CN108282775A - Dynamic Additional Verification method towards mobile ad hoc network and system - Google Patents

Abstract

The present invention provides a dynamic additional authentication method and system oriented to a mobile dedicated network. The steps of the method include: UE judges whether access authentication needs to be started, and if necessary, initiates an access authentication request to SAS; or, S/P- The GW receives the service request sent by the UE and triggers to judge whether it is necessary to start the access authentication between the SAS and the UE. If necessary, it initiates an access authentication request to the SAS; after the SAS receives the access authentication request, it determines whether to start the access authentication , if activated, send user ID and IMSI information provided by S/P‑GW to HSS; HSS generates initial key after receiving it; SAS generates key according to initial key to protect the control plane between itself and UE Interaction information; UE generates an initial key, generates a key according to the initial key, and protects the control plane interaction information between itself and SAS; after receiving the authentication command from SAS, UE authenticates the legitimacy of the dedicated core network and notifies SAS; The SAS authenticates the legitimacy of the UE and notifies the UE.

Description

Dynamic additional authentication method and system for mobile private network

technical field

The invention relates to the technical field of network communication security, in particular to a mutual authentication method and system between users and equipment and a special network in a mobile communication network.

Background technique

Due to its mobility and convenience, mobile communication network services have been widely used in people's daily life. With the large-scale deployment of 4G mobile communication networks, more and more people are beginning to use 4G network services. While enjoying the convenience brought by the mobile communication network, pseudo base stations and pseudo networks also bring new security issues to mobile applications. At the same time, the mobile communication network is also faced with more and more intelligent handheld terminal devices, which are becoming more and more diverse, and are subject to illegal access and attacks from a large number of IoT terminals.

In the process of mobile private network users using network services, due to user mobility and network coverage limitations of private network operators, in some cases, such as roaming scenarios, users may need to roam through public mobile networks to access private Mobile core network. Roaming public mobile access network is not completely reliable for private network users and private core network. In the case of roaming, the user needs to be authenticated when accessing the private core network. The default authentication process is performed by the roaming core network MME to determine the authentication result, so there may be a risk of man-in-the-middle attacks on the private core network. In addition, when the private network user is in the non-roaming state, at this time, the user directly accesses the private core network through the trusted private access network, then the above-mentioned problem of the non-fully trusted MME acting as a middleman is gone. How to address different scenarios Taking flexible and efficient security protection measures is a problem worth considering.

In order to prevent illegal users from accessing 3G and 4G networks, the AKA authentication mechanism is designed, using the shared security credential information and AKA algorithm of the HSS on the network side and the terminal to enable the network to authenticate the legitimacy of the user, and the user terminal device can also authenticate the network. legality. At present, 3GPP designs mobile network security authentication mechanism assuming that all functions of access network and core network are safe and reliable. Existing 3G and 4G mobile networks assume that the roaming network and the home network are mutually trustworthy in terms of security, that is, the home network always trusts the roaming network, so the security of the above-mentioned roaming core network MME becoming a middleman is not considered. risk. The current 4G network authentication method for roaming users is based on the assumption that the roaming network is completely trustworthy, and there is no solution to the problem of the roaming core network becoming a man-in-the-middle. Existing roaming user authentication measures cannot solve new problems faced by new usage scenarios of mobile private networks.

Contents of the invention

The purpose of the present invention is to propose a dynamic additional authentication method and system for mobile private networks, that is, a mutual authentication method for private mobile communication networks and private network users, which can realize private networks in untrusted 3GPP access network environments or roaming environments. Safe and reliable mutual authentication between users and the private network, so as to prevent private network users and equipment from accessing pseudo-private networks, and also prevent illegal users and equipment from accessing private networks.

In order to achieve the above object, the technical scheme adopted in the present invention is as follows:

A dynamic additional authentication method oriented to a mobile private network, the steps of which include:

The user terminal UE that has conducted two-way authentication with the mobile management node MME and the server HSS located in the private core network judges whether it is necessary to start dynamic additional access authentication. If necessary, the UE initiates a Access authentication request; or, the gateway S/P-GW of the dedicated core network receives the service request sent by the UE and triggers to judge whether it is necessary to start the dynamic additional access authentication between the SAS and the UE. If necessary, the S/P-GW The P-GW initiates an access authentication request to the SAS;

After receiving the access authentication request, the SAS determines whether to start the access authentication, and if it is started, the SAS sends the user ID and the user identity IMSI information provided by the S/P-GW to the HSS;

After receiving the user ID and IMSI information, the HSS generates the initial key required for the security protection of the control plane;

The SAS generates the key required for the security protection of the control plane according to the initial key, and protects the control plane interaction information between it and the UE;

The UE generates the initial key required for the security protection of the control plane, generates the key required for the security protection of the control plane according to the initial key, and protects the control plane interaction information between it and the SAS;

After receiving the authentication command from SAS, UE authenticates the legitimacy of the private core network and notifies SAS;

The SAS authenticates the legitimacy of the UE, and notifies the UE of the authentication result.

Further, according to the current location of the UE, whether it is roaming, the security reliability of the access network, the type of the access network, the ID of the access network, whether the service accessed by the UE is a private network-related service, and the pre-configured security policy, it is judged whether the Enable dynamic additional access authentication.

Further, the security policy is used to determine whether access authentication needs to be started between the UE and the dedicated core network, and the policy defines conditions for starting additional authentication. For example: if the UE accesses the private core network through an untrusted 3GPP or through a public LTE network (PLMN ID=A) in a roaming state, it needs to start access authentication; If the network (PLMN ID=B) accesses the dedicated core network, then access authentication does not need to be activated.

Further, the access authentication request includes UE current location, hardware ID, access network type, access network ID and PLMN ID, and IP address information.

Further, the UE and the HSS generate an initial key according to security credential information shared by the UE and the HSS (including CK, IK and shared factor factor).

Further, the generation algorithm of the initial key is as shown in Figure 2 (the USIM is set on the UE in the figure), specifically: the CK, IK and sharing factor Factor of the security credential information shared by the UE and the HSS, and the service network identifier SN ID and serial number SQN XOR AK are input, and the initial key Ks_init is generated through the standard key calculation function KDF operation.

Further, the UE and the SAS also generate a key according to the security credential information shared by the UE and the SAS (including the shared factor Factor and the shared timestamp Timestamp) and the security credential information shared by the UE and the HSS; the sharing includes static pre-configuration or Information Passed Through Shared Third-Party Devices.

Further, the key includes a confidentiality protection key and an integrity protection key;

The generation algorithm of the confidentiality protection key is shown in Figure 3 (the USIM is set on the UE in the figure), specifically: the security credential information shared by the initial key Ks_init, UE and HSS, and the security credential shared by UE and SAS Information, Alg-ID, the newly defined confidentiality protection algorithm type identifier SA-init-enc-alg, and the newly defined algorithm identifier 256-EEA4 AESbased algorithm (AES-CTR) are used as input and generated by the key calculation function KDF operation Confidentiality protection key Kinit_enc;

The generation algorithm of the integrity protection key is shown in Figure 3, specifically: the initial key Ks_init, the security credential information shared by the UE and the HSS, the security credential information shared by the UE and the SAS, the Alg-ID, the newly defined The integrity protection algorithm type identifier SA-init-int-alg and the newly defined algorithm identification 256-EIA4 AES based algorithm (AES-CMAC) are used as input, and the integrity protection key Kinit_int is generated by the key calculation function KDF operation;

The key calculus architecture is as follows:

Algorithm type distinguishers

Extended definition:

SA-init-enc-alg=0x09,

SA-init-int-alg = 0x10;

Alg-ID;

Extended definition:

"0100"=256-EEA4 AES based algorithm (AES-CTR),

"0110"＝256-EIA4 AES based algorithm(AES-CMAC);

Confidentiality protected key:

Kinit_enc

=KDF(Factor,TIME,SA-init-enc-alg,256-EEA4 AES based algorithm(AES-CTR),Ks_init);

Integrity protected key:

Kinit_int

= KDF(Factor, TIME, SA-init-int-alg, 256-EIA4 AES based algorithm (AES-CMAC), Ks_init).

Further, the authentication command includes the random number RAND generated by the HSS and the information of the authentication token AUTN.

Further, the UE authenticates the legitimacy of the dedicated core network according to the initial key generated by the UE, the security credential information shared by the UE and the SAS, and the AKA algorithm.

Further, the SAS authenticates the legitimacy of the UE according to the initial key generated by the HSS, the security credential information shared by the UE and the SAS, and the AKA algorithm.

A dynamic additional authentication system for mobile private networks, including:

UE is used to send access authentication requests or service requests, generate initial keys and keys required for control plane security protection, protect the control plane interaction information between it and SAS, and authenticate the legitimacy of the dedicated core network;

SAS, located in the dedicated core network, is used to determine whether to start dynamic additional access authentication, generate the key required for the security protection of the control plane, protect the control plane interaction information between it and the UE, and authenticate the legitimacy of the UE;

HSS, located in the dedicated core network, is used to generate the initial key required for the security protection of the control plane;

The S/P-GW is located in the dedicated core network and is used to provide the user identity IMSI information to the SAS.

Further, if the UE sends an access authentication request, it is judged whether dynamic additional access authentication needs to be started before sending; if the UE sends a service request, the service request triggers the S/P-GW to judge whether Dynamic additional access authentication between SAS and UE needs to be activated.

The invention proposes a safe and reliable mutual authentication method between a dedicated mobile communication network user and a dedicated mobile communication network. In order to avoid the credibility problem caused by the public core network control plane function MME in the roaming situation, SAS is introduced in the private core network. The method protects the interface message between the UE and the SAS by using the security credential information shared by the UE and the dedicated core network and the key generated according to the key generation algorithm. The SAS decides whether to perform dynamic additional access authentication on the UE based on information such as the current location of the UE, the security reliability of the access network, and the roaming status of the user. If authentication is required, the SAS and the HSS interact to obtain authentication data generated according to the security credential information shared by the UE and the HSS, and use the authentication data to perform access authentication with the UE. According to the authentication result, it is determined whether the UE can access the private network.

In addition, the present invention enables the UE to generate a key by using the security credential information shared with the HSS and the SAS and the initial key generation algorithm by enhancing the terminal function, so as to protect the interface between the UE and the SAS. In addition, the HSS function of the core network needs to be enhanced. The HSS needs to use the security credential information shared with the UE and the initial key generation algorithm to generate an initial key and pass the key to the SAS. UE or S/P-GW decides whether to trigger SAS to start additional independent authentication according to access network ID, access network credibility, roaming status and pre-configured security policies.

Figure 1 shows the calculation system of the control plane security protection key based on the existing LTE key calculation system. The key calculation part related to USIM/AUC, UE/HSS, UE/MME and UE/ENB in the figure is the current existing mechanism. In order to solve the security protection problem of the control plane between the UE and the newly added security access server SAS, the existing LTE key calculation system is extended, and the UE/SAS related key calculation mechanism is introduced. UE and HSS respectively use IK, CK and newly introduced parameters, such as the sharing factor Factor, to generate the initial key Ks_init through KDF function calculation. HSS passes the generated initial key to SAS. Then, the UE and the SAS each use the initial key Ks_init, and other newly defined parameters, including the sharing factor Factor, the timestamp Timestamp, etc., and use the KDF function to generate the confidentiality protection key Kinit_enc and the integrity protection key Kinit_int for protection The signaling interaction between the UE and the security access server SAS is secure.

Description of drawings

Figure 1 is a diagram of the key calculation system required for the security protection of the control plane.

Fig. 2 is a schematic diagram of the initial key calculation required for the security protection of the control plane.

Fig. 3 is a schematic diagram of the key calculation required for the security protection of the control plane.

Fig. 4 is a structural diagram of a dynamic additional authentication system oriented to a mobile private network in Embodiment 1.

Fig. 5 is a flow chart of a dynamic additional authentication method oriented to a mobile private network in Embodiment 1.

Fig. 6 is a structural diagram of a dynamic additional authentication system oriented to a mobile private network in Embodiment 2.

Fig. 7 is a flowchart of a dynamic additional authentication method oriented to a mobile private network in Embodiment 2.

Detailed ways

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

Based on the same technical idea of the present invention, and considering different impacts on existing terminals and networks, the present invention proposes two embodiments.

Embodiment one

In this embodiment, in order to enhance the existing UE functions, the system architecture is shown in FIG. 4 . UE judges whether to trigger SAS to start dynamic additional access authentication based on roaming status, access network type, and access network credibility, and reports UE-related information and access network-related information to SAS if necessary. In addition, when SAS is introduced into the dedicated core network, the SAS determines whether to enable the UE based on the current location of the UE, the security credibility of the access network, the type of the access network, the ID of the access network, the PLMN ID of the access network, and the pre-configured security policy. UE performs access authentication. If the SAS determines that authentication is necessary, the UE uses the security credential information shared with the HSS on the network side and the initial key generation algorithm to generate the initial key required for the security protection of the control plane between the UE and the SAS, and initiates the communication between the UE and the SAS. Keep messages safe. At the same time, the SAS and the HSS interact to obtain the authentication data generated by the HSS based on the shared security credential information and the key required for the security protection of the control plane. The HSS needs to use the security credential information shared with the UE and the initial key generation algorithm to generate the initial key required for the security protection of the control plane and transmit the initial key and authentication data to the SAS. The SAS generates a key according to the initial key, and protects the interface messages from the SAS to the UE according to the key and the pre-configured security policy. At the same time, the SAS uses the authentication data provided by the HSS to perform access authentication with the UE based on the AKA algorithm through the security-protected interface, and determines whether the UE can access the private network according to the authentication result. The UE can determine whether to access the network according to the authentication result.

The method of this embodiment is shown in Figure 5, and the main steps are as follows:

(1) The UE sends an attach request message to the MME of the core network function, and the MME and the HSS interact to obtain user authentication data, and use the authentication data to interact with the UE to complete the two-way authentication between the user and the network.

(2) The UE judges whether to trigger dynamic additional access based on its current location, access network security reliability, access network type, access network ID, roaming status, and the service to be accessed (whether it is a private network-related service) certified.

(3) If access authentication needs to be triggered, the UE sends an access authentication request message to the SAS, which includes: UE current location, hardware ID, access network type, access network ID and PLMN ID, user IP address and other information.

(4) The SAS determines whether to start access authentication according to the UE's current location, roaming status, whether the access network is trusted, whether the current location is safe, etc., and according to the pre-configured security policy.

For example, security policies: when a UE accesses a dedicated core network through a dedicated LTE access network (PLMN ID=B) in a non-roaming state, access authentication does not need to be activated; in a roaming state, access to a public LTE network (PLMN ID=B) A) When accessing, access authentication needs to be activated.

(5) The SAS sends a message to the S/P-GW to request the user identity IMSI information.

(6) The S/P-GW finds the corresponding IMSI information, and informs the SAS of the IMSI information through a response message.

(7) If access authentication needs to be started, the SAS sends a message to the HSS to request user authentication data, which includes user ID and IMSI information.

(8) The HSS generates the authentication vector according to the security credential information shared with the UE, and generates the initial key required for the security protection of the control plane according to the initial key generation algorithm.

(9) The HSS notifies the generated authentication vector and initial key to the SAS through a response message.

(10) The SAS replies to the UE with a response message, which includes the access check result, that is, whether access authentication needs to be started.

(11) If the access authentication needs to be started, the UE uses the security credential information shared with the HSS to use the initial key generation algorithm to generate the initial key required for the security protection of the control plane.

(12) According to the initial key generated by the UE, the security credential information shared with the HSS and the security credential information shared with the SAS as input, the key generation algorithm is used to generate the key required for the security protection of the control plane, and the pre-configured algorithm is used for protection. AKA authentication information exchanged between the SAS and the control plane of the UE.

(13) The SAS takes the initial key, the security credential information shared with the UE, and the security credential information of the UE and the HSS as input, and generates the key required for control plane protection according to the key generation algorithm. Pre-configured security policies are used to protect the AKA authentication information of the control plane interaction between the SAS and the UE.

(14) The SAS sends an additional authentication command message to the UE, and the message includes the random number RAND generated by the HSS and the authentication token AUTN information.

(15) The UE authenticates the legitimacy of the dedicated core network based on the security credential information shared with the HSS and the AKA algorithm.

(16) After passing the authentication of the dedicated core network, the UE sends an authentication request message, which includes the authentication response result RES generated by using the security credential information and the AKA algorithm.

(17) After receiving the UE's authentication response data, the SAS authenticates the legitimacy of the UE.

(18) The SAS replies to the UE with an additional authentication response message, which contains the authentication result.

Embodiment two

In this embodiment, a secure access server SAS of a new network function is introduced, which is located in a dedicated core network to avoid influence on the MME of an existing network function. The system architecture is shown in FIG. 6 . After the dedicated core network gateway S/P-GW receives the user's access service request, according to the access network ID, access network type, PLMN ID, access network credibility, roaming status (whether roaming), pre-configured security policy And the service type/name accessed by the user determines whether to trigger dynamic additional access authentication. If triggering is required, the S/P-GW reports information such as the UE's current location, access network type, access network reliability, and roaming status through the newly defined interface with the SAS. The SAS determines whether to start access authentication for the UE according to the current location of the UE, the security reliability of the access network, the type of the access network, the ID of the access network, the PLMN ID of the access network, and the pre-configured security policy. If necessary, an authentication procedure between the UE and the private core network is initiated.

The method flow of this embodiment is shown in Figure 7, and the main steps are as follows:

(1) The UE sends an attach request message to the core network function MME. The MME and the HSS interact to obtain user authentication data, and use the authentication data to interact with the UE to complete the two-way authentication between the user and the network.

(2) The UE initiates a service request to the application server AF, such as an HTTP request message, which is first received by the S/P-GW.

(3) The S/P-GW decides whether to trigger dynamic traffic based on the access network ID, access network type, PLMN ID, access network credibility, roaming status, pre-configured security policy, and service type/name accessed by the user. Additional access authentication.

(4) If access authentication needs to be triggered, S/P-GW sends an access authentication request message to SAS through the newly defined interface, which contains the following relevant information: UE current location, access network type, access network PLMN name , access network reliability, roaming status, user identity IMSI information, etc.

(5) The SAS determines whether to start access authentication according to the pre-configured security policy according to the current location of the UE reported by the S/P-GW, the roaming status, whether the access network is trusted, and whether the current location of the UE is safe.

(6) If access authentication needs to be started, the SAS sends a message to the HSS to request user authentication data, which includes user ID and IMSI information.

(7) The HSS generates the authentication vector according to the security credential information shared with the UE, and generates the initial key required for the security protection of the control plane according to the initial key generation algorithm.

(8) The HSS notifies the generated authentication vector and initial key to the SAS through a response message.

(9) The SAS replies the UE with a response message, which includes the access check result, that is, whether access authentication needs to be started.

(10) If access authentication needs to be started, the UE uses the security credential information shared with the HSS to generate an initial key required for control plane security protection using an initial key generation algorithm.

(11) According to the initial key generated by the UE, the security credential information shared with the HSS, and the security credential information shared with the SAS as input, the key generation algorithm is used to generate the key required for the security protection of the control plane, and the pre-configured algorithm is used for protection. AKA authentication information exchanged between the SAS and the control plane of the UE.

(12) The SAS takes the initial key, the security credential information shared with the UE, and the security credential information of the UE and the HSS as input, and generates the key required for control plane protection according to the key generation algorithm. Pre-configured security policies are used to protect the AKA authentication information of the control plane interaction between the SAS and the UE.

(13) The SAS sends an additional authentication command message to the UE, and the message includes the random number RAND generated by the HSS and the authentication token AUTN information.

(14) The UE authenticates the legitimacy of the private network based on the security credential information shared with the HSS and the AKA algorithm.

(15) After the authentication of the dedicated core network is passed, the UE sends an authentication request message, which includes the authentication response result RES generated by using the security credential information and the AKA algorithm.

(16) After receiving the UE's authentication response data, the SAS authenticates the legitimacy of the UE.

(17) The SAS replies to the UE with an additional authentication response message, which contains the authentication result; sends an authentication notification message to the S/P-GW, which contains the user authentication result.

(18) The P-GW replies with a SAS response message.

(19) According to the authentication result, the S/P-GW decides whether to allow the UE's service request to pass.

(20) If the authentication is passed, the S/P-GW routes the user's IP data packet (service request message) to the service server AF behind the private network.

(21) UE and AF perform service interaction.

The above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Those of ordinary skill in the art can modify or equivalently replace the technical solution of the present invention without departing from the spirit and scope of the present invention. The scope of protection should be determined by the claims.

Claims (10)

1. a kind of dynamic Additional Verification method towards mobile ad hoc network, step include：

The UE for having carried out two-way authentication with the MME and HSS positioned at special core net judges whether to need to start dynamically additional connect Enter certification, if desired, then the UE initiates access authentication request to the SAS positioned at special core net；Alternatively, the S/ of special core net P-GW receives the service request triggering that the UE is sent out and judges whether to need to start that the dynamic between the SAS and the UE is additional Access authentication, if desired, then the S/P-GW initiates access authentication request to the SAS；

After the SAS receives access authentication request, it is determined whether start access authentication, if started, the SAS is to institute State the IMSI information that HSS sends User ID and provided by the S/P-GW；

After the HSS receives the User ID and the IMSI information, the initial key that control plane safeguard protection needs is generated；

The SAS generates the key that control plane safeguard protection needs according to the initial key, protects it between the UE Control plane interactive information；

The UE generates the initial key that control plane safeguard protection needs, and control plane safeguard protection need are generated according to the initial key The key wanted protects its control plane interactive information between the SAS；

After the UE receives the authentication command of the SAS, the legitimacy of the special core net of certification, and notify the SAS；

The legitimacy of UE described in the SAS certifications, and notify the UE.

2. according to the method described in claim 1, it is characterized in that, according to the current location of the UE, whether roaming, accessing Whether business is private network business, access network security confidence level, access network type, access network ID and the safety of pre-configuration Strategy judges whether to start the access authentication.

3. according to the method described in claim 1, it is characterized in that, the access authentication request include the current locations UE, Hardware ID, access network type, access net ID and PLMN ID, IP address information.

4. according to the method described in claim 1, it is characterized in that, the UE and the HSS between share safety with It is believed that breath generates initial key.

5. according to the method described in claim 4, it is characterized in that, the generating algorithm of the initial key is：With the UE and The CK, IK and sharing learning Factor of security documents the information shared HSS, service network identification SN ID and sequence number SQN exclusive or AK is input, and calculating function KDF operations by standard key generates the initial key.

6. according to the method described in claim 1, it is characterized in that, the safety that the UE and the SAS are shared also according between The security documents information that authority information and the UE and the HSS share generates key.

7. according to the method described in claim 6, it is characterized in that, the key includes Confidentiality protection key and integrality guarantor Protect key；

The generating algorithm of the Confidentiality protection key is：The security documents letter shared with initial key, the UE and the HSS It ceases, the security documents information that the UE and the SAS are shared, Alg-ID, the Confidentiality protection algorithm types identifier newly defined The SA-init-enc-alg and algorithm mark 256-EEA4AES based algorithm (AES-CTR) newly defined is used as defeated Enter, the Confidentiality protection key is generated through key calculation function KDF operations；

The generating algorithm of the tegrity protection key is：The security documents letter shared with initial key, the UE and the HSS It ceases, the security documents information that the UE and the SAS are shared, Alg-ID, the protection algorithm integrallty type identifier newly defined SA-init-int-alg and algorithm mark 256-EIA4AES based algorithm (AES-CMAC) conduct newly defined Input generates the tegrity protection key through key calculation function KDF operations.

8. according to the method described in claim 1, it is characterized in that, the UE according to its generation initial key, itself and it is described Security documents information and AKA algorithms shared SAS carrys out the legitimacy of the special core net of certification；The SAS gives birth to according to the HSS At initial key, the shared security documents information and AKA algorithms of itself and the UE carry out the legitimacy of UE described in certification.

9. a kind of dynamic Additional Verification system towards mobile ad hoc network, including：

UE, for send access authentication request or service request, generate control plane safeguard protection need initial key and key, Protect its control plane interactive information between SAS, and the legitimacy of the special core net of certification；

SAS is located at special core net, is used to determine whether that starting dynamic adds access authentication, generating control plane safeguard protection needs The key wanted protects its control plane interactive information between the UE, and the legitimacy of UE described in certification；

HSS is located at special core net, the initial key for generating control plane safeguard protection needs；

S/P-GW is located at special core net, for providing IMSI information to the SAS.

10. system according to claim 9, which is characterized in that if the UE sends access authentication request, sending First judge whether that needing to start dynamic adds access authentication before；If the UE sends service request, which touches It sends out S/P-GW described and judges whether that the dynamic for needing to start between SAS and UE adds access authentication.