Patent Publication Number: US-11665598-B2

Title: Method for batch handover authentication and key agreement oriented to heterogeneous network

Description:
CROSS REFERENCE TO THE RELATED APPLICATIONS 
     This application is based upon and claims priority to Chinese Patent Application No. 202010733277.0, filed on Jul. 27, 2020, the entire contents of which are incorporated herein by reference. 
     TECHNICAL FIELD 
     The present invention belongs to the technical field of long term evolution-advanced (LTE-A) and wireless local area network (WLAN) integrated heterogeneous networks, and in particular, relates to a method for batch handover authentication and key agreement oriented to a heterogeneous network. 
     BACKGROUND 
     In the past several years, with the increasing use of mobile devices, users have increasing demands for real-time and stable wireless networks, not only requiring basic communication services, but also desiring to enjoy rich multimedia services such as online games and videos. With the advent of the 5G era, a new generation of wireless communication systems will be integrated with different wireless access technologies to support secure and seamless handover of user equipment, as well as applications and services with different quality of service (QoS) requirements. An integrated heterogeneous network includes nodes with different transmission power and coverage. High power nodes (HPNs) cover a wide area, and thus are typically deployed in cities, suburbs, and rural areas to provide full coverage. Low power nodes (LPNs), on the other hand, are typically deployed in railway stations and libraries to achieve small-area coverage, thereby improving system capacity and network throughput. The HPN and LPN integrated heterogeneous networks are capable of achieving greater network capacity and coverage. Therefore, as the most widely used technology and standard, a typical heterogeneous network architecture integrated with a 3 rd  generation partnership project (3GPP) LTE-A network (providing HPNs) and a WLAN (providing LPNs) can support high-quality data services for a lot of user equipment. In this case, users inevitably face the problem of handover between LTE-A and WLAN heterogeneous networks. In order to ensure the security of wireless communication, it is necessary to carry out secure identity authentication and key agreement. 
     The present invention provides an LTE-A and WLAN integrated heterogeneous network architecture, where the service gateway (S-GW) supports 3GPP access connection, and has the function of mobile access gateway (MAG) for IP mobility management. The access gateway (A-GW) supports non-3GPP access connection, and serves as an MAG in trusted non-3GPP access. The packet data network gateway (PDN GW) is responsible for allocating IP addresses to user equipment, while serving as a local mobility anchor (LMA) between 3GPP and non-3GPP access networks to manage the binding and revocation status of the user equipment. The discovery function module ANDSF supports the discovery and selection of 3GPP and non-3GPP access networks as a trusted third party in the seamless handover process of heterogeneous networks. The user equipment sends key information such as its identity and location to the discovery function module ANDSF via the S 14  interface to request target access network detection. The discovery function module ANDSF defined in 3GPP provides necessary auxiliary functions such as network discovery and selection for the inter-system handover of heterogeneous networks, that is, sending relevant available target access network information and inter-system mobility policies of the operator to the user equipment as a response to the access network information. The authentication, authorization, and accounting (AAA) server is responsible for authenticating the user equipment and authorizing legitimate equipment to access the network. The current access authentication protocol process has the following problems: 
     (1) It is not suitable for large-scale group access authentication. Due to the fact that in the heterogeneous network architecture, users are not clear about the mobile access gateway-related access policies of the target access network. In this case, if each user uses the discovery function module ANDSF to request to access gateway information alone, it will not only cause serious network congestion, but also consume substantial network resources, and the computation and communication overheads will increase exponentially as a result. 
     (2) The security level is low. In a heterogeneous network, the related signals are transmitted via an open air interface. In this process, the protocol fails to provide privacy protection and thus is vulnerable to various malicious attacks such as impersonation, man-in-the-middle attacks, replay attacks, and redirection attacks. Moreover, the session key agreed between the target access network and the user lacks forward/backward security. In this case, once the session key is leaked, confidential information will be leaked, making the entire communication process no longer secure. 
     SUMMARY 
     In view of the above-mentioned shortcomings in the prior art, the present invention provides a method for batch handover authentication and key agreement oriented to a heterogeneous network. The method is capable of effectively realizing secure and fast handover from the LTE-A network to the WLAN among a large number of users to realize batch handover authentication while greatly reducing the system overhead, thereby providing a strong security guarantee for users under wireless communication. 
     In order to achieve the above-mentioned objective, the present invention adopts the following technical solutions. 
     A method for batch handover authentication and key agreement oriented to a heterogeneous network includes the following steps: 
     S 1 , system establishment and participant registration: establishing a system, and allowing users authenticated by a plurality of participants to register on an LTE-A network to obtain their respective identity information; 
     S 2 , access authentication: taking an equipment with computing capacity superior to storage capacity as a leader, discovering a target access network WLAN by using a discovery function module ADNSF, sending, by the leader, complete group authentication information to an authentication, authorization, and accounting (AAA) server of the WLAN to authenticate identity information of each participant, determining whether the identity information is successfully authenticated, and if yes, returning an identity authentication response by the AAA server of the WLAN to complete the batch handover authentication and the key agreement, otherwise, entering step S 3 ; and 
     S 3 , if the authentication fails, terminating the execution to complete the batch handover authentication and the key agreement. 
     Further, step S 2  includes the following steps: 
     S201, taking the equipment with computing capacity superior to storage capacity as the leader; 
     S202, computing, by a user equipment UE i , a message authentication code MAC i/ANDSF  of the user equipment UE i  according to a personal temporary identity TID i  and a group temporary identity TID G1 , and sending the message authentication code MAC i/ANDSF , the personal temporary identity TID i  and the group temporary identity TID G1  to the leader; wherein 
     the message authentication code MAC i/ANDSF  is expressed as:
 
 MAC   i/ANDSF   =H ( SK   i/ANDSF   ,TID   i   ∥TID   G1 );
 
     wherein H represents a hash function, SK i-ANDSF  represents a shared key of the user equipment UE i  and the discovery function module ANDSF; 
     S203, aggregating the message authentication code MAC i  of the user equipment UE i  by the leader, obtaining an address of the nearby discovery function module ANDSF by using a domain name server DNS, and performing integrity protection by using a random number N LD  encrypted and generated by a symmetric key SK LD-ANDSF  and uniquely determined location information L LD , route identifier ID route  and message authentication code MAC G1/ANDSF , and sending the random number N LD  and the uniquely determined location information L LD , route identifier ID route  and message authentication code MAC G1/ANDSF  as an information request of the access network to the discovery function module ANDSF; 
     S204, according to the information request of the access network, verifying the identity information of the user equipment UE i  in batches by using the message authentication code MAC G1/ANDSF , and determining whether there is an illegitimate user equipment UE i , if yes, entering step S 3 , otherwise, returning the identity authentication response by the AAA server of the WLAN, and entering step S205; 
     S205, selecting a target access network AAA by using the discovery function module ANDSF based on a preset access network priority strategy, computing parameter information used by a server AAA WLAN  of the target access network AAA for authenticating the user equipment UE i , encrypting random numbers N ANDSF  and N LD  by using a symmetric key K ANDSF-AAA , computing a local identity, a temporary key and an access node identifier ID NAP  of the target access network of the user equipment UE i , respectively, computing a message authentication code MAC ANDSF/AAA  in combination with the parameter information of the user equipment UE i , and sending the message authentication code MAC ANDSF/AAA  to the server AAA WLAN  of the target access network AAA; 
     S206, computing a message authentication code XMAC ANDSF/AAA  by the server AAA WLAN  of the target access network AAA, and determining whether the message authentication code XMAC ANDSF/AAA  has passed a verification by the server AAA WLAN  of the target access network AAA together with the message authentication code MAC ANDSF/AAA  from the ANDSF, if yes, entering step S207, otherwise, terminating a protocol and entering step S 3 ; 
     S207, selecting a random number N AAA  by the server AAA WLAN  of the target access network AAA, computing a session key corresponding to the user equipment UE i  one-to-one, and obtaining a message authentication code MAC AAA/ANDSF  by performing encryption protection on the random number N AAA  using the symmetric key K ANDSF-AAA  according to the corresponding session key, and sending the message authentication code MAC AAA/ANDSF  to the discovery function module ANDSF; 
     S208, computing a message authentication code XMAC AAA/ANDSF  according the random number N AAA  and the symmetric key K ANDSF-AAA , comparing the message authentication code MAC AAA/ANDSF  with the message authentication code XMAC AAA/ANDSF , verifying message integrity and identity information of the server AAA WLAN  of the target access network AAA according to the comparison result, encrypting the random numbers N AAA  and N LD , the access node identifier ID NAP  of the target access network and a timestamp T ANDSF  by using a group temporary key GTK G1 , computing a message authentication code MAC ANDSF/G1  according to the group temporary key GTK G1 , the random numbers N AAA , N LD  and the timestamp T ANDSF , and sending an access network selection decision to the leader; 
     S209, decrypting the message and checking the random number N LD  by using the group temporary key GTK G1 , verifying the integrity of the message received in S208 and authenticating a message source according to the message authentication code MAC ANDSF/G1 , and determining whether the message source is successfully authenticated, if yes, broadcasting, by the leader, a message of the access network selection decision to other user equipment UE i , and entering step S2010, otherwise, terminating the protocol and entering step S3; wherein 
     the message authentication code MAC ANDSF/G1  is expressed as:
 
 MAC   ANDSF/G1   =H ( GTK   G1   ,LID   G1   ∥N   AAA   ∥N   LD   ∥ID   NAP   ∥T   ANDSF );
 
     wherein GTK G1  represents the group temporary key, ID NAP  represents the access node identifier of the target access network, N LD  represents a random number of the leader, N AAA  represents a random number selected by the server of the target access network AAA, LID G1  represents a local identity identifier of a user group/equipment UE, and T ANDSF  represents the timestamp at which the discovery function module ANDSF sends the message; 
     S2010, verifying the decrypted message by the user equipment UE i , computing a session key SK iAAA  shared with the server AAA WLAN  of the target access network AAA according to the verification result, computing the local personal identity LID i  and the local group identity LID G1  for the users to access the target access network, and a personal temporary key TK i  for generating a session between the user equipment UE i  and the server AAA WLAN  of the target access network AAA, computing a new temporary key TK G1  and a message authentication code MAC i/LD  according to a preset shared key, and sending a handover request message to the leader by using the new temporary key TK G1  and the message authentication code MAC i/LD ; 
     S2011, collecting and verifying, by the leader, the handover request information of the user equipment UE i , performing encryption protection on a newly generated random number N LD2  by using a symmetric key SK LD-S-GW , computing a corresponding message authentication code MAC LD/S-GW  in combination with the timestamp T LD , generating an identity authentication ticket TicP-GW for a service gateway S-GW by using the message authentication code MAC LD/S-GW , and sending the handover information to the service gateway S-GW via a base station eNodeB; 
     S2012, decrypting the information by the service gateway S-GW to obtain the random number N LD2 , computing a message authentication code XMAC LD/S-GW  according to the random number N LD2 , comparing the message authentication code XMAC LD/S-GW  with the received message authentication code MAC LD/S-GW , and determining whether the two values are equal, if yes, the authentication is successful, and entering step S2013, otherwise, repeating step S2012; 
     S2013, computing a message authentication code MAC S-GW/P-GW  according to the random number N LD2 , and forwarding the message authentication code MAC S-GW/P-GW  together with the identity authentication ticket Tic P-GW as a fast proxy binding update request to a packet gateway P-GW; wherein 
     the message authentication code MAC S-GW/P-GW  is expressed as:
 
 MAC   S-GW/P-GW   =H ( K   S-GW-P-GW   ,N   LD2 );
 
     wherein K S-GW-P-GW  represents the shared key of the service gateway S-GW and the packet gateway P-GW; 
     S2014, decrypting the identity authentication ticket Tic P-GW by the packet gateway P-GW, generating a message authentication code XMAC S-GW/P-GW  according to the random number N LD2 , comparing the message authentication code XMAC S-GW/P-GW  with the message authentication code MAC S-GW/P-GW  from the service gateway S-GW, and determining whether the two values are equal, if yes, determining that the service gateway S-GW is a legitimate node authorized by the user equipment UE i , computing the message authentication code MAC P-GW/S-GW  by the packet gateway P-GW according to the random number N LD2 , sending the message authentication code MAC P-GW/S-GW  as a fast proxy binding acknowledgment message to the service gateway S-GW, and entering step S2015, otherwise, terminating the protocol and entering step S 3 ; 
     S2015, buffering, by the packet gateway P-GW, data packets of the user equipment UE i  into a database of the packet gateway P-GW, and receiving returned data packets; 
     S2016, encrypting, by the packet gateway P-GW using the symmetric key K P-GW-A-GW , a generated random number N P-GW  and the local identity LID i  of all user equipment UE i , and computing a corresponding message authentication code MAC P-GW/A-GW ; wherein 
     the message authentication code MAC P-GW/A-GW  is expressed as:
 
 MAC   P-GW/A-GW   =H ( K   P-GW-A-GW   ,LID   (1−n)   ∥LID   G1   ∥N   P-GW );
 
     wherein H represents a hash function, K P-GW-A-GW  represents the shared key of the packet gateway P-GW and a gateway A-GW, LID (1−n)  represents local identities of n users contained in a G1 group for identity authentication when accessing the WLAN, LID G1  represents a group local identity, and N P-GW  represents a random number; 
     S2017, sending the cipher text and the message authentication code MAC P-GW/A-GW  obtained in step S2016 as a handover packet forwarding address request message to the gateway A-GW, obtaining a proxy care-of address CoA of the gateway A-GW, and allocating a temporary IP address to the user equipment UE i  by using the proxy care-of address CoA; 
     S2018, decrypting the forwarding address request message by using the gateway A-GW to generate a message authentication code XMAC P-GW/A-GW , and authenticating the packet gateway P-GW and checking message integrity by using the message authentication code XMAC P-GW/A-GW ; 
     S2019, determining whether the authentication is successful, wherein if yes, the gateway A-GW selects a random number N A-GW , uses the shared key K P-GW-A-GW  of the packet gateway P-GW and the gateway A-GW to encrypt the random number N A-GW  and the proxy care-of address CoA, computes a message authentication code MAC A-GW/P-GW , and sends the encrypted cipher text and the corresponding message authentication code MAC A-GW/P-GW  as a response to a handover packet forwarding address request HPAR message to the packet gateway P-GW, and entering step S2020, otherwise, terminating the protocol and entering step S 3 ; 
     the message authentication code MAC A-GW/P-GW  is expressed as:
 
 MAC   A-GW/P-GW   =H ( K   P-GW-A-GW ,Proxy- CoAA - GW∥N   A-GW );
 
     wherein Proxy-CoAA-GW represents the proxy care-of address of the gateway A-GW, H represents a hash function, K P-GW-A-GW  represents the shared key of the packet gateway P-GW and the gateway A-GW, and N A-GW  represents a random number; 
     S2020, decrypting the handover packet forwarding address request HPAR message by the packet gateway P-GW to obtain the proxy care-of address CoA and the random number N A-GW  of the gateway A-GW, computing the message authentication code XMAC A-GW/P-GW  by obtaining the proxy care-of address CoA, comparing the message authentication code XMAC A-GW/P-GW  with the MAC A-GW/P-GW , and determining whether an authenticated identity of the gateway A-GW is legitimate according to the comparison result, if yes, computing the message authentication code MAC P-GW/A-GW  according to the random number N A-GW , and sending the message authentication code MAC P-GW/A-GW  as a fast proxy binding update FPBU message to the gateway A-GW to establish a connection, and entering step S2021, otherwise, terminating the protocol and entering step S 3 ; 
     S2021, computing a message authentication code XMAC P-GW-A-GW  by using the random number N A-GW  to authenticate the packet gateway P-GW, computing the message authentication code MAC A-GW/P-GW  by using the random numbers N A-GW  and N P-GW , and sending the message authentication code MAC A-GW/P-GW  as a fast proxy binding acknowledgment message to the packet gateway P-GW to indicate that the connection is established successfully; 
     S2022, disconnecting the user equipment UE i  from a current base station, and connecting the user equipment UE i  to a WLAN access node IDNAP; 
     S2023, collecting and aggregating, by the leader, the message authentication code MAC i  into MAC G1 , and sending the MAC G1  to the server AAA WLAN  of the target access network AAA via the WLAN access gateway A-GW; 
     S2024, determining whether the server AAA WLAN  of the target access network AAA has successfully verified the received message, if yes, returning a response message MAC 2  and entering step S2025; otherwise, ignoring the message and entering step 2025; 
     S2025, forwarding the buffered data packets by the service gateway P-GW during a handover process of the user equipment UE; and 
     S2026, when all the buffered data packets are forwarded to the user equipment UE i , creating a proxy mobile IPv6 (PMIPv6) tunnel between the packet gateway P-GW and the access gateway A-GW to complete access to authentication. 
     Furthermore, step S205 includes the following steps: 
     S2051, selecting the target access network AAA by the discovery function module ANDSF based on the preset access network priority strategy; 
     S2052, computing a personal local identity and a group local identity for authenticating the user equipment UE i  for the server AAA WLAN  of the target access network AAA, computing a personal temporary key for generating a session key of the user equipment UE i  and the server AAA WLAN  of the target access network AAA according to the personal local identity, and computing a new temporary key by using a pre-shared key according to the group local identity; wherein 
     the personal local identity LID i  is expressed as:
 
 LID   i   =TID   i   ⊕H ( N   LD   ,SK   i-ANDSF );
 
     wherein TID i  represents the personal temporary identity, ⊕ represents an exclusive OR operation, and SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF; 
     the group local identity LID G1  is expressed as:
 
 LID   G1   =TID   G1   ⊕H ( N   LD   ,GTK   G1 );
 
     wherein TID G1  represents the group temporary identity, and GTK G1  represents the shared key of the G1 group; 
     the personal temporary key TK i  is expressed as:
 
 TK   i   =H ( SK   i-ANDSF   ∥N   LD   ∥LID   i )
 
 i= 1,2,3, . . . , n;  
 
     the new temporary key TK G1  is expressed as:
 
 TK   G1   =H ( GTK   G1   ∥N   LD   ∥LID   G1 );
 
     wherein H represents a hash function, SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF, N LD  represents a random number, LID i  represents the local personal identity, i represents an n th  user serial number, and GTK G1  represents the shared key of the G1 group; 
     S2053, encrypting the random numbers N ANDSF  and N LD  by using the symmetric key K ANDSF-AAA , and computing the local identity, the temporary key and the access node identifier ID NAP  of the target access network for the user equipment UE i ; 
     S2054, computing the message authentication code MAC ANDSF/AAA  according to the random numbers N ANDSF  and N LD , the group local identity, the new temporary key, and the access node identifier ID NAP  of the target access network, and sending the message authentication code MAC ANDSF/AAA  to the server AAA WLAN  of the target access network AAA; 
     the message authentication code MAC ANDSF/AAA  is expressed as:
 
 MAC   ANDSF/AAA   =H ( K   ANDSF-AAA   ,ID   ANDSF   ∥T   ANDSF   ∥N   ANDSF   ∥N   LD   ∥TK   (1−n)   ∥TK   G1   ∥LID   (1-n)   ∥LID   G1   ∥ID   NAP );
 
     wherein H represents a hash function, T ANDSF  represents a timestamp at which the discovery function module ANDSF sends a message, TK (1−n)  represents the personal temporary key, TK G1  represents the temporary key shared by the G1 group, LID G1  represents the local identity of the G1 group, ID NAP  represents an access identifier of the target network, ID ANDSF  represents an identity identifier of the ANDSF, and LID (1−n)  represents the local personal identity of the (1−n) th  user serial number. 
     Furthermore, in step S208, the message authentication code XMAC AAA/ANDSF  is expressed as:
 
XMAC AAA/ANDSF   =H ( K   ANDSF-AAA   ,ID   AAA   ∥T   AAA   ∥N   AAA   ∥N   ANDSF );
 
     wherein XMAC AAA/ANDSF  represents a message authentication code sent by the target access network AAA to the ANDSF, ID AAA  represents an identity identifier of the target access network AAA, T AAA  represents the timestamp at which the target access network AAA sends the message, and N ANDSF  represents a random number of the discovery function module ANDSF; 
     the message authentication code MAC ANDSF/G1  is expressed as:
 
 MAC   ANDSF/G1   =H ( GTK   G1   ,LID   G1   ∥N   AAA   ∥N   LD   ∥ID   NAP   ∥T   ANDSF );
 
     wherein MAC ANDSF/G1  represents a message authentication code sent by the discovery function module ANDSF to the G1 group, GTK G1  represents the group temporary key, ID NAP  represents the access node identifier of the target access network, LID G1  represents the local identity of the G1 group, and T ANDSF  represents the timestamp. 
     Furthermore, in step S2010, the message authentication code MAC i/LD  is expressed as:
 
 MAC   i/LD   =H ( TK   G1   ,LID   i   ∥LID   G1   ∥T   i );
 
     wherein TK G1  represents the new temporary key, and T i  represents the timestamp at which each UE sends the message; 
     the session key SK iAAA  is expressed as:
 
 SK   iAAA   =H ( TK   i   ∥N   AAA   ∥N   LD );
 
     wherein TK i  represents the personal temporary key, and both N LD  and N AAA  represent random numbers; 
     the local personal identity LID i  is expressed as:
 
 LID   i   =TID   i ⊕( N   LD   ,SK   i-ANDSF );
 
     wherein SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF, TID i  represents the personal temporary identity, N LD  represents a random number, and SK i-ANDSF  represents the pre-shared key of the user equipment UE i  and the discovery function module ANDSF; 
     the local group identity LID G1  is expressed as:
 
 LID   G1   TID   G1   ⊕H ( N   LD   ,GTK   G1 );
 
     wherein GTK G1  represents the shared key of the G1 group, N LD  represents a random number, and H represents a hash function; 
     the personal temporary key TK i  is expressed as:
 
 TK   i   =H ( SK   i-ANDSF   ∥N   LD   ∥LID   i );
 
     wherein H represents a hash function, SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF, N LD  represents a random number, and LID i  represents the local personal identity; 
     the new temporary key TK G1  is expressed as:
 
 TK   G1   =H ( GTK   G1   ∥N   LD   ∥LID   G1 );
 
     wherein GTK G1  represents the shared key of the G1 group, N LD  represents a random number, and LID G1  represents the local identity of the G1 group; 
     the message authentication code MAC i/LD  is expressed as:
 
 MAC   i/LD   =H ( TK   G1   ,LID   i   |∥LID   G1   ∥T   i );
 
     wherein TK G1  represents the temporary key for users in the whole G1 group to access the WLAN, LID i  represents the local identity of the user equipment UE i , LID G1  represents the local identity of the G1 group, and T i  represents the timestamp at which each UE sends the message. 
     Furthermore, in step S2011, the message authentication code MAC LD/S-GW  is expressed as:
 
 MAC   LD/S-GW   =H ( SK   LD-S-GW   ,T   LD   ∥N   LD2 );
 
     the identity authentication ticket TicP-GW is expressed as:
 
 Tic P - GW={LID   (1−n)   ∥LID   G1   ∥T   LD   ∥N   LD2   ∥ID   NAP   ∥H ( LID   (1−n)   ∥LID   G1   ∥T   LD   ∥N   LD2   ∥ID   NAP )} SK   LD-P-GW ;
 
     wherein ID NAP  represents the access node identifier of the target access network, SK LD-P-GW  represents the pre-shared key of the leader and the packet gateway P-GW, T LD  represents the timestamp, N LD2  represents the newly generated random number, LID (1−n)  represents the local personal identity of the (1−n) th  user serial number, LID G1  represents the local identity of the G1 group, and T LD  represents the timestamp. 
     Furthermore, in step S 2014 , the message authentication code MAC P-GW/S-GW  is expressed as:
 
 MAC   P-GW/S-GW   =H ( K   S-GW-P-GW   ,N   LD2 +1);
 
     the message authentication code XMAC S-GW/P-GW  is expressed as:
 
XMAC S-GW/P-GW   =H ( K   S-GW-P-GW   ,N   LD2 );
 
     wherein H represents a hash function, K S-GW-P-GW  represents the shared key of the service gateway S-GW and the packet gateway P-GW, and N LD2  represents the newly generated random number. 
     Furthermore, in step S2021, the message authentication code MAC P-GW-A-GW  is expressed as:
 
 MAC   P-GW/A-GW   =H ( K   P-GW-A-GW   ,N   A-GW );
 
     wherein H represents a hash function, K P-GW-A-GW  represents the shared key of the packet gateway P-GW and the gateway A-GW, and N A-GW  represents a random number. 
     Furthermore, in step S2023, the message authentication code MAC i  is expressed as:
 
 MAC   i   =H ( TK   i   ,N   AAA   ∥LID   G1   ∥LID   i );
 
     wherein H represents a hash function, MAC i  represents the message authentication code aggregated by the user equipment UE i , TK i  represents the temporary key, N AAA  represents a random number selected by the target access network AAA, LID G1  represents the local identity of the G1 group, and LID i  represents the local identity of the user equipment UE i . 
     The advantages of the present invention are as follows. 
     The present invention provides a method for batch handover authentication and key agreement oriented to a heterogeneous network. According to the method, users participating in the authentication register on the LTE-A network to obtain their respective identity information. When a large number of users request access to the WLAN, the target network WLAN is discovered by using the ANDSF, and the leader sends a complete group authentication message to the AAA server of the WLAN to request identity authentication. If the authentication succeeds, the AAA server of the WLAN returns an identity authentication response; and if the authentication fails, the continued execution of the protocol is terminated. The method effectively realizes batch authentication of users during handover from the LTE-A network to the WLAN, and thus has high authentication efficiency, small signaling overheads, and high security. In this way, the method is capable of effectively realizing secure and fast handover from the LTE-A network to the WLAN among a large number of users to realize batch handover authentication while greatly reducing the system overhead, thereby providing a strong security guarantee for users under wireless communication. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       FIGURE is a flowchart of the method of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
     The specific embodiments of the present invention will be described below to help those skilled in the art understand the present invention. It should be clear, however, that the present invention is not limited to the scope of the specific embodiments, for those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention defined and determined by the appended claims, these changes are obvious and all inventions and creations that utilize the concept of the present invention shall fall within the scope of the present invention. 
     Embodiment 
     As shown in FIGURE, the present invention provides a method for batch handover authentication and key agreement oriented to a heterogeneous network, including: 
     S1: system establishment and participant registration: a system is established, and users authenticated by a plurality of participants register on an LTE-A network to obtain their respective identity information. 
     In this embodiment, the user equipment, when roaming from the LTE-A network to the WLAN, firstly needs to register on the LTE-A network. Assuming that all user equipment has completed two-way identity authentication with the LTE-A network, and has obtained relevant parameters for subsequent communication. The relevant parameters include: (1) a temporary identity TID configured to communicate with a discovery function module ANDSF; (2) a group pre-shared group temporary key GTKG1; (3) a pre-shared key (i.e., SKLD-S-GW and SKLD-P-GW) agreed with a service gateway and a packet gateway in an LTE system, respectively; and (4) a session key SKi-BSF agreed by mutually authenticating a bootstrapping server function (BSF) and user equipment (UE i ) using a generic bootstrapping architecture (GBA) based on authentication and key agreement (AKA), wherein the discovery function module ANDSF and a pre-shared key SKi-discovery function module ANDSF of the UE are derived from the SKi-BSF key. 
     S 2 : access authentication: an equipment with computing capacity superior to storage capacity is taken as the leader, a target access network WLAN is discovered by using the discovery function module ADNSF, the leader sends complete group authentication information to an AAA server of the WLAN to authenticate identity information of each participant, and it is determined whether the identity information is successfully authenticated, if yes, the AAA server of the WLAN returns an identity authentication response to complete the batch handover authentication and the key agreement, otherwise, step S 3  is entered. 
     S 3 : if the authentication fails, the execution is terminated to complete the batch handover authentication and the key agreement. 
     In this embodiment, step S 2  includes the following steps: 
     S201: the equipment with computing capacity superior to storage capacity is taken as the leader; 
     S202: the user equipment UE i  computes a message authentication code MAC i/ANDSF  of the user equipment UE i  according to a personal temporary identity TID i  and a group temporary identity TID G1 , and sends the message authentication code MAC i/ANDSF , the personal temporary identity TID i  and the group temporary identity TID G1  to the leader; 
     the message authentication code MAC i/ANDSF  is expressed as:
 
 MAC   i/ANDSF   =H ( SK   i-ANDSF   ,TID   i   ∥TID   G1 );
 
     wherein H represents a hash function, SK i-ANDSF  represents a shared key of the user equipment UE i  and the discovery function module ANDSF; 
     S203: the leader aggregates the message authentication code MAC i  of the user equipment UE i , obtains an address of the nearby discovery function module ANDSF by using a domain name server DNS, performs integrity protection by using a random number N LD  encrypted and generated by a symmetric key SK LD-ANDSF  and uniquely determined location information L LD , route identifier ID route  and message authentication code MAC G1/ANDSF , and sends the random number N LD  and the uniquely determined location information L LD , route identifier ID route  and message authentication code MAC G1/ANDSF  as an information request of the access network to the discovery function module ANDSF; 
     S204: according to the information request of the access network, the identity information of the user equipment UE i  is verified in batches by using the message authentication code MAC G1/ANDSF , and it is determined whether there is an illegitimate user equipment UE i , if yes, step S 3  is entered, otherwise, the AAA server of the WLAN returns the identity authentication response, and step S205 is entered; 
     S205: the discovery function module ANDSF selects a target access network AAA by a preset access network priority strategy, computes parameter information used by a server AAA WLAN  of the target access network AAA for authenticating the user equipment UE i , encrypts the random numbers N ANDSF  and N LD  by using a symmetric key K ANDSF-AAA , computes the local identity, the temporary key and the access node identifier ID NAP  of the target access network of the user equipment UE i , respectively, computes a message authentication code MAC ANDSF/AAA  in combination with the parameter information of the user equipment UE i , and sends the message authentication code MAC ANDSF/AAA  to the server AAA WLAN  of the target access network AAA; step S205 specifically includes: 
     S2051: the discovery function module ANDSF selects the target access network AAA based on the preset access network priority strategy; 
     S2052: a personal local identity and a group local identity for authenticating the user equipment UE i  are computed for the server AAA WLAN  of the target access network AAA, a personal temporary key for generating a session key of the user equipment UE i  and the server AAA WLAN  of the target access network AAA is computed according to the personal local identity, and a new temporary key is computed by using a pre-shared key according to the group local identity; 
     the personal local identity LID i  is expressed as:
 
 LID   i   =TID   i   ⊕H ( N   LD   ,SK   i-ANDSF );
 
     wherein TID i  represents the personal temporary identity, ⊕ represents an exclusive OR operation, and SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF; 
     the group local identity LID G1  is expressed as:
 
 LID   G1   =TID   G1   ⊕H ( N   LD   ,GTK   G1 );
 
     wherein TID G1  represents the group temporary identity, and GTK G1  represents the shared key of a G1 group; 
     the personal temporary key TK i  is expressed as:
 
 TK   i=H ( SK   i-ANDSF   ∥N   LD   ∥LID   i )
 
 i= 1,2,3, . . . , n;  
 
     the new temporary key TK G1  is expressed as:
 
 TK   G1   =H ( GTK   G1   ∥N   LD   ∥LID   G1 );
 
     wherein H represents a hash function, SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF, N LD  represents a random number, LID i  represents the local personal identity, i represents an n th  user serial number, and GTK G1  represents the shared key of the G1 group; 
     S2053: the random numbers N ANDSF  and N LD  are encrypted by using the symmetric key K ANDSF-AAA , and the local identity, the temporary key and the access node identifier ID NAP  of the target access network are computed for the user equipment UE i ; 
     S2054: the message authentication code MAC ANDSF/AAA  is computed according to the random numbers N ANDSF  and N LD , the group local identity, the new temporary key, and the access node identifier ID NAP  of the target access network and is sent to the server AAA WLAN  of the target access network AAA; 
     the message authentication code MAC ANDSF/AAA  is expressed as:
 
 MAC   ANDSF/AAA   =H ( K   ANDSF-AAA   ,ID   ANDSF   ∥T   ANDSF   ∥N   ANDSF   ∥N   LD   ∥TK   (1−n)   ∥TK   G1   ∥LID   (1−n)   ∥LID   G1   ∥ID   NAP );
 
     wherein H represents a hash function, T ANDSF  represents a timestamp at which the discovery function module ANDSF sends a message, TK (1−n)  represents the personal temporary key, TK G1  represents the temporary key shared by the G1 group, LID G1  represents the local identity of the G1 group, ID NAP  represents an access identifier of the target network, ID ANDSF  represents an identity identifier of the ANDSF, and LID (1−n)  represents the local personal identity of the (1−n) th  user serial number; 
     S206: the server AAA WLAN  of the target access network AAA computes a message authentication code XMAC ANDSF/AAA , and determines whether the message authentication code XMAC ANDSF/AAA  has passed a verification together with the message authentication code MAC ANDSF/AAA  from the ANDSF, if yes, step S207 is entered, otherwise, the protocol is terminated and step S 3  is entered; 
     S207: the server AAA WLAN  of the target access network AAA selects a random number N AAA , computes a session key corresponding to the user equipment UE i  one-to-one, obtains a message authentication code MAC AAA/ANDSF  by performing encryption protection on the random number N AAA  using the symmetric key K ANDSF-AAA  according to the corresponding session key, and sends the message authentication code MAC AAA/ANDSF  to the discovery function module ANDSF; 
     S208: a message authentication code XMAC AAA/ANDSF  is computed according the random number N AAA  and the symmetric key K ANDSF-AAA , the message authentication code MAC AAA/ANDSF  is compared with the message authentication code XMAC AAA/ANDSF , message integrity and identity information of the server AAA WLAN  of the target access network AAA are verified according to the comparison result, the random numbers N AAA  and N LD , the access node identifier ID NAP  of the target access network and the timestamp T ANDSF  are encrypted by using the group temporary key GTK G1 , a message authentication code MAC ANDSF/G1  is computed according to the group temporary key GTK G1 , the random numbers N AAA  and N LD  and the timestamp T ANDSF , and an access network selection decision is sent to the leader; 
     the message authentication code XMAC AAA/ANDSF  is expressed as:
 
XMAC AAA/ANDSF   =H ( K   ANDSF-AAA   ,ID   AAA   ∥T   AAA   ∥∥N   AAA   ∥N   ANDSF );
 
     wherein XMAC AAA/ANDSF  represents a message authentication code sent by the target access network AAA to the ANDSF, ID AAA  represents an identity identifier of the target access network AAA, T AAA  represents the timestamp at which the target access network AAA sends the message, and N ANDSF  represents a random number of the discovery function module ANDSF; 
     the message authentication code MAC ANDSF/G1  is expressed as:
 
 MAC   ANDSF/G1   =H ( GTK   G1   ,LID   G1   ∥N   AAA   ∥N   LD   ∥ID   NAP   ∥T   ANDSF );
 
     wherein MAC ANDSF/G1  represents a message authentication code sent by the discovery function module ANDSF to the G1 group, GTK G1  represents the group temporary key, ID NAP  represents an access node identifier of the target access network, LID G1  represents the local identity of the G1 group, and T ANDSF  represents the timestamp; 
     S209: the message is decrypted and the random number N LD  is checked by using the group temporary key GTK G1 , according to the message authentication code MAC ANDSF/G1 , the integrity of the message received in S208 is verified and the message source is authenticated, and it is determined whether the message source is successfully authenticated, if yes, the leader broadcasts a message of the access network selection decision to other user equipment UE i , and step S2010 is entered, otherwise, the protocol is terminated and step S 3  is entered; 
     the message authentication code MAC ANDSF/G1  is expressed as:
 
 MAC   ANDSF/G1   =H ( GTK   G1   ,LID   G1   ∥N   AAA   ∥N   LD   ∥ID   NAP   ∥T   ANDSF );
 
     wherein GTK G1  represents the group temporary key, ID NAP  represents the access node identifier of the target access network, N LD  represents a random number of the leader, N AAA  represents a random number selected by the server of the target access network AAA, LID G1  represents a local identity identifier of a user group/equipment UE, T ANDSF  represents the timestamp at which the discovery function module ANDSF sends the message; 
     S2010: the user equipment UE verifies the decrypted message, computes a session key SK iAAA  shared with the server AAA WLAN  of the target access network AAA according to the verification result, computes the local personal identity LID i  and the local group identity LID G1  for the users to access the target access network, and a personal temporary key TK i  for generating a session between the user equipment UE i  and the server AAA WLAN  of the target access network AAA, computes a new temporary key TK G1  and a message authentication code MAC i/LD  according to a preset shared key, and sends a handover request message to the leader by using the new temporary key TK G1  and the message authentication code MAC i/LD ; 
     the message authentication code MAC i/D  is expressed as:
 
 MAC   i/LD   =H ( TK   G1   ,LID   i   ∥LID   G1   ∥T   i );
 
     wherein TK G1  represents the new temporary key, and T i  represents the timestamp at which each UE sends the message; 
     the session key SK iAAA  is expressed as:
 
 SK   iAAA   =H ( TK   i   ∥N   AAA   ∥N   LD );
 
     wherein TK i  represents the personal temporary key, and both N LD  and N AAA  represent random numbers; 
     the local personal identity LID i  is expressed as:
 
 LID   i   =TID   i ⊕( N   LD   ,SK   i-ANDSF );
 
     wherein SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF, TID i  represents the personal temporary identity, N LD  represents a random number, and SK i-ANDSF  represents the pre-shared key of the user equipment UE i  and the discovery function module ANDSF; 
     the local group identity LID G1  is expressed as:
 
 LID   G1   =TID   G1   ⊕H ( N   LD   ,GTK   G1 );
 
     wherein GTK G1  represents the shared key of the G1 group, N LD  represents a random number, and H represents a hash function; 
     the personal temporary key TK i  is expressed as:
 
 TK   i   =H ( SK   i-ANDSF   ∥N   LD   ∥LID   i );
 
     wherein H represents a hash function, SK i-ANDSF  represents the shared key of the user equipment UE i  and the discovery function module ANDSF, N LD  represents a random number, and LID i  represents the local personal identity; 
     the new temporary key TK G1  is expressed as:
 
 TK   G1   =H ( GTK   G1   ∥N   LD   ∥LID   G1 );
 
     wherein GTK G1  represents the shared key of the G1 group, N LD  represents a random number, and LID G1  represents the local identity of the G1 group; 
     the message authentication code MAC i/LD  is expressed as:
 
 MAC   i/LD   =H ( TK   G1   ,LIG   i   ∥LID   G1   ∥T   i );
 
     wherein TK G1  represents the temporary key for users in the whole G1 group to access the WLAN, LID i  represents the local identity of the user equipment UE i , LID G1  represents the local identity of the G1 group, and T i  represents the timestamp at which each UE sends the message; 
     S2011: the leader collects and verifies the handover request information of the user equipment UE i , performs encryption protection on the newly generated random number N LD2  by using the symmetric key SK LD-S-GW , computes a corresponding message authentication code MAC LD/S-GW  in combination with the timestamp T LD , and generates an identity authentication ticket TicP-GW for a service gateway S-GW by using the message authentication code MAC LD/S-GW , wherein the handover information is sent to the service gateway S-GW via a base station eNodeB; 
     the message authentication code MAC LD/S-GW  is expressed as:
 
 MAC   LD/S-GW   =H ( SK   LD-S-GW   ,T   LD   ∥N   LD2 );
 
     the identity authentication ticket TicP-GW is expressed as:
 
 Tic P - GW={LID   1−n)   ∥LID   G1   ∥T   LD   ∥N   LD2   ∥ID   NAP   ∥H ( LID   (1−n)   ∥T   LD   ∥N   LD2   ∥ID   NAP )} SK   LD-P-GW ;
 
     wherein ID NAP  represents the access node identifier of the target access network, SK LD-P-GW  represents a pre-shared key of the leader and the packet gateway P-GW, T LD  represents the timestamp, N LD2  represents the newly generated random number, LID (1−n)  represents the local personal identity of the (1−n) th  user serial number, LID G1  represents the local identity of the G1 group, and T LD  represents the timestamp; 
     S2012: the service gateway S-GW decrypts the information to obtain the random number N LD2 , computes a message authentication code XMAC LD/S-GW  according to the random number N LD2 , compares the message authentication code XMAC LD/S-GW  with the received message authentication code MAC LD/S-GW , and determines whether the two values are equal, if yes, the authentication is successful, and step S2013 is entered, otherwise, step S2012 is repeated; 
     S2013: a message authentication code MAC S-GW/P-GW  is computed according to the random number N LD2 , and is forwarded to the packet gateway P-GW together with the identity authentication ticket Tic P-GW as a fast proxy binding update request; 
     the message authentication code MAC S-GW/P-GW  is expressed as:
 
 MAC   S-GW/P-GW   =H ( K   S-GW-P-GW   ,N   LD2 );
 
     wherein K S-GW-P-GW  represents the shared key of the service gateway S-GW and the packet gateway P-GW; 
     S2014: the packet gateway P-GW decrypts the identity authentication ticket Tic P-GW, generates a message authentication code XMAC S-GW/P-GW  according to the random number N LD2 , compares the message authentication code XMAC S-GW/P-GW  with the message authentication code MAC S-GW/P-GW  from the service gateway S-GW, and determines whether the two values are equal, if yes, it is determined that the service gateway S-GW is a legitimate node authorized by the user equipment UE i , the packet gateway P-GW computes the message authentication code MAC P-GW/S-GW  according to the random number N LD2 , and sends the message authentication code MAC P-GW/S-GW  as a fast proxy binding acknowledgment message to the service gateway S-GW, and step S2015 is entered, otherwise, the protocol is terminated and step S 3  is entered; 
     the message authentication code MAC P-GW/S-GW  is expressed as:
 
 MAC   P-GW/S-GW   =H ( K   S-GW-P-GW   ,N   LD2 +1)
 
     the message authentication code XMAC S-GW/P-GW  is expressed as:
 
XMAC S-GW/P-GW   =H ( K   S-GW-P-GW   ,N   LD2 );
 
     Wherein H represents a hash function, K S-GW-P-GW  represents the shared key of the service gateway S-GW and the packet gateway P-GW, and N LD2  represents the newly generated random number; 
     S2015: the packet gateway P-GW buffers data packets of the user equipment UE i  into a database of the packet gateway P-GW, and receives returned data packets; 
     S2016: the packet gateway P-GW uses the symmetric key K P-GW-A-GW  to encrypt the generated random number N P-GW  and the local identity LID i  of all user equipment UE i , and computes a corresponding message authentication code MAC P-GW/A-GW ; 
     the message authentication code MAC P-GW/A-GW  is expressed as:
 
 MRC   P-GW/A-GW   =H ( K   P-GW-A-GW   ,LID   (1−n)   ∥LID   G1   ∥N   P-GW );
 
     wherein H represents a hash function, K P-GW-A-GW  represents the shared key of the packet gateway P-GW and a gateway A-GW, LID (1−n)  represents local identities of n users contained in the G1 group for identity authentication when accessing the WLAN, LID G1  represents the group local identity, and N P-GW  represents a random number; 
     S2017: the cipher text and the message authentication code MAC P-GW/A-GW  obtained in step S2016 are sent as a handover packet forwarding address request message to the gateway A-GW, a proxy care-of address CoA of the gateway A-GW is obtained, and a temporary IP address is allocated to the user equipment UE i  by using the proxy care-of address CoA; 
     S2018: the forwarding address request message is decrypted by using the gateway A-GW to generate a message authentication code XMAC P-GW/A-GW , and the packet gateway P-GW is authenticated and message integrity is checked by using the message authentication code XMAC P-GW/A-GW ; 
     S2019: it is determined whether the authentication is successful, if yes, the gateway A-GW selects a random number N A-GW , uses the shared key K P-GW-A-GW  of the packet gateway P-GW and the gateway A-GW to encrypt the random number N A-GW  and the proxy care-of the address CoA, computes a message authentication code MAC A-GW/P-GW , and sends the encrypted cipher text and the corresponding message authentication code MAC A-GW/P-GW  as a response to a handover packet forwarding address request HPAR message to the packet gateway P-GW, and step S2020 is entered, otherwise, the protocol is terminated and step S 3  is entered; 
     the message authentication code MAC A-GW/P-GW  is expressed as:
 
 MAC   A-GW/P-GW   =H ( K   P-GW-A-GW ,Proxy- CoAA - GW∥N   A-GW );
 
     wherein Proxy-CoAA-GW represents the proxy care-of address of the gateway A-GW, H represents a hash function, K P-GW-A-GW  represents the shared key of the packet gateway P-GW and the gateway A-GW, and N A-GW  represents a random number; 
     S2020: the packet gateway P-GW decrypts the handover packet forwarding address request HPAR message to obtain the proxy care-of address CoA and the random number N A-GW  of the gateway A-GW, computes the message authentication code XMAC A-GW/P-GW  by obtaining the proxy care-of address CoA, compares the message authentication code XMAC A-GW/P-GW  with the MAC A-GW/P-GW , and determines whether the authenticated identity of the gateway A-GW is legitimate according to the comparison result, if yes, the message authentication code MAC P-GW/A-GW  is computed according to the random number N A-GW , and is sent as a fast proxy binding update FPBU message to the gateway A-GW to establish a connection, and step S2021 is entered, otherwise, the protocol is terminated and step S 3  is entered; 
     S2021: a message authentication code XMAC P-GW-A-GW  is computed by using the random number N A-GW  to authenticate the packet gateway P-GW, and the message authentication code MAC A-GW/P-GW  is computed by using the random numbers N A-GW  and N P-GW  and is sent as a fast proxy binding acknowledgment message to the packet gateway P-GW to indicate that the connection is established successfully; 
     the message authentication code MAC P-GW-A-GW  is expressed as:
 
 MAC   P-GW/A-GW   =H ( K   P-GW-A-GW   ,N   A-GW );
 
     wherein H represents a hash function, K P-GW-A-GW  represents the shared key of the packet gateway P-GW and the gateway A-GW, and N A-GW  represents a random number; 
     S2022: the user equipment UE i  is disconnected from a current base station, and is connected to a WLAN access node IDNAP; 
     S2023: the leader collects and aggregates the message authentication code MAC i  into MAC G1 , and sends the MAC G1  to the server AAA WLAN  of the target access network AAA via the WLAN access gateway A-GW; 
     the message authentication code MAC i  is expressed as:
 
 MAC   i   =H ( TK   i   ,N   AAA   ∥LID   G1   ∥LID   i );
 
     wherein H represents a hash function, MAC i  represents the message authentication code aggregated by the user equipment UE i , TK i  represents the temporary key, N AAA  represents a random number selected by the target access network AAA, LID G1  represents the local identity of the G1 group, LID i  represents the local identity of the user equipment UE i ; 
     S2024: it is determined whether the server AAA WLAN  of the target access network AAA has successfully verified the received message, if yes, a response message MAC 2  is returned and step S2025 is entered; otherwise, this message is ignored and step 2025 is entered; 
     S2025: the buffered data packets are forwarded by the service gateway P-GW during the handover process of the user equipment UE i ; and 
     S2026: when all the buffered data packets are forwarded to the user equipment UE i , a PMIPv6 tunnel is created between the packet gateway P-GW and the access gateway A-GW to complete access to authentication. 
     By means of the above design, the present invention can effectively realize batch authentication of users during handover from the LTE-A network to the WLAN, and thus has high authentication efficiency, small signaling overheads, and high security.