WO2014206316A1

WO2014206316A1 - Service authentication method and system

Info

Publication number: WO2014206316A1
Application number: PCT/CN2014/080852
Authority: WO
Inventors: 查敏
Original assignee: 华为技术有限公司
Priority date: 2013-06-26
Filing date: 2014-06-26
Publication date: 2014-12-31
Also published as: CN104253787A

Abstract

The embodiments of the present invention relate to the technical field of communications. Disclosed are a service authentication method and system. The method comprises: a terminal receiving an instruction about invoking shared user information to conduct third party service authentication which is sent by a user; the terminal sending a request message of acquiring a user token to a BNG; the BNG sending the request message of acquiring the user token to an AAA server; the AAA server generating and saving the user token; the AAA server sending the user token to the BNG; the BNG sending the user token to the terminal; the terminal sending the user token to a server of the third party service; the AAA server receiving service request information sent by the server of the third party service; and the AAA server judging whether the user token received thereby is equal to the user token saved thereby or not, and if so, passing the third party authentication. By implementing the embodiments of the present invention, the user experience can be improved.

Description

Business Certification Method and System This application claims priority to Chinese Patent Application No. CN 201310259633.X, entitled "Business Authentication Method and System", filed on June 26, 2013, the entire contents of which are filed on June 26, 2013. This is incorporated herein by reference. The present invention relates to the field of communications technologies, and in particular, to a service authentication method and system.

BACKGROUND Currently, when a network user accesses a network, it is generally required to perform authentication by an AAA (Authentication, Authorization, Accounting, Authentication, Authorization, and Accounting) server. In the authentication process, the user generally needs to input a user name and a password. After the authentication is passed, the user is authenticated. You can use the network service provided by the operator.

In the process of using the network service by the user, when using some third-party services, the user name and password registered by the user in the third-party service provider are also required, and each third-party service provider generally needs a separate user name and The password, so that when the user accesses the network, it may need to remember multiple user names and passwords, which is not only easy to forget, but also requires frequent input of user information, which brings inconvenience to the user.

SUMMARY OF THE INVENTION The technical problem to be solved by embodiments of the present invention is to provide a service authentication method and system for facilitating users in using third party services.

The embodiment of the invention provides a service authentication method, including:

Receiving, by the terminal, an instruction for calling the shared user information to perform third-party service authentication, where the shared user information is user information used by the user for performing authentication, authorization, and accounting AAA authentication; and the terminal sends the user token to obtain the user token token. Requesting a message to the broadband network gateway BNG;

Sending, by the BNG, the request message for acquiring a user token to an AAA server;

The AAA server generates a user token and saves it; Sending, by the AAA server, the user token to the BNG;

Sending, by the BNG, the user token to the terminal;

Transmitting, by the terminal, the user token to a server of a third-party service;

The AAA server receives the service request information sent by the server of the third-party service; the service request information includes an Internet Protocol IP address of the terminal, a Transmission Control Protocol TCP/User Datagram Protocol UDP port number, and the third-party service. User token received by the server;

The AAA server determines whether the user token received by the AAA server is equal to the user token stored by the AAA server. If they are equal, the third party service authentication of the terminal is performed.

Correspondingly, the embodiment of the present invention further provides a service authentication method, where the method includes: receiving, by the terminal, an instruction for calling a shared user information to perform third-party service authentication; the shared user information is that the user is performing authentication, authorization, The user information used for the AAA authentication is charged; the terminal sends a request message for acquiring the user token token to the security server; and the request message for obtaining the user token carries the user token type;

The security server generates an authentication confirmation webpage, and stores authentication confirmation information related to the authentication confirmation webpage;

Sending, by the security server, the authentication confirmation webpage to the terminal;

The terminal displays the authentication confirmation webpage, receives authentication confirmation information input by the user, and sends the authentication confirmation information input by the user to the security server;

The security server determines whether the received authentication confirmation information input by the user is consistent with the previously saved authentication confirmation information, and if yes, sends a request message for acquiring the user token to the AAA server;

The AAA server generates a user token and saves the user token and the user token type;

Sending, by the AAA server, the user token to the security server;

Sending, by the security server, the user token to the terminal;

Receiving, by the AAA server, the service request information sent by the server of the third-party service; the service request information includes an IP address of the terminal, a transmission control protocol TCP/user datagram protocol UDP port number, and the third-party service server receives the User token

The AAA server determines that the user token it receives and the user token it holds are No, and determine whether the user token type it receives matches its saved user token type, if the user token it receives is equal to the user token it holds and the user token type it receives and the user token type it holds. Matching, the third party service authentication by the terminal.

Correspondingly, the embodiment of the present invention further provides a service authentication system, where the system includes: a terminal, a broadband service gateway BNG, and an AAA server, where

The terminal is configured to receive an instruction sent by the user to invoke the shared user information to perform third-party service authentication; the shared user information is user information used by the user in performing authentication, authorization, and accounting AAA authentication;

The terminal is further configured to send a request message for acquiring a user token token to the broadband network gateway BNG;

The BNG is configured to send the request message for acquiring a user token to an AAA server; the AAA server is configured to generate a user token and save the message;

The AAA server is further configured to send the user token to the BNG;

The BNG is further configured to send the user token to the terminal;

The terminal is further configured to send the user token to a server of a third-party service;

The AAA server is further configured to receive service request information sent by a server of the third-party service; the service request information includes an Internet Protocol IP address of the terminal, a Transmission Control Protocol TCP/User Datagram Protocol UDP port number, and a a user token received by a server of the third-party service;

The AAA server is further configured to determine whether the user token received by the AAA server is equal to the user token that is saved, and if they are equal, the third-party service authentication of the terminal.

Correspondingly, the embodiment of the present invention further provides a service authentication system, where the system includes: a terminal, an AAA server, and a security server;

The terminal is further configured to send a request message for acquiring a user token token to the security server; the request message for obtaining the user token carries a user token type; The security server is configured to generate an authentication confirmation webpage, save authentication confirmation information related to the authentication confirmation webpage, and send the authentication confirmation webpage to the terminal;

The terminal is further configured to display the authentication confirmation webpage, and receive authentication confirmation information input by the user, where the terminal is further configured to send the authentication confirmation information input by the user to the security server;

The security server is further configured to determine whether the received authentication confirmation information input by the user is consistent with the previously stored authentication confirmation information, and if yes, send a request message for acquiring a user token to the AAA server;

The AAA server is further configured to generate a user token and save the user token and the user token type;

The AAA server is further configured to send the user token to the security server; the security server is further configured to send the user token to the terminal;

The AAA server is further configured to receive service request information sent by a server of the third-party service; the service request information includes an IP address of the terminal, a TCP/UDP port number, and a user token received by the server of the third-party service. ;

The AAA server is further configured to determine whether the user token received by the user token is equal to the user token stored by the user, and whether the type of the user token received by the user token matches the type of the user token it holds, if the user token received by the user is The saved user tokens are equal and the received user token type matches the saved user token type, and the third party service authentication is performed by the terminal.

The service authentication method and system provided by the embodiment of the present invention can provide a user with a third-party service without using a user to input a user name and a password, thereby facilitating the use of the user and improving the user. Experience; At the same time, in the third-party service authentication process, the user token assigned by the AAA server needs to be verified, which can improve the security of the authentication.

BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description only It is only some embodiments of the present invention, and those skilled in the art can obtain other drawings according to these drawings without any creative work.

1 is a schematic flowchart of a service authentication method according to Embodiment 1 of the present invention;

2 is a schematic flowchart of a service authentication method according to Embodiment 2 of the present invention;

3 is a schematic diagram of an interface of an authentication confirmation webpage in an embodiment of the present invention;

4 is a schematic structural diagram of a service authentication system according to Embodiment 3 of the present invention;

FIG. 5 is a schematic structural diagram of a service authentication system according to Embodiment 4 of the present invention.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. example. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

A service authentication method and system are provided in the embodiments of the present invention, which are respectively described in detail below.

Embodiment 1:

The present invention provides a service authentication method, and the network architecture involved in the method includes: a terminal, a BNG, and an AAA server. As shown in FIG. 1, the method includes:

101. The terminal receives an instruction sent by the user to invoke the shared user information to perform third-party service authentication. The shared user information is user information used by the user when performing AAA (Authentication, Authorization, Accounting, Authentication, Authorization, and Accounting) authentication;

For example, the shared user information may be an account name and a password used when the network service provided by the network operator is input when the user accesses the network, for example, the user dials using ADSL (Asymmetric Digital Subscriber Line). The account name and password entered when surfing the Internet;

In this embodiment, if the third-party service provides the function of using the shared user information to perform the third-party service authentication, the third-party service of the third-party service may provide a "one-click authentication" function button, and the function button may be invoked. An application interface for sharing user information provided by the network operator. After the user clicks the function button, the terminal receives the call sharing sent by the user. User information for third-party service certification instructions;

102. The terminal sends a request message for acquiring a user token (token) to a BNG (Broadband Network Gateway, a broadband network gateway);

103. The foregoing BNG sends the foregoing request message for acquiring a user token to the AAA server.

The BNG forwards or transparently transmits the request message for obtaining the user token to the AAA server;

104. The foregoing AAA server generates a user token and saves the user token.

After receiving the request message, the AAA server generates a user token and saves it for subsequent verification;

105. The foregoing AAA server sends the user token to the BNG.

106. The foregoing BNG sends the user token to the terminal.

BNG forwards or transparently transmits the user token to the terminal;

107. The foregoing terminal sends the user token to a server of a third-party service;

108. The AAA server receives the service request information sent by the server of the third-party service, where the service request information includes an IP (Internet Protocol) address of the terminal, and a Transmission Control Protocol (TCP) I UDP (User) Datagram Protocol, User Datagram Protocol) port number and the user token received by the server of the above third party service;

In this embodiment, when the terminal accesses the server of the third-party service, the server of the third-party service can obtain the IP address of the terminal and the TCP/UDP port number; after the server of the third-party service receives the user token sent by the terminal, The IP address of the terminal, the TCP/UDP port number, and the received user token are carried in the service request information and sent to the AAA server.

109. The AAA server determines whether the user token received by the AAA server is equal to the saved user token, and if yes, step 110 is performed; otherwise, step 111 is performed;

The AAA server passes the foregoing third-party service authentication of the terminal; the process ends; preferably, in this embodiment, after the third-party service authentication, the AAA server can delete the previously saved user token, so that each User tokens are only used for one-time service authentication to improve security;

Preferably, in this embodiment, after passing the third-party service authentication, the AAA server may return the corresponding confirmation information to the server of the third-party service, and the server of the third-party service may also send an appropriate confirmation message to the terminal accordingly. The user is informed that the business certification is passed; 111. The foregoing AAA server determines that the third-party service authentication fails.

After determining that the third-party service authentication fails, the AAA server may return a corresponding prompt message to the server of the third-party service, and the server of the third-party service may correspondingly send an appropriate prompt message to the terminal to enable the user to learn that the service authentication fails.

The service authentication method provided in this embodiment provides a scheme for using the shared user information for authentication, so that the user does not need to input a user name and password when using the third-party service, thereby facilitating the user's use and improving the user experience; In the third-party service authentication process, the user token assigned by the AAA server needs to be verified to improve the security of the authentication.

Further, after step 104, the method further includes:

The above AAA server starts a timer; the timing of the timer may be preset, for example, but not limited to 1 minute;

If the timer expires, the AAA server deletes the user token generated and saved in step 104.

Further, the service request information of the server from the third party service received by the AAA server in step 108 may include at least one of the following request information:

Authentication request information;

Billing request information;

Request information for information acquisition;

QOS (Quality Of Service) control request information.

Further, if the service request information includes the charging request information, the method may further include: the AAA server charging the fee generated by the terminal in the process of using the third-party service according to the IP address and the TCP/UDP port number. . In this way, the user can use the account provided by the network operator to consume the third-party service, which facilitates unified billing management.

Embodiment 2:

The invention also provides a service authentication method, and the network architecture involved in the method includes: a terminal, a security server, and an AAA server. As shown in FIG. 2, the method includes:

201. The terminal receives an instruction sent by the user to invoke the shared user information to perform third-party service authentication. The shared user information is user information used by the user when performing AAA authentication.

For example, the shared user information may be an account name and a password used when the network service provided by the network operator is input when the user accesses the network, for example, the user uses China Telecom ADSL. (Asymmetric Digital Subscriber Line, Asymmetric Digital Subscriber Line) Enter the account name and password when dialing up;

In this embodiment, if the third-party service provides the function of using the shared user information to perform the third-party service authentication, the third-party service of the third-party service may provide a "one-click authentication" function button, and the function button may be invoked. An application program interface for sharing user information provided by the network operator, after the user clicks the function button, the terminal receives an instruction sent by the user to invoke the shared user information for third-party service authentication;

202. The terminal sends a request message for obtaining a user token to the security server. The request message for obtaining the user token carries the user token type, where the user token type may be at least one of the following types: authentication, accounting, and information. Acquisition, QOS control;

The request message or other message that the terminal sends to the security server to obtain the user token may be sent to the BNG first and then forwarded by the BNG or transparently transmitted to the security server, and details are not described herein;

203. The security server generates an authentication confirmation webpage, and stores authentication confirmation information related to the authentication confirmation webpage.

204. The security server sends the authentication confirmation webpage to the terminal.

The authentication confirmation webpage or other message sent by the security server to the terminal may be sent to the BNG first and then forwarded to the terminal by the BNG or transparently transmitted to the terminal, and details are not described herein;

205. The terminal displays the authentication confirmation webpage, and receives the authentication confirmation information input by the user. In this embodiment, the authentication confirmation webpage may be an interface as shown in FIG. 3, and prompts the user to input a verification code, and the verification code may be in the form of a text. Numbers or other suitable formats are not specifically limited herein;

206. The terminal sends the authentication confirmation information input by the user to the security server.

207, the security server determines whether the received authentication confirmation information input by the user is consistent with the previously stored authentication confirmation information, if yes, step 208 is performed, otherwise step 209 is performed;

208, the security server sends a request message for obtaining a user token to the AAA server; and step 210 is performed;

If the verification is passed, the security server sends a request message for acquiring the user token to the AAA server;

209, the security server returns a prompt message to the terminal, and returns to step 203;

If the verification fails, the security server may return a prompt message that the verification fails, and returns to step 203 to continue the verification; The AAA server generates a user token and saves the user token and the user token type. Specifically, the AAA server may generate a user token matching the user token type according to the received user token type.

211. The foregoing AAA server sends the user token to the security server.

212. The foregoing security server sends the user token to the terminal.

213. The terminal sends the user token to a server of a third-party service.

214. The foregoing AAA server receives the service request information sent by the server of the third-party service, where the service request information includes an Internet Protocol IP address of the terminal, a Transmission Control Protocol TCP/User Datagram Protocol UDP port number, and a received user token.

When the terminal accesses the server of the third-party service, the server of the third-party service can obtain the IP address of the terminal and the TCP/UDP port number; after receiving the user token sent by the terminal, the server of the third-party service can set the IP of the terminal. The address, the TCP/UDP port number, and the received user token are carried in the service request information and sent to the AAA server;

215. The AAA server determines whether the user token received by the AAA server is equal to the saved user token, and determines whether the type of the user token received by the AAA server matches the type of the user token it holds, if the user token received by the user token is the same as the saved token. The user token is equal and the type of the user token it receives matches the type of the user token it holds, step 216 is performed, otherwise step 217 is performed;

216. The AAA server passes the foregoing third-party service authentication of the terminal, and ends the process. After the third-party service is authenticated, the AAA server may delete the previously saved user token, so that each user token is used only for one service authentication. , improve safety;

After passing the third-party service authentication, the AAA server may also return corresponding confirmation information to the server of the third-party service;

217. The AAA server determines that the third-party service authentication of the terminal fails. After determining that the third-party service authentication fails, the AAA server may return the corresponding prompt information to the server of the third-party service.

The service authentication method provided in this embodiment provides a scheme for using the shared user information for authentication, so that the user does not need to input the user name and password when using the third-party service, thereby facilitating the use of the user and improving the user experience. Different from the first embodiment, in this embodiment, the security server can provide security verification for calling third party service authentication by sharing user information, and preventing The user's misoperation or malicious operation of some illegal programs further improves the security of the service authentication method and prevents the user's interests from being lost.

Further, after step 210, the method may further include:

If the timer expires, the AAA server deletes the user token generated and saved in step 210.

Further, the service request information of the server from the third party service received by the AAA server in step 214 may include at least one of the following request information:

Authentication request information;

Billing request information;

Request information for information acquisition;

QOS (Quality Of Service) control request information.

Embodiment 3:

The present invention also provides a service authentication system. As shown in FIG. 4, the system may include: a terminal 100, a BNG 200, and an AAA server 300, where

The terminal 100 may be configured to receive an instruction sent by the user to invoke the shared user information to perform third-party service authentication. The shared user information is user information used by the user in performing authentication, authorization, and accounting AAA authentication; for example, sharing user information may be It is the account name and password used when the network service provided by the network operator is input when the user accesses the network. For example, the account name and password entered when the user dials the Internet using ADSL (Asymmetric Digital Subscriber Line). In this embodiment, if the third-party service provides the function of using the shared user information to perform the third-party service authentication, the third-party service of the third-party service may provide a "one-click authentication" function button, and the function button may be invoked. An application program interface for sharing user information provided by the network operator, after the user clicks the function button, the terminal receives an instruction sent by the user to invoke the shared user information for third-party service authentication; The terminal 100 is further configured to send a request message for acquiring a user token to the BNG 200.

The BNG 200 can be configured to send the foregoing request message for acquiring a user token to the AAA server 300;

The AAA server 300 can be used to generate a user token and save; after receiving the request message, the AAA server 300 generates a user token and saves it for subsequent verification;

The AAA server 300 can also be configured to send the user token to the BNG 200;

The BNG 200 can also be used to send the user token to the terminal 100;

The terminal 100 can also be used to send the user token to the server of the third party service;

The AAA server 300 is further configured to receive service request information sent by the server of the third-party service, where the service request information includes an Internet Protocol IP address of the terminal, a Transmission Control Protocol TCP/User Datagram Protocol UDP port number, and the foregoing third-party service. The user token received by the server; in this embodiment, when the terminal accesses the server of the third-party service, the server of the third-party service can obtain the IP address of the terminal and the TCP/UDP port number; the server of the third-party service receives the After the user token is sent by the terminal, the IP address of the terminal, the TCP/UDP port number, and the received user token are carried in the service request information and sent to the AAA server.

The AAA server 300 can also be used to determine whether the user token received by the user token is equal to the user token stored by the terminal. If they are equal, the third-party service authentication of the terminal is determined, otherwise the third-party service authentication fails.

Preferably, in this embodiment, after the AAA server passes the foregoing third-party service authentication of the terminal, the AAA server may delete the previously saved user token, so that each user token can be used only for one service authentication, thereby improving security. After passing the third-party service authentication, the AAA server can also return the corresponding confirmation information to the server of the third-party service.

Preferably, in this embodiment, after the AAA server determines that the third-party service authentication fails, the AAA server may also return corresponding prompt information to the server of the third-party service.

The service authentication system provided by the embodiment provides a scheme for using the shared user information for authentication, so that the user does not need to input the user name and password when using the third-party service, thereby facilitating the user's use and improving the user experience; In the third-party service authentication process, the user token assigned by the AAA server needs to be verified to improve the security of the authentication.

Further, the AAA server may further start a timer after the user token is generated and saved, where the timer time may be preset, such as but not limited to 1 minute; the AAA server may also be used to perform the foregoing timing. Timeout, delete the saved user token. Further, the service request message of the server from the third-party service received by the AAA server may include at least one of the following request information:

Authentication request information;

Billing request information;

Request information for information acquisition;

QOS (Quality Of Service) control request information.

Further, if the service request information includes the charging request information, the AAA server may be further configured to: charge the fee generated by the terminal in the process of using the third party service according to the IP address and the TCP/UDP port number. In this way, the user can use the account provided by the network operator to consume the third-party service, which facilitates unified billing management.

Embodiment 4:

The present invention further provides a service authentication system. As shown in FIG. 5, the system may include: a terminal 100, an AAA server 300, and a security server 400, where

The terminal 100 is configured to receive an instruction that is sent by the user to invoke the shared user information to perform third-party service authentication. The shared user information is user information used by the user when performing AAA authentication. For example, the shared user information may be when the user accesses the network. The account name and password used when entering the network service provided by the network operator, for example, the account name and password entered by the user when dialing the Internet using ADSL (Asymmetric Digital Subscriber Line); In this embodiment, The third-party service provides the function of using the shared user information for third-party service authentication. The third-party service web page or interface displayed by the terminal can provide a "one-click authentication" function button, and the function button can call the sharing provided by the network operator. The application interface of the user information, after the user clicks the function button, the terminal receives an instruction sent by the user to invoke the shared user information for third-party service authentication;

The terminal 100 is further configured to send a request message for acquiring a user token to the security server; the request message for acquiring the user token carries a user token type;

The security server 400 is configured to generate an authentication confirmation webpage, save the authentication confirmation information related to the authentication confirmation webpage, and send the authentication confirmation webpage to the terminal;

The terminal 100 is further configured to display the authentication confirmation webpage, and receive the authentication confirmation information input by the user, and send the authentication confirmation information input by the user to the security server. In this embodiment, the authentication confirmation webpage may be an interface as shown in FIG. , prompting the user to enter a verification code, the form of the verification code can be It is a text, a number or other suitable format and is not specifically limited herein;

The security server 400 is further configured to determine whether the received authentication confirmation information input by the user is consistent with the previously saved authentication confirmation information. If they are consistent, the request message for acquiring the user token may be sent to the AAA server, otherwise the prompt information may be returned to the BNG. The BNG forwards the prompt message to the terminal to prompt the user to perform the re-authentication; the token type; specifically, the user token generated by the AAA server matches the user token type;

The AAA server 300 is further configured to send the user token to the terminal 100;

The terminal 100 is further configured to send the user token to a server of a third-party service;

The AAA server 300 is further configured to receive service request information sent by the server of the third-party service, where the service request information includes an Internet Protocol IP address of the terminal, a TCP/User Datagram Protocol (UDP) port number, and a server of the third-party service. The received user token; wherein, when the terminal accesses the server of the third-party service, the server of the third-party service can obtain the IP address of the terminal and the TCP/UDP port number; the server of the third-party service receives the user sent by the terminal. After the token, the IP address of the terminal, the TCP/UDP port number, and the received user token are carried in the service request information and sent to the AAA server.

The AAA server 300 is further configured to determine whether the user token received by the user token is equal to the saved user token, and whether the type of the user token received by the user token matches the type of the user token it holds, if the user token received by the user token is saved. The user tokens are equal and the type of the user token received is matched with the type of the user token that is stored, and the third-party service authentication is performed by the terminal. Otherwise, the third-party service authentication fails.

In this embodiment, after the third-party service is authenticated, the AAA server 300 can delete the previously saved user token, so that each user token can be used only for one service authentication, thereby improving security; Afterwards, the AAA server 300 can also return corresponding confirmation information to the server of the third-party service;

In this embodiment, after determining that the third-party service authentication fails, the AAA server 300 may return the corresponding prompt information to the server of the third-party service.

It should be noted that, in this embodiment, the system may further include a BNG, and the BNG may serve as a information relay between the terminal and the security server, that is, the received message from the terminal may be forwarded or transparently transmitted to the terminal. The secure server can also forward or transparently receive the received message from the secure server to Terminal.

The service authentication system provided in this embodiment provides a scheme for using the shared user information for authentication, so that the user does not need to input a user name and password when using the third-party service, thereby facilitating the use of the user and improving the user experience. Different from the third embodiment, in this embodiment, the security server can provide security verification for invoking the shared user information for third-party service authentication, preventing user misoperation or malicious operation of some illegal programs, and further improving the service authentication method. Security, to prevent the loss of the user's interests.

Further, the AAA server may further start a timer after the user token is generated and saved, where the timer time may be preset, such as but not limited to 1 minute; the AAA server may also be used to perform the foregoing timing. Timeout, delete the saved user token. Further, the service request message of the server from the third party service received by the AAA server may include at least one of the following request information:

Authentication request information;

Billing request information;

Request information for information acquisition;

QOS (Quality Of Service) control request information.

The above embodiments are all based on the same inventive concept, and the descriptions in the respective embodiments are different, and the descriptions in the other embodiments are not exhaustive, and the descriptions in other embodiments may be referred to.

A person of ordinary skill in the art may understand that all or part of the steps of the foregoing embodiments may be performed by a program to instruct related hardware. The program may be stored in a computer readable storage medium, and the storage medium may include: Flash disk, read-only memory (Read-Only Memory,

ROM), Random Access Memory (RAM), disk or CD.

The service authentication method and system provided by the embodiments of the present invention are described in detail above.

The present invention is only used to help understand the method of the present invention and its core ideas; at the same time, for those skilled in the art, according to the idea of the present invention, there will be changes in the specific implementation and application scope. In the above, the contents of this specification are not to be construed as limiting the invention.

Claims

Rights request

1. A business authentication method, characterized by including:

The terminal receives the instruction sent by the user to call the shared user information for third-party service authentication; the shared user information is the user information used by the user when performing authentication, authorization, and accounting AAA authentication; the terminal sends the instruction to obtain the user token token. Request message to Broadband Network Gateway BNG;

The BNG sends the request message for obtaining the user token to the AAA server;

The AAA server generates a user token and saves it;

The AAA server sends the user token to the BNG;

The BNG sends the user token to the terminal;

The terminal sends the user token to a third-party service server;

The AAA server receives the service request information sent by the server of the third-party service; the service request information includes the Internet Protocol IP address of the terminal, the Transmission Control Protocol TCP/User Datagram Protocol UDP port number and the number of the third-party service The user token received by the server;

The AAA server determines whether the user token it receives is equal to the user token it saves. If they are equal, the third-party service authentication of the terminal is passed.

2. The method according to claim 1, characterized in that, after the AAA server generates a user token and saves the user token, the method further includes:

The AAA server starts the timer;

The method also includes:

If the timer times out, the AAA server deletes the user token saved by it.

3. The method according to claim 1 or 2, characterized in that, the method further includes: the AAA server determines whether the terminal is using a third-party service based on the IP address and the TCP/UDP port number. Charges incurred will be billed.

4. A business authentication method, characterized in that the method includes:

The terminal receives the instruction sent by the user to call the shared user information for third-party service authentication; the shared user information is the user information used by the user when performing authentication, authorization, and accounting AAA authentication; the terminal sends the instruction to obtain the user token token. The request message is sent to the security server; the request message for obtaining the user token carries the user token type;

The security server generates an authentication confirmation web page, and saves the authentication information related to the authentication confirmation web page. Certificate confirmation information;

The security server sends the authentication confirmation web page to the terminal;

The terminal displays the authentication confirmation web page, receives the authentication confirmation information input by the user, and sends the authentication confirmation information input by the user to the security server;

The security server determines whether the received authentication confirmation information input by the user is consistent with the previously saved authentication confirmation information. If consistent, sends a request message to obtain the user token to the AAA server;

The AAA server sends the user token to the security server;

The security server sends the user token to the terminal;

The terminal sends the user token to a third-party service server;

The AAA server receives the service request information sent by the server of the third-party service; the service request information includes the IP address of the terminal, the Transmission Control Protocol TCP/User Datagram Protocol UDP port number and the server of the third-party service received The user token received;

The AAA server determines whether the user token it receives is equal to the user token it saves, and determines whether the user token type it receives matches the user token type it saves. If the user token it receives matches the user token type it saves, If the user tokens are equal and the user token type received matches the user token type saved, the third-party service authentication of the terminal is passed.

5. The method according to claim 4, characterized in that, after the AAA server generates a user token and saves the user token and the user token type, the method further includes: the AAA server starts a timer ;

The method also includes:

If the timer times out, the AAA server deletes the user token and user token type it has saved.

6. The method according to claim 4 or 5, characterized in that, the method further includes: the AAA server determines whether the terminal is using a third-party service based on the IP address and the TCP/UDP port number. Charges incurred will be billed.

7. A service authentication system, characterized in that the system includes: a terminal, a broadband service network Off BNG, AAA server, among which,

The terminal is used to receive instructions sent by users to invoke shared user information for third-party service authentication; the shared user information is user information used by users when performing authentication, authorization, and accounting AAA authentication;

The terminal is also used to send a request message to obtain the user token token to the broadband network gateway BNG;

The BNG is used to send the request message for obtaining the user token to the AAA server; the AAA server is used to generate the user token and save it;

The AAA server is also used to send the user token to the BNG;

The BNG is also used to send the user token to the terminal;

The terminal is also used to send the user token to a server of a third-party service;

The AAA server is also used to receive service request information sent by the third-party service server; the service request information includes the Internet Protocol IP address of the terminal, Transmission Control Protocol TCP/User Datagram Protocol UDP port number and all The user token received by the server of the above-mentioned third-party business;

The AAA server is also used to determine whether the user token it receives is equal to the user token it saves. If they are equal, the third-party service authentication of the terminal is passed.

8. The system according to claim 7, wherein the AAA server is also configured to start a timer after generating and saving a user token; and to delete the saved user token when the timer times out. .

9. The system according to claim 7 or 8, characterized in that the AAA server is also used to calculate the fees incurred by the terminal in using third-party services based on the IP address and the TCP UDP port number. Perform billing.

10. A service authentication system, characterized in that the system includes: a terminal, an AAA server and a security server; wherein the terminal is used to receive an instruction sent by a user to invoke shared user information for third-party service authentication; Shared user information is the user information used by users for authentication, authorization, and accounting AAA authentication;

The terminal is also used to send a request message to obtain a user token to the security server; the request message to obtain a user token carries a user token type;

The security server is configured to generate an authentication confirmation web page, save authentication confirmation information related to the authentication confirmation web page, and send the authentication confirmation web page to the terminal; The terminal is also used to display the authentication confirmation web page, receive the authentication confirmation information input by the user, and the terminal is also used to send the authentication confirmation information input by the user to the security server;

The security server is also used to determine whether the received authentication confirmation information input by the user is consistent with the previously saved authentication confirmation information. If they are consistent, send a request message to obtain the user token to the AAA server;

The AAA server is also used to generate a user token and save the user token and the user token type;

The AAA server is also used to send the user token to the security server; the security server is also used to send the user token to the terminal;

The AAA server is also used to receive service request information sent by the server of the third-party service; the service request information includes the IP address of the terminal, the TCP/UDP port number, and the user token received by the server of the third-party service. ;

The AAA server is also used to determine whether the user token it receives is equal to the user token it saves, and to determine whether the user token type it receives matches the user token type it saves. If the user token it receives matches its saved user token type, If the saved user tokens are equal and the received user token type matches the saved user token type, the third-party service authentication of the terminal is passed.

11. The system according to claim 10, wherein the AAA server is further configured to start a timer after generating and saving a user token; and to delete the saved user token when the timer times out. .

12. The system according to claim 10 or 11, characterized in that, the AAA server is also used to analyze the data generated by the terminal during the use of third-party services based on the IP address and the TCP/UDP port number. Fees are billed.