Processing method for terminal access to 3GPP network and apparatus
A processing method for terminal access to a 3GPP network is provided. A UE sends an access request message to a core network device on the 3GPP network, and the core network device sends an unauthorized access message to the UE after determining that the UE has no permission to access the 3GPP network. The unauthorized access message includes authentication information of the core network device. The UE performs authentication on the core network device according to the authentication information of the core network device, and executes a corresponding network access policy after authentication on the core network device by the UE succeeds, that is, after the UE determines that a source of the unauthorized access message is authorized.
1. A method, comprising:
sending, by a terminal, an access request message to a core network device in a 3rd Generation Partnership Project (3GPP) network, wherein the access request message requests access to the 3GPP network, and the access request message comprises identity information of the terminal;
receiving, by the terminal, an unauthorized access message from the core network device in response to sending the access request message, wherein the unauthorized access message indicates that the terminal is unauthorized to access the 3GPP network, and the unauthorized access message comprises authentication information of the core network device for the terminal to use to authenticate the core network device;
determining, by the terminal, whether the core network device is authorized for sending the unauthorized access message, by performing, by the terminal, authentication on the core network device using the authentication information comprised in the unauthorized access message; and
in response to determining that the authentication on the core network device is successful, discontinuing, by the terminal, to request to access the 3GPP network, and re-attempting to access the 3GPP network upon a predefined condition is satisfied.
2. The method according to claim 1 , wherein the authentication information comprises a first message digest for the terminal to perform authentication on a home subscriber server (HSS) comprised in the core network device; and
wherein performing, by the terminal, the authentication on the core network device using the authentication information comprises:
generating a second message digest according to a preset algorithm, the identity information of the terminal, and a failure message code carried in the unauthorized access message;
when the first message digest is the same as the second message digest, determining that authentication on the HSS has succeeded; and
when the first message digest is different from the second message digest, determining that authentication on the HSS has failed.
3. The method according to claim 1 , wherein the authentication information comprises an authentication vector set, the authentication vector set comprises a first parameter and a message authentication code (MAC), and the first parameter is used to generate an expected message authentication code (X-MAC); and
wherein performing, by the terminal, the authentication on the core network device using the authentication information comprises:
generating the X-MAC according to the first parameter;
when the X-MAC is the same as the MAC, determining that authentication on an HSS comprised in the core network device has succeeded; and
when the X-MAC is different from the MAC, determining that authentication on the HSS has failed.
4. The method according to claim 1 , wherein the authentication information comprises certificate information and signature information of an evolved packet data gateway (ePDG); and
wherein performing, by the terminal, the authentication on the core network device using the authentication information comprises:
when both the certificate information and the signature information of the ePDG are correct, determining that authentication on the ePDG has succeeded; and
when the certificate information or the signature information of the ePDG is incorrect, determining that authentication on the ePDG has failed.
5. The method according to claim 4 , wherein the authentication information further comprises an authentication vector set, the authentication vector set comprises a first parameter and a MAC, and the first parameter is used to generate an X-MAC; and
wherein performing, by the terminal, the authentication on the core network device using the authentication information further comprises:
generating the X-MAC according to the first parameter when authentication on the ePDG has succeeded;
when the X-MAC is the same as the MAC, determining that authentication on an HSS comprised in the core network device succeeds; and
when the X-MAC is different from the MAC, determining that authentication on the HSS has failed.
6. The method according to claim 1 , wherein discontinuing, by the terminal, to request to access the 3GPP network, and reattempting to access the 3GPP network upon the predefined condition is satisfied further comprises:
stopping, by the terminal, a current reattempt to access the 3GPP network, and subsequently reattempting to access the 3GPP network when a status of the terminal satisfies a first preset condition, wherein the status of the terminal satisfies the first preset condition when a subscriber identity module (SIM) card of the terminal is changed, when the terminal restarts, when a time duration starting from a failure of an attempt to access the 3GPP network by the terminal exceeds a first preset duration, or when the terminal reselects a non-3GPP network.
7. The method according to claim 1 , further comprising:
when the authentication on the core network device performed by the terminal has failed, reattempting, by the terminal, to access the 3GPP network; and
when a preset quantity of times of attempts to access the 3GPP network have failed, reattempting to access the 3GPP network after a second preset duration.
8. A method, comprising:
receiving, by a core network device in a 3rd Generation Partnership Project (3GPP) network, an access request message from a terminal requesting for accessing the 3GPP network, wherein the access request message comprises at least identity information of the terminal; and
sending, by the core network device in response to receiving the access request message, an unauthorized access message to the terminal upon determining, according to the identity information of the terminal, that the terminal has no permission to access the 3GPP network, wherein the unauthorized access message comprises authentication information of the core network device for the terminal to use to determine that the unauthorized access message is sent by an authorized device.
9. The method according to claim 8 , wherein
when the core network device comprises an evolved packet data gateway (ePDG), the authentication information comprises certificate information and signature information of the ePDG, or the authentication information comprises certificate information and signature information of the ePDG and an authentication vector set, wherein the authentication vector set comprises a first parameter and a message authentication code (MAC); and
when the core network device does not comprise any ePDG, the authentication information comprises a first message digest, wherein the first message digest is generated by a home subscriber server (HSS) according to a preset algorithm, a failure message code carried in the unauthorized access message, and the identity information of the terminal, or the authentication information comprises the authentication vector set.
10. A terminal, comprises:
a transmitter, configured to send an access request message to a core network device on a 3rd Generation Partnership Project (3GPP) network, wherein the access request message requests to access the 3GPP network, and the access request message comprises identity information of the terminal;
a receiver, configured to receive an unauthorized access message from the core network device in response to sending the access request message, wherein the unauthorized access message indicates that the terminal is unauthorized to access the 3GPP network, and the unauthorized access message comprises authentication information of the core network device for the terminal to use to authenticate the core network device; and
a processor, configured to:
determine whether the unauthorized access message is sent from an authorized entity by performing authentication on the core network device according to the authentication information comprised in the unauthorized access message; and
in response to determining that the authentication on the core network device is successful, discontinue to attempt to access the 3GPP network, and re-request to access the 3GPP network upon a predefined condition is satisfied.
11. The terminal according to claim 10 , wherein the authentication information comprises a first message digest for the terminal to perform authentication on a home subscriber server (HSS) comprised in the core network device; and
wherein, when performing the authentication on the core network device according to the authentication information, the processor is further configured to:
generate a second message digest according to a preset algorithm, the identity information of the terminal, and a failure message code carried in the unauthorized access message; and
when the first message digest is the same as the second message digest, determine that authentication on the HSS has succeeded, and when the first message digest is different from the second message digest, determine that authentication on the HSS has failed.
12. The terminal according to claim 10 , wherein the authentication information comprises an authentication vector set, the authentication vector set comprises a first parameter and a message authentication code (MAC), and the first parameter is used to generate an expected message authentication code (X-MAC); and
wherein, when performing the authentication on the core network device according to the authentication information, the processor is further configured to:
generate the X-MAC according to the first parameter; and
when the X-MAC is the same as the MAC, determine that authentication on an HSS comprised in the core network device has succeeded, and when the X-MAC is different from the MAC, determine that authentication on the HSS has failed.
13. The terminal according to claim 10 , wherein the authentication information comprises certificate information and signature information of an evolved packet data gateway (ePDG); and
wherein, when performing the authentication on the core network device according to the authentication information, the processor is further configured to:
when both the certificate information and the signature information of the ePDG are correct, determine that authentication on the ePDG has succeeded; and
when the certificate information or the signature information of the ePDG is incorrect, determine that authentication on the ePDG has failed.
14. The terminal according to claim 13 , wherein the authentication information further comprises an authentication vector set, the authentication vector set comprises a first parameter and a MAC, and the first parameter is used to generate an X-MAC; and
wherein, when performing the authentication on the core network device according to the authentication information, the processor is further configured to:
generate the X-MAC according to the first parameter when authentication on the ePDG has succeeded; and
when the X-MAC is the same as the MAC, determine that authentication on an HSS comprised in the core network device has succeeded, and when the X-MAC is different from the MAC, determine that authentication on the HSS has failed.
15. The terminal according to claim 10 , wherein, in response to determining that the authentication on the core network device is successful, the processor is further configured to:
stop a current reattempt to access the 3GPP network, and subsequently reattempt to access the 3GPP network when a status of the terminal satisfies a first preset condition, wherein the status of the terminal satisfies the first preset condition when: a subscriber identity module (SIM) card of the terminal is changed, the terminal restarts, a time duration starting from a failure of an attempt to access the 3GPP network by the terminal exceeds a first preset duration, or the terminal reselects a first non-3GPP network.
16. The terminal according to claim 15 , wherein the access request message further comprises access point name (APN) information, the APN information indicates a second non-3GPP network that is requested by the terminal for use, and the core network device comprises an ePDG; and
wherein, when stopping the current reattempt to access the 3GPP network, and reattempting to access the 3GPP network when the status of the terminal satisfies the first preset condition, the processor is further configured to:
when the ePDG belongs to a home public land mobile network (HPLMN), stop a current reattempt to access the 3GPP network, and subsequently reattempt to access the 3GPP network when a SIM card of the terminal is changed, when the terminal restarts, when a time duration starting from a failure of an attempt to access the 3GPP network by the terminal exceeds the first preset duration, or when the terminal attempts to access the 3GPP network again using the second non-3GPP network indicated by the APN information; and
when the ePDG belongs to a visited public land mobile network (VPLMN), and after the first non-3GPP network is reselected, reattempt to access the 3GPP network using the reselected first non-3GPP network.
17. The terminal according to claim 15 , wherein the core network device does not comprise any ePDG, and the first preset condition is satisfied when a time duration starting from the failure of the attempt to access the 3GPP network by the terminal exceeds the first preset duration.
18. The terminal according to claim 10 , wherein the processor is further configured to:
when the authentication on the core network device fails, reattempt to access the 3GPP network; and
when a preset quantity of times of reattempts to access the 3GPP network have failed, reattempt to access the 3GPP network after a second preset duration.
19. A core network device, comprising:
a receiver, configured to receive an access request message from a terminal requesting to access a 3rd Generation Partnership Project (3GPP) network, wherein the access request message comprises identity information of the terminal; and
a processor, configured to send, using a communications interface in response to receiving the access request message, an unauthorized access message to the terminal upon determining, according to the identity information of the terminal, that the terminal has no permission to access the 3GPP network, wherein the unauthorized access message comprises authentication information of the core network device for the terminal to use to verify that the unauthorized access message is sent by an authorized device.
20. The core network device according to claim 19 , wherein
when the core network device comprises an evolved packet data gateway (ePDG), the authentication information comprises certificate information and signature information of the ePDG, or the authentication information comprises certificate information and signature information of the ePDG and an authentication vector set, wherein the authentication vector set comprises a first parameter and a message authentication code (MAC); and
when the core network device does not comprise an ePDG, the authentication information comprises a first message digest, wherein the first message digest is generated by a home subscriber server (HSS) according to a preset algorithm, a failure message code carried in the unauthorized access message, and the identity information of the terminal, or the authentication information comprises the authentication vector set.