WO2007033550A1 - Method for controlling terminal to access 3g network - Google Patents

Abstract

A method for controlling terminal to access 3G network, when terminal wants to access 3G network, the 3G network control the terminal to access 3G network or not according to the supporting ability for the terminal to R99 version protocol and the authentication set in the corresponding authentication information. On one hand, the present invention can realize that the 3G network can refuse the access of terminal which uses SIM card with extend R99 version, thereby complying the description of 3GPP 33.102, and complying the requirement of security described in 3GPP 33.102 document when UE accessing 3G network. On the other hand, the present invention will not send out AUTN message when the user terminal is using USIM card with lower version of R99, thereby making the terminal can access 3G network easily, and realizing the compatibility for terminal with lower version of R99 to USIM card, improving the successful rate of call, and the compatibility of 3G network.

Description

 Control method for terminal accessing third generation network

 The present invention relates to a third generation (3G) network technology, and more particularly to a control method for a terminal to access a 3G network. Background of the invention

 Figure 1 shows the basic networking diagram of 3G. The network side includes NODE B (access node), RC (radio network controller), MSC (mobile switching center), VLR (visiting location server), HLR (home location). Server), AuC (authentication center), where MSC and VLR can be combined into one device, which is recorded as MSC/VLR, HLR and AuC can be combined into one device, which is recorded as HLR/AuC;

 When the user equipment (UE, User Equipment) needs to access the 3G network, for example, when the UE enters the 3G network or the UE performs location update, the UE initiates a location update request to access the 3G network, and the location update request passes NODE B and RC. The MSC sends the location update request to the VLR, and the VLR accesses the HLR/AuC to obtain the subscription information and the authentication parameter information of the UE. The VLR authenticates the UE according to the obtained subscription information and the authentication parameter. After the authentication is passed, a response message is sent to the UE to prompt the location update success, allowing the UE to access the 3G network.

 Currently, for security requirements, the SIM card user has the following restrictions in the 3GPP 33.102 document: R99+ ME with a SIM inserted, shall participate only in GSM AKA.

Specifically, this paragraph indicates that the terminal using the R99 version of the SIM card can only use GSMAKA (AKA: is a mutual authentication protocol, which enables communication) Both parties authenticate each other's identity and generate the same key on both sides of the communication. The protocol accesses the GSM network, that is, the terminal above the R99 version of the SIM card is not allowed to access the 3G network.

 At present, there is no way to control how to control the access to the 3G network due to the use of the R99 version of the SIM card. This results in the successful access of the terminal above the R99 version of the SIM card when accessing the 3G network, and thus does not meet the security requirements for the UE to access the 3G network as described in the 3GPP 33.102 document.

 For example, in the 3GPP protocol 33.102, when the UMTS card (USIM, Subscriber Identity Module) is used for the 2G terminal, the following restrictions are imposed: A GSM security context in UTRAN is only established for a GSM subscribers with a R99+ ME.

 Specifically, this protocol indicates that an AUTN message can only be processed when a terminal of the R99 version and above uses a USIM card (the AUTN message is an authentication message). Therefore, when the USIM card is used by the terminal below the R99 version, the AUTN authentication message may not be processed correctly, and the user cannot access the network or the call fails.

 At present, the prior art does not provide a specific implementation method for accessing a 3G network by using a terminal below the R99 version of the USIM card. This results in the use of the USIM card R99 version when the terminal accesses the 3G network. As described above, the AUTN authentication message cannot be processed correctly and the 3G network cannot be accessed or the call fails. Summary of the invention

 In view of this, the main object of the present invention is to provide a control method for a terminal to access a 3G network, so as to enable the 3G network to control whether to allow access of the terminal.

 The present invention provides a control method for a terminal to access a 3G network, and the method includes the following steps:

Al, the terminal initiates an access request, and the access request carries the terminal to the R99 version protocol. Information on support capabilities;

 Bl. The network receives the access request, and obtains, from the network side device that records the terminal authentication information, the authentication information of the terminal that includes the authentication set;

 The network determines whether the terminal supports the R99 version protocol to support the R99 version or later, and determines whether the authentication set in the obtained authentication information is a 3-tuple or a 5-tuple; Control whether the terminal is allowed to access the 3G network.

 The control in step C1 includes:

 The terminal is determined to support the R99 version protocol to support the R99 version or higher, and when the authentication set is a 3-tuple group, the terminal is denied access to the 3G network.

 The control in step C1 includes:

 It is determined that the terminal supports the R99 version protocol to support the R99 version or less, and when the authentication set is a 5-tuple group, the AUTN authentication message is not sent to the terminal to allow the terminal to access the 3G network.

 The step B1 includes the following steps:

 Bll, the MSC receives the access request, and records the support capability information of the terminal that is carried in the access request to the R99 version protocol; the MSC requests the authentication information from the network side device that records the terminal authentication information;

 B12. The network side device that records the terminal authentication information sends the authentication information of the terminal, including the authentication set, to the MSC.

 The network also includes a visit location server VLR;

 The communication between the MSC and the network side device that records the terminal authentication information

The VLR is transited.

The network side device that records the terminal authentication information is one of the following: a home location server HLR, an authentication center AuC, or a combination of a home location server and an authentication center, HLR/AuC. The step CI determines the support capability of the terminal for the R99 version protocol, and determines that the execution device of the authentication set in the obtained authentication information is one of the following:

 MSC, VLR, HLR or AuC.

 The information about the support capability of the carrying terminal to the R99 version protocol in step A1 is carried by the level information Classmark field in the access request.

 The determining terminal's support capability for the R99 version protocol is determined according to the level information Classmark field value.

 The determining terminal supports the R99 version protocol to support the R99 version or higher: according to the level information, the 7th and 6th bits of the Classmark field are respectively determined to be 1, 0.

 The determining terminal supports the R99 version protocol to support the R99 version as follows: According to the level information, the 7th and 6th bits of the Classmark field are 0, 0 or 0, respectively.

 In addition, after step C1, the method further includes:

 The network side returns a response message to the user to allow the user to access the 3G network or refuse to access the 3G network.

 It can be seen from the foregoing method that the present invention can implement the access of the terminal above the R99 version of the 3G network that refuses to use the SIM card, and conforms to the description of the 3GPP 33.102 document, thereby complying with the security of the UE accessing the 3G network described in the 3GPP 33.102 document. Claim. In addition, the implementation of the present invention rejects the illegal user during the user access phase, and avoids such illegal access. After the service phase is used, the user is found to be illegal and refused, thereby saving network resources.

On the other hand, when the network determines that the user terminal is the terminal of the R99 version of the USIM card, the network does not send the AUTN message, so that the terminal can smoothly access the 3G network, and the terminal is used for the R99 version or lower. The compatibility of the USIM card improves the call success rate and improves the compatibility of the 3G network. BRIEF DESCRIPTION OF THE DRAWINGS

 Figure 1 is a basic networking diagram of a 3G grid;

 2 is a flowchart of a first embodiment of controlling a UE to access a 3G network;

 3 is a flow chart of a second embodiment of controlling a UE to access a 3G network. Mode for carrying out the invention

 The present invention will be further described in detail below with reference to the drawings and embodiments.

 The core idea of the present invention is: obtaining the support capability of requesting access to the 3G network terminal for the R99 version protocol, and the type of SIM card used; determining whether to allow according to the support capability of the terminal for the R99 version protocol and the type of SIM card used. The terminal accesses the 3G network.

 Two embodiments are respectively introduced in the present invention. The first embodiment is mainly directed to a control method for accessing a 3G network by using a terminal of the R99 version or higher of the SIM card; the second embodiment is mainly for using the R99 version of the USIM card. The terminal accesses the control method of the 3G network.

 Embodiment 1

 In this example, when the UE requests to access the 3G network, the MSC first obtains whether the support capability of the UE is greater than or equal to the R99 version from the request message of the UE, and the MSC obtains the authentication parameter of the UE from the HLR/AuC request, according to the authentication. The authentication set included in the parameter determines whether the UE uses the SIM card type; and then determines whether to reject the UE to access the network according to the version information of the UE and whether it is the SIM card type.

 Referring to the flowchart of the UE accessing the 3G network shown in FIG. 2, the present invention is described in detail, including the following steps:

 Step 201: When the UE is powered on or enters the 3G network, the UE initiates a location update request to access the 3G network.

The location update request carries the support capability of the terminal, as shown in Table 1 below. The content of the level information (Classmark) field in the request message, when the 7th and 6th bits of the field correspond to the value of 1, 0 (see italics in Table 1), indicating that the UE is the R99 version. The above terminal.

 Step 202: The step includes the step 202a and the step 202b. Specifically, the request message of the UE is transmitted to the MSC through the NODE B and the RNC, and the MSC determines the capability of the terminal according to the support capability of the terminal carried in the location update request message, and performs recording. In addition, the MSC also sends a Location Update Request message to the VLR, which also contains the identity of the UE, such as an IMSI (International Mobile Subscriber Identity).

Step 203: After receiving the location update request, the VLR initiates authentication for accessing the UE. The authentication parameter is first requested from the HLR/AuC, and the request includes the identity of the UE. Step 204: The HLR/AuC returns an authentication parameter of the UE to the VLR according to the information it records, including an encryption key (KC), a random number, a triplet or a five-tuple authentication set, and the like.

 It should be noted that the information about the UE opening account is stored in the HLR. When the SIM card user is used when the UE is opened, the authentication set returned by the HLR to the VLR is a triplet.

 Step 205: The step includes step 205a and step 205b. Specifically, the VLR authenticates the UE according to the received authentication parameter of the UE. This process is the same as the authentication process of the background technology, and the VLR authenticates the UE. After the authentication is passed, the authentication parameters are sent to

MSC.

 Step 206: After obtaining the authentication parameter, the MSC determines whether the authentication set is a 3-tuple or a 5-tuple. When it is determined to be a 3-tuple, it indicates that the UE uses the SIM card; meanwhile, the MSC determines that it is in step 202. Whether the recorded UE is a terminal above the R99 version. When the recorded UE terminal is a terminal of the R99 version or higher, and the authentication set in the authentication parameter is a 3-tuple number, the MSC rejects the access of the UE, and sends the UE to the UE. Returns a response message for the location update rejection to prompt the user and end the current processing flow.

 If the MSC determines that the authentication set in the authentication parameter is a 5-tuple, or the UE is not a terminal above the R99 version, then according to the existing UE accessing the network, the MSC continues to perform the normal steps, and the information sent by the VLR is passed. RNC and NODE B are sent to the UE.

 Step 207: After receiving the authentication request, the terminal returns an authentication response message, and carries the authentication response number (SERS) information.

 Step 208: The authentication response message is uplinked to the VLR, and the VLR compares whether the SERS obtained from the HLR/AuC and the SERS returned in the terminal authentication response message are the same. When the authentication is successful, the VLR returns to the MSC to receive the location update request. The message, if the authentication fails, the VLR returns a reject location update request message to the MSC.

Step 209: After receiving the response message of the VLR, the MSC returns the content of the response message. Give the terminal.

 As can be seen from the above, when the UE accesses the 3G network, it can be determined whether the UE is using the terminal of the R99 version or more of the SIM card, thereby determining whether to allow access of the UE. In addition, the foregoing embodiment implements the determining process by the MSC, but it is not difficult to understand that the determining process may occur on any device on the network side, such as RC, VLR>HLR/AuC, or in a new device. on.

 Embodiment 2

 In this example, when the UE requests to access the network, the MSC first obtains, from the request message of the UE, whether the support capability of the UE is below the R99 version, and the MSC requests the authentication parameter from the HLR/AuC, according to the authentication parameter. The authentication set determines whether the SIM card type used by the user is a USIM, thereby determining whether to send the AUTN authentication information to the UE.

 Referring to the flowchart of the UE accessing the 3G network shown in FIG. 3, the present invention is described in detail, including the following steps:

 Step 301: When the UE enters the 3G network, the UE initiates a location update request message requesting access to the network.

 The location update request message carries the support capability of the terminal, as shown in Table 1 above, which is part of the content included in the Classmark field in the request message, when the 7th and 6th bits of the field correspond to the 00 or 01 value. The time indicates that the UE is a terminal below the R99 version.

 Step 302: The step includes the step 302a and the step 302b. Specifically, the request message of the UE is transmitted to the MSC through the NODE B and the RC. The MSC determines the terminal capability according to the support capability of the terminal carried in the request message, so as to know whether the UE is R99. The terminal below the version is recorded; in addition, the MSC also sends a location update request to the VLR, including the identity of the UE, such as an MSI (International Mobile Subscriber Identity).

Step 303: After receiving the location update request, the VLR starts authentication and requests an authentication parameter from the HLR/AuC, where the request includes an identifier of the UE, such as an IMSI. Step 304: The HLR/AuC returns the recorded authentication parameters of the UE to the VLR, including an encryption key (KC), a random number, a triplet or a five-tuple authentication set, and the like.

 It should be noted that, since the user account information is stored in the HLR, when the user is a USIM card user, the authentication set returned by the HLR is a five-tuple.

 Step 305: The step includes step 305a and step 305b. Specifically, the VLR initiates an authentication process for the terminal. This process is the same as the existing authentication process. The VLR authenticates the UE. After the authentication is passed, The authentication parameter is sent to the MSC through the authentication request information.

 Step 306: After obtaining the authentication parameter, the MSC determines whether the authentication set is a 5-tuple or a 3-tuple. When it is determined to be a 5-tuple, it indicates that the SIM card type used by the user is USIM. Meanwhile, the MSC determines that it is in the step. Whether the UE recorded in 302 is a terminal below the R99 version. When the recorded UE terminal is a terminal of the R99 version or less, and the authentication set in the authentication parameter is a 5-tuple group, the MSC does not send an AUTN message to the terminal, directly The current UE sends a response message that the location update is accepted, so as to prevent the terminal from being correctly processed and unable to access the network.

 If the MSC determines that the authentication set in the authentication parameter is a 3-tuple number, or the UE is a terminal of the R99 version or the R99 version, the MSC continues to perform the normal steps according to the existing UE access network procedure, and the VLR The sent authentication request information is sent to the UE through RC and NODE B.

 Step 307: After receiving the authentication request, the terminal returns an authentication response message to the MSC, and carries the SERS.

 Step 308: The authentication response message is uplinked to the VLR, and the VLR compares whether the SERS obtained from the HLR/AuC and the SERS returned in the terminal authentication response message are the same. When the authentication is successful, the VLR returns an accept request message to the MSC. If the authentication fails, the VLR returns a reject request message to the MSC.

Step 309: After receiving the response message of the VLR, the MSC returns to the terminal according to the content of the response message. It can be seen from this example that when the user accesses the 3G network, it can be determined whether the user is using the terminal below the R99 version of the USIM card, thereby determining whether to send an AUTN message to the UE. In addition, the foregoing embodiment implements the determining process at the MSC, but it is not difficult to understand that the determining process may occur on any device on the network side, or on a newly added device.

 According to the actual networking, the MSC and the VLR may be one device, and the MSC may also directly communicate with the HLR/AuC without going through the VLR. '

 The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are included in the spirit and scope of the present invention, should be included in the present invention. Within the scope of protection.

Claims

Rights request  A control method for a terminal to access a third-generation 3G network, characterized in that the method comprises the following steps:  Al, the terminal initiates an access request, where the access request carries the support capability information of the terminal for the R99 version protocol;  Bl, the network receives the access request, and obtains, from the network side device that records the terminal authentication information, the authentication information of the terminal that includes the authentication set;  The network determines whether the terminal supports the R99 version protocol to support the R99 version or later, and determines whether the authentication set in the obtained authentication information is a 3-tuple or a 5-tuple; The result controls whether the terminal is allowed to access the 3G network.  2. The method according to claim 1, wherein the controlling in step C1 comprises:  The terminal is determined to support the R99 version protocol to support the R99 version or higher, and when the authentication set is a 3-tuple group, the terminal is denied access to the 3G network.  3. The method according to claim 1, wherein the controlling in step C1 comprises:  It is determined that the terminal supports the R99 version protocol to support the R99 version or less, and when the authentication set is a 5-tuple group, the AUTN authentication message is not sent to the terminal to allow the terminal to access the 3G network.  4. The method according to claim 1, wherein the step B1 comprises the following steps: Bll, the MSC receives the access request, and records the support capability information of the terminal to the R99 version protocol carried in the access request; the MSC requests the authentication information from the network side device that records the terminal authentication information; B12. The network side device that records the terminal authentication information sends the authentication information of the terminal, including the authentication set, to the MSG.  The method according to claim 4, wherein the network further comprises a visit location server VLR;  The communication between the MSC and the network side device that records the terminal authentication information is relayed through the VLR.  The method according to any one of claims 1 to 5, wherein the network side device that records the terminal authentication information is one of the following:  The home location server HLR, the authentication center AuC or the combination of the home location server and the authentication center HLR/AuC.  The method of claim 1, wherein the step C1 determines the terminal's support capability for the R99 version protocol, and determines that the execution device of the authentication set in the obtained authentication information is one of the following:  MSC, VLR, HLR or AuC.  The method of claim 1, 2, 3, 4, 5 or 7, wherein the supporting capability information of the carrying terminal to the R99 version protocol in step A1 is the level information in the access request. Carryed by the Classmark field;  The determining terminal's support capability for the R99 version protocol is determined according to the level information Classmark field value.  The method according to claim 8, wherein the determining terminal supports the R99 version protocol to support the R99 version or higher: according to the level information, the 7th and 6th bits of the Classmark field are respectively 1 , 0 is determined. 10. The method according to claim 8, wherein the determining terminal supports the R99 version protocol to support the R99 version. The following are: According to the level information, the 7th and 6th bits of the Classmark field are respectively 0, 0 or 0, 1 is determined. The method according to claim 1, wherein after step C1, the method further comprises:  The network side returns a response message to the user to allow the user to access the 3G network or refuse to access the 3G network.