WO2016154813A1

WO2016154813A1 - User authentication method, apparatus and system

Info

Publication number: WO2016154813A1
Application number: PCT/CN2015/075279
Authority: WO
Inventors: 桂亦慧; 饶超; 张晟; 田春长
Original assignee: 华为技术有限公司
Priority date: 2015-03-27
Filing date: 2015-03-27
Publication date: 2016-10-06
Also published as: CN107079008A; CN107079008B

Abstract

Provided are a user authentication method, apparatus and system. The user authentication method in the present invention comprises: receiving an application registration request sent by a user equipment (UE), wherein the application registration request comprises information about a first application in which the UE requests registration; querying a service identifier of the first application and a user identifier of the UE according to the application registration request; sending an account registration request to a core network device, wherein the account registration request comprises the service identifier and the user identifier; and acquiring the application account from the core network device so as to take the application account as an authentication identifier for the UE to subsequently log into the first application, and returning an application registration response to the UE. The embodiments of the present invention solve the limitation in platform application management, reduce user information redundancy, reduce management loads, and improve the efficiency of system authorization.

Description

User authentication method, device and system

Technical field

The embodiments of the present invention relate to communication technologies, and in particular, to a user authentication method, apparatus, and system.

Background technique

Authentication refers to verifying that a user has the right to access the system. The traditional authentication is verified by a password. The premise of this method is that each user who has obtained the password has been authorized. When the user registers, the user is assigned a username and password, and the user uses the username and The password is logged in, and the system completes the user authentication by verifying that the username and password are valid.

Open Mobile Platform (OMP) is China Mobile's comprehensive, standards-based comprehensive platform for meeting the development needs of mobile Internet services. OMP integrates the basic capabilities of the Internet and telecommunications, and can provide application programming interfaces. (Application Programming Interface, API for short) can also be used as an operation management platform. OMP provides unified authentication services for applications published on the platform. These applications are used as part of the OMP service. The authentication center manages user information in a unified manner. When users use an application on the OMP, enter the corresponding user name. And the password, the authentication center authenticates it, and the user who passes the authentication can use the application.

However, the OMP platform authentication mechanism can only complete the authentication of the application published on the platform. The application requires the application to be part of the OMP service, which has certain limitations, and the user information management is for each application, resulting in A large amount of user information redundancy increases the management load and affects the efficiency of system authentication.

Summary of the invention

The embodiment of the invention provides a user authentication method, device and system, which can solve the limitation of platform application management, reduce user information redundancy, reduce management load, and improve system authentication efficiency.

In a first aspect, an embodiment of the present invention provides a user authentication method, including:

Receiving an application registration request sent by the user equipment UE, where the application registration request includes information about the first application that the UE requests to register;

Querying, according to the application registration request, a service identifier of the first application and a user identifier of the UE;

Sending an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device allocates the login to the first application according to the account registration request. Applying an account and sending the application account to the application server of the first application;

Acquiring the application account from the core network device to use the application account as the authentication identifier of the UE to log in to the first application, and return an application registration response to the UE.

With reference to the first aspect, in a first possible implementation manner of the first aspect, before the receiving the application registration request sent by the user equipment UE, the method further includes:

Obtaining, from the core network device, a service identifier allocated by the core network device to a pre-registered application.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the acquiring, by the core network device, the application account to use the application account After the UE subsequently logs in to the authentication identifier of the first application, and returns an application registration response to the UE, the method further includes:

Receiving an application login request sent by the UE, where the application login request includes information about the second application that the UE requests to log in;

Querying, according to the application login request, the application account that the UE logs in to the second application;

Sending the application account to the application server of the second application, so that the application server authenticates the application account and returns an authentication response;

Receiving the authentication response from the application server, and feeding back the login result to the UE according to the authentication response.

With the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, after the querying, by the application login request, the UE logs in to an application account of the second application, Also includes:

If the application account is not queried, the account acquisition request is sent to the core network device, where the account acquisition request includes the service identifier and the user identifier, and the application account is obtained from the core network device.

In combination with the second or third possible implementation of the first aspect, the fourth aspect in the first aspect In a possible implementation, after the querying, by the application login request, the UE to log in to the application account of the second application, the method further includes:

If the two or more application accounts are queried, the two or more application accounts are sent to the UE, and the application account that is sent by the UE to log in to the second application is received.

With reference to the first aspect, in a fifth possible implementation manner of the first aspect, before the receiving the application registration request sent by the user equipment UE, the method further includes:

Receiving, by the core network device, a user identifier allocated to the UE according to a virtual machine registration request sent by the UE;

Allocating a virtual machine to the UE according to the user identifier, and returning a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device according to the The virtual machine allocation response stores the username and password of the UE and returns a virtual machine registration response to the UE.

With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, the virtual machine registration request includes a user name, a password, and a temporary Identifier.

With reference to the fifth possible implementation of the first aspect, in a seventh possible implementation manner of the first aspect, the virtual machine registration request includes using user information of the UE;

The method further includes: assigning a virtual machine to the UE according to the user identifier,

The username and password are randomly generated for the UE.

With the possible implementation of any one of the fifth to seventh aspects of the first aspect, in an eighth possible implementation manner of the first aspect, the assigning a virtual machine to the UE according to the user identifier, After returning the virtual machine allocation response to the core network device, the method further includes:

Receiving a virtual machine login request of the UE, where the virtual machine login request includes a username and a password of the UE;

Sending the user name and password of the UE to the core network device, so that the core network device authenticates the UE according to the user name and password of the UE, and returns an authentication response, where the authentication response includes User identifier of the UE;

Starting the virtual machine allocated for the UE according to the user identifier, and returning a virtual machine login response to the UE.

In combination with any of the fifth to eighth possible implementations of the first aspect, in a first aspect The ninth possible implementation manner, after the allocating a virtual machine to the UE according to the user identifier, and returning the virtual machine allocation response to the core network device, the method further includes:

Receiving a virtual machine removal request sent by the core network device after authenticating the UE according to the virtual machine logout request sent by the UE and querying the user identifier of the UE, where the virtual machine removal request includes the user of the UE Identification

And deleting the virtual machine allocated to the UE according to the virtual machine destruction request, and deleting configuration information corresponding to the user identifier of the UE.

In a second aspect, an embodiment of the present invention provides a user authentication method, including:

Receiving an account registration request sent by the mobile virtualization device, where the account registration request includes a service identifier of the first application requested by the user equipment UE and a user identifier of the UE;

Assigning, to the UE, an application account that is logged in to the first application according to the account registration request;

Sending the application account to the mobile virtualization device and the application server of the first application.

With reference to the second aspect, in a first possible implementation manner of the second aspect, before the receiving the account registration request sent by the mobile virtualization device, the method further includes:

Assigning a service identifier to the pre-registered application and transmitting the service identifier to the mobile virtualization device.

With the second aspect or the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the sending the application account to the mobile virtualization device and the After an application server, it also includes:

Receiving an account acquisition request sent by the mobile virtualization device after the UE is logged in to the application account of the second application, where the account acquisition request includes the service identifier of the second application and the user identifier of the UE;

Returning the application account to the mobile virtualization device according to the account acquisition request.

With the second aspect or the first possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, before the receiving the account registration request sent by the mobile virtualization device, the method further includes:

Receiving a virtual machine registration request sent by the UE, and assigning a user identifier to the UE according to the virtual machine registration request;

Sending the user identifier to the mobile virtualization device to cause the mobile virtualization device root Allocating a virtual machine to the UE according to the user identifier;

Receiving a virtual machine allocation response sent by the mobile virtualization device, where the virtual machine allocation response includes a username and a password of the UE;

The user name and password of the UE are stored, and a virtual machine registration response is returned to the UE.

With reference to the third possible implementation of the second aspect, in a fourth possible implementation manner of the second aspect, the virtual machine registration request includes a user name, a password, and a temporary Identification code; or,

The virtual machine registration request includes user information using the UE.

With reference to the third or fourth possible implementation of the second aspect, in a fifth possible implementation manner of the second aspect, the user name and password of the UE are stored, and the virtual machine is returned to the UE After registering for the response, it also includes:

Receiving, by the mobile virtualization device, a user name and a password of the UE that are sent according to a virtual machine login request sent by the UE, where the virtual machine login request includes a username and a password of the UE;

And authenticating the UE according to the user name and password of the UE, and returning an authentication response, where the authentication response includes a user identifier of the UE, so that the mobile virtualization device is started according to the user identifier. The virtual machine allocated by the UE, and returning a virtual machine login response to the UE.

With reference to the possible implementation of any one of the third to fifth aspects of the second aspect, in a sixth possible implementation manner of the second aspect, the user name and password of the UE are stored, and After the UE returns the virtual machine registration response, it also includes:

Receiving a virtual machine logout request sent by the UE, where the virtual machine logout request includes a username and a password of the UE;

And authenticating the UE according to the virtual machine logout request, and querying a user identifier of the UE;

Sending a virtual machine removal request to the mobile virtualization device, the virtual machine removal request including the user identification to cause the mobile virtualization device to remove a virtual machine allocated to the UE according to the virtual machine removal request, And deleting configuration information corresponding to the user identifier;

The configuration information corresponding to the user identifier is deleted, and the virtual machine logout response is returned to the UE.

In a third aspect, an embodiment of the present invention provides a user authentication method, including:

Receiving an application account sent by the core network device, where the application account is used by the core network device The user equipment UE requests the application account allocated when registering the first application.

With reference to the third aspect, in a first possible implementation manner of the third aspect, after receiving the application account that is sent by the core network device, the method further includes:

Receiving an application account that is sent by the mobile virtualization device, where the application account is an application account of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE;

And authenticating the application account, and returning an authentication response to the mobile virtualization device.

In a fourth aspect, an embodiment of the present invention provides a mobile virtual device, including:

a receiving module, configured to receive an application registration request sent by the user equipment UE, where the application registration request includes information about the first application that the UE requests to register;

a processing module, configured to query, according to the application registration request, a service identifier of the first application and a user identifier of the UE;

a sending module, configured to send an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device allocates a login office to the UE according to the account registration request. Transmitting an application account of the first application and sending the application account to an application server of the first application;

The receiving module is further configured to acquire the application account from the core network device to use the application account as an authentication identifier of the UE to log in to the first application, and return an application registration response to the UE.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the receiving module is further configured to obtain, from the core network device, a service identifier that is allocated by the core network device to a pre-registered application.

With reference to the fourth aspect, or the first possible implementation manner of the fourth aspect, in a second possible implementation manner of the fourth aspect, the receiving module is further configured to receive an application login request sent by the UE, where the application is The login request includes information of the second application that the UE requests to log in;

The processing module is further configured to query, according to the application login request, the application account of the UE to log in to the second application;

The sending module is further configured to send the application account to the application server of the second application, so that the application server authenticates the application account and returns an authentication response;

The receiving module is further configured to receive the authentication response from the application server, according to the The authentication response feeds back the login result to the UE.

In conjunction with the second possible implementation of the fourth aspect, in a third possible implementation manner of the fourth aspect, the sending module is further configured to: if the application account is not queried, to the core network The device sends an account acquisition request, where the account acquisition request includes the service identifier and the user identifier;

The receiving module is further configured to acquire the application account from the core network device.

With reference to the second or third possible implementation manner of the fourth aspect, in a fourth possible implementation manner of the fourth aspect, the sending module is further configured to: if two or more application accounts are queried, Sending the two or more application accounts to the UE;

The receiving module is further configured to receive an application account that is sent by the UE and is selected to log in to the second application.

With reference to the fourth aspect, in a fifth possible implementation manner of the fourth aspect, the receiving module is further configured to receive, by the core network device, a user identifier that is allocated to the UE according to a virtual machine registration request sent by the UE;

The processing module is further configured to allocate a virtual machine to the UE according to the user identifier;

The sending module is further configured to return a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device allocates response according to the virtual machine allocation The user name and password of the UE and return a virtual machine registration response to the UE.

With reference to the fifth possible implementation manner of the fourth aspect, in a sixth possible implementation manner of the fourth aspect, the virtual machine registration request includes a user name, a password, and a temporary Identifier.

With reference to the fifth possible implementation manner of the fourth aspect, in a seventh possible implementation manner of the fourth aspect, the virtual machine registration request includes using user information of the UE;

The processing module is further configured to randomly generate the user name and password for the UE while allocating a virtual machine to the UE according to the user identifier.

With reference to any one of the fifth to seventh possible implementation manners of the fourth aspect, in the eighth possible implementation manner of the fourth aspect, the receiving module is further configured to receive a virtual machine login request of the UE The virtual machine login request includes a username and a password of the UE;

The sending module is further configured to send the username and password of the UE to the core network And the core network device performs authentication on the UE according to the username and password of the UE, and returns an authentication response, where the authentication response includes a user identifier of the UE;

The processing module is further configured to start, according to the user identifier, the virtual machine allocated for the UE;

The sending module is further configured to return a virtual machine login response to the UE.

With reference to any one of the fifth to eighth possible implementations of the fourth aspect, in a ninth possible implementation manner of the fourth aspect, the receiving module is further configured to receive the core network device Deleting a virtual machine removal request sent after the UE is authenticated according to a virtual machine logout request sent by the UE and querying the user identifier of the UE, where the virtual machine removal request includes a user identifier of the UE;

The processing module is further configured to remove the virtual machine allocated to the UE according to the virtual machine destruction request, and delete configuration information corresponding to the user identifier of the UE.

In a fifth aspect, an embodiment of the present invention provides a core network device, including:

a receiving module, configured to receive an account registration request sent by the mobile virtualization device, where the account registration request includes a service identifier of the first application that the user equipment UE requests to register, and a user identifier of the UE;

a processing module, configured to allocate, according to the account registration request, an application account that is used to log in to the first application;

And a sending module, configured to send the application account to the mobile virtualization device and the application server of the first application.

With reference to the fifth aspect, in a first possible implementation manner of the fifth aspect, the processing module is further configured to allocate a service identifier to the pre-registered application;

The sending module is further configured to send the service identifier to the mobile virtualization device.

With reference to the fifth aspect, or the first possible implementation manner of the fifth aspect, in a second possible implementation manner of the fifth aspect, the receiving module is further configured to receive that the mobile virtualization device is not obtained An account obtaining request sent by the UE after logging in to the application account of the second application, where the account obtaining request includes the service identifier of the second application and the user identifier of the UE;

The sending module is further configured to return the application account to the mobile virtualization device according to the account acquisition request.

In combination with the fifth aspect or the first possible implementation of the fifth aspect, the third aspect of the fifth aspect In a possible implementation manner, the receiving module is further configured to receive a virtual machine registration request sent by the UE;

The processing module is further configured to allocate a user identifier to the UE according to the virtual machine registration request;

The sending module is further configured to send the user identifier to the mobile virtualization device, so that the mobile virtualization device allocates a virtual machine to the UE according to the user identifier;

The receiving module is further configured to receive a virtual machine allocation response sent by the mobile virtualization device, where the virtual machine allocation response includes a username and a password of the UE;

The processing module is further configured to store a username and a password of the UE;

The sending module is further configured to return a virtual machine registration response to the UE.

With reference to the third possible implementation manner of the fifth aspect, in a fourth possible implementation manner of the fifth aspect, the virtual machine registration request includes a user name, a password, and a temporary Identification code; or,

With reference to the third or fourth possible implementation manner of the fifth aspect, in a fifth possible implementation manner of the fifth aspect, the receiving module is further configured to receive, according to the UE, the mobile virtualization device a user name and a password of the UE sent by the virtual machine login request, where the virtual machine login request includes a username and a password of the UE;

The processing module is further configured to perform authentication on the UE according to the username and password of the UE;

The sending module is further configured to: return an authentication response, where the authentication response includes a user identifier of the UE, so that the mobile virtualization device starts the virtual machine allocated to the UE according to the user identifier. And returning a virtual machine login response to the UE.

With reference to the possible implementation of any one of the third to fifth aspects of the fifth aspect, in a sixth possible implementation manner of the fifth aspect, the receiving module is further configured to receive a virtual machine logout sent by the UE The request, the virtual machine logout request includes a username and a password of the UE;

The processing module is further configured to perform authentication on the UE according to the virtual machine logout request, and query a user identifier of the UE;

The sending module is further configured to send a virtual machine removal request to the mobile virtualization device, where the virtual machine removal request includes the user identifier, so that the mobile virtualization device removes the allocation according to the virtual machine removal request. Giving the virtual machine of the UE, and deleting the corresponding to the user identifier Configuration information;

The processing module is further configured to delete configuration information corresponding to the user identifier;

The sending module is further configured to return a virtual machine logout response to the UE.

In a sixth aspect, an embodiment of the present invention provides an application server, including:

The receiving module is configured to receive an application account that is sent by the core network device, where the application account is an application account that is allocated when the core network device requests the user equipment UE to register the first application.

With reference to the sixth aspect, in a first possible implementation manner of the sixth aspect, the method further includes: a processing module and a sending module;

The receiving module is further configured to receive an application account that is sent by the mobile virtualization device, where the application account is an application account of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE. ;

The processing module is configured to authenticate the application account;

The sending module is configured to return an authentication response to the mobile virtualization device.

A seventh aspect of the present invention provides a mobile virtual device, including:

a receiver, configured to receive an application registration request sent by the user equipment UE, where the application registration request includes information about the first application that the UE requests to register;

a processor, configured to query, according to the application registration request, a service identifier of the first application and a user identifier of the UE;

a sender, configured to send an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device allocates a login office to the UE according to the account registration request. Transmitting an application account of the first application and sending the application account to an application server of the first application;

The receiver is further configured to acquire the application account from the core network device to use the application account as an authentication identifier of the UE to log in to the first application, and return an application registration response to the UE.

With reference to the seventh aspect, in a first possible implementation manner of the seventh aspect, the receiver is further configured to obtain, from the core network device, a service identifier that is allocated by the core network device to a pre-registered application.

With reference to the seventh aspect, or the first possible implementation manner of the seventh aspect, in a second possible implementation manner of the seventh aspect, the receiver is further configured to receive an application login request sent by the UE, The application login request includes information of a second application that the UE requests to log in;

The processor is further configured to query, according to the application login request, the application account of the UE to log in to the second application;

The sender is further configured to send the application account to an application server of the second application, so that the application server authenticates the application account and returns an authentication response;

The receiver is further configured to receive the authentication response from the application server, and feed back a login result to the UE according to the authentication response.

In conjunction with the second possible implementation of the seventh aspect, in a third possible implementation manner of the seventh aspect, the transmitter is further configured to: if the application account is not queried, to the core network The device sends an account acquisition request, where the account acquisition request includes the service identifier and the user identifier;

The receiver is further configured to acquire the application account from the core network device.

With reference to the second or third possible implementation manner of the seventh aspect, in a fourth possible implementation manner of the seventh aspect, the transmitter is further configured to: if two or more application accounts are queried, Sending the two or more application accounts to the UE;

The receiver is further configured to receive an application account that is sent by the UE and is selected to log in to the second application.

With reference to the seventh aspect, in a fifth possible implementation manner of the seventh aspect, the receiver is further configured to receive, by the core network device, a user identifier that is allocated to the UE according to a virtual machine registration request sent by the UE;

The processor is further configured to allocate a virtual machine to the UE according to the user identifier;

The transmitter is further configured to return a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device allocates response according to the virtual machine allocation The user name and password of the UE and return a virtual machine registration response to the UE.

With reference to the fifth possible implementation manner of the seventh aspect, in a sixth possible implementation manner of the seventh aspect, the virtual machine registration request includes a user name, a password, and a temporary Identifier.

With reference to the fifth possible implementation manner of the seventh aspect, in a seventh possible implementation manner of the seventh aspect, the virtual machine registration request includes using user information of the UE;

The processor is further configured to randomly generate the username and password for the UE while allocating a virtual machine to the UE according to the user identifier.

With reference to any one of the fifth to seventh possible implementation manners of the seventh aspect, in the eighth possible implementation manner of the seventh aspect, the receiver is further configured to receive a virtual machine login request of the UE The virtual machine login request includes a username and a password of the UE;

The sender is further configured to send the user name and password of the UE to the core network device, so that the core network device authenticates the UE according to the user name and password of the UE, and returns the authentication. In response, the authentication response includes a user identifier of the UE;

The processor is further configured to start, according to the user identifier, the virtual machine allocated for the UE;

The transmitter is further configured to return a virtual machine login response to the UE.

With reference to any one of the fifth to eighth possible implementations of the seventh aspect, in a ninth possible implementation manner of the seventh aspect, the receiver is further configured to receive the core network device Deleting a virtual machine removal request sent after the UE is authenticated according to a virtual machine logout request sent by the UE and querying the user identifier of the UE, where the virtual machine removal request includes a user identifier of the UE;

The processor is further configured to remove the virtual machine allocated to the UE according to the virtual machine destruction request, and delete configuration information corresponding to the user identifier of the UE.

The eighth aspect of the present invention provides a core network device, including:

a receiver, configured to receive an account registration request sent by the mobile virtualization device, where the account registration request includes a service identifier of the first application that the user equipment UE requests to register, and a user identifier of the UE;

a processor, configured to allocate, according to the account registration request, an application account that is used to log in to the first application;

And a sender, configured to send the application account to the mobile virtualization device and the application server of the first application.

With reference to the eighth aspect, in a first possible implementation manner of the eighth aspect, the processor is further configured to allocate a service identifier to the pre-registered application;

The transmitter is further configured to send the service identifier to the mobile virtualization device.

With reference to the eighth aspect, or the first possible implementation manner of the eighth aspect, in a second possible implementation manner of the eighth aspect, the receiver is further configured to receive the mobile virtualization device Acquiring an account acquisition request sent after the UE logs in to the application account of the second application, where the account acquisition request includes the service identifier of the second application and the user identifier of the UE;

The sender is further configured to return the application account to the mobile virtualization device according to the account acquisition request.

With reference to the eighth aspect, or the first possible implementation manner of the eighth aspect, in a third possible implementation manner of the eighth aspect, the receiver is further configured to receive a virtual machine registration request sent by the UE;

The processor is further configured to allocate a user identifier to the UE according to the virtual machine registration request;

The transmitter is further configured to send the user identifier to the mobile virtualization device, so that the mobile virtualization device allocates a virtual machine to the UE according to the user identifier;

The receiver is further configured to receive a virtual machine allocation response sent by the mobile virtualization device, where the virtual machine allocation response includes a username and a password of the UE;

The processor is further configured to store a username and a password of the UE;

The transmitter is further configured to return a virtual machine registration response to the UE.

With reference to the third possible implementation of the eighth aspect, in a fourth possible implementation manner of the eighth aspect, the virtual machine registration request includes a user name, a password, and a temporary Identification code; or,

In conjunction with the third or fourth possible implementation of the eighth aspect, in a fifth possible implementation of the eighth aspect, the receiver is further configured to receive, by the mobile virtualization device, the UE a user name and a password of the UE sent by the virtual machine login request, where the virtual machine login request includes a username and a password of the UE;

The processor is further configured to perform authentication on the UE according to the username and password of the UE;

The sender is further configured to return an authentication response, where the authentication response includes a user identifier of the UE, so that the mobile virtualization device starts the virtual machine allocated to the UE according to the user identifier. And returning a virtual machine login response to the UE.

With reference to any one of the third to fifth possible implementation manners of the eighth aspect, in a sixth possible implementation manner of the eighth aspect, the receiver is further configured to receive a virtual machine logout sent by the UE The request, the virtual machine logout request includes a username and a password of the UE;

The processor is further configured to perform authentication on the UE according to the virtual machine logout request, and query a user identifier of the UE;

The transmitter is further configured to send a virtual machine removal request to the mobile virtualization device, where the virtual machine removal request includes the user identifier, so that the mobile virtualization device removes the allocation according to the virtual machine removal request Giving the virtual machine of the UE, and deleting configuration information corresponding to the user identifier;

The processor is further configured to delete configuration information corresponding to the user identifier;

The transmitter is further configured to return a virtual machine logout response to the UE.

A ninth aspect, an embodiment of the present invention provides an application server, including:

The receiver is configured to receive an application account that is sent by the core network device, where the application account is an application account that is allocated when the core network device requests the user equipment UE to register the first application.

With reference to the ninth aspect, in a first possible implementation manner of the ninth aspect, the method further includes: a processor and a transmitter;

The receiver is further configured to receive an application account that is sent by the mobile virtualization device, where the application account is an application account of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE. ;

The processor is configured to authenticate the application account;

The transmitter is configured to return an authentication response to the mobile virtualization device.

According to a tenth aspect, an embodiment of the present invention provides an authentication system, including: a mobile virtualization device, a core network device, an application server, and a user equipment UE; wherein the mobile virtualization device adopts the fourth aspect and the fourth aspect. The mobile virtualization device according to any one of the first to the ninth possible implementations; the core network device adopting any of the first to sixth aspects of the fifth aspect, the fifth aspect The core network device according to the implementation manner; the application server adopts the application server described in the sixth aspect or the first possible implementation manner of the sixth aspect.

In an eleventh aspect, an embodiment of the present invention provides an authentication system, including: a mobile virtualization device, a core network device, an application server, and a user equipment UE; wherein the mobile virtualization device adopts the seventh aspect and the seventh aspect. The mobile virtualization device according to any one of the first to the ninth possible implementation manners; the core network device adopting the eighth aspect, the first one to the sixth aspect of the eighth aspect The implementation of the core network device; the application server adopts the application server of the ninth aspect or the first possible implementation manner of the ninth aspect.

In the embodiment of the present invention, the user authentication method, device, and system can eliminate the registration of the UE in each application by using the mobile virtualization device as a proxy of the UE instead of the UE to implement registration and login of the application. Manually set the complicated operation of user name and password, solve the limitations of platform application management, reduce user information redundancy, reduce management load, and improve system authentication efficiency.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic structural diagram of an embodiment of an authentication system according to the present invention;

2 is a flowchart of an embodiment of a user authentication method according to the present invention;

3 is a flow chart of another embodiment of a user authentication method according to the present invention;

4 is a flowchart of still another embodiment of a user authentication method according to the present invention;

FIG. 5 is a flowchart of a fourth embodiment of a user authentication method according to the present invention; FIG.

6 is a flowchart of a fifth embodiment of a user authentication method according to the present invention;

7 is a flowchart of a sixth embodiment of a user authentication method according to the present invention;

FIG. 8 is a flowchart of a seventh embodiment of a user authentication method according to the present invention; FIG.

9 is a flowchart of an eighth embodiment of a user authentication method according to the present invention;

10 is a schematic structural diagram of an embodiment of a mobile virtual device according to the present invention;

11 is a schematic structural diagram of an embodiment of an application server according to the present invention;

12 is a schematic structural diagram of another embodiment of a mobile virtual device according to the present invention;

FIG. 13 is a schematic structural diagram of still another embodiment of an application server according to the present invention; FIG.

Figure 14 is a block diagram showing another embodiment of the authentication system of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

1 is a schematic structural diagram of an embodiment of an authentication system according to the present invention, as shown in FIG. The authentication system of the embodiment may include: a mobile virtualization device 11, a core network device 12, an application server 13, and a user equipment (User Equipment, UE for short) 14. Further, the mobile virtualization device 11 may further include a virtual user module. 111 and lightweight application server 112. The virtual user module 111 provides a virtual machine service for the UE 14. The lightweight application server 112 can be regarded as an implementation of some functions of the multiple application servers in the mobile virtualization device 11, and can also be deployed as an application developer on the authentication system. Application servers that provide complete application services. The user wirelessly connects to the virtual subscriber module 111 in the mobile virtualization device 11 by using the UE 14, thereby using the virtual machine service, with the virtual subscriber module 111 acting as a proxy for the UE 14. The virtual user module 111 interacts with the lightweight application server 112. The core network device 12 may include a Mobility Management Entity (MME) and a Home Subscriber Server (HSS), each storing certain user data to authenticate the user. The application server 13 is a corresponding server of a plurality of applications in the authentication system, which stores user information of the user using the application, for example, login information, game progress, recorded data, and the like.

In this embodiment, the user logs in to the mobile virtualization device 11 through the UE 14, and inputs a user name and password. After the mobile virtualization device 11 authenticates the user, the mobile virtualization device 11 implements registration, login, and the like operations of the user by using the application as a proxy of the user. In this process, the user does not have to register once for each application, the mobile virtualization device 11 can interact with the application server 13 of each application instead of the user, and the mobile virtualization device 11 can replace the application account generated by the user, or even The user needs to be fed back to the user, and the application does not need to belong to a fixed management platform. As long as the lightweight application server 112 is deployed on the mobile virtualization device 11, unified authentication and authentication can be implemented, and user information redundancy can be reduced. Improve the efficiency of authentication.

2 is a flowchart of an embodiment of a user authentication method according to the present invention. As shown in FIG. 2, this embodiment is a process in which a UE requests to register an application, and the method may include:

Step 101: Receive an application registration request sent by the user equipment UE, where the application registration request includes information about the first application that the UE requests to register;

The execution body of this embodiment may be the mobile virtualization device in the structural diagram shown in FIG. 1. The user initiates an application registration request to the mobile virtualization device through the UE. For example, the user registers the WeChat or the mobile game, and can click the icon of the WeChat or the mobile game on the UE to select the registration, and the application for the WeChat or the mobile game can be sent through the UE. a registration request, the application registration request includes information related to the first application (such as WeChat or mobile game) that the user requests to register, and may include an application. Name, application ID, corresponding application server ID, and so on.

Step 102: Query, according to the application registration request, a service identifier of the first application and a user identifier of the UE.

After receiving the application registration request, the mobile virtualization device acquires the service identifier (Service Identity) of the first application according to the information of the first application that the UE requests to register, specifically, the virtual user in the mobile virtualization device. The module receives the application registration request, and then obtains the service identifier of the first application from the lightweight application server of the first application in the mobile virtualization device according to the first application information in the application registration request. The UE needs to be registered before using the authentication system. Therefore, the mobile virtualization device can also obtain the user identity (User Identity, User ID) of the UE to the sender through the application registration request.

Step 103: Send an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device allocates the login to the UE according to the account registration request. An application account of an application and sending the application account to an application server of the first application;

The mobile virtualization device packages the service identifier of the first application and the user identifier of the UE to the core network device to initiate an account registration request. The core network device may be an HSS, and the HSS allocates an application account according to the service identifier and the user identifier, where the application account is The account used by the user to identify the application corresponding to the subsequent login service identifier of the UE. The HSS sends the application account to the application server of the first application at the same time, and the application server can also perform authentication according to the application account after the subsequent login. This step is maximally compatible with the authentication mechanism in the existing communication network. The mobile virtualization device interacts with each application server according to the current standard, and the core network device regards the mobile virtualization device as the UE assigning an application account to it, regardless of Which application is used, as long as it is a trusted application that is recognized and supported in the system, the application account can be obtained by the method of this embodiment.

Step 104: Obtain the application account from the core network device to use the application account as an authentication identifier for the UE to log in to the first application, and return an application registration response to the UE.

After receiving the application account allocated by the core network device, the mobile virtualization device records the application account and feeds back the application registration response to the UE. The application registration response may be a result including whether the registration is successful, and the UE receives the response and may pop up the window. The form informs the user. The mobile virtualization device may store the application account information in the format of Table 1. Each record includes a user identifier, a service identifier, and an application account. The mobile virtualization device may not feed the application account to the UE, but only locally. In this way, when the UE logs in to the application, it only needs to send an application login request, and the mobile virtualization device obtains the application account locally, and then interacts with the application server through the application account to complete authentication and login.

Table 1

User ID

Service identifier

Application account

In this embodiment, by using the mobile virtualization device as the proxy of the UE, instead of the UE, the registration and login of the application are implemented, the complicated operation of manually setting the user name and password in the registration process of the application is eliminated, and the limitation of the platform application management is solved. Reduce user information redundancy, reduce management load, and improve system authentication efficiency.

Further, before the step 101, the method may further include: acquiring, from the core network device, a service identifier that is allocated by the core network device to a pre-registered application.

The mobile virtualization device can implement some functions of multiple application servers, and the functions implemented by the application include a configuration file of a pre-registered application. For example, a third party develops a mobile game, if the mobile game supports the authentication of the present invention, The authentication mechanism can register with the core network device first. As long as the core network device passes the authentication of the mobile game and considers it to be a trusted application, it can assign a service identifier to the mobile game and send the service identifier to the mobile device. A virtualization device, specifically a lightweight application server in a mobile virtualization device.

FIG. 3 is a flowchart of another embodiment of a user authentication method according to the present invention. As shown in FIG. 3, this embodiment is also a process in which a UE requests to register an application, and the method may include:

Step 201: Receive an account registration request sent by the mobile virtualization device, where the account registration request includes a service identifier of the first application that the user equipment UE requests to register, and a user identifier of the UE.

The execution body of this embodiment may be the core network device in the schematic diagram of the structure shown in FIG. 1. The method in this embodiment corresponds to the method embodiment shown in FIG. 2, and is a method performed by a core network device in a process in which a UE requests to register an application.

Step 202: Assign, to the UE, an application account that is logged in to the first application according to the account registration request.

Step 203: Send the application account to the mobile virtualization device and the application server of the first application.

In this embodiment, the core network device regards the mobile virtualization device as the UE requesting the registration application, and allocates an application account for it. By using the mobile virtualization device as a proxy of the UE, instead of the UE, the application registration and login are implemented, and the UE can be exempted from the UE. Manually set the username and password during the registration process for each application Complex operations, solve the limitations of platform application management, reduce user information redundancy, reduce management load, and improve system authentication efficiency.

4 is a flowchart of still another embodiment of a user authentication method according to the present invention. As shown in FIG. 4, this embodiment is also a process for a UE to request to register an application, and the method may include:

Step 301: Receive an application account that is sent by the core network device, where the application account is an application account that is allocated when the core network device requests the user equipment UE to register the first application.

The execution body of this embodiment may be an application server in the schematic diagram of the structure shown in FIG. 1. The method in this embodiment corresponds to the method embodiment shown in FIG. 2 and FIG. 3, and is a method performed by the application server in the process of requesting registration of the application by the UE.

In this embodiment, the application server regards the mobile virtualization device as the UE requesting the registration application, records the application account, and uses the mobile virtualization device as the proxy of the UE to replace the UE to implement application registration and login, thereby exempting the UE from Manually set the complicated operation of user name and password during the registration process of the application, solve the limitations of platform application management, reduce user information redundancy, reduce management load, and improve system authentication efficiency.

The foregoing method embodiment is an implementation process of the mobile virtualization device, the core network device, and the application server in the process of requesting the registration of the application by the UE. The method in this embodiment further includes the UE requesting the login application, the UE requesting to register the mobile virtualization device, and the UE. The process of requesting to log in to the mobile virtualization device and requesting to log off the mobile virtualization device. The technical solutions of the method embodiments of the present invention are described in detail below by using several specific interaction embodiments. In the following method embodiments, the mobile virtualization device includes a virtual user module and a lightweight application server. In order to make the method steps clearer, the virtual user module and the lightweight application server are respectively the execution entities of the partial steps, and the mobile virtualization is described. The interaction process inside the device; the core network device also includes MME and HSS.

FIG. 5 is a flowchart of a fourth embodiment of a user authentication method according to the present invention. As shown in FIG. 5, this embodiment is also a process in which a UE requests to register an application, and the method may include:

S401. The core network device allocates a service identifier to the pre-registered application, and sends the service identifier to the lightweight application server.

In this embodiment, the core network device may be an HSS.

S402. The virtual user module receives an application registration request sent by the UE to request to register the first application.

S403. The virtual user module sends a query request to the lightweight application server according to the application registration request.

The service identifier of each application is recorded in the s401 lightweight application server.

S404. The lightweight application server returns a service identifier of the first application to the virtual user module.

S405. The virtual user module sends an account registration request to the core network device according to the service identifier of the first application and the user identifier of the UE.

According to the record in Table 1, the virtual user module can obtain the user identifier of the UE, and the service identifier of the first application corresponding to the UE is also recorded in Table 1.

S406. The core network device allocates, according to the account registration request, an application account that is used to log in to the first application.

The application account is generated when the first registration is performed, and the mobile virtualization device can store it locally without using a notification, so that the subsequent UE can directly obtain the application account and submit it to the application server for authentication when logging in to the first application. The application account that is allocated by the core network device may be a user name and password that are used in a conventional manner, or may be a string of pre-scheduled formats, as long as it can be used as a credential for the login application, and is not specifically limited herein.

S407. The core network device sends the application account to the virtual user module and the application server of the first application.

S408. The virtual user module stores the application account.

S409. The virtual user module informs the UE that the registration is completed.

FIG. 6 is a flowchart of a fifth embodiment of a user authentication method according to the present invention. As shown in FIG. 6 , this embodiment is also a process in which a UE requests to log in to an application, and the method may include:

S501. The virtual user module receives an application login request that is sent by the UE and is requested to log in to the second application.

S502. The virtual user module queries an application account of the second application according to the application login request.

Through the registration process shown in FIG. 5, the mobile virtualization device records the mapping relationship between the user identifier, the service identifier, and the application account in the locally saved table 1. The virtual user module can obtain the user identifier and UE of the UE according to the request. The service identifier of the second application that requests the login, and the query table 1 obtains the application account of the UE to log in to the second application.

S503. The virtual user module sends an account acquisition request to the core network device.

If the virtual user module does not locally query the application account of the second application, the account acquisition request is sent to the core network device, and the application account of the second application is re-acquired from the core network device. The core network device in this embodiment may be an HSS.

S504. The core network device returns an application account of the second application to the virtual user module.

S503 and s504 are optional steps, and only need to perform these two steps if the virtual user module does not query the application account from the local.

S505. The virtual user module sends an application account of two or more second applications to the UE.

If the user registers multiple application accounts in the second application, the virtual user module can query and obtain more than two application accounts, so all application accounts are sent to the UE, and the user selects the account that wants to log in.

S506. The UE selects an application account used for login.

S507. The virtual user module receives an account selection response sent by the UE.

S505 to s507 are optional steps, and only need to be queried for multiple application accounts.

S508. The virtual user module sends a login request to the lightweight application server according to the application account.

S509. The lightweight application server forwards the login request to an application server of the second application.

S510. The application server authenticates the application account.

S511. The application server returns an authentication response to the lightweight application server.

S512. The lightweight application server forwards the authentication response to the virtual user module.

S513. The virtual user module feeds back the login result to the UE according to the authentication response.

FIG. 7 is a flowchart of a sixth embodiment of a user authentication method according to the present invention. As shown in FIG. 7, the embodiment is also a process for a UE to request to register a mobile virtualization device, and the method may include:

S601: The MME receives a virtual machine registration request sent by the UE.

The virtual machine registration request includes a username and a password set by the UE, and a temporary identifier of the UE. Optionally, the virtual machine registration request may also include user information of the UE.

S602, the MME forwards the virtual machine registration request to the HSS;

If the virtual machine registration request includes the user name and password set by the UE, and the temporary identifier of the UE, the MME queries and obtains an International Mobile Subscriber Identification Number (IMSI) of the UE, and The IMSI is carried when the virtual machine registration request is forwarded. If the user information of the UE is included in the virtual machine registration request, the information is directly forwarded to the HSS, and the validity is verified by the HSS.

S603. The HSS allocates a user identifier to the UE according to the virtual machine registration request.

The HSS can assign a unique user identifier to the UE according to a preset algorithm.

S604, the HSS returns the user identifier to the MME;

S605. The MME sends the user identifier to the mobile virtualization device.

S606. The mobile virtualization device allocates a virtual machine to the UE according to the user identifier.

Optionally, if the virtual machine registration request includes the user information of the UE, the mobile virtualization device also randomly generates a username and a password for the UE, that is, the user name and password of the UE are not set by the user, but are moved. The virtualization device is randomly generated for it.

S607. The mobile virtualization device returns a virtual machine allocation response to the MME.

The virtual machine allocation response includes a user identifier, a username, and a password of the UE.

S608. The MME stores a username and a password of the UE according to the virtual machine allocation response.

The MME can store the mapping relationship between the user identifier and the mobile virtualization device identifier in the form of Table 2, and is used to destroy the virtual machine data of the UE and the synchronous user data during the virtual machine migration. The MME can query the virtual used by the UE through Table 2. The mobile virtualization device where the machine is located.

Table 2

User ID

Mobile virtualization device ID

The MME can store the mapping relationship between the user identifier, the username, and the password of the UE in the form of Table 3. When the UE requests to log in to the mobile virtualization device, the MME authenticates the user identity.

table 3

User ID

username

password

S609. The MME returns a virtual machine registration response to the UE.

FIG. 8 is a flowchart of a seventh embodiment of a user authentication method according to the present invention. As shown in FIG. 8 , this embodiment is also a process for a UE to log in to a mobile virtualization device. The method may include:

S701. The mobile virtualization device receives a virtual machine login request of the UE.

The virtual machine login request includes a username and password of the UE.

S702: The mobile virtualization device sends the username and password to the MME.

S703. The MME performs authentication on the UE according to the username and password.

S704. The MME returns an authentication response to the mobile virtualization device.

The authentication response includes a user identification of the UE.

S705. The mobile virtualization device starts a virtual machine allocated to the UE according to the user identifier.

S706: The mobile virtualization device and the MME perform virtual machine synchronization according to the user identifier.

This step is an optional step.

S707. The mobile virtualization device returns a virtual machine login response to the UE.

S708. The UE establishes a connection with the mobile virtualization device and performs data interaction.

FIG. 9 is a flowchart of an eighth embodiment of a user authentication method according to the present invention. As shown in FIG. 9 , this embodiment is also a process for a UE to request to log off a mobile virtualization device. The method may include:

S801. The MME receives a virtual machine logout request sent by the UE.

The virtual machine logout request includes a username and password of the UE.

S802. The MME performs authentication on the UE according to the virtual machine logout request, and queries the user identifier of the UE.

S803. The MME sends a virtual machine removal request to the mobile virtualization device.

The virtual machine removal request includes the user identification.

S804. The mobile virtualization device removes the virtual machine allocated to the UE according to the virtual machine removal request, and deletes configuration information corresponding to the user identifier.

S805. The mobile virtualization device returns a virtual machine removal response to the MME.

S806. The MME sends a user identity deletion request to the HSS.

The user identity deletion request includes the user identity.

S807, the HSS deletes the user identifier according to the user identifier deletion request, and configuration information corresponding to the user identifier;

S808, the HSS returns a user identity deletion response to the MME;

S809. The MME deletes configuration information corresponding to the user identifier.

S810. The MME returns a virtual machine logout response to the UE.

10 is a schematic structural diagram of an embodiment of a mobile virtual device according to the present invention. As shown in FIG. 10, the device in this embodiment may include: a receiving module 11, a processing module 12, and a sending module 13, where the receiving module 11 is used. Receiving an application registration request sent by the user equipment UE, where the application registration request includes information of the first application that the UE requests to register; the processing module 12 is configured to query the service identifier of the first application according to the application registration request. And the user identifier of the UE; the sending module 13 is configured to send an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device is configured according to the account The registration request is that the UE is configured to log in to the application account of the first application, and the application account is sent to the application server of the first application. The receiving module 11 is further configured to acquire the application from the core network device. The application account is used to use the application account as an authentication identifier for the UE to log in to the first application, and return an application registration response to the UE.

The device in this embodiment may be used to implement the technical solution of the method embodiment shown in any of FIG. 2 and FIG. 5 to FIG. 9. The implementation principle and technical effects are similar, and details are not described herein again.

Further, the receiving module 11 is further configured to acquire, from the core network device, a service identifier that is allocated by the core network device to a pre-registered application.

Further, the receiving module 11 is further configured to receive an application login request sent by the UE, where the application login request includes information about the second application that the UE requests to log in; the processing module 12 is further configured to: Applying the login request to query the UE to log in to the application account of the second application; the sending module 13 is further configured to send the application account to the application server of the second application, so that the application server is The application account is used for authentication and returns an authentication response. The receiving module 11 is further configured to receive the authentication response from the application server, and feed back the login result to the UE according to the authentication response.

Further, the sending module 13 is further configured to: if the application account is not queried, send an account obtaining request to the core network device, where the account obtaining request includes the service identifier and the user identifier; The receiving module 11 is further configured to acquire the application account from the core network device.

Further, the sending module 13 is further configured to: if the two or more application accounts are queried, send the two or more application accounts to the UE; and the receiving module 11 is further configured to receive And sending, by the UE, an application account that is logged in to the second application.

Further, the receiving module 11 is further configured to receive, by the core network device, a user identifier that is allocated to the UE according to the virtual machine registration request sent by the UE, where the processing module 12 is further configured to use, according to the user identifier, The UE allocates a virtual machine; the sending module 13 is further configured to return a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device Storing a username and password of the UE according to the virtual machine allocation response and returning a virtual machine registration response to the UE.

Further, the virtual machine registration request includes a username, a password, and a temporary identifier of the UE set by the UE.

Further, the virtual machine registration request includes using user information of the UE, and the processing module 12 is further configured to randomly generate, for the UE, a virtual machine according to the user identifier. User name and password.

Further, the receiving module 11 is further configured to receive a virtual machine login request of the UE, where The virtual machine login request includes the user name and password of the UE, and the sending module 13 is further configured to send the user name and password of the UE to the core network device, so that the core network device is configured according to the UE. The user name and the password are used to authenticate the UE and return an authentication response, where the authentication response includes the user identifier of the UE, and the processing module 12 is further configured to start, according to the user identifier, the UE to be allocated according to the user identifier. The sending module 13 is further configured to return a virtual machine login response to the UE.

Further, the receiving module 11 is further configured to receive a virtual machine removal request sent by the core network device after authenticating the UE according to a virtual machine logout request sent by the UE, and querying the user identifier of the UE, The virtual machine removal request includes a user identifier of the UE; the processing module 12 is further configured to: remove the virtual machine allocated to the UE according to the virtual machine destruction request, and delete the user identifier corresponding to the UE Configuration information.

FIG. 10 is a schematic structural diagram of an embodiment of the core network device of the present invention. As shown in FIG. 10, the receiving module 11 is configured to receive an account registration request sent by the mobile virtualization device, where the account is registered. The request includes the service identifier of the first application and the user identifier of the UE that the user equipment UE requests to register; the processing module 12 is configured to allocate, according to the account registration request, the application account that is logged into the first application according to the account registration request; The module 13 is configured to send the application account to the mobile virtualization device and the application server of the first application.

The device of this embodiment may be used to implement the technical solution of the method embodiment shown in any of FIG. 3 and FIG. 5 to FIG. 9. The implementation principle and technical effects are similar, and details are not described herein again.

Further, the processing module 12 is further configured to allocate a service identifier to the pre-registered application, and the sending module 13 is further configured to send the service identifier to the mobile virtualization device.

Further, the receiving module 11 is further configured to receive an account obtaining request that is sent after the mobile virtualization device does not obtain an application account that the UE logs in to the second application, where the account obtaining request includes the second application. The service identifier and the user identifier of the UE; the sending module 13 is further configured to return the application account to the mobile virtualization device according to the account acquisition request.

Further, the receiving module 11 is further configured to receive a virtual machine registration request sent by the UE, where the processing module 12 is further configured to allocate a user identifier to the UE according to the virtual machine registration request; And the method is further configured to send the user identifier to the mobile virtualization device, so that the mobile virtualization device allocates a virtual machine to the UE according to the user identifier, and the receiving module 11 is further configured to receive the a virtual machine allocation response sent by the mobile virtualization device, the virtual machine The allocation response includes a username and a password of the UE; the processing module 12 is further configured to store a username and a password of the UE; and the sending module 13 is further configured to return a virtual machine registration response to the UE.

Further, the virtual machine registration request includes a user name and a password set by the UE, and a temporary identifier of the UE; or the virtual machine registration request includes user information using the UE.

Further, the receiving module 11 is further configured to receive a username and a password of the UE that are sent by the mobile virtualization device according to a virtual machine login request sent by the UE, where the virtual machine login request includes a username of the UE and The processing module 12 is further configured to perform authentication on the UE according to the user name and password of the UE; the sending module 13 is further configured to return an authentication response, where the authentication response includes the UE User identification, such that the mobile virtualization device initiates the virtual machine allocated for the UE according to the user identifier, and returns a virtual machine login response to the UE.

Further, the receiving module 11 is further configured to receive a virtual machine logout request sent by the UE, where the virtual machine logout request includes a username and a password of the UE, and the processing module 12 is further configured to use the virtual machine according to the virtual machine And the sending module 13 is further configured to send a virtual machine removal request to the mobile virtualization device, where the virtual machine removal request includes the a user identifier, so that the mobile virtualization device removes the virtual machine allocated to the UE according to the virtual machine removal request, and deletes configuration information corresponding to the user identifier; the processing module 12 is further configured to delete The configuration information corresponding to the user identifier; the sending module 13 is further configured to return a virtual machine logout response to the UE.

FIG. 11 is a schematic structural diagram of an embodiment of an application server according to the present invention. As shown in FIG. 11, the apparatus in this embodiment may include: a receiving module 21, configured to receive an application account sent by a core network device, where the application account is The core network device requests the user equipment UE to register an application account that is allocated when the first application is registered.

Further, the structural diagram shown in FIG. 10 can also be used as a schematic structural diagram of another embodiment of the application server of the present invention. As shown in FIG. 10, the receiving module 11 is further configured to receive an application account sent by the mobile virtualization device. The application account is an application account of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE; the processing module 12 is configured to authenticate the application account; The sending module 13 is configured to return an authentication response to the mobile virtualization device.

The device in this embodiment may be used to implement the technical solution of the method embodiment shown in any of FIG. 4 to FIG. 9. The implementation principle and technical effects are similar, and details are not described herein again.

FIG. 12 is a schematic structural diagram of another embodiment of a mobile virtual device according to the present invention. As shown in FIG. 12, the device in this embodiment may include: a receiver 31, a processor 32, and a transmitter 33, wherein the receiver 31, For receiving an application registration request sent by the user equipment UE, the application registration request includes information of the first application that the UE requests to be registered, and the processor 32 is configured to query the service of the first application according to the application registration request. The identifier and the user identifier of the UE; the sender 33 is configured to send an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device is configured according to the The account registration request is configured to allocate an application account of the first application to the UE and send the application account to the application server of the first application; the receiver 31 is further configured to acquire from the core network device. The application account is used to use the application account as an authentication identifier for the UE to log in to the first application, and return an application registration response to the UE.

Further, the receiver 31 is further configured to acquire, from the core network device, a service identifier that is allocated by the core network device to a pre-registered application.

Further, the receiver 31 is further configured to receive an application login request sent by the UE, where the application login request includes information about a second application that the UE requests to log in, and the processor 32 is further configured to: Applying the login request to query the UE to log in to the application account of the second application; the sender 33 is further configured to send the application account to the application server of the second application, so that the application server is The application account is used for authentication and returns an authentication response. The receiver 31 is further configured to receive the authentication response from the application server, and feed back the login result to the UE according to the authentication response.

Further, the sender 33 is further configured to: if the application account is not queried, send an account acquisition request to the core network device, where the account acquisition request includes the service identifier and the user identifier; The receiver 31 is further configured to acquire the application account from the core network device.

Further, the sender 33 is further configured to: if the two or more application accounts are queried, send the two or more application accounts to the UE; and the receiver 31 is further configured to receive And sending, by the UE, an application account that is logged in to the second application.

Further, the receiver 31 is further configured to receive, by the core network device, a user identifier that is allocated to the UE according to a virtual machine registration request sent by the UE, where the processor 32 is further configured to use, according to the user identifier, The UE allocates a virtual machine; the sender 33 is further configured to return a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device Storing a username and password of the UE according to the virtual machine allocation response and returning a virtual machine registration response to the UE.

Further, the virtual machine registration request includes using user information of the UE, and the processor 32 is further configured to randomly generate, for the UE, a virtual machine according to the user identifier. User name and password.

Further, the receiver 31 is further configured to receive a virtual machine login request of the UE, where the virtual machine login request includes a username and a password of the UE, and the sender 33 is further configured to: The name and password are sent to the core network device, so that the core network device authenticates the UE according to the user name and password of the UE and returns an authentication response, where the authentication response includes the user identifier of the UE. The processor 32 is further configured to start, according to the user identifier, the virtual machine allocated for the UE, and the sender 33 is further configured to return a virtual machine login response to the UE.

Further, the receiver 31 is further configured to receive a virtual machine removal request sent by the core network device after authenticating the UE according to a virtual machine logout request sent by the UE, and querying the user identifier of the UE, The virtual machine removal request includes a user identifier of the UE, and the processor 32 is further configured to: remove the virtual machine allocated to the UE according to the virtual machine destruction request, and delete the user identifier corresponding to the UE Configuration information.

FIG. 12 is a schematic structural diagram of another embodiment of the core network device of the present invention. As shown in FIG. 12, the receiver 31 is configured to receive an account registration request sent by the mobile virtualization device, where the account is The registration request includes a service identifier of the first application that the user equipment UE requests to register, and a user identifier of the UE; the processor 32 is configured to allocate, according to the account registration request, an application account that is logged into the first application according to the account registration request; The sender 33 is configured to send the application account to the mobile virtualization device and the application server of the first application.

The device in this embodiment may be used to execute the method embodiment shown in any one of FIG. 3 and FIG. 5 to FIG. The technical solution has similar implementation principles and technical effects, and will not be described here.

Further, the processor 32 is further configured to allocate a service identifier to the pre-registered application, and the sender 33 is further configured to send the service identifier to the mobile virtualization device.

Further, the receiver 31 is further configured to receive an account acquisition request sent by the mobile virtualization device after acquiring an application account that the UE logs in to the second application, where the account acquisition request includes the second application The service identifier and the user identifier of the UE; the sender 33 is further configured to return the application account to the mobile virtualization device according to the account acquisition request.

Further, the receiver 31 is further configured to receive a virtual machine registration request sent by the UE, where the processor 32 is further configured to allocate a user identifier to the UE according to the virtual machine registration request; And sending the user identifier to the mobile virtualization device, so that the mobile virtualization device allocates a virtual machine to the UE according to the user identifier; the receiver 31 is further configured to receive the a virtual machine allocation response sent by the mobile virtualization device, the virtual machine allocation response including a username and a password of the UE; the processor 32, further configured to store a username and a password of the UE; the sender 33, Also used to return a virtual machine registration response to the UE.

Further, the receiver 31 is further configured to receive a username and a password of the UE that are sent by the mobile virtualization device according to a virtual machine login request sent by the UE, where the virtual machine login request includes a username of the UE and The processor 32 is further configured to perform authentication on the UE according to the user name and password of the UE; the sender 33 is further configured to return an authentication response, where the authentication response includes the UE User identification, such that the mobile virtualization device initiates the virtual machine allocated for the UE according to the user identifier, and returns a virtual machine login response to the UE.

Further, the receiver 31 is further configured to receive a virtual machine logout request sent by the UE, where the virtual machine logout request includes a username and a password of the UE, and the processor 32 is further configured to use the virtual machine according to the virtual machine Deleting a request to authenticate the UE, and querying a user identifier of the UE; the sender 33 is further configured to send a virtual machine removal request to the mobile virtualization device, where the virtual machine removal request includes the a user identifier, so that the mobile virtualization device removes the virtual machine allocated to the UE according to the virtual machine removal request, and deletes configuration information corresponding to the user identifier; the processor 32 is further configured to delete Configuration information corresponding to the user identifier; the sending The device 33 is further configured to return a virtual machine logout response to the UE.

FIG. 13 is a schematic structural diagram of still another embodiment of an application server according to the present invention. As shown in FIG. 13, the device in this embodiment may include: a receiver 41, configured to receive an application account sent by a core network device, where the application account is The core network device requests the user equipment UE to register an application account that is allocated when the first application is registered.

Further, the structural diagram shown in FIG. 12 can also be used as a schematic structural diagram of another embodiment of the application server of the present invention. As shown in FIG. 12, the receiver 31 is further configured to receive an application account sent by the mobile virtualization device. The application account is an application account of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE, and the processor 32 is configured to authenticate the application account. The transmitter 33 is configured to return an authentication response to the mobile virtualization device.

FIG. 14 is a schematic structural diagram of another embodiment of an authentication system according to the present invention. As shown in FIG. 14, the system in this embodiment includes: a mobile virtualization device 51, a core network device 52, an application server 53, and a UE 54; The mobile virtualization device 51 may adopt the structure of the device embodiment shown in FIG. 10 or FIG. 12, and correspondingly, the technical solution of the method embodiment of any one of FIG. 2, FIG. 5 to FIG. The technical effects are similar, and are not described herein again; the core network device 52 may adopt the structure of the device embodiment shown in FIG. 10 or FIG. 12, and correspondingly, the method embodiment of any one of FIG. 3, FIG. 5 to FIG. The technical solution, the implementation principle and the technical effect are similar, and are not described herein again; the application server 53 can adopt the structure of the device embodiment shown in any one of FIG. 10 to FIG. 13 , and correspondingly, the execution can be performed in FIG. 4 to FIG. 9 . The technical solution of any method embodiment is similar to the technical solution, and details are not described herein again.

In the several embodiments provided by the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium. The above software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the methods of the various embodiments of the present invention. Part of the steps. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

A person skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of each functional module described above is exemplified. In practical applications, the above function assignment can be completed by different functional modules as needed, that is, the device is installed. The internal structure is divided into different functional modules to perform all or part of the functions described above. For the specific working process of the device described above, refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims

A user authentication method, comprising:

Receiving an application registration request sent by the user equipment UE, where the application registration request includes information about the first application that the UE requests to register;

Querying, according to the application registration request, a service identifier of the first application and a user identifier of the UE;

Sending an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device allocates the login to the first application according to the account registration request. Applying an account and sending the application account to the application server of the first application;

Acquiring the application account from the core network device to use the application account as the authentication identifier of the UE to log in to the first application, and return an application registration response to the UE.
The method according to claim 1, wherein before receiving the application registration request sent by the user equipment UE, the method further includes:

Obtaining, from the core network device, a service identifier allocated by the core network device to a pre-registered application.
The method according to claim 1 or 2, wherein the acquiring the application account from the core network device to use the application account as the authentication identifier of the UE for subsequent login to the first application, and After returning the application registration response to the UE, the method further includes:

Receiving an application login request sent by the UE, where the application login request includes information about the second application that the UE requests to log in;

Querying, according to the application login request, the application account that the UE logs in to the second application;

Sending the application account to the application server of the second application, so that the application server authenticates the application account and returns an authentication response;

Receiving the authentication response from the application server, and feeding back the login result to the UE according to the authentication response.
The method according to claim 3, after the querying the UE to log in to the application account of the second application according to the application login request, the method further includes:

And if the application account is not queried, sending an account acquisition request to the core network device, where the account acquisition request includes the service identifier and the user identifier, and from the core network device Obtain the application account.
The method according to claim 3 or 4, wherein after the querying the UE to log in to the application account of the second application according to the application login request, the method further includes:

If the two or more application accounts are queried, the two or more application accounts are sent to the UE, and the application account that is sent by the UE to log in to the second application is received.
The method according to claim 1, wherein before receiving the application registration request sent by the user equipment UE, the method further includes:

Receiving, by the core network device, a user identifier allocated to the UE according to a virtual machine registration request sent by the UE;

Allocating a virtual machine to the UE according to the user identifier, and returning a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device according to the The virtual machine allocation response stores the username and password of the UE and returns a virtual machine registration response to the UE.
The method according to claim 6, wherein the virtual machine registration request comprises a username, a password set by the UE, and a temporary identifier of the UE.
The method according to claim 6, wherein the virtual machine registration request comprises user information using the UE;

The method further includes: assigning a virtual machine to the UE according to the user identifier,

The username and password are randomly generated for the UE.
The method according to any one of claims 6 to 8, wherein after the virtual machine is allocated to the UE according to the user identifier, and the virtual machine allocation response is returned to the core network device, the method further includes :

Receiving a virtual machine login request of the UE, where the virtual machine login request includes a username and a password of the UE;

Sending the user name and password of the UE to the core network device, so that the core network device authenticates the UE according to the user name and password of the UE, and returns an authentication response, where the authentication response includes User identifier of the UE;

Starting the virtual machine allocated for the UE according to the user identifier, and returning a virtual machine login response to the UE.
The method according to any one of claims 6 to 9, wherein the basis After the user identifier is allocated to the UE and the VM is allocated to the core network device, the method further includes:

Receiving a virtual machine removal request sent by the core network device after authenticating the UE according to the virtual machine logout request sent by the UE and querying the user identifier of the UE, where the virtual machine removal request includes the user of the UE Identification

And deleting the virtual machine allocated to the UE according to the virtual machine destruction request, and deleting configuration information corresponding to the user identifier of the UE.
A user authentication method, comprising:

Receiving an account registration request sent by the mobile virtualization device, where the account registration request includes a service identifier of the first application requested by the user equipment UE and a user identifier of the UE;

Assigning, to the UE, an application account that is logged in to the first application according to the account registration request;

Sending the application account to the mobile virtualization device and the application server of the first application.
The method according to claim 11, wherein before receiving the account registration request sent by the mobile virtualization device, the method further includes:

Assigning a service identifier to the pre-registered application and transmitting the service identifier to the mobile virtualization device.
The method according to claim 11 or 12, wherein after the sending the application account to the mobile virtualization device and the application server of the first application, the method further includes:

Receiving an account acquisition request sent by the mobile virtualization device after the UE is logged in to the application account of the second application, where the account acquisition request includes the service identifier of the second application and the user identifier of the UE;

Returning the application account to the mobile virtualization device according to the account acquisition request.
The method according to claim 11 or 12, wherein before receiving the account registration request sent by the mobile virtualization device, the method further includes:

Receiving a virtual machine registration request sent by the UE, and assigning a user identifier to the UE according to the virtual machine registration request;

Sending the user identifier to the mobile virtualization device, so that the mobile virtualization device allocates a virtual machine to the UE according to the user identifier;

Receiving a virtual machine allocation response sent by the mobile virtualization device, the virtual machine assigning a response Including the username and password of the UE;

The user name and password of the UE are stored, and a virtual machine registration response is returned to the UE.
The method according to claim 14, wherein the virtual machine registration request includes a username, a password set by the UE, and a temporary identifier of the UE; or

The virtual machine registration request includes user information using the UE.
The method according to claim 14 or 15, wherein after the user name and password of the UE are stored and the virtual machine registration response is returned to the UE, the method further includes:

Receiving, by the mobile virtualization device, a user name and a password of the UE that are sent according to a virtual machine login request sent by the UE, where the virtual machine login request includes a username and a password of the UE;

And authenticating the UE according to the user name and password of the UE, and returning an authentication response, where the authentication response includes a user identifier of the UE, so that the mobile virtualization device is started according to the user identifier. The virtual machine allocated by the UE, and returning a virtual machine login response to the UE.
The method according to any one of claims 14 to 16, wherein after the user name and password of the UE are stored and the virtual machine registration response is returned to the UE, the method further includes:

Receiving a virtual machine logout request sent by the UE, where the virtual machine logout request includes a username and a password of the UE;

And authenticating the UE according to the virtual machine logout request, and querying a user identifier of the UE;

Sending a virtual machine removal request to the mobile virtualization device, the virtual machine removal request including the user identification to cause the mobile virtualization device to remove a virtual machine allocated to the UE according to the virtual machine removal request, And deleting configuration information corresponding to the user identifier;

The configuration information corresponding to the user identifier is deleted, and the virtual machine logout response is returned to the UE.
A user authentication method, comprising:

Receiving an application account that is sent by the core network device, where the application account is an application account that is allocated when the core network device requests the user equipment UE to register the first application.
The method according to claim 18, wherein after receiving the application account sent by the core network device, the method further includes:

Receiving an application account sent by the mobile virtualization device, where the application account is an application of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE. account number;

And authenticating the application account, and returning an authentication response to the mobile virtualization device.
A mobile virtual device, comprising:

a receiving module, configured to receive an application registration request sent by the user equipment UE, where the application registration request includes information about the first application that the UE requests to register;

a processing module, configured to query, according to the application registration request, a service identifier of the first application and a user identifier of the UE;

a sending module, configured to send an account registration request to the core network device, where the account registration request includes the service identifier and the user identifier, so that the core network device allocates a login office to the UE according to the account registration request. Transmitting an application account of the first application and sending the application account to an application server of the first application;

The receiving module is further configured to acquire the application account from the core network device to use the application account as an authentication identifier of the UE to log in to the first application, and return an application registration response to the UE.
The device according to claim 20, wherein the receiving module is further configured to acquire, from the core network device, a service identifier that is allocated by the core network device to a pre-registered application.
The device according to claim 20 or 21, wherein the receiving module is further configured to receive an application login request sent by the UE, where the application login request includes information of the second application that the UE requests to log in;

The processing module is further configured to query, according to the application login request, the application account of the UE to log in to the second application;

The sending module is further configured to send the application account to the application server of the second application, so that the application server authenticates the application account and returns an authentication response;

The receiving module is further configured to receive the authentication response from the application server, and feed back a login result to the UE according to the authentication response.
The device according to claim 22, wherein the sending module is further configured to: if the application account is not queried, send an account obtaining request to the core network device, where the account obtaining request includes the Service identifier and the user identifier;

The receiving module is further configured to acquire the application account from the core network device.
The device according to claim 22 or 23, wherein said transmitting module, The method is further configured to send the two or more application accounts to the UE if two or more application accounts are queried;

The receiving module is further configured to receive an application account that is sent by the UE and is selected to log in to the second application.
The device according to claim 20, wherein the receiving module is further configured to receive a user identifier that is allocated by the core network device to the UE according to a virtual machine registration request sent by the UE;

The processing module is further configured to allocate a virtual machine to the UE according to the user identifier;

The sending module is further configured to return a virtual machine allocation response to the core network device, where the virtual machine allocation response includes a username and a password of the UE, so that the core network device allocates response according to the virtual machine allocation The user name and password of the UE and return a virtual machine registration response to the UE.
The device according to claim 25, wherein the virtual machine registration request comprises a username, a password set by the UE, and a temporary identifier of the UE.
The device according to claim 25, wherein the virtual machine registration request comprises user information using the UE;

The processing module is further configured to randomly generate the user name and password for the UE while allocating a virtual machine to the UE according to the user identifier.
The device according to any one of claims 25 to 27, wherein the receiving module is further configured to receive a virtual machine login request of the UE, where the virtual machine login request includes a username and a password of the UE;

The sending module is further configured to send the user name and password of the UE to the core network device, so that the core network device authenticates the UE according to the user name and password of the UE, and returns the authentication. In response, the authentication response includes a user identifier of the UE;

The processing module is further configured to start, according to the user identifier, the virtual machine allocated for the UE;

The sending module is further configured to return a virtual machine login response to the UE.
The device according to any one of claims 25 to 28, wherein the receiving module is further configured to receive, by the core network device, an authentication of the UE according to a virtual machine logout request sent by the UE. Querying a virtual machine removal request sent after the user identifier of the UE, the virtual The virtual machine removal request includes a user identifier of the UE;

The processing module is further configured to remove the virtual machine allocated to the UE according to the virtual machine destruction request, and delete configuration information corresponding to the user identifier of the UE.
A core network device, comprising:

a receiving module, configured to receive an account registration request sent by the mobile virtualization device, where the account registration request includes a service identifier of the first application that the user equipment UE requests to register, and a user identifier of the UE;

a processing module, configured to allocate, according to the account registration request, an application account that is used to log in to the first application;

And a sending module, configured to send the application account to the mobile virtualization device and the application server of the first application.
The device according to claim 30, wherein the processing module is further configured to allocate a service identifier to the pre-registered application;

The sending module is further configured to send the service identifier to the mobile virtualization device.
The device according to claim 30 or 31, wherein the receiving module is further configured to receive an account obtaining request sent by the mobile virtualization device after acquiring an application account that the UE logs in to the second application, where The account acquisition request includes a service identifier of the second application and a user identifier of the UE;

The sending module is further configured to return the application account to the mobile virtualization device according to the account acquisition request.
The device according to claim 30 or 31, wherein the receiving module is further configured to receive a virtual machine registration request sent by the UE;

The processing module is further configured to allocate a user identifier to the UE according to the virtual machine registration request;

The sending module is further configured to send the user identifier to the mobile virtualization device, so that the mobile virtualization device allocates a virtual machine to the UE according to the user identifier;

The receiving module is further configured to receive a virtual machine allocation response sent by the mobile virtualization device, where the virtual machine allocation response includes a username and a password of the UE;

The processing module is further configured to store a username and a password of the UE;

The sending module is further configured to return a virtual machine registration response to the UE.
The device according to claim 33, wherein the virtual machine registration request comprises a username, a password set by the UE, and a temporary identifier of the UE; or

The virtual machine registration request includes user information using the UE.
The device according to claim 33 or 34, wherein the receiving module is further configured to receive a username and a password of the UE that are sent by the mobile virtualization device according to a virtual machine login request sent by the UE, The virtual machine login request includes a username and password of the UE;

The processing module is further configured to perform authentication on the UE according to the username and password of the UE;

The sending module is further configured to: return an authentication response, where the authentication response includes a user identifier of the UE, so that the mobile virtualization device starts the virtual machine allocated to the UE according to the user identifier. And returning a virtual machine login response to the UE.
The device according to any one of claims 33 to 35, wherein the receiving module is further configured to receive a virtual machine logout request sent by the UE, where the virtual machine logout request includes a username and a password of the UE. ;

The processing module is further configured to perform authentication on the UE according to the virtual machine logout request, and query a user identifier of the UE;

The sending module is further configured to send a virtual machine removal request to the mobile virtualization device, where the virtual machine removal request includes the user identifier, so that the mobile virtualization device removes the allocation according to the virtual machine removal request. Giving the virtual machine of the UE, and deleting configuration information corresponding to the user identifier;

The processing module is further configured to delete configuration information corresponding to the user identifier;

The sending module is further configured to return a virtual machine logout response to the UE.
An application server, comprising:

The receiving module is configured to receive an application account that is sent by the core network device, where the application account is an application account that is allocated when the core network device requests the user equipment UE to register the first application.
The device according to claim 37, further comprising: a processing module and a sending module;

The receiving module is further configured to receive an application account that is sent by the mobile virtualization device, where the application account is an application account of the second application that the mobile virtualization device requests to log in according to the application login request sent by the UE. ;

The processing module is configured to authenticate the application account;

The sending module is configured to return an authentication response to the mobile virtualization device.
An authentication system, comprising: a mobile virtualization device, a core network device, an application server, and a user equipment UE; wherein the mobile virtualization device uses the mobile device according to any one of claims 20-29 The core network device adopts the core network device according to any one of claims 30 to 36; and the application server adopts the application server according to claim 37 or 38.