CN102883325A - Identification server, mobile terminal and end-to-end identification communication channel establishing method - Google Patents
Identification server, mobile terminal and end-to-end identification communication channel establishing method Download PDFInfo
- Publication number
- CN102883325A CN102883325A CN2012104213493A CN201210421349A CN102883325A CN 102883325 A CN102883325 A CN 102883325A CN 2012104213493 A CN2012104213493 A CN 2012104213493A CN 201210421349 A CN201210421349 A CN 201210421349A CN 102883325 A CN102883325 A CN 102883325A
- Authority
- CN
- China
- Prior art keywords
- message
- calling party
- callee
- common parameter
- authentication
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention provides an identification server which is located in a core net. The identification server comprises an identification unit and a public parameter determining unit, wherein the identification unit can be used for identifying the identity of a calling party when the calling party calls a called party to generate a first message identifying code, and identifying the identity of the called party to generate a second message identifying code; and the public parameter determining unit is used for determining public parameters according to the first message identifying code and the second message identifying code, and distributing the public parameters to the calling party and the called party. Correspondingly, the invention further provides a mobile terminal and an end-to-end identification communication channel establishing method. According to the technical scheme of the invention, end-to-end encryption communication between cell phone terminals can be realized; and an encryption secret key is only grasped by the two cell phone terminals participating in the communication, and the safety of the encryption secret key is effectively improved.
Description
Technical field
The present invention relates to communication technical field, in particular to a kind of authentication server, a kind of portable terminal and a kind of end to end authentication communication channel method for building up.
Background technology
In existing mobile communication system, the voice call between the mobile phone has only realized encryption when wireless transmission, and is not encrypted when core net is transmitted.This present situation has caused voice call to have the possibility that is ravesdropping, and needs moving speech communication to have higher fail safe in the higher occasion of some security requirement, therefore need to set up the end-by-end security communication channel.
The method of end-to-end enciphoring voice telecommunication in a kind of mobile communication system has been proposed in the correlation technique, work as the caller mobile phone terminal in the method and send the call encryption request, after encrypting the qualification authentication, generate encryption key by KDC (KDC), and encryption key sent to respectively calling terminal and terminal called, set up safe enciphoring voice telecommunication channel for both sides.There is a security vulnerabilities in this scheme, and namely key is generated by (KDC) in the key distribution in the core net fully, and this might cause the security breaches of two aspects.At first, if the data leak of KDC, perhaps key is sent in the way of portable terminal monitoredly by KDC, and then this key has no fail safe and can say; Simultaneously, also exist man-in-the-middle attack and the assailant KDC that disguises oneself as to generate the possibility of key.
A kind of method of setting up safety authentication channel has also been proposed in the correlation technique, in the method, two peer-entities that are equivalent to the voice call both sides are all held digital certificate, two peer-entities will be chosen respectively a temporary transient private key, and calculate a temporary transient PKI, then temporary transient PKI, digital certificate, identify label are sent to the other side; Both sides all calculate temporary transient shared key by the other side's temporary transient PKI and one's own side's temporary transient private key, and by digital certificate, Hash operation authentication the other side identity; Last both sides all obtain final session key by temporary transient shared key is carried out Hash operation; The final session key that uses is encrypted communication, realizes the fail safe of communication.But the authentication property of communicating pair is realized by digital certificate in this scheme, set up before the key at every turn, communicating pair all must be to the authenticity of certificate center CA place checking the other side digital certificate, this brings very large communication overhead, also mean when being applied in the mobile communication system, will experience larger delay before setting up conversation, this is unacceptable in the higher voice call occasion of requirement of real-time.In mobile communication system, also can't realize before this type order that depends on PKIX PKI checking portable terminal simultaneously.In fact, in mobile communication system, core net has been done authentication to the portable terminal of access, and this verification process is to realize by the authentication parameter of the AUC of the AUC storage of using core net.Another problem is how the open parameter in this scheme is not chosen and explained, and communicating pair should be consensus before setting up key for open parameter.
Therefore, need a kind of end-by-end security set up authentication communication channel of easy realization, can improve key safety.
Summary of the invention
Consider the above-mentioned background technology, the invention provides a kind of End-to-End Security authentication communication channel and set up technology, can improve key safety.
According to an aspect of the present invention, a kind of authentication server is provided, has been positioned at core net, having comprised: authentication unit, when the caller calls callee, verify described calling party's identity and generate the first Message Authentication Code and verify described callee's identity and generate the second Message Authentication Code; The common parameter determining unit is determined common parameter according to described the first Message Authentication Code and described the second Message Authentication Code, and described common parameter is distributed to described calling party and described calling party.
This authentication server can utilize the identity of checking calling both sides and the Message Authentication Code that produces generates common parameter, and common parameter is sent to calling both sides, thereby has finished the authentication to both call sides, and need not to rely on PKI and digital certificate.
In technique scheme, preferred, described common parameter determining unit is determined described common parameter according to following formula: g=h (MAC
a, MAC
b), wherein, g represents described common parameter, h represents hash function, MAC
aRepresent described the first Message Authentication Code, MAC
bRepresent described the second Message Authentication Code.
According to a further aspect in the invention, also provide a kind of portable terminal, having comprised: Transmit-Receive Unit receives the common parameter from authentication server, and the first message that the key generation unit generates is sent to other-end with described communication of mobile terminal; Described key generation unit generates described the first message according to described common parameter, and the second message generation encryption key that sends over according to described other-end; Ciphering unit is encrypted to sent data according to described encryption key, and the data after will encrypting are sent to described other-end via described Transmit-Receive Unit.
Generate an encryption key by a message exchange procedure between two mobile phone terminals, thereby finish the foundation of secure authenticated communication channel, only have these two mobile phone terminals of participation just to know this encryption key, guaranteed the fail safe of encrypting.
In technique scheme, preferably, can also comprise: verification unit, verify whether described portable terminal and described other-end use same described common parameter, when judging the same described common parameter of use, order described Transmit-Receive Unit that described the first message is sent to described other-end.Only guaranteeing that both call sides uses on the basis of same common parameter, the guarantee both call sides generates identical encryption key.
In technique scheme, preferred, described Transmit-Receive Unit is also for the first validation value L that described authentication unit is calculated
aBe sent to described other-end, and receive the second validation value L from described other-end
b, described the second validation value L
bBased on formula
Calculate; Described verification unit also is used for based on formula
Calculate described the first validation value L
a, and verify described the second validation value L
bWhether correct, when being correct, determine that described portable terminal and described other-end use same described common parameter at the result, wherein, n
bThe identification code of described other-end, n
aBe the identification code of described portable terminal, q is the modulus that is pre-stored in described portable terminal and the described other-end.
In above-mentioned arbitrary technical scheme, preferred, described Transmit-Receive Unit also is used for receiving the second message K from described other-end
b, described the second message K
bBased on formula
Generate, and the first message K that described ciphering unit is generated
aBe sent to described other-end; Described ciphering unit is according to formula
Generate the first message K
a, and according to formula
With the second message K from described other-end
bCalculate described encryption key, wherein, r
aAnd r
bRespectively less than or equal to default integer-valued integer more than or equal to 1.It is relevant with the maximum message value of hash function output to preset integer value.
According to another aspect of the invention, a kind of end to end authentication communication channel method for building up also is provided, may further comprise the steps: when the caller calls callee, core net is determined common parameter according to the described calling party's of checking identity the first Message Authentication Code that generates and the second Message Authentication Code that the identity of verifying described callee generates, and described common parameter is distributed to described calling party and described calling party; Described calling party and described callee generate separately message according to described common parameter, and mutually exchange described message separately; The encryption key that described calling party is identical with the message generation that described callee sends over according to the other side respectively, described calling party and described callee are encrypted to sent data according to described encryption key respectively, to set up the end to end authentication communication channel between described calling party and the described callee.
Core net can be utilized the identity of checking calling both sides and the Message Authentication Code that produces generates common parameter, and common parameter is sent to calling both sides, thereby has finished the authentication to both call sides, and need not to rely on PKI and digital certificate.Generate an encryption key by a message exchange procedure between two mobile phone terminals, thereby finish the foundation of secure authenticated communication channel, only have these two mobile phone terminals that participate in cipher key change just to know this encryption key, guaranteed the fail safe of encrypting.
In technique scheme, preferred, described core net is determined described common parameter according to following formula: g=h (MAC
a, MAC
b), wherein, g is described common parameter, h is hash function, MAC
aDescribed calling party's Message Authentication Code, MAC
bMessage Authentication Code for described callee.
In technique scheme, preferred, can also may further comprise the steps: verify whether described calling party and described callee use same described common parameter; If use same described common parameter, then mutually exchange described message separately.
In technique scheme, preferred, proof procedure specifically comprises: described calling party is based on formula
Calculate the first validation value L
a, and with described the first validation value L
aBe sent to described callee; Described callee is based on formula
Calculate the second validation value L
b, and with described the second validation value L
bBe sent to described calling party; Described calling party verifies described the second validation value L
bWhether correct, described callee verifies described the first validation value L
aWhether correct, if described the first validation value L
aWith described the second validation value L
bAll correct, determine that then described calling party and described callee use same described common parameter, wherein, n
bDescribed callee's identification code, n
aBe described calling party's identification code, q is the modulus that is pre-stored among described calling party and the described callee.
In technique scheme, preferred, the generative process of described encryption key specifically comprises: described calling party is according to formula
Generate the first message K
a, and with the first message K
aBe sent to described callee, described callee is according to formula
Generate the second message K
b, and with the second message K
bBe sent to described calling party; Described calling party is according to formula
With the second message K from described callee
bCalculate described encryption key, described callee is according to formula
With the first message K from described calling party
aCalculate described encryption key, wherein, r
aAnd r
bRespectively less than or equal to default integer-valued integer more than or equal to 1.It is relevant with the maximum message value of hash function output to preset integer value.
Description of drawings
Fig. 1 shows the according to an embodiment of the invention block diagram of authentication server;
Fig. 2 shows the according to an embodiment of the invention block diagram of portable terminal;
Fig. 3 shows the block diagram that End-to-End Security authenticated channel is according to an embodiment of the invention set up system;
Fig. 4 shows the flow chart of end to end authentication communication channel method for building up according to an embodiment of the invention;
Fig. 5 shows the flow chart of end to end authentication communication channel method for building up according to still another embodiment of the invention.
Embodiment
In order more clearly to understand above-mentioned purpose of the present invention, feature and advantage, below in conjunction with the drawings and specific embodiments the present invention is further described in detail.
A lot of details have been set forth in the following description so that fully understand the present invention; but; the present invention can also adopt other to be different from other modes described here and implement, and therefore, protection scope of the present invention is not subjected to the restriction of following public specific embodiment.
The present invention will be further described below in conjunction with drawings and Examples.Need to prove that in the situation of not conflicting, the application's embodiment and the feature among the embodiment can make up mutually.
Fig. 1 shows the according to an embodiment of the invention block diagram of authentication server.
As shown in Figure 1, authentication server 100 according to an embodiment of the invention, are positioned at core net, comprising: authentication unit 102, when the caller calls callee, the checking calling party identity and generate the first Message Authentication Code and the checking callee identity and generate the second Message Authentication Code; Common parameter determining unit 104 is determined common parameter according to the first Message Authentication Code and the second Message Authentication Code, and common parameter is distributed to calling party and calling party.
This authentication server 100 can utilize the identity of checking calling both sides and the Message Authentication Code that produces generates common parameter, and common parameter is sent to calling both sides, thereby has finished the authentication to both call sides, and need not to rely on PKI and digital certificate.
Preferably, common parameter determining unit 104 is determined common parameter according to following formula: g=h (MAC
a, MAC
b), wherein, g represents common parameter, h represents hash function, MAC
aRepresent the first Message Authentication Code, MAC
bRepresent the second Message Authentication Code.
Fig. 2 shows the according to an embodiment of the invention block diagram of portable terminal.
As shown in Figure 2, portable terminal 200 according to an embodiment of the invention, comprising: Transmit-Receive Unit 202 receives the common parameter from authentication server, and the first message that the key generation unit generates is sent to other-end with communication of mobile terminal; Key generation unit 204 generates the first message according to common parameter, and the second message generation encryption key that sends over according to other-end; Ciphering unit 206 is encrypted to sent data according to encryption key, and the data after will encrypting are sent to other-end via Transmit-Receive Unit.
Generate an encryption key by a message exchange procedure between two mobile phone terminals, thereby finish the foundation of secure authenticated communication channel, only have these two mobile phone terminals of participation just to know this encryption key, guaranteed the fail safe of encrypting.
Preferably, portable terminal 200 can also comprise: verification unit 208, and whether checking portable terminal and other-end use same common parameter, and when judging the same common parameter of use, the order Transmit-Receive Unit is sent to other-end with the first message.Only guaranteeing that both call sides uses on the basis of same common parameter, the guarantee both call sides generates identical encryption key.
Preferably, Transmit-Receive Unit 202 is also for the first validation value L that authentication unit is calculated
aBe sent to other-end, and receive the second validation value L from other-end
b, the second validation value L
bBased on formula
Calculate; Verification unit 208 also is used for based on formula
Calculate described the first validation value L
a, and verify described the second validation value L
bWhether correct, when being correct, determine that described portable terminal and described other-end use same described common parameter at the result, wherein, n
bThe identification code of described other-end, n
aBe the identification code of described portable terminal, q is the modulus that is pre-stored in described portable terminal and the described other-end.
In above-mentioned arbitrary technical scheme, preferred, described Transmit-Receive Unit 202 also is used for receiving the second message K from described other-end
bDescribed the second message K
bBased on formula
Generate, and the first message K that described ciphering unit is generated
aBe sent to described other-end; Described ciphering unit 206 is according to formula
Generate the first message K
a, and according to formula
With the second message K from described other-end
bCalculate described encryption key, wherein, r
aAnd r
bRespectively less than or equal to default integer-valued integer more than or equal to 1.It is relevant with the maximum message value of hash function output to preset integer value.
Fig. 3 shows the block diagram that End-to-End Security authenticated channel is according to an embodiment of the invention set up system.
As shown in Figure 3, common parameter g is distributed to two portable terminals (portable terminal A and portable terminal B) after being selected by the authentication server 100 that is positioned at core-network side, so guarantees that by the one-time authentication data interaction both sides use same parameter g between latter two portable terminal.
After guaranteeing that portable terminal A and portable terminal B use same parameter g, generate an encryption key by a key exchange process between two portable terminals, thereby finish the foundation of secure authenticated communication channel, utilize at last this encryption key to be encrypted to sent data.Because the generative process of encryption key only has portable terminal A and portable terminal B to participate in and produces in exchange process, does not have the third party to know this encryption key, thus Effective Raise the fail safe of encryption key.
Secure authenticated communication channel is used for authenticating mutually the other side's identity between two communication equipments, and the exchange session encryption key, so that both sides realize coded communication.Can realize that by this safety authentication channel end-to-end encrypted communication between the mobile phone terminal, the present invention rely on existing mobile communication system mechanism, realize easily.Encryption key is set up by mutual by two portable terminals of communication, has avoided the grasp of core network entity to encryption key, Effective Raise the fail safe of encryption key, and then the fail safe that has improved enciphoring voice telecommunication; Simultaneously, the authentication property among the present invention is realized by the authentication of core net to portable terminal, need not communicating pair and again authenticates, and has reduced communication overhead.
Fig. 4 shows the according to an embodiment of the invention flow chart of end to end authentication communication channel method for building up.
As shown in Figure 4, end to end authentication communication channel method for building up according to an embodiment of the invention, may further comprise the steps: step 402, when the caller calls callee, core net is determined common parameter according to checking calling party's identity the first Message Authentication Code that generates and the second Message Authentication Code that the identity of verifying the callee generates, and common parameter is distributed to calling party and calling party; Step 404, calling party and callee are according to common parameter generation message separately, and mutual exchange message separately; Step 406, the encryption key that the calling party is identical with the message generation that the callee sends over according to the other side respectively, calling party and callee are encrypted to sent data according to encryption key respectively, to set up the end to end authentication communication channel between calling party and the callee.
Core net can be utilized the identity of checking calling both sides and the Message Authentication Code that produces generates common parameter, and common parameter is sent to calling both sides, thereby has finished the authentication to both call sides, and need not to rely on PKI and digital certificate.Generate an encryption key by a message exchange procedure between two mobile phone terminals, thereby finish the foundation of secure authenticated communication channel, only have these two mobile phone terminals that participate in cipher key change just to know this encryption key, guaranteed the fail safe of encrypting.
In technique scheme, preferred, core net is determined common parameter according to following formula: g=h (MAC
a, MAC
b), wherein, g is common parameter, h is hash function, MAC
aCalling party's Message Authentication Code, MAC
bMessage Authentication Code for the callee.
In technique scheme, preferred, can also may further comprise the steps: whether checking calling party and callee use same common parameter; If use same common parameter, then mutually exchange message separately.
In technique scheme, preferred, proof procedure specifically comprises: the calling party is based on formula
Calculate the first validation value L
a, and with the first validation value L
aBe sent to the callee; The callee is based on formula
Calculate the second validation value L
b, and with the second validation value L
bBe sent to the calling party; The calling party verifies the second validation value L
bWhether correct, the callee verifies the first validation value L
aWhether correct, if the first validation value L
aWith the second validation value L
bAll correct, determine that then calling party and callee use same common parameter, wherein, n
bCallee's identification code, n
aBe calling party's identification code, q is the modulus that is pre-stored among calling party and the callee.
In technique scheme, preferred, the generative process of encryption key specifically comprises: the calling party is according to formula
Generate the first message K
a, and with the first message K
aBe sent to the callee, the callee is according to formula
Generate the second message K
b, and with the second message K
bBe sent to the calling party; The calling party is according to formula
With the second message K from the callee
bCalculate encryption key, the callee is according to formula
With the first message K from the calling party
aCalculate encryption key, wherein, r
aAnd r
bRespectively less than or equal to default integer-valued integer more than or equal to 1.It is relevant with the maximum message value of hash function output to preset integer value.
Further specify according to an embodiment of the invention end to end authentication communication channel method for building up below in conjunction with Fig. 5.Authentication property in this method is by the authentication realization of core net to portable terminal, and the authentication that core net is carried out mobile phone terminal can be guaranteed the entity authentication of mobile phone terminal.Key exchange process in this method is realized by an IKE, wherein, the open parameter of IKE comprises a modulus q and a Montgomery Algorithm truth of a matter g, and modulus q is a large prime number and is contained in advance in the mobile phone terminal memory that truth of a matter g then dynamically generates.In order to narrate conveniently, in the below's narration core net is abstracted into an entity, no longer distinguish each network element in the core net.
In step 502, carry out the normal call flow process between the mobile phone terminal.Call flow herein is the call flow in the mobile communication system, is used for setting up between mobile phone terminal call link.
In step 504, determine common parameter g.In the authentication process of normal call flow process, core network can generating messages identifying code MAC for the verification terminal identity.The corresponding Message Authentication Code that two mobile phone terminals of safety authentication channel are set up in participation is designated as respectively MACa and MACb.
Make hash function h for { 0,1}* → Zp, wherein, { 0,1}* represents the message of the random length inputted, and Zp represents any one integer between 1 to p-1, for example Z
100Any one integer between the expression 1 to 99, core net calculates common parameter g=h (MACa, MACb) according to the Message Authentication Code of hash algorithm and two mobile phone terminals.
Two mobile phone terminals supposing to participate in to set up safety authentication channel are designated as respectively terminal A and terminal B, and core net sends to respectively terminal A and terminal B with the common parameter g that calculates.
Wherein, use same common parameter in order to ensure two mobile phone terminals, need to verify.The cell-phone number of supposing terminal A is na, and the cell-phone number of terminal B is nb.In order to verify whether both sides use same parameter g, and terminal A is based on formula
Calculate L
aAnd with L
aSend to terminal B, and terminal B is based on formula
Calculate L
bAnd with L
bSend to terminal A.
Terminal A and terminal B verify respectively the correctness of the other side's sending value, if correctly, then continue the cipher key change of execution in step 506; If incorrect, then stop this flow process.
In step 506, cipher key change.
Terminal A selects random number r
a∈ Zp calculates
And the first message Ka sent to terminal B.
Terminal B selects random number r
b∈ Zp calculates
And the second message Kb sent to terminal A.
Terminal A calculates encryption key
Terminal B calculates encryption key
Final both sides generate same encryption key for session, have so far set up End-to-End Security authentication communication channel.Both sides utilize this encryption key to be encrypted to sent data, have realized coded communication.
More than be described with reference to the accompanying drawings according to technical scheme of the present invention, proposed a kind of technology of setting up the End-to-End Security authenticated channel between mobile phone terminal, only needing increases several interaction messages on existing mobile communication system basis, realizes easily.Secondly, the encryption key in the technical program is only grasped by two mobile phone terminals that participate in communication, Effective Raise key safety; The authentication of mobile phone terminal is finished by the authentication mechanism of core net in this programme simultaneously, need not to depend on PKIX and digital certificate, the coded communication of using the technical program to realize, the delay of communication channel stage is less setting up, can be applicable to the higher voice call occasion of requirement of real-time, the fine real-time requirement that satisfies the user of energy improves user's experience and experiences.
The above is the preferred embodiments of the present invention only, is not limited to the present invention, and for a person skilled in the art, the present invention can have various modifications and variations.Within the spirit and principles in the present invention all, any modification of doing, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (11)
1. an authentication server is characterized in that, is positioned at core net, comprising:
Authentication unit when the caller calls callee, is verified described calling party's identity and is generated the first Message Authentication Code and verify described callee's identity and generate the second Message Authentication Code;
The common parameter determining unit is determined common parameter according to described the first Message Authentication Code and described the second Message Authentication Code, and described common parameter is distributed to described calling party and described calling party.
2. authentication server according to claim 1 is characterized in that, described common parameter determining unit is determined described common parameter according to following formula:
G=h (MAC
a, MAC
b), wherein, g represents described common parameter, h represents hash function, MAC
aRepresent described the first Message Authentication Code, MAC
bRepresent described the second Message Authentication Code.
3. a portable terminal is characterized in that, comprising:
Transmit-Receive Unit receives the common parameter from authentication server, and the first message that the key generation unit generates is sent to other-end with described communication of mobile terminal;
Described key generation unit generates described the first message according to described common parameter, and the second message generation encryption key that sends over according to described other-end;
Ciphering unit is encrypted to sent data according to described encryption key, and the data after will encrypting are sent to described other-end via described Transmit-Receive Unit.
4. portable terminal according to claim 3, it is characterized in that, also comprise: verification unit, verify whether described portable terminal and described other-end use same described common parameter, when judging the same described common parameter of use, order described Transmit-Receive Unit that described the first message is sent to described other-end.
5. portable terminal according to claim 4 is characterized in that, described Transmit-Receive Unit is also for the first validation value L that described authentication unit is calculated
aBe sent to described other-end, and receive the second validation value L from described other-end
b, described the second validation value L
bBased on formula
Calculate;
Described verification unit also is used for based on formula
Calculate described the first validation value L
a, and verify described the second validation value L
bWhether correct, when being correct, determine that described portable terminal and described other-end use same described common parameter at the result, wherein, n
bThe identification code of described other-end, n
aBe the identification code of described portable terminal, q is the modulus that is pre-stored in described portable terminal and the described other-end.
6. each described portable terminal in 5 according to claim 3 is characterized in that described Transmit-Receive Unit also is used for receiving the second message K from described other-end
bDescribed the second message K
bBased on formula
Generate, and the first message K that described ciphering unit is generated
aBe sent to described other-end;
Described ciphering unit is according to formula
Generate the first message K
a, and according to formula
With the second message K from described other-end
bCalculate described encryption key, wherein, r
aAnd r
bRespectively less than or equal to default integer-valued integer more than or equal to 1.
7. an end to end authentication communication channel method for building up is characterized in that, may further comprise the steps:
When the caller calls callee, core net is determined common parameter according to the described calling party's of checking identity the first Message Authentication Code that generates and the second Message Authentication Code that the identity of verifying described callee generates, and described common parameter is distributed to described calling party and described calling party;
Described calling party and described callee generate separately message according to described common parameter, and mutually exchange described message separately;
The encryption key that described calling party is identical with the message generation that described callee sends over according to the other side respectively, described calling party and described callee are encrypted to sent data according to described encryption key respectively, to set up the end to end authentication communication channel between described calling party and the described callee.
8. end to end authentication communication channel method for building up according to claim 7 is characterized in that described core net is determined described common parameter according to following formula:
G=h (MAC
a, MAC
b), wherein, g is described common parameter, h is hash function, MAC
aDescribed calling party's Message Authentication Code, MAC
bMessage Authentication Code for described callee.
9. end to end authentication communication channel method for building up according to claim 7 is characterized in that, also comprises:
Verify whether described calling party and described callee use same described common parameter;
If use same described common parameter, then mutually exchange described message separately.
10. end to end authentication communication channel method for building up according to claim 9 is characterized in that proof procedure specifically comprises:
Described calling party is based on formula
Calculate the first validation value L
a, and with described the first validation value L
aBe sent to described callee;
Described callee is based on formula
Calculate the second validation value L
b, and with described the second validation value L
bBe sent to described calling party;
Described calling party verifies described the second validation value L
bWhether correct, described callee verifies described the first validation value L
aWhether correct, if described the first validation value L
aWith described the second validation value L
bAll correct, determine that then described calling party and described callee use same described common parameter, wherein, n
bDescribed callee's identification code, n
aBe described calling party's identification code, q is the modulus that is pre-stored among described calling party and the described callee.
11. each described end to end authentication communication channel method for building up in 10 according to claim 7 is characterized in that the generative process of described encryption key specifically comprises:
Described calling party is according to formula
Generate the first message K
a, and with the first message K
aBe sent to described callee, described callee is according to formula
Generate the second message K
b, and with the second message K
bBe sent to described calling party;
Described calling party is according to formula
With the second message K from described callee
bCalculate described encryption key, described callee is according to formula
With the first message K from described calling party
aCalculate described encryption key, wherein, r
aAnd r
bRespectively less than or equal to default integer-valued integer more than or equal to 1.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210421349.3A CN102883325B (en) | 2012-10-29 | 2012-10-29 | Authentication server, mobile terminal and end to end authentication communication channel method for building up |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210421349.3A CN102883325B (en) | 2012-10-29 | 2012-10-29 | Authentication server, mobile terminal and end to end authentication communication channel method for building up |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102883325A true CN102883325A (en) | 2013-01-16 |
| CN102883325B CN102883325B (en) | 2015-09-30 |
Family
ID=47484427
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210421349.3A Active CN102883325B (en) | 2012-10-29 | 2012-10-29 | Authentication server, mobile terminal and end to end authentication communication channel method for building up |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102883325B (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104066080A (en) * | 2014-06-05 | 2014-09-24 | 天地融科技股份有限公司 | Data processing method of voice communication |
| CN104144051A (en) * | 2014-07-24 | 2014-11-12 | 上海斐讯数据通信技术有限公司 | Remote voice encryption and decryption method |
| CN104301567A (en) * | 2014-08-25 | 2015-01-21 | 宇龙计算机通信科技(深圳)有限公司 | Network communication method and system |
| CN104869570A (en) * | 2015-04-10 | 2015-08-26 | 电子科技大学 | Speaking terminal confirmation method based on language channel |
| WO2016165446A1 (en) * | 2015-09-23 | 2016-10-20 | 中兴通讯股份有限公司 | Mobile terminals of teacher and parent, and method of authenticating identity of parent |
| CN112787709A (en) * | 2021-01-26 | 2021-05-11 | 兴唐通信科技有限公司 | End-to-end identity authentication method suitable for satellite mobile communication system |
| CN115022024A (en) * | 2022-05-31 | 2022-09-06 | 中国电信股份有限公司 | Method and device for encrypted call, storage medium and electronic equipment |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101183938A (en) * | 2007-10-22 | 2008-05-21 | 华中科技大学 | Wireless network security transmission method, system and equipment |
| CN101527905A (en) * | 2009-04-08 | 2009-09-09 | 刘建 | Wireless local area network identification and privacy infrastructure unicast key agreement method and system thereof |
| WO2010031600A1 (en) * | 2008-09-16 | 2010-03-25 | Telefonaktiebolaget Lm Ericsson (Publ) | Key management in a communication network |
-
2012
- 2012-10-29 CN CN201210421349.3A patent/CN102883325B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101183938A (en) * | 2007-10-22 | 2008-05-21 | 华中科技大学 | Wireless network security transmission method, system and equipment |
| WO2010031600A1 (en) * | 2008-09-16 | 2010-03-25 | Telefonaktiebolaget Lm Ericsson (Publ) | Key management in a communication network |
| CN101527905A (en) * | 2009-04-08 | 2009-09-09 | 刘建 | Wireless local area network identification and privacy infrastructure unicast key agreement method and system thereof |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104066080A (en) * | 2014-06-05 | 2014-09-24 | 天地融科技股份有限公司 | Data processing method of voice communication |
| CN104066080B (en) * | 2014-06-05 | 2017-12-08 | 天地融科技股份有限公司 | A kind of data processing method of voice call |
| CN104144051A (en) * | 2014-07-24 | 2014-11-12 | 上海斐讯数据通信技术有限公司 | Remote voice encryption and decryption method |
| CN104144051B (en) * | 2014-07-24 | 2018-04-06 | 上海斐讯数据通信技术有限公司 | A kind of remote speech encipher-decipher method |
| CN104301567A (en) * | 2014-08-25 | 2015-01-21 | 宇龙计算机通信科技(深圳)有限公司 | Network communication method and system |
| CN104869570A (en) * | 2015-04-10 | 2015-08-26 | 电子科技大学 | Speaking terminal confirmation method based on language channel |
| CN104869570B (en) * | 2015-04-10 | 2018-08-28 | 电子科技大学 | A kind of terminal check method of speaking based on voice channel |
| WO2016165446A1 (en) * | 2015-09-23 | 2016-10-20 | 中兴通讯股份有限公司 | Mobile terminals of teacher and parent, and method of authenticating identity of parent |
| CN112787709A (en) * | 2021-01-26 | 2021-05-11 | 兴唐通信科技有限公司 | End-to-end identity authentication method suitable for satellite mobile communication system |
| CN115022024A (en) * | 2022-05-31 | 2022-09-06 | 中国电信股份有限公司 | Method and device for encrypted call, storage medium and electronic equipment |
| CN115022024B (en) * | 2022-05-31 | 2023-09-29 | 中国电信股份有限公司 | Method and device for encrypting call, storage medium and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102883325B (en) | 2015-09-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108270571B (en) | Internet of Things identity authorization system and its method based on block chain | |
| CN102883325B (en) | Authentication server, mobile terminal and end to end authentication communication channel method for building up | |
| Halevi et al. | Public-key cryptography and password protocols | |
| EP2905719B1 (en) | Device and method certificate generation | |
| CN110268676A (en) | The private cipher key computing system and method for the Self-certified signature scheme of identity-based | |
| US20020164026A1 (en) | An authentication method | |
| ATE309656T1 (en) | AUTHENTICATION IN A PACKET DATA NETWORK | |
| EP1151574A1 (en) | Method of securing communication | |
| WO2019219862A1 (en) | Internet of things security with multi-party computation (mpc) | |
| CN111970699B (en) | Terminal WIFI login authentication method and system based on IPK | |
| US11044081B2 (en) | System and method for obtaining a common session key between devices | |
| Azad et al. | Authentic caller: Self-enforcing authentication in a next-generation network | |
| CN110808999B (en) | Service interaction method, device, equipment and storage medium | |
| WO2018169489A1 (en) | System and method for computing common session keys in a forward secure identity-based authenticated key exchange scheme | |
| CN105790942A (en) | Method and system for secure call and terminals | |
| CN105162585A (en) | Efficient privacy protecting session key agreement method | |
| CN112242993B (en) | Bidirectional authentication method and system | |
| CN110809000B (en) | Service interaction method, device, equipment and storage medium based on block chain network | |
| Cao et al. | On Two Kinds of Flaws in Some Server-Aided Verification Schemes. | |
| Ni et al. | A pairing-free identity-based authenticated key agreement mechanism for sip | |
| CN101938491A (en) | Password-based three-party key exchange method | |
| Ashraf et al. | Robust and lightweight remote user authentication mechanism for next-generation IoT-based smart home | |
| KR101506564B1 (en) | Method for generating parameter of public key infrastructure | |
| Malina et al. | Efficient and secure access control system based on programmable smart cards | |
| CN114760037A (en) | Identity authentication method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |