CN107911814A - A kind of subscriber identity information guard method and system based on HSS enhancings - Google Patents

Abstract

The invention discloses a user identity information protection method and system based on HSS enhancement. The present invention enhances the function of the existing mobile core network HSS. After the HSS receives the user identity information update notification sent by the user identity location protection server, it needs to update the user's new temporary subscription identity information and the user's long-term subscription identity information or old temporary subscription information. Identity information is bound. When a user uses temporary subscription identity information to access the HSS, if there is binding information related to the temporary subscription identity information in the HSS, the user identity information authentication process is started; otherwise, the user is directly denied access to the mobile network. The present invention can greatly reduce or completely avoid the user's long-term contract identity information being transmitted in clear text in the air interface, avoid being actively or passively intercepted/monitored by malicious elements, and improve the protection of privacy information such as user identity and location.

Description

A method and system for protecting user identity information based on HSS enhancement

technical field

The invention belongs to the technical field of network communication security, and relates to a method and system for protecting user identity information in a mobile communication network.

Background technique

Due to its mobility and convenience, mobile communication network services have been widely used in people's daily life. With the large-scale deployment of 4G mobile communication networks, more and more people are beginning to use 4G network services. While enjoying the convenience brought by the mobile communication network, communication monitoring and personal privacy leakage have become increasingly serious problems.

When mobile network users use 3G, 4G and other network services, malicious users intercept the user's access request to access the wireless network and have not yet protected the signaling message, analyze the signaling message to obtain user identity information, or use malicious software to imitate The core network initiates the user identity information request mechanism, maliciously obtains the user's identity information, that is, the real IMSI information, and then obtains the mobile user subscription information through illegal means to perceive the user identity represented by the IMSI. Therefore, by intercepting the signaling and traffic information related to a specific IMSI, illegal tracking of the user's location is performed, resulting in the leakage of sensitive user information.

In order to reduce the risk of users’ real IMSI information being leaked, existing 3G and 4G mobile networks adopt temporary identity information, namely P-TMSI and GUTI. After users successfully access the network for the first time, they use the network side when accessing network services in the future. Temporary identity information assigned to identify oneself. The network side relies on dynamically changing the temporary contract identity information, thereby reducing the risk of leakage of the user's real identity information IMSI.

The existing mechanism can reduce the risk of users' real identity information being leaked to a certain extent by relying on temporary identity information. However, there are still some loopholes in the current 4G network design. When a user accesses the mobile network, if the network element of the core network cannot identify the temporary contract identity information received, it will actively request the user to report its real identity information in plain text. Currently, this mechanism can be disguised as the core network by malicious software or institutions to obtain the real identity information of users. Illegal use of user real identity information may lead to leakage of user location information. Therefore, the current 4G mobile network mechanism still has certain defects and cannot solve the security threats of users' real identity information leakage and location tracking.

The invention proposes a method for protecting user identity information of a mobile communication network, which can avoid leakage of long-term contract identity information of users, thereby protecting private information such as user identity and location from being discovered.

Contents of the invention

The invention proposes a method and a system for protecting long-term subscription identity information of mobile communication network users. This method dynamically assigns temporary subscription identity information to the user (the form of the temporary subscription identity information is still IMSI), and uses the temporary subscription identity information to access the mobile network for access authentication each time the user accesses the mobile network, thereby avoiding The exposure of the user's real identity information in the network environment leads to the malicious interception of the user's real identity information and the tracking of the user's location.

Technical scheme of the present invention is:

A method for protecting user identity information based on HSS enhancements, the steps comprising:

1) When the user terminal is powered on or opens the mobile network connection, use the user's long-term subscription identity information or temporary subscription identity information to initiate a mobile network attachment process to complete the network attachment;

2) The user terminal sends an identity request message to the identity location protection server, and the identity request message includes the user's current temporary subscription identity information IMSIn or long-term subscription identity information IMSI0;

3) After receiving the user identity request message, the identity location protection server allocates new temporary subscription identity information IMSIn+1 for the user from the temporary subscription identity information pool and sends a dynamic identity request message to notify the HSS to update the user identity information; The dynamic identity request message includes the user's current temporary subscription identity information IMSIn or long-term subscription identity information IMSI0, and new temporary subscription identity information IMSI information to be used in the future;

4) If the dynamic identity request message includes the new temporary subscription identity information IMSIn+1 and the current temporary subscription identity information IMSIn, the HSS uses the user's new temporary subscription identity information IMSIn+1 to replace the currently stored temporary subscription identity information; If the dynamic identity request message includes temporary subscription identity information IMSIn and long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and IMSI0;

5) The HSS sends an update success message to the identity location protection server;

6) The identity location protection server replies a response message to the user terminal, and the response message should include the user's new temporary subscription identity information IMSIn+1;

7) After the MME receives the attach request message initiated by the user terminal equipment, the MME sends an authentication data request message to the HSS. If the user identity information in the authentication data request message is temporary subscription identity information and there is binding information related to the temporary subscription identity information , the HSS starts the user identity information authentication process, otherwise no authentication data is generated;

The attach request message includes user long-term subscription identity information IMSI0 or temporary subscription identity information IMSIn.

The data format of the temporary subscription identity information IMSIn, the new temporary subscription identity information IMSIn+1 and the long-term subscription identity information IMSI is the same.

In the step 7), if the identity information in the authentication data request is the user's long-term subscription identity information and has no binding relationship, the HSS executes according to the existing 3GPP specification.

After receiving the user's new temporary subscription identity information to attach to the network, the HSS releases the binding between the user's previous temporary subscription identity information and the user's long-term subscription identity information.

After receiving the user's new temporary subscription identity information to attach to the network, the HSS starts a timer, and releases the binding between the user's previous temporary subscription identity information and the user's long-term subscription identity information after the timer expires.

The HSS binds one or more temporary subscription identity information to the long-term subscription identity information of the same user.

An HSS-based enhanced user identity information protection system, characterized in that it includes an identity location protection server, HSS and MME; wherein,

The identity location protection server is configured to allocate new temporary subscription identity information IMSIn+1 to the user from the temporary subscription identity information pool and send a dynamic identity request message to notify the HSS to update the user identity information; the dynamic identity request message includes , the user's current temporary subscription identity information IMSIn or long-term subscription identity information IMSI0, and the new temporary subscription identity information IMSI information to be used in the future; and reply a response message to the user terminal after receiving the update success message sent by the HSS, the response message should be Contains the user's new temporary signing identity information IMSIn+1;

The HSS is used to update the user identity information according to the received dynamic identity request message. If the dynamic identity request message contains the new temporary subscription identity information IMSIn+1 and the current temporary subscription identity information IMSIn, the HSS uses the user's new The temporary subscription identity information IMSIn+1 replaces the currently stored temporary subscription identity information; if the dynamic identity request message contains the temporary subscription identity information IMSIn and the long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and IMSI0 Get up; HSS sends an update success message to the identity location protection server;

The MME is used to receive the attach request message initiated by the user terminal equipment and send the authentication data request message to the HSS. If the user identity information in the authentication data request message is temporary subscription identity information and there is binding information related to the temporary subscription identity information, Then the HSS starts the user identity information authentication process, otherwise no authentication data is generated; the attach request message includes the user's long-term subscription identity information IMSI0 or temporary subscription identity information IMSIn.

The present invention enhances the function of the existing mobile core network HSS. After the HSS receives the update notification of the user identity information sent by the user identity location protection server, it needs to update the user's new temporary subscription identity information and the user's long-term subscription identity information or old temporary subscription information. Identity information is bound. When a user uses temporary subscription identity information to access the HSS, if there is binding information related to the temporary subscription identity information in the HSS, the user identity information authentication process is started; otherwise, the user is directly denied access to the mobile network.

The architecture of the present invention is shown in Figure 1. The present invention enhances the HSS function in the existing mobile core network and introduces a new network function, the identity location protection server. A new interface is defined between the enhanced HSS and the identity location protection server to realize the function of dynamic user identity update. After the identity location protection server provides the temporary subscription identity information for the user (the form of the temporary subscription identity information and the long-term subscription identity information IMSI are the same), it sends an interface message to notify the HSS to update the user identity information. After HSS receives the user identity information update notification from the user identity location protection server, it needs to replace the permanent subscription identity information with the user's temporary subscription identity information, or replace the old dynamic identity information with the user's new temporary subscription identity information . When the user performs network attachment next time, the HSS determines whether to generate authentication data for the user according to the temporary subscription identity information in the authentication data request message sent by the MME. If the user identity information in the authentication data request message is temporary subscription identity information and there is binding information related to the temporary subscription identity information, the user identity information authentication process is started; otherwise, no authentication data is generated, and the user is indirectly denied access to the mobile network.

Specifically, the program mainly has the following invention points:

A new interface is defined between the newly defined network function and the enhanced HSS, and the enhanced HSS interacts with the HSS through this interface to complete the dynamic identity update function.

The identity location protection server notifies the relevant HSS to update the user identity information by sending a dynamic identity request message. The request message includes temporary subscription identity information IMSIn or long-term subscription identity information IMSI0 currently used by the user, and new temporary subscription identity information IMSI information to be used in the future.

After receiving the request message from the secure access server, HSS performs different operations according to the content of the message to complete the dynamic identity information update:

If the message contains the user's long-term subscription identity information IMSI0 and the temporary subscription identity information IMSIn to be used, the HSS will bind the temporary subscription identity information and the long-term subscription identity information, that is, the temporary subscription identity information is equivalent to the long-term subscription identity information . And write the binding information to the database.

If the message contains the current temporary signing identity information IMSIn and the temporary signing identity information IMSIn+1 to be used next time, the HSS replaces the current temporary signing identity information IMSIn or before with the temporary signing identity information IMSIn+1 to be used next time IMSIn-1.

After the user's long-term subscription identity information IMSI0 is bound to the dynamic identity information IMSIn, the HSS can decide whether to accept the user's long-term subscription identity information to access the network and related conditions according to the security policy.

After the temporary subscription identity information is updated, the HSS notifies the identity location protection server that the user identity information has been updated, that is, the user can use the new temporary subscription identity information to access the network.

When the user attaches, when receiving the authentication data request from the MME, the HSS searches the database to determine whether there is a corresponding binding for the temporary contract identity information:

·If the identity information is temporary contract identity information and is not bound to any long-term contract identity information, reject the user;

· If it is temporary contract identity information and is bound to long-term contract identity information, accept the user authentication request, and at the same time use the credential information corresponding to the long-term contract identity information to authenticate the user.

In addition, after receiving the user's new temporary subscription identity information to attach to the network, the HSS can immediately release it, or start a timer, and release the binding between the old temporary subscription identity information and the user's long-term subscription identity information after the timer expires. The HSS can bind one or more temporary subscription identity information to the long-term subscription identity information of a specific user.

Compared with prior art, positive effect of the present invention is:

The present invention can greatly reduce or completely avoid the transmission of the user's long-term contract identity information in clear text (that is, included in the attachment request or identity response message) over the air interface, avoiding being actively or passively intercepted/monitored by malicious elements, and improving the user's identity, location, etc. Protection of private information.

Description of drawings

Figure 1 is a schematic diagram of the user identity and location information protection scheme;

Fig. 2 is a flow chart of assigning user dynamic identity information;

FIG. 3 is a process diagram of enabling user dynamic identity information and releasing a binding relationship.

Detailed ways

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail together with the accompanying drawings.

1) Dynamic identity information allocation process

As shown in Figure 2, the main steps of dynamic identity information allocation are as follows:

(1) When the user equipment is powered on or opens the mobile network connection, the protocol stack function on the user terminal equipment uses the long-term subscription identity information or the temporary subscription identity information to initiate the mobile network attachment process and complete the network attachment.

(2) After the attachment is completed, the user terminal sends an identity request message to the identity location protection server, and the identity request message includes the temporary subscription identity information (IMSIn) or long-term subscription identity information (IMSI0) currently used by the user.

(3) After receiving the user identity request message, the identity location protection server allocates new temporary subscription identity information IMSIn+1 to the user from the temporary subscription identity information pool.

(4) The identity location protection server sends an identity update message to the HSS related to the user. The message includes the user's current temporary subscription identity information IMSIn (or long-term subscription identity information IMSI0) and new temporary subscription identity information IMSIn+1.

5A. If the message contains the new temporary subscription identity information IMSIn+1 and the current temporary subscription identity information IMSIn, the HSS uses the user's new temporary subscription identity information IMSIn+1 to replace the currently stored temporary subscription identity information.

5B. If the message contains the temporary signing identity information IMSIn and the long-term signing identity information IMSI0, the HSS binds the temporary signing identity information IMSIn and IMSI0, that is, IMSIn and IMSI0 are equivalent, and stores the binding relationship in the database .

(6) The HSS replies a response message to the identity location protection server to indicate that the user's temporary subscription identity information is successfully updated.

(7) The identity location protection server replies a response message to the user terminal device, and the message should include the user's new temporary subscription identity information IMSIn+1.

2) Dynamic identity information activation and binding relationship release process

As shown in Figure 3, the main steps of recovery of temporary contract identity information are as follows:

(1) The user terminal equipment is (re)started.

(2) The user terminal device sends an attach request message to the MME, and the message includes the user's long-term subscription identity information IMSI0 or the temporary subscription identity information IMSIn previously allocated by the identity location protection server.

(3) The MME sends an authentication data request message to the HSS, which contains the current user identity information IMSIn or IMSI0.

4A After receiving the message, the HSS checks the identity information and related database in the message. If it is the user's long-term contract identity information and there is no binding relationship, it will be implemented according to the existing 3GPP specifications. If it is the user's long-term subscription identity information and the temporary subscription identity information is bound, then determine whether to generate subscription data for the user according to the configured security policy. The security policy may specify the time period (hours, days, etc.) or the number of times (1 time, 5 times) for a certain user to use certain dynamic identity information. If the user uses a certain dynamic identity information for too long, the security will be reduced, and in the extreme case, it will fall back to the existing mechanism. Dynamic signing identity = long-term signing identity information; security policies can be configured in HSS as part of user signing information , different users may have different requirements for privacy protection, so user-level customization can be realized.

4B After receiving the message, the HSS checks the identity information and related database in the message. If it is temporary contract identity information and no binding relationship exists, no authentication data is generated to deny the user access to the network. If it is the temporary contract identity information and the long-term contract identity information is bound, use the credential information corresponding to the long-term contract identity information to generate authentication data information for the user.

(4) The HSS replies to the MME with a response message, which may include authentication data and result information, and the MME completes mutual authentication with the user according to the authentication data information.

(5) The MME replies with an attach response message for the UE.

To sum up, the present invention discloses a method for protecting long-term subscription identity information and location of mobile network users.

The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Apparently, those skilled in the art can make various changes and modifications to the examples of the present invention without departing from the spirit and principle of the present invention. The embodiment was chosen and described in order to better explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention and design various embodiments with various modifications as are suited to the particular use.

Claims (10)

1. A subscriber identity information protection method based on HSS enhancement comprises the following steps:

1) when a user terminal is started or mobile network connection is opened, a mobile network attachment process is initiated by using long-term subscription identity information or temporary subscription identity information of a user to complete network attachment;

2) the user terminal sends an identity request message to an identity position protection server, wherein the identity request message comprises current temporary subscription identity information IMSIN or long-term subscription identity information IMSI0 of the user;

3) after receiving the user identity request message, the identity position protection server distributes new temporary signing identity information IMSIn +1 for the user from the temporary signing identity information pool and sends a dynamic identity request message to inform HSS of updating the user identity information; the dynamic identity request message includes the current temporary subscription identity information IMSIn or the long-term subscription identity information IMSI0 of the user, and the new temporary subscription identity information IMSI information to be used in the future;

4) if the dynamic identity request message contains new temporary subscription identity information IMSIn +1 and current temporary subscription identity information IMSIn, the HSS replaces the currently stored temporary subscription identity information with the new temporary subscription identity information IMSIn +1 of the user; if the dynamic identity request message contains the temporary subscription identity information IMSIn and the long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and the IMSI 0;

5) HSS sends update success message to identity position protection server;

6) the identity position protection server replies a response message to the user terminal, wherein the response message contains new temporary subscription identity information IMSIn +1 of the user;

7) after MME receives an attachment request message initiated by user terminal equipment, MME sends an authentication data request message to HSS, if the user identity information in the authentication data request message is temporary subscription identity information and binding information related to the temporary subscription identity information exists, HSS starts a user identity information authentication process, otherwise authentication data is not generated; the attach request message contains the subscriber long-term subscription identity information IMSI0 or the temporary subscription identity information IMSIn.

2. The method of claim 1, wherein the temporary subscription identity information IMSIn, the new temporary subscription identity information IMSIn +1 and the long-term subscription identity information IMSI have the same data format.

3. The method as claimed in claim 1, wherein in step 7), if the identity information in the authentication data request is the user long-term subscription identity information and there is no binding relationship, the HSS performs according to the existing 3GPP specifications.

4. The method of claim 1, wherein the HSS releases the binding between the previous temporary subscription identity information of the subscriber and the long-term subscription identity information of the subscriber after receiving the new temporary subscription identity information attached to the network by the subscriber.

5. The method as claimed in claim 1, wherein the HSS starts a timer after receiving the new temporary subscription identity information attached to the network by the subscriber, and releases the binding between the previous temporary subscription identity information of the subscriber and the long-term subscription identity information of the subscriber after the timer expires.

6. The method of claim 1, wherein the HSS binds one or more temporary subscription identities for long-term subscription identities of the same user.

7. A user identity information protection system based on HSS enhancement is characterized by comprising an identity position protection server, an HSS and an MME; wherein,

the identity position protection server is used for distributing new temporary subscription identity information IMSIn +1 for the user from the temporary subscription identity information pool and sending a dynamic identity request message to inform the HSS of updating the user identity information; the dynamic identity request message includes the current temporary subscription identity information IMSIn or the long-term subscription identity information IMSI0 of the user, and the new temporary subscription identity information IMSI information to be used in the future; after receiving the update success message sent by the HSS, replying a response message to the user terminal, wherein the response message contains new temporary subscription identity information IMSIn +1 of the user;

the HSS is used for updating the user identity information according to the received dynamic identity request message, and if the dynamic identity request message contains new temporary subscription identity information IMSIn +1 and current temporary subscription identity information IMSIn, the HSS replaces the currently stored temporary subscription identity information with the new temporary subscription identity information IMSIn +1 of the user; if the dynamic identity request message contains the temporary subscription identity information IMSIn and the long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and the IMSI 0; HSS sends update success message to identity position protection server;

the MME is used for receiving an attachment request message initiated by user terminal equipment and sending an authentication data request message to the HSS, if the user identity information in the authentication data request message is temporary subscription identity information and binding information related to the temporary subscription identity information exists, the HSS starts a user identity information authentication process, otherwise, authentication data are not generated; the attach request message contains the subscriber long-term subscription identity information IMSI0 or the temporary subscription identity information IMSIn.

8. The system of claim 7, wherein the temporary subscription identity information IMSIn, the new temporary subscription identity information IMSIn +1 and the long-term subscription identity information IMSI have the same data format.

9. The system of claim 7, wherein the HSS releases the binding between the previous temporary subscription identity information of the subscriber and the long-term subscription identity information of the subscriber after receiving the new temporary subscription identity information attached to the network by the subscriber.

10. The system of claim 7, wherein the HSS binds one or more temporary subscription identities for long-term subscription identities of the same user.