Message protection method, user equipment, and core network device
A message protection method, user equipment, and a core network device are disclosed. The method includes: sending a request message on which no security protection is performed to the core network device, where the request message includes a first random number; receiving an abnormal response message, where the abnormal response message includes a third random number and a signature; and determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message. According to the message protection method provided in the embodiments of the disclosure, security protection can be performed on a message transmitted before a security context is established between the user equipment and the core network device, so as to improve network communication security.
1. A message protection method, comprising:
sending a request message on which no security protection is performed to a core network device, wherein the request message comprises a first random number;
receiving an abnormal response message, wherein the abnormal response message comprises a third random number and a signature; and
determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message.
2. The method according to claim 1 , wherein the determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message comprises:
if the first random number is the same as the third random number, and signature verification succeeds, determining that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the signature, and the credential succeeds.
3. The method according to claim 1 , wherein the abnormal response message further comprises a second random number, and the determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message comprises:
if the first random number is the same as the third random number, and signature verification succeeds, determining that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second random number, the signature, and the credential succeeds.
4. The method according to claim 1 , wherein the method further comprises: determining a second hash value based on the request message; and
the determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message comprises:
if the first random number is the same as the third random number, and signature verification succeeds, determining that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second hash value, the signature, and the credential succeeds.
5. The method according to claim 1 , wherein the method further comprises: determining a second hash value based on the request message, wherein
the abnormal response message further comprises a first hash value, and the first hash value is determined by the core network device based on the request message; and
the determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message comprises:
if the first random number is the same as the third random number, the first hash value is the same as the second hash value, and signature verification succeeds, determining that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the first hash value, the signature, and the credential succeeds.
6. The method according to claim 1 , wherein the method further comprises: determining a second hash value based on the request message, wherein
the abnormal response message further comprises a second random number; and
the determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message comprises:
if the first random number is the same as the third random number, and signature verification succeeds, determining that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second random number, the second hash value, the signature, and the credential succeeds.
7. The method according to claim 1 , wherein the method further comprises: determining a second hash value based on the request message, wherein
the abnormal response message further comprises a second random number and a first hash value, and the first hash value is determined by the core network device based on the request message; and
the determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message comprises:
if the first random number is the same as the third random number, the first hash value is the same as the second hash value, and signature verification succeeds, determining that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second random number, the first hash value, the signature, and the credential succeeds.
8. The method according to claim 1 , wherein the request message comprises an attach request message or a tracking area update request message.
9. The method according to claim 1 , wherein the abnormal response message comprises an attach reject message, a tracking area update reject message, or an identity request message.
10. The method according to claim 1 , wherein the abnormal response message further comprises the credential, and the credential is used to verify the signature.
11. The method according to claim 1 , wherein the method further comprises:
if the abnormal response message is an invalid message, changing an accessed access network device, and resending the request message to the core network device by using a changed access network device.
12. User equipment, comprising:
a transceiver, configured to: send a request message on which no security protection is performed to a core network device, wherein the request message comprises a first random number; and receive an abnormal response message, wherein the abnormal response message comprises a third random number and a signature; and
a processor, configured to determine, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message.
13. The user equipment according to claim 12 , wherein the processor is specifically configured to:
if the first random number is the same as the third random number, and signature verification succeeds, determine that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the signature, and the credential succeeds.
14. The user equipment according to claim 12 , wherein the abnormal response message further comprises a second random number, and the processor is specifically configured to:
if the first random number is the same as the third random number, and signature verification succeeds, determine that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second random number, the signature, and the credential succeeds.
15. The user equipment according to claim 12 , wherein the processor is further configured to determine a second hash value based on the request message; and
the processor is specifically configured to:
if the first random number is the same as the third random number, and signature verification succeeds, determine that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second hash value, the signature, and the credential succeeds.
16. The user equipment according to claim 12 , wherein the processor is further configured to determine a second hash value based on the request message, wherein
the abnormal response message further comprises a first hash value, and the first hash value is determined by the core network device based on the request message; and
the processor is specifically configured to:
if the first random number is the same as the third random number, the first hash value is the same as the second hash value, and signature verification succeeds, determine that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the first hash value, the signature, and the credential succeeds.
17. The user equipment according to claim 12 , wherein the processor is further configured to determine a second hash value based on the request message, wherein
the abnormal response message further comprises a second random number; and
the processor is specifically configured to:
if the first random number is the same as the third random number, and signature verification succeeds, determine that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second random number, the second hash value, the signature, and the credential succeeds.
18. The user equipment according to claim 12 , wherein the processor is further configured to determine a second hash value based on the request message, wherein
the abnormal response message further comprises a second random number and a first hash value, and the first hash value is determined by the core network device based on the request message; and
the processor is specifically configured to:
if the first random number is the same as the third random number, the first hash value is the same as the second hash value, and signature verification succeeds, determine that the abnormal response message is a valid message, wherein that signature verification succeeds comprises: signature verification performed on the abnormal response message based on the third random number, the second random number, the first hash value, the signature, and the credential succeeds.
19. The user equipment according to claim 12 , wherein the request message comprises an attach request message or a tracking area update request message.
20. A computer program product stored in a non-transitory medium, comprising instructions which, when executed by a computer, cause the computer to:
send a request message on which no security protection is performed to a core network device, wherein the request message comprises a first random number;
receive an abnormal response message, wherein the abnormal response message comprises a third random number and a signature; and
determine, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message.