WO2011032515A1 - 认证处理方法及装置 - Google Patents
认证处理方法及装置 Download PDFInfo
- Publication number
- WO2011032515A1 WO2011032515A1 PCT/CN2010/077085 CN2010077085W WO2011032515A1 WO 2011032515 A1 WO2011032515 A1 WO 2011032515A1 CN 2010077085 W CN2010077085 W CN 2010077085W WO 2011032515 A1 WO2011032515 A1 WO 2011032515A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- service
- authentication
- current service
- authenticated
- current
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
- H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
- H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/03—Protecting confidentiality, e.g. by encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/041—Key generation or derivation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/062—Pre-authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/069—Authentication using certificates or pre-shared keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/10—Integrity
- H04W12/106—Packet or message integrity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/60—Context-dependent security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/80—Wireless
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W36/00—Hand-off or reselection arrangements
- H04W36/0005—Control or signalling for completing the hand-off
- H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
- H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
- H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/90—Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W48/00—Access restriction; Network selection; Access point selection
- H04W48/02—Access restriction performed under specific conditions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W48/00—Access restriction; Network selection; Access point selection
- H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W76/00—Connection management
- H04W76/20—Manipulation of established connections
- H04W76/25—Maintenance of established connections
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W76/00—Connection management
- H04W76/50—Connection management for emergency connections
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
- H04W80/02—Data link layer protocols
Definitions
- the present invention claims the priority of the Chinese patent application filed on September 21, 2009, the Chinese Patent Office, the application number is 200910093828.5, and the invention name is "certification processing method and device", the entire contents of which are incorporated by reference.
- the present invention relates to the field of communications, and in particular, to an authentication processing method and apparatus.
- a Non-Access Stratum (NAS) count is part of a security context in a Long Term Evolution (LTE) system.
- LTE Long Term Evolution
- the NAS count can be used as the key life cycle to make the key fresh.
- the NAS count can ensure the synchronization of the user equipment (User Equipment, UE) with the network side key.
- UE User Equipment
- Each Evolved Packet System (EPS) security context contains two independent NAS count values: the upstream NAS count value and the downstream NAS count value. The counters of these two NAS counts are independently maintained by the UE and the Mobility Management Entity (MME).
- MME Mobility Management Entity
- the NAS count has 32 bits and is mainly composed of two parts: the NAS serial number (SQN) and the NAS overflow value (OVERFLOW), where the NAS serial number is 8 bits and the NAS overflow value is 16 bits.
- the NAS serial number is carried in each NAS message. When each new or retransmitted NAS message is sent, the sender will increase the NAS serial number by one; when the NAS serial number is increased to the maximum. Value, when the loop is over, the NAS overflow value is increased by 1.
- the MME when the MME detects that the downlink NAS count value is about to wrap, that is, when the NAS count value is close to the maximum value 2 24 , the MME will trigger a new EPS authentication and key agreement (Authentication and Key Agreement). , abbreviation: AKA ) Flow, establishes a new security context, and initializes the NAS count value to 0 when the security context is activated.
- AKA EPS authentication and key agreement
- Embodiments of the present invention provide an authentication processing method and apparatus for saving resources.
- An embodiment of the present invention provides another authentication processing method, including:
- the wireless communication network side device determines whether the network policy supports the current service without authentication.
- the current service is continued to be executed;
- the current service is continued to be executed.
- An embodiment of the present invention provides another authentication processing apparatus, including:
- An execution module configured to perform an authentication and key agreement process
- the processing module is located in the wireless communication network side device, and includes:
- a first determining unit configured to determine, in a case where the authentication and the key agreement process are performed on the user equipment, whether the network policy supports the current service without authentication
- a second determining unit configured to determine, according to the network policy, that the current service is not authenticated, whether the current service is a service that needs to be authenticated, or whether the user equipment has the capability of performing an authentication and a key negotiation process. Or the user equipment has an insertion card; the execution unit is configured to determine, in the second determining unit, that the current service is a service that does not need to be authenticated, or that the user equipment does not have performing authentication and key agreement Process capability, Or if the user equipment does not have a card inserted, the current service is continued to be executed.
- the connection is not immediately released, but the connection is released or the current service is continued according to the local information and the network policy, thereby avoiding releasing the connection that is not necessary to be released, thereby saving resources.
- FIG. 1 is a flowchart of an authentication processing method according to an embodiment of the present invention
- FIG. 2 is a flowchart of a method for processing authentication according to Embodiment 2 of the present invention.
- FIG. 3 is a flowchart of a method for processing authentication according to Embodiment 3 of the present invention.
- FIG. 4 is a flowchart of a method for processing authentication according to Embodiment 4 of the present invention.
- FIG. 5 is a flowchart of a method for processing authentication according to Embodiment 5 of the present invention.
- FIG. 6 is a flowchart of a method for processing authentication according to Embodiment 6 of the present invention.
- FIG. 7 is a flowchart of a method for processing authentication according to Embodiment 7 of the present invention.
- Embodiment 8 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 8 of the present invention.
- FIG. 9 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 9 of the present invention.
- FIG. 10 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 10 of the present invention.
- FIG. 11 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 11 of the present invention.
- FIG. 12 is a schematic structural diagram of an apparatus for processing an authentication according to Embodiment 12 of the present invention.
- FIG. 13 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 13 of the present invention.
- FIG. 1 is a flowchart of an authentication processing method according to an embodiment of the present invention. As shown in FIG. 1 , this embodiment specifically includes the following steps: Step 101: When the non-access stratum count value is close to the maximum value, the local information is detected. Step 102: Determine, according to the local information, whether to trigger an authentication and key agreement process with the user equipment.
- the NAS count value is close to the maximum value, that is, when the NAS count value is about to wrap, the authentication and key negotiation process can be the EPS AKA process.
- the executor of the two steps may be the MME.
- the MME detects the local information, and determines whether to trigger the EPS AKA process according to the detection result.
- the MME receives the NAS message, and the MME receives the NAS message, and the NAS count value is incremented by one; the MME detects whether the NAS count value is close to the maximum value. Specifically, the MME can detect whether the NAS count value is equal to the threshold value, and the threshold value. It is a preset value close to the maximum value; if yes, it detects the local information, and determines whether to trigger the authentication and key agreement process according to the detection result; otherwise, it continues to receive the NAS message.
- the MME does not trigger the EPS AKA process as soon as it detects that the NAS count value is about to wrap, which reduces the number of times the EPS AKA process is triggered, avoids the resource consumption caused by triggering the unnecessary EPS AKA process, and saves resources. .
- the EPS security context can be divided into the current EPS security context and the non-current EPS security context.
- the current EPS security context refers to the latest activated security context, which is the security context currently in use.
- the security context currently in use above can coexist with a set of non-current native EPS security contexts.
- the EPS security context can be divided into a mapped EPS security context and a native EPS security context.
- the mapping EPS security context refers to the security context mapped from other systems, such as mapping from Universal Mobile Telecommunications System (UMTS) to LTE. system.
- UMTS Universal Mobile Telecommunications System
- the local EPS security context refers to the security context generated by the EPS AKA in the LTE system.
- the local EPS security context is further divided into a partial native EPS security context and a full native EPS security context.
- the main difference is that some local EPS security contexts do not pass a successful NAS security.
- the mode process runs, so in the partial local EPS security context, only the root key K ASME , Key Set Identity (KSI), and the security capability of the UE that the UE accesses the LTE network are set and set to 0.
- the full local EPS security context is the security context activated by a successful NAS Security Mode Command (SMC) process after the EPS AKA process, which contains a complete set of EPS NAS security contexts. Therefore, the complete local EPS security context will additionally include the NAS layer integrity key K NASmt , the encryption key K NASenc , and the selected NAS encryption algorithm and integrity algorithm identification.
- FIG. 2 is a flowchart of a method for processing authentication according to Embodiment 2 of the present invention.
- the local information is a locally saved security context
- the following security contexts are local EPS security contexts.
- the embodiment specifically includes the following steps:
- Step 201 The MME receives the NAS message, and the NAS count value is incremented by one.
- Step 202 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 203; otherwise, performs step 201.
- a value close to the maximum value may be preset as a threshold value, and the MME detects whether the NAS count value is equal to the threshold value. If yes, step 203 is performed; otherwise, step 201 is performed.
- Step 203 The MME detects whether the locally saved security context includes a non-current security context in addition to the current security context. If yes, step 204 is performed; otherwise, the EPS AKA process is triggered.
- Step 204 Activate the non-current security context.
- the above non-current security context can be activated by successfully running the NAS SMC process.
- the successfully running NAS SMC process includes: The MME uses the security context to perform integrity protection on the NAS SMC message, and when the UE successfully authenticates the NAS SMC message integrity, sends the NAS to the MME. The Security Mode Complete message, the MME decrypts the NAS security mode completion message and performs integrity verification. The MME can then learn to share this security context with the UE and the security context is activated. Therefore, step 204 activates the non-current security context by successfully executing the NAS SMC process described above.
- the MME triggers the EPS A A process.
- the non-current local security context may include a non-current partial local security context or a non-current full local security context.
- the foregoing step 204 may be: the MME activates a non-current partial local security context or a non-current complete local security context.
- the non-current local security context shared by the MME and the UE is activated by successfully running the NAS SMC process triggered by the MME.
- the MME does not receive the NAS security mode complete message returned by the UE, the MME triggers the EPS AKA procedure.
- the MME learns that the MME and the UMTS Subscriber Identity Module Integrated Circuit Card (UICC) have saved a set of non-currents by detecting the security context.
- the MME activates the non-current partial security context, at which point the NAS count value is initialized to 0, thus eliminating the EPS AKA procedure.
- UICC UMTS Subscriber Identity Module Integrated Circuit Card
- the MME does not immediately trigger the EPS AKA process in this scenario, which avoids the waste of non-current part of the security context resources, and also avoids the resource consumption caused by performing the unnecessary EPS AKA process.
- the UE establishes the current security context in the process of accessing the EPS, and then the UE switches from the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) to the universal terrestrial radio access network.
- E-UTRAN Evolved Universal Terrestrial Radio Access Network
- GSMRAN GSM / EDGE Radio Access Network
- the MME when the MME detects that the NAS count value is close to the maximum value, the MME learns that the non-current complete security context is saved locally by detecting the security context, and the MME activates the non-current complete security context, thus eliminating the EPS AA. Process.
- the MME does not immediately trigger the EPS A A process in this scenario, which avoids the waste of the previously saved non-current complete security context resources, and also avoids the resource consumption caused by performing the unnecessary EPS AKA process.
- the MME does not trigger the EPS AKA process as soon as it detects that the NAS count value is about to wrap, which reduces the number of times the EPS AKA process is triggered, avoids the resource consumption caused by triggering the unnecessary EPS AKA process, and saves resources. .
- FIG. 3 is a flowchart of a method for processing authentication according to Embodiment 3 of the present invention.
- the local information is a timer state.
- a timer is preset on the MME, and the state of the timer may be running and stopping.
- the count value of the NAS counter reaches the threshold and the EPS AKA process is successfully completed, the state of the timer is turned to run; when the timer time reaches the set time threshold, the state of the timer is stopped.
- the embodiment specifically includes the following steps:
- Step 301 The MME receives the NAS message, and the NAS count value is incremented by one.
- Step 302 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 303; otherwise, performs step 301.
- a value close to the maximum value is preset as a threshold value. If the value is 2 24 -100, the MME detects whether the NAS count value is equal to 2 24 -100. If yes, step 303 is performed; otherwise, the step is performed. 301.
- Step 303 The MME detects whether the timer status is running, and if yes, performs step 304; otherwise, triggers the EPS AKA process.
- Step 304 Activate a non-current security context.
- the non-current security context is activated by a successful NAS SMC process run.
- a successful NAS SMC process includes: The MME uses the security context to perform integrity protection on the NAS SMC message. When the UE successfully authenticates the NAS SMC message integrity, the NAS sends a NAS security mode complete message to the MME, and the MME decrypts the NAS security mode complete message and performs the message. Integrity verification. The MME can then learn to share this security context with the UE and the security context is activated. Thus step 304 activates the non-current local security context by successfully executing the NAS SMC process described above.
- the MME triggers the EPS AKA process.
- the downlink NAS count value and the uplink NAS count value are generally not much different.
- the MME detects that the downlink NAS count value is about to wrap around, the uplink NAS count value will soon be detected to be around; and the MME triggers the EPS AKA process.
- the MME triggers the NAS SMC process, and by executing the NAS SMC process, the NAS count value is initialized to zero. If the MME detects that the downlink NAS count value is about to wrap around, the MME triggers the EPS AKA procedure, and before detecting that the uplink NAS count value is about to wrap, the NAS SMC process is not triggered to activate the newly generated security context, and the NAS count value is not present.
- the prior art detects that the upstream NAS count value is about to wrap and triggers the EPS AKA process again.
- the time from the last successful completion of the EPS AKA process has reached the set time threshold, which is successfully completed according to the EPS AKA process to the triggering of the NAS SMC.
- the MME triggers the NAS SMC process; when the current NAS count value is close to the maximum distance
- the MME triggers the EPS AKA process.
- FIG. 4 is a flowchart of a method for processing authentication according to Embodiment 4 of the present invention.
- the local information is a state machine state.
- the state machine needs to be preset in the MME, and the state of the state machine may be running and stopping. Specifically, the operation may be represented by 0, and the stop may be indicated by 1.
- the operation indicates that the time from the last EPS AKA process is successfully completed is less than the set time threshold, and the stop indicates that the time from the last EPS AKA process is successfully completed is greater than or equal to the set time threshold.
- the state machine can be triggered by a timer.
- the embodiment specifically includes the following steps:
- Step 401 The MME receives the NAS message, and the NAS count value is increased by 1.
- Step 402 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 403; otherwise, performs step 401.
- a value close to the maximum value is preset as a threshold value, and if it is set to 2 24 -100, the MME detects whether the NAS count value is equal to 2 24 -100, and if yes, performs step 403; otherwise, triggers EPS.
- AKA process a value close to the maximum value is preset as a threshold value, and if it is set to 2 24 -100, the MME detects whether the NAS count value is equal to 2 24 -100, and if yes, performs step 403; otherwise, triggers EPS. AKA process.
- Step 403 The MME detects whether the status of the status is 0. If yes, step 404 is performed; otherwise, the EPS A A process is triggered.
- Step 404 Activate a non-current security context.
- the non-current security context is activated by a successful NAS SMC process run.
- a successful NAS SMC process includes: The MME uses the security context to perform integrity protection on the NAS SMC message.
- the NAS sends a NAS security mode complete message to the MME, and the MME decrypts the NAS security mode completion message and performs Integrity verification.
- the MME can learn to share this security context with the UE, and the security context is activated. Therefore, step 404 activates the non-current local security context by successfully executing the NAS SMC process described above.
- the MME triggers the EPS AKA process.
- the downlink NAS count value and the uplink NAS count value are generally not much different.
- the MME detects that the downlink NAS count value is about to wrap around, the uplink will be detected soon.
- the NAS count value is about to wrap around; and, after the MME triggers the EPS AKA process, the MME triggers the NAS SMC process, and the NAS count value is initialized to 0 by executing the NAS SMC process.
- the MME detects that the downlink NAS count value is about to wrap around, the MME triggers the EPS AKA procedure, and before detecting that the uplink NAS count value is about to wrap, the NAS SMC is not triggered, and the NAS count value is not initialized, then the prior art It is detected that the upstream NAS count value is about to wrap, and the EPS AKA process is triggered again.
- the state of the state it can be known whether the time from the last successful completion of the EPS AKA process has reached the set time threshold, which is successfully completed according to the EPS AKA process to the triggering of the NAS SMC.
- the MME Time to determine, when the current NAS count value is close to the maximum distance from the last EPS AKA process successfully completed less than the set time threshold, the MME triggers the NAS SMC; when the current NAS count value is close to the maximum distance
- the MME triggers the EPS AKA process. Therefore, in the scenario of the above-mentioned practical application, the embodiment avoids triggering the EPS AKA process again after detecting that the uplink NAS count value is about to wrap, and the EPS AKA process is triggered again, thereby reducing the number of EPS AKA processes and avoiding the cause.
- the resource consumption caused by the unnecessary EPS AKA process is triggered, saving resources.
- FIG. 5 is a flowchart of a method for processing authentication according to Embodiment 5 of the present invention.
- the local information in this embodiment is the current service type, Quality of Service (QoS), or the ability of the user equipment to perform authentication.
- QoS Quality of Service
- the embodiment specifically includes the following steps:
- Step 501 The MME receives the NAS message, and the NAS count value is incremented by one.
- Step 502 The MME detects whether the NAS count value is close to the maximum value, and if yes, performs step 503; otherwise, performs step 501.
- a value close to the maximum value may be preset as a threshold value, and the MME detects whether the NAS count value is equal to the threshold value. If yes, step 503 is performed; otherwise, step 501 is performed.
- Step 503 The MME detects, by detecting the current service type, whether the current service requested by the UE corresponding to the current service type is a service that needs to be authenticated; or, the MME detects the QoS. Detecting whether the current service requested by the UE corresponding to the QoS is a service that needs to be authenticated; or, the MME detects whether the UE has the capability of performing an EPS AKA process by detecting the capability of the UE to perform authentication;
- step 504 is performed.
- Step 504 Continue to use the current security context, or do not perform security protection on the current service, or interrupt the connection of the current service.
- the present embodiment detects that the service requested by the UE is an emergency call (EMC) service, and detects that the service requested by the UE is not a service that needs to be authenticated, and the EPS AKA is no longer triggered.
- EMC emergency call
- the process while ignoring the detection result that the NAS count value is close to the maximum value, can continue to use the current security context, or not secure the current service, or interrupt the connection of the current service.
- the MME receives the General Packet Radio Service (GPRS) service support node (Service GPRS).
- GPRS General Packet Radio Service
- Support Node abbreviation: SGSN
- Kc security parameter
- K ASME encryption key
- IK Integrity Key
- the NAS count value starts at 0.
- the security protection of the UE in the LTE network is protected by the subkey derived from K ASME .
- the MME may detect that the UE is a SIM card user according to Kc, and does not have the capability of performing the EPS AKA process, the MME does not trigger the EPS AKA process, and ignores the detection result that the NAS count value is close to the maximum value. You can continue to use the current security context, or do not secure the current service, or interrupt the connection of the current service.
- the EPS AKA process when the service requested by the UE is not the service that needs to be authenticated or the UE does not have the capability of performing the authentication and key negotiation process, the EPS AKA process is not triggered, the number of EPS AKA processes is reduced, and the unnecessary triggering is avoided.
- the resource consumption caused by the EPS AKA process saves resources.
- FIG. 6 is a flowchart of a method for processing authentication according to Embodiment 6 of the present invention. As shown in Figure 6, this implementation The example specifically includes the following steps:
- Step 601 The MME receives the NAS message, and the NAS count value is incremented by one.
- Step 602 The MME detects whether the NAS count value is close to the maximum value. If yes, step 603 is performed; otherwise, step 601 is performed.
- the NAS count value may be an uplink NAS count value or a downlink NAS count value.
- a value close to the maximum value may be preset as a threshold value, and the MME detects whether the NAS count value is equal to the threshold value. If yes, step 603 is performed; otherwise, step 601 is performed.
- Step 603 The MME triggers the EPS AKA process, and the MME triggers the NAS SMC to activate the security context generated by the AKA process, and the NAS count value is initialized to 0.
- the EPS AKA process is bound to the execution of the NAS SMC, so that the NAS count value is about to wrap around in different directions (upstream direction and downlink direction), and the EPS AKA process is repeatedly triggered, and the number of EPS AKA processes is reduced. , avoiding resource consumption caused by triggering unnecessary EPS AKA process and saving resources.
- FIG. 7 is a flowchart of a method for processing authentication according to Embodiment 7 of the present invention. As shown in FIG. 7, the embodiment specifically includes the following steps:
- Step 801 The MME initiates an EPS AKA process.
- Step 802 In case the failure of the EPS AKA process is performed, the connection is released or the current service is continued according to the local information and the network policy.
- the MME initiates the EPS AKA process, which may be performed under various conditions, for example: when the NAS count value is close to the maximum value, the MME initiates the EPS AKA process; and the EPS AKA process may also be triggered by the operator's policy.
- the operator may set a certain current policy, and the MME may trigger the EPS AKA of the UE under the UE, which may be a policy formulated by the operator based on a certain security policy or other requirements;
- the EPS AKA procedure is triggered, specifically, when the UE switches from a network with a lower security level (such as a GSM or UMTS network) (including active state switching and idle state mobility) to a network with a higher security level (such as an LTE network).
- the EPS AKA process is triggered by the network side.
- the local information may include at least one of the following information: current service type, quality of service, The user device's ability to perform authentication, network policy, user identification module type, or information about whether the user device is plugged into the card.
- the current service type indicates the type information of the current service, and the MME can determine whether the current service is a service that needs to be authenticated according to the current service type.
- the QoS can identify services that do not need to be authenticated. Therefore, the MME can also determine whether the current service is a service that needs to be authenticated according to the quality of service.
- the UE's ability to perform authentication indicates whether the UE has relevant information for performing the EP SAA, and the MME may determine whether the UE has the capability to perform EPS AKA according to the UE's ability to perform authentication.
- the SIM card type also indicates whether the UE has relevant information for the ability to perform EPS AKA, and the MME can determine whether the UE has the capability to perform EPS AKA according to the SIM card type. Since the authentication needs to be performed when the UE inserts the card, for example, if the EPS AKA process fails after the UE inserts the card, the NAS signaling connection should be released; if the UE does not insert the card, it is determined according to the network policy whether to release the connection.
- a network policy is a policy set by a network side device, which can support whether the current service is authenticated.
- the foregoing step 802 may specifically include: if the MME determines that the network policy does not support the current service without authentication, the MME releases the connection of the current service;
- the MME determines that the current service is not authenticated by the network policy, and the MME determines that the current service is a service that does not need to be authenticated according to the current service type or the quality of service in the local information, or if the MME performs authentication according to the user equipment in the local information.
- the capability or the user identification module type determines that the user equipment does not have the capability to perform the authentication and key agreement process, or the user equipment does not insert the card, and then continues to execute the current service;
- the MME determines whether the current service is a service that needs to be authenticated according to the current service type or the service quality in the local information, or the MME performs the authentication according to the user equipment in the local information. Or the user identification module type determines that the user equipment has the ability to perform the authentication and key agreement process, or if the user equipment has an insertion card, the connection of the current service is released.
- the MME determines that the network policy supports the current service
- the MME detects that the service requested by the UE is an EMC service or a public alarm service by detecting the current service type. Since the EMC service or public alarm service is not a service that requires authentication, and the network policy supports unauthenticated EMC or public alarm services, the MME and the UE continue to perform the current service.
- the connection of the current service can be released by releasing the NAS signaling connection. If the NAS signaling connection carries multiple services and determines that the multiple current services need to be authenticated according to the current service type, the NAS signaling connection is released. If the service that requires authentication and the service that does not require authentication (such as EMC) are currently available, the EPS bearer corresponding to the service that needs to be authenticated is released, and the EPS bearer (such as EMC bearer) of the service that does not require authentication is maintained.
- EMC EMC bearer
- the authentication fails, the service requested by the UE is not the service that needs to be authenticated, or the UE does not have the capability to perform the EPS AKA process, or the user equipment does not insert the card, and the network policy supports the current service without authentication, and can continue to execute the current
- the business avoids the interruption of the current business execution and saves the resources of the system.
- FIG. 8 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 8 of the present invention.
- the embodiment specifically includes a detection module 11 and a processing module 12.
- the detecting module 11 is configured to detect local information when the non-access stratum count value is close to the maximum value
- the processing module 12 is configured to determine, according to the detection result, whether to trigger an authentication and key agreement process with the UE.
- the authentication processing apparatus provided in this embodiment can operate according to the method provided in the first embodiment.
- FIG. 9 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 9 of the present invention.
- the local information is a security context
- the processing module 12 includes a first activation unit 21 and a first trigger unit 22.
- the first activation unit 21 is configured to activate a non-current security context when the detection module 11 determines that the security context includes a non-current security context.
- the first triggering unit 22 is configured to: when the detection module 11 determines that the security context does not include a non-current security context, The authentication and key negotiation process is triggered.
- the processing module 12 of this embodiment may further include a transceiver unit 23, configured to send a NAS SMC to the UE, and receive a message that the NAS security mode is successfully executed, to the processing module.
- the first activation unit 21 of 12 transmits information that triggers its action.
- the first activation unit 21 activates the non-current security context according to the trigger information.
- the transceiver unit 23 does not receive the message that the NAS security mode returned by the UE is successful, the first trigger unit 22 triggers the authentication and key agreement procedure.
- the authentication processing apparatus provided in this embodiment can operate according to the method provided in the second embodiment.
- FIG. 10 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 10 of the present invention.
- the local information is a timer state
- the processing module 12 specifically includes a second activation unit 31 and a second trigger unit 32.
- the second activation unit 31 is configured to activate a non-current security context when the detection module 11 detects that the timer state is running.
- the second triggering unit 32 is configured to trigger the authentication when the detection module 11 detects that the timer state is stopped. And key negotiation process.
- the processing module 12 of the embodiment may further include a transceiver unit 33, configured to send a NAS SMC to the UE, and receive a message that the NAS security mode is successfully executed, and send the message to the second activation unit 31 in the processing module 12.
- the second activation unit 31 activates the non-current security context based on the trigger information.
- the transceiver unit 33 does not receive the message that the NAS security mode returned by the UE is successful, the second trigger unit 32 triggers the authentication and key agreement procedure.
- the authentication processing apparatus provided in this embodiment can operate according to the method provided in the third embodiment.
- FIG. 11 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 11 of the present invention.
- the local information is a state state
- the processing module 12 specifically includes a third activation unit 41 and a third trigger unit 42.
- the third activation unit 41 is configured to activate a non-current security context when the detection module 11 detects that the state state is running.
- the third triggering unit 42 is configured to trigger the authentication when the detection module 11 detects that the state state is stopped. And key negotiation process.
- the processing module 12 of this embodiment may further include a transceiver unit 43 configured to send a NAS SMC to the UE, and receive a message that the NAS security mode is successfully executed.
- the third activation unit 41 in the processing module 12 sends information triggering its action. Third activation unit
- the third trigger unit 42 triggers the authentication and key agreement procedure.
- the authentication processing apparatus provided in this embodiment can operate in accordance with the method provided in the fourth embodiment.
- FIG. 12 is a schematic structural diagram of an apparatus for processing an authentication according to Embodiment 12 of the present invention.
- the local information is the current service type, or the quality of service, or the capability of the user equipment to perform authentication
- the processing module 12 specifically includes a fourth trigger unit 51 and processing. Unit 52.
- the fourth triggering unit 51 is configured to: if the detecting module 11 determines that the service corresponding to the current service type is a service that needs to be authenticated, or determines that the service corresponding to the service quality is a service that needs to be authenticated, or determines that the capability of the user equipment to perform the authentication has performed.
- the ability to authenticate and key negotiation processes triggers the authentication and key negotiation process.
- the processing unit 52 is configured to: if the detecting module 11 determines that the service corresponding to the current service type is not the service that needs to be authenticated, or determines that the service corresponding to the service quality is not the service that needs to be authenticated, or determines that the capability of the user equipment to perform the authentication does not have the execution authentication and The ability of the key negotiation process continues to use the current security context, or does not protect the current service; or interrupts the connection of the current service.
- the authentication processing apparatus provided in this embodiment can operate according to the method provided in the above fifth embodiment.
- the EPS AKA process is triggered immediately upon detecting that the NAS count value is about to wrap, which reduces the number of times the EPS AKA process is triggered, avoids the resource consumption caused by triggering the unnecessary EPS AKA process, and saves resources. .
- FIG. 13 is a schematic structural diagram of an authentication processing apparatus according to Embodiment 13 of the present invention.
- the embodiment specifically includes an execution module 61 and a processing module 62.
- the execution module 61 is configured to perform an authentication and a key agreement process.
- the processing module 62 is configured to: when the execution module 61 performs the authentication and the key negotiation process fails, decide to release the connection or continue to perform the current service according to the local information and the network policy.
- the embodiment may further include a triggering module 63, where the triggering module 63 is configured to trigger the execution module 61 to execute under the trigger condition that the non-access stratum count value is close to the maximum value, the operator policy, or the user equipment performs inter-network handover. Authentication and key negotiation process.
- the above processing module 62 may further include: a first determining unit 64, a first releasing unit 65, a second determining unit 66, a second releasing unit 67, and an executing unit 68.
- the first determining unit 64 is configured to determine, in the case that the execution module 61 fails to perform the authentication and the key agreement process, whether the network policy supports the current service without authentication.
- the first releasing unit 65 is configured to determine, by the first determining unit 64, that If no, the connection of the current service is released.
- the second determining unit 66 is configured to determine, according to the current service type or the quality of service in the local information, whether the current service needs to be authenticated, if the first determining unit 64 determines that it is YES.
- the second release unit 67 is used to release the connection of the current service when the second determination unit 66 determines YES; and the execution unit 68 is configured to continue to execute the current service if the second determination unit 66 determines to be NO.
- the authentication processing apparatus provided in this embodiment can operate according to the method provided in the above-mentioned Embodiment 7.
- the authentication fails, the service requested by the UE is not the service that needs to be authenticated, or the UE does not have the capability to perform the EPS AKA process, or the user equipment does not insert the card, and the network policy supports the current service without authentication, and can continue to execute the current
- the business avoids the interruption of the current business execution and saves the resources of the system.
- the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
- Computer And Data Communications (AREA)
- Telephonic Communication Services (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Communication Control (AREA)
Description
Claims
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP18204267.1A EP3531731B1 (en) | 2009-09-21 | 2010-09-19 | Computer readable medium and apparatus for authentication |
EP10816719.8A EP2472928B1 (en) | 2009-09-21 | 2010-09-19 | Method and device for authentication processing |
BR112012006409-6A BR112012006409B1 (pt) | 2009-09-21 | 2010-09-19 | método e aparelho de autenticação |
EP17151314.6A EP3242498B1 (en) | 2009-09-21 | 2010-09-19 | Method and apparatus for authentication |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN2009100938285A CN102025685B (zh) | 2009-09-21 | 2009-09-21 | 认证处理方法及装置 |
CN200910093828.5 | 2009-09-21 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2011032515A1 true WO2011032515A1 (zh) | 2011-03-24 |
Family
ID=43757774
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2010/077085 WO2011032515A1 (zh) | 2009-09-21 | 2010-09-19 | 认证处理方法及装置 |
Country Status (6)
Country | Link |
---|---|
US (1) | US9088616B2 (zh) |
EP (3) | EP3531731B1 (zh) |
CN (1) | CN102025685B (zh) |
BR (1) | BR112012006409B1 (zh) |
TR (1) | TR201902606T4 (zh) |
WO (1) | WO2011032515A1 (zh) |
Families Citing this family (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9002357B2 (en) * | 2009-06-26 | 2015-04-07 | Qualcomm Incorporated | Systems, apparatus and methods to facilitate handover security |
CA2832067C (en) * | 2011-04-01 | 2019-10-01 | Interdigital Patent Holdings, Inc. | Method and apparatus for controlling connectivity to a network |
CN102595369B (zh) * | 2012-02-29 | 2015-02-25 | 大唐移动通信设备有限公司 | 一种nas算法的传输方法及装置 |
GB2500720A (en) * | 2012-03-30 | 2013-10-02 | Nec Corp | Providing security information to establish secure communications over a device-to-device (D2D) communication link |
GB2491047B (en) * | 2012-06-07 | 2013-12-11 | Renesas Mobile Corp | Apparatus and methods for security context selection |
US20140068098A1 (en) * | 2012-09-04 | 2014-03-06 | Qualcomm Incorporated | Reducing network latency resulting from non-access stratum (nas) authentication for high performance content applications |
US9519761B2 (en) * | 2012-09-06 | 2016-12-13 | Paypal, Inc. | Systems and methods for authentication using low quality and high quality authentication information |
CN103686651B (zh) * | 2012-09-12 | 2018-05-11 | 中兴通讯股份有限公司 | 一种基于紧急呼叫的认证方法、设备和*** |
KR101639541B1 (ko) * | 2012-09-24 | 2016-07-13 | 알까뗄 루슨트 | 통신 네트워크에서의 유저 인증 트리거링 |
CN103906049B (zh) * | 2012-12-28 | 2019-09-24 | 北京三星通信技术研究有限公司 | 一种同步辅小区和ue之间加密信息的方法 |
US9203835B2 (en) | 2013-03-01 | 2015-12-01 | Paypal, Inc. | Systems and methods for authenticating a user based on a biometric model associated with the user |
WO2015015714A1 (en) * | 2013-07-31 | 2015-02-05 | Nec Corporation | Devices and method for mtc group key management |
CN104270752B (zh) * | 2014-09-30 | 2017-10-27 | 新华三技术有限公司 | 无线网络中的密钥协商方法及装置 |
KR102213885B1 (ko) * | 2014-11-28 | 2021-02-08 | 삼성전자주식회사 | 무선 통신 시스템에서 보안 모드 제어 장치 및 방법 |
WO2017117721A1 (zh) | 2016-01-05 | 2017-07-13 | 华为技术有限公司 | 移动通信方法、装置及设备 |
CN105898894B (zh) * | 2016-05-13 | 2021-08-20 | 华为技术有限公司 | Rrc状态的控制方法和装置 |
US10462837B2 (en) | 2016-11-04 | 2019-10-29 | Qualcomm Incorporated | Method, apparatus, and system for reestablishing radio communication links due to radio link failure |
CN109842881B (zh) * | 2017-09-15 | 2021-08-31 | 华为技术有限公司 | 通信方法、相关设备以及*** |
WO2019196800A1 (en) | 2018-04-10 | 2019-10-17 | Mediatek Singapore Pte. Ltd. | Improvement for incorrect ksi handling in mobile communications |
US10805792B2 (en) * | 2018-09-07 | 2020-10-13 | Nokia Technologies Oy | Method and apparatus for securing multiple NAS connections over 3GPP and non-3GPP access in 5G |
CN110913393B (zh) * | 2018-09-15 | 2021-09-07 | 华为技术有限公司 | 切换方法和终端设备 |
CN109982260B (zh) * | 2019-03-08 | 2021-01-26 | 杭州迪普科技股份有限公司 | 信令的解密方法、装置、电子设备及机器可读存储介质 |
US11632695B2 (en) * | 2019-06-11 | 2023-04-18 | Qualcomm Incorporated | Evolved packet system (EPS) mobility configuration from wireless system |
US11991525B2 (en) | 2021-12-02 | 2024-05-21 | T-Mobile Usa, Inc. | Wireless device access and subsidy control |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101119381A (zh) * | 2007-09-07 | 2008-02-06 | 中兴通讯股份有限公司 | 防止重放攻击的方法及*** |
CN101237334A (zh) * | 2007-01-31 | 2008-08-06 | 华为技术有限公司 | 微波接入全球互通***及提供紧急业务的方法和设备 |
CN101272251A (zh) * | 2007-03-22 | 2008-09-24 | 华为技术有限公司 | 鉴权和密钥协商方法、认证方法、***及设备 |
US20090103728A1 (en) * | 2007-10-09 | 2009-04-23 | Sarvar Patel | Secure wireless communication |
Family Cites Families (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6125283A (en) * | 1998-05-18 | 2000-09-26 | Ericsson Inc. | Multi-mode mobile terminal and methods for operating the same |
US7587598B2 (en) * | 2002-11-19 | 2009-09-08 | Toshiba America Research, Inc. | Interlayer fast authentication or re-authentication for network communication |
US20050149440A1 (en) * | 2003-12-23 | 2005-07-07 | Leslie Michelassi | Systems and methods for routing requests for reconcilement information |
TWI249316B (en) * | 2004-02-10 | 2006-02-11 | Ind Tech Res Inst | SIM-based authentication method for supporting inter-AP fast handover |
US7372856B2 (en) * | 2004-05-27 | 2008-05-13 | Avaya Technology Corp. | Method for real-time transport protocol (RTP) packet authentication |
JP2005352710A (ja) * | 2004-06-10 | 2005-12-22 | Hitachi Ltd | 個人認証装置 |
US7877787B2 (en) * | 2005-02-14 | 2011-01-25 | Nokia Corporation | Method and apparatus for optimal transfer of data in a wireless communications system |
CN101056171A (zh) | 2006-06-20 | 2007-10-17 | 华为技术有限公司 | 一种加密通信方法和装置 |
US8699711B2 (en) | 2007-07-18 | 2014-04-15 | Interdigital Technology Corporation | Method and apparatus to implement security in a long term evolution wireless device |
CN101400059B (zh) | 2007-09-28 | 2010-12-08 | 华为技术有限公司 | 一种active状态下的密钥更新方法和设备 |
CN101470794A (zh) | 2007-12-27 | 2009-07-01 | 华为技术有限公司 | 无线射频识别***中的认证方法、设备和*** |
CN101232736B (zh) * | 2008-02-22 | 2012-02-29 | 中兴通讯股份有限公司 | 用于不同接入***之间密钥生存计数器的初始化设置方法 |
US8179903B2 (en) * | 2008-03-12 | 2012-05-15 | Qualcomm Incorporated | Providing multiple levels of service for wireless communication devices communicating with a small coverage access point |
US8693642B2 (en) * | 2009-04-16 | 2014-04-08 | Alcatel Lucent | Emergency call handling in accordance with authentication procedure in communication network |
-
2009
- 2009-09-21 CN CN2009100938285A patent/CN102025685B/zh active Active
-
2010
- 2010-09-19 EP EP18204267.1A patent/EP3531731B1/en active Active
- 2010-09-19 EP EP17151314.6A patent/EP3242498B1/en active Active
- 2010-09-19 WO PCT/CN2010/077085 patent/WO2011032515A1/zh active Application Filing
- 2010-09-19 TR TR2019/02606T patent/TR201902606T4/tr unknown
- 2010-09-19 EP EP10816719.8A patent/EP2472928B1/en active Active
- 2010-09-19 BR BR112012006409-6A patent/BR112012006409B1/pt active IP Right Grant
- 2010-09-21 US US12/886,949 patent/US9088616B2/en active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101237334A (zh) * | 2007-01-31 | 2008-08-06 | 华为技术有限公司 | 微波接入全球互通***及提供紧急业务的方法和设备 |
CN101272251A (zh) * | 2007-03-22 | 2008-09-24 | 华为技术有限公司 | 鉴权和密钥协商方法、认证方法、***及设备 |
CN101119381A (zh) * | 2007-09-07 | 2008-02-06 | 中兴通讯股份有限公司 | 防止重放攻击的方法及*** |
US20090103728A1 (en) * | 2007-10-09 | 2009-04-23 | Sarvar Patel | Secure wireless communication |
Non-Patent Citations (1)
Title |
---|
See also references of EP2472928A4 * |
Also Published As
Publication number | Publication date |
---|---|
EP3531731B1 (en) | 2020-08-19 |
EP2472928A1 (en) | 2012-07-04 |
EP3242498B1 (en) | 2018-12-12 |
US20110072488A1 (en) | 2011-03-24 |
EP2472928B1 (en) | 2017-03-08 |
EP3242498A1 (en) | 2017-11-08 |
CN102025685B (zh) | 2013-09-11 |
BR112012006409B1 (pt) | 2021-01-19 |
CN102025685A (zh) | 2011-04-20 |
EP2472928A4 (en) | 2012-07-04 |
BR112012006409A2 (pt) | 2016-04-12 |
EP3531731A1 (en) | 2019-08-28 |
TR201902606T4 (tr) | 2019-03-21 |
US9088616B2 (en) | 2015-07-21 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2011032515A1 (zh) | 认证处理方法及装置 | |
US10404677B2 (en) | Secure method for MTC device triggering | |
BR112020006242A2 (pt) | método de proteção de segurança, aparelho, e sistema | |
WO2009030164A1 (fr) | Procédé, système et dispositif pour empêcher l'attaque par dégradation pendant qu'un terminal se déplace | |
WO2009152759A1 (zh) | 防止网络安全失步的方法和装置 | |
KR20130054317A (ko) | 보안 구성들의 동기화를 용이하게 하는 방법들 및 장치들 | |
WO2009155835A1 (zh) | 密钥衍生方法、设备及*** | |
US11882433B2 (en) | Communication method and communications apparatus | |
CN111886885B (zh) | 恢复rrc连接时的安全验证 | |
WO2014059947A1 (zh) | 一种双向认证的方法、设备及*** | |
WO2019233432A1 (zh) | 一种验证网络合法性的方法及装置、计算机存储介质 | |
WO2015081784A1 (zh) | 一种验证安全能力的方法、设备及*** | |
CN102638793B (zh) | 认证处理方法及装置 | |
CN113396637B (zh) | 一种通信的方法、装置及*** | |
CN112822141B (zh) | 在wlan中防攻击的方法、装置、用户终端和计算机可读介质 | |
WO2019137250A1 (zh) | 一种完整性保护密钥管理方法和设备 | |
CN113170369A (zh) | 用于在***间改变期间的安全上下文处理的方法和装置 | |
WO2022178727A1 (zh) | 寻呼方法、装置及通信设备 | |
CN103458410A (zh) | 认证处理方法及装置 | |
WO2012159294A1 (zh) | 网络接入控制方法、终端和接入网络设备 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 10816719 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 718/KOLNP/2012 Country of ref document: IN |
|
REEP | Request for entry into the european phase |
Ref document number: 2010816719 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2010816719 Country of ref document: EP |
|
REG | Reference to national code |
Ref country code: BR Ref legal event code: B01A Ref document number: 112012006409 Country of ref document: BR |
|
ENP | Entry into the national phase |
Ref document number: 112012006409 Country of ref document: BR Kind code of ref document: A2 Effective date: 20120321 |