CN107911814B - HSS (home subscriber server) -enhanced user identity information protection method and system - Google Patents

Abstract

The invention discloses a method and system for protecting user identity information based on HSS enhancement. The invention enhances the HSS function of the existing mobile core network. After the HSS receives the user identity information update notification sent by the user identity location protection server, it needs to update the user's new temporary subscription identity information and the user's long-term subscription identity information or the old temporary subscription identity information. Identity information is bound. When a user accesses the HSS using the temporary subscription identity information, the user identity information authentication process is started if there is binding information related to the temporary subscription identity information in the HSS; otherwise, the user is directly refused to access the mobile network. The invention can greatly reduce or completely avoid the long-term contract identity information of users being transmitted in clear text on the air interface, avoid being actively or passively intercepted/monitored by malicious elements, and improve the protection of privacy information such as user identity and location.

Description

A method and system for protecting user identity information based on HSS enhancement

technical field

The invention belongs to the technical field of network communication security, and relates to a method and a system for protecting user identity information in a mobile communication network.

Background technique

Mobile communication network services have been widely used in people's daily life due to their mobility and convenience. With the large-scale deployment of 4G mobile communication networks, more and more people begin to use 4G network services. While enjoying the convenience brought by the mobile communication network, communication monitoring and personal privacy leakage have become increasingly serious problems.

In the process of mobile network users using 3G, 4G and other network services, malicious users intercept the signaling messages that have not been securely protected during the access request process of the user to access the wireless network, analyze the signaling messages to obtain user identity information, or imitate the user through malicious software. The core network initiates a user identity information request mechanism, maliciously obtains the user's identity information, that is, the real IMSI information, and then obtains the mobile user subscription information through illegal means to perceive the user identity represented by the IMSI. Therefore, by intercepting specific IMSI-related signaling and traffic information, illegal tracking of the user's location leads to leakage of user sensitive information.

In order to reduce the risk of leakage of real IMSI information of users, the existing 3G and 4G mobile networks adopt temporary identity information, namely P-TMSI and GUTI. After users successfully access the network for the first time, they use the network side to access network services later Assigned temporary identity information to identify yourself. The network side relies on the dynamic change of the temporary subscription identity information, thereby reducing the risk of leakage of the user's real identity information IMSI.

The existing mechanism can reduce the risk of the user's real identity information being leaked to a certain extent by relying on temporary identity information. However, there are still some loopholes in the current 4G network design. During the user's access to the mobile network, if the network element of the core network cannot identify the temporary subscription identity information received, it will take the initiative to request the user to report its real identity information in plaintext. This mechanism can currently be used by malware or institutions to disguise the core network to obtain the user's real identity information. Illegal use of the user's real identity information may lead to the disclosure of the user's location information. Therefore, the current 4G mobile network mechanism still has certain defects and cannot solve the security threat of leakage of user's real identity information and location tracking.

The present invention proposes a method for protecting user identity information of a mobile communication network, which can avoid the leakage of user identity information for long-term contracts, thereby protecting privacy information such as user identity and location from being discovered.

SUMMARY OF THE INVENTION

The present invention provides a method and system for protecting long-term subscription identity information of mobile communication network users. The method dynamically allocates temporary subscription identity information to users (the form of temporary subscription identity information is still IMSI), and the user uses the temporary subscription identity information to access the mobile network for access authentication every time the user accesses the mobile network, thereby avoiding unsafe Exposing the user's real identity information in the network environment leads to malicious interception of the user's real identity information and tracking of the user's location.

The technical scheme of the present invention is:

A method for protecting user identity information based on HSS enhancement, the steps of which include:

1) When the user terminal is powered on or opens a mobile network connection, the user's long-term subscription identity information or temporary subscription identity information is used to initiate a mobile network attachment process to complete the network attachment;

2) The user terminal sends an identity request message to the identity location protection server, where the identity request message includes the user's current temporary subscription identity information IMSIn or long-term subscription identity information IMSI0;

3) After receiving the user identity request message, the identity location protection server allocates new temporary subscription identity information IMSIn+1 for the user from the temporary subscription identity information pool and sends a dynamic identity request message to notify the HSS to update the user identity information; The dynamic identity request message includes the user's current temporary subscription identity information IMSIn or long-term subscription identity information IMSI0, and new temporary subscription identity information IMSI information to be used in the future;

4) if what this dynamic identity request message contains is new temporary subscription identity information IMSIn+1 and current temporary subscription identity information IMSIn, then HSS utilizes the new temporary subscription identity information IMSIn+1 of the user to replace the currently saved temporary subscription identity information; If the dynamic identity request message contains temporary subscription identity information IMSIn and long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and IMSI0;

5) HSS sends an update success message to the identity location protection server;

6) The identity location protection server replies a response message to the user terminal, and the response message should contain the user's new temporary subscription identity information IMSIn+1;

7) After the MME receives the attach request message initiated by the user terminal equipment, the MME sends an authentication data request message to the HSS, if the user identity information in the authentication data request message is temporary subscription identity information and there is binding information related to the temporary subscription identity information , the HSS starts the user identity information authentication process, otherwise the authentication data will not be generated;

The attach request message includes user long-term subscription identity information IMSI0 or temporary subscription identity information IMSIn.

The temporary subscription identity information IMSIn and the new temporary subscription identity information IMSIn+1 have the same data format as the long-term subscription identity information IMSI.

In the step 7), if the identity information in the authentication data request is the user's long-term subscription identity information and does not have any binding relationship, the HSS is executed according to the existing 3GPP specifications.

After receiving that the user attaches to the network using the new temporary subscription identity information, the HSS releases the binding between the user's previous temporary subscription identity information and the user's long-term subscription identity information.

After receiving that the user attaches to the network using the new temporary subscription identity information, the HSS starts a timer. After the timer expires, it releases the binding between the user's previous temporary subscription identity information and the user's long-term subscription identity information.

The HSS binds one or more temporary subscription identities to the long-term subscription identities of the same user.

An enhanced user identity information protection system based on HSS, characterized in that it includes an identity location protection server, an HSS and an MME; wherein,

The identity location protection server is configured to allocate new temporary subscription identity information IMSIn+1 for the user from the temporary subscription identity information pool and send a dynamic identity request message to notify the HSS to update the user identity information; the dynamic identity request message includes , the user's current temporary subscription identity information IMSIn or long-term subscription identity information IMSI0, and the new temporary subscription identity information IMSI information to be used in the future; and after receiving the update success message sent by the HSS, reply a response message to the user terminal, the response message should be Contains the user's new temporary subscription identity information IMSIn+1;

The HSS is used to update the user identity information according to the received dynamic identity request message. If the dynamic identity request message contains the new temporary subscription identity information IMSIn+1 and the current temporary subscription identity information IMSIn, the HSS uses the user's new The temporary subscription identity information IMSIn+1 replaces the currently stored temporary subscription identity information; if the dynamic identity request message contains the temporary subscription identity information IMSIn and the long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and IMSI0 Get up; HSS sends an update success message to the identity location protection server;

The MME is used to receive the attach request message initiated by the user terminal equipment and send the authentication data request message to the HSS. If the user identity information in the authentication data request message is temporary subscription identity information and there is binding information related to the temporary subscription identity information, Then the HSS starts the user identity information authentication process, otherwise, no authentication data is generated; the attach request message includes the user's long-term subscription identity information IMSI0 or temporary subscription identity information IMSIn.

The invention enhances the HSS function of the existing mobile core network. After the HSS receives the user identity information update notification sent by the user identity location protection server, it needs to update the user's new temporary subscription identity information and the user's long-term subscription identity information or the old temporary subscription identity information. Identity information is bound. When a user accesses the HSS using the temporary subscription identity information, the user identity information authentication process is started if there is binding information related to the temporary subscription identity information in the HSS; otherwise, the user is directly refused to access the mobile network.

The architecture of the present invention is shown in FIG. 1 , the present invention enhances the HSS function in the existing mobile core network, and at the same time introduces a new network function, the identity location protection server. A new interface is defined between the enhanced HSS and the identity location protection server to implement the dynamic user identity update function. The identity location protection server sends an interface message to notify the HSS to update the user identity information after the temporary subscription identity information (the form of the temporary subscription identity information and the long-term subscription identity information IMSI is the same) for the user. After the HSS receives the user identity information update notification from the user identity location protection server, it needs to replace the long-term contract identity information with the user's temporary contract identity information, or replace the old dynamic identity information with the user's new temporary contract identity information. . When the user attaches to the network next time, the HSS determines whether to generate authentication data for the user according to the temporary subscription identity information in the authentication data request message sent by the MME. If the user identity information in the authentication data request message is temporary subscription identity information and there is binding information related to the temporary subscription identity information, the user identity information authentication process is started; otherwise, no authentication data is generated, and the user is indirectly denied access to the mobile network.

Specifically, the scheme mainly has the following invention points:

在新定义的网络功能和增强的HSS之间定义新的接口，增强HSS通过该接口和HSS交互完成动态身份更新功能。

A new interface is defined between the newly defined network function and the enhanced HSS, and the enhanced HSS interacts with the HSS to complete the dynamic identity update function through the interface.

身份位置保护服务器通过发送动态身份请求消息通知相关HSS进行用户身份信息更新。该请求消息包括，用户当前使用的临时签约身份信息IMSIn或长期签约身份信息IMSI0，以及未来即将使用的新临时签约身份信息IMSI信息。

The identity location protection server notifies the relevant HSS to update the user identity information by sending a dynamic identity request message. The request message includes the temporary subscription identity information IMSIn or long-term subscription identity information IMSI0 currently used by the user, and the new temporary subscription identity information IMSI information to be used in the future.

收到来自安全接入服务器的请求消息后，根据消息内容HSS进行不同的操作完成动态身份信息更新：

After receiving the request message from the secure access server, HSS performs different operations according to the message content to update the dynamic identity information:

If the message contains the user's long-term subscription identity information IMSI0 and the temporary subscription identity information to be used IMSIn, the HSS binds the temporary subscription identity information and the long-term subscription identity information, that is, the temporary subscription identity information is equivalent to the long-term subscription identity information . And write the binding information to the database.

If the message contains the current temporary subscription identity information IMSIn and the temporary subscription identity information to be used next time, IMSIn+1, the HSS replaces the current temporary subscription identity information IMSIn or the previous temporary subscription identity information IMSIn+1 with the temporary subscription identity information to be used next time. IMSIn-1.

用户长期签约身份信息IMSI0绑定动态身份信息IMSIn后，根据安全策略HSS可以决定是否接受用户使用长期签约身份信息接入网络，及相关条件。

After the user's long-term subscription identity information IMSI0 is bound to the dynamic identity information IMSIn, according to the security policy HSS can decide whether to accept the user's long-term subscription identity information to access the network, and related conditions.

临时签约身份信息更新完毕后，HSS并通知身份位置保护服务器该用户身份信息已经更新，即用户可以使用新的临时签约身份信息接入网络。

After the temporary subscription identity information is updated, the HSS notifies the identity location protection server that the user identity information has been updated, that is, the user can use the new temporary subscription identity information to access the network.

用户附着时，收到来自MME的认证数据请求时，HSS在查找数据库确定该临时签约身份信息是否存相应绑定：

When the user attaches, when receiving the authentication data request from the MME, the HSS searches the database to determine whether the temporary subscription identity information has a corresponding binding:

If the identity information is temporary contract identity information and no long-term contract identity information is bound, reject the user;

· If it is temporary contract identity information and exists bound to long-term contract identity information, the user authentication request is accepted, and the user is authenticated using the credential information corresponding to the long-term contract identity information.

此外，HSS收到用户使用新临时签约身份信息附着网络后，可立释放，或启动定时器，等定时器超时后，释放旧的临时签约身份信息和用户长期签约身份信息之间的绑定。HSS可以为某个具体用户的长期签约身份信息绑定一个或多个临时签约身份信息。

In addition, after receiving the user using the new temporary subscription identity information to attach to the network, the HSS can release it immediately, or start a timer, and after the timer expires, release the binding between the old temporary subscription identity information and the user's long-term subscription identity information. The HSS can bind one or more temporary subscription identity information to the long-term subscription identity information of a specific user.

Compared with the prior art, the positive effects of the present invention are:

The present invention can greatly reduce or completely avoid the transmission of long-term user identity information in clear text (that is, contained in the attachment request or identity response message) on the air interface, avoid active or passive interception/monitoring by malicious elements, and improve the user's identity and location. Protection of Private Information.

Description of drawings

Figure 1 is an architecture diagram of a user identity and location information protection scheme;

Fig. 2 is a flow chart of user dynamic identity information allocation;

FIG. 3 is a process diagram of enabling dynamic identity information of a user and releasing a binding relationship.

Detailed ways

In order to make the above-mentioned features and advantages of the present invention more obvious and easy to understand, the following embodiments are given and described in detail with the accompanying drawings.

1) Dynamic identity information allocation process

As shown in Figure 2, the main steps of dynamic identity information allocation are as follows:

(1) When the user equipment is powered on or the mobile network connection is opened, the protocol stack function on the user terminal equipment uses the long-term subscription identity information or the temporary subscription identity information to initiate the mobile network attachment process to complete the network attachment.

(2) After the attachment is completed, the user terminal sends an identity request message to the identity location protection server, where the identity request message includes the temporary subscription identity information (IMSIn) or long-term subscription identity information (IMSI0) currently being used by the user.

(3) After receiving the user identity request message, the identity location protection server allocates new temporary subscription identity information IMSIn+1 to the user from the temporary subscription identity information pool.

(4) The identity location protection server sends an identity update message to the HSS related to the user. The message includes the user's current temporary subscription identity information IMSIn (or long-term subscription identity information IMSI0) and new temporary subscription identity information IMSIn+1.

5A. If the message contains the new temporary subscription identity information IMSIn+1 and the current temporary subscription identity information IMSIn, the HSS replaces the currently saved temporary subscription identity information with the user's new temporary subscription identity information IMSIn+1.

5B. If the message contains temporary subscription identity information IMSIn and long-term subscription identity information IMSI0, the HSS binds the temporary subscription identity information IMSIn and IMSI0, that is, IMSIn and IMSI0 are equivalent, and stores the binding relationship in the database .

(6) The HSS replies a response message to the identity location protection server to indicate that the user's temporary subscription identity information is updated successfully.

(7) The identity location protection server replies a response message to the user terminal equipment, and the message should contain the user's new temporary subscription identity information IMSIn+1.

2) Dynamic identity letter enablement and binding relationship release process

As shown in Figure 3, the main steps for the recovery of temporary contract identity information are as follows:

(1) The user terminal equipment is (re)restarted.

(2) The user terminal device sends an attach request message to the MME, the message including the user's long-term subscription identity information IMSI0 or the temporary subscription identity information IMSIn previously allocated by the identity location protection server.

(3) The MME sends an authentication data request message to the HSS, where the message includes the user's current identity information IMSIn or IMSI0.

4A After receiving the message, the HSS checks the identity information and related database in the message. If it is the user's long-term contract identity information and there is no binding relationship, it is executed according to the existing 3GPP specifications. If it is the user's long-term subscription identity information and the temporary subscription identity information is bound, it is determined whether to generate subscription data for the user according to the configured security policy. The security policy can specify the usage time period (hours, days, etc.) or the number of times (1 time, 5 times) for a certain user to use a specific dynamic identity information. If a user uses a certain dynamic identity information for too long, the security will be reduced, and in extreme cases, it will fall back to the existing mechanism, dynamic contract identity = long-term contract identity information; security policies can be configured in the HSS as part of the user's contract information , different users may have different privacy protection requirements, so user-level customization can be achieved.

After receiving the message, 4B HSS checks the identity information and related database in the message. If it is temporary subscription identity information and no binding relationship exists, no authentication data is generated to deny the user access to the network. If it is the temporary contract identity information and the long-term contract identity information is bound, the authentication data information is generated for the user by using the credential information corresponding to the long-term contract identity information.

(4) The HSS replies to the MME with a response message, which may include authentication data and result information, and the MME completes the mutual authentication with the user according to the authentication data information.

(5) The MME replies the user terminal equipment attach response message.

To sum up, the present invention discloses a method for protecting long-term identity information and location of mobile network users.

The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or to limit the invention to the form disclosed. It will be apparent to those skilled in the art that various changes and modifications can be made to the examples of the present invention without departing from the spirit and principles of the invention. The embodiment was chosen and described in order to better explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use.

Claims (10)

1. A subscriber identity information protection method based on HSS enhancement comprises the following steps:

1) when a user terminal is started or mobile network connection is opened, a mobile network attachment process is initiated by using long-term subscription identity information or temporary subscription identity information of a user to complete network attachment;

2) the user terminal sends an identity request message to an identity position protection server, wherein the identity request message comprises current temporary subscription identity information IMSIN or long-term subscription identity information IMSI0 of the user;

3) after receiving the user identity request message, the identity position protection server distributes new temporary signing identity information IMSIn +1 for the user from the temporary signing identity information pool and sends a dynamic identity request message to inform HSS of updating the user identity information; if the temporary subscription identity information of the user is used for attaching to the network in the step 1), the dynamic identity request message includes: after the network attachment is completed, the current temporary subscription identity information IMSIN of the user and the new temporary subscription identity information IMSI information which is used in the future are obtained; if the network is attached by using the long-term subscription identity information of the user in the step 1), the dynamic identity request message includes: long-term subscription identity information IMSI0 after completing network attachment and new temporary subscription identity information IMSI information to be used in the future;

4) if the dynamic identity request message contains new temporary subscription identity information IMSIn +1 after the network attachment is completed and current temporary subscription identity information IMSIn after the network attachment is completed, the HSS replaces the currently stored temporary subscription identity information with the new temporary subscription identity information IMSIn +1 of the user; if the dynamic identity request message contains temporary subscription identity information IMSin after the completion of network attachment and long-term subscription identity information IMSI0 after the completion of network attachment, the HSS binds the temporary subscription identity information IMSin and IMSI 0;

5) HSS sends update success message to identity position protection server;

6) the identity position protection server replies a response message to the user terminal, wherein the response message contains new temporary subscription identity information IMSIn +1 of the user;

7) when the user terminal is attached again, after the MME receives an attachment request message initiated by user terminal equipment, the MME sends an authentication data request message to the HSS, if the user identity information in the authentication data request message is temporary subscription identity information and binding information related to the temporary subscription identity information exists, the HSS starts a user identity information authentication process, otherwise, authentication data are not generated; the attach request message contains temporary subscription identity information IMSIn.

2. The method of claim 1, wherein the temporary subscription identity information IMSIn, the new temporary subscription identity information IMSIn +1 and the long-term subscription identity information IMSI have the same data format.

3. The method as claimed in claim 1, wherein in step 7), if the identity information in the authentication data request is the user long-term subscription identity information and there is no binding relationship, the HSS performs according to the existing 3GPP specifications.

4. The method of claim 1, wherein the HSS releases the binding between the previous temporary subscription identity information of the subscriber and the long-term subscription identity information of the subscriber after receiving the new temporary subscription identity information attached to the network by the subscriber.

5. The method as claimed in claim 1, wherein the HSS starts a timer after receiving the new temporary subscription identity information attached to the network by the subscriber, and releases the binding between the previous temporary subscription identity information of the subscriber and the long-term subscription identity information of the subscriber after the timer expires.

6. The method of claim 1, wherein the HSS binds one or more temporary subscription identities for long-term subscription identities of the same user.

7. A user identity information protection system based on HSS enhancement is characterized by comprising an identity position protection server, an HSS and an MME; wherein,

the identity position protection server is used for distributing new temporary subscription identity information IMSIn +1 for the user from the temporary subscription identity information pool and sending a dynamic identity request message to inform the HSS of updating the user identity information; if the network is attached by using the temporary subscription identity information of the user, the dynamic identity request message includes: after the network attachment is completed, the current temporary subscription identity information IMSIn of the user and the new temporary subscription identity information IMSI information to be used in the future are obtained, and if the network is attached by using the long-term subscription identity information of the user, the dynamic identity request message includes: long-term subscription identity information IMSI0 after completing network attachment and new temporary subscription identity information IMSI information to be used in the future; after receiving the update success message sent by the HSS, replying a response message to the user terminal, wherein the response message contains new temporary subscription identity information IMSIn +1 of the user;

the HSS is used for updating the user identity information according to the received dynamic identity request message, and if the dynamic identity request message contains new temporary subscription identity information IMSIn +1 after the network attachment is completed and current temporary subscription identity information IMSIn after the network attachment is completed, the HSS replaces the currently stored temporary subscription identity information with the new temporary subscription identity information IMSIn +1 of the user; if the dynamic identity request message contains temporary subscription identity information IMSin after the completion of network attachment and long-term subscription identity information IMSI0 after the completion of network attachment, the HSS binds the temporary subscription identity information IMSin and IMSI 0; HSS sends update success message to identity position protection server;

the MME is used for receiving an attachment request message initiated when the user terminal equipment is attached again and sending an authentication data request message to the HSS, if the user identity information in the authentication data request message is temporary subscription identity information and binding information related to the temporary subscription identity information exists, the HSS starts a user identity information authentication process, otherwise, authentication data are not generated; the attach request message contains temporary subscription identity information IMSIn.

8. The system of claim 7, wherein the temporary subscription identity information IMSIn, the new temporary subscription identity information IMSIn +1 and the long-term subscription identity information IMSI have the same data format.

9. The system of claim 7, wherein the HSS releases the binding between the previous temporary subscription identity information of the subscriber and the long-term subscription identity information of the subscriber after receiving the new temporary subscription identity information attached to the network by the subscriber.

10. The system of claim 7, wherein the HSS binds one or more temporary subscription identities for long-term subscription identities of the same user.

Images