to it by the BSF, so as to prevent the user terminal from being tracked and attacked.

To achieve the above object, the technical solution of the present invention is achieved in that:

A method for a user terminal to obtain a session transaction identifier assigned by a BSF, the method comprising the following steps:

a. After receiving the authentication request from the user terminal UE and successfully authenticating the UE, the entity BSF that performs the initial check and verification of the user identity generates a session transaction identifier B-TID assigned to the UE, and applies the key used for authentication Encrypt the generated B-TID, and then send a message indicating successful authentication to the UE, the message at least includes the encrypted B-TID;

b. After receiving the message indicating successful authentication, the UE obtains the same key as described in step a, decrypts the encrypted B-TID, and obtains a complete B-TID.

Preferably, the format of the B-TID generated by the BSF in step a is: a user name composed of a unique field, an anti-tracking field, and an authentication random number RAND, plus the domain name of the BSF.

Preferably, the field representing uniqueness is the current system time field, and the anti-tracking field is a field composed of any number specified by BSF.

Preferably, the method for the BSF in step a to encrypt the B-TID with the key used for authentication is: to encrypt the entire B-TID with the key used for authentication, or to encrypt the entire B-TID Any part is encrypted, and the encrypted part contains the authentication random number RAND or does not contain the authentication random number RAND.

Preferably, when the BSF encrypts the B-TID as a whole, and the user equipment ME in the UE performs the decryption operation, step b obtains the same key as described in step a, and performs encryption on the encrypted B-TID The process of decrypting and obtaining the complete B-TID is as follows: ME directly obtains the same key as described in step a from itself, and applies the key to decrypt the encrypted B-TID to directly obtain the complete B-TID.

Preferably, when the BSF encrypts any part of the B-TID, and the user equipment ME in the UE performs a decryption operation, the message indicating successful authentication in step a also includes the unencrypted part of the B-TID ;

Obtain the same key as described in step a in step b, decrypt the encrypted B-TID, and obtain the complete B-TID process as follows: ME directly obtains the same key as described in step a from itself, And apply the key to decrypt the encrypted part of the B-TID, and then combine the decrypted part of the B-TID with the unencrypted part to obtain a complete B-TID.

Preferably, when the BSF encrypts the B-TID as a whole, and the user identity card UICC in the UE performs a decryption operation, step b obtains the same key as that described in step a, and encrypts the encrypted B-TID The process of decrypting and obtaining the complete B-TID is as follows: After the ME receives the message indicating that the authentication is successful, it forwards the encrypted B-TID to the UICC, and the forwarded message also includes the B-TID stored in the ME and the B-TID. The plaintext of the authentication random number RAND corresponding to the TID, the UICC obtains the same key as step a from itself according to the plaintext authentication random number RAND to decrypt the received B-TID, directly obtains the complete B-TID and saves it , and then send the complete B-TID to the ME.

Preferably, when the BSF encrypts any part of the B-TID, and the UICC in the UE performs the decryption operation, the message indicating successful authentication in step a also includes the B-TID of the unencrypted part. TID;

Obtain the same key as described in step a in step b, decrypt the encrypted B-TID, and obtain the complete B-TID process as follows:

After the ME receives the message indicating that the authentication is successful, it forwards the encrypted B-TID to the UICC. If the encrypted part does not contain the authentication random number RAND, the forwarded message also includes the B-TID of the unencrypted part. part contains the authentication random number RAND, the forwarded message also includes the unencrypted part of the B-TID and the plaintext of the authentication random number RAND corresponding to the B-TID stored in the ME, and the UICC authenticates according to the plaintext Random number RAND, obtain the same key as step a from itself to decrypt the received B-TID, combine the decrypted part of the B-TID with the unencrypted part, obtain the complete B-TID and save it, and then complete the B-TID The B-TID is sent to ME.

Preferably, the key used for authentication in step a is the integrity key IK, or the encryption key CK, or the communication key Ks generated by the integrity key IK and the encryption key CK, or the above three any combination of those.

Preferably, after the UE obtains the complete B-TID, the method further includes: associating and saving the B-TID with the communication key corresponding to the B-TID.

Preferably, after receiving the authentication request from the user terminal, the BSF further includes: judging whether the request contains the B-TID or the user identity, and if it is the user identity, continue the subsequent processing according to the existing authentication method ; If it is a B-TID, the BSF judges whether the B-TID exists locally, if it exists, extracts the user identity corresponding to the B-TID, and then continues the follow-up processing according to the existing authentication method, otherwise, the BSF The user is required to send an authentication request containing the user ID.

Applying the present invention, after receiving the authentication request from the UE and successfully authenticating the UE, the BSF sends the generated B-TID to the user terminal in the form of cipher text; the user terminal obtains the complete B-TID after decrypting and saves it . In this way, the attacker is prevented from directly intercepting the B-TID, and the attacker is also prevented from obtaining the corresponding relationship between the IMPI of the UE and the B-TID applied thereto, thereby preventing the attacker from tracking the user, thus ensuring the user Information Security.

Description of drawings

FIG. 1 is a schematic structural diagram of a general authentication framework;

FIG. 2 is a schematic flow diagram of the application of Embodiment 1 of the present invention;

FIG. 3 is a schematic flow chart of the application of Embodiment 2 of the present invention.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

FIG. 2 is a schematic flow chart of Embodiment 1 of the application of the present invention. In this embodiment, the ME stores the IK and CK information generated during authentication.

In step 201, the UE sends an authentication request to the BSF, and the request includes the IMPI.

In steps 202-203, the BSF requests the UE's authentication information from the HSS, and the request includes the UE's IMPI. The HSS finds the UE's attribute information according to the UE's IMPI and generates an authentication vector (AV) to return to the BSF. AV includes integrity key IK, encryption key CK, authentication random number RAND, authentication attribute value AUTN and expected return value XRES.

In step 204, the BSF and the UE perform mutual authentication. During the authentication process, the UICC in the UE calculates the IK and CK, and sends the calculated IK and CK to the ME, and the ME stores the IK and CK information.

Step 205, after the authentication is successful, the BSF generates a B-TID, and encrypts the whole B-TID with the key used in the authentication, or encrypts any part of the B-TID, and the encrypted part may contain RAND It is also possible not to include RAND.

The format of the B-TID generated by BSF is: the user name composed of the uniqueness field, the anti-tracking field and the authentication random number RAND, plus the BSF domain name, among them, the field used to represent the uniqueness It is the current time field of the system, and the field used to indicate anti-tracking is a field composed of any number specified by BSF, that is, the format of B-TID can be expressed as follows:

Current time + a number specified by BSF + RAND + BSF domain name

Among them, the underlined part is the user name, and the order of the positions of the fields in the user name part depends on the system configuration.

When encrypting the whole B-TID, its form is shown in formula (1):

hash(current time+a number specified by BSF+RAND+BSF domain name) (1)

When the part of B-TID is encrypted, and the encrypted part contains RAND, its form is shown in formula (2):

hash (current time + a number specified by BSF + RAND) + domain name of BSF (2)

When the part of B-TID is encrypted, and the encrypted part does not contain RAND, its form is shown in formula (3):

hash (current time + a number specified by BSF) + RAND + BSF domain name (3)

In step 206, the BSF sends the encrypted B-TID to the UE through a message indicating successful authentication. If the BSF encrypts the B-TID part, the message also includes the B-TID of the unencrypted part.

Step 207, since the IK and CK information has been stored in the ME, the ME applies the same key used for encryption with the BSF to decrypt the received information, acquires and stores the complete B-TID. The specific process is:

If BSF encrypts the B-TID as a whole, then ME obtains from itself the same key used for BSF encryption to decrypt the received B-TID and directly obtains the complete B-TID; if BSF encrypts the B-TID Partially encrypted, ME obtains from itself the same key used for BSF encryption to decrypt the received B-TID, and then combines the decrypted part of the B-TID with the unencrypted part to obtain a complete B-TID . For example, during partial encryption, the value of the encrypted part and RAND is 256 bits in total, and RAND is the last 128 bits. Then ME decrypts the first 128 bits and combines them with the latter RAND to form a complete B-TID.

In step 208, the ME in the UE generates a key Ks using its own stored IK and CK, and stores the complete B-TID in association with its corresponding communication key Ks and other information. That is to say, the UE will store the B-TID in association with the communication key corresponding to the B-TID. After that, ME applies the key Ks_NAF derived from Ks as the protection key when communicating with NAF, and uses the acquired B-TID to communicate with NAF normally.

FIG. 3 is a schematic flow chart of the application of Embodiment 2 of the present invention. In this embodiment, the IK and CK information generated during authentication are not saved in the ME. When the ME needs to use the key information generated during authentication, it will request to the UICC.

Steps 301 to 303 are the same as steps 201 to 203 in FIG. 2 .

In step 304, the BSF performs mutual authentication with the UE. During the authentication process, the IK and CK calculated by the UICC in the UE are only stored in itself and not sent to the ME.

Steps 305 to 306 are the same as steps 205 to 206 .

In step 307, the ME forwards the B-TID information in the received message indicating successful authentication to the UICC. If the BSF encrypts the whole B-TID, the forwarded B-TID information is the encrypted B-TID; if the BSF encrypts the B-TID part, the forwarded B-TID information is the B-TID of the encrypted part. TID and B-TID of the unencrypted part.

Since ME needs UICC to perform the decryption operation, in order for UICC to obtain the key for decryption from the information saved by itself, ME must send the plain text of RAND to UICC, so that UICC can use the saved RAND and IK, CK Correspondence to get the required key. That is to say, if BSF encrypts the whole B-TID, it is the encryption method of formula (1), or if BSF encrypts any part of B-TID and the encrypted part contains RAND, it is the encryption method of formula (2). method, the forwarded message above also includes the plaintext of the RAND corresponding to the B-TID stored in the ME; if the BSF encrypts any part of the B-TID, and the encrypted part does not contain RAND, that is, the formula (3) encryption method, then the above-mentioned forwarded message does not need to include the plaintext of RAND, but only includes the B-TID of the encrypted part and the B-TID of the unencrypted part.

In step 308, the UICC directly decrypts the received information using the same key used for encryption by the BSF to obtain a complete B-TID. The specific process is:

If the BSF encrypts the B-TID as a whole, the UICC obtains from itself the same key used for encryption by the BSF to decrypt the received B-TID and directly obtains the complete B-TID; if the BSF encrypts the B-TID The TID part is encrypted, and the UICC obtains from itself the same key as that used by the BSF to decrypt the received B-TID, and then combines the decrypted part of the B-TID with the unencrypted part to obtain a complete B-TID -TID. And, the UICC stores the complete B-TID in association with its corresponding communication key Ks and other information. That is to say, the UE will store the B-TID in association with the communication key corresponding to the B-TID.

In step 309, the UICC sends the complete B-TID to the ME, and the ME saves it so as to request services from the NAF.

In step 310, the UE communicates normally with the NAF using the acquired B-TID. When a key is needed, the ME in the UE uses the B-TID as an index to request the UICC to perform calculations. The specific process is the same as that of the prior art, and will not be described in detail again.

The main difference between the above two embodiments is that in the first embodiment, the decryption operation is performed by the ME, and in the second embodiment, the decryption operation is performed by the UICC.

The key used in the authentication described in the above two embodiments is the integrity key IK, or the encryption key CK, or the communication key Ks generated by the integrity key IK and the encryption key CK, or the above Any combination of the three. Of course, which key to use is determined according to the system configuration, and both encryption and decryption parties are known in advance.

In addition, for the above two embodiments, the authentication request sent by the UE to the BSF may not contain the IMPI, but may contain the existing B-TID of the UE. At this time, when the BSF receives the authentication request from the user terminal After the request, first judge whether the request includes the B-TID or the user identity, if it is the user identity, then obtain the authentication vector from the HSS according to the user identity, and then continue the follow-up processing according to the existing authentication mode; If it is a B-TID, the BSF judges whether the B-TID exists locally, and if so, extracts the user identity corresponding to the B-TID, and obtains authentication information from the HSS according to the user identity, and then follows the current Some authentication methods continue to follow-up processing, otherwise, the BSF requires the user to send an authentication request including the user ID.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection.

Claims (11)

1. A method for a user terminal to obtain a session transaction identifier assigned by a BSF, characterized in that the method comprises the following steps: a. After receiving the authentication request from the user terminal UE and successfully authenticating the UE, the entity BSF that performs the initial check and verification of the user identity generates a session transaction identifier B-TID assigned to the UE, and applies the key used for authentication Encrypt the generated B-TID, and then send a message indicating successful authentication to the UE, the message at least includes the encrypted B-TID; b. After receiving the message indicating successful authentication, the UE obtains the same key as described in step a, decrypts the encrypted B-TID, and obtains a complete B-TID. 2. The method according to claim 1, wherein the format of the B-TID generated by the BSF in step a is: a user ID composed of a unique field, an anti-tracking field and an authentication random number RAND. name, plus the BSF domain name. 3. The method according to claim 2, wherein the unique field is the system current time field, and the anti-tracking field is a field composed of numbers arbitrarily specified by BSF. 4. The method according to claim 2, characterized in that the method of encrypting the B-TID with the key used by the BSF when applying authentication in step a is: using the key pair B-TID when applying authentication The whole is encrypted, or any part of the B-TID is encrypted, and the encrypted part contains the authentication random number RAND or does not include the authentication random number RAND. 5. The method according to claim 4, wherein when the BSF encrypts the entire B-TID and the user equipment ME in the UE performs the decryption operation, the acquisition in step b is the same as that in step a Key, to decrypt the encrypted B-TID, the process of obtaining the complete B-TID is: ME directly obtains the same key as described in step a from itself, and applies the key to the encrypted B-TID Decrypt to get the complete B-TID directly. 6. The method according to claim 4, wherein when the BSF encrypts any part of the B-TID, and the user equipment ME in the UE performs the decryption operation, the indication of successful authentication in step a The message also includes the B-TID of the unencrypted part; Obtain the same key as described in step a in step b, decrypt the encrypted B-TID, and obtain the complete B-TID process as follows: ME directly obtains the same key as described in step a from itself, And apply the key to decrypt the encrypted part of the B-TID, and then combine the decrypted part of the B-TID with the unencrypted part to obtain a complete B-TID. 7. The method according to claim 4, wherein when the BSF encrypts the B-TID as a whole, and the UICC in the UE performs the decryption operation, the acquisition in step b is the same as that in step a key, decrypt the encrypted B-TID, and obtain the complete B-TID process: After the ME receives the message indicating that the authentication is successful, it forwards the encrypted B-TID to the UICC, and the forwarded message contains It also includes the plaintext of the authentication random number RAND corresponding to the B-TID stored in the ME, and the UICC obtains the same key as that in step a from itself according to the authentication random number RAND in the plaintext to process the received B-TID Decrypt, directly obtain and save the complete B-TID, and then send the complete B-TID to ME. 8. The method according to claim 4, wherein when the BSF encrypts any part of the B-TID and the UICC in the UE performs the decryption operation, the step a indicates that the authentication is successful The unencrypted part of the B-TID is also included in the message; Obtain the same key as described in step a in step b, decrypt the encrypted B-TID, and obtain the complete B-TID process as follows: After the ME receives the message indicating that the authentication is successful, it forwards the encrypted B-TID to the UICC. If the encrypted part does not contain the authentication random number RAND, the forwarded message also includes the B-TID of the unencrypted part. part contains the authentication random number RAND, the forwarded message also includes the unencrypted part of the B-TID and the plaintext of the authentication random number RAND corresponding to the B-TID stored in the ME, and the UICC authenticates according to the plaintext Random number RAND, obtain the same key as step a from itself to decrypt the received B-TID, combine the decrypted part of the B-TID with the unencrypted part, obtain the complete B-TID and save it, and then complete the B-TID The B-TID is sent to ME. 9. The method according to claim 1, wherein the key used in the authentication in step a is the integrity key IK, or the encryption key CK, or the combination of the integrity key IK and the encryption key The communication key Ks generated by CK, or any combination of the above three. 10. The method according to claim 1, wherein after the UE obtains the complete B-TID, further comprising: associating and saving the B-TID with the communication key corresponding to the B-TID. 11. The method according to claim 1, characterized in that after receiving the authentication request from the user terminal, the BSF further includes: judging whether the request contains the B-TID or the user identity, if it is the user identity, Then continue the follow-up processing according to the existing authentication method; if it is a B-TID, the BSF judges whether the B-TID exists locally, and if so, extracts the user identity corresponding to the B-TID, and then follows the existing Otherwise, the BSF requires the user to send an authentication request including the user ID.

Images