TWI755951B - Communication system and communication method - Google Patents

Abstract

Provided is a communication system for executing a third-party authentication between an edge service terminal and a cloud service terminal, which includes a first authentication procedure executing module disposed in a proxy for executing a first authentication procedure and a second authentication procedure executing module disposed in the proxy for executing a second authentication procedure. The first authentication procedure executing module includes a virtual home subscriber server and a virtual user. The second authentication procedure executing module includes a virtual open identify provider and a virtual user equipment. When a subscriber of the cloud service terminal requests a service from the edge service terminal, the first authentication procedure executing module executes the first authentication procedure.

Description

Communication system and communication method

The present invention relates to the technical field of communication, especially the technical field of authentication of communication.

With the development of communication technology, communication services in the cloud have become widely known, and the usage rate is increasing day by day. However, the speed of cloud communication is usually not as fast as that of local telecommunications services (or edge services). Therefore, when users require high bandwidth or low latency transmission quality, they still need to use telecommunications services provided by local operators. . Currently, if a user wants to use the cloud service and the edge service, not only the cloud server must have an account, but also the edge server must have an account, and they must switch accounts to use both services, which will cause inconvenience. In addition, currently the cloud server and the border server use different communication protocols, so it is difficult to communicate between the two systems.

In view of this, the present invention provides an improved communication system and communication method to solve the above problems.

Based on the above purpose, the present invention provides a communication system for performing third-party authentication between a border server and a cloud server. The communication system includes: the first authentication set on the proxy server The authentication mechanism execution module is used to execute the first authentication mechanism. The first authentication mechanism execution module includes a virtual home subscriber server (VHSS) and a virtual user (virtual user, vUSER), wherein the virtual home subscriber server is used to communicate with the border server, and the first The virtual user unit is used to communicate with the cloud server. Wherein, when the account of the cloud server wants to use the service of the boundary server, the first authentication mechanism execution module executes the first authentication mechanism.

In addition, the present invention further provides a communication method for a communication system, which is used for third-party authentication between a border server and a cloud server. The communication method includes the steps of: when the account of the cloud server wants to use the service of the boundary server, the first authentication mechanism is executed by a first authentication mechanism execution module set on the proxy server, wherein the first authentication mechanism execution module includes a virtual home The user server and the first virtual user unit, the virtual home user server is used for communicating with the border server, and the first virtual user unit is used for communicating with the cloud server.

1: Communication system

2: Proxy server

3: Cloud server

4: Boundary server

5: User Equipment

6: Message conversion mapping table

21a: The first authentication mechanism execution module

21b: Second Authentication Mechanism Execution Module

211: Virtual home user server

212: Virtual User

213: Virtual User Equipment

214: Virtual Open Account Provider

310: Cloud Database

320: Dependent side

410: Mobility Management Entity

420: home user server

510: Embedded User Identity Module

520: Universal Mobile Communication System User Identity Module

7: Second proxy server

8: Second border server

9: Third proxy server

10: Second cloud server

S201~S214: Steps

S301~S317: Steps

FIG. 1 is a system architecture diagram of a communication system according to an embodiment of the present invention.

FIG. 2(A) is a schematic diagram of signal transmission for executing a first authentication mechanism in a communication system according to an embodiment of the present invention.

FIG. 2(B) is a detailed flowchart of a communication method (first authentication mechanism) according to an embodiment of the present invention.

FIG. 3(A) is a schematic transmission diagram of a communication system executing a second authentication mechanism according to an embodiment of the present invention.

3(B) is a detailed flowchart of a communication method (second authentication mechanism) according to an embodiment of the present invention.

FIG. 4 is a detailed flowchart of a communication method according to another embodiment of the present invention.

FIG. 5(A) is a system architecture diagram of a communication system according to another embodiment of the present invention.

FIG. 5(B) is a system architecture diagram of a communication system according to yet another embodiment of the present invention.

The embodiments and operation principles of the present invention will be described below through a number of embodiments. Those with ordinary knowledge in the technical field to which the present invention pertains can understand the features and effects of the present invention through the above embodiments, and can combine, modify, replace or transfer based on the spirit of the present invention.

The term "connected" as referred to herein includes aspects such as direct connection or indirect connection, and is not limiting. The terms "when", "when" used herein mean "now, before or after" and are not limiting.

Terms such as "first", "second", etc. used in this document are used to modify the request element, and they do not imply or represent that the request element has any previous ordinal numbers, nor does it represent a request The order of an element and another requested element, or the order of the manufacturing method, the use of these ordinal numbers is only used to clearly distinguish a requested element with a certain name from another requested element with the same name.

When multiple functions (or elements) are described herein, if the word "or" is used between multiple functions (or elements), it means that the functions (or elements) can exist independently, but multiple functions (or elements) are not excluded. ) may coexist, in other words, the word "or" includes the aspect of "and" as long as the described aspect is reasonable.

FIG. 1 is a system architecture diagram of a communication system 1 according to an embodiment of the present invention. As shown in FIG. 1 , the communication system 1 of the present invention can perform third-party authentication between a cloud server 3 and a border server 4 through a proxy server 2 , so that the account of the cloud server 3 can directly Use the services of the border server 4 without registering with the border server 4, or allow the account of the border server 4 to directly use the services of the cloud server 3 without registering with the cloud server 3.

In this paper, the situation where the account of the cloud server 3 wants to use the services of the edge server 4 is defined as "cloud-to-edge", and the following paragraphs will be directly referred to as cloud-to-edge. In addition, the situation where the account of the edge server 4 wants to use the services of the cloud server 3 is defined as "edge-to-cloud", which will also be referred to as edge-to-cloud in subsequent paragraphs.

In addition, the cloud server 3 can be, for example, e-commerce companies such as Google (Google), Amazon (Amazon), T-Mobile, etc., and the services of the cloud server 3 can be, for example, various cloud services provided by these e-commerce companies, such as basic Infrastructure as a service (IaaS), software as a service (SaaS), or platform as a service (PaaS), etc., but not limited thereto. In addition, the border server 4 can be, for example, various telecommunications companies at the local end, such as Chunghwa Telecom (Hinet), FETnet (FETnet), AT&T mobile (AT&T mobile), T-Mobile (T-Mobile) or Verizon (Verizon), etc. , and the services of the border server 4 are provided by various telecom operators, such as the third generation partnership project (hereinafter referred to as 3GPP), the third generation mobile communication technology (third generation, 3G), the fourth The fourth generation mobile communication technology (4G) or the fifth generation mobile communication technology (5G), but not limited thereto.

In one embodiment, the communication system 1 of the present invention includes a proxy server 2 , a cloud server 3 and a border server 4 , so the communication system 1 may include the hardware of the proxy server 2 , the cloud server 3 and the border server 4 . body equipment and at least a portion of the software. In another embodiment, the communication system 1 of the present invention may include the hardware device of the proxy server 2 and at least a part of software, but only includes the software part of the cloud server 3 and the border server 4 . In yet another embodiment, the communication system 1 of the present invention may only include at least a part of the software of the proxy server 2 , the cloud server 3 and the border server 4 , but does not include hardware devices.

First, the details of the proxy server 2 will be described. The proxy server 2 may be provided with a first authentication mechanism execution module 21a and a second authentication mechanism execution module 21b. In the cloud-to-edge case (when the cloud When the account of the end server 3 wants to use the service of the border server 4 through the user equipment 5), the first authentication mechanism execution module 21a executes a first authentication mechanism, and when the first authentication mechanism is completed, the border server 4 A service may be provided to the user equipment 5 . In the case of edge-to-cloud (when the account of the edge server 4 wants to use the service of the cloud server 3 through the user equipment 5), the second authentication mechanism execution module 21b executes a second authentication mechanism, and when When the second authentication mechanism is completed, the cloud server 3 can provide services to the user equipment 5 . It should be noted that "the first authentication mechanism execution module 21a executes the first authentication mechanism" or "the second authentication mechanism execution module 21b executes the second authentication mechanism" includes a part of the first authentication mechanism or the second authentication mechanism. Each step is executed by the first authentication mechanism execution module 21a or the second authentication mechanism execution module 21b (not all steps are executed by the first authentication mechanism execution module 21a or the second authentication mechanism execution module 21b) .

The first authentication mechanism execution module 21a includes a virtual home subscriber server (virtual home subscriber server, vHSS) 211 and a first virtual user (virtual user, vUSER) 212 . The virtual home user server 211 is used to communicate with the border server 4 . The virtual user 212 is used to communicate with the cloud server 3 . The virtual home subscriber server 211 can be used to simulate the functions of an actual home subscriber server (HSS), such as data configuration, user identity management, user status storage, etc., and can be used as data for providing account information in the 3GPP network library, and is not limited to this. The virtual user 212 can be used to simulate the functions of the actual user equipment 5 , so that the proxy server 2 can perform registration, login and other actions on the cloud server 3 .

The second authentication mechanism execution module 21b includes a virtual user equipment (vUE) 213 and a virtual open identity (openID) provider (vOP) 214 . The virtual user equipment 213 is used to communicate with the border server 4 , and the virtual open identity provider 214 is used to communicate with the cloud server 3 and the user equipment 5 . one embodiment Among them, the virtual open identity provider 214 is used to implement an open ID connect (openID connect, hereinafter referred to as OIDC) authentication mechanism.

In one embodiment, the virtual home user server 211, the virtual user 212, the virtual user equipment 213, and the virtual open identity provider 214 may be functional modules whose functions are implemented by computer program products (ie, software). It can also be implemented by a hardware device with software, such as hardware with a microprocessor and software, but not limited to this. Therefore, in one embodiment, the proxy server 2 may include a microprocessor for executing a computer program product to realize the virtual home user server 211 , the virtual user 212 , the virtual user equipment 213 , and the virtual open identity provisioning function of the reader 214. In one embodiment, the proxy server 2 may further include a memory for storing the computer program product and data required for executing the first authentication mechanism and the second authentication mechanism.

Next, the cloud server 3 will be described. In one embodiment, the cloud server 3 may include a cloud database 310 and a relying party (RP) 320 . In the case of cloud-to-edge, an embedded subscriber identity module (hereinafter referred to as eSIM) of the user equipment 5 is provided by the cloud server 3, so the cloud server 3 can have the user's data , and store user data through the cloud database 310 . The relying side 320 is used to implement the OIDC authentication mechanism with the virtual open identity provider 214 . In one embodiment, the cloud database 310 may be implemented by means of a memory, a hard disk, or the like. In one embodiment, the cloud server 3 includes a microprocessor, and the dependent end 320 can be implemented by executing a computer program product through the microprocessor, but is not limited thereto.

Next, the border server 4 will be described. In one embodiment, the border server 4 may include a mobility management entity (MME) 410 and a home subscriber server (HSS) 420 . The mobility management entity 410 is used for communicating with the virtual home user server 211 and the virtual user equipment 213 . Mobility management entity 410 may be used to handle user equipment 5 pairs Access to the core network, support allocation, tracking, paging, roaming, network resource handover, manage eNodeBs, assist in gateway messaging, perform security procedures, end-to-end network Actions such as processing during communication and management of idle terminal locations are not limited to this. The functions of the home user server 420 are as described in the preceding paragraphs.

It should be noted that, since the communication protocols adopted by the cloud server 3 and the border server 4 are different, the proxy server 2 must be used as a communication intermediary element between the two.

In one embodiment, in the case of cloud-to-edge, the communication between the border server 4 and the proxy server 2 is performed by means of, for example, roaming, and the roaming can adopt the S6a specification of the 3GPP agreement, and The authentication steps required for 3GPP roaming can be EPS-AKA, for example, and thus can be performed by the virtual home user server 211 . In addition, the authentication method of common web page login can be adopted between the proxy server 2 and the cloud server 3 , so it can be performed by the virtual user 212 .

In one embodiment, in the case of edge-to-cloud, EPS-AKA authentication is also performed between the edge server 4 and the proxy server 2, so that the virtual user equipment 214 can play the role of the actual user equipment for EPS-AKA certification. In addition, the OIDC authentication method is used between the proxy server 2 and the cloud server 3, so the virtual open identity provider 214 can be used as an open identity provider, and the cloud server 3 can be used as a relying end.

Next, the user equipment 5 will be described. In one embodiment, the user equipment 5 may be various devices with Internet of Things (Internet of Things, IoT) functions, such as notebook computers, tablet computers, desktop computers, smart phones, various smart portable devices ( For example, smart watches, wristbands and the like), digital cameras, etc., but not limited thereto.

In one embodiment, when cloud-to-edge, the cloud server 3 can provide various types of user identity modules for the user equipment 5, such as eSIM510; for the convenience of description, the following paragraphs also refer to Take eSIM510 as an example. In one embodiment, when edge-to-cloud, the edge server 4 can provide various types of subscriber identity modules for the user equipment 5, such as eSIM510, universal mobile telecommunications system subscriber identity module (universal mobile telecommunications system subscriber) identity module, USIM) 520, etc.; for the convenience of description, the subsequent paragraphs also take USIM 520 as an example.

In addition, in one embodiment, the proxy server 2 can be provided with a message conversion mapping table 6, which can have conversion information of the message format between the cloud server 3 and the border server 4, so as to realize the two Convert between message formats.

Thereby, the system architecture of the communication system 1 can be understood. Next, the flow of the first authentication mechanism and the second authentication mechanism will be described.

First, the first authentication mechanism, that is, the authentication mechanism in the cloud-to-edge case will be described. Please refer to FIG. 1 to FIG. 2(B) at the same time, wherein FIG. 2(A) is a schematic diagram of signal transmission for executing the first authentication mechanism in a communication system according to an embodiment of the present invention, and FIG. 2(B) is a communication diagram of an embodiment of the present invention. Detailed flowchart of the method (first authentication mechanism).

As shown in FIG. 2(A) and FIG. 2(B), the first authentication mechanism may include a first authentication request phase (steps S201-S204), a first request-response phase (steps S205-S208), and a first Authentication confirmation stage (steps S209 to S214).

First, the first authentication request stage is described: first, step S201 is executed, and the user equipment 5 initiates a service request to the border server 4 . The service request may be, for example, an attach request, that is, the user equipment 5 wants to connect to the core network of the border server 4 . In one embodiment, the service request (attach request) includes an international mobile subscriber identity (IMSI) of the user equipment 5 . In one embodiment, the international mobile subscriber identity can be provided by the cloud server 3 .

After step S202 is executed, the mobility management entity 410 of the border server 4 obtains the IMS and sends an authentication request to the proxy server 2, wherein the authentication request includes the IMS.

Then step S203 is executed, the virtual home user server 211 of the proxy server 2 obtains the authentication request, and transmits the authentication request to the virtual user 212, and the virtual user 212 transmits a login request (login request) to the authentication request. Cloud server 3. In one embodiment, the login request is a request message generated based on a common website login method, which may include a login account (ID), a login password (pwd) and an international mobile user identity, but is not limited thereto.

After step S204 is executed, the cloud server 3 verifies the international mobile subscriber identity, that is, the cloud server 3 can match the international mobile subscriber identity with the data in the cloud database 310 to confirm the user equipment Whether the account of 5 is the account of cloud server 3. Since the eSIM 510 of the user equipment 5 is provided by the cloud server 3 , the database 310 of the cloud server 3 can store the International Mobile Subscriber Identity of the user equipment 5 . When the international mobile subscriber ID matches the data in the cloud database 310 (ie, when it is confirmed that the user equipment 5 is valid), the cloud server 3 sends a response to the virtual user 212 , otherwise it stops working. In one embodiment, the cloud server 3 can further verify the login account (ID) and the login password (pwd), but it is not limited. Thereby, the first authentication request phase can be completed.

Next, the first request response stage is described: Step S205 is executed, when the IMSID matches the data in the cloud database 310, the cloud server 3 can generate a claim as a response, and send the claim Sent to the virtual user 212 , wherein the authentication statement includes an authentication vector (AV), wherein the authentication vector includes information to confirm the validity of the eSIM 510 of the user equipment 5 . in a real In an embodiment, the verification vector may include an expected response (XRES), an authentication value (AUTN), a random number (RAND), and a communication session key (Kasme), but is not limited thereto.

After step S206 is executed, the virtual user 212 transmits the authentication response including the authentication vector to the virtual home user server 211, so the virtual home user server 211, the mobility management entity 410 and the user equipment 5 can EPS-AKA certification through the certification vector. Generally speaking, the EPS-AKA authentication is provided by the physical home user server of the core network side (such as the border server 4 ) to provide an authentication vector, and the mobility management entity 410 presents an authentication challenge to the user equipment 5, The user equipment 5 calculates the challenge response (RES) through the eSIM 510 to achieve authentication. However, in the case of cloud-to-edge, only the cloud server 4 has the relevant information of the user equipment 5 and the account, so cloud-to-edge -The EPS-AKA authentication of the edge must play the role of the physical home user server through the virtual home user server 211 of the proxy server 2, and use the authentication vector provided by the cloud server 4 as the authentication vector of EPS-AKA authentication.

After step S207 is executed, the virtual home user server 211 sends an authentication request response including an authentication vector to the mobility management entity 410, and the mobility management entity 410 retains the expected response (XRES) and the communication period key (Kasme), and authenticates the The value (AUTN) and the random number (RAND) are sent to the user equipment 5 as an authentication challenge. In an embodiment, the authentication value (AUTN) and the random number (RAND) can be encrypted by the communication period key (Kasme), and the correct user equipment 5 will also have the communication period key (Kasme), so Can be unlocked.

After step S208 is executed, the eSIM 510 of the user equipment 5 can confirm the legitimacy of the core network to be connected according to the authentication value (AUTN), and calculate the challenge response (RES) according to the random number (RAND). Thereby, the first request response phase can be completed.

Next, the first authentication confirmation stage is described: First, step S209 is executed, and the user equipment 5 returns the calculated challenge response (RES) to the mobility management entity 410 . After step S210 is performed, the mobility management entity 410 compares the challenge response (RES) with the expected response (XRES). If the challenge response (RES) matches the expected response (XRES), step S211 is executed, the mobility management entity 410 transmits an authentication completion message to the user equipment 5 and enables the border server 4 to start providing services to the user equipment 5 . Otherwise, stop working. Thereby, the two-way authentication between the user equipment 5 and the border server 4 (for example, the authentication of the core network validity and the authentication challenge of the user equipment 5) can be completed.

In addition, in order for the cloud server 3 to also know that the user equipment 5 has completed the authentication, steps S212 to S214 may be performed. In steps S212 to S214 , the mobility management entity 410 sends an update message to the proxy server 2 , and the virtual home user server 211 and the virtual user 212 send the update message to the cloud server 3 . In one embodiment, the update message includes not only the information that the user equipment 5 has been authenticated, but also the information of the mobility management entity 410, so the cloud server 3 can record the information of the mobility management entity 410, so that as long as the first Once the authentication mechanism is completed once, the cloud server 3 and the border server 4 can form a federation, and in the future, the first authentication mechanism will not need to be executed between the two, that is, the border server 4 and the cloud server 3 A cross-border alliance has been formed.

Thereby, the first authentication mechanism can be understood.

Next, the second authentication mechanism, ie, the authentication mechanism in the edge-to-cloud case, will be described. Please refer to FIG. 1 to FIG. 3(B) at the same time, wherein FIG. 3(A) is a schematic diagram of signal transmission of a communication system executing a second authentication mechanism according to an embodiment of the present invention, and FIG. 3(B) is a communication diagram of an embodiment of the present invention. Detailed flowchart of the method (second authentication mechanism).

As shown in FIG. 3(A) and FIG. 3(B), the second authentication mechanism may also include a second authentication request phase (steps S301-S305), a second request-response phase (steps S306-S312), and a first The second authentication confirmation stage (steps S313-S317).

First, the second authentication request stage is described: first, step S301 is executed, the user equipment 5 initiates a service request to the cloud server 4 , and can select a third-party authenticated server, such as the boundary server 4 . The cloud server 4 can direct the user equipment 5 to the edge server 4 for communication.

After step S302 is executed, the user equipment 5 transmits an authentication request to the virtual open account provider 214 of the proxy server 3, wherein the authentication request includes the international mobile subscriber identity code. In one embodiment, the International Mobile Subscriber Identity is extracted from the USIM 520 of the user equipment 5 .

Then steps S303 and S304 are executed, the virtual open account provider 214 obtains the authentication request, and transmits the authentication request to the virtual user equipment 213, and the virtual user equipment 213 transmits the authentication request to the mobility management of the border server 4 Entity 410.

After that, step S305 is executed, and the home subscriber server 420 obtains the international mobile subscriber identity code from the mobility management entity 410 . In the case of edge-to-cloud, the USIM 520 of the user equipment 5 is provided by the border server 4, so the database of the home user server 420 can have the information of the international mobile subscriber identity of the user equipment 5, so The legitimacy of the International Mobile Subscriber Identity can be checked by comparing the International Mobile Subscriber Identity with the data in the database. When the two match (the user equipment 5 is valid), the communication system 1 enters the second request response stage; otherwise, it stops working.

Next, the second request response stage will be described: first, step S306 is executed. When the IMSID matches the data in the database, the home user server 420 generates an authentication statement as the authentication request result, and sends the authentication request result Passed to the mobility management entity 410, wherein the authentication statement also includes the authentication vector, and the authentication vector also includes the authentication value (AUTN), random number (RAND), expected response (XRES) and communication period key (Kasme), but not limited to this.

After step S307 is executed, the mobility management entity 410 retains the expected response (XRES), and transmits the authentication value (AUTN) and the random number (RAND) to the virtual user equipment 213 of the proxy server 3 as an authentication challenge. In one embodiment, the home user server 420 and the mobility management entity 410 may regard the virtual user equipment 213 as an EPS-AKA certified user equipment, so the mobility management entity 410 may authenticate the virtual user equipment 213 The virtual user equipment 213 forwards the authentication challenge to the user equipment 5 for processing, and obtains a challenge response from the user equipment 5 . In addition, in one embodiment, the authentication value (AUTN) and the random number (RAND) can form an encrypted message through the communication session key (Kasme), and the encrypted message can be unlocked through the communication session key (Kasme).

Then steps S308 and S309 are executed, the proxy server 3 transmits the authentication value (AUTN) and random number (RAND) to the user equipment 5 through its virtual user equipment 213 and the virtual open account provider 214, and the user equipment 5. Confirm the legitimacy of the core network (border server 4) through the authentication value (AUTN), and calculate the challenge response (RES) through the random number (RAND).

After that, steps S310 to S312 are executed, the user equipment 5 sends the challenge response (RES) back to the proxy server 3 , and the proxy server 3 further sends the challenge response (RES) to the mobility management entity 410 . Thereby, the second request response phase can be completed.

Next, the second authentication and confirmation phase is described: first, step S313 is executed, and the mobility management entity 410 compares the challenge response (RES) with the expected response (XRES).

When the two match, steps S314 and S315 are executed, the mobility management entity 410 transmits the authentication completion message to the virtual user equipment 213, and the virtual user equipment 213 transmits the authentication completion message to the virtual open account provider 214, The virtual open account provider 214 transmits a token to the user equipment 5 according to the confirmation message.

After that, steps S316 and S317 are executed, the user equipment 5 transmits a verification code to the cloud server 3 according to the certificate, and the cloud server 3 can verify whether the verification code is correct to the virtual open account provider 214. The service to the user equipment 5 is started. In addition, the cloud server 3 can also update the information of the mobility management entity 410 for future use, whereby the second authentication mechanism does not need to be executed, that is, the cloud server 3 and the border server 4 have formed a cross-border alliance.

Thereby, the operation flow of the second authentication mechanism can be understood.

The communication method of the present invention can also be extended and applied. FIG. 4 is a detailed flowchart of a communication method according to another embodiment of the present invention, and please refer to FIGS. 1 to 3(B) at the same time. It should be noted that although the embodiment shown in FIG. 4 is an example of the cloud-to-edge situation, those skilled in the art can infer the implementation of the edge-to-cloud situation accordingly.

As shown in FIG. 4 , first step S401 is executed. When the account of the cloud server 3 uses the service provided by the edge server 4 , the user equipment 5 can transmit the accumulated traffic information to the cloud server 3 . After step S402 is executed, the cloud server 3 can transmit the traffic information to the proxy server 2 . After step S403 is executed, the proxy server 2 can convert the traffic information into a message format (eg, 3GPP protocol) recognized by the border server 4 , and transmit the data to the border server 4 . After that, step S404 is executed, and the border server 4 generates charging information according to the traffic information, and returns the charging information to the proxy server 2 . Then step S405 is executed, and the proxy server 2 converts the charging information into a message format that can be recognized by the cloud server 3 formula (such as the OIDC protocol), and send it to the cloud server 3 . After that, step S406 is executed, and the user equipment 5 obtains the charging information of the border server 4 from the cloud server 3 .

From this, it can be seen that the cross-border charging between the cloud server 3 and the border server 4 can be completed through the proxy server 2 .

The communication system of the present invention can also be further improved. FIG. 5(A) is a detailed flow chart of the communication system 1 according to another embodiment of the present invention, and please refer to FIGS. 1 to 4 at the same time.

As shown in FIG. 5(A), the communication system 1 may further include a second proxy server 7, wherein the second proxy server 7 and the proxy server 3 have the same configuration. The second proxy server 7 can be disposed between the cloud server 3 and a second border server 8, and acts as the cloud server 3 and a second border server by executing the first authentication mechanism and the second authentication mechanism Communication intermediary between 8.

In this embodiment, when the account of the border server 4 wants to use the services of the second border server 8, as long as a cross-border alliance has been formed between the cloud server 3 and the border server 4, and the cloud server 3 and the first A cross-border alliance has also been formed between the two border servers 8 through the second proxy server 7 , and the account of the border server 4 can communicate with the proxy server 2 , the cloud server 3 , and the second proxy server 7 through The second border server 8 performs two-way authentication and information exchange. The present invention is not limited to this.

FIG. 5(B) is a detailed flow chart of the communication system 1 according to still another embodiment of the present invention, and please refer to FIGS. 1 to 3(B) and 5(A) at the same time.

As shown in FIG. 5(B), the communication system 1 may further include a third proxy server 9, wherein the third proxy server 9 and the proxy server 3 have the same configuration, and can be set on the border server 4 and a first proxy server 9 between two cloud servers 10 . The third proxy server 9 can act as a communication intermediary between the second cloud server 10 and the border server 4 by executing the first authentication mechanism and the second authentication mechanism.

In this embodiment, when the account of the cloud server 3 wants to use the services of the second cloud server 10, as long as the border server 4 and the cloud server 3 have formed a cross-border alliance, and the border server 4 is also connected with the second cloud server 10 A cross-border alliance has also been formed between the cloud servers 10, so that the account of the cloud server 3 can perform mutual authentication with the second cloud server 10 through the proxy server 2, the border server 4, and the third proxy server 9. and information exchange.

Thereby, the communication system 1 of the present invention can continuously establish an alliance relationship with different communication systems through the setting of the proxy server, so that the cross-border services that can be used by a single account are continuously increased.

Through the communication system and the communication method of the present invention, the user only needs to have a single account, which can be used for both the cloud server and the border server. Compared with the prior art, the communication system of the present invention can have full convenience. In addition, the communication method of the present invention can have a complete authentication mechanism and is fully secure.

The above-mentioned embodiments are only examples for convenience of description, and the scope of the claims claimed in the present invention should be based on the scope of the patent application, rather than being limited to the above-mentioned embodiments.

1: Communication system

2: Proxy server

3: Cloud server

4: Boundary server

5: User Equipment

6: Message conversion mapping table

21a: The first authentication mechanism execution module

21b: Second Authentication Mechanism Execution Module

211: Virtual home user server

212: Virtual User

213: Virtual User Equipment

214: Virtual Open Account Provider

310: Cloud Database

320: Dependent side

410: Mobility Management Entity

420: home user server

510: Embedded User Identity Module

520: Universal Mobile Communication System User Identity Module

Claims (4)

A communication system for performing third-party authentication between a border server (4) and a cloud server (3), comprising: a first authentication mechanism execution module (21a) arranged on a proxy server ( 2), for executing a first authentication mechanism, and including a virtual home subscriber server (virtual home subscriber server, V HSS) (211) and a virtual user (virtual user equipment, vUSER) (212), wherein the The virtual home user server (211) is used to communicate with a mobility management entity (MME) (410) of the border server (4), and the virtual user (212) is used to communicate with the cloud service The terminal (3) communicates; wherein, when an account of the cloud server (3) wants to use the service of the border server (4), the first authentication mechanism execution module (21a) executes the first authentication mechanism , wherein the first authentication mechanism includes the step: when the user equipment (5) sends a service request to the border server (4), and the cloud server (3) confirms an international authentication of the user equipment (5) When the mobile user identification code is valid, the virtual user (212) receives an authentication vector provided by the cloud server (3), and the virtual home user server (211), the mobility management entity (410) and the user equipment (5) performs Evolved Packet System-Authentication and Key Agreement (EPS-AKA) authentication according to the authentication vector. The communication system according to claim 1, further comprising a second authentication mechanism execution module (21b) disposed in the proxy server (2) for executing a second authentication mechanism, and including a virtual user equipment (virtual user equipment, vUE) (213) and a virtual open ID provider (virtual open ID provider, OP) (214), the virtual user equipment (213) is used for communication with the border server (4) The mobility management entity (410) communicates with the virtual open identity provider (214) for the cloud The server (3) communicates with a user equipment (5), wherein when an account of the border server (4) wants to use the service of the cloud server (3), a second authentication mechanism execution module (21b) ) execute the second authentication mechanism, wherein the second authentication mechanism comprises the steps: when the user equipment (5) makes a service request to the cloud server (3), and a home user of the border server (4) When the server (420) confirms that an international mobile subscriber identity code of the user equipment (5) is valid, the virtual user equipment (213) receives the home user server through the mobility management entity (410) (420) provides an authentication vector and transmits the authentication vector to the user equipment (5) by the virtual user equipment (213) and the virtual open identity provider (214) to enable the use of The user equipment (5) calculates a challenge response parameter (RES) according to the authentication vector, and uses the home user server (420), the mobility management entity (410) and the virtual user equipment (213) and The user equipment (5) performs EPS-AKA authentication according to the authentication vector and the challenge response parameter (RES), and uses the virtual open identity provider (214), the cloud server (3) and The user equipment (5) performs open ID connect (OIDC) authentication; and when the EPS-AKA authentication is completed, the virtual open ID provider (214) provides a token to the User equipment (5), wherein the cloud server (3) provides services according to the warrant. A communication method, executed by a communication system (1), for performing third-party authentication between a border server (4) and a cloud server (3), the communication method comprising the steps of: when the cloud server ( When an account of 3) wants to use the service of the border server (4), a first authentication mechanism execution module (21a) provided in a proxy server (2) executes a first authentication mechanism, wherein the The first authentication mechanism execution module (21a) includes a virtual home user server (211) and a virtual user (212), and the virtual home user server (211) is used for a communication with the border server (4). Mobility Management Entity (410) to communicate, the virtual user (212) is used to communicate with the cloud server (3), wherein the first authentication mechanism comprises the step of: when the user equipment (5) communicates with the boundary server (4) ) sends out a service request, by means of the mobility management entity (410), the virtual home user server (211) and the virtual user (212), to identify an international mobile user of the user equipment (5) The code is sent to the cloud server (3) for verification; and when the user equipment (5) sends a service request to the border server (4), and the cloud server (3) confirms that the user equipment ( 5) When an international mobile subscriber identity code of 5) is valid, the virtual user (212) receives an authentication vector provided by the cloud server (3), and the virtual home user server (211), the mobility The management entity (410) and the user equipment (5) perform EPS-Authenticated Key Agreement Protocol authentication according to the authentication vector. The communication method according to claim 3, further comprising the step of: when an account of the border server (4) wants to use the service of the cloud server (3), by setting the proxy server (2) a second authentication mechanism execution module (21b) executes a second authentication mechanism, wherein the second authentication mechanism execution module (21b) comprises a virtual user equipment (213) and a virtual open identity provider (214) ), the virtual user equipment (213) is used to communicate with the mobility management entity (410) of the border server (4), and the virtual open identity provider (214) is used to communicate with the cloud server ( 3) communicate with a user equipment (5), wherein the second authentication mechanism includes the step of: when the user equipment (5) makes a service request to the cloud server (3), through the virtual open The identity provider (214), the virtual user equipment (213) and the mobility management entity (410) transmit an international mobile subscriber identity of the user equipment (5) to the home user server (420) check; When the user equipment (5) makes a service request to the cloud server (3), and a home user server (420) of the border server (4) confirms an international mobile of the user equipment (5) When the user identification code is valid, use the virtual user equipment (213) to receive an authentication vector provided by the home user server (420) through the mobility management entity (410), and use the virtual user equipment (213) and the virtual open identity provider (214) transmit the authentication vector to the user equipment (5), so that the user equipment (5) responds to a challenge response parameter ( RES), and by the home user server (420), the mobility management entity (410) and the virtual user equipment (213) and the user equipment (5), according to the authentication vector and the challenge response parameter (RES) perform EPS-AKA authentication, and perform open ID connect (OIDC) through the virtual open identity provider (214), the cloud server (3) and the user equipment (5) ) authentication; and when the EPS-AKA authentication is completed, the virtual open identity provider (214) provides a token to the user equipment (5), wherein the cloud server (3) according to the Warrants provide services.

Images