CN101808313A - Method for acquiring TMSI (Temporary Mobile Subscriber Identity), mobile station, home location register and communication system - Google Patents

Abstract

Embodiments of the present invention provide a method for acquiring TMSI, a mobile station, a home location register and a communication system, which belong to the technical field of information security. The method includes: encrypting the IMSI using an encryption mechanism agreed upon with the HLR; sending the encrypted IMSI to the HLR through the VLR; receiving the visiting The temporary customer identification code generated by the location register according to the decrypted international mobile subscriber identification code. The mobile station includes: an encryption module and a first sending module. The home location register includes: a decryption module and a second sending module. The system includes: a mobile station, a visitor location register and a home location register. In the embodiment of the present invention, in the process of obtaining the TMSI, the IMSI is transmitted in the form of ciphertext on the wireless link, the IMSI is protected, and the encryption method is simple, which can be directly used in the GSM system.

Description

Method for obtaining TMSI, mobile station, home location register and communication system

technical field

The embodiment of the present invention relates to the technical field of information security, and in particular to a method for obtaining TMSI, a mobile station, a home location register and a communication system.

Background technique

In mobile communication, the International Mobile Subscriber Identification (IMSI) is a sign to identify a mobile station (Mobile Station, hereinafter referred to as MS) user, which is equivalent to the MS user in the Global System for Mobile Communications (Global System for Mobile Communications, hereinafter referred to as The ID card in the GSM network for short. Since the IMSI is unique in the entire network and the world, in order to make the network more secure, the GSM system generally does not use the IMSI to identify the user, but uses the Temporary Mobile Subscriber Identity (TMSI) of the MS to identify MS, that is, for each MS user entering its visiting area, the visiting location register (visiting location register, hereinafter referred to as VLR) will allocate a TMSI. During the communication process, the user only needs to use the TMSI and the location area identification code (Location Area ID, Hereinafter referred to as LAI) can identify their own identity.

In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art: when the MS registers in the service network for the first time, or the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, it must Use IMSI. In this case, the IMSI needs to be transmitted in clear text on the wireless link, which may cause leakage of the IMSI during the process of obtaining the TMSI.

Contents of the invention

The embodiment of the present invention provides a method for obtaining TMSI, a mobile station, a home location register and a communication system, which are used to solve the defect of IMSI leakage caused by transmitting the IMSI in plain text to obtain the TMSI in the prior art, so as to protect the security of the IMSI.

An embodiment of the present invention provides a method for obtaining a temporary customer identification code, the method comprising:

encrypt the IMSI using the encryption mechanism agreed with the HLR;

sending the encrypted IMSI to the HLR through the VLR, so that the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism and sending the decrypted IMSI to the VLR;

receiving the customer temporary identification code generated by the VLR according to the decrypted international mobile subscriber identification code.

An embodiment of the present invention provides a mobile station, and the mobile station includes: an encryption module and a first sending module;

The encryption module is used to encrypt the International Mobile Subscriber Identity code using the encryption mechanism agreed with the HLR;

The first sending module is configured to send the IMSI code encrypted by the encryption module to the home location register through the visitor location register, so that the home location register according to the agreed encryption mechanism Decrypting the encrypted IMSI and sending the decrypted IMSI to the VLR.

A home location register in an embodiment of the present invention, the home location register includes: a decryption module and a second sending module;

The decryption module is used to decrypt the received encrypted IMSI by adopting an encryption mechanism agreed with the mobile station to obtain the decrypted IMSI;

The second sending module is used to send the decrypted international mobile subscriber identification code obtained by the decryption module to the visitor location register, so that the visitor location register generates a client according to the decrypted international mobile subscriber identity code. Temporary ID.

An embodiment of the present invention provides a communication system, and the system includes: a mobile station, a visitor location register, and a home location register;

The mobile station is configured to encrypt the International Mobile Subscriber Identity code using an encryption mechanism agreed with the Home Location Register; and send the encrypted International Mobile Subscriber Identity Code to the VLR, so that the The above-mentioned International Mobile Subscriber Identity code is transmitted in cipher text on the wireless link;

The visitor location register is configured to send the encrypted international mobile subscriber identity code to the home location register after receiving the encrypted international mobile subscriber identity code sent by the mobile station; receiving the decrypted IMSI sent by the HLR, and generating a temporary client ID according to the decrypted IMSI.

The home location register is used to decrypt the received encrypted IMSI according to the encryption mechanism agreed with the mobile station, and send the decrypted IMSI to the access location register described above.

The embodiment of the present invention encrypts the IMSI by adopting the encryption mechanism negotiated with the HLR, and sends the encrypted IMSI to the HLR through the VLR. After the HLR receives the encrypted IMSI, it decrypts the encrypted IMSI according to the agreed encryption mechanism, and sends The decrypted IMSI is sent to the VLR, so that the VLR generates a TMSI based on the decrypted IMSI. During the process of obtaining the TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI. After obtaining the TMSI, the VLR and the MS The exchange of commands between uses TMIS instead of IMSI, which prevents illegal individuals or groups from stealing the IMSI of the MS user or tracking the position of the MS user by monitoring the signaling exchange on the wireless path.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Figure 1a is a schematic structural diagram of the GSM system;

Fig. 1b is a schematic flow chart of the first embodiment of the method for obtaining a temporary identification code of a customer according to the present invention;

Fig. 2 is a schematic flow chart of the second embodiment of the method for obtaining a temporary customer identification code in the present invention;

Fig. 3 is a schematic flow chart of the third embodiment of the method for obtaining a temporary customer identification code in the present invention;

Fig. 4 is a schematic flow chart of the fourth embodiment of the method for obtaining a temporary customer identification code in the present invention;

FIG. 5 is a schematic structural diagram of the first embodiment of the mobile station of the present invention;

FIG. 6 is a schematic structural diagram of the second embodiment of the mobile station of the present invention;

FIG. 7 is a schematic structural diagram of a third embodiment of the mobile station of the present invention;

FIG. 8 is a schematic structural diagram of a first embodiment of a home location register according to the present invention;

FIG. 9 is a schematic structural diagram of a second embodiment of a home location register of the present invention;

FIG. 10 is a schematic structural diagram of a third embodiment of a home location register of the present invention;

Fig. 11 is a schematic structural diagram of the first embodiment of the communication system of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Example 1

The method provided in this embodiment can be applied in the GSM system. Figure 1a is a schematic diagram of the GSM system structure, please refer to Figure 1a, the GSM system is mainly composed of MS, Network Switching Subsystem (hereinafter referred to as NSS), Base Station Subsystem (hereinafter referred to as BSS) and operation support subsystem ( operation support Subsystem, hereinafter referred to as OSS) consists of four parts.

NSS is the core of the entire GSM system. It plays the function of exchanging connections and managing the communication between GSM users and between users and users of other communication networks. MS, BSS and NSS constitute the physical part of the GSM system. The BSS provides and manages the transmission path between the MS and the NSS, especially including the management of the radio interface between the MS and the functional entities of the GSM system.

Specifically, the NSS includes a mobile switching center (Mobile Switching Center, hereinafter referred to as MSC), a visitor location register VLR, a home location register HLR, an authentication center (AUthenticationCenter, referred to as AUC), and an equipment identity register (abbreviated as EIR). .

MSC is the core of the entire switching network, completes or participates in all functions of the NSS, controls and connects calls, provides billing information, and coordinates and controls various functional entities in the entire GSM network.

VLR is a database serving mobile users within its control area. The system stores the relevant information of registered mobile users entering its control area, and provides the registered mobile users with the necessary conditions for establishing call connections. After a certain user enters the VLR control area, the VLR will obtain and store necessary data from the home location register HLR of the mobile user, and once the user leaves, the data of the user in the VLR will be canceled. VLR is usually set up together with MSC.

HLR is a static database that stores mobile subscriber data. Including data such as user identification numbers, access capabilities, user categories and supplementary services. At the same time, it also stores the relevant dynamic data of the VLR area where the mobile user is located.

NSS also includes Network Management Subsystem (hereinafter referred to as NMS), NMS is also called Operation & Maintenance Center (hereinafter referred to as OMC), and OMC is responsible for the maintenance and management of NSS and BSS systems.

The BSS consists of a base station controller (Base Station Control, hereinafter referred to as BSC) and a base transceiver station (Base Transceiver Station, hereinafter referred to as BTS). BSC is the control part of the base station subsystem BSS. It mainly completes interface management, terrestrial channel management between BTS--BSC, wireless parameter and wireless resource management measurement and statistical switching, and supports call control operation and maintenance functions. BTS is controlled by the base station controller BSC, belongs to the wireless part of the base station subsystem BSS, and is a wireless transceiver station device serving a certain cell.

OSS includes Network Management Center (Net Management Center, hereinafter referred to as NMC), Data Post Processing System (Date PostProcessing System, hereinafter referred to as DPPS), User Identification Card Personalization Center (Personal Center System, hereinafter referred to as PCS) and Security Management Center ( SEcurity Management Center, hereinafter referred to as SEMC).

The GSM system also includes a public data network (Public Date Net, hereinafter referred to as PDN), a public telephone network (Public Switched Telephone Network, hereinafter referred to as PSTN), and an integrated services digital network (Integrated Services Digital Network, hereinafter referred to as ISDN).

In the GSM system, the International Mobile Subscriber Identity (IMSI) is the number that uniquely identifies a mobile station user. IMSI is valid in all service areas of the GSM system. IMSI is required for call establishment and location update. IMSI is stored in HLR, VLR and SIM card. Considering the security of the mobile user's IMSI, VLR can assign a unique TMSI to each visiting mobile station user. All IMSI transmitted on the wireless link will be replaced by TMSI, which will be assigned after each authentication. It is valid within the jurisdiction of a certain VLR. When the user leaves the service area of the VLR, the number is released, and the TMSI can be used in call establishment and location update.

Please refer to FIG. 1b, which is a schematic flow chart of the first embodiment of the method for obtaining a temporary customer identification code. As shown in FIG. 1b, the method includes:

Step 101: Encrypt the IMSI using the encryption mechanism agreed with the HLR.

Step 102: Send the encrypted IMSI to the HLR through the VLR, so that the HLR decrypts the encrypted IMSI according to the above agreed encryption mechanism and sends the decrypted IMSI to the VLR.

For example, send the encrypted IMSI and the identifier of the HLR to the VLR, so that the IMSI is transmitted in cipher text on the wireless link, and then the VLR will send the encrypted IMSI to the HLR according to the identifier of the HLR.

Step 103: Receive the TMSI generated by the VLR according to the decrypted IMSI.

After receiving the TMSI, the command exchange between the VLR and the MS uses TMIS, and the user's IMSI is no longer transmitted in clear text on the wireless link, preventing illegal individuals or groups from stealing by monitoring the signaling exchange on the wireless path. Get the IMSI of a mobile customer or track the location of a mobile customer.

Encrypt the IMSI by using the encryption mechanism agreed with the HLR, and send the encrypted IMSI to the HLR through the VLR. After the HLR receives the encrypted IMSI, it decrypts the encrypted IMSI according to the agreed encryption mechanism, and sends the decrypted IMSI Send it to the VLR, so that the VLR generates TMSI according to the decrypted IMSI. During the process of obtaining the TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI; after obtaining the TMSI, the command between the VLR and the MS The exchange uses TMIS instead of IMSI, which prevents illegal individuals or groups from stealing the IMSI of the MS user or tracking the location of the MS user by monitoring the signaling exchange on the wireless path.

Example 2

Fig. 2 is a schematic flow chart of the second embodiment of the method for obtaining a temporary identification code for a client. As shown in Fig. 2, the method includes:

Step 201: The MS sends a request to the HLR through the VLR, requesting the HLR to send the public key of the HLR.

Step 202: The MS receives the public key of the HLR through the VLR.

Step 203: The MS encrypts the IMSI using the received public key of the HLR.

Step 204: The MS sends the HLR ID and the encrypted IMSI to the VLR, so that the IMSI is transmitted in cipher text on the wireless link, and the VLR sends the encrypted IMSI to the corresponding HLR according to the HLR ID.

Wherein, if only the public key of HLR is used to encrypt the IMSI, although the IMSI can be protected, replay attacks cannot be prevented, because only the public key of the HLR is used to encrypt the IMSI, the result E _sk (IMSI) of each encryption is the same If yes, the attacker often listens to the encryption result, and the attacker can also pretend to be a legitimate MS and send E _sk (IMSI) to the HLR through the VLR. This is a replay attack. can happen.

In order to prevent replay attacks, MS can generate a random number itself, encrypt the IMSI and the random number with the queried HLR public key, and then send them to HLR through VLR, which not only protects IMSI, but also prevents replay attacks.

Because if the IMSI and the random number are encrypted with the public key of the HLR, since the random number generated each time is different, the result E _sk (RAND||IMSI) after each encryption is also different, and the attacker listens to Therefore, the attacker cannot send the correct encrypted IMSI result to the HLR through the VLR, so encrypting the IMSI with the random number and the public key of the HLR can prevent replay attacks very well.

Furthermore, after the HLR receives the encryption result sent by the MS through the VLR, it decrypts it through the private key stored in the HLR. If it only encrypts the IMSI, it can directly obtain the IMSI after decryption; if it encrypts the IMSI and a random number, it can obtain the The results include IMSI and random numbers. Since the encryption mechanism is pre-agreed, the relationship between random numbers and IMSI is also predictable. When encrypting, if the random number is in front of the IMSI, the last 15 digits in the decrypted result are the IMSI ; If the random number is behind the IMSI, the first 15 digits in the decrypted result are the IMSI; the random number can also be placed in the middle of the IMSI, because the IMSI is composed of 15 bits of 0 and/or 1, and most of the random numbers Not 0 or 1, so it's easy to tell the difference. But when the random number is 0 or 1, you can add other characters before and after the random number to distinguish it from the IMSI. For example, if the decrypted result is 01010*1*0010111001, you can remove the 1 in the middle of the * number, and the rest is for the IMSI.

After the HLR decrypts and obtains the IMSI, it obtains the corresponding master key Ki according to the IMSI, generates authentication information based on the master key and the random number generated by itself, and sends the authentication information to the VLR, so that the VLR can verify the corresponding IMSI according to the authentication information. Whether the MS is legal, if legal, then send the decrypted IMSI to the VLR.

In this embodiment, the authentication information may be a tuple, which at least includes: the random number Rand generated by HLR, the authentication parameter RES generated by Rand and Ki through the authentication algorithm, and the encryption parameter RES generated by Rand and Ki through the encryption algorithm. Key Kc.

For example, the process for the VLR to verify whether the MS is legal according to the authentication information can be:

a: VLR sends the random number generated by HLR to MS;

b: After MS receives it, it uses the A3 algorithm to perform authentication operations on the random number, and sends the obtained authentication operation result SERS to the VLR;

c: After receiving the SERS sent by the MS, the VLR compares it with the RES in the triplet. If the two are equal, the verification is successful, indicating that the MS is legal, and sends a successful verification message to the HLR.

d: After the HLR receives the successful authentication message sent by the VLR, it sends the IMSI of the MS to the VLR, so that the VLR generates a TMSI based on the IMSI, and sends the generated TMSI to the above-mentioned MS, so that the MS uses the TMSI instead of the MS when communicating. IMSI, thus ensuring the security of the IMSI.

The method provided in this embodiment can be applied to the process of requesting user identity. For example, when the MS registers in the service network for the first time, or when the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, the method can be used. The method provided in this embodiment transmits the IMSI in ciphertext and generates the TMSI.

This embodiment encrypts the IMSI with the public key of the HLR, and sends the encrypted IMSI to the HLR through the VLR. After the HLR receives the encrypted IMSI, it uses the private key of the HLR to decrypt the encrypted IMSI, and the decrypted The IMSI is sent to the VLR, so that the VLR generates the TMSI according to the decrypted IMSI. In the process of obtaining the TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI; compared with the method of encrypting the IMSI in 3G, The method for encrypting the TMSI in this embodiment is simple, and can be directly applied to the GSM system, without making major changes to various hardware devices of the GSM system; after obtaining the TMSI, the command exchange between the VLR and the MS uses TMIS instead of The IMSI prevents illegal individuals or groups from stealing the IMSI of the MS user or tracking the location of the MS user by monitoring the signaling exchange on the wireless path.

Example 3

Fig. 3 is a schematic flow chart of the third embodiment of the method for obtaining a temporary customer identification code, as shown in Fig. 3, the method includes:

Step 301: Negotiate the homomorphic encryption algorithm with the HLR.

Step 302: The VLR receives a plurality of random numbers encrypted by the HLR using a homomorphic encryption algorithm sent by the HLR; the number of the random numbers is the same as the number of digits of the IMSI of the MS.

Among them, the homomorphic encryption algorithm needs to satisfy the following properties: for the three numbers a, b, c in the domain, E(a)*E(b)=E(a+b), E(a) ^c =E( c·a).

For example, since the current IMSI has 15 digits, the HLR encrypts 15 random numbers r ₁ , r ₂ ,...r ₁₅ selected by itself with the above-mentioned homomorphic encryption algorithm. These 15 random numbers r ₁ , r ₂ , ...r ₁₅ are not equal to 0.

If 15 random numbers are encrypted together, the calculation process may be more complicated. In order to simplify the calculation process, HLR can encrypt these 15 random numbers selected by itself in batches, that is, E(r ₁ r ₂ r ₃ )||E (r ₄ r ₅ r ₆ )||...||E(r ₁₃ r ₁₄ r ₁₅ ), || is represented as a link, and then the 15 random numbers encrypted in batches are sent to the MS through the VLR.

It should be noted that, in this embodiment, there is no limitation on the batches encrypted in batches and the number of random numbers in each batch.

Step 303: After receiving the encrypted random numbers sent by the HLR through the VLR, according to the properties of the homomorphic encryption algorithm, the IMSI is used to perform a homomorphic encryption operation on the encrypted random numbers to complete the encryption of the IMSI.

Specifically, the property E(a) ^c = E(c a) of the homomorphic encryption algorithm can be used, and the IMSI can be used to perform exponentiation on the encrypted multiple random numbers, for example:

E(r ₁ r ₂ r ₃ ) ^a1a2a3 ||E(r ₄ r ₅ r ₆ ) ^a4a5a6 ||...||E(r ₁₃ r ₁₄ r ₁₅ ) ^a13a14a15 ，a ₁ ，a ₂ ，…， a ₁₅ is the 15th digit of the IMSI.

It is also possible to use the property E(a)*E(b)=E(a+b) of the homomorphic encryption algorithm, and use IMSI to multiply the encrypted random numbers, for example:

E(r ₁ r ₂ r ₃ )*E(a ₁ a ₂ a ₃ )||E(r ₄ r ₅ r ₆ )*E(a ₄ a ₅ a ₆ )||...||E(r ₁₃ r ₁₄ r ₁₅ )*E(a ₁₃ a ₁₄ a ₁₅ ).

Step 304: Send the HLR ID and the encrypted IMSI to the VLR, so that the IMSI is transmitted in ciphertext on the wireless link, and the VLR sends the encrypted IMSI to the corresponding HLR according to the HLR ID.

Further, after receiving the encrypted IMSI, the HLR uses the property of the homomorphic encryption algorithm to perform a homomorphic decryption operation on the IMSI to obtain the IMSI.

Specifically, when the HLR receives E(r ₁ r ₂ r ₃ ) ^a1a2a3 ||E(r ₄ r ₅ r ₆ ) ^a4a5a6 ||...||E(r ₁₃ r ₁₄ r ₁₅ ) ^a13a14a15 , use the same The nature of state encryption algorithm E(a) ^c = E(c·a) to decrypt, get

a ₁ a ₂ a ₃ r ₁ r ₂ r ₃ , a ₄ a ₅ a ₆ r ₄ r ₅ r ₆ , ..., a ₁₃ a ₁₄ a ₁₅ r ₁₃ r ₁₄ r ₁₅ , then by division Get a ₁ , a ₂ , ..., a ₁₅ , so as to get the IMSI;

When HLR receives E(r ₁ r ₂ r ₃ )*E(a ₁ a ₂ a ₃ )||E(r ₄ r ₅ r ₆ )*E(a ₄ a ₅ a ₆ )||...| |E(r ₁₃ r ₁₄ r ₁₅ )*E(a ₁₃ a ₁₄ a ₁₅ ), use the property E(a)*E(b)=E(a+b) of the homomorphic encryption algorithm to decrypt, and get

r ₁ r ₂ r ₃ +a ₁ a ₂ a ₃ ||r ₄ r ₅ r ₆ +a ₄ a ₅ a ₆ ...||r ₁₃ r ₁₄ r ₁₅ +a ₁₃ a ₁₄ a ₁₅ , then subtract 15 random numbers, a ₁ , a ₂ , ..., a ₁₅ are obtained, and thus the decrypted IMSI is obtained.

The processing process after the HLR obtains the decrypted IMSI is the same as the processing process after the HLR obtains the decrypted IMSI in Embodiment 1, and will not be repeated here.

The method provided in this embodiment can be applied to the process of requesting user identity. For example, when the MS registers in the service network for the first time, or when the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, the method can be used. The method provided in this embodiment transmits the IMSI in ciphertext and generates the TMSI.

In this embodiment, after receiving multiple random numbers encrypted by the HLR with the homomorphic encryption algorithm negotiated with the MS, the MS uses the property of the homomorphic encryption algorithm to perform a homomorphic encryption operation on the encrypted multiple random numbers using the IMSI. Complete the encryption of the IMSI, and send the encrypted IMSI to the HLR through the VLR. After the HLR receives the encrypted IMSI, it decrypts the encrypted IMSI according to the agreed homomorphic encryption algorithm, and sends the decrypted IMSI to the VLR. , so that the VLR generates TMSI according to the decrypted IMSI, and in the process of obtaining the TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI and prevents replay attacks; Compared with the method, the method for encrypting the TMSI in this embodiment is simple, can be directly applied to the GSM system, and does not need to make major changes to various hardware devices of the GSM system; after obtaining the TMSI, the command exchange between the VLR and the MS uses the TMIS , without using the IMSI, preventing illegal individuals or groups from stealing the IMSI of the MS user or tracking the location of the MS user by monitoring the signaling exchange on the wireless path.

Example 4

Fig. 4 is a schematic flow chart of a fourth embodiment of a method for obtaining a temporary identification code for a customer. As shown in Fig. 4, the method includes:

Step 401: The MS sends the first random number generated by itself to the HLR through the VLR, and receives the second random number generated by the HLR sent by the HLR through the VLR.

For example, let the first random number generated by the MS be R1, and send R1 to the HLR through the VLR; let the second random number generated by the HLR be R2, and send R2 to the MS through the VLR.

Step 402: The MS performs an authentication operation and an XOR operation on the first random number generated by itself and the received second random number to obtain a third random number, and performs an XOR operation on the third random number with its own IMSI, Get the encrypted IMSI.

Step 403: Send the encrypted IMSI and the HLR ID to the VLR, so that the IMSI is transmitted in cipher text on the wireless link, and the VLR sends the encrypted IMSI to the HLR according to the HLR ID.

Wherein, the MS sends the first random number generated by itself to the HLR through the VLR, and after receiving the second random number generated by the HLR sent by the HLR through the VLR, the MS compares the first random number generated by itself with the second random number received. Before the authentication operation and the XOR operation, the method provided in this embodiment may further include:

Performing an authentication operation on the first random number and the second random number to obtain a first authentication operation result, and sending the first authentication operation result to the HLR through the VLR;

Receive the second authentication calculation result sent by the HLR through the VLR; the second authentication calculation result is obtained by the HLR using the same authentication algorithm to perform authentication operations on the first random number and the second random number;

When the result of the first authentication operation is the same as the result of the second authentication operation, the MS confirms that the second random number is sent by the HLR, and the HLR also confirms that the first random number is sent by the MS.

The algorithm of the authentication operation is further described below using the A3 algorithm as an example, for example,

MS sends R1 and R2 through A3 calculation, and sends the first authentication calculation result to HLR through VLR;

After the HLR performs the A3 operation on R1 and R2, the second authentication operation result is sent to the MS through the VLR;

If the second authentication operation result sent by the HLR received by the MS is the same as the first authentication operation result obtained by the MS, the MS sends an authentication success message to the HLR;

If the first authentication operation result sent by the MS received by the HLR is the same as the second authentication operation result obtained by itself, then the HLR sends an authentication success message to the MS;

If the MS is successfully authenticated and receives the message of successful authentication sent by the HLR, the MS then performs an authentication operation and an XOR operation on the first random number R1 generated by itself and the second random number R2 received.

Wherein, MS performs authentication and XOR operation on the first random number generated by itself and the second random number received, which can be specifically:

The MS performs an authentication operation on the first random number and the second random number, performs an XOR operation on the result after the authentication operation and the first random number, and then performs an authentication operation on the result of the XOR operation and the second random number, Get the third random number.

Still taking the A3 algorithm as the authentication algorithm as an example for illustration, the third random number R is R=A3(R1⊕A3(R1, R2), R2).

Further, after the HLR receives the encrypted IMSI through the VLR, it calculates a third random number according to the first random number sent by the MS and the second random number generated by itself, and then combines the calculated third random number with the received Exclusive OR operation is performed on the encrypted IMSI to obtain the decrypted IMSI.

The processing procedure after the HLR obtains the decrypted IMSI is the same as the processing procedure after the HLR obtains the decrypted IMSI in Embodiment 1, and will not be repeated here.

It should be noted that, before performing the exclusive OR operation, the MS and the HLR need to convert the random number to be subjected to the exclusive OR operation into binary.

The method provided in this embodiment can be applied to the process of requesting user identity. For example, when the MS registers in the service network for the first time, or when the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, the method can be used. The method provided in this embodiment transmits the IMSI in ciphertext and generates the TMSI.

In this embodiment, the MS obtains the third random number by performing authentication operation and XOR operation on the first random number generated by itself and the received second random number, and performs XOR operation on the three random numbers with its own IMSI , to get the encrypted IMSI, after the HLR receives the encrypted IMSI, it decrypts the encrypted IMSI through the XOR operation, and sends the decrypted IMSI to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI. During the process of TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI and prevents replay attacks; compared with the method for encrypting the IMSI in 3G, the method for encrypting the TMSI in this embodiment is simple. It can be directly applied to the GSM system, without major changes to the various hardware devices of the GSM system; and the XOR method is simple, without a large number of encryption and decryption operations, which greatly improves the efficiency; after obtaining the TMSI, between the VLR and the MS TMIS is used instead of IMSI for the exchange of commands, which prevents illegal individuals or groups from stealing the IMSI of the MS user or tracking the location of the MS user by monitoring the signaling exchange on the wireless path.

Example 5

FIG. 5 is a schematic structural diagram of a first embodiment of a mobile station. As shown in FIG. 5, the mobile station includes: an encryption module 501 and a first sending module 502;

The encryption module 501 is configured to encrypt the IMSI using the encryption mechanism agreed with the HLR.

The first sending module 502 is configured to send the IMSI encrypted by the encryption module 501 to the HLR through the VLR, so that the HLR decrypts the encrypted IMSI according to an agreed encryption mechanism and sends the decrypted IMSI to the VLR.

The first sending module 502 can send the identifier of the HLR and the encrypted IMSI to the VLR, so that the IMSI is transmitted in cipher text on the wireless link, and then the VLR will send the encrypted IMSI to the HLR according to the identifier of the HLR.

Specifically, the encryption module 501 uses the public key of the HLR to encrypt the IMSI, or uses the public key of the HLR to encrypt the IMSI and a random number, and the random number is used to make the IMSI different after each encryption. Correspondingly, after the HLR receives the encryption result sent by the MS through the VLR, it decrypts it with its own stored private key to obtain the IMSI of the MS, and obtains the corresponding master key Ki according to the IMSI. Generate verification information with a random number, and send the verification information to the VLR, so that the VLR verifies the MS according to the verification information, so as to determine that the mobile station corresponding to the IMSI is legal.

In this embodiment, the authentication information can be a multigroup, which includes at least: the random number Rand generated by HLR, the authentication parameter RES generated by Rand and Ki through the authentication algorithm, and the encryption parameter RES generated by Rand and Ki through the encryption algorithm. Key Kc.

For example, the specific process for the VLR to verify the MS according to the verification information may be:

a: VLR sends the random number generated by HLR to MS;

b: After MS receives it, it uses the A3 algorithm to perform authentication operations on the random number, and sends the obtained authentication operation result SERS to the VLR;

c: After receiving the SERS sent by the MS, the VLR compares it with the RES in the triplet. If the two are equal, the verification is successful, indicating that the MS is legal, and sends a successful verification message to the HLR.

d: After the HLR receives the verification success message sent by the VLR, it sends the IMSI of the MS to the VLR, so that the VLR generates a TMSI according to the IMSI.

The mobile station provided by this embodiment can be applied to the process of requesting user identity. For example, when the MS registers in the service network for the first time, or the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, it can The method provided in this embodiment is used to transmit the IMSI in ciphertext and generate the TMSI.

This embodiment encrypts the IMSI by adopting the encryption mechanism agreed with the HLR, and sends the encrypted IMSI to the HLR through the VLR. After the HLR receives the encrypted IMSI, it uses its own private key to decrypt the encrypted IMSI, and decrypts the encrypted The final IMSI is sent to the VLR, so that the VLR generates a TMSI based on the decrypted IMSI. During the process of obtaining the TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI. It is similar to the scheme of encrypting the IMSI in 3G. Compared, utilizing the MS provided by this embodiment to transmit the IMSI in the form of ciphertext, the structure is simple, and can be directly applied to the GSM system, without making major changes to various hardware devices of the GSM system; after obtaining the TMSI, the VLR and the MS Inter-command exchange uses TMIS instead of IMSI, which prevents illegal individuals or groups from stealing MS user's IMSI or tracking the MS user's location by monitoring the signaling exchange on the wireless path.

Example 6

FIG. 6 is a schematic structural diagram of the second embodiment of the mobile station. As shown in FIG. 6, the mobile station includes: an encryption module 501 and a first sending module 502;

Specifically, the encryption module 501 includes: a first negotiation unit 5010, a first receiving unit 5011, and a first encryption unit 5012;

The first negotiating unit 5010 is configured to negotiate a homomorphic encryption algorithm with the HLR.

Among them, the homomorphic encryption algorithm needs to satisfy the following properties: for the three numbers a, b, c in the domain, E(a)*E(b)=E(a+b), E(a) ^c =E( c·a).

The first receiving unit 5011 is configured to receive a plurality of random numbers encrypted by the HLR sent by the HLR through the VLR using the above-mentioned homomorphic encryption algorithm; the number of the random numbers is the same as the number of digits of the IMSI.

For example, since the current IMSI has 15 digits, the HLR uses the homomorphic encryption algorithm to encrypt 15 random numbers r ₁ , r ₂ ,...r ₁₅ , these 15 random numbers r ₁ , r ₂ ,... None of r ₁₅ is equal to 0.

If 15 random numbers r ₁ , r ₂ , ...r ₁₅ are encrypted together, the calculation process may be more complicated. In order to simplify the calculation process, HLR can encrypt 15 random numbers selected by itself in batches; for example,

E(r ₁ r ₂ r ₃ )||E(r ₄ r ₅ r ₆ )||...||E(r ₁₃ r ₁₄ r ₁₅ ), || is represented as a link.

The first encryption unit 5012 is configured to use the property of the homomorphic encryption algorithm to perform a homomorphic encryption operation on the encrypted random numbers by using the IMSI after the first receiving unit 5011 receives the encrypted random numbers to complete the IMSI encryption.

Specifically, the first encryption unit 5012 utilizes the property E(a) ^c = E(c·a) of the homomorphic encryption algorithm, uses the IMSI to perform exponentiation on multiple encrypted random numbers, and completes the encryption of the IMSI, for example, E( r ₁ r ₂ r ₃ ) ^a1a2a3 ||E(r ₄ r ₅ r ₆ ) ^a4a5a6 ||...||E(r ₁₃ r ₁₄ r ₁₅ ) ^a13a14a15 ，a ₁ ，a ₂ ，...，a ₁₅ 15 digits of IMSI;

The first encryption unit 5012 can also use the property E(a)*E(b)=E(a+b) of the homomorphic encryption algorithm to multiply the encrypted random numbers by IMSI, for example:

E(r ₁ r ₂ r ₃ )*E(a ₁ a ₂ a ₃ )||E(r ₄ r ₅ r ₆ )*E(a ₄ a ₅ a ₆ )||...||E(r ₁₃ r ₁₄ r ₁₅ )*E(a ₁₃ a ₁₄ a ₁₅ ).

The first sending module 502 is configured to send the identifier of the HLR and the IMSI encrypted by the encryption module 501 to the VLR, so that the IMSI is transmitted in cipher text on the wireless link, and the VLR sends the encrypted IMSI according to the identifier of the HLR Send to HLR;

Further, after receiving the encrypted IMSI, the HLR uses the property of the homomorphic encryption algorithm to perform a homomorphic decryption operation on the IMSI, and sends the decrypted IMSI to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI.

The mobile station provided by this embodiment can be applied to the process of requesting user identity. For example, when the MS registers in the service network for the first time, or the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, it can The method provided in this embodiment is used to transmit the IMSI in ciphertext and generate the TMSI.

In this embodiment, after receiving multiple random numbers encrypted by the HLR with the homomorphic encryption algorithm negotiated with the MS, the MS uses the properties of the homomorphic encryption algorithm to perform a homomorphic encryption operation on the encrypted multiple random numbers using the IMSI. Send the operation result to HLR through VLR, complete the encryption of IMSI, and send the encrypted IMSI to HLR through VLR. After HLR receives the encrypted IMSI, it performs homomorphic encryption on the encrypted IMSI according to the agreed homomorphic encryption algorithm. Decryption operation, and send the decrypted IMSI to the VLR, so that the VLR generates TMSI according to the decrypted IMSI, and in the process of obtaining the TMSI, the IMSI is transmitted in the form of cipher text on the wireless link, which protects the security of the IMSI and also The replay attack has been prevented. Compared with the scheme of encrypting IMSI in 3G, the MSI provided by this embodiment is used to transmit the IMSI in the form of ciphertext, the structure is simple, and it can be directly applied to the GSM system. There is no need to make major changes; after the TMSI is obtained, the command exchange between the VLR and the MS uses TMIS instead of IMSI, preventing illegal individuals or groups from stealing the IMSI or IMSI of the MS user by monitoring the signaling exchange on the wireless path. Track MS user's location.

Example 7

FIG. 7 is a schematic structural diagram of a third embodiment of a mobile station. As shown in FIG. 7, the mobile station includes: an encryption module 501 and a first sending module 502;

The encryption module 501 includes: a first sending unit 5013, a second receiving unit 5014 and a second encrypting unit 5015;

The first sending unit 5013 is configured to send the first random number to the HLR through the VLR.

For example, the first sending unit 5013 sends the first random number R1 to the HLR through the VLR.

The second receiving unit 5014 is configured to receive, through the VLR, the second random number generated by the HLR sent by the HLR.

For example, after the HLR generates the second random number R2, it sends R2 to the MS through the VLR.

The second encryption unit 5015 is used to perform an authentication operation and an XOR operation on the first random number and the second random number to obtain a third random number; perform an XOR operation on the third random number with its own IMSI to complete the IMSI encryption.

In this embodiment, the A3 algorithm may be used as the authentication algorithm, and the third random number R is R=A3(R1⊕A3(R1, R2), R2).

The encryption module 501 may also include: a first authentication unit and a first confirmation unit;

The first authentication unit is configured to perform an authentication operation on the first random number and the second random number to obtain a first authentication operation result, and send the first authentication operation result to the HLR through the VLR;

It is also used for receiving the second authentication operation result sent by the HLR through the VLR; the second authentication operation result is obtained by the HLR using the same authentication algorithm as the first authentication unit to perform authentication operations on the first random number and the second random number.

The first confirmation unit is configured to confirm that the second random number is sent by the HLR when the result of the first authentication operation is the same as the result of the second authentication operation, and trigger the second encryption unit 5015 .

Specifically, the second encryption unit 5015 is used to perform an authentication operation on the first random number and the second random number, perform an XOR operation on the result after the authentication operation and the first random number, and then combine the result of the XOR operation with the first random number An authentication operation is performed on the two random numbers to obtain a third random number; an XOR operation is performed on the third random number and its own IMSI to complete the encryption of the IMSI.

The first sending module 502 is configured to send the IMSI encrypted by the encryption module 501 and the identifier of the HLR to the VLR, so that the IMSI is transmitted in cipher text on the wireless link, and the VLR sends the encrypted IMSI according to the identifier of the HLR Sent to HLR.

After the HLR receives the encrypted IMSI through the VLR, it calculates the third random number according to the first random number sent by the MS and the second random number generated by itself, and then compares the calculated third random number with the received encrypted IMSI Exclusive OR operation to obtain the decrypted IMSI, and send the decrypted IMSI to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI.

The mobile station provided by this embodiment can be applied to the process of requesting user identity. For example, when the MS registers in the service network for the first time, or the service network interacting with the MS cannot obtain the corresponding IMSI according to the TMSI of the MS, it can The method provided in this embodiment is used to transmit the IMSI in ciphertext and generate the TMSI.

In this embodiment, the MS obtains the third random number by performing authentication operation and XOR operation on the first random number generated by itself and the received second random number, and performs XOR operation on the three random numbers with its own IMSI , complete the encryption of the IMSI, send the encrypted IMSI to the HLR through the VLR, and after the HLR receives the encrypted IMSI, calculate the third random number according to the first random number sent by the MS and the second random number generated by itself, Then perform XOR operation with the calculated third random number and the received encrypted IMSI to obtain the decrypted IMSI, and send the decrypted IMSI to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI, and obtains During the process of TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI and prevents replay attacks. Transmission in the form of cipher text, MS structure is simple, can be directly applied to the GSM system, without major changes to the various hardware devices of the GSM system; after obtaining TMSI, the command exchange between VLR and MS uses TMIS instead of Using the IMSI prevents illegal individuals or groups from stealing the IMSI of the MS user or tracking the location of the MS user by listening to signaling exchanges on the wireless path.

Example 8

FIG. 8 is a schematic structural diagram of a first embodiment of a home location register. As shown in FIG. 8, the HLR includes: a decryption module 601 and a second sending module 602;

The decryption module 601 is configured to use an encryption mechanism agreed with the MS to decrypt the received encrypted IMSI to obtain the decrypted IMSI.

When the encryption module 501 in Embodiment 5 specifically uses the public key of the HLR to encrypt the IMSI, correspondingly, the decryption module 601 uses the private key of the HLR to decrypt the received encrypted IMSI to obtain the decrypted IMSI.

The second sending module 602 is configured to send the decrypted IMSI obtained by the decryption module 601 to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI.

In this embodiment, the HLR decrypts the received encrypted IMSI by using the encryption mechanism agreed with the MS to obtain the decrypted IMSI, and sends the decrypted IMSI to the VLR, so that the VLR generates a TMSI based on the decrypted IMSI After obtaining the TMSI, the command exchange between the VLR and the MS uses TMIS instead of IMSI, preventing illegal individuals or groups from stealing the IMSI of the MS user or tracking the MS user's ID by monitoring the signaling exchange on the wireless link. Location.

Example 9

Fig. 9 is a schematic structural diagram of the second embodiment of the home location register. As shown in Fig. 9, the HLR includes: a decryption module 601 and a second sending module 602; wherein, the decryption module 601 specifically includes: a second negotiating unit 6010, a third An encryption unit 6011, a second sending unit 6012 and a first decryption unit 6013;

The second negotiating unit 6010 is configured to negotiate a homomorphic encryption algorithm with the MS.

The structure of the MS in this embodiment is the same as that of the MS in Embodiment 6.

The third encryption unit 6011 is configured to use the homomorphic encryption algorithm negotiated by the second negotiation unit 6010 to encrypt multiple random numbers selected by itself, and the number of the random numbers is the same as the number of digits of the IMSI.

For example, since the current IMSI has 15 digits, the third encryption unit 6011 uses the homomorphic encryption algorithm negotiated by the second negotiation unit 6010 to encrypt 15 random numbers r ₁ , r ₂ ,...r ₁₅ selected by itself, None of the 15 random numbers r ₁ , r ₂ , . . . r ₁₅ are equal to 0.

If 15 random numbers r ₁ , r ₂ , ... r ₁₅ are encrypted together, the calculation process may be more complicated. In order to simplify the calculation process, the third encryption unit 6011 can encrypt 15 random numbers selected by itself in batches; for example , E(r ₁ r ₂ r ₃ )||E(r ₄ r ₅ r ₆ )||...||E(r ₁₃ r ₁₄ r ₁₅ ), || is expressed as a link.

It should be noted that, in this embodiment, there is no limitation on the batches encrypted in batches and the number of random numbers in each batch.

The second sending unit 6012 is configured to send the multiple random numbers encrypted by the third encrypting unit 6011 to the MS through the VLR.

The first decryption unit 6013 is configured to perform a homomorphic decryption operation on the encrypted IMSI by using the property of the homomorphic encryption algorithm after receiving the encrypted IMSI sent by the MS through the VLR to obtain the decrypted IMSI.

Continuing the above example, when the first encryption unit 5012 in Embodiment 6 encrypts the IMSI as E(r ₁ r ₂ r ₃ ) ^a1a2a3 ||E(r ₄ r ₅ r ₆ ) ^a4a5a6 ||...||E(r ₁₃ r ₁₄ r ₁₅ ) ^a13a14a15 , the first decryption unit 6013 uses the property E(a) ^c = E(c·a) of the homomorphic encryption algorithm to perform a homomorphic decryption operation, and obtain

a ₁ a ₂ a ₃ r ₁ r ₂ r ₃ , a ₄ a ₅ a ₆ r ₄ r ₅ r ₆ , ..., a ₁₃ a ₁₄ a ₁₅ r ₁₃ r ₁₄ r ₁₅ , then by division Get a ₁ , a ₂ , ..., a ₁₅ , and thus get the decrypted IMSI;

When the first encryption unit 5012 in Embodiment 6 encrypts the IMSI as

E(r ₁ r ₂ r ₃ )*E(a ₁ a ₂ a ₃ )||E(r ₄ r ₅ r ₆ )*E(a ₄ a ₅ a ₆ )||...||E(r ₁₃ r ₁₄ r ₁₅ )*E(a ₁₃ a ₁₄ a ₁₅ ), the first decryption unit 6013 uses the property E(a)*E(b)=E(a+b) of the homomorphic encryption algorithm to perform homomorphic decryption operation, get

r ₁ r ₂ r ₃ +a ₁ a ₂ a ₃ ||r ₄ r ₅ r ₆ +a ₄ a ₅ a ₆ ...||r ₁₃ r ₁₄ r ₁₅ +a ₁₃ a ₁₄ a ₁₅ , then subtract 15 random numbers, a ₁ , a ₂ , ..., a ₁₅ are obtained, and thus the decrypted IMSI is obtained.

The second sending module 602 is configured to send the decrypted IMSI obtained by the decryption module 601 to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI.

In this embodiment, the HLR performs a homomorphic decryption operation on the received encrypted IMSI by using the homomorphic encryption algorithm agreed with the MS to obtain the decrypted IMSI, and sends the decrypted IMSI to the VLR, so that the VLR The final IMSI generates TMSI. After obtaining TMSI, the command exchange between VLR and MS uses TMIS instead of IMSI, which prevents illegal individuals or groups from stealing the IMSI or IMSI of the MS user by monitoring the signaling exchange on the wireless path. Track MS user's location.

Example 10

Fig. 10 is a schematic structural diagram of a third embodiment of a home location register. As shown in Fig. 10, the HLR includes: a decryption module 601 and a second sending module 602; wherein, the decryption module 601 specifically includes: a third receiving unit 6014, a third a sending unit 6015 and a second decryption unit 6016;

The third receiving unit 6014 is configured to receive the first random number sent by the MS through the VLR.

The structure of the MS in this example is the same as that of the MS in Example 7.

The third sending unit 6015 is configured to send the second random number to the MS through the VLR.

The second decryption unit 6016 is configured to calculate a third random number according to the first random number and the second random number, and then perform an XOR operation on the calculated third random number and the received encrypted IMSI to obtain the decrypted The IMSI.

The second sending module 602 is configured to send the decrypted IMSI obtained by the decryption module 601 to the VLR, so that the VLR generates a TMSI according to the decrypted IMSI.

Wherein, the decryption module 601 also includes: a second authentication unit and a second confirmation unit;

The second authentication unit is configured to perform an authentication operation on the first random number and the second random number to obtain a second authentication operation result, and send the second authentication operation result to the MS through the VLR;

It is also used to receive the first authentication operation result sent by the MS through the VLR; the first authentication operation result is obtained by the MS using the same authentication algorithm as the second authentication unit to perform authentication operations on the first random number and the second random number.

The second confirming unit is configured to confirm that the first random number is sent by the MS when the result of the first authentication operation is the same as the result of the second authentication operation, and send a message of successful authentication to the MS.

It should be noted that before performing the XOR operation, the random number to be subjected to the XOR operation needs to be converted into binary.

In this embodiment, the HLR performs an XOR operation on the received encrypted IMSI by using the XOR encryption mechanism agreed with the MS to obtain the decrypted IMSI, and sends the decrypted IMSI to the VLR, so that the VLR TMSI is generated from the IMSI, and after the TMSI is obtained, the command exchange between the VLR and the MS uses the TMIS instead of the IMSI, which prevents illegal individuals or groups from stealing the MS's IMSI or tracking the MS by monitoring the signaling exchange on the wireless path The user's location.

Example 11

Fig. 11 is a schematic structural diagram of the first embodiment of the communication system. As shown in Fig. 11, the system includes: MS11, VLR12 and HLR13;

MS11 is configured to encrypt the IMSI using the encryption mechanism agreed with the HLR13, and send the encrypted IMSI to the VLR12, so that the IMSI is transmitted in cipher text on the wireless link.

VLR12 is used for sending the encrypted IMSI to HLR13 after receiving the encrypted IMSI sent by MS11; it is also used for receiving the decrypted IMSI sent by HLR13 and generating TMSI according to the decrypted IMSI.

The HLR13 is configured to decrypt the received encrypted IMSI according to the encryption mechanism agreed with the MS11, and send the decrypted IMSI to the VLR12.

Wherein, before HLR13 sends the decrypted IMSI to the VLR, it is also used to obtain the corresponding master key according to the decrypted IMSI, generates verification information according to the master key and the random number generated by itself, and sends the verification information to VLR;

Correspondingly, the VLR verifies the mobile station corresponding to the IMSI according to the verification information, so as to confirm that the MS corresponding to the IMSI is legal.

In this embodiment, the MS encrypts the IMSI using the encryption mechanism agreed with the HLR, and sends the encrypted IMSI to the HLR through the VLR. After receiving the encrypted IMSI, the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism, and Send the decrypted IMSI to the VLR, so that the VLR generates the TMSI according to the decrypted IMSI. During the process of obtaining the TMSI, the IMSI is transmitted in cipher text on the wireless link, which protects the security of the IMSI; it is the same as the encrypted IMSI in 3G Compared with the scheme, the scheme of encrypting the IMSI in this embodiment is simple, can be directly applied to the GSM system, and does not need to make major changes to various hardware devices of the GSM system; after obtaining the TMSI, the command exchange between the VLR and the MS just uses TMIS, rather than using IMSI, prevents rogue individuals or parties from stealing a mobile client's IMSI or tracking a mobile client's location by listening to signaling exchanges over the wireless path.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (19)

1. A method for obtaining a client temporary identification code, characterized in that the method comprises: encrypt the IMSI using the encryption mechanism agreed with the HLR; sending the encrypted IMSI to the HLR through the VLR, so that the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism and sending the decrypted IMSI to the VLR; receiving the customer temporary identification code generated by the VLR according to the decrypted international mobile subscriber identification code. 2. The method according to claim 1, wherein the encryption mechanism agreed upon with the HLR is used to encrypt the International Mobile Subscriber Identity code, comprising: encrypting the IMSI using the public key of the HLR; Correspondingly, the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism, including: The HLR uses the private key to decrypt the received encrypted IMSI to obtain the decrypted IMSI. 3. The method according to claim 1, wherein the encryption mechanism agreed upon with the HLR is used to encrypt the International Mobile Subscriber Identity code, comprising: Using the public key of the HLR to encrypt the IMSI and random numbers, the random numbers are used to make the IMSIs different after each encryption; Correspondingly, the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism, including: The HLR uses the private key to decrypt the received encrypted IMSI and the random number to obtain the decrypted IMSI. 4. The method according to claim 1, wherein said adopting an encryption mechanism agreed upon with the HLR to encrypt the International Mobile Subscriber Identity code comprises: Negotiating a homomorphic encryption algorithm with the HLR; Receive a plurality of random numbers encrypted by the homomorphic encryption algorithm sent by the home location register through the visitor location register; the number of the random numbers is the same as the number of digits of the international mobile subscriber identification code; After receiving the encrypted multiple random numbers through the visitor location register, use the international mobile subscriber identification code to perform a homomorphic encryption operation on the encrypted multiple random numbers to obtain the encrypted international mobile subscriber Identifier; Correspondingly, the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism, including: The HLR performs a homomorphic decryption operation on the encrypted IMSI to obtain the decrypted IMSI. 5. The method according to claim 1, wherein said adopting an encryption mechanism agreed upon with the HLR to encrypt the International Mobile Subscriber Identity code comprises: sending a first random number to the home location register through the visitor location register, and receiving a second random number sent by the home location register through the visitor location register; performing an authentication operation and an XOR operation on the first random number and the second random number to obtain a third random number; performing an XOR operation on the third random number and the International Mobile Subscriber Identity Code to obtain an encrypted said International Mobile Subscriber Identity after Correspondingly, the HLR decrypts the encrypted IMSI according to the agreed encryption mechanism, including: The home location register calculates a third random number according to the received first random number and the second random number, and then combines the calculated third random number with the received encrypted international Exclusive OR operation is performed on the mobile subscriber identification code to obtain the decrypted international mobile subscriber identification code. 6. The method according to claim 5, characterized in that, sending the first random number to the HLR through the VLR, and receiving the random number sent by the HLR through the VLR After the second random number, before performing the authentication operation and XOR operation on the first random number and the second random number, it also includes: performing an authentication operation on the first random number and the second random number to obtain a first authentication operation result, and sending the first authentication operation result to the home location register through the VLR; Receive a second authentication operation result sent by the HLR through the VLR, and the second authentication operation result is an authentication operation performed by the HLR on the first random number and the second random number owned; When the first authentication operation result is the same as the second authentication operation result, confirm that the second random number is sent by the HLR. 7. The method according to any one of claims 1-6, wherein, before sending the decrypted IMSI to the VLR, further comprising: The HLR acquires the corresponding master key according to the decrypted IMSI; Generate authentication information according to the master key and a random number, and send the authentication information to the visitor location register, so that the visitor location register verifies the mobile station corresponding to the international mobile subscriber identity code according to the authentication information Whether it is legal, if legal, execute the step of sending the decrypted IMSI to the VLR. 8. A mobile station, characterized in that the mobile station comprises: an encryption module and a first sending module; The encryption module is used to encrypt the International Mobile Subscriber Identity code using the encryption mechanism agreed with the HLR; The first sending module is configured to send the IMSI code encrypted by the encryption module to the home location register through the visitor location register, so that the home location register according to the agreed encryption mechanism Decrypting the encrypted IMSI and sending the decrypted IMSI to the VLR. 9. The mobile station according to claim 8, wherein the encryption module is specifically configured to encrypt the International Mobile Subscriber Identity code by using the public key of the HLR. 10. The mobile station according to claim 8, wherein the encryption module is specifically configured to encrypt the International Mobile Subscriber Identity code and the random number by using the public key of the HLR, and the random number It is used to make the IMSI after each encryption different. 11. The mobile station according to claim 8, wherein the encryption module comprises: a first negotiation unit, a first receiving unit, and a first encryption unit; The first negotiating unit is configured to negotiate a homomorphic encryption algorithm with the home location register; The first receiving unit is configured to receive a plurality of random numbers encrypted by the homomorphic encryption algorithm sent by the home location register through the visitor location register, and the number of the random numbers is the same as that of the international mobile subscriber The number of digits of the identification code is the same; The first encryption unit is configured to perform a homomorphic encryption operation on the encrypted random numbers by using the International Mobile Subscriber Identity Code after the first receiving unit receives the encrypted random numbers , to obtain the encrypted International Mobile Subscriber Identity code. 12. The mobile station according to claim 8, wherein the encryption module comprises: a first sending unit, a second receiving unit and a second encrypting unit; The first sending unit is configured to send a first random number to the home location register through the visitor location register; The second receiving unit is configured to receive the second random number sent by the HLR through the VLR; The second encryption unit is configured to perform an authentication operation and an XOR operation on the first random number and the second random number to obtain a third random number, and then identify the third random number with an international mobile user The XOR operation is performed on the code to obtain the encrypted International Mobile Subscriber Identity code. 13. The mobile station according to claim 12, wherein the encryption module further comprises: a first authentication unit and a first confirmation unit; The first authentication unit is configured to perform an authentication operation on the first random number and the second random number to obtain a first authentication operation result, and send the first authentication operation result to the said home location register; The first authentication unit is further configured to receive a second authentication operation result sent by the home location register through the visitor location register, and the second authentication operation result is the first random number paired by the home location register obtained by performing an authentication operation with the second random number; The first confirmation unit is configured to confirm that the second random number is sent by the HLR when the first authentication operation result is the same as the second authentication operation result, and trigger the second encryption unit. 14. A home location register, characterized in that the home location register comprises: a decryption module and a second sending module; The decryption module is used to decrypt the received encrypted IMSI by adopting an encryption mechanism agreed with the mobile station to obtain the decrypted IMSI; The second sending module is used to send the decrypted international mobile subscriber identification code obtained by the decryption module to the visitor location register, so that the visitor location register generates a client according to the decrypted international mobile subscriber identity code. Temporary ID. 15. The home location register according to claim 14, wherein the decryption module is specifically configured to use a private key to decrypt the received encrypted IMSI to obtain the decrypted International Mobile Subscriber Identity. 16. The home location register according to claim 14, wherein the decryption module comprises: a second negotiation unit, a third encryption unit, a second sending unit, and a first decryption unit; The second negotiating unit is configured to negotiate a homomorphic encryption algorithm with the mobile station; The third encryption unit is configured to encrypt multiple random numbers using the homomorphic encryption algorithm negotiated by the second negotiation unit; The second sending unit is configured to send the plurality of random numbers encrypted by the third encryption unit to the mobile station through the visitor location register, so that the mobile station can use the plurality of random numbers to Encrypt the above-mentioned International Mobile Subscriber Identity; The first decryption unit is configured to use the homomorphic encryption algorithm negotiated by the second negotiation unit to perform a homomorphic decryption operation on the received encrypted IMSID to obtain the decrypted IMSID. User ID. 17. The home location register according to claim 14, wherein the decryption module comprises: a third receiving unit, a third sending unit and a second decrypting unit; a third receiving unit, configured to receive the first random number sent by the mobile station through the visitor location register; a third sending unit, configured to send a second random number to the mobile station through the visitor location register; The second decryption unit is configured to calculate a third random number according to the first random number and the second random number, and then combine the calculated third random number with the received encrypted international mobile Exclusive OR operation is performed on the subscriber identification code to obtain the decrypted international mobile subscriber identification code. 18. The home location register according to claim 17, wherein the decryption module further comprises: a second authentication unit and a second confirmation unit; The second authentication unit is configured to receive a first authentication operation result sent by the mobile station through the visitor location register, and the first authentication operation result is the mobile station's pair of the first random number and the The second is obtained by performing authentication operations along with the count; It is also used to perform an authentication operation on the first random number and the second random number to obtain a second authentication operation result, and send the second authentication operation result to the mobile station through the visitor location register; A second confirmation unit, configured to confirm that the first random number is sent by the mobile station when the first authentication operation result is the same as the second authentication operation result, and send an authentication success message to the mobile station news. 19. A communication system, characterized in that the system comprises: the mobile station according to any one of claims 8-13, a visitor location register and a home location register; The visitor location register is configured to send the encrypted international mobile subscriber identity code to the home location register after receiving the encrypted international mobile subscriber identity code sent by the mobile station; receiving the decrypted IMSI sent by the HLR, and generating a temporary client ID according to the decrypted IMSI. The home location register is used to decrypt the received encrypted IMSI according to the encryption mechanism agreed with the mobile station, and send the decrypted IMSI to the access location register described above.

Images