WO2017166976A1

WO2017166976A1 - Method, device, and system for distributing and verifying application service

Info

Publication number: WO2017166976A1
Application number: PCT/CN2017/075760
Authority: WO
Inventors: 冯春来
Original assignee: 华为技术有限公司
Priority date: 2016-03-30
Filing date: 2017-03-06
Publication date: 2017-10-05
Also published as: CN105744520B; CN105744520A

Abstract

Disclosed in the present invention are a method, a device, and a system for distributing and verifying an application service so as to provide a reliable service distribution and verification solution independent of mobile phone short messages. The method comprises: a terminal, when receiving a service distribution request, establishing a first security channel to an operator authentication center, the service distribution request carrying a first MSISDN therein; the terminal acquiring an authentication parameter, transmitting the authentication parameter to the operator authentication center, and delivering the authentication parameter, by means of the operator authentication center, to an AAA server for EAP authentication, and acquiring, after the EAP authentication is passed, a second MSISDN of the terminal; the terminal forwarding, when the first MSISDN and the second MSISDN are the same, the service distribution request, by means of the operator authentication center, to an application provider to which the service distribution request corresponds. In this way, when an application service is distributed, there is no necessity of sending to the terminal a short message verification code, eliminating the dependence on short messages.

Description

Method, device and system for issuing verification of application service

This application claims the priority of the Chinese Patent Application filed on March 30, 2016, the Chinese Patent Application No. 201610195162.4, the title of the invention is "the application verification method, device and system for application service", the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present invention relates to the field of wireless, and in particular, to a method, device and system for issuing and verifying an application service.

Background technique

Since the mobile phone number has already achieved legal mandatory real-name authentication, the mobile phone number is of great significance to the user. A large number of personal mobile applications use the short message verification code as the main auxiliary method to confirm the identity of the user terminal during the user registration or business use process. In addition, today's users have a large number of user names in various applications, passwords, passwords forgotten to become a very common phenomenon, this time a common strategy for password recovery is to retrieve through the mobile phone SMS verification code.

In the mobile phone operating system, the telecommunication application service, such as wifi-based voice service (vowifi), LTE-based voice service (volte), or the like, or the Internet provides the user with various application services (Over The Top, OTT) application services. The service opening of the application service bound to the user's mobile phone number is mostly verified by sending a short message verification code to the mobile phone. The reason is that the short message channel is based on the operator channel, and the operator is authenticated. Only the mobile phone where the mobile phone number is located can Receive text messages and therefore have the ability to resist counterfeiting. For example, when the WeChat service and the common mobile Internet banking are registered, because these services are bound to the mobile phone number, the service provider will send a short message verification code to the mobile phone to confirm the mobile phone, and ensure that the user service belongs to the user to which the mobile phone number belongs. initiate.

However, when the mobile network is unavailable, such as an area that is not covered by the carrier's base station, if the user's overseas business trip does not sign international roaming, etc., the user fails to accept the short message, and the application service fails to be issued, and in this case, Application service delivery is often a relatively urgent need of customers, so there is a need for a reliable service delivery verification solution that does not rely on mobile phone text messages.

Summary of the invention

The embodiment of the invention provides a method, a device and a system for issuing and verifying an application service, so as to provide a reliable service delivery verification solution that does not depend on a short message of a mobile phone.

The specific technical solutions provided by the embodiments of the present invention are as follows:

The first aspect provides a method for issuing and verifying an application service, including:

When receiving the service issuance request, the terminal establishes a first security channel with the operator authentication center, where the service release request carries the first international public subscriber identification number MSISDN, and the authentication center is located in the operator network;

Obtaining, by the terminal, an authentication parameter used by the terminal for the EAP authentication of the extensible authentication protocol, and transmitting, by using the first security channel, the authentication parameter to the operator authentication center, by using the operator The authentication center will describe the The weight parameter is passed to the authentication, authorization, and accounting AAA server for EAP authentication, and the AAA server is located in the carrier network;

After the EAP authentication is passed, the terminal acquires a second MSISDN of the terminal;

When the first MSISDN carried in the service issuance request is the same as the second MSISDN, the terminal forwards the service release request to the application provider corresponding to the service release request by using the operator authentication center. .

On the basis of the first aspect, optionally, the terminal acquires an authentication parameter used by the terminal for EAP authentication, including:

The terminal interacts with a user identification module embedded in the terminal to obtain an authentication parameter used by the terminal for EAP authentication.

On the basis of the first aspect, the method further includes: after the terminal forwards the service issuance request to the application provider corresponding to the service release request by using the operator authentication center, the method further includes:

The terminal removes a first secure channel from the authentication center.

On the basis of the first aspect, optionally, the acquiring, by the terminal, the MSISDN of the terminal includes:

The terminal interacts with a user identification module embedded in the terminal to obtain an international mobile subscriber identity (IMSI) of the terminal, and sends the IMSI to the operator authentication center by using the first secure channel. The operator authentication center sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI.

On the basis of the first aspect, optionally, the terminal forwards the service release request to the application provider corresponding to the service release request by using the operator authentication center, including:

Sending, by the terminal, the service release request to the operator authentication center by using the first secure channel, and using the second security between the service security center and the application provider corresponding to the service release request And the channel forwards the service release request to an application provider corresponding to the service release request.

The second aspect provides a method for issuing and verifying an application service, including:

The operator authentication center establishes a first secure channel between the terminal and the terminal, and uses the first secure channel to receive an authentication parameter sent by the terminal for the received service release request, where the authentication parameter is used by the terminal. Extensible authentication protocol EAP authentication with the AAA server;

The operator authentication center transmits the authentication parameter to the AAA server for EAP authentication, and the AAA server is located in the operator network;

After the EAP authentication is passed, the operator authentication center receives the service issuance request sent by the terminal, and sends the service release request to the application provider corresponding to the service release request.

On the basis of the second aspect, optionally, before receiving the service issuance request sent by the terminal, the operator authentication center further includes:

The operator authentication center receives the international mobile subscriber identity (IMSI) of the terminal sent by the terminal by using the first secure channel, and sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI, and Sending the MSISDN to the terminal through the first secure channel.

On the basis of the second aspect, optionally, the operator authentication center receives the service issuance request sent by the terminal, and sends the service release request to the application provider corresponding to the service release request, including :

The operator authentication center receives the service release request sent by the terminal by using the first secure channel, and uses the second secure channel between the service security center and the application provider corresponding to the service release request, Forwarding the service release request to an application provider corresponding to the service release request.

In a third aspect, an apparatus for issuing and verifying an application service is provided, including:

The establishing unit, when receiving the service issuance request, establishes a first security channel with the operator authentication center, where the service issuance request carries the first international public subscriber identification number MSISDN, and the authentication center is located in the operator network;

a processing unit, configured to obtain an authentication parameter of the device for extensible authentication protocol EAP authentication, and use the first secure channel to transmit the authentication parameter to the operator authentication center, by using the The operator authentication center passes the authentication parameter to the authentication, authorization, and accounting AAA server for EAP authentication, and the AAA server is located in the carrier network;

After the EAP authentication is passed, acquiring the second MSISDN of the device;

When the first MSISDN carried in the service issuance request is the same as the second MSISDN, the service issuance request is forwarded by the operator authentication center to the application provider corresponding to the service issuance request.

On the basis of the third aspect, optionally, the processing unit acquires an authentication parameter used by the device for EAP authentication, specifically for:

Interacting with a user identification module embedded in the device to obtain an authentication parameter used by the terminal for EAP authentication.

On the basis of the third aspect, optionally, after the processing unit forwards the service issuance request to the application provider corresponding to the service issuance request through the operator authentication center, the establishing unit further Used for:

The first secure passage between the authentication center and the authentication center is removed.

On the basis of the third aspect, optionally, when the processing unit acquires the MSISDN of the device, the processing unit is specifically configured to:

Interacting with a subscriber identity module embedded in the device to obtain an International Mobile Subscriber Identity (IMSI) of the device, and transmitting the IMSI to the operator authentication center by using the first secure channel, through an operator's identity The right center sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI.

On the basis of the third aspect, the processing unit is specifically configured to: when the service delivery request is forwarded to the application provider corresponding to the service release request by the operator authentication center, specifically:

Sending the service release request to the operator authentication center by using the first secure channel, and using the second secure channel between the carrier security center and the application provider corresponding to the service release request, The service issuance request is forwarded to an application provider corresponding to the service issuance request.

A fourth aspect provides a device for issuing and verifying an application service, including:

a transceiver unit, configured to establish a first secure channel with the terminal, and use the first secure channel to receive an authentication parameter sent by the terminal for the received service release request, where the authentication parameter is used by the terminal Extensible authentication protocol EAP authentication with the AAA server;

An authentication unit, configured to pass the authentication parameter to an AAA server for performing an Extensible Authentication Protocol (EAP) authentication, where the AAA server is located in an operator network;

The transceiver unit is further configured to: after the EAP authentication is passed, receive a service issuance request sent by the terminal, and send the service release request to an application provider corresponding to the service release request.

On the basis of the fourth aspect, optionally, the transceiver unit is further configured to: before receiving the service issuance request sent by the terminal,

Receiving, by the first secure channel, the international mobile subscriber identity (IMSI) of the terminal sent by the middle station, sending the IMSI to an operator BOSS, acquiring an MSISDN corresponding to the IMSI, and adopting the first security A channel transmits the MSISDN to the terminal.

On the basis of the fourth aspect, optionally, the transceiver unit receives the service issuance request sent by the terminal, When the service issuance request is sent to the application provider corresponding to the service issuance request, it is specifically used to:

Receiving, by the first secure channel, a service issuance request sent by the terminal, and forwarding, by using the second secure channel between the application provider and the application provider corresponding to the service issue request, the service issue request to the The application provider corresponding to the service issuance request.

In a fifth aspect, a terminal device is provided, the terminal device comprising a processor, a memory, a transmitter, and a receiver, wherein the memory stores a computer readable program, and the processor runs the program in the memory And controlling the transmitter and the receiver to implement an issuance verification method of the application service related to the first aspect.

In a sixth aspect, a server device is provided, the device comprising a processor, a memory, a transceiver, wherein the memory stores a computer readable program, and the processor controls the program by running a program in the memory The transmitter and the receiver implement the verification verification method for the application service involved in the second aspect.

The seventh aspect provides an application verification verification system, where the application verification verification system includes a first device and a second device, where the first device is a device related to the third aspect or the fifth aspect relates to A terminal device, which is the device related to the fourth aspect or the server device related to the sixth aspect.

When the terminal receives the service issuance request, the terminal establishes a first security channel with the operator authentication center, where the service delivery request carries the first MSISDN, and the terminal obtains the authentication parameter. Passing the authentication parameter to the operator authentication center, and transmitting the authentication parameter to the AAA server for EAP authentication through the operator authentication center, and acquiring the second terminal after the EAP authentication is passed. The MSISDN; when the first MSISDN is the same as the second MSISDN, the terminal forwards the service issuance request to the application provider corresponding to the service issuance request through the operator authentication center, compared to the prior art, the application When the service is issued, the authentication scheme of the mobile phone short message is used. In the solution of the embodiment of the present invention, the application service provider does not need to use the operator to send the short message verification code to the terminal, thereby eliminating the dependence on the short message and reducing the dependency. The application cost of the application service reduces the development difficulty of the service side of the operator.

DRAWINGS

1 is a schematic diagram of an application verification and verification system in an embodiment of the present invention;

2 is a schematic structural diagram of a terminal device according to an embodiment of the present invention;

3 is a schematic structural diagram of a network side device according to an embodiment of the present invention;

4 is a flowchart of a method for issuing and verifying an application service according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for issuing and verifying an application service in an application scenario according to an embodiment of the present disclosure;

FIG. 6 is a flowchart of a method for issuing and verifying an application service in another application scenario according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of an apparatus for issuing and verifying an application service on a terminal side according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a device for issuing and verifying a network-side application service according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other realities obtained by those of ordinary skill in the art without creative efforts The examples are all within the scope of protection of the present invention.

The embodiment of the invention provides a method and device for issuing and verifying an application service, and considers that after the lapse of the short message service in the future, a trusted terminal authentication solution that does not depend on the mobile phone short message is used to distribute the APP self-service service. Terminal authentication provides protection. This solution requires the same trusted credibility as the short message authentication method by means of the Internet-based trusted authentication method of the wifi network accessed by the terminal.

Referring to FIG. 1 , an embodiment of the present invention provides an application verification and verification system, including a terminal 11 with an authentication application, an operator authentication center 12, authentication, authorization, and accounting (Authentication, Authorization, Accounting, AAA). a server 13 in which the operator authentication center 12 and the AAA server 13 are both located in a carrier network, wherein the terminal may be the terminal device 200 shown in FIG. 2, and the operator authentication center 12 can be the network side device shown in Figure 3, specifically:

The terminal 11 is configured to establish a first secure channel with the operator authentication center 12 when receiving the service issuance request, where the service issuance request carries the first international public subscriber identification number (Mobile Subscriber International ISDN/PSTN number) Obtaining an authentication parameter of the terminal for Extensible Authentication Protocol (EAP) authentication, and transmitting the authentication parameter to the operator authentication by using the first secure channel The center 12 transmits the authentication parameter to the AAA server 13 for EAP authentication through the operator authentication center 12; after the EAP authentication is passed, acquires the second MSISDN of the terminal; When the first MSISDN carried in the same manner as the second MSISDN, the service issuance request is forwarded by the operator authentication center 12 to the application provider corresponding to the service issuance request.

The operator authentication center 12 is configured to establish a first secure channel with the terminal 11, and use the first secure channel to receive an authentication parameter sent by the terminal 11 for the received service release request, where the authentication is performed. The parameter is used for EAP authentication between the terminal and the AAA server 13; the authentication parameter is transmitted to the AAA server 13 for EAP authentication; after the EAP authentication is passed, the service issuance request sent by the terminal is received. And sending the service issuance request to an application provider corresponding to the service issuance request.

As shown in FIG. 2, an embodiment of the present invention provides a terminal device 200, which may be a mobile phone terminal or a tablet computer capable of running a Subscriber Identity Module (SIM) card. 1 shows a block diagram of a terminal device 200 including a processor 201 and a memory 202, optionally including an input unit, a display unit, a gravitational acceleration sensor, a proximity light sensor, etc., in accordance with some embodiments. Ambient light sensor, RF unit, audio circuit, speaker, microphone, WiFi (wireless fidelity) module, Bluetooth module, power supply, external interface and other components.

It will be understood by those skilled in the art that FIG. 2 is only an example of the terminal device 200, and does not constitute a limitation of the terminal device, and may include more or less components than those illustrated, or combine some components or different components. .

The input unit is operative to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the portable multifunction device. In particular, the input unit can include a touch screen as well as other input devices. The touch screen may collect a touch operation on or near the user (such as an operation of the user using a finger, a joint, a stylus, or the like on the touch screen or in the vicinity of the touch screen), and drive the corresponding according to a preset program. Connect the device. The touch screen can detect a user's touch action on the touch screen, convert the touch action into a touch signal and send the signal to the processor 201, and can receive and execute a command sent by the processor 201; the touch signal includes at least a touch Point coordinate information. The touch screen may provide an input interface and an output interface between the terminal device 200 and a user. In addition, touch screens can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch screen, the input unit may also include other input devices. Specifically, other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (such as a volume control button, a switch button processor 201, etc.), a trackball, a mouse, a joystick, and the like.

The display unit terminal device 200 can be used to display information input by a user or information provided to a user and various menus of the terminal device 200. Further, the touch screen may cover the display panel, and when the touch screen detects a touch operation on or near it, the touch screen is transmitted to the processor 201 to determine the type of the touch event, and then the processor 201 provides corresponding on the display panel according to the type of the touch event. Visual output. In this embodiment, the touch screen and the display unit can be integrated into one component to implement the input, output, and display functions of the terminal device 200. For convenience of description, the embodiment of the present invention uses the touch screen to represent the function set of the touch screen and the display unit; In an embodiment, the touch screen and the display unit can also function as two separate components.

The gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and the gravity acceleration sensor can also be used to detect the magnitude and direction of gravity when the terminal is stationary, and can be used to identify the gesture of the mobile phone (such as horizontal and vertical). Screen switching, related games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; in the embodiment of the invention, the gravity acceleration sensor is used to acquire a user's touch motion contact touch screen in z Gravity acceleration in the axial direction.

The terminal device 200 may also include one or more proximity light sensors for turning off and disabling the touch screen to avoid erroneous operation of the touch screen by the user when the terminal device 200 is closer to the user (eg, close to the ear when the user is making a call) The terminal device 200 may also include one or more ambient light sensors for keeping the touch screen off when the terminal device 200 is located in a user's pocket or other dark area to prevent the terminal device 200 from consuming unnecessary battery power when in the locked state. Or being mishandled, in some embodiments, the proximity light sensor and the ambient light sensor may be integrated into one component or as two separate components. The terminal device 200 can also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, and details are not described herein again. Although FIG. 2 shows the proximity photosensor and the ambient light sensor, it can be understood that it does not belong to the essential configuration of the terminal device 200, and may be omitted as needed within the scope of not changing the essence of the invention.

The memory 202 can be used to store instructions and data, the memory 202 can mainly include a storage instruction area and a storage data area, the storage data area can store an association relationship between the joint touch gesture and the application function; the storage instruction area can store an operating system, at least one The instructions and the like are required for the function; the instruction may cause the processor 201 to perform the following method, the specific method includes: when receiving the service issuance request, establishing a first secure channel with the operator authentication center, where the service issuance request is carried The first international public subscriber identification number MSISDN, the authentication center is located in the operator network; the authentication parameter used by the terminal device 200 for EAP authentication is obtained, and the authentication parameter is transmitted to the first secure channel to The operator authentication center transmits the authentication parameter to the AAA server for EAP authentication through the operator authentication center, and the AAA server is located in the carrier network; after the EAP authentication is passed, the acquiring a second MSISDN of the terminal; when the first MSISDN carried in the service issuance request is the same as the second MSISDN, the service is sent Forwarding the request by the operator authentication center to the service corresponding to the request issuance application provider.

The processor 201 is a control center of the terminal device 200, and connects various parts of the entire mobile phone by using various interfaces and lines, and executes the terminal device 200 by operating or executing an instruction stored in the memory 202 and calling data stored in the memory 202. Various functions and processing data to monitor the terminal as a whole. Optionally, the processor 201 may include one or more processing units; preferably, the processor 201 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like. , the main processing of the modem processor Wireless communication. It can be understood that the above modem processor may not be integrated into the processor 201. In some embodiments, the processors, memories, can be implemented on a single chip, and in some embodiments, they can also be implemented separately on separate chips. In the embodiment of the present invention, the processor 201 is further configured to invoke an instruction in the memory to implement terminal authentication verification in an application service release process.

By programming the processor, the code corresponding to the method shown in FIG. 4 is solidified into the chip, so that the chip can perform the operation function of the terminal in the method shown in FIG. 4 during operation. How to design and program the processor is a technique well known to those skilled in the art, and details are not described herein.

The radio frequency unit can be used for receiving and transmitting signals during the transmission and reception of information or during the call. In particular, after receiving the downlink information of the base station, the processing is performed by the processor 201. In addition, the data designed for the uplink is sent to the base station. Generally, RF circuits include, but are not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like. In addition, the radio unit can communicate with network devices and other devices through wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code). Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), E-mail, Short Messaging Service (SMS), etc.

An audio circuit, a speaker, and a microphone can provide an audio interface between the user and the terminal device 200. The audio circuit can transmit the converted electrical signal of the received audio data to the speaker and convert it into a sound signal output by the speaker; on the other hand, the microphone converts the collected sound signal into an electrical signal, which is received by the audio circuit and converted into audio. The data is processed by the audio data output processor 201, sent to the terminal such as another terminal via the radio frequency unit, or outputted to the memory 202 for further processing. The audio circuit may also include a headphone jack 163 for providing audio. The interface between the circuit and the headset.

WiFi is a short-range wireless transmission technology, and the terminal device 200 can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module, which provides wireless broadband Internet access for users. Although FIG. 2 shows the WiFi module, it can be understood that it does not belong to the essential configuration of the terminal device 200, and may be omitted as needed within the scope of not changing the essence of the invention.

Bluetooth is a short-range wireless communication technology. With Bluetooth technology, communication between mobile communication terminal devices such as handheld computers, notebook computers, and mobile phones can be effectively simplified, and communication between the above devices and the Internet can be successfully simplified. The terminal device 200 is enabled by the Bluetooth module. The data transmission between the terminal device 200 and the Internet becomes more rapid and efficient, broadening the road for wireless communication. Bluetooth technology is an open solution for wireless transmission of voice and data. Although FIG. 2 shows the Bluetooth module, it can be understood that it does not belong to the essential configuration of the terminal device 200, and may be omitted as needed within the scope of not changing the essence of the invention.

The terminal device 200 also includes a power source (such as a battery) that supplies power to the various components. Preferably, the power source can be logically coupled to the processor 201 through the power management system 194 to manage charging, discharging, and power management through the power management system 194. Features.

The terminal device 200 further includes an external interface, which may be a standard Micro USB interface, or a multi-pin connector, which may be used to connect the terminal device 200 to communicate with other devices, or may be used to connect the charger to the terminal. Device 200 is charged.

Although not shown, the terminal device 200 may further include a camera, a flash, and the like, and details are not described herein again.

Referring to FIG. 3, an embodiment of the present invention provides a network side device 300. The device 300 includes a processor 301 and a memory 302. The program code for executing the solution of the present invention is stored in the memory 302 and controlled by the processor 301. carried out.

The program stored in the memory 302 is used by the instruction processor 301 to perform the issuance verification method of the application service, including: establishing a first secure channel with the terminal, and receiving, by using the first secure channel, the terminal to issue the service for the received service. An authentication parameter requested to be sent, the authentication parameter being used for EAP authentication of the extensible authentication protocol between the terminal and the AAA server; and the authentication parameter is transmitted to the AAA server for performing an Extensible Authentication Protocol (EAP) The AAA server is located in the carrier network; after the EAP authentication is passed, the service issuance request sent by the terminal is received, and the service issuance request is sent to the application provider corresponding to the service issuance request.

It is to be understood that the processor involved in the foregoing apparatus 300 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more. An integrated circuit for controlling the execution of the program of the present invention. One or more memories included in the computer system, which may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or Other types of dynamic storage devices that store information and instructions may also be disk storage. These memories are connected to the processor via a bus.

A memory, such as a RAM, holds an operating system and a program for executing the inventive scheme. The operating system is a program that controls the running of other programs and manages system resources.

These memories can be connected to the processor via a bus or can be connected to the processor via dedicated connection lines.

By designing and programming the processor, the code corresponding to the method shown in FIG. 4 is solidified into the chip, so that the chip can perform the operation function of the operator authentication center in the method shown in FIG. 4 during operation. How to design and program the processor is a technique well known to those skilled in the art, and details are not described herein.

The method provided by the embodiment of the present invention is described below.

Based on the system architecture shown in FIG. 1 , referring to FIG. 4 , an embodiment of the present invention provides a method for issuing and verifying an application service, and the process of the method is as follows.

Step 41: The terminal receives a service issuance request, where the service issuance request carries the first MSISDN.

The first MSISDN may obtain the MSISDN corresponding to the user information according to the user information input by the user, and the first MSISDN and the application involved in the service issuance request are in a one-to-one binding relationship.

Step 42: The terminal establishes a first secure channel with the operator authentication center.

The first secure channel is a secure connection channel based on a Transport Layer Security (TLS) protocol.

Step 43: The terminal acquires an authentication parameter used by the terminal for EAP authentication, and transmits the authentication parameter to the AAA server through the operator authentication center to perform an EAP authentication process.

Specifically, the terminal transmits the authentication parameter to the operator authentication center through the first secure channel, and the operator authentication center forwards the authentication parameter to the AAA server for EAP authentication.

Step 44: After the EAP authentication is passed, the terminal acquires the second MSISDN of the terminal.

Specifically, the terminal interacts with a user identification module embedded in the terminal to obtain an international mobile subscriber identification number (IMSI) of the terminal, and the terminal sends the IMSI to the operator for authentication. Center, the operator authentication center sends the IMSI to the operator's business operation support The system (Business & Operation Support System. BOSS), the operator BOSS queries the second MSISDN corresponding to the IMSI, and feeds the second MSISDN to the terminal through the operator authentication center.

Step 45: The terminal forwards the service issuance request to the application provider corresponding to the service issuance request through the operator authentication center when the first MSISDN is the same as the second MSISDN.

Specifically, the terminal sends the service issuance request to the operator authentication center by using the first secure channel, and the application security center uses an application provider corresponding to the service release request. And the second security channel forwards the service release request to the application provider corresponding to the service release request.

It should be noted that the operator authentication center establishes a second secure channel with each application provider in the configuration phase, and the second secure channel is a TLS-based secure connection channel.

The following is a description of the method in FIG. 4 by taking the terminal as a mobile phone terminal as an example. The specific application scenario is: setting the operator authentication center on the operator side and setting the client authentication application on the mobile terminal side to operate the mobile terminal and the mobile terminal. A trusted secure channel is established between the business authentication centers through the Internet, and the authentication parameters of the mobile terminal are obtained by the client's authentication application, and the authentication parameters are transmitted to the AAA server on the operator side to authenticate the terminal. EAP authentication, after the authentication is passed, the authentication application of the client obtains the second MSISDN of the mobile terminal to match the first MSISDN carried in the service issuance request, and confirms that the service issuance request is verified when the matching succeeds, thereby eliminating the pair. The verification of mobile phone text messages depends.

Application scenario 1

The authentication APP under the mobile phone operating system interacts with the operator authentication center to implement the APP service delivery. The APP service provides the services provided by the APP of the application service (Over The Top, OTT) type to the Internet. See Figure 5.

Step 51: Establish a secure channel between the operator authentication center and the APP provider, where a long connection based on TLS is established.

Step 52: The application APP of the mobile phone client initiates a self-service service issuance request and sends it to the authentication APP of the mobile phone client. The service issuance request carries the mobile phone number bound to the application APP.

Step 53: The authentication APP of the mobile client establishes a secure channel between the Internet and the operator's authentication center, where a long connection based on TLS is established.

Step 54: The authentication APP of the mobile phone client obtains the orientation system authority by cooperation with the mobile phone operating system manufacturer, and can perform EAP-AKA authentication by using the interface to interact with the mobile phone SIM card to determine the authenticity of the SIM card.

Step 55: When the EAP-AKA authentication is passed, the authentication APP of the mobile phone client obtains the real mobile phone number of the mobile phone from the operator BOSS through the operator's authentication center.

Step 56: When the mobile phone number bound by the application APP is the same as the real mobile phone number of the mobile phone, the authentication APP of the mobile phone client forwards the self-service service issuance request to the operator authentication center.

Step 57: The operator authentication authorization center sends the self-service service issuance request to the APP provider through a secure channel with the APP provider.

Step 58: The authentication channel of the mobile phone client is removed from the secure channel established between the operator authentication and authorization center.

Step 59: The APP provider receives the self-service provisioning request of the user, and after the service is released, the mobile phone system manufacturer can be notified of the service delivery success message.

Step 510: The mobile phone system manufacturer sends a push message to the mobile phone by using the push message server to successfully deliver the service.

According to the solution, due to the authority of the operator authentication center, the APP provider does not need to perform the authenticity verification of the user terminal, so that the SMS verification code does not need to be sent to the user terminal.

Application scenario 2

The application provider for the application service in scenario 2 is the self-service distribution process of the carrier BOSS system. For the specific process, refer to Figure 6.

Step 61: The application APP of the mobile client provided by the operator initiates a self-service issuance request, and sends the request to the mobile client's authentication APP.

Step 62: The authentication client of the mobile client establishes a secure channel between the Internet and the operator's authentication center, where a long connection based on TLS is established.

Step 63: The authentication APP of the mobile phone client obtains the orientation system authority by cooperation with the mobile phone operating system manufacturer, and can perform EAP-AKA authentication by using the interface to interact with the mobile phone SIM card to determine the authenticity of the SIM card.

Step 64: When the EAP-AKA authentication is passed, the authentication APP of the mobile phone client obtains the real mobile phone number of the mobile phone from the operator BOSS through the operator's authentication center.

Step 65: When the mobile phone number bound by the application APP is the same as the real mobile phone number of the mobile phone, the authentication APP of the mobile phone client forwards the self-service service issuance request to the APP provider, where the APP provider is the operator BOSS system.

Step 66: The authentication channel of the mobile client is removed from the secure channel established between the operator and the authorization center of the operator.

Step 67: After receiving the self-service provisioning request of the user, the operator BOSS system performs service delivery, and after the service is released, sends a service delivery success message to the operator authentication center.

Step 68: The operator authentication center sends a service delivery success message to the mobile phone system manufacturer.

Step 69: The mobile phone system manufacturer sends a push message to the mobile phone by using the push message server to successfully deliver the service.

Based on the method for issuing and verifying the application service provided by the foregoing embodiment, the embodiment of the present invention provides an application verification certificate issuing device 700, which can be used to execute the execution process of the terminal in the method described in FIG. 4-6. The device 700 can be a terminal or a device installed on the terminal. FIG. 7 is a schematic structural diagram of a device 700 according to an embodiment of the present invention. As shown in FIG. 7, the device 700 includes an establishing unit 701. And processing unit 702, wherein:

The establishing unit 701, when receiving the service issuance request, establishes a first secure channel with the operator authentication center, where the service issuance request carries the first international public subscriber identification number MSISDN, and the authentication center is located in the operator network;

The processing unit 702 is configured to obtain an authentication parameter used by the device for the EAP authentication of the Extensible Authentication Protocol, and use the first secure channel to transmit the authentication parameter to the operator authentication center. The operator authentication center passes the authentication parameter to the authentication, authorization, and accounting AAA server for EAP authentication, and the AAA server is located in the operator network;

Optionally, the processing unit 702 is configured to obtain an authentication parameter used by the device for EAP authentication, specifically, to:

Optionally, after the processing unit 702 forwards the service release request to the application provider corresponding to the service release request by using the operator authentication center, the establishing unit 701 is further configured to:

Optionally, when the processing unit 702 acquires the MSISDN of the device, the processing unit 702 is specifically configured to:

Interacting with a subscriber identity module embedded in the device to obtain an International Mobile Subscriber Identity (IMSI) of the device, and transmitting the IMSI to the operator authentication center by using the first secure channel, through an operator's identity Right The heart sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI.

Optionally, the processing unit 702 is specifically configured to: when the service issuance request is forwarded to the application provider corresponding to the service issuance request by the operator authentication center, specifically:

The device 700 involved in the above embodiments may be a separate component or integrated into other components.

It should be noted that the function implementation and the interaction mode of the various units of the apparatus 700 in the embodiment of the present invention may be further referred to the description of the related method embodiments, and details are not described herein again.

Based on the method for issuing and verifying the application service provided by the foregoing embodiment, the embodiment of the present invention provides an application verification verification device 800, which can be used to execute the operator certificate in the method described in FIG. The device 800 can be the device described in FIG. 3, and FIG. 8 is a schematic structural diagram of the device 800 according to the embodiment of the present invention. As shown in FIG. 8, the device 800 includes a transceiver unit 801 and a card. Right unit 802, wherein:

The transceiver unit 801 is configured to establish a first secure channel with the terminal, and use the first secure channel to receive an authentication parameter sent by the terminal for the received service release request, where the authentication parameter is used by the Extensible authentication protocol EAP authentication between the terminal and the AAA server;

The authentication unit 802 is configured to: pass the authentication parameter to an AAA server for performing an Extensible Identity Authentication Protocol EAP authentication, where the AAA server is located in an operator network;

The transceiver unit 801 is further configured to: after the EAP authentication is passed, receive a service issuance request sent by the terminal, and send the service release request to an application provider corresponding to the service release request.

Optionally, before receiving the service issuance request sent by the terminal, the transceiver unit 801 is further configured to:

Optionally, the transceiver unit 801 is configured to: when receiving the service issuance request sent by the terminal, and sending the service release request to the application provider corresponding to the service release request, specifically:

The device 800 involved in the above embodiments may be a separate component or integrated into other components.

It should be noted that the function implementation and the interaction mode of the various units of the apparatus 800 in the embodiment of the present invention may be further referred to the description of the related method embodiments, and details are not described herein again.

In summary, in the embodiment of the present invention, when the terminal receives the service issuance request, the terminal establishes a first security channel with the operator authentication center, where the service issuance request carries the first MSISDN, and the authentication center is located in the operation. And the terminal obtains the authentication parameter used by the terminal for EAP authentication, and uses the first security channel to transmit the authentication parameter to the operator authentication center, and authenticates by the operator. The center passes the authentication parameter to the AAA server for EAP authentication, and the AAA server is located in the carrier network; after the EAP authentication is passed, the terminal acquires the second MSISDN of the terminal; When the first MSISDN carried in the service issuance request is the same as the second MSISDN, the service issuance request is forwarded to the service delivery request by the operator authentication center. Use provider. In this way, as long as the terminal can successfully access the Internet, the self-service issuance of the application service can be realized, and the short message verification code is not sent to the terminal, thereby eliminating the dependence on the short message, thereby reducing the application cost of the application service.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the embodiments of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the embodiments of the invention.

Claims

An application verification verification method for an application service, comprising:

When receiving the service issuance request, the terminal establishes a first security channel with the operator authentication center, where the service release request carries the first international public subscriber identification number MSISDN, and the authentication center is located in the operator network;

Obtaining, by the terminal, an authentication parameter used by the terminal for the EAP authentication of the extensible authentication protocol, and transmitting, by using the first security channel, the authentication parameter to the operator authentication center, by using the operator The authentication center passes the authentication parameter to the authentication, authorization, and accounting AAA server for EAP authentication, and the AAA server is located in the operator network;

After the EAP authentication is passed, the terminal acquires a second MSISDN of the terminal;

When the first MSISDN carried in the service issuance request is the same as the second MSISDN, the terminal forwards the service release request to the application provider corresponding to the service release request by using the operator authentication center. .
The method of claim 1, wherein the acquiring, by the terminal, the authentication parameter used by the terminal for EAP authentication comprises:

The terminal interacts with a user identification module embedded in the terminal to obtain an authentication parameter used by the terminal for EAP authentication.
The method according to claim 1, wherein the method further comprises: after the terminal forwards the service issuance request to the application provider corresponding to the service issuance request, by the operator authentication center, the method further includes:

The terminal removes a first secure channel from the authentication center.
The method of claim 2, wherein the acquiring, by the terminal, the MSISDN of the terminal comprises:

The terminal interacts with a user identification module embedded in the terminal to obtain an international mobile subscriber identity (IMSI) of the terminal, and sends the IMSI to the operator authentication center by using the first secure channel. The operator authentication center sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI.
The method according to claim 1, wherein the terminal forwards the service issuance request to the application provider corresponding to the service issuance request through the operator authentication center, including:

Sending, by the terminal, the service release request to the operator authentication center by using the first secure channel, and using the second security between the service security center and the application provider corresponding to the service release request And the channel forwards the service release request to an application provider corresponding to the service release request.
An application verification verification method for an application service, comprising:

The operator authentication center establishes a first secure channel between the terminal and the terminal, and uses the first secure channel to receive an authentication parameter sent by the terminal for the received service release request, where the authentication parameter is used by the terminal. Extensible authentication protocol EAP authentication with the AAA server;

The operator authentication center transmits the authentication parameter to the AAA server for EAP authentication, and the AAA server is located in the operator network;

After the EAP authentication is passed, the operator authentication center receives the service issuance request sent by the terminal, and sends the service release request to the application provider corresponding to the service release request.
The method of claim 6, wherein before the operator authentication center receives the service issuance request sent by the terminal, the method further includes:

The operator authentication center receives the international mobile subscriber identity (IMSI) of the terminal sent by the terminal by using the first secure channel, and sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI, and Pass through The first secure channel sends the MSISDN to the terminal.
The method according to claim 6, wherein the operator authentication center receives a service issuance request sent by the terminal, and sends the service issuance request to an application provider corresponding to the service issuance request. include:

The operator authentication center receives the service release request sent by the terminal by using the first secure channel, and uses the second secure channel between the service security center and the application provider corresponding to the service release request, Forwarding the service release request to an application provider corresponding to the service release request.
An apparatus for issuing and verifying an application service, comprising:

The establishing unit, when receiving the service issuance request, establishes a first security channel with the operator authentication center, where the service issuance request carries the first international public subscriber identification number MSISDN, and the authentication center is located in the operator network;

a processing unit, configured to obtain an authentication parameter of the device for extensible authentication protocol EAP authentication, and use the first secure channel to transmit the authentication parameter to the operator authentication center, by using the The operator authentication center passes the authentication parameter to the authentication, authorization, and accounting AAA server for EAP authentication, and the AAA server is located in the carrier network;

After the EAP authentication is passed, acquiring the second MSISDN of the device;

When the first MSISDN carried in the service issuance request is the same as the second MSISDN, the service issuance request is forwarded by the operator authentication center to the application provider corresponding to the service issuance request.
The device according to claim 9, wherein the processing unit acquires an authentication parameter used by the device for EAP authentication, specifically for:

Interacting with a user identification module embedded in the device to obtain an authentication parameter used by the terminal for EAP authentication.
The apparatus according to claim 9, wherein after the processing unit forwards the service issuance request to the application provider corresponding to the service issuance request through the operator authentication center, the establishing unit Also used for:

The first secure passage between the authentication center and the authentication center is removed.
The device according to claim 10, wherein when the processing unit acquires the MSISDN of the device, the processing unit is specifically configured to:

Interacting with a subscriber identity module embedded in the device to obtain an International Mobile Subscriber Identity (IMSI) of the device, and transmitting the IMSI to the operator authentication center by using the first secure channel, through an operator's identity The right center sends the IMSI to the operator BOSS to obtain the MSISDN corresponding to the IMSI.
The device according to claim 9, wherein the processing unit is configured to: when the service issuance request is forwarded to the application provider corresponding to the service issuance request by the operator authentication center, specifically:

Sending the service release request to the operator authentication center by using the first secure channel, and using the second secure channel between the carrier security center and the application provider corresponding to the service release request, The service issuance request is forwarded to an application provider corresponding to the service issuance request.
An apparatus for issuing and verifying an application service, comprising:

a transceiver unit, configured to establish a first secure channel with the terminal, and use the first secure channel to receive an authentication parameter sent by the terminal for the received service release request, where the authentication parameter is used by the terminal Extensible authentication protocol EAP authentication with the AAA server;

An authentication unit, configured to pass the authentication parameter to an AAA server for performing an Extensible Authentication Protocol (EAP) authentication, where the AAA server is located in an operator network;

The transceiver unit is further configured to: after the EAP authentication is passed, receive a service issuance request sent by the terminal, and send the service release request to an application provider corresponding to the service release request.
The device according to claim 14, wherein the transceiver unit is further configured to: before receiving the service issuance request sent by the terminal:

Receiving, by the first secure channel, the international mobile subscriber identity (IMSI) of the terminal sent by the middle station, sending the IMSI to an operator BOSS, acquiring an MSISDN corresponding to the IMSI, and adopting the first security A channel transmits the MSISDN to the terminal.
The device according to claim 14, wherein the transceiver unit receives the service issuance request sent by the terminal, and sends the service issuance request to the application provider corresponding to the service issuance request, specifically Used for:

Receiving, by the first secure channel, a service issuance request sent by the terminal, and forwarding, by using the second secure channel between the application provider and the application provider corresponding to the service issue request, the service issue request to the The application provider corresponding to the service issuance request.
An issuance verification system for an application service, comprising: the apparatus of claims 8-13 and the apparatus of claims 14-16.