WO2013023475A1

WO2013023475A1 - Method for sharing user data in network and identity providing server

Info

Publication number: WO2013023475A1
Application number: PCT/CN2012/076275
Authority: WO
Inventors: 韦银星; 符涛; 吴强
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-08-15
Filing date: 2012-05-30
Publication date: 2013-02-21
Also published as: CN102938757A; CN102938757B

Abstract

A method for sharing user data in a network, a service providing server, an identity providing server and user equipment, wherein the network includes an identity providing server and a resource server (RS). The method includes: a service providing server receiving access from user equipment (UE); the service providing server directly or indirectly acquiring user shared data authorized by a user from the RS. The method for sharing user data in a network, service providing server, identity providing server and user equipment above enable the service providing server to securely share the user data of telecommunication operators.

Description

Method of sharing user data in a network and identity providing server

Technical field

The present invention relates to the field of communications and the Internet, and in particular, to a method for sharing user data in a network, a service providing server, an identity providing server, and a user equipment.

Background technique

With the popularity of the Internet and the development of information technology, people are increasingly doing business activities in the cyberspace, such as online shopping, Internet telephony, e-mail, blogs, instant messaging, and so on. Generally, telecom operators and service providers provide services to users. The telecommunication operators have the infrastructure of the communication network, providing users with rich access methods, such as Asymmetric Digital Subscriber Line (ADSL). In the third generation (The Third Generation, 3G) mobile communication access, wireless local area network (WLAN) access, Ethernet access, etc.; service providers provide users with rich services, such as traditional portals Websites, e-commerce, internet communications, online banking and social networking.

The number of service providers on the Internet varies, and although some can provide innovative services, the number of users is slow to develop, and the number of users often becomes a bottleneck for business development. In recent years, there has been a type of provider of identity services on the Internet, called an Identity Provider (Identity Provider). The identity provider server provided by the identity provider usually has a relatively large user resource and can provide services such as authentication for other users or service providers. Telecom operators have a large number of users and have the ability to provide servers with natural identity. However, compared with the open Internet, the telecommunications network is relatively closed and has a single business category. In order to enhance the competitiveness of telecom operators, rather than just providing a conduit for service providers, it is necessary for telecom operators to become part of the business value chain: providing identity services as an identity providing server, sharing user information, and providing trusted security services. Providing mobile payment capabilities, etc.; Service providers can reuse the capabilities provided by telecom operators to focus on core competitive services; for users, enjoy a seamless business experience and enhance security and personal privacy.

In the related technology, an application server (AS) in the IP Multimedia System (IMS) can directly access the home subscriber server (Home Subscriber). Signing data for users in Server, HSS). The user decides which data to share by modifying the subscription information. For service providers on the Internet, the number is large, and new service providers are constantly appearing, and it is difficult to define subscription data in advance. Therefore, this solution has scalability problems. In addition, for the third-party AS, the user subscription data is obtained from the HSS according to the trust relationship, but currently, the AS cannot flexibly control the access of the AS to the user subscription data.

In the current Identity Management (IdM), there are three roles involved: users, service providers, and identity providers. The current solution is mainly to solve single sign-on problems, such as OpenID (IDID), Free Alliance. ( Liberty Alliance ) , Card Space , Generic Authentication Architecture ( GAA ) and Kerberos model. These schemes do not define user identity independently and are completed independently. The diversity of identities is inconvenient for users to use the Internet.

Open Authorization (OAuth) A protocol for resolving authorized access to user resource data on the Internet. It does not define how to use the unified method for users to identify, and does not define how to use it with the resources of the telecom operator.

In the current network, the identity of the user is used for the identification of the user at the network layer, and can also be used for the identification of the user by the service provider, providing the user with a unified identity. However, there is currently no effective way to realize that the service provider's service provider server securely shares the subscriber's subscriber data, which also limits the development of new services. Summary of the invention

The embodiments of the present invention provide a method for sharing user data in a network, a service providing server, an identity providing server, and a user equipment, to solve the problem that the service providing server cannot securely share the user data of the telecommunication operator.

An embodiment of the present invention provides a method for sharing user data in a network, where the network includes an identity providing server and a resource server (RS), and the method includes:

The service providing server receives the access of the user equipment (UE);

The service providing server directly or indirectly acquires user-shared data authorized by the user from the RS. Preferably, before the service providing server receives the access of the UE, the method further includes: the service providing server directly or indirectly completing service access authentication for the UE. Preferably, the service providing server directly completing the service access authentication to the UE includes: the service providing server obtaining a user security parameter from the identity providing server, and completing the service connection to the UE according to the user security parameter. Enter the certification.

Preferably, the service providing server indirectly completing the service access authentication to the UE includes: the service providing server obtaining, by the identity providing server, a service access authentication result of the identity providing server to the UE.

Preferably, the user security parameter is obtained by the identity providing server according to an access authentication result of the network to the UE.

Preferably, the service access authentication result is that the identity providing server completes according to the access authentication result of the network to the UE.

Preferably, the service providing server directly acquiring the user-shared user-shared data from the RS includes:

The service providing server acquires a token from the identity providing server, and directly acquires user shared data authorized by the user from the RS according to the token.

Preferably, the service providing server obtains user-authorized user sharing data from the RS indirectly:

The service providing server acquires user shared data authorized by the user through the identity providing server.

The embodiment of the present invention further provides a service providing server, where the service providing server includes: a receiving module, configured to receive access by a user equipment (UE);

The acquisition module is configured to obtain user-authorized user-shared data directly or indirectly from a resource server (RS).

Preferably, the service providing server further includes:

The service access authentication module is configured to directly or indirectly complete service access authentication for the UE before the receiving module receives the access of the UE. Preferably, the service access authentication module is configured to obtain a user security parameter from an identity providing server, complete service access authentication to the UE according to the user security parameter, or obtain an office from the identity providing server. The identity provides a service authentication result of the server to the UE.

Preferably, the user security parameter is obtained by the identity providing server according to an access authentication result of the network to the UE; or

The service authentication result is that the identity providing server is completed according to the access authentication result of the network to the UE.

Preferably, the obtaining module is configured to acquire a token from the identity providing server, directly acquire user-authorized user-shared data from the RS according to the token, or acquire user authorization by using the identity providing server. Users share data.

The embodiment of the present invention further provides an identity providing server, where the identity providing server includes: a network access authentication module, configured to authenticate a user equipment (UE) access network, and obtain user security parameters;

The service access authentication module is configured to perform service access authentication for the UE according to the user security parameter obtained by the network access authentication module, and send the service access authentication result to the service providing server.

Preferably, the identity providing server further includes:

The first sending module is configured to send the user security parameter obtained by the network access authentication module to the service providing server.

Preferably, the user security parameter comprises a session key.

Preferably, the identity providing server further includes:

a second sending module, configured to: after the service access authentication module sends the service access authentication result or the first sending module sends the user security parameter to the service providing server, receive the data sent by the service providing server And requesting, according to the data request, obtaining user shared data authorized by the user from the resource server (RS), and transmitting the user shared data to the service providing server.

Preferably, the second sending module is further configured to: send, by the service access authentication module, a service access authentication result or the first sending module to send the user security parameter to a service providing service After receiving the token request sent by the service providing server, sending a token to the service providing server according to the token request, so that the service providing server obtains a user from the RS according to the token Authorized users share data.

An embodiment of the present invention further provides a user equipment (UE), where the UE includes:

An access module, configured to access a service providing server;

a data processing module, configured to receive a user data authorization request sent by the identity providing server according to the data request sent by the service providing server, and provide the server to the identity according to the authorization result of the user data carried in the user data authorization request Returns the user-shared data shared by the user.

Preferably, the access module is configured to access the service providing server after the UE uses the identifier to successfully access the network and obtain the service access authentication of the service providing server.

The above method for sharing user data in the network, the service providing server, the identity providing server, and the user equipment enable the service providing server to securely share the user data of the telecommunications carrier. BRIEF abstract

1 is a schematic diagram of a scenario of user data in a shared network according to an embodiment of the present invention;

2 is a schematic structural diagram of Embodiment 1 of user data in a shared network according to the present invention;

3 is a schematic structural diagram of Embodiment 2 of user data in a shared network according to the present invention;

4 is a signaling flowchart of Embodiment 1 of user data in a shared network according to the present invention;

5 is a signaling flowchart of Embodiment 2 of user data in a shared network according to the present invention;

6 is a signaling flowchart of Embodiment 3 of user data in a shared network according to the present invention;

FIG. 7 is a schematic structural diagram of a service providing server according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an identity providing server according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a user equipment according to the present invention. Preferred embodiment of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that In the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other. As shown in FIG. 1 , a schematic diagram of a scenario for sharing user data in a network according to an embodiment of the present invention. In this embodiment, a social network securely shares data of a user in a network, such as a contact list, where the sharing process includes:

Step 10: The user 100 accesses the network 102 and passes the authentication of the network 102.

Step 12: The user 100 accesses the social networking website 104;

Step 14, the social networking website 104 does not have the identity information of the user 100, the social networking website 104 finds the network 102 according to the configuration information or finds the network 102 by using the dynamic discovery protocol;

Step 16. The network 102 contacts the user 100, and the user 100 authorizes sharing of user data, such as a contact list;

Step 18: After the user 100 authorizes the shared user data, the network 102 continues the subsequent processing; Step 20, the network 102 returns the information shared by the user 100 to the social network 104, such as a contact list;

Step 22: When the user 106 accesses the social networking website 104 through the network 102, the user data shared by the user 100, such as a contact list, is used.

As shown in FIG. 2, it is a schematic diagram of the architecture of the user data in the shared network according to the present invention. The network completes the routing of the data packet by using an Access Serving Node (ASN); the user equipment (UE) 200 identifies by using the ID. . In the network, the user equipment 200 is authenticated by the identity providing server, and the data shared by the user is directly obtained from the resource server (RS) 206, or the data shared by the user is acquired by the identity providing server 204. The network includes, but is not limited to, a mobile communication network, an identification network. The authentication between the UE 200 and the service providing server 208 is based on the result of the user access authentication. In this architecture, the network does not pass the user's security credentials to the service providing server 208, so that the service providing server 208 cannot directly authenticate the user equipment 200, and the user authentication needs to be completed through the interface between the UE 200 and the identity providing server 204. .

The user equipment 200 refers to a user node, such as a mobile phone, a personal computer, etc.; the user equipment pre-configures or obtains an identification ID from the network; the user equipment owns a security credential, pre-shares the root key with the network, or sets Set a digital certificate. In the mobile communication network, the ID of the user equipment can use the international mobile subscriber identity

(IMSI) or Mobile Subscriber Integrated Services Digital Network (MSISDN) to identify; In the identification network, the ID of the user equipment is the Access Identifier (AID). The capabilities of the user equipment include but are not limited to: Support Hypertext Transfer Protocol (HTTP) Digest authentication protocol; Support Session Initiation Protocol (SIP) Digest authentication protocol; Support Extensible Authentication Protocol (EAP) and EAP authentication methods ; Ability to derive new key material.

The access service node 202 is located at the boundary of the network, and is configured to provide an access service for the user equipment 200, maintain a connection between the terminal and the network, implement routing and forwarding of data packets, and cooperate with the identity providing server 204 to complete the UE 200. Access authentication. In the mobile communication network, the access service node is a GPRS service support node (Serving GPRS SUPPORT NODE, SGSN) and/or a Gateway GPRS Support Node (GGSN). In the identification network, the access service node is an ASN. .

The identity providing server 204 is responsible for creating, maintaining, and managing the identity information of the user in the network with the user identity ID as the core, and providing the user identity verification service. The capabilities of the identity providing server 204 include, but are not limited to: providing network access authentication services; providing service access authentication services; supporting EAP functions; being able to obtain user information from the RS; and implementing identity management of the authentication center Features such as support for web features, HTTP (Hypertext Transfer Protocol), HTTP digest authentication protocol, Security Assertion Markup Language (SAML).

The Resource Server (RS) 206 stores the user's security information, providing the user's attribute data and other data such as contact lists, avatars, photos, videos, and the like.

The service providing server 208 provides services to the user node 200, which may be Web-type services, such as a portal website or an electronic mall. Such services usually use Hypertext Transfer Markup Language (HTML)/HTTP; or non-Web-type services, such as electronic Mail, instant messaging, such services are usually based on transport layer protocols such as Transmission Control Protocol (TCP).

The following describes each interface in Figure 2:

Interface A: located between the UE 200 and the ASN 202, providing bidirectional authentication of the UE 200 and the ASN 202, supporting but not limited to the EAP protocol; Interface B: located between the ASN 202 and the identity providing server 204, transmitting the primary session key from the identity providing server 204 to the ASN 202; supporting but not limited to delivering the EAP payload through the Authentication Authorization Accounting (AAA) protocol;

The interface C is located between the identity providing server 204 and the RS 206, and the identity providing server 204 obtains the user's security information and other user data through the C214 interface. The protocol of this interface includes but is not limited to: Support Diameter protocol.

Interface D: Located between the UE 200 and the identity providing server 204, it supports the user's single sign-on service and supports secure shared data. The protocol of this interface includes but is not limited to: Support HTTP Digest protocol; Support SIP Digest protocol; Support SAML protocol.

The interface E is located between the UE 200 and the service providing server 208. The UE 200 accesses the service provided by the service providing server 208 through the interface. The protocols of the interface include but are not limited to: support the HTTP protocol; support the transport layer protocol, such as TCP; SAML protocol; support Diameter protocol; support HTTPS protocol.

The interface F is located between the identity providing server 204 and the service providing server 208, and provides a single sign-on service to support secure shared data. The protocol of this interface includes but is not limited to: Support HTTP protocol, support AAA protocol.

Interface G: is located between the service providing server 208 and the RS 206, and the service providing server 208 obtains user related data through the interface. The protocol of this interface includes but is not limited to: Support for the Diameter protocol.

As shown in FIG. 3, it is a schematic structural diagram of Embodiment 2 of user data in a shared network according to the present invention. The difference between the architecture diagram and the architecture diagram shown in FIG. 2 is that, in the architecture diagram in this embodiment, the UE and the identity providing server are There is no interface between them; however, the network can pass user security information (such as identification, primary session key, key life cycle, etc.) to the service providing server 208, so that the service providing server 208 can directly authenticate the user device 200. The user security information used by the UE 200 and the service providing server 208 is used as a result of the user's network access authentication.

As shown in FIG. 4, it is a signaling flowchart of Embodiment 1 of user data in a shared network according to the present invention. The flowchart is completed based on the architecture shown in FIG. 2. In this embodiment, the UE 200 is authenticated by the identity providing server 204, the service providing server 208 obtains the token from the identity providing server 204, and directly acquires the user shared from the RS 206. Data, the identity providing server 204 and the RS 206 have pre-configured templates for user data sharing, specifically which data is shared by the user.

The prerequisite for the process is that the link between the UE 200 and the ASN 202 has been established, and the UE

200 has pre-configured the user's identity ID; the user data process in the shared network includes: Step 220, ASN 202 sends an identity request to the UE 200;

Step 222: The UE 200 sends a response to the ASN 202, and carries the identity ID of the user in the response. Step 224: The ASN 202 sends the response packet to the identity providing server 204, where the packet carries the user identity ID.

Step 226: The identity providing server 204 sends a packet carrying the ID to the RS 206 to request the key material.

Step 228: The RS 206 returns the key material to the identity providing server 204.

Step 230: The UE 200 and the identity providing server 204 negotiate security parameters, including the security protocols and session keys supported by the two parties.

The foregoing steps 220-230 are an access authentication process of the network to the UE;

Step 232: The UE 200 accesses the service of the service providing server 208, and the service providing server 208 discovers the location of the identity providing server 204 by static configuration or dynamic discovery;

Step 234, the service providing server 208 sends a redirect message to the UE 200, the UE 200 sends the message to the identity providing server 204 according to the address of the identity providing server in the redirect message header;

Step 236: The identity providing server 204 sends an unauthorized message to the UE 200.

Step 238: The UE 200 sends a digest authentication message to the identity providing server 204, where the ID is used as the username and the session key is used as the password.

Step 240: The identity providing server 204 verifies the identity of the user after receiving the digest authentication message. Step 242: The identity providing server 204 requests the user data list from the RS 206, where the request carries the identity of the user. Step 244: The RS 206 returns a user list to the identity providing server 204.

Step 246: The identity providing server 204 requests the user to authorize by sending a list of user data to the UE2000.

Step 248: The UE 200 returns a user authorization result to the identity providing server 204.

Step 250: The identity providing server 204 sends a redirect message to the UE 200. The UE 200 contacts the service providing server 208 according to the address in the message header, where the message includes an index and an authorization code. Step 252: The service providing server 208 provides the identity providing server 204 Requesting an access token, the request including an index and an authorization code;

Step 254: The identity providing server 204 returns an access token to the service providing server 208, where the token includes information such as a key, a key life cycle, and the like;

Step 256: The service providing server 208 obtains the shared user data in batches from the RS 206, and the RS 206 performs security protection, such as confidentiality protection and integrity protection. After receiving the user data, the service providing server 208 reads the access token. Take these protected data;

Step 258: The service providing server 208 returns a result message to the UE 200.

The following uses the EAP, AAA, HTTP, and SAML protocols as an example to describe the user data flow in the secure shared network shown in Figure 4 as an application example:

Step 220a, ASN 202 sends an EAP-Identity identity request to the UE 200;

Step 222a: The UE 200 sends an EAP-Identity response to the ASN 202, and carries the identity ID of the user in the response, where the Type-Data in the EAP-Identity response is set to an ID.

Step 224a, the ASN 202 sends an EAP payload (EAP-Payload) to the identity providing server 204 via the AAA protocol. For the Diameter protocol, use the EAP-Payload AVP (Attribute-Value Pair) of the Diameter-EAP-Request message to encapsulate the EAP-Identity payload; for the Remote User Dial-In Authentication Service (RADIUS) protocol, use RADIUS Access. - The EAP-Message attribute of the -Request message encapsulates the EAP-Identity payload;

Step 226a: The identity providing server 204 sends the ID to the RS 206 through the Diameter protocol to obtain the key material, and specifically uses a Multimedia-Auth-Request (MAR). Carrying an ID;

Step 228a: The RS 206 returns the key material to the identity providing server 204 through the Diameter protocol, and specifically carries a key material by using a Multimedia-Auth-Answer (MAA) message, where the ID is mapped to a user name (User-Name). )Attributes;

Step 230a, UE 200 and identity providing server 204 negotiate security parameters: (1) Negotiate EAP method (Method), such as EAP-authentication and key agreement (AKA), EAK-secure transport layer protocol (TLS), etc., for Diameter protocol The EAP-Payload AVP (Attribute-Value Pair) of the Diameter-EAP-Request message is used to encapsulate the payloads such as EAP-AKA and EAP-TLS. For the RADIUS protocol, RADIUS Access-Challenge and Access- are used. Accept encapsulates EAP-AKA, EAP-TLS and other payloads. (2) The UE 200 and the identity providing server 204 negotiate an MSK (Master Session Key). For the Diameter protocol, the EAP-Master-Session-Key AVP of the Diameter-EAP-Request message is used to carry the key material. For the RADIUS protocol, the VSA (Vendable Service Provider ecific Attribute, specific vendor attribute) in the RADIUS Accept message carries the MSK;

Step 232a: The UE 200 sends an HTTP request to the service providing server 208, and selects to log in through the identity providing server 204 on the service providing server 208. In the header field of the HTTP request, a URL (Uniform Resource Locator) address of the identity providing server is provided, and the service providing server 208 statically configures or dynamically discovers the URL address of the identity providing server 204, and the request message carries <1 : AuthnRequest>;

Step 234a: The service providing server 208 sends an HTTP redirect message to the UE 200, and the UE

200 sends the message to the identity providing server 204 according to the URL address of the identity providing server in the HTTP redirect message header;

Step 236a: The identity providing server 204 sends an HTTP 401 Unauthorized message to the UE 200.

Step 238a: The UE 200 sends an HTTP request message to the identity providing server 204, and uses the ID as the username and the MSK as the password to perform HTTP Digest authentication.

Step 240a: After receiving the HTTP digest authentication message, the identity providing server 204 checks the local ID/MSK according to the ID, and performs the same HTTP Digest authentication algorithm. When the calculated results are consistent, Then pass the verification;

Step 242a: The identity providing server 204 sends an ID to the RS 206 requesting user data list through the Diameter protocol, and uses a Push-Profile-Request message User Data attribute to carry a list of user data, where the ID is mapped to a User-Name attribute;

Step 244a, RS 206 returns a user data list to the identity providing server 204 through the Diameter protocol, and uses a Push-Profile-Answer message User Data attribute to carry a list of user data, where the ID is mapped to the User-Name attribute;

Step 246a: The identity providing server 204 sends a list of user data to the UE 200 via the HTTPS to request user authorization.

Step 248a, after the user authorization, the UE 200 returns the user authorization data list to the identity providing server 204;

Step 250a, the identity providing server 204 generates a SAML Artifact and an authorization code, and redirects the message to the UE 200 through HTTPS. The UE 200 contacts the service providing server 208 according to the URL in the message header, where the SAML Artifact points to the structure of the SAML protocol message. The data object, SAML Artifact is relatively small, can be embedded in the HTTP message;

Step 252a, the service providing server 208 sends an HTTP GET request to the secondary identity providing server 204 via the HTTPS, where the message includes the SAML Artifact and the authorization code;

Step 254a: The identity providing server 204 returns an access token to the service providing server 208 by using an HTTPS response message, where the token includes information such as a key, a key life cycle, and the like;

Step 256a: The service providing server 208 obtains the shared user data in batches from the RS 206 through the Diameter protocol, and uses the Diameter Push-Request-Request/Answer message User Data attribute to acquire the data shared by the user in batches. The RS 206 secures the data, such as confidentiality protection and integrity protection; after receiving the user data, the service providing server 208 reads the protected data with the access token;

Step 258a: The service providing server returns an HTTP 200 OK message to the UE 200.

The above process is applicable to EAP-authenticated access such as ADSL, WLAN, and Ethernet. For the 3G access process, the AKA authentication process is used, and MSK = CK || IK is set after the authentication process ends.

The identity location separation network supports compatibility with existing terminals and access technologies, ie without changing the terminal and Access Network. In this case, the UE 200 accesses the network according to the existing mode. After the access authentication, the network allocates an access identifier to the user equipment, and the user equipment and the network share the session key. The subsequent processing flow is completely consistent.

As shown in FIG. 5, it is a signaling flowchart of Embodiment 2 of user data in a shared network according to the present invention. The embodiment is also implemented based on the architecture shown in FIG. 2, in this embodiment, the identity providing server 204 is used by the UE 200. The authentication is performed, and the service providing server 208 obtains the data shared by the user through the identity providing server 204, and specifically shares which data is authorized by the user, and the real identity information of the user may not be disclosed to the service providing server.

200 has pre-configured the user's identity ID or assigns an ID to the user by the network; the user data process in the shared network includes:

Step 302: The UE 200 passes the access authentication of the network. After the authentication ends, the UE 200 shares the session key with the identity providing server 204.

Step 302 may specifically include step 220 to step 230 in FIG. 4, and details are not described herein. Step 304: The UE 200 accesses the service of the service providing server 208, and the service providing server 208 discovers the location of the identity providing server 204 by static configuration or dynamic discovery. ;

Step 306, the service providing server 208 sends a redirect message to the UE 200, the UE 200 sends the message to the identity providing server 204 according to the address of the identity providing server in the redirect message header;

Step 308: The identity providing server 204 sends an unauthorized message to the UE 200.

Step 310: The UE 200 sends a digest authentication message to the identity providing server 204, where the ID is used as the username and the session key is used as the password.

Step 312: The identity providing server 204 verifies the identity of the user after receiving the digest authentication message. Step 314: The identity providing server 204 sends a redirect message to the service providing server 208, where the message includes an index.

Step 316: The service providing server 208 sends a request to the identity providing server 204 to authenticate the identity of the user, where the message includes an index. Step 318: The identity providing server 204 returns the authentication result to the service providing server 208. Step 320: The service providing server 208 requests the identity providing server 204 to share data, where the message includes an index.

Step 322: The identity providing server 204 requests user data from the RS 208, where the request includes a user ID.

Step 324: The RS 206 returns user data to the identity providing server.

Step 326: The identity providing server 204 sends a request to the UE 200 to request the user to authorize the data. Step 328: The UE 200 returns the data authorized by the user to the identity providing server 204. Step 330: The identity providing server 204 returns the user authorization to the service providing server 208. Data

Step 332, the service providing server 208 returns a result message to the UE 200.

The HTTP and SAML protocols are used as an example to describe the user data flow in the secure shared network shown in Figure 5 as an application example:

Step 302a, the UE 200 passes the access authentication of the network, and after the end of the authentication, the UE 200 shares the session key MSK with the identity providing server 204;

Step 304a: The UE 200 sends an HTTP request to the service providing server 208, and selects to log in through the identity providing server 204 on the service providing server 208. The URL (Uniform Resource Locator) address of the identity providing server is included in the header field of the HTTP request, and the service providing server 208 carries the <1: AuthnRequest> by statically configuring or dynamically discovering the URL address of the identity providing server 204. ;

Step 306a, the service providing server 208 sends an HTTP redirect message to the UE 200, and the UE 200 sends the message to the identity providing server 204 according to the URL address of the identity providing server in the HTTP redirect message header;

Step 308a: The identity providing server 204 sends an HTTP 401 Unauthorized message to the UE 200.

Step 310a: The UE 200 sends an HTTP request message to the identity providing server 204, using the ID. As the username, MSK is used as the password to perform HTTP Digest authentication.

Step 312a: After receiving the HTTP digest authentication message, the identity providing server 204 checks the local ID/MSK according to the ID and performs the same HTTP Digest authentication algorithm. If the calculation result is consistent, the verification succeeds;

Step 314a, the identity providing server 204 generates a SAML Artifact, and sends an HTTPS redirect message to the service providing server 208, where the message carries a SAML Artifact, where the SAML Artifact points to a structured data object of the SAML protocol message, and the SAML Artifact is relatively small and can be embedded in the HTTP In the message;

Step 316a: After receiving the SAML Artifact, the service providing server 208 sends an HTTPS request to the identity providing server 204, where the message carries the SAML Artifact; after receiving the message, the identity providing server 204 constructs the SAML assertion;

Step 318a, the identity providing server 204 returns the SAML assertion to the service providing server 208 via HTTPS;

After the service providing server 208 verifies the signature of the SAML assertion, the HTTPS request is sent to the identity providing server 204 to request the shared user data, and the message carries the SAML Artifact. Step 322a, the identity providing server 204 obtains the ID according to the SAML Artifact, and passes the Diameter. Push-Profile-Request requests the user to share data to RS206;

Step 324a, RS206 returns the user shared data to the identity providing server 204, and carries the user data through the Diameter Push-Profile-Answer message User Data attribute;

Step 326a: The identity providing server 204 sends an HTTPS request to the UE 200 to request the user to authorize the shared data.

Step 328a: After the user authorizes the shared user data, the result is returned to the identity providing server 204. Step 330a, after the user authorizes, the identity providing server 204 returns the data authorized by the user to the service providing server 208;

Step 332a, the service providing server 208 returns an HTTP 200 OK message to the UE 200.

FIG. 6 is a signaling flowchart of Embodiment 3 of user data in a secure shared network according to the present invention. The flowchart is completed based on the architecture shown in FIG. 3. In this embodiment, the identity providing server 204 performs access authentication on the UE 200, the service providing server 208 authenticates the user identity, and then performs a user data process in the secure shared network.

The process is performed on the premise that the link between the UE 200 and the ASN 202 has been established, and the UE 200 has pre-configured the ID of the user or assigns an ID to the user by the network. The process includes: Step 402: The UE 200 passes Access authentication of the network, after the end of the authentication, the UE 200 shares the session key with the identity providing server 204;

Step 404: The UE 200 accesses the service of the service providing server 208, and the service providing server 208 discovers the location of the identity providing server 204 by static configuration or dynamic discovery;

Step 406: The service providing server 208 sends an unauthorized message to the UE 200.

Step 408: The UE 200 sends a digest authentication message to the service providing server 208, where the ID is used as the username and the session key is used as the password.

Step 410: The service providing server 208 requests the identity providing server 204 for the security parameter of the user.

Step 412: The identity providing server 204 returns the security parameter of the user to the service providing server 208.

Step 414: The service providing server 208 verifies the identity of the user, and the verification process is based on the received digest authentication message and the security parameter of the user.

Step 416: The service providing server 208, the RS 206, the identity providing server 204, and the UE 200 perform a user data process in the secure shared network.

The process of securely sharing the data may be the same as the steps 252-258 in FIG. 4, and may be the same as the steps 320-332 in FIG. 5, and details are not described herein again.

As shown in FIG. 7, an embodiment of the present invention further provides a service providing server, where the service providing server includes:

The receiving module 70 is configured to receive an access of the user equipment (UE);

The obtaining module 71 is configured to obtain the user authorization directly or indirectly from the resource server (RS) Users share data.

In addition, the service providing server may further include: a service access authentication module 72, configured to directly or indirectly complete the service access authentication of the UE before the receiving module receives the access of the UE.

Specifically, the service access authentication module 72 is configured to obtain a user security parameter from the identity providing server, complete service access authentication to the UE according to the user security parameter, or obtain the identity providing server from the identity providing server. The identity provides a service authentication result of the server to the UE. The user security parameter is obtained by the identity providing server according to the access authentication result of the network to the UE; the service authentication result is that the identity providing server connects to the UE according to the network. The certification results are completed.

Preferably, the obtaining module 71 is configured to acquire a token from the identity providing server, and directly acquire user-authorized user-authorized data from the RS according to the token; or obtain by the identity providing server. User authorized users share data.

The service providing server can share the data shared by the user authorized by the user in the network. The specific implementation process can be seen in Figure 4-6.

As shown in FIG. 8, an embodiment of the present invention further provides an identity providing server, where the identity providing server includes:

The network access authentication module 80 is configured to authenticate the user equipment (UE) access network, and obtain user security parameters;

The service access authentication module 81 is configured to perform service access authentication for the UE according to the user security parameter obtained by the network access authentication module 80, and send the service access authentication result to the service providing server.

The user security parameter includes a session key.

In addition, the identity providing server may further include: a first sending module 82, configured to send the user security parameter obtained by the network access authentication module to the service providing server.

Preferably, the identity providing server may further include: a second sending module 83, configured to: in the service access authentication module 81, access the service authentication result or the first sending module 82 After the user security parameter is sent to the service providing server, receiving a data request sent by the service providing server, obtaining user-authorized user shared data from the resource server (RS) according to the data request, and sending the user shared data to The service providing server. The second sending module 83 is further configured to: after the service access authentication module 81 sends the service access authentication result or the first sending module 82 sends the user security parameter to the service providing server, The service provides a token request sent by the server, and sends a token to the service providing server according to the token request, so that the service providing server obtains user-authorized user shared data from the RS according to the token.

The identity providing server lays a foundation for implementing the UE to access the service providing server, and also provides data for the user that provides the user authorization for the service providing server, or provides a token for the service providing server, so that the service providing server can obtain the user according to the token. Authorized users share data.

As shown in FIG. 9, the present invention further provides a user equipment (UE), where the UE includes: an access module 90, configured to access a service providing server;

The data processing module 91 is configured to receive a user data authorization request sent by the identity providing server according to the data request sent by the service providing server, and provide the identity according to the authorization result of the user data carried in the user data authorization request by the user. The server returns the user-authorized user to share data.

Specifically, the accessing module 92 is configured to access the service providing server after the UE uses the identifier to successfully access the network and obtain the service access authentication of the service providing server.

After successfully accessing the network and obtaining the service access authentication of the service providing server, the UE can access the service providing server, and the authorized service providing server can share which data in the network, and then the service providing server can share the user in the network. The data is shared by the user authorized by the UE. For the specific interaction process, refer to Figure 4-6.

One of ordinary skill in the art can understand that all or part of the above steps can be completed by a program to instruct related hardware, and the above program can be stored in a computer readable storage medium, such as read only. Memory, disk or disc, etc. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above embodiments are only intended to illustrate the technical solutions of the present invention and are not to be construed as limiting the invention. It should be understood by those skilled in the art that the present invention may be modified or equivalently substituted without departing from the spirit and scope of the invention.

Industrial applicability

The above method for sharing user data in the network, the service providing server, the identity providing server, and the user equipment enable the service providing server to securely share the user data of the telecommunications carrier.

Claims

Claim

A method for sharing user data in a network, the network comprising an identity providing server and a resource server (RS), the method comprising:

The service providing server receives access from the user equipment (UE);

The service providing server directly or indirectly acquires user-shared data authorized by the user from the RS.

2. The method of claim 1 wherein:

Before the step of the service providing server receiving the access of the UE, the method further includes: the service providing server directly or indirectly completing service access authentication for the UE.

3. The method of claim 2, wherein:

The step of the service providing server directly completing the service access authentication for the UE includes: obtaining, by the service providing server, a user security parameter from the identity providing server, and completing service access to the UE according to the user security parameter Certification.

4. The method of claim 2, wherein:

The step of the service providing server indirectly completing the service access authentication for the UE includes: obtaining, by the service providing server, a service access authentication result of the identity providing server to the UE from the identity providing server.

5. The method of claim 3, wherein:

The user security parameter is obtained by the identity providing server according to the access authentication result of the network to the UE.

6. The method of claim 4, wherein:

The result of the service access authentication is that the identity providing server is completed according to the access authentication result of the network to the UE.

7. A method according to any of claims 1-6, wherein:

The step of the service providing server directly acquiring user-authorized user shared data from the RS includes: The service providing server acquires a token from the identity providing server, and directly acquires user shared data authorized by the user from the RS according to the token.

8. A method according to any of claims 1-6, wherein:

The step of the service providing server acquiring the user-authorized user sharing data from the RS to the ground includes:

9. A service providing server, the service providing server comprising:

a receiving module, configured to: receive access by a user equipment (UE);

The obtaining module is configured to: directly or indirectly obtain user-authorized user shared data from a resource server (RS).

10. The service providing server according to claim 9, wherein the service providing server further comprises:

The service access authentication module is configured to: directly or indirectly complete the service access authentication of the UE before the receiving module receives the access of the UE.

11. The service providing server according to claim 10, wherein:

The service access authentication module is configured to: obtain a user security parameter from the identity providing server, complete service access authentication to the UE according to the user security parameter; or obtain the identity providing from the identity providing server. The service authentication result of the server to the UE.

12. The service providing server according to claim 11, wherein:

The user security parameter is obtained by the identity providing server according to the access authentication result of the network to the UE; or

The service providing server according to any one of claims 9 to 12, wherein: the obtaining module is configured to: acquire a token from the identity providing server, and directly from the RS according to the token Obtaining user-authorized user sharing data; or providing by the identity The server obtains data shared by users authorized by the user.

14. An identity providing server, the identity providing server comprising:

a network access authentication module, configured to: authenticate a user equipment (UE) access network, and obtain user security parameters;

The service access authentication module is configured to: perform service access authentication for the UE according to the user security parameter obtained by the network access authentication module, and send the service access authentication result to the service providing server.

The identity providing server according to claim 14, wherein the identity providing server further comprises:

And a first sending module, configured to: send the user security parameter obtained by the network access authentication module to the service providing server.

16. An identity providing server according to claim 14 or 15, wherein:

The user security parameter includes a session key.

17. The identity providing server of claim 15, the identity providing server further comprising:

a second sending module, configured to: after the service access authentication module sends the service access authentication result or the first sending module sends the user security parameter to the service providing server, receiving the service providing server to send And the data request, obtaining user-authorized user shared data from the resource server (RS) according to the data request, and transmitting the user shared data to the service providing server.

18. The identity providing server according to claim 17, wherein:

The second sending module is further configured to: after the service access authentication module sends the service access authentication result or the first sending module sends the user security parameter to the service providing server, receiving the service providing server The sent token request sends a token to the service providing server according to the token request, so that the service providing server obtains user-authorized user shared data from the RS according to the token.

19. A user equipment (UE), the UE comprising: An access module, which is configured to: access a service providing server;

a data processing module, configured to: receive a user data authorization request sent by the identity providing server according to the data request sent by the service providing server, and send the identity to the identity according to the authorization result of the user data carried in the user data authorization request Provides the server to return user-authorized users to share data.

20. The UE of claim 19, wherein:

The access module is configured to: after the UE uses the identifier to successfully access the network and obtain the service access authentication of the service providing server, access the service providing server.