Huawei Technologies Co., Limited

Yingxin Huang

Wenlin Zhang

Lijia Zhang

Xiaohan Liu

Yixian Xu

Yajuan Wu

Fenqin Zhu

Zhengwei Wang

Meriau Laurence

Laurence Meriau

Methods for managing a local Terminal Equipment (TE) accessing a network are provided. In accordance with this disclosure, the MT will not send the key(s) information to the TE until having received a notice of successful authentication from the TE or having decided that the message forwarded by the TE is a response message of successful authentication, which makes the procedure more reasonable and saves the network resources the method further includes a management list containing the identities of local TEs on the basis of the modified procedure.

Method for managing local terminal equipment accessing a network

A method for updating a key includes: assigning, by a network, a stipulated specific value to an authentication management field AMF and generating a corresponding authentication tuple, and sending corresponding parameters in the authentication tuple to the terminal when an authentication request is initiated to the terminal, and generating a new authentication key for use in the next authentication; generating, by the terminal, a new authentication key corresponding to the network for use in the next authentication, when the corresponding parameters are received and it is determined that the authentication for the network is passed and the authentication management field in the corresponding parameters is with the predetermined value. According to the method for updating the key according to the invention, the key may be updated conveniently without adding to or modifying the existing signaling resources or the authentication parameters, so that network security may be improved.

Method and device for updating a key

Embodiments of the present invention provide an MTC device authentication method, an MTC gateway, and a related device, which are used to solve a problem that direct interaction between a large quantity of MTC devices and a network side brings a heavy load to a network when the MTC devices are authenticated in the prior art. The method includes: performing, by an MTC gateway, mutual authentication with a core network node; performing, by the MTC gateway, mutual authentication with an MTC device; reporting, by the MTC gateway, a result of the mutual authentication with the MTC device to the core network node; and providing, by the MTC gateway, a non access stratum link protection key K between the MTC device and the core network node according to a key Kor a key K

MTC device authentication method, MTC gateway, and related device

Embodiments of the present invention provide a security authentication method, apparatus, and system, where the method includes: verifying a feature identifier for identifying terminal equipment, where the terminal equipment is machine-to-machine equipment; and obtaining a key corresponding to the feature identifier, so as to perform secure communication with the terminal equipment according to the key. In the embodiments of the present invention, after terminal equipment, a mobility management entity, and a home subscriber system successfully perform authentication and key agreement, it is verified whether a feature identifier of the terminal is legal, and when the feature identifier of the terminal is a legal identifier, a key is obtained according to the feature identifier, so that the mobility management entity and the terminal equipment perform secure communication according to the key, thereby implementing secure communication between M2M equipment and a network side.

Security authentication method, apparatus, and system

Embodiments of the present invention disclose a method and an apparatus for authenticating a communication device, where the method includes: receiving an attach request including a group identifier and sent by an MTC device to be authenticated, where the group identifier is a group identifier of an MTC group where the MTC device to be authenticated is located; determining whether a first group authentication vector bound to the group identifier exists locally, where the first group authentication vector is an authentication vector used for authenticating MTC devices in the MTC group; and if existing, according to the first group authentication vector, authenticating the MTC device to be authenticated, and generating a system key of the MTC device to be authenticated. The technical solutions provided in the present invention can be applied to the technical field of authenticating the MTC device.

Method and apparatus for authenticating communication device

A method for processing a registration exception in a user registration procedure is provided to solve the problem that network devices are unable to determine subsequent handling procedures when a registration exception occurs in a registration, where it is impossible to distinguish the initial registration and the re-registration according to whether the registration request is a protected register. According to the solution disclosed by the embodiments of the present invention, after the I-CSCF forwards the registration request to the S-CSCF and determines that a registration exception occurs, the I-CSCF returns a registration failure message to the terminal initiating the registration request or reselects a new S-CSCF, according to instruction information, indicating whether the registration request is an initial registration or a re-registration, carried in the registration request or according to S-CSCF-associated information carried in a response from the HSS.

Method, system and device for processing registration exception in user registration procedure

The present invention provides a method for a roaming user to establish security association with the application server in the visited network. When receiving the service request from the roaming user, the application server in the visited network establishes security association with the roaming user by making use of the authentication results of the generic authentication architecture in the home network via the BSF in the local network, or the generic authentication architecture proxy in the local network, or the AAA server in the local network and the AAA server in the roaming user's home network, so as to achieve the object that the roaming user is able to use the services of the visited network after authentication of the generic authentication architecture in his home network.

Method for roaming user to establish security association with visited network application server

Methods for managing a local Terminal Equipment (TE) accessing a network are provided. One is to set in a Mobile Terminal (MT) a management list containing the identities of local TEs, and to decide according to the information of the management list whether to accept a request message from the TE, thereby implementing the management of local TE that accesses the network using resources of the MT, improving the function of the MT, and at the same time, enhancing the security of users' accounts. In accordance with this invention, a user is able to define an authority for the TE to access and learn the current state of the TE, which gives the user facilities for daily use. The other method is to modify the existing procedure such that the MT will not send the key(s) information to the TE until having received a notice of successful authentication from the TE or having decided that the message forwarded by the TE is a response message of successful authentication, which makes the procedure more reasonable and saves the network resources the method further includes a management list containing the identities of local TEs on the basis of the modified procedure.

The invention disclose a method for verifying the validity of a user, making full use of a TID as the bridge for establishing confidence between a NAF and a user equipment, and the BSF assigning a term of validity for the TID, thereby extending the function of the TID, enabling the NAF to verify the term of validity for using the TID, and accordingly, achieving a further verification of the validity to the user. By using the method of the invention, it is possible to avoid the situation in which one TID is permanently valid for one or more NAFs, enhance the system security, decrease the risks caused by the theft of users' TID and corresponding secret keys, and at the same time, implement TID management by the NAF. In addition, a combination of the method with billing system makes it easy to implement the function of charging a user.

Method for verifying the validity of a user

The present invention discloses a method for a network to choose an authentication mode, wherein the key lies in that, according to the received authentication information in the authentication vector request message from S-CSCF as well as according to type of the requesting subscriber, HSS returns authentication information of the Early-IMS-based authentication vector to S-CSCF, or returns authentication information of the Full-IMS-based authentication mode to S-CSCF, or directly returns failure information to S-CSCF. If it is under the former two situations, the subscriber will be authenticated by adopting the corresponding authentication mode, and then S-CSCF will return access-allowed or access-rejected information to the subscriber according to authentication result. If it is in the latter situation, S-CSCF will directly send access-rejected information to the subscriber. By applying the present invention, the network can choose a proper authentication mode to authenticate the subscriber according to the subscriber's requirements, so that processing ability of the network is enhanced and the network is compatible with original security protocols to the fullest extent.

Growing community of inventors

Shenzhen, China

Yingxin Huang