WO2018046017A1 - 信息处理方法、装置、电子设备及计算机存储介质 - Google Patents

信息处理方法、装置、电子设备及计算机存储介质 Download PDF

Info

Publication number
WO2018046017A1
WO2018046017A1 PCT/CN2017/101445 CN2017101445W WO2018046017A1 WO 2018046017 A1 WO2018046017 A1 WO 2018046017A1 CN 2017101445 W CN2017101445 W CN 2017101445W WO 2018046017 A1 WO2018046017 A1 WO 2018046017A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
identity information
negotiation
unit
network side
Prior art date
Application number
PCT/CN2017/101445
Other languages
English (en)
French (fr)
Inventor
刘福文
左敏
庄小君
彭晋
Original Assignee
***通信有限公司研究院
***通信集团公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***通信有限公司研究院, ***通信集团公司 filed Critical ***通信有限公司研究院
Publication of WO2018046017A1 publication Critical patent/WO2018046017A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support

Definitions

  • the present invention relates to the field of wireless communications technologies, and in particular, to an information processing method, apparatus, electronic device, and computer storage medium.
  • a temporary identity is allocated to the user equipment (User Equipment, UE) for accessing the network to hide the second identity information of the UE.
  • UE User Equipment
  • the second identity information sent by the UE to the network side may be stolen, resulting in leakage of the second identity information of the UE, which may result in poor security of the user's privacy.
  • embodiments of the present invention are directed to providing an information processing method, apparatus, electronic device, and computer storage medium, which can at least partially solve the above problems.
  • An embodiment of the present invention provides an information processing method, including:
  • the key negotiation is used to obtain an encryption key for encrypting the second identity information of the UE.
  • An embodiment of the present invention further provides an information processing method, including:
  • the second identity information of the UE is encrypted by using the encryption key, and is sent to the network side.
  • An embodiment of the present invention provides an information processing apparatus, including a first receiving unit, a determining unit, a first negotiating unit, and a decrypting unit:
  • the first receiving unit is configured to receive an attach request sent by the user equipment UE;
  • the determining unit is configured to determine whether the first identity information is carried in the attach request
  • the first negotiation unit is configured to perform key negotiation with the UE when the first identity information is not carried in the attach request, where the key negotiation is used to obtain a second for the UE Encryption key for identity information encryption;
  • the first receiving unit is configured to receive the sent second identity information that is encrypted by the UE by using the encryption key;
  • the decrypting unit is configured to decrypt the second identity information by using the encryption key; wherein the second identity information is used to allocate first identity information to the UE.
  • Another embodiment of the present invention provides an information processing apparatus, including:
  • a second sending unit configured to send an attach request to the network side
  • a second negotiation unit configured to perform key negotiation with the network side, where the key negotiation is sent when the network side determines that the first identity information of the user equipment UE is not carried in the attach request, And the key negotiation is used to obtain the second identity information of the user equipment UE.
  • Secret encryption key
  • the second sending unit is further configured to: encrypt the second identity information of the UE by using the encryption key, and send the second identity information to the network side.
  • An embodiment of the present invention further provides an electronic device, where the electronic device includes: a transceiver, a memory, and a processor; at least a portion of the memory stores computer executable instructions;
  • the processor is respectively coupled to the transceiver and the memory, configured to execute the computer executable instructions, and implement the information processing method provided by the one or more technical solutions by executing the computer executable instructions.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used in the information processing method provided by the foregoing one or more technical solutions.
  • the key negotiation is performed to form an encryption key for encrypting the second identity information, so that the UE can be encrypted to the network side.
  • the second identity information is encrypted and transmitted, so that the information leakage problem caused by transmitting the second identity information in the plaintext is reduced, and the security of the second identity information is improved.
  • FIG. 1 is a schematic flowchart diagram of a first information processing method according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of a second information processing method according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a first information processing apparatus according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic structural diagram of a second information processing apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a third information processing apparatus according to an embodiment of the present invention.
  • this embodiment provides an information processing method, including:
  • Step S110 Receive an attach request sent by the user equipment UE.
  • Step S120 Determine whether the first identity information is carried in the attach request.
  • Step S130 Perform key agreement with the UE when the first identity information is not carried in the attach request, where the key negotiation is used to obtain an encryption key for encrypting the second identity information of the UE. key;
  • Step S140 Receive second identity information that is sent by the UE by using the encryption key.
  • Step S150 Decrypt the second identity information by using the encryption key, where the second identity information is used to allocate first identity information to the UE.
  • the information processing method in this embodiment may be: a method applied to any one of the network elements on the network side, for example, may be applied to a Mobility Management Entity (MME) or a Home Subscriber Server (Home Subscriber Server, HSS) and other methods in network elements.
  • MME Mobility Management Entity
  • HSS Home Subscriber Server
  • these network elements may be collectively referred to as a Control Plane-Authentication Unit (CP-AU).
  • CP-AU Control Plane-Authentication Unit
  • the first identity information After receiving the attach request sent by the user equipment in this embodiment, it is first determined whether the first identity information is carried in the attach request, and if the UE has been assigned the first identity information, the default UE attach request carries the first An identity information, if the UE has not assigned the first identity information, the first identity information will not be carried in the attach request, or if the UE is assigned the first identity information, and the first identity If the information is available, the first identity information is carried in the attach request, otherwise it is not carried, and the network side needs to re-allocate the first identity information.
  • the first identity information may be temporary identity information temporarily allocated to the UE.
  • the first identity information may include a Globally Unique Temporary UE Identity (GUTI).
  • GUI Globally Unique Temporary UE Identity
  • the second identity information here may generate the first body for the network side.
  • a reference factor of the information for example, a correspondence between the first identity information and the second identity information needs to be established, so that the network side can identify each UE according to the first identity information.
  • the first identity information herein may be allocated to the UE by the network element on the network side, or generated.
  • the network side can refer to any network element or device other than the UE that constructs the communication network or the data network.
  • the first identity information and the second identity information are all predetermined types of identity information, for example, all of the identity information that the network element allocates for the UE.
  • the correspondence between the second identity information of the UE and the first identity information needs to be established, so that the second identity information of the UE needs to be acquired.
  • the UE may be directly sent an indication to the UE to report the second identity information.
  • the UE will report the second identity information in plain text, which obviously provides an opportunity for the illegal person to steal the second identity information of the UE, resulting in leakage of the second identity information of the UE.
  • the step S130 is performed first, and key negotiation is performed to generate an encryption key.
  • the key negotiation in this embodiment may include performing multiple data interactions with the UE to generate an encryption key.
  • the key interaction in the step S130 in this embodiment may be any type of key negotiation, for example, a symmetric key negotiation or an asymmetric key negotiation.
  • the secret generated by the key negotiation may be The key is referred to as an encryption key in this embodiment.
  • the second identity information encrypted with the encryption key will be received in step S140.
  • the second identity information of the UE is not transmitted in the plaintext, and the second identity information of the UE cannot be correctly interpreted after the unauthorized person steals. Since the encryption key is not known, the plaintext in the network is obviously avoided. Transmitting the leakage of the second identity information caused by the second identity information of the UE.
  • the second identity information here may be another identity information that is different from the first identity information and that can uniquely identify the UE, and may be formal identity information, which may be regarded as identity information permanently allocated to the UE, for example, The International Mobile Subscriber Identification Number (IMSI) of the UE.
  • IMSI International Mobile Subscriber Identification Number
  • the second identity information may also be a network slice identifier and a network access identifier and the like allocated to the UE.
  • the method further includes:
  • performing key negotiation with the UE includes:
  • the shared key is negotiated with the UE; and the shared key is negotiated based on the shared key.
  • the encryption key is negotiated based on the shared key.
  • the shared key may be a shared key DH key or K DH generated by Diffie-Hellman (DH) key negotiation.
  • the shared key is used in a secure mode command phase for deriving intermediate information determining whether the UE is currently subject to a predetermined type of attack.
  • the DH key negotiation in this embodiment may include various types of DH key negotiation, for example, ordinary DH key agreement and elliptic curve DH key agreement.
  • the shared key is further used to generate the session key, which changes the derivation of the session key based on the root key only in the prior art, and the derivation due to the leakage of the root key. The key is easy to crack and the security is not high.
  • the authentication vector is also used in the process of generating the session key; if the authentication vector is transmitted on an insecure link, the authentication vector may be leaked, and in this embodiment, the shared secret is introduced.
  • the key is used as the basis for generating the session key. Even if the authentication vector is leaked, the illegal attacker cannot directly obtain the session key, which obviously increases the difficulty of stealing the session key and improves the session key. safety.
  • the key negotiation is usually performed after entering the security mode command phase, which is advanced in the embodiment to the attach procedure triggered by the attach request of the UE.
  • the security mode command phase the shared key negotiation is not required, so that the signaling of the interaction between the UE and the network side is reduced, the information exchange process is simplified, and the power consumption of the UE is reduced.
  • the key request is triggered in the attach request, and the second identity information of the UE may be encrypted and protected, and the shared key is saved by the UE and the CP-AU.
  • the encryption key may be generated by using the shared key saved for the first time negotiation to perform the next encryption protection of the second identity information to simplify the next key agreement.
  • step S130 may include:
  • the shared key and the randomly generated first random number are used together to generate the encryption key.
  • the UE randomly generates a first random number, and the first random number and the shared key jointly generate the encryption key.
  • the CP-AU further receives the first random number to generate the encryption key in combination with the shared key, so as to facilitate subsequent decryption of the second identity of the UE by using the encryption key.
  • the decrypted second identity information can be used to perform various authentications to obtain the first identity information of the UE.
  • the second identity information is used to perform Authentication and Key Agreement (AKA) authentication.
  • AKA Authentication and Key Agreement
  • the shared key and the randomly generated second random number are used together to generate an integrity key; the integrity key is used to The second identity information is described for integrity protection.
  • the second random number may also be randomly generated by the UE, and the subsequent network side may receive the information sent by the UE, and generate an integrity key in combination with the shared key to complete the second identity information sent by the UE.
  • the method further includes:
  • the specific verification method may include: performing integrity calculation on the first information by using the first session key to obtain a first information verification code;
  • the information is used to trigger the UE to perform the integrity calculation on the first information by using the second session key generated by the UE to obtain a second information verification code, and compare the second information verification code with the first information verification code. And verifying whether the first session key and the second session key are the same; the second session key is generated based on the shared key, so that two session keys are completed on the UE side Verification
  • the method of the embodiment may further include: performing, by using the second session key, the UE to perform integrity verification on the second information, to obtain a third information verification code, where the network side receives the second information sent by the UE side and The third information verification code, the CP-AU on the network side calculates the second information integrity using the first session key, obtains the fourth information verification verification code, and compares the calculated verification code with the third information verification code. If the comparison is consistent, the network side can complete the verification of the two session keys and pass the verification.
  • the method can be verified by means of encryption and decryption.
  • the first session key decrypts the first information
  • the UE side uses the second session key to decrypt. If the decryption is not garbled, The verification can be considered as passed. In short, there are many ways to verify, and are not limited to any of the above.
  • the verification process of the session key generated by the network side and the UE is also introduced to ensure the consistency of the session key generated by the UE side and the network side, thereby reducing the current
  • the subsequent session fails due to the inconsistency of the session key generated by the network side and the UE.
  • the attach procedure triggered by the attach request may be terminated. If the verification succeeds, the subsequent steps may be continued.
  • the network side verification is performed, and if the network side verification fails, the UE side may also perform the verification. Terminate the attach process, otherwise continue subsequent verification.
  • the method further includes:
  • the step S130 may include:
  • key negotiation is performed with the UE.
  • the network side detects whether a predetermined type of attack is received, for example, detecting whether a Denial of Service (DoS) attack is received.
  • DoS Denial of Service
  • Different types of attacks have different methods of determination.
  • the DoS attack can determine whether the resource usage rate on the network side exceeds a preset threshold. If it exceeds, it can be considered that the DoS attack is currently being attacked.
  • the DoS attack causes a problem of repeatedly initiating an attach procedure.
  • a hash challenge indication is sent in this embodiment. If the UE can complete the hash challenge, it can be considered that there is no problem in performing real information interaction with the current UE, so the process proceeds to step S130 to negotiate the encryption key.
  • the hash challenge indication may include a hash value that is an n-bit number x and an attach request is subjected to a predetermined hash process.
  • the UE After receiving the hash value, the UE will use the predetermined hash process to obtain another number y, and send the y to the network side through the hash challenge response, and the network side compares x and y, if y is equal to x.
  • the hash challenges success otherwise it fails.
  • the x and the attach request are used, and the messages carried in the attach request sent by different UEs may be different, so that the security may be improved with respect to the statically set predetermined message.
  • the method further includes:
  • the difficulty level of the hash challenge is determined based on the severity information of the attack of the predetermined type.
  • the value of n can be determined in this embodiment, and if n is larger, the difficulty of the hash challenge is larger.
  • the n can be determined according to the current resource usage rate of the server.
  • the resource usage rate of the server may be proportional to the value of the value of the n.
  • the resource usage of the server herein may be processor usage, bandwidth usage, and/or storage resource usage. Therefore, in this embodiment, the difficulty level of the hash challenge is determined in combination with the severity information of the predetermined type of attack, thus implementing the hash challenge and the attack. The degree of verification matches, and the attack defense is better realized.
  • this embodiment provides an information processing method, including:
  • Step S210 Send an attach request to the network side
  • Step S220 Perform key agreement with the network side, where the key negotiation is sent when the network side determines that the first identity information of the user equipment UE is not carried in the attach request, and the secret is The key negotiation is used to obtain an encryption key for encrypting the second identity information of the user equipment UE;
  • Step S230 The second identity information of the UE is encrypted by using the encryption key, and sent to the network side.
  • the information processing method described in this embodiment may be an information processing method applied to the UE.
  • the UE sends the attach request to the base station on the network side when it needs to attach to the network. And when the UE sends the attach request, if it finds that it has been assigned the first identity information or not only the first identity information is allocated, and the first identity information that is allocated is available, the first identity information is carried in the Attached in the request.
  • the network side After the network side receives the attach request, it is determined whether the UE has been assigned the first identity information and/or the first identity information allocated to the UE is available.
  • the network side needs to obtain the second identity information of the UE, but in order to improve the security of the second identity information, It is required to perform key negotiation with the UE first, and negotiate an encryption key that can encrypt the second identity information transmission of the UE. Therefore, in step S220, the UE performs key agreement with the network side, where the key negotiation may include data interaction, thereby respectively generating a key that can encrypt the second identity information.
  • the key negotiation may be symmetric key agreement and asymmetric key agreement.
  • step S230 the second identity information of the UE to be encrypted by using the encryption key is sent to the network side, which obviously enhances the security of the second identity information in the transmission process.
  • the step S220 may include: sharing a key with the network side Negotiation; wherein the shared key is used for generation of a session key.
  • the key generation in the step S220 in this embodiment may be the negotiation of the foregoing DH key.
  • the negotiation and calculation of the DH key are not performed in the security mode command phase, and the UE and the network can be reduced.
  • the amount of data interaction on the side and the amount of information calculation reduce the hardware resources and power consumption that the UE consumes.
  • the generation of the DH key here is implemented by DH key negotiation, where the DH key negotiation can be various forms of DH keys.
  • the method further includes:
  • the encryption key is generated based on the shared key and the first random number.
  • the UE may generate a first random number by using a random algorithm, and generate the encryption key by using the first random number and the shared key.
  • other constants can also be introduced to generate the encryption key.
  • the method further includes:
  • the method further includes:
  • the second identity information is integrity protected by using the integrity key.
  • the second random number may be generated by the UE by using a random algorithm.
  • the UE sends the first random number and the second random number to the network side respectively.
  • the convenient network side also generates an encryption key and an integrity key in combination with a random number and a shared key.
  • other generation factors may also be introduced, for example, another constant is introduced, and the integrity key is generated by using a key generation algorithm.
  • the method further includes:
  • the UE can implement the verification of the session key by interacting with the authentication request message and the result of the verification on the network side, and avoid the problem of session failure caused by the inconsistency of the session key generated by the network side and the UE.
  • the verification of the session key here, reference may be made to the foregoing embodiment.
  • the method further includes:
  • the step S220 may include:
  • key negotiation is performed with the network side.
  • the predetermined type of attack may be the foregoing DoS attack.
  • the UE performs the step S220 by receiving the hash challenge indication and the hash challenge processing to form a hash challenge response, and the DoS attack and the like may be defended.
  • the embodiment provides an information processing apparatus, including: a first receiving unit 110, a determining unit 120, a first negotiating unit 130, and a decrypting unit 140:
  • the first receiving unit 110 is configured to receive an attach request sent by the user equipment UE;
  • the determining unit 120 is configured to determine whether the first identity information is carried in the attach request.
  • the first negotiating unit 130 is configured to perform key negotiation with the UE when the first identity information is not carried in the attach request, where the key negotiation is used to obtain the first Two encryption keys for identity information encryption;
  • the first receiving unit 110 is configured to receive the sent second identity information that is encrypted by the UE by using the encryption key;
  • the decrypting unit 140 is configured to decrypt the second identity information by using the encryption key, where the second identity information is used to allocate first identity information to the UE.
  • This embodiment provides an information processing apparatus, which may be applied to an MME. Or an information processing structure in a CP-AU such as HSS. ,
  • the physical structure corresponding to the first receiving unit 110 and the first negotiating unit 130 may include a communication interface.
  • the communication interface can be used to receive data sent by the UE.
  • the hardware structure corresponding to the first negotiating unit 130 may further include a processor or a processing circuit.
  • the determining unit 120 and the decrypting unit 140 may also correspond to a processor or a processing circuit.
  • the processor may include a central processing unit CPU, a digital signal processor DSP, a microprocessor MCU, a digital signal processor DSP or an application processor AP or a programmable array PLC, and the like.
  • the processing circuit can include an application specific integrated circuit.
  • the processor or the processing circuit can implement the data processing of the determining unit 120, the first negotiating unit 130, and the decrypting unit 140 by performing the execution of the predetermined code, so as to avoid the second identity information of the UE by using the key negotiation.
  • the plaintext transmission enhances the protection of the second identity information of the UE.
  • the determining unit 120 is further configured to determine whether the UE completes negotiation of a shared key, where the shared key is used for generating a session key;
  • the first negotiating unit 130 is configured to perform negotiation of the shared key with the UE when the first identity information is not carried in the attach request, and the UE does not complete the negotiation of the shared key;
  • the encryption key is generated based on the negotiation of the shared key.
  • the determining unit 120 is configured to perform the negotiation of the shared key.
  • the negotiation of the shared key is used as the negotiation of the encryption key, so that the encryption can be completed by using the shared key negotiation.
  • the negotiation of the key does not need to repeat the negotiation of the shared key, which simplifies the information interaction with the UE and reduces the calculation amount of the key.
  • the negotiation may be any one of the foregoing DH key negotiation.
  • the first negotiating unit 130 is further configured to generate the shared key based on a negotiation with a shared key of the UE; wherein the shared key and the randomly generated first random The numbers are used together to generate the encryption key.
  • the shared key is used to generate an encryption key together with the first random number.
  • the shared key and the randomly generated second random number are used in common Generating an integrity key; the integrity key is used to perform integrity protection on the second identity information.
  • the encryption key and the integrity key are simultaneously generated by using the shared key, so that the second identity information can be encrypted and protected by using the encryption key, and the second identity information can be guaranteed by using the integrity key. protection.
  • the apparatus further includes: a first generating unit and a first verifying unit: the first generating unit, configured to generate the first session key according to the shared key;
  • a verification unit is configured to verify whether the first session key and the second session key generated by the UE according to the shared key are consistent by performing information interaction with the UE.
  • the verification of the key is performed on the network side and the UE side, respectively, based on the session key generated by the shared key, and the subsequent reduction of the session key generated by the network side and the UE side may be reduced by verification.
  • the phenomenon of session failure is performed on the network side and the UE side, respectively, based on the session key generated by the shared key, and the subsequent reduction of the session key generated by the network side and the UE side may be reduced by verification.
  • the apparatus further includes: a determining unit and a first sending unit:
  • the determining unit is configured to determine whether there is currently a predetermined type of attack; the first sending unit is configured to send a hash challenge indication to the UE when subjected to a predetermined type of attack; the first receiving unit 110.
  • the first negotiation unit 130 is configured to receive a hash challenge response returned by the UE according to the hash challenge indication, where the first negotiation unit 130 is configured to: when the hash challenge response indicates that the hash challenge is successful, Perform key negotiation.
  • a hash challenge process can be performed to defend against the predetermined type of attack.
  • the determining unit is further configured to determine a difficulty level of the hash challenge according to the severity information of the attack of the predetermined type. In this way, it is possible to perform a hash challenge of different difficulty for a predetermined type of attack of different severity to balance the calculation of computation and security.
  • the embodiment further provides an information processing apparatus, including:
  • the second sending unit 210 is configured to send an attach request to the network side
  • the second negotiating unit 220 is configured to perform key negotiation with the network side, where the key association The quotient is sent when the network side determines that the first identity information of the user equipment UE is not carried in the attach request, and the key negotiation is used to obtain encryption for encrypting the second identity information of the user equipment UE. Key
  • the second sending unit 220 is further configured to: encrypt the second identity information of the UE by using the encryption key, and send the second identity information to the network side.
  • the information processing apparatus in this embodiment may be an information processing apparatus that is used in the UE, and may reduce the UE to send the second identity information to the network side in the form of a plaintext, and reduce the second identity by using the key negotiation triggered by the attach request.
  • the risk of information exposure increases the security of the second identity information.
  • the second sending unit 220 may correspond to a communication interface such as a transmitting antenna in the UE.
  • the second negotiating unit 220 can include a processor or processing circuitry.
  • the processor or processing circuit herein can be referred to the foregoing embodiment and will not be repeated here. Also the processor or processing circuitry may complete the key negotiation by execution of a predetermined code.
  • the second negotiating unit 220 is configured to perform a negotiation of a shared key with the network side; wherein the shared key is used for generation of a session key.
  • the shared key is obtained by DH key negotiation.
  • the apparatus further comprises: a second generating unit configured to generate a first random number; and generating the encryption key based on the shared key and the first random number.
  • the first random number here may be any one of randomly generated values, and the shared key and the first random number generate an encryption key.
  • the second generating unit is further configured to generate a second random number; generate an integrity key based on the shared key and the second random number; the apparatus further includes: integrity And a protection unit configured to perform integrity protection on the second identity information by using the integrity key.
  • the first random number and the second random number are randomly generated, and may be the same or different. When implemented, the first random number and the second random number are different.
  • the second generating unit generates a random number and finds that two random numbers are the same, and may regenerate at least the first One of a random number and a second random number, so that it is convenient to generate different encryption keys and integrity keys.
  • the algorithm for generating the encryption key and the integrity key may be the same or different, and is preferably different in this embodiment to improve the security and privacy of the second identity information. .
  • the second generating unit is configured to generate a second session key according to the shared key; the device further includes a second verification unit configured to perform information interaction with the network side, Verifying whether the second session key and the first session key generated by the network side according to the shared key are consistent.
  • the second generation unit here is also configured to generate a second session key.
  • the physical structure corresponding to the second verification unit may also be a processor or a processing circuit, and the processor or the processing circuit may implement the verification of the session key by executing the predetermined code, and avoid the session key generated by the network side and the UE side.
  • the second receiving unit is configured to receive a hash challenge indication sent by the network side when it is determined that the attack is subjected to a predetermined type; the apparatus further includes: a response unit, configured to respond to the a hash challenge indication, returning a hash challenge response to the network side; the second negotiation unit 220, configured to perform key negotiation with the network side when the hash challenge response determines that the hash challenge is successful .
  • the device in this embodiment also introduces a response unit whose physical structure can likewise correspond to a processor or processing circuit.
  • the processor or processing circuitry can be executed by code to implement the processing of the hash challenge.
  • the second negotiating unit will perform key negotiation only when the hash challenge is successful; this can avoid the UE that is negotiated and the key that is negotiated is leaked when the key negotiation is received. The problem of the leakage of the second identity information.
  • the present example provides an information processing method that can be divided into multiple stages; as shown in FIG. 5, the stage can include an identity management phase, an AKA phase, and a security mode command phase.
  • the identity management phase in FIG. 5 may include steps 1-5; the AKA phase may include steps 6-8;
  • the segment may include steps 9, 10.
  • the information processing method provided in this example may specifically include:
  • the UE sends an attach request to the CP-AU to initiate an attach procedure.
  • the CP-AU sends an identity request and carries a hash challenge indication, which may include: the CP-AU determines that the attachment request does not carry temporary identity information such as GUTI, and detects whether the CP-AU and the UE have been established. DH key K DH . If the attach request does not carry temporary identity information such as GUTI and does not establish a DH key with the UE, the identity request is sent. CP-AU will proceed to step 6. Otherwise, the CP-AU sends an identity request back to the UE, which optionally includes a hash challenge indication to defeat the DoS attack. If the attach request message does not contain a temporary identity, the CP-AU also sends an identity request message to the UE.
  • a hash challenge indication may include: the CP-AU determines that the attachment request does not carry temporary identity information such as GUTI, and detects whether the CP-AU and the UE have been established. DH key K DH . If the attach request does not carry temporary identity information such as GU
  • the construction method of the hash challenge is as follows: CP-AU randomly generates a positive integer x with a binary length of n, and calculates the hash value of x and the attach request, ie hash (x, attach request), where n is by CP-AU The degree of use of the resource is determined, and the higher the degree of use of the resource, the larger the value of n. Hash (x, attach request) and n form a hash challenge.
  • the UE solves the hash challenge, generates the DH private key KU pri , and calculates the DH public key KU pub .
  • the step 2a may specifically include: the UE receives the identity request message, if the hash challenge indication exists, the UE will first try to find the correct integer x ⁇ , by comparing the hash (x, attach request) with the hash (x, attach request) ) is equal.
  • the integer x ⁇ is used as a hash response.
  • the UE generates a DH private key KU pri and calculates a corresponding DH public key KU pub .
  • the UE sends the DH public key KU pub and the hash challenge response to the CP-AU.
  • Step 3a Verify the hash challenge response, generate the DH private key KC pri and calculate the DH public key KC pub to derive the shared key K DH between the UE and the CP-AU.
  • Step 3a may specifically include: after receiving the response from the UE, if the hash response is included in the message, the CP-AU compares it with x. CP-AU will abort the attach process if the hash response is not equal to x. Otherwise, the CP-AU generates the DH private key KC pri and computes the associated DH public key KC pub . Furthermore, the CP-AU derives the shared key K DH with the UE by using its private key KC pri and the public key KU pub of the UE.
  • the CP-AU sends the DH public key KC pub to the UE, which may include performing DH key negotiation normally.
  • Step 4a The UE pushes the shared key K DH between the outgoing and the CP-AU to generate a random number nonce, and uses the nonce and K DH to calculate the encryption key K E .
  • Step 4a may specifically include: after receiving the KC pub , the UE derives the shared key K DH from the CP-AU by using its private key KU pri and the public key KC pub of the CP-AU. In order to encrypt the official identity information of the UE, the UE generates a random number nonce and derives the encryption key K E and the integrity key K M .
  • K E and K M are calculated as follows:
  • K E KDF (nonce, K DH , C1)
  • K M KDF(nonce, K DH , C2)
  • KDF is the key derivation function. If the authentication encryption method is used to encrypt the identity of the UE, only the encryption key K E is generated.
  • the C1 and C2 are two constants.
  • the random numbers nonce, K DH , C1 are known quantities for generating an encryption key.
  • the nonce, K DH and C2 are known quantities that generate an integrity key.
  • the K M here is used for integrity verification. In this example, both the integrity key and the encryption key may be generated using the same random number nonce.
  • the UE sends the official identity information and MAC0 encrypted by the nonce and K E to the CP-AU.
  • the step 5 may include the UE deriving an encryption key K E and an integrity key K M .
  • the UE first encrypts the official identity information by using K E , and uses K M to calculate the verification code MAC0 of the message and transmits it to the CP-AU.
  • the official identity information here corresponds to the aforementioned second identity information.
  • the CP-AU sends an authentication data request to an Authentication Authorization Accounting (AAA) server.
  • the authentication data request carries official identity information of the UE.
  • the step 6 may specifically include: in the same manner as the UE, the CP-AU derives the encryption key K E and the integrity key K M .
  • CP-AU It first verifies MAC0. If the verification is successful, the CP-AU decrypts the encrypted part of the message with K E to obtain the official identity information of the UE. Otherwise, the CP-AU terminates the attach procedure.
  • the AAA server sends the authentication vector to the CP-AU. Specifically, the AAA server searches for the root key Ki of the UE according to the official identity information of the UE, and calculates an authentication vector according to the root key Ki. The AAA server then sends the authentication vector to the CP-AU.
  • the mutual authentication of the CP-AU and the UE may include: calculating an intermediate key K mid based on the authentication vector sent by the AAA server, including: UE and CP-AU are respectively pushed to K mid and calculated by using K mid and K DH respectively .
  • the CP-AU sends the security mode command message and the MAC1 to the UE, and the method may include: the CP-AU sends a security mode command message to the UE, where the authentication code MAC1 of the security mode command message is calculated by using the session key Ks.
  • the UE sends the security mode complete message and the MAC2 to the CP-AU to the CP-AU, which may specifically include: the UE verifies the received MAC1 by using the session key Ks. If the verification fails, the UE terminates the attach procedure. Otherwise, the UE completes the message response CP-AU in a secure mode whose message authentication code MAC2 is calculated by using the session key Ks.
  • the CP-AU checks the correctness of the MAC2. If the check fails, the CP-AU aborts the attach process. Otherwise, the UE and the CP-AU complete the attach procedure.
  • MAC2 and MAC1 may correspond to the information verification code in the aforementioned session key verification process.
  • the UE and the CP-AU can guarantee that they have the same session key Ks after successfully verifying MAC1 and MAC2 respectively. This further means that they already have the same shared key K DH .
  • the last key K DH is stored in the UE and CP-AU, respectively, for generating a new session key in the next attach procedure.
  • An embodiment of the present invention further provides an electronic device, where the electronic device includes: a transceiver, a memory, and a processor; at least a portion of the memory stores computer executable instructions;
  • the processor is respectively connected to the transceiver and the memory, configured to execute the computer executable instructions, by executing one or more of the information processing methods applicable to the network side executable by the computer, or Implementing a letter applied to the UE by computer executable instructions
  • the information processing method may, for example, perform one or more of the methods shown in FIGS. 1, 2, and 5.
  • the computing executable instructions can include: a computer program and/or software.
  • the transceiver in this embodiment may correspond to a network interface, and the network interface may be a cable interface, and may be used for data interaction of other network elements.
  • the memory can include: various types of storage media that can be used for data storage.
  • the memory includes a storage medium that is at least partially a non-volatile storage medium and can be used to store computer-executable instructions such as the computer program.
  • the processor may comprise: a central processing unit, a microprocessor, a digital signal processor, an application processor, an application specific integrated circuit or a programmable array, etc., which may be used to implement second identity information by execution of computer executable instructions.
  • a central processing unit a microprocessor, a digital signal processor, an application processor, an application specific integrated circuit or a programmable array, etc., which may be used to implement second identity information by execution of computer executable instructions.
  • the processor can be connected to the transceiver and the memory through an in-device bus such as an integrated circuit bus.
  • the electronic device provided in this embodiment may include: the foregoing information processing device applied to the network element or the UE, for example, may include the information processing device shown in FIG. 3 or FIG. 4.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the information processing method applied to the network side by executing the computer.
  • One or more, or for implementing an information processing method applied to the UE by computer executable instructions for example, one or more of the methods shown in FIGS. 1, 2, and 5 may be performed.
  • the computer storage medium provided by the embodiment of the invention includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. Medium.
  • the computer storage medium can be a non-transitory storage medium.
  • the non-transitory storage medium herein may also be referred to as a non-volatile storage medium.
  • the disclosed device and party The law can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
  • the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.
  • the units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; the above integration
  • the unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
  • ROM read-only memory
  • RAM random access memory
  • magnetic disk or an optical disk.
  • optical disk A medium that can store program code.
  • the network element determines whether the connection request sent by the UE carries the predetermined identity information (that is, the first identity information), and if it is not carried, it can be considered that the UE is not currently assigned the predetermined identity information, and then After the key negotiation process is completed, the second identity information is automatically allocated, and the second identity information is sent to the UE.
  • the self-use allocation of the predetermined identity information is realized, and on the other hand, the encrypted transmission is performed by the negotiated key, the probability of the second identity information being secreted is reduced, and the security of the second identity is improved. Therefore, it has a positive industrial effect.
  • the technical solution provided by the embodiment of the present invention can be implemented by modifying the information interaction process between the network element and the UE, and has the advantages of simple implementation and wide promotion in the field of communication and network technologies.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Databases & Information Systems (AREA)

Abstract

本发明实施例公开了一种信息处理方法及装置，所述方法可包括：接收用户设备UE发送的附着请求；判断附着请求中是否有携带第一身份信息；当附着请求中未携带有第一身份信息时，与UE进行密钥协商；其中，密钥协商用于获得对UE的第二身份信息加密的加密密钥；接收UE利用加密密钥加密的发送的第二身份信息；利用加密密钥解密第二身份信息。本发明实施例还同时公开了一种电子设备及计算机存储介质。

Description

信息处理方法、装置、电子设备及计算机存储介质
本申请基于申请号为201610818481.6、申请日为2016年09月12日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明涉及无线通信领域技术，尤其涉及一种信息处理方法、装置、电子设备及计算机存储介质。
背景技术
在现有技术中为了提升信息安全性，确保用户的隐私性。会在用户设备(User Equipment,UE)分配一个临时身份用于接入网络，以隐藏UE的第二身份信息。但是在UE首次接入到网络的过程中，还是可能会被窃取到UE发送给网络侧的第二身份信息，导致UE的第二身份信息的泄漏，进而导致用户的隐私的安全性差的问题。
发明内容
有鉴于此，本发明实施例期望提供一种信息处理方法、装置、电子设备及计算机存储介质，可以至少部分解决上述问题。
本发明实施例的技术方案是这样实现的：
本发明实施例提供了一种信息处理方法，包括：
接收用户设备UE发送的附着请求；
判断所述附着请求中是否有携带第一身份信息；
当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商； 其中，所述密钥协商用于获得对所述UE的第二身份信息加密的加密密钥；
接收所述UE利用所述加密密钥加密的发送的第二身份信息；
利用所述加密密钥解密所述第二身份信息；其中，所述第二身份信息用于为所述UE分配第一身份信息。
本发明实施例还提供了一种信息处理方法，包括：
向网络侧发送附着请求；
与网络侧进行密钥协商；其中，所述密钥协商是在所述网络侧确定出所述附着请求中未携带有用户设备UE的第一身份信息时发送的，且所述密钥协商用于获得对用户设备UE的第二身份信息加密的加密密钥；
将利用所述加密密钥加密所述UE的第二身份信息，发送给所述网络侧。
本发明实施例提供了一种信息处理装置，包括第一接收单元、判断单元、第一协商单元及解密单元：
所述第一接收单元，配置为接收用户设备UE发送的附着请求；
所述判断单元，配置为判断所述附着请求中是否有携带第一身份信息；
所述第一协商单元，配置为当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商；其中，所述密钥协商用于获得对所述UE的第二身份信息加密的加密密钥；
所述第一接收单元，配置为接收所述UE利用所述加密密钥加密的发送的第二身份信息；
所述解密单元，配置为利用所述加密密钥解密所述第二身份信息；其中，所述第二身份信息用于为所述UE分配第一身份信息。
本发明实施例还提供了另一种信息处理装置，包括：
第二发送单元，配置为向网络侧发送附着请求；
第二协商单元，配置为与网络侧进行密钥协商；其中，所述密钥协商是在所述网络侧确定出所述附着请求中未携带有用户设备UE的第一身份信息时发送的，且所述密钥协商用于获得对用户设备UE的第二身份信息加 密的加密密钥；
所述第二发送单元，还配置为将利用所述加密密钥加密所述UE的第二身份信息，发送给所述网络侧。
本发明实施例还提供一种电子设备，其中，所述电子设备包括：收发器、存储器及处理器；至少部分所述存储器存储有计算机可执行指令；
所述处理器，分别与所述收发器及存储器连接，配置为执行所述计算机可执行指令，通过执行所述计算机可执行指令实现前述一个或多个技术方案提供的信息处理方法。
本发明实施例还提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于前述一个或多个技术方案提供的信息处理方法。
本发明实施例提供的技术方案中，在判断出附着请求中没有携带有预定的身份信息时，将进行密钥协商，形成加密第二身份信息的加密密钥，这样可以使UE加密向网络侧加密传输第二身份信息，这样可以减少以明文传输第二身份信息导致的信息泄露问题，提升第二身份信息的使用安全性。
附图说明
图1为本发明实施例提供的第一种信息处理方法的流程示意图；
图2为本发明实施例提供的第二种信息处理方法的流程示意图；
图3为本发明实施例提供的第一种信息处理装置的结构示意图；
图4为本发明实施例提供的第二种信息处理装置的结构示意图；
图5为本发明实施例提供的第三种信息处理装置的结构示意图。
具体实施方式
以下结合说明书附图及具体实施例对本发明的技术方案做进一步的详细阐述，应当理解，以下所说明的优选实施例仅用于说明和解释本发明， 并不用于限定本发明。
如图1所示，本实施例提供一种信息处理方法，包括：
步骤S110：接收用户设备UE发送的附着请求；
步骤S120：判断所述附着请求中是否有携带第一身份信息；
步骤S130：当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商；其中，所述密钥协商用于获得对所述UE的第二身份信息加密的加密密钥；
步骤S140：接收所述UE利用所述加密密钥加密的发送的第二身份信息；
步骤S150：利用所述加密密钥解密所述第二身份信息；其中，所述第二身份信息用于为所述UE分配第一身份信息。
本实施例所述的信息处理方法可为：应用于网络侧任意一个网元中的方法，例如，可为应用于移动管理实体(Mobility Management Entity，MME)或归属签约用户服务器(Home Subscriber Server，HSS)等网元中的方法。在本实施例中这些网元可以统称为控制面认证单元(Control Plane-Authentication Unit，CP-AU)。这些实体可以通过基站与用户设备进行信息交互。
在本实施例中接收到用户设备发送的附着请求之后，先判断附着请求中是否携带有第一身份信息，若UE已经被分配了第一身份信息，则默认UE的附着请求中就会携带第一身份信息，若UE还未分配第一身份信息，则所述附着请求中将不会携带所述第一身份信息，或者，若所述UE被分配了第一身份信息，且该第一身份信息可用，则所述附着请求中会携带所述第一身份信息，否则就不会携带，需要网络侧重新分配所述第一身份信息。这里的第一身份信息可为临时分配给UE使用的临时身份信息，例如，所述第一身份信息可包括全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)。当然，这里的第二身份信息可为网络侧生成所述第一身 份信息的参考因素，例如，需要建立所述第一身份信息和所述第二身份信息的对应关系，方便网络侧根据所述第一身份信息识别各个UE。总之，这里的第一身份信息可为网络侧的网元为UE分配的，或者，生成的。这里的网络侧，可以泛指构建通信网络或数据网络的UE以外的任意网元或设备。在一些实施例中，所述第一身份信息和所述第二身份信息，均为预定类型的身份信息，例如，均是网元为UE分配的身份信息。
而在分配第一身份信息的过程中，为了方便后续用户设备的识别，需要建立该UE的第二身份信息与第一身份信息的对应关系，故需要获取该UE的第二身份信息。在现有技术中，可能就会直接向UE发送指示，让UE上报第二身份信息。通常此时，所述UE就会明文上报所述第二身份信息，这样显然为窃取所述UE的第二身份信息的非法者提供了可趁之机，导致了UE的第二身份信息的泄漏。而在本实施例中首先会执行所述步骤S130将进行密钥协商，生成加密密钥。在本实施例中所述密钥协商可包括与UE进行多次数据交互，以生成加密密钥。
在本实施例中所述步骤S130中的密钥交互，可以为任意一种密钥协商，例如，可以是对称密钥协商，也可以是非对称密钥的协商，总之，密钥协商生成的密钥在本实施例中都称为加密密钥。
在步骤S140中将接收到利用加密密钥加密后的第二身份信息。这样在传输过程中，UE的第二身份信息不会以明文传输，非法者窃取到之后不能够正确解读出UE的第二身份信息，因不知道加密密钥，显然避免了在网络中以明文传输所述UE的第二身份信息导致的第二身份信息的泄漏，。这里的第二身份信息可为与所述第一身份信息不同的另一个可以唯一标识所述UE的身份信息，可为正式身份信息，可认为是永久分配给所述UE的身份信息，例如，所述UE的国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)。当然在本实施例中所述第二身份信息还可以是分配给UE的网络切片标识以及网络接入标识符等。
在一些实施例中，所述方法，还包括：
判断所述UE是否完成共享密钥的协商；其中，所述共享密钥用于会话密钥的生成；
所述当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商，包括：
当所述附着请求中未携带有第一身份信息时且所述UE未完成共享密钥的协商时，与所述UE进行所述共享密钥的协商；基于所述共享密钥的协商生成所述加密密钥。
在本实施例中所述共享密钥可为利用迪菲赫尔曼(Diffie-Hellman，DH)密钥协商，生成的共享密钥DH密钥或称为KDH。通常所述共享密钥是用于安全模式命令阶段用于导出确定所述UE当前是否有受到预定类型的攻击的中间信息。在本实施例中所述DH密钥协商可包括各种类型的DH密钥协商，例如，普通的DH密钥协商以及椭圆曲线DH密钥协商。且在本实施例中所述共享密钥还用于生成所述会话密钥，这样就改变了现有技术中仅依据根密钥推导所述会话密钥，由于根密钥的泄露导致的推导出的密钥容易被破解及安全性不高的问题。此外，生成所述会话密钥的过程中，还会使用到认证向量；若认证向量在不安全的链路传输，则可能会导致认证向量的泄露，而在本实施例中由于引入了共享密钥作为所述会话密钥的生成依据，即便所述认证向量泄露了，非法攻击者也无法直接获得所述会话密钥，显然增大了会话密钥被窃取的难度，提升了会话密钥的安全性。
在现有技术中，通常密钥协商是在进入安全模式命令阶段之后进行的，在本实施例中将其提前到UE的附着请求触发的附着流程中。这样后续在安全模式命令阶段，就不用再进行所述共享密钥的协商了，这样就减少了UE与网络侧交互的信令，简化信息交互流程，减少了UE的功耗。。此外，在本实施例中在附着请求触发了密钥协商，一方面可以对所述UE的第二身份信息进行加密保护，与此同时UE和CP-AU都会保存着所述共享密钥，另 外下一次发送附着请求时，可以利用首次协商保存的共享密钥生成所述加密密钥，以进行下一次所述第二身份信息的加密保护，以简化下一次的密钥协商。
可选地，所述步骤S130可包括：
基于与所述UE的共享密钥的协商，生成所述共享密钥；
其中，所述共享密钥和随机产生的第一随机数，共同用于生成所述加密密钥。
完成所述共享密钥的协商之后，UE将随机产生一个第一随机数，该第一随机数和共享密钥，共同生成所述加密密钥。可选地，所述CP-AU还会接收到所述第一随机数，以结合所述共享密钥生成所述加密密钥，方便后续利用所述加密密钥解密所述UE的第二身份信息。解密出的第二身份信息可用于进行各种认证，从而获得所述UE的第一身份信息。例如，利用所述第二身份信息进行认证与密钥协商协议(Authentication and Key Agreement,，AKA)认证。
为了确保信息在传输过程中的完整性，在本实施例中，所述共享密钥和随机产生的第二随机数，共同用于生成完整性密钥；所述完整性密钥用于对所述第二身份信息进行完整性保护。这里的第二随机数也可以是UE随机产生的，后续网络侧会从UE发送的信息中接收到，并结合所述共享密钥生成完整性密钥，对UE发送的第二身份信息进行完整性验证，以确保第二身份信息在传输中没有被篡改或泄漏。此外，所述方法还包括：
根据所述共享密钥生成所述第一会话密钥；
通过与所述UE进行信息交互，验证所述第一会话密钥和所述UE根据所述共享密钥生成的第二会话密钥是否一致。
具体的验证方法，可包括：利用所述第一会话密钥对第一信息进行完整性计算，得到第一信息验证码；
将所述第一信息及第一信息验证码发送给所述UE；其中，所述第一信 息用于触发所述UE利用自身生成的第二会话密钥对第一信息进行完整性计算得到第二信息验证码，并将所述第二信息验证码与所述第一信息验证码进行比对，验证所述第一会话密钥和所述第二会话密钥是否相同；所述第二会话密钥是基于所述共享密钥生成的，这样就在UE侧完成了两个会话密钥的验证；
接着，所述UE可以将验证的结果告知网络侧即可；这样的话，验证双方就都知道了验证结果。当然，本实施例所述的方法还可包括：UE侧利用第二会话密钥对第二信息进行完整性验证，得到第三信息验证码；这样网络侧接收到UE侧发送的第二信息及第三信息验证码，网络侧的CP-AU将利用第一会话密钥对所述第二信息完整性计算，得第四信息验证验证码，将计算得到的验证码与第三信息验证码比对，比对出一致可认为网络侧完成两个会话密钥的验证且验证通过。当然验证的方法还有很多，例如可以通过加密解密的方式进行验证，例如，有第一会话密钥解密所述第一信息，UE侧利用第二会话密钥进行解密，若解密后不是乱码则可认为验证通过。总之，验证的方式有多种，不局限于上述任意一种。
在本实施例中所述DH密钥协商过程中，还引入了网络侧和UE生成的会话密钥的验证过程，以确保UE侧和网络侧生成的会话密钥的一致性，从而可以减少现有技术中由于网络侧和UE生成的会话密钥的不一致导致的后续会话失败的问题。UE侧，发现验证不通过时，可种终止附着请求触发的附着流程，若验证通过，可继续后续步骤，例如在本实施例中还会进行网络侧的验证，若网络侧验证失败，也可以终止所述附着流程，否则继续后续验证。
此外，所述方法还包括：
确定当前所述是否有受到预定类型的攻击；
当受到预定类型的攻击时，向所述UE发送哈希挑战指示；
接收所述UE基于所述哈希挑战指示返回的哈希挑战响应；
所述步骤S130可包括：
当所述哈希挑战响应指示哈希挑战成功时，与所述UE进行密钥协商。
在本实施例中所述网络侧会检测是否收到预定类型的攻击，例如，检测是否收到拒绝服务(Denial of Service，DoS)攻击。不同类型的攻击，具有不同的确定方法。例如，所述DoS攻击，可以判断网络侧的资源使用率是否超过预设的阈值，若超过，可认为当前受到所述DoS攻击。为了避免所述预定类型的攻击导致的问题，例如，所述DoS攻击导致的反复发起附着流程的问题。在本实施例中会发送哈希挑战指示。若UE能够完成哈希挑战，则可认为与当前UE进行真实信息交互是不存在问题的，故将进入步骤S130进行加密密钥的协商。例如，所述哈希挑战指示可包括哈希值，该哈希值是一个n位的数x与附着请求经过预定哈希处理得到的。UE接收到哈希值之后，将利用预定哈希处理，得到另一个数y，并将该y通过所述哈希挑战响应发送给网络侧，网络侧比对x和y，若y等于x可认为哈希挑战成功，否则失败。当然，哈希挑战的方法还很多，不局限于上述方法。例如，还可以将n位的x与某一个预定消息哈希得到所述哈希值。在本实施例利用x与附着请求，由于不同的UE发送的附着请求中携带的消息可能不同，从而相对于静态设置的预定消息，可以提升安全性。
所述方法还包括：
根据受到所述预定类型的攻击的严重程度信息，确定所述哈希挑战的难易程度。
例如，在本实施例中可以决定所述n的值，若n越大，则哈希挑战的难度越大。例如，可以根据目前服务器的资源使用率的高低，确定所述n。在本实施例中所述服务器的资源使用率的高低与所述n的取值大小，可呈正比。这里的服务器的资源使用率可为处理器的使用率、带宽的使用率和/或存储资源的使用率等。故在本实施例中将结合预定类型的攻击的严重程度信息，确定哈希挑战的难易程度，这样实现了哈希挑战与受到的攻击的 验证程度的匹配，更好的实现了攻击防御。
如图2所示，本实施例提供一种信息处理方法，包括：
步骤S210：向网络侧发送附着请求；
步骤S220：与网络侧进行密钥协商；其中，所述密钥协商是在所述网络侧确定出所述附着请求中未携带有用户设备UE的第一身份信息时发送的，且所述密钥协商用于获得对用户设备UE的第二身份信息加密的加密密钥；
步骤S230：将利用所述加密密钥加密所述UE的第二身份信息，发送给所述网络侧。
本实施例所述的信息处理方法可为应用于UE中的信息处理方法。在步骤S210中所述UE在需要附着到网络时，向网络侧的基站发送所述附着请求。且UE在发送附着请求时，若发现自身已经被分配了第一身份信息或不仅分配了第一身份信息且分配的第一身份信息可用时，则会将所述第一身份信息携带在所述附着请求中。
这样方便网络侧接收到所述附着请求之后，判断所述UE是否已经被分配了第一身份信息和/或分配给UE的第一身份信息是否可用。
在步骤S220中若UE被网络侧确定出未分配第一身份信息和/或第一身份信息不可用，网络侧需要获得UE的第二身份信息，但是为了提升第二身份信息的安全性，则需要和UE首先进行密钥协商，协商出可以加密所述UE的第二身份信息传输的加密密钥。故在步骤S220中UE将与网络侧进行密钥协商，这里的密钥协商可包括数据交互，从而各自生成可以加密所述第二身份信息的密钥。在本实施例中所述密钥协商可以为对称密钥协商和非对称密钥协商。
在步骤S230中，将会利用加密密钥加密的UE的第二身份信息发送给网络侧，显然这样提升第二身份信息在传输过程中的安全性。
在一些实施例中，所述步骤S220可包括：与所述网络侧进行共享密钥 的协商；其中，所述共享密钥用于会话密钥的生成。
在本实施例中所述步骤S220中的密钥生成，可为前述DH密钥的协商，这样的话，后续在安全模式命令阶段就不用在进行DH密钥的协商和计算，可以减少UE与网络侧的数据交互量及信息计算量，减少UE因此消耗的硬件资源和功耗等。这里的DH密钥的生成，是通过DH密钥协商实现的，这里的DH密钥协商可为各种形式的DH密钥。
在一些实施例中，所述方法还包括：
生成第一随机数；
基于所述共享密钥和所述第一随机数，生成所述加密密钥。
在本实施例中所述UE可以采用随机算法生成第一随机数，利用第一随机数和共享密钥生成所述加密密钥。实现时，还可以引入其他常数来生成所述加密密钥。
可选地，所述方法还包括：
生成第二随机数；
基于所述共享密钥和所述第二随机数，生成完整性密钥；
所述方法还包括：
利用所述完整性密钥，对所述第二身份信息进行完整性保护。
这里的第二随机数，也可以UE采用随机算法生成的，在后续与网络侧的信息交互过程中，所述UE会将所述第一随机数和所述第二随机数分别发送给网络侧，方便网络侧也结合随机数和共享密钥生成加密密钥和完整性密钥。当然在生成完整性密钥生成的过程中，也可以引入其他生成因素，例如，引入另一个常数，利用密钥生成算法生成所述完整性密钥。
在一些实施例中，所述方法还包括：
根据所述共享密钥生成第二会话密钥；
通过与所述网络侧进行信息交互，验证所述第二会话密钥和所述网络侧根据所述共享密钥生成的第一会话密钥是否一致。
在本实施例中UE通过与网络侧的认证请求消息及验证的结果的交互，可以实现会话密钥的验证，可以避免网络侧和UE生成的会话密钥的不一致导致的会话失败的问题。这里的会话密钥的验证详细描述，可以参见前述实施例。
此外，所述方法还包括：
接收网络侧在确定出有受到预定类型的攻击时，发送的哈希挑战指示；
响应所述哈希挑战指示，向所述网络侧返回哈希挑战响应；
所述步骤S220可包括：
当所述哈希挑战响应确定出哈希挑战成功时，与所述网络侧进行密钥协商。
在本实施例中所述预定类型的攻击，可为前述DoS攻击。在本实施例中UE通过所述哈希挑战指示的接收，以及哈希挑战的处理，形成哈希挑战响应的成功时，才进行所述步骤S220，可以防御所述DoS攻击等。
如图3所示，本实施例提供一种信息处理装置，包括：第一接收单元110、判断单元120、第一协商单元130及解密单元140：
所述第一接收单元110，配置为接收用户设备UE发送的附着请求；
所述判断单元120，配置为判断所述附着请求中是否有携带第一身份信息；
所述第一协商单元130，配置为当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商；其中，所述密钥协商用于获得对所述UE的第二身份信息加密的加密密钥；
所述第一接收单元110，配置为接收所述UE利用所述加密密钥加密的发送的第二身份信息；
所述解密单元140，配置为利用所述加密密钥解密所述第二身份信息；其中，所述第二身份信息用于为所述UE分配第一身份信息。
本实施例提供了一种信息处理装置，该信息处理装置可为应用于MME 或HSS等CP-AU中的信息处理结构。，
所述第一接收单元110及所述第一协商单元130对应的物理结构可包括通信接口。该通信接口可用于接收UE发送的数据。
所述第一协商单元130对应的硬件结构还可包括处理器或处理电路。
所述判断单元120和所述解密单元140同样可对应于处理器或处理电路。所述处理器可包括中央处理器CPU、数字信号处理器DSP、微处理器MCU、数字信号处理器DSP或应用处理器AP或可编程阵列PLC等。所述处理电路可包括专用集成电路。所述处理器或处理电路可通过预定代码的执行，可以实现上述判断单元120、第一协商单元130及解密单元140的数据处理，从而通过密钥的协商，避免所述UE的第二身份信息的明文传输，提升UE的第二身份信息的保护。
在一些实施例中，所述判断单元120，还配置为判断所述UE是否完成共享密钥的协商；其中，所述共享密钥用于会话密钥的生成；
所述第一协商单元130，配置为当所述附着请求中未携带有第一身份信息时且所述UE未完成共享密钥的协商时，与所述UE进行所述共享密钥的协商；基于所述共享密钥的协商生成所述加密密钥。
在本实施例中所述判断单元120，配置为进行共享密钥的协商，在本实施例将共享密钥的协商作为所述加密密钥的协商，这样可以利用共享密钥的协商，完成加密密钥的协商，后续也不用再重复所述共享密钥的协商，简化了与UE之间的信息交互，减少密钥的计算量。在本实施例中所述协商可为前述任意一种DH密钥协商。
在一些实施例中，所述第一协商单元130，还配置为基于与所述UE的共享密钥的协商，生成所述共享密钥；其中，所述共享密钥和随机产生的第一随机数，共同用于生成所述加密密钥。在本实施例中所述共享密钥用于和第一随机数，共同生成加密密钥。
在一些实施例中，所述共享密钥和随机产生的第二随机数，共同用于 生成完整性密钥；所述完整性密钥用于对所述第二身份信息进行完整性保护。
在本实施例中同时利用共享密钥生成加密密钥和完整性密钥，这样利用加密密钥可以对第二身份信息进行加密保护，还可以利用完整性密钥对第二身份信息进行保证性保护。
在一些实施例中，所所述装置还包括：第一生成单元及第一验证单元：所述第一生成单元，配置为根据所述共享密钥生成所述第一会话密钥；所述第一验证单元，配置为通过与所述UE进行信息交互，验证所述第一会话密钥和所述UE根据所述共享密钥生成的第二会话密钥是否一致。
在本实施例中还会对进行网络侧和UE侧，分别基于共享密钥生成的会话密钥进行密钥的验证，可以通过验证减少因为网络侧和UE侧生成的会话密钥不一致导致后续的会话失败的现象。
在一些实施例中，所述装置还包括：确定单元及第一发送单元：
所述确定单元，配置为确定当前是否有受到预定类型的攻击；所述第一发送单元，配置为当受到预定类型的攻击时，向所述UE发送哈希挑战指示；所述第一接收单元110，配置为接收所述UE基于所述哈希挑战指示返回的哈希挑战响应；所述第一协商单元130，配置为当所述哈希挑战响应指示哈希挑战成功时，与所述UE进行密钥协商。
在本实施例中还会在检测到受到预定类型的攻击时，可以进行哈希挑战的处理，从而防御所述预定类型的攻击。可选地，所述确定单元，还配置为根据受到所述预定类型的攻击的严重程度信息，确定所述哈希挑战的难易程度。这样可以针对不同严重程度预定类型的攻击，实现不同难度的哈希挑战的处理，以平衡计算量和安全性的处理。
如图4所示，本实施例还提供了一种信息处理装置，包括：
第二发送单元210，配置为向网络侧发送附着请求；
第二协商单元220，配置为与网络侧进行密钥协商；其中，所述密钥协 商是在所述网络侧确定出所述附着请求中未携带有用户设备UE的第一身份信息时发送的，且所述密钥协商用于获得对用户设备UE的第二身份信息加密的加密密钥；
所述第二发送单元220，还配置为将利用所述加密密钥加密所述UE的第二身份信息，发送给所述网络侧。
本实施例所述信息处理装置，可为运行在UE中的信息处理装置，通过在附着请求触发的密钥协商，可以减少UE以明文的形式向网络侧发送第二身份信息，减少第二身份信息暴露的风险，提升第二身份信息的安全性。
所述第二发送单元220可对应于UE中的发送天线等通信接口。所述第二协商单元220可包括处理器或处理电路。这里的处理器或处理电路可参见前述实施例中，此处就不在重复了。同样所述处理器或处理电路可通过预定代码的执行，完成所述密钥协商。
在一些实施例中，所述第二协商单元220，配置为与所述网络侧进行共享密钥的协商；其中，所述共享密钥用于会话密钥的生成。例如，通过DH密钥协商，获得所述共享密钥。
在一些实施例中，所述装置还包括：第二生成单元，配置为生成第一随机数；基于所述共享密钥和所述第一随机数，生成所述加密密钥。
这里的第一随机数可为随机生成的任意的一个数值，所述共享密钥和第一随机数生成加密密钥。
在一些实施例中，所述第二生成单元，还配置为生成第二随机数；基于所述共享密钥和所述第二随机数，生成完整性密钥；所述装置还包括：完整性保护单元，配置为利用所述完整性密钥，对所述第二身份信息进行完整性保护。
所述第一随机数和所述第二随机数都是随机生成的，可以相同，也可以不同，实现时，所述第一随机数和所述第二随机优选为不同。所述第二生成单元在生成随机数，发现两个随机数相同，则可以至少重新生成第一 随机数和第二随机数中的一个，从而可以方便生成不同的加密密钥和完整性密钥。但是在一些实施例中，生成所述加密密钥和所述完整性密钥的算法可以相同，也可以不同，在本实施例中优选为不同，以提升第二身份信息的安全性和隐私性。
在一些实施例中，所述第二生成单元，配置为根据所述共享密钥生成第二会话密钥；所述装置还包括第二验证单元，配置为通过与所述网络侧进行信息交互，验证所述第二会话密钥和所述网络侧根据所述共享密钥生成的第一会话密钥是否一致。
这里的第二生成单元，还会配置为生成第二会话密钥。所述第二验证单元对应的物理结构同样可为处理器或处理电路，处理器或处理电路通过预定代码的执行，可以实现会话密钥的验证，避免网络侧和UE侧生成的会话密钥的不同导致的问题。
在一些实施例中，所述第二接收单元，配置为接收网络侧在确定出有受到预定类型的攻击时，发送的哈希挑战指示；所述装置还包括：响应单元，用于响应所述哈希挑战指示，向所述网络侧返回哈希挑战响应；所述第二协商单元220，用于当所述哈希挑战响应确定出哈希挑战成功时，与所述网络侧进行密钥协商。
在本实施例中所述装置还引入了响应单元，该响应单元的物理结构同样可对应于处理器或处理电路。所述处理器或处理电路可通过代码执行，实现哈希挑战的处理。所述第二协商单元，将在哈希挑战成功时，才进行密钥协商；这样可以避免在收到预定类型的攻击时，还进行密钥协商导致协商的密钥被泄漏，从而导致的UE的第二身份信息的泄漏的问题。
以下结合上述实施例提供一个具体的示例：
本示例提供一种信息处理方法，可分为多个阶段；如图5所示，所述阶段可包括身份管理阶段、AKA阶段及安全模式命令阶段。在图5中身份管理阶段可包括步骤1-5；所述AKA阶段可包括步骤6-8；安全模式命令阶 段可包括步骤9、10。本示例提供的信息处理方法可具体包括：
1：UE向CP-AU发送附着请求，以发起附着流程。
2：CP-AU发送身份请求，并携带有哈希挑战指示，具体可包括：CP-AU判断出附着请求中未携带GUTI等临时身份信息，并检测到CP-AU与UE是否已将建立了DH密钥KDH。若附着请求中未携带GUTI等临时身份信息且未与UE建立DH密钥，则发送身份请求。CP-AU将进入第6步。否则，CP-AU发送身份请求返回给UE，其可选地包括用以挫败DoS攻击的哈希挑战指示。如果附着请求消息中不含有临时身份，CP-AU同样也发身份请求消息给UE。如果CP-AU确定自己受到DoS攻击，CP-AU就会把哈希挑战指示嵌入到身份请求里。哈希挑战的构造方法如下：CP-AU随机生成与二进制长度为n的正整数x，并计算x和附着请求的哈希值，即hash(x，附着请求)，其中n是由CP-AU使用资源的程度确定的，使用资源程度越高，n值越大。hash(x，附着请求)和n构成哈希挑战。
2a：UE解出哈希挑战，生成DH私钥KUpri，并计算DH公钥KUpub。步骤2a具体可包括：UE在收到身份请求消息，如果哈希挑战指示存在，UE将首先尝试找到正确的整数x`，通过比较hash(x`，附着请求)是否与hash(x，附着请求)相等得出。整数x`作为哈希响应。UE生成DH私钥KUpri，并计算相应的DH公钥KUpub。
3：UE将DH公钥KUpub及哈希挑战响应发送给CP-AU。
3a：验证哈希挑战响应，生成DH私钥KC pri并计算DH公钥KCpub推导UE和CP-AU间的共享密钥KDH。步骤3a具体可包括：接收来自UE的响应后，如果哈希响应包括在该消息中，CP-AU把它与x进行比较。CP-AU将中止附着流程，如果哈希响应不等于x。否则，CP-AU生成DH私钥KCpri，并计算相关的DH公钥KCpub。此外，CP-AU通过使用其私钥KCpri和UE的公钥KUpub派生出与UE之间的共享密钥KDH。
4：CP-AU向UE发送DH公钥KCpub，具体可包括正常进行DH密钥协商。
4a：UE推到出和CP-AU间共享密钥KDH，生成随机数nonce，使用nonce和KDH计算加密密钥KE。步骤4a具体可包括：接收KCpub后，UE通过使用其私钥KUpri和CP-AU的公钥KCpub派生出与CP-AU之间的共享密钥KDH。为了加密UE的正式身份信息，UE产生一个随机数nonce，并导出加密密钥KE和完整性密钥KM。KE和KM的计算方法如下：
KE＝KDF(nonce,KDH,C1)；
KM＝KDF(nonce,KDH,C2)；
这里KDF是密钥推导函数。如果采用认证加密方法用于加密UE的身份，只要生成加密密钥KE。所述C1和C2为两个常数。所述随机数nonce、KDH,C1为生成加密密钥的已知量。所述nonce,KDH及C2为生成完整性密性密钥的已知量。这里的KM用于进行完整性验证。在本示例中，所述完整性密钥和所述加密密钥的生成都可以采用同一个所述随机数nonce。
5：UE将nonce以及KE加密后的正式身份信息及MAC0发送给CP-AU。所述步骤5可包括：UE推导出加密密钥KE和完整性密钥KM。UE首先利用KE加密正式身份信息，并利用KM计算该消息的验证码MAC0，并传输给CP-AU。这里的正式身份信息对应于前述的第二身份信息。
6：CP-AU向认证授权记账(Authentication Authorization Accounting，AAA)服务器发送认证数据请求。该认证数据请求携带有所述UE的正式身份信息。所述步骤6可具体包括：以UE同样的方式，CP-AU导出加密密钥KE和完整性密钥KM。CP-AU它首先验证MAC0，如果验证成功，则CP-AU用KE解密消息的加密部分，以获得UE的正式身份信息，否则，CP-AU终止附着流程。
7：AAA服务器向CP-AU发送认证向量，具体可包括：AAA服务器根据UE的正式身份信息查找UE的根密钥Ki，并依据根密钥Ki计算出认证向量。然后AAA服务器发送认证向量给CP-AU。
8：CP-AU与UE相互认证，具体可包括：基于AAA服务器发送的认证向量，计算出中间密钥Kmid，包括：UE和CP-AU分别推到Kmid并使用Kmid和KDH计算会话密钥Ks。例如，可利用Ks＝KDF(KDH,Kmid)计算得到所述会话密钥Ks。
9：CP-AU向UE发送安全模式命令消息及MAC1，具体可包括：CP-AU发送安全模式命令消息给UE，该安全模式命令消息的认证码MAC1是通过使用会话密钥Ks来计算。
10：UE向CP-AU发送安全模式完成消息及MAC2给CP-AU，可具体包括：UE通过使用会话密钥Ks验证所接收的MAC1。如果验证失败，则UE终止附着流程。否则，UE用安全模式完成消息响应CP-AU，其消息认证码MAC2是通过使用会话密钥Ks来计算。接到安全模式完成消息后，CP-AU检查MAC2的正确性。如果检查失败，CP-AU中止附着流程。否则，UE和CP-AU完成附着流程。这里的MAC2和MAC1可相当于前述会话密钥验证过程中的信息验证码。
UE和CP-AU在分别成功验证MAC1和MAC2后可以保证他们拥有相同的会话密钥Ks。这进一步意味着，他们已经拥有相同的共享密钥KDH。最后密钥KDH被存储分别在UE和CP-AU里，以用于在下一次附着流程中生成新的会话密钥。
本发明实施例还提供一种电子设备，其中，所述电子设备包括：收发器、存储器及处理器；至少部分所述存储器存储有计算机可执行指令；
所述处理器，分别与所述收发器及存储器连接，配置为执行所述计算机可执行指令，通过执行所述计算机可执行应用于网络侧的信息处理方法中的一个或多个，或者，用于通过计算机可执行指令实现应用于UE中的信 息处理方法，例如，可执行如图1、图2及图5所示方法中的一个或多个。
所述计算可执行指令可包括：计算机程序和/或软件。
本实施例中所述收发器可对应于网络接口，所述网络接口可为电缆接口、可以用于其他网元进行数据交互。
所述存储器可包括：各种类型的存储介质，可以用于数据存储。在本实施例中，所述存储器包括的存储介质至少部分为非易失性存储介质，可以用于存储所述计算机程序等计算机可执行指令。
所述处理器可包括：中央处理器、微处理器、数字信号处理器、应用处理器、专用集成电路或可编程阵列等，可以用于通过计算机可执行指令的执行，实现第二身份信息的分配、信息传输的加密等上述一个或多个技术方案中的信息处理方法的实现。
在本实施例中，所述处理器可通过集成电路总线等设备内总线，与所述收发器及存储器连接。
本实施例提供的电子设备可包括：前述的应用于网元中或UE中的信息处理装置，例如，可包括：图3或图4所示的信息处理装置。
本发明实施例还提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于通过执行所述计算机可执行应用于网络侧的信息处理方法中的一个或多个，或者，用于通过计算机可执行指令实现应用于UE中的信息处理方法，例如，可执行如图1、图2及图5所示方法中的一个或多个。
本发明实施例提供的计算机存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。可选为，所述计算机存储介质可为非瞬间存储介质。这里的非瞬间存储介质又可以称为非易失性存储介质。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方 法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个***，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能单元可以全部集成在一个处理模块中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，凡按照本发明原理所作的修改，都应当理解为落入本发明的保护范围。
工业实用性
本发明实施例中基站等网元会判断UE发送的附着请求中是否有携带预定的身份信息(即第一身份信息)，若未携带可认为当前未给该UE分配预定的身份信息，则发起密钥协商的流程，在完成密钥协商流程之后，自动分配第二身份信息，并将第二身份信息发送给UE。这样的话，一方面实现了预定的身份信息的自用分配，另一方面通过协商的密钥进行加密传输，降低了第二身份信息被窃密的概率，提升了第二身份的安全性。故具有积极的工业效果。于此同时，可以通过改造网元和UE之间的信息交互流程实现本发明实施例提供的技术方案，具有实现简单及可在通信和网络技术领域内广泛推广的前景。

Claims (28)

  1. 一种信息处理方法，包括：
    接收用户设备UE发送的附着请求；
    判断所述附着请求中是否有携带第一身份信息；
    当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商；其中，所述密钥协商用于获得对所述UE的第二身份信息加密的加密密钥；
    接收所述UE利用所述加密密钥加密的发送的第二身份信息；
    利用所述加密密钥解密所述第二身份信息；其中，所述第二身份信息用于为所述UE分配第一身份信息。
  2. 根据权利要求1所述的方法，其中，
    所述方法，还包括：
    判断所述UE是否完成共享密钥的协商；其中，所述共享密钥用于会话密钥的生成；
    所述当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商，包括：
    当所述附着请求中未携带有第一身份信息时且所述UE未完成共享密钥的协商时，与所述UE进行所述共享密钥的协商；基于所述共享密钥的协商生成所述加密密钥。
  3. 根据权利要求2所述的方法，其中，
    所述当所述附着请求中未携带有第一身份信息时且所述UE未完成共享密钥的协商时，与所述UE进行所述共享密钥的协商，包括：
    基于与所述UE的共享密钥的协商，生成所述共享密钥；
    其中，所述共享密钥和随机产生的第一随机数，共同用于生成所述加密密钥。
  4. 根据权利要求3所述的方法，其中，
    所述共享密钥和随机产生的第二随机数，共同用于生成完整性密钥；所述完整性密钥用于对所述第二身份信息进行完整性保护。
  5. 根据权利要求2所述的方法，其中，
    所述方法还包括：
    根据所述共享密钥生成所述第一会话密钥；
    通过与所述UE进行信息交互，验证所述第一会话密钥和所述UE根据所述共享密钥生成的第二会话密钥是否一致。
  6. 根据权利要求1至5任一项所述的方法，其中，
    所述方法还包括：
    确定当前是否有受到预定类型的攻击；
    当受到预定类型的攻击时，向所述UE发送哈希挑战指示；
    接收所述UE基于所述哈希挑战指示返回的哈希挑战响应；
    所述当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商，包括：
    当所述哈希挑战响应指示哈希挑战成功时，与所述UE进行密钥协商。
  7. 根据权利要求6所述的方法，其中，
    所述方法还包括：
    根据受到所述预定类型的攻击的严重程度信息，确定所述哈希挑战的难易程度。
  8. 一种信息处理方法，包括：
    向网络侧发送附着请求；
    与网络侧进行密钥协商；其中，所述密钥协商是在所述网络侧确定出所述附着请求中未携带有用户设备UE的第一身份信息时发送的，且所述密钥协商用于获得对用户设备UE的第二身份信息加密的加密密钥；
    将利用所述加密密钥加密所述UE的第二身份信息，发送给所述网络侧。
  9. 根据权利要求8所述的方法，其中，
    所述与网络侧进行密钥协商，包括：
    与所述网络侧进行共享密钥的协商；其中，所述共享密钥用于会话密钥的生成。
  10. 根据权利要求9所述的方法，其中，
    所述方法还包括：
    生成第一随机数；
    基于所述共享密钥和所述第一随机数，生成所述加密密钥。
  11. 根据权利要求10所述的方法，其中，
    所述方法还包括：
    生成第二随机数；
    基于所述共享密钥和所述第二随机数，生成完整性密钥；
    所述方法还包括：
    利用所述完整性密钥，对所述第二身份信息进行完整性保护。
  12. 根据权利要求9所述的方法，其中，
    所述方法还包括：
    根据所述共享密钥生成第二会话密钥；
    通过与所述网络侧进行信息交互，验证所述第二会话密钥和所述网络侧根据所述共享密钥生成的第一会话密钥是否一致。
  13. 根据权利要求8至12任一项所述的方法，其中，
    所述方法还包括：
    接收网络侧在确定出有受到预定类型的攻击时，发送的哈希挑战指示；
    响应所述哈希挑战指示，向所述网络侧返回哈希挑战响应；
    所述与网络侧进行密钥协商，包括：
    当所述哈希挑战响应确定出哈希挑战成功时，与所述网络侧进行密钥协商。
  14. 一种信息处理装置，包括第一接收单元、判断单元、第一协商单 元及解密单元：
    所述第一接收单元，配置为接收用户设备UE发送的附着请求；
    所述判断单元，配置为判断所述附着请求中是否有携带第一身份信息；
    所述第一协商单元，配置为当所述附着请求中未携带有第一身份信息时，与所述UE进行密钥协商；其中，所述密钥协商用于获得对所述UE的第二身份信息加密的加密密钥；
    所述第一接收单元，配置为接收所述UE利用所述加密密钥加密的发送的第二身份信息；
    所述解密单元，配置为利用所述加密密钥解密所述第二身份信息；其中，所述第二身份信息用于为所述UE分配第一身份信息。
  15. 根据权利要求14所述的装置，其中，
    所述判断单元，还配置为判断所述UE是否完成共享密钥的协商；其中，所述共享密钥用于会话密钥的生成；
    所述第一协商单元，配置为当所述附着请求中未携带有第一身份信息时且所述UE未完成共享密钥的协商时，与所述UE进行所述共享密钥的协商；基于所述共享密钥的协商生成所述加密密钥。
  16. 根据权利要求15所述的装置，其中，
    所述第一协商单元，配置为基于与所述UE的共享密钥的协商，生成所述共享密钥；
    其中，所述共享密钥和随机产生的第一随机数，共同用于生成所述加密密钥。
  17. 根据权利要求16所述的装置，其中，
    所述共享密钥和随机产生的第二随机数，共同用于生成完整性密钥；所述完整性密钥用于对所述第二身份信息进行完整性保护。
  18. 根据权利要求15所述的装置，其中，
    所述装置还包括第一生成单元及验证单元：
    所述第一生成单元，配置为根据所述共享密钥生成所述第一会话密钥；
    所述第一验证单元，配置为通过与所述UE进行信息交互，验证所述第一会话密钥和所述UE根据所述共享密钥生成的第二会话密钥是否一致。
  19. 根据权利要求14至18任一项所述的装置，其中，
    所述装置还包括确定单元及第一发送单元：
    所述确定单元，配置为确定当前是否有受到预定类型的攻击；
    所述第一发送单元，配置为当受到预定类型的攻击时，向所述UE发送哈希挑战指示；
    所述第一接收单元，配置为接收所述UE基于所述哈希挑战指示返回的哈希挑战响应；
    所述第一协商单元，配置为当所述哈希挑战响应指示哈希挑战成功时，与所述UE进行密钥协商。
  20. 根据权利要求19所述的装置，其中，
    所述确定单元，还用于根据受到所述预定类型的攻击的严重程度信息，确定所述哈希挑战的难易程度。
  21. 一种信息处理装置，包括：
    第二发送单元，配置为向网络侧发送附着请求；
    第二协商单元，配置为与网络侧进行密钥协商；其中，所述密钥协商是在所述网络侧确定出所述附着请求中未携带有用户设备UE的第一身份信息时发送的，且所述密钥协商用于获得对用户设备UE的第二身份信息加密的加密密钥；
    所述第二发送单元，还配置为将利用所述加密密钥加密所述UE的第二身份信息，发送给所述网络侧。
  22. 根据权利要求21所述的装置，其中，
    所述第二协商单元，具体用于与所述网络侧进行共享密钥的协商；其中，所述共享密钥用于会话密钥的生成。
  23. 根据权利要求21所述的装置，其中，
    所述装置还包括：
    第二生成单元，配置为生成第一随机数；基于所述共享密钥和所述第一随机数，生成所述加密密钥。
  24. 根据权利要求23所述的装置，其中，
    所述第二生成单元，还配置为生成第二随机数；基于所述共享密钥和所述第二随机数，生成完整性密钥；
    所述装置还包括：
    完整性保护单元，配置为利用所述完整性密钥，对所述第二身份信息进行完整性保护。
  25. 根据权利要求22所述的装置，其中，
    所述第二生成单元，配置为根据所述共享密钥生成第二会话密钥；
    所述装置还包括：
    第二验证单元，配置为通过与所述网络侧进行信息交互，验证所述第二会话密钥和所述网络侧根据所述共享密钥生成的第一会话密钥是否一致。
  26. 根据权利要求21至25任一项所述的装置，其中，
    所述第二接收单元，配置为接收网络侧在确定出有受到预定类型的攻击时，发送的哈希挑战指示；
    所述装置还包括：
    响应单元，配置为响应所述哈希挑战指示，向所述网络侧返回哈希挑战响应；
    所述第二协商单元，配置为当所述哈希挑战响应确定出哈希挑战成功时，与所述网络侧进行密钥协商。
  27. 一种电子设备，其中，所述电子设备包括：收发器、存储器及处理器；至少部分所述存储器存储有计算机可执行指令；
    所述处理器，分别与所述收发器及存储器连接，配置为执行所述计算 机可执行指令，通过执行所述计算机可执行指令实现权利要求1至7，或8至13任一项提供的方法。
  28. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求实现权利要求1至7，或8至13任一项提供的方法。
PCT/CN2017/101445 2016-09-12 2017-09-12 信息处理方法、装置、电子设备及计算机存储介质 WO2018046017A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610818481.6 2016-09-12
CN201610818481.6A CN106888092B (zh) 2016-09-12 2016-09-12 信息处理方法及装置

Publications (1)

Publication Number Publication Date
WO2018046017A1 true WO2018046017A1 (zh) 2018-03-15

Family

ID=59176741

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/101445 WO2018046017A1 (zh) 2016-09-12 2017-09-12 信息处理方法、装置、电子设备及计算机存储介质

Country Status (2)

Country Link
CN (1) CN106888092B (zh)
WO (1) WO2018046017A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820239B (zh) * 2016-09-12 2021-11-19 ***通信有限公司研究院 信息处理方法及装置
CN106888092B (zh) * 2016-09-12 2019-06-25 ***通信有限公司研究院 信息处理方法及装置
CN109756451B (zh) 2017-11-03 2022-04-22 华为技术有限公司 一种信息交互方法及装置
CN109274534B (zh) * 2018-09-30 2021-07-30 中国联合网络通信集团有限公司 一种网络切片的监管方法及设备、通信***
CN111404669B (zh) * 2019-01-02 2023-05-09 ***通信有限公司研究院 一种密钥生成方法、终端设备及网络设备
CN111404670A (zh) * 2019-01-02 2020-07-10 ***通信有限公司研究院 一种密钥生成方法、ue及网络设备
CN111404666A (zh) * 2019-01-02 2020-07-10 ***通信有限公司研究院 一种密钥生成方法、终端设备及网络设备
CN114499969B (zh) * 2021-12-27 2023-06-23 天翼云科技有限公司 一种通信报文的处理方法、装置、电子设备及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102006298A (zh) * 2010-11-26 2011-04-06 华为技术有限公司 接入网关实现负荷分担的方法和装置
CN102026178A (zh) * 2010-12-31 2011-04-20 成都三零瑞通移动通信有限公司 一种基于公钥机制的用户身份保护方法
CN102131188A (zh) * 2010-09-01 2011-07-20 华为技术有限公司 用户身份信息传输的方法、用户设备、网络侧设备及***
CN102905266A (zh) * 2012-10-11 2013-01-30 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
CN103051611A (zh) * 2012-12-11 2013-04-17 北京交通大学 一种身份与位置分离体系下的安全移动性管理方法
CN103096318A (zh) * 2013-02-01 2013-05-08 无锡南理工科技发展有限公司 一种基于身份隐替机制的无线异构网络统一接入认证方法
CN106888092A (zh) * 2016-09-12 2017-06-23 ***通信有限公司研究院 信息处理方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101102190A (zh) * 2006-07-04 2008-01-09 华为技术有限公司 生成本地接口密钥的方法
CN101951590B (zh) * 2010-09-03 2015-07-22 中兴通讯股份有限公司 认证方法、装置及***
CN102905265B (zh) * 2012-10-11 2016-02-10 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
CN104754581B (zh) * 2015-03-24 2018-01-19 河海大学 一种基于公钥密码体制的lte无线网络的安全认证方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102131188A (zh) * 2010-09-01 2011-07-20 华为技术有限公司 用户身份信息传输的方法、用户设备、网络侧设备及***
CN102006298A (zh) * 2010-11-26 2011-04-06 华为技术有限公司 接入网关实现负荷分担的方法和装置
CN102026178A (zh) * 2010-12-31 2011-04-20 成都三零瑞通移动通信有限公司 一种基于公钥机制的用户身份保护方法
CN102905266A (zh) * 2012-10-11 2013-01-30 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
CN103051611A (zh) * 2012-12-11 2013-04-17 北京交通大学 一种身份与位置分离体系下的安全移动性管理方法
CN103096318A (zh) * 2013-02-01 2013-05-08 无锡南理工科技发展有限公司 一种基于身份隐替机制的无线异构网络统一接入认证方法
CN106888092A (zh) * 2016-09-12 2017-06-23 ***通信有限公司研究院 信息处理方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
CHINA MOBILE: "pCR Security enhancement to the attach procedure relying on PKI", 3GPP TSG SA WG3 (SECURITY) ADHOC MEETING ON FS_NSA S 3-161380, 29 September 2016 (2016-09-29), XP051170337 *

Also Published As

Publication number Publication date
CN106888092A (zh) 2017-06-23
CN106888092B (zh) 2019-06-25

Similar Documents

Publication Publication Date Title
WO2018046017A1 (zh) 信息处理方法、装置、电子设备及计算机存储介质
WO2018046014A1 (zh) 信息处理方法、装置、电子设备及计算机存储介质
WO2018050081A1 (zh) 设备身份认证的方法、装置、电子设备及存储介质
RU2480925C2 (ru) Генерация криптографического ключа
WO2018127081A1 (zh) 一种加密密钥获取方法及***
US10439801B2 (en) Entity authentication method and device based on pre-shared key
JP2018509117A (ja) アイデンティティ認証のための方法、装置、及びシステム
CN109981562B (zh) 一种软件开发工具包授权方法及装置
JP7192122B2 (ja) ユーザデバイスと車両との接続を認証するためのシステムおよび方法
CN110545252B (zh) 一种认证和信息保护的方法、终端、控制功能实体及应用服务器
CN108809903B (zh) 一种认证方法、装置及***
CN106576237B (zh) 移动管理实体、归属服务器、终端、身份认证***和方法
CN110505055B (zh) 基于非对称密钥池对和密钥卡的外网接入身份认证方法和***
CN112351037B (zh) 用于安全通信的信息处理方法及装置
CN110635901B (zh) 用于物联网设备的本地蓝牙动态认证方法和***
CN111031061A (zh) 一种验证方法及网关设备
CN101192927B (zh) 基于身份保密的授权与多重认证方法
CN110519222B (zh) 基于一次性非对称密钥对和密钥卡的外网接入身份认证方法和***
CN112118568B (zh) 一种设备身份鉴权的方法及设备
CN109309648B (zh) 一种信息传输的方法和设备
WO2006026925A1 (fr) Procede d'etablissement de la cle d'authentification
CN112769789A (zh) 一种加密通信方法及***
KR102415628B1 (ko) Dim을 이용한 드론 인증 방법 및 장치
Saxena et al. NS-AKA: An improved and efficient AKA protocol for 3G (UMTS) networks
CN105828330B (zh) 一种接入方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17848190

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15.07.2019)

122 Ep: pct application non-entry in european phase

Ref document number: 17848190

Country of ref document: EP

Kind code of ref document: A1