WO2006047960A1 - Method and system for guaranteeing the privacy of the user identification - Google Patents

Abstract

A method and system for guaranteeing the privacy of user identification, the key is, after judging that it has its own B-TID, the UE sends the authentication request containing the B-TID to BSF. BSF extracts the user identification corresponding to the B-TID according to the B-TID and the information stored in itself, obtains the authentication information from the user home network server HSS according to the user identification, and performs the authentication process with the authentication information. With the method and system of the invention, it could reduce the times of using user identification and avoid the probability of tracking user identification, while increasing the security of the user identification at the air interfaces, thus guaranteeing the privacy of the user identification.

Description

 Method and system for guaranteeing privacy of user identity

Technical field

 The present invention relates to the field of wireless communication technologies, and in particular to a method and system for ensuring the privacy of a user identity in the process of applying a universal authentication framework. Background of the invention

 In the wireless communication standard, the universal authentication framework is a general structure used by various application service entities to complete the verification of the user identity, and the universal authentication framework can be used to check and verify the identity of the user of the application service. The foregoing multiple application services may be a multicast/broadcast service, a user certificate service, an information immediate service, or a proxy service.

 Figure 1 shows the structure of the general authentication framework. The universal authentication framework is generally composed of a user terminal (UE) 101, an entity performing a user identity initial check (BSF) 102, a home home network server (HSS, Home Suscriber Server) 103, and a network application entity (NAF, Network). Application Function ) 104 composition. The BSF 102 is configured to perform mutual authentication with the UE 101, and simultaneously generate a shared key of the BSF 102 and the user 101. The HSS 103 stores a profile file for describing user information, where the profile includes all user identifiers and the like. The related description information, while the HSS 103 also has the function of generating authentication vector information.

 When the user needs to use a certain service, if it knows that it needs to first go to the BSF for mutual authentication, contact the BSF for mutual authentication. Otherwise, the user will first contact the NAF corresponding to the service, if the NAF uses universal authentication. The framework, and finds that the requesting user has not yet authenticated to the BSF, and notifies the requesting user to the BSF for mutual authentication to verify the identity.

The process of the user verifying the identity to the BSF is: The UE sends an authentication request to the BSF, the authentication The request message includes the user identity of the UE, and after receiving the authentication request from the user, the BSF requests the HSS for the authentication information of the user, and the request message that the BSF requests the HSS for the authentication information of the user also includes the The user identity of the UE, the HSS searches for the profile file of the user according to the user identity of the UE, and generates an authentication vector to return to the BSF. The user identity identifier is a permanent identity of the user, and the permanent identity identifier may be an IP Multimedia Private User Identity (IMPI), or may be an IMPI converted by an International Mobile Subscriber Identity (IMSI).

 The BSF performs an authentication and key agreement protocol (AKA) with the UE according to the obtained authentication information to perform mutual authentication. After the authentication succeeds, the UE and the BSF authenticate each other and simultaneously generate a shared key Ks. The BSF defines an effective period for the shared key Ks so that the shared key Ks is updated. Thereafter, the BSF assigns a session transaction identifier (B-TID) to the UE, the B-TID is associated with Ks, and the B-TID, the user's permanent identity, the shared key Ks, and the Ks are valid for the BSF locally. The information is stored in association, and then the B-TID is sent to the UE, and the message sent to the UE also includes the expiration date information of the Ks. The shared key Ks is used as the root key and does not leave the UE and BSF of the user. When the UE communicates with the NAF, the derived key derived from Ks will be used.

 After receiving the B-TID, the UE re-issues a connection request to the NAF, and the B-TID is carried in the connection request, and the UE calculates the derived key Ks_NAF according to Ks. After receiving the request, the NAF confirms that the UE is legal and obtains the derived key Ks_NAF, performs normal communication with the UE, and performs communication protection by the derived key Ks-NAF in the subsequent communication process.

 When the user finds that the shared key Ks is about to expire, or the NAF requires the UE to re-authenticate to the BSF, the UE will re-authenticate to the BSF to obtain a new Ks and B-TID.

According to the above process, in the process of requesting authentication from the UE to the BSF, whether the first request authentication or the update of the shared key Ks and the B-TID is performed, the UE sends the request. The authentication message contains its own permanent identity. The connection between the UE and the BSF is accomplished through a wireless connection over the air interface. The wireless connection is characterized by poor security and is extremely vulnerable to attack. Therefore, it is very dangerous for the UE's permanent identity to be frequently used in the air interface, which is very easy to be tracked and stolen by the attacker, and the user's permanent identity is difficult to ensure privacy. ' Invention content

 In view of this, an object of the present invention is to provide a method for ensuring the privacy of a user identity, which prevents the user identity from being frequently used and improves the privacy of the user identity.

 Another aspect of the present invention is a system for assuring privacy of a user identity for use in implementing the above method.

 In order to achieve the above object, the technical solution of the present invention is achieved as follows:

 A method for ensuring the privacy of a user identity is applicable to a process in which a UE applies a universal authentication frame for authentication, and the method includes the following steps:

 After receiving the authentication request from the UE, the BSF determines whether the request includes the session transaction identifier B-TID or the user identity. If the B-TID is included, step b is performed, and if the user identity is included, The user identity obtains the authentication information from the HSS, and then applies the authentication information for authentication processing.

 b. The BSF determines whether the B-TID exists locally. If yes, the user identity corresponding to the B-TID is extracted, and the authentication information is obtained from the home network server HSS according to the user identity, and then the authentication is applied. The information is authenticated. If not, the BSF requests the UE to send an authentication request containing the user identity.

 Preferably, the method further comprises:

01) The UE determines whether there is a B-TID in the local area, if yes, step 02), otherwise step 03); 02) sending an authentication request containing the B-TID to the BSF, and then performing step a;

 03) Send an authentication request containing the user identity to the BSF, and then perform step a. Preferably, after the UE determines that the B-TID exists locally, the method further includes: determining whether the B-TID is within the validity period, and if yes, performing step 02), otherwise, performing step 03).

 Preferably, the determining of step a is performed according to the identified domain name.

 Preferably, the user identity is a user's permanent identity IMPI or a user permanent identity IMPI converted by an international mobile subscriber identity.

 A system for ensuring privacy of a user identity, the system comprising a UE, a BSF, and an HSS, the system further comprising an identifier selection module and an identifier recognition module;

 The identifier selection module is configured to determine whether a B-TID is included in the UE, and notify the UE of the determined information;

 The UE is configured to send an authentication request including a B-TID according to the received notification from the identifier selection module, or send an authentication request including the user identity identifier;

 The identifier identifying module is configured to determine whether the identifier in the authentication request received by the BSF from the UE is a B-TID or a user identity, and notify the BSF of the determined information; if the BSF determines that the received If the B-TID is included in the authentication request, and the B-TID exists locally, the user identity corresponding to the B-TID is extracted, and the authentication information of the UE is requested from the HSS according to the user identity, and then the application is applied. The authentication information is subjected to an authentication process. If it is determined that the B-TID does not exist locally, the UE is notified to send an authentication request including the user identity.

 If it is determined that the received authentication request includes the user identity, the authentication information of the UE is requested from the HSS according to the user identity, and then the authentication information is applied for authentication processing.

Preferably, the user identity is a permanent identity of the user, IMH, or a permanent identity of the user, translated by the international mobile subscriber identity code. Compared with the prior art, the present invention mainly sends an authentication request including a B-TID to the BSF after the UE determines that it has a B-TID, and the BSF according to the B-TID and the information that has been saved by itself. The user identity corresponding to the B-TID is extracted, and the authentication information is obtained from the home network server HSS according to the user identity, and then the authentication information is applied to perform authentication processing. By applying the method and system of the invention, the number of times of using the user identity is reduced, the possibility that the user identity is tracked is avoided, the security of the user identity on the air interface is improved, and the privacy of the user identity is ensured. BRIEF DESCRIPTION OF THE DRAWINGS

 FIG. 1 is a schematic structural diagram of an existing universal authentication framework;

 Figure 2 is a flow chart showing the application of the present invention for authentication using a universal authentication framework. Mode for carrying out the invention

 In order to make the objects, technical solutions and advantageous effects of the present invention more clear, the invention will be further described in detail below with reference to the specific embodiments and drawings.

 The idea of the present invention is: after receiving the authentication request from the UE, the BSF determines whether the request includes the B-TID or the user identity, and if the user identity is included, continues the subsequent processing according to the existing processing manner; B-TID, further determining whether the B-TID exists locally, if yes, extracting the user identity corresponding to the B-TID, and obtaining authentication information from the user home network server HSS according to the user identity, and then according to the user identity The existing processing mode continues the subsequent processing. Otherwise, the BSF requests the UE to send an authentication/requesting request including the user identity, and then continues the subsequent processing according to the existing processing mode.

Figure 2 is a flow chart showing the application of the present invention for authentication using a universal authentication framework. Step 201: Before the UE needs to go to the BSF for authentication, first check whether a B-TID exists in the local area. If not, send an authentication request message (not shown) containing the user identity to the BSF; if present, Then, it is further checked whether the Ks associated with the B-TID expires, that is, whether the B-TID is valid, and if valid, sends an authentication request message including the B-TID to the BSF, otherwise, the user identity is still sent to the BSF. Authentication request message.

 After the BSF and the UE complete the authentication, and assign the B-TID to the UE, and set the expiration date of the key Ks associated with the B-TID, the BSF saves the B-TID before the expiration date is reached. However, when the expiration date is reached, the BSF will delete the B-TID and related information. Therefore, if the UE detects that the locally saved B-TID has expired, it still sends an authentication request message containing the user identity to the BSF.

 The above user identity is the user's permanent identity IMPI or the user permanent identity IMPI converted by IMSI.

 Step 202: After receiving the authentication request from the UE, the BSF determines whether the request includes the session transaction identifier B-TID or IMPI, and if it is an IMPI, sends the authentication request information including the IMPI to the HSS (not shown). If it is a B-TID, the BSF continues to determine whether the B-TID exists. If yes, step 205 is performed; otherwise, step 203 is performed.

 Since the B-TID is different from the domain name of the user identity, the BSF can know the identity of the B-TID or IMPL after receiving the identity sent by the user. Generally, the format of the B-TID and IMPI identifiers is as follows:

 B-TID: base64encode(RAND)@B SF—servers— domain— name

 IMPI : User @MNC.MCC.IMSI.3gppnetwork.org or User @MNC .MCC .3 gppnetwork. org

 Step 203: The BSF requests the user to send an authentication request including the IMPI.

Step 204: The UE sends an authentication request message including an IMPI to the BSF. Step 205: If the BSF receives the authentication request including the B-TID, the BSF extracts the B- according to the information correspondence between the B-TID saved by the local management, the IMPI of the user, the key Ks, and the expiration date of the key Ks. The IMPI corresponding to the TID, and sending the authentication request information including the IMPI to the HSS; if the BSF receives the authentication request including the IMPI, sending the authentication request information including the IMPI to the HSS.

 Step 206: The HSS returns the authentication information to the BSF.

 Step 207: The BSF applies the authentication information acquired by the HSS to the mutual authentication right of the UE that initiates the authentication request. After the authentication succeeds, the UE and the BSF mutually authenticate the identity and simultaneously generate the shared key Ks, and the BSF is this. The shared key Ks defines an expiration date so that the key Ks is updated.

 Step 208: The BSF allocates a B-TID to the UE, and the B-TID is associated with the Ks, and locally saves information about the B-TID, the user's IMPI, the shared key Ks, and the validity period of the Ks, and then Sending the B-TID to the UE, the message also includes the expiration date information of the Ks. The shared key Ks is used as the root key and does not leave the user's U and BSF. When the user communicates with the NAF, the key derived from Ks will be used.

 Step 209: After receiving the B-TID, the UE sends a connection request to the NAF, where the B-TID is carried in the request message, and the UE calculates the derived key Ks_NAF according to the Ks.

 Step 210: After receiving the requested NAF, confirm that the UE is legal and obtain the derived key Ks_NAF, perform normal communication with the user, and perform communication protection by using the derived key Ks-NAF in the subsequent communication process.

In order not to affect the normal use of the service by the user, the user can initiate the authentication process again before the UE expires, so as to obtain a new B-TID and Ks. If the user does not re-authenticate within the validity period of the local B-TID because it is shut down or not in the service area, in the re-authentication process, the authentication request including the IMPI can only be sent to the BSF, because the BSF is likely to have already Delete the expired B-TID. If the NAF notifies the user for re-authentication for security reasons, at this time, if the B-TID in the UE is still within the validity period, the UE can still send an authentication request including the B-TID to the BSF.

 The above is described by taking the authentication success as an example. Of course, if the BSF receives the authentication request including the B-TID, extracts the IMPI corresponding to the B-TID, and sends the authentication request information including the ΪΜΡΙ to the HSS; The BSF may also receive the error message from the HSS, or the BSF may also receive the authentication information from the HSS, but for some reason it cannot be successfully mutually authenticated with the UE, and it is possible that it exists. The subsequent specific processing methods are the same as the existing processing methods, and are not described here.

 The present invention further provides a system for ensuring privacy of a user identity, the system includes not only a UE, a BSF, and an HSS, but also an identifier selection module and an identifier identification module. The identifier selection module is configured to determine whether the UE is included in the UE. Β-ΉΕ), and notify the UE of the determined information;

 The foregoing UE is configured to send, according to the received notification from the identifier selection module, an authentication request including a B-TID, or send an authentication request including a user identity identifier;

 The identifier identifying module is configured to determine whether the identifier in the authentication request received by the BSF from the UE is a B-TID or a user identity, and notify the BSF of the determined information; if the BSF determines the received authentication If the B-TID is included in the request, and the B-TID exists locally, the user identity corresponding to the B-TID is extracted, and the authentication information of the UE is requested from the HSS according to the user identity, and then the authentication is applied. The information is subjected to an authentication process. If it is determined that the B-TID does not exist locally, the UE is notified to send an authentication request including the user identity.

The BSF, if it is determined that the received authentication request includes the user identity, requests the authentication information of the UE from the HSS according to the user identity, and then applies the authentication information to perform authentication processing. The user identity identifier is the user's permanent identity IMPI or the user permanent identity IMPL converted by the international mobile subscriber identity code.

 The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are included in the spirit and scope of the present invention, should be included in the present invention. Within the scope of protection.

Claims

Claim  A method for ensuring the privacy of a user identity, which is applicable to a process in which a user terminal UE applies a universal authentication framework for authentication, and the method includes the following steps: a. The BSF receives an authentication request from the UE. After determining whether the request includes the session transaction identifier B-TID or the user identity, if the B-TID is included, step b is performed, and if the user identity is included, requesting the user home network server HSS according to the user identity The authentication information of the UE is then applied to the authentication process and ends; b. The BSF determines whether the B-TID exists locally, and if so, extracts the user identity corresponding to the B-TID, and according to the user The identity requesting the authentication information of the UE from the HSS, and then applying the authentication information to perform authentication processing. If not, the BSF requests the UE to send an authentication request including the user identity.  2. The method according to claim 1, wherein the method further comprises: 01) The UE determines whether there is a B-TID in the local area, if yes, step 02), otherwise, step 03);  02) Send an authentication request containing the B-TID to the BSF, and then perform step a;  03) Send an authentication request containing the user identity to the BSF, and then perform step a. The method according to claim 2, wherein after the UE determines that the B-TID exists locally, the method further includes: determining whether the B-TID is within a valid period, and if yes, performing step 02), otherwise, Go to step 03).  The method according to claim 1, wherein the determining of the step a is performed based on the identified domain name. 5. The method according to claim 1, wherein the user identity is a permanent identity of the user, IMPI, or a permanent identity of the user, translated by the international mobile subscriber identity. A system for ensuring privacy of a user identity, the system comprising a UE, a BSF, and an HSS, wherein the system further includes an identifier selection module and an identifier identification module; Contains the B-TID and notifies the UE of the determined information;  The UE is configured to send an authentication request including a B-TID according to the received notification from the identifier selection module, or send an authentication request including the user identity identifier;  The identifier identifying module is configured to determine whether the identifier in the authentication request received by the BSF from the UE is a B-TID or a user identity, and notify the BSF of the determined information;  If the BSF determines that the received authentication request includes the B-TID, and determines that the B-TID is in the Β-ΉΌ, extracts the user identity corresponding to the B-TID, and requests the HSS according to the user identity. And authenticating the authentication information of the UE, and then applying the authentication information to perform an authentication process. If it is determined that the B-TID does not exist locally, the UE is notified to send an authentication request that includes the user identity.  If it is determined that the received authentication request includes the user identity, the authentication information of the UE is requested from the HSS according to the identity of the user, and then the authentication information is applied for authentication processing.  7. The system according to claim 6, wherein the user identity is a user's permanent identity IMPI or a user permanent identity MPL converted by an international mobile subscriber identity code.