TWI801615B - Communication method between terminal and server, server communicating with terminal, and terminal communicating with server - Google Patents

Abstract

The embodiment of the present invention provides a communication method and device between a terminal and a server. The communication between the terminal and the server includes: the first server receives the first request message sent by the terminal, and the first request message is used for Make the first server send an authentication request to the second server, and obtain the first key from the second server; the first server sends a first request response message corresponding to the first request message to the terminal, and the second A request response message includes a second key; the first server receives a second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make The first server generates a second request response message corresponding to the second request message according to the second key corresponding to the second key identifier, and the second request message is encrypted by the first key; the first server decrypting the second request message according to the first key; encrypting the second request response message by the first server according to a second key corresponding to the second key identifier in the second request message; The first server sends a second request response message to the terminal; the first server deletes the first key. In the embodiment of the present invention, the terminal can obtain authentication and encryption keys from the application server in the form of over-the-air download, which solves the problem of strong coupling between the terminal and the application server and the strong coupling of the operator's AKA protocol, making the key The generation and use of keys are more flexible.

Description

Communication method between terminal and server, server communicating with terminal, and terminal communicating with server

The present invention relates to the technical field of communication, in particular to a communication method between a terminal and a server, and a communication device between a terminal and a server.

The Internet of Things technology is the third information technology revolution after computers and the Internet. It has the characteristics of immediacy and interactivity, and has been widely used in urban management, digital home, positioning and navigation, logistics management, security systems, etc. field. The topic of IoT security is becoming more and more important. IoT devices need to communicate with application servers through a set of security mechanisms to ensure the security of services and user privacy data.

In order to solve the problems of authentication between application servers and IoT devices and establishment of secret channels, 3GPP (Third Generation Mobile Communications Standardization Organization) defines a general authentication mechanism (General Bootstrapping Architecture, GBA). GBA provides a common mechanism for establishing a shared key between UE and server, which is implemented based on the AKA authentication mechanism. The AKA authentication mechanism is a mutual authentication and key negotiation mechanism used in 2G/3G networks. GBA makes full use of the advantages of the AKA authentication mechanism to complete the security boot process of services.

In the GBA, the Bootstrapping Service Function (BSF) is a network element introduced by the GBA mechanism. BSF can obtain relevant user information through Zh interface and home location register HLR (Home Location Register) or home subscription server HSS (Home Subscriber Server), such as International Mobile Subscriber Identification Number IMSI (International Mobile Subscriber Identification Number) and Ki . The BSF can perform two-way authentication with the user equipment (UE, User Equipment) through the Ub interface through the AKA (Authentication and Key Agreement) protocol, and after successful authentication, a shared key is generated. BSF will pass the common key and related key parameters, user information, etc. to the network application function NAF (Network Application Function) through the Zn interface. The shared key will be used for secure transmission of information between UE and NAF.

Although the GBA solution can establish a secure communication channel between the UE and the NAF, the generation of the shared key is strongly coupled with the AKA protocol, which makes the cost of establishing a secure channel and maintenance costs too high.

In view of the above problems, embodiments of the present invention are proposed to provide a communication method between a terminal and a server and a communication device between a terminal and a server, which overcome the above problems or at least partially solve the above problems.

In order to solve the above problems, an embodiment of the present invention discloses a communication method between a terminal and a server, including: the first server receives a first request message sent by the terminal, and the first request message is used to make the first server Send the certificate to the second server request, and obtain the first key from the second server; the first server sends a first request response message corresponding to the first request message to the terminal, and the first request response message includes the second key; the The first server receives the second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server according to the second key identifier The corresponding second key generates a second request response message corresponding to the second request message, the second request message is encrypted by the first key; the first server decrypts the second request message according to the first key request message; the first server encrypts the second request response message according to the second key corresponding to the second key identifier in the second request message; the first server sends the second request message to the terminal 2. A request response message; the first server deletes the first key.

The embodiment of the present invention also discloses a communication method between a terminal and a server, including: the terminal sends a first request message to the first server, and the first request message is used to make the first server send a request to the second server sending an authentication request, and obtaining a first key from a second server; the terminal receives a first request response message corresponding to the first request message sent by the first server, and the first request response message includes the second Key; the terminal sends a second request message to the first server, the second request message includes a second key identifier, and the second key identifier is used to make The first server generates the second request response message corresponding to the second request message according to the second key corresponding to the second key identifier; preferably, the second request message is encrypted by the first key ; Preferably, it also includes: the first request response message includes a second key identification; Preferably, it also includes: the first request message includes a second key identification, and the second key identification is used In making the first server send the second key to the terminal through the first request response message; preferably, the method further includes: the terminal deleting the first key.

The embodiment of the present invention also discloses a communication method between a terminal and a server, including: the first server receives the first request message sent by the terminal, and the first request message is used to make the first server send the second server The server sends an authentication request, and obtains the first key from the second server; the first server sends to the terminal a first request response message corresponding to the first request message, and the first request response message includes the second key ; The first server receives a second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server according to the second The second key corresponding to the key identifier generates a second request response message corresponding to the second request message; the first server sends the second request response message to the terminal.

Preferably, it further includes: the first server decrypts the second request message according to the first key; the first server identifies the corresponding The second key encrypts the second request response message; preferably, the second request message is encrypted by the first key.

Preferably, it further includes: the first request response message includes the second key identifier; preferably, it also includes: the first server receives the first request message sent by the terminal, and the first request message includes The second key identification, the second key identification is used to make the first server send the second key to the terminal through the first request response message; preferably, it also includes: the first server The device deletes the first key.

The embodiment of the present invention also discloses a communication method between a terminal and a server, including: the terminal sends a third request message to the third server, and the third request message is used to make the third server send a request to the fourth server sending an authentication request, and obtaining a third key from a fourth server; the terminal receives a third request response message corresponding to the third request message sent by the third server, and the third request response message includes the fourth key; The terminal sends a fourth request message to the third server, the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server correspond to The fourth key generates a fourth request response message corresponding to the fourth request message; the terminal receives the fourth request response message sent by the third server, the fourth request response message includes the fifth key, The fifth key is obtained from the fifth server after the third server receives the fourth request message sent by the terminal, sends a request to the fifth server.

Preferably, the method further includes: the fourth request message is encrypted by a fourth key.

Preferably, it also includes: the third request response message includes the fourth key identifier; preferably, it also includes: the terminal sends a third request message to the third server, and the third request message includes the fourth key identifier. Four key identifiers, the fourth key identifier is used to make the third server send the fourth key to the terminal through the third request response message; preferably, it also includes: the terminal deletes the The third key and the fourth key.

The embodiment of the present invention also discloses a communication method between a terminal and a server, including: the third server receives the third request message sent by the terminal, and the third request message is used to make the third server send a request to the fourth server The server sends an authentication request, and obtains the third key from the fourth server; The third server sends a third request response message corresponding to the third request message to the terminal, the third request response message includes a fourth key; the third server receives the fourth key sent by the terminal A request message, the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server generate a fourth request message corresponding to the fourth key corresponding to the fourth key identifier. The fourth request-response message; the third server sends the fourth request-response message to the terminal, the fourth request-response message includes a fifth key, and the fifth key is for the third server to receive the terminal After the fourth request message is sent, a request is sent to the fifth server and obtained from the fifth server.

Preferably, the method further includes: the fourth request message is encrypted by a fourth key.

Preferably, it also includes: the third request response message includes a fourth key identifier; preferably, it also includes: the third server receives the third request message sent by the terminal, and the third request The message includes a fourth key identifier, and the fourth key identifier is used to make the third server send the fourth key to the terminal through the third request response message; preferably, it also includes: the first The third server deletes the third key and the fourth key.

The embodiment of the present invention also discloses a communication device between a terminal and a server, including: The receiving module located in the first server is used to receive the first request message sent by the terminal, and the first request message is used to make the first server send an authentication request to the second server, and receive the authentication request from the second server The server obtains the first key; the sending module located in the first server is used to send the first request response message corresponding to the first request message to the terminal, and the first request response message includes the second key; located in The receiving module of the first server is configured to receive a second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server The device generates a second request response message corresponding to the second request message according to the second key corresponding to the second key identifier, and the second request message is encrypted by the first key; processing at the first server a module, configured to decrypt the second request message according to the first key; a processing module located in the first server, configured to identify the corresponding The second key encrypts the second request response message; the sending module located in the first server is used to send the second request response message to the terminal; the processing module located in the first server, Used to delete the first key.

The embodiment of the present invention also discloses a communication device between a terminal and a server, including: a sending module located at the terminal, used to send the first server to the first server A request message, the first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; the receiving module located at the terminal is used to receive The first request response message corresponding to the first request message sent by the first server, the first request response message includes the second key; the sending module located at the terminal is used to send to the first server A second request message, the second request message includes a second key identifier, and the second key identifier is used to make the first server generate a second request according to a second key corresponding to the second key identifier A second request response message corresponding to the message; a receiving module located at the terminal, configured to receive the second request response message sent by the first server.

Preferably, the method further includes: the second request message is encrypted by the first key.

Preferably, it also includes: the first request response message includes a second key identifier; preferably, it also includes: a sending module located at the terminal, configured to send the first request message to the first server, The first request message includes a second key identifier, and the second key identifier is used to make the first server send the second key to the terminal through the first request response message; preferably, The method includes: the terminal deleting the first key.

The embodiment of the present invention also discloses a communication device between a terminal and a server, including: a receiving module located at the first server, used to receive the first request message sent by the terminal, and the first request message is used to make The first server sends an authentication request to the second server, and obtains the first key from the second server; the sending module located in the first server is used to send the first request message corresponding to the first request message to the terminal. A request response message, the first request response message includes a second key; a receiving module located at the first server is configured to receive a second request message sent by the terminal, and the second request message includes the second key Two key identifiers, the second key identifier is used to make the first server generate the second request response message corresponding to the second request message according to the second key corresponding to the second key identifier; located in the second key identifier A sending module of the server is used for sending the second request response message to the terminal.

Preferably, it further includes: a processing module located in the first server, configured to decrypt the second request message according to the first key; a processing module located in the first server, configured to Encrypting the second request response message according to the second key corresponding to the second key identifier in the second request message; preferably, further comprising: the second request message is encrypted by the first key.

Preferably, it also includes: the first request response message includes a second key identifier; preferably, it also includes: a receiving device located at the first server, configured to receive the first request message sent by the terminal, The first request message includes a second key identifier, and the second key identifier is used to make the first server send the second key to the terminal through the first request response message; preferably, It includes: a processing module located in the first server, used to delete the first key.

The embodiment of the present invention also discloses a communication device between a terminal and a server, including: a sending module located at the terminal, configured to send a third request message to the third server, and the third request message is used to make the first The third server sends an authentication request to the fourth server, and obtains the third key from the fourth server; the receiving module located at the terminal is used to receive the corresponding third request message sent by the third server The third request response message, the third request response message includes the fourth key; the sending module located at the terminal is used to send the fourth request message to the third server, the fourth request message includes the fourth key a key identifier, the fourth key identifier is used to make the third server generate a fourth request response message corresponding to the fourth request message according to the fourth key corresponding to the fourth key identifier; The receiving module located at the terminal is configured to receive the fourth request-response message sent by the third server, the fourth request-response message includes a fifth key, and the fifth key is the third After receiving the fourth request message sent by the terminal, the server sends a request to the fifth server, and obtains it from the fifth server.

Preferably, the method further includes: the fourth request message is encrypted by a fourth key.

Preferably, it also includes: the third request response message includes a fourth key identifier; preferably, it also includes: a sending module located at the terminal, configured to send the third request message to a third server, The third request message includes a fourth key identifier, and the fourth key identifier is used to make the third server send the fourth key to the terminal through the third request response message; preferably, It includes: a processing module located in the terminal, used to delete the third key and the fourth key.

The embodiment of the present invention also discloses a communication device between a terminal and a server, including: a receiving module located at a third server, configured to receive a third request message sent by the terminal, and the third request message is used to make The third server sends an authentication request to the fourth server, and obtains the third key from the fourth server; the sending module located in the third server is used to send the terminal to the terminal sending a third request response message corresponding to the third request message, the third request response message including a fourth key; a receiving module located in the third server, configured to receive the fourth request message sent by the terminal , the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server generate the fourth key corresponding to the fourth request message according to the fourth key corresponding to the fourth key identifier. Four request-response messages; the sending module located in the third server is used to send the fourth request-response message to the terminal, the fourth request-response message includes the fifth key, and the fifth key is the third After receiving the fourth request message sent by the terminal, the server sends a request to the fifth server, and obtains it from the fifth server.

Preferably, the method further includes: the fourth request message is encrypted by a fourth key.

Preferably, it further includes: the third request response message includes a fourth key identifier; preferably, it also includes: a receiving module located at the third server, configured to receive the third key identifier sent by the terminal. A request message, the third request message includes a fourth key identifier, and the fourth key identifier is used to make the third server send the fourth key to the terminal through the third request response message; preferably Alternatively, it further includes: a processing module located in the third server, configured to delete the third key and the fourth key.

The embodiment of the present invention also discloses an apparatus, including: one or more processors; and one or more machine-readable media storing instructions thereon, which, when executed by the one or more processors, cause the The device performs one or more of the methods described above.

The embodiment of the present invention also discloses one or more machine-readable media, on which instructions are stored, and when executed by one or more processors, the device executes one or more methods as described above.

The embodiment of the present invention has the following advantages: In the embodiment of the present invention, the terminal can obtain authentication and encryption keys from the application server in the form of over-the-air download, which solves the problem of key generation between the terminal and the application server and the operator The problem of strong coupling in the AKA protocol makes the generation and use of keys more flexible.

101: Steps

102: Step

103: Step

104: Step

105: Step

106: Step

107: Step

201: Step

202: Step

203: Step

204: step

301: Step

302: Step

303: Step

304: step

401: step

402: step

403: step

404: step

501: step

502: Step

503: step

504: step

1001: The sending module located at the terminal

1002: The receiving module located at the terminal

1003: The processing module located in the terminal

2001: Sending module on the third server

2002: Receiving module on the third server

2003: Processing module on third server

Figure 1 is a flow chart of the steps of Embodiment 1 of a communication method between a terminal and a server of the present invention; Figure 2 is a flow chart of the steps of Embodiment 2 of a method of communication between a terminal and a server of the present invention; Figure 3 is a flow chart of the steps of Embodiment 2 of a communication method between a terminal and a server of the present invention; A flow chart of the steps of Embodiment 2 of a communication method between a terminal and a server; FIG. 4 is a flow chart of the steps of Embodiment 3 of a communication method between a terminal and a server of the present invention; FIG. 5 is a flow chart of the steps of Embodiment 3 of a communication method between a terminal and a server of the present invention Communication method embodiment 3 Figure 6 is a flow chart of the steps of Embodiment 3 of a communication method between a terminal and a server of the present invention; Figure 7 is a flow chart of steps of Embodiments 2 and 3 of a communication device between a terminal and a server of the present invention ; FIG. 8 is a flow chart of the steps of Embodiments 1, 2, and 3 of a communication device between a terminal and a server of the present invention;

In order to make the above objects, features and advantages of the present invention more comprehensible, the present invention will be further described in detail below in conjunction with the drawings and specific embodiments.

One of the core concepts of the embodiments of the present invention is that the terminal generates a shared key with the BSF through AKA. The shared key is used to establish a secret channel between the terminal, the operator's network, and the application server. The application server sends the authentication between the application layer and the terminal and the encryption key to the terminal through OTA.

In the following, firstly, the communication process between the terminal and the server is introduced from the perspective of the server.

Referring to FIG. 1 , it shows a flow chart of the steps of Embodiment 1 of a communication method between a terminal and a server according to the present invention, which may specifically include the following steps: Step 101, the first server receives the first request message sent by the terminal, The first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; Specifically, the first server is an application server, which may also be called NAF. The first request message may be an application request (Application Request). The application request carries a bootstrap session identifier (B-TID). Optionally, the application request may also include application layer data payload. Before sending the first request message, the terminal can derive the shared key Ks_NAF according to the shared key Ks generated by the AKA protocol. And the first request message is encrypted by the shared key Ks_NAF. The bootstrap session identifier (B-TID) in the first request message may not be used as an encrypted part. The second server may be BSF. The first key may be the common key Ks_NAF. After receiving the first request message, the NAF sends an authentication request (Authentication Request) to the BSF, and the authentication request includes a bootstrap session identifier and optionally, a NAF identifier (NAF-Id). The BSF finds the shared key Ks generated during the AKA negotiation with the terminal according to the bootstrap session identifier. And the shared key Ks_NAF is derived according to the shared key Ks. Then the BSF sends an authentication response message (Authentication Answer) to the first server, and the response message includes the shared key Ks_NAF. Optionally, the authentication response message may also include a Ks_NAF lifetime (key_lifetime). When the trial period expires, the terminal needs to re-generate a new shared key Ks_NAF through the shared key Ks with the BSF. After receiving the shared key Ks_NAF, the first server stores the shared key Ks_NAF. And the shared key Ks_NAF is used between the terminal and the first server to encrypt and decrypt air interface messages.

Step 102, the first server sends a first request response message corresponding to the first request message to the terminal, and the first request response message includes the second key; specifically, the first request response message may be an application response ( Application Answer) message. The second key may be an application layer common key K ₂ . The common key _K2 may be managed by the first server itself. It can also be managed by an application layer key management server. When the application layer key management server is used for management, the first server first obtains the common key K ₂ from the application layer key management server by sending a request message. And the shared key K ₂ is sent to the terminal through the first request response message. At the same time, the first server also stores the common key K ₂ . Optionally, the first request-response message may be encrypted by the first key, ie, the common key Ks_NAF. Since both the NAF and the terminal have the shared key Ks_NAF, the first request response message can be encrypted by the shared key Ks_NAF and sent to the terminal, and decrypted by the terminal.

Step 103, the first server receives a second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server according to the The second key corresponding to the second key identifier generates a second request response message corresponding to the second request message encrypted by the first key; specifically, the second request message may be an application request message. The second key identifier may be a unique identifier of the application layer common key _K2 . The second request message may be encrypted by the shared key Ks_NAF. Optionally, the second request message can also be encrypted by the common key _K2 . When encrypted with the common key _K2 , the second key identifier may not be encrypted. The second key identifier can be used as an instruction to enable the server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier.

Step 104, the first server decrypts the second request message according to the first key; specifically, the second request message may be an application request message. The first key is the common key Ks_NAF. The second request message may be encrypted by the shared key Ks_NAF. Optionally, the second request message can also be encrypted by the common key _K2 . When encrypted with the common key _K2 , the second key identifier may not be encrypted. The second key identifier can be used as an instruction to enable the server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier.

Step 105, the first server encrypts the second request response message according to the second key corresponding to the second key identifier in the second request message; specifically, the second key identifier may be an application layer The unique identifier of the shared key _K2 . The second key is the application layer common key K ₂ . The first server obtains the unique identifier of the application layer shared key _K2 in the application request message, and encrypts the application response message corresponding to the application request message with the application layer shared key _K2 corresponding to the unique identifier of the application layer shared key _K2 .

Step 106, the first server sends a second request response message to the terminal; specifically, the first server may be an application server, also called NAF. The second request response message sent by the first server to the terminal may be encrypted by the application layer shared key _K2 . Optionally, the second request response message may include the second key identifier. The identification part of the second key may not be encrypted. The terminal can use the corresponding application layer shared key _K2 to decrypt the second request response message according to the second key identifier;

Step 107, the first server deletes the first key.

Specifically, the first server may be an application server, which may also be called NAF. The first key may be the common key Ks_NAF. When both the terminal and the first server have the application layer shared key _K2 , there is no need to store the shared key Ks_NAF. Therefore, the first server can delete the shared key Ks_NAF after sending the second request response message. Optionally, if the application layer shared key _K2 is used for encryption in the first application request message, the first server may delete the shared key Ks_NAF after sending the first request response message.

Referring to FIG. 2 , it shows a flow chart of the steps of Embodiment 2 of a communication method between a terminal and a server according to the present invention, which may specifically include the following steps: Step 201, the terminal sends a first request message to the first server, so The first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; specifically, the first server is an application server, which can also be called NAF. The first request message may be an application request. The application request carries a bootstrap session identifier (B-TID). Optionally, the application request may also include application layer data payload. Before sending the first request message, the terminal can derive the shared key Ks_NAF according to the shared key Ks generated by the AKA protocol. And the first request message is encrypted by the shared key Ks_NAF. The bootstrap session identifier (B-TID) in the first request message may not be used as an encrypted part. The second server may be BSF. The first key may be the common key Ks_NAF. After receiving the first request message, the NAF sends an authentication request (Authentication Request) to the BSF, and the authentication request includes a bootstrap session identifier and optionally, a NAF identifier (NAF-Id). The BSF finds the shared key Ks generated during the AKA negotiation with the terminal according to the bootstrap session identifier. And the shared key Ks_NAF is derived according to the shared key Ks. Then the BSF sends an authentication response message (Authentication Answer) to the first server, and the response message includes the shared key Ks_NAF. Optionally, the authentication response message may also include a Ks_NAF lifetime (key_lifetime). When the trial period expires, the terminal needs to re-generate a new shared key Ks_NAF through the shared key Ks with the BSF. After receiving the shared key Ks_NAF, the first server stores the shared key Ks_NAF. And the shared key Ks_NAF is used between the terminal and the first server to encrypt and decrypt air interface messages.

In the embodiment of the present invention, the step 201 may include the following sub-steps: sub-step S2011, the terminal sends a first request message to the first server, the first request message includes the second key identifier, the The second key identifier is used to make the first server send the second key to the terminal through the first request response message; specifically, the second key identifier may be an identifier of the application layer common key _K2 . The second key identifier can be preset on the terminal. The second key identifier may be included in the first request message sent by the terminal to the first server. And the first server may be instructed to send the second key corresponding to the second key identifier to the terminal through the first request response message corresponding to the first request message. Optionally, the first server may first obtain the common key K ₂ from the application layer key management server. And the shared key K ₂ is sent to the terminal through the first request response message.

Step 202, the terminal receives a first request response message corresponding to the first request message sent by the first server, the first request response message includes a second key; specifically, the first request response message may be Application Answer\(Application Answer) message. The second key may be an application layer common key K ₂ . The common key _K2 may be managed by the first server itself. It can also be managed by an application layer key management server. When the application layer key management server is used for management, the first server first obtains the common key K ₂ from the application layer key management server by sending a request message. And the shared key K ₂ is sent to the terminal through the first request response message. At the same time, the first server also stores the common key K ₂ . Optionally, the first request-response message may be encrypted by the first key, ie, the common key Ks_NAF. Since both the NAF and the terminal have the shared key Ks_NAF, the first request response message can be encrypted by the shared key Ks_NAF and sent to the terminal, and decrypted by the terminal.

In the embodiment of the present invention, the step 202 may include the following sub-steps: sub-step S2021, the first request response message includes the second key identifier; specifically, the first request response message may be an Application Answer (Application Answer )message. The second key identifier may be the identifier of the application layer common key _K2 . The second key identifier can be used as an instruction to enable the first server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier. Optionally, the second key identifier may instruct the first server to use the second key to encrypt the second request response message.

Step 203, the terminal sends a second request message to the first server, the second request message includes a second key identifier, and the second key identifier is used to make the first server The second key corresponding to the key identifier generates a second request response message corresponding to the second request message; specifically, the second request message may be an application request message. The second key identifier may be a unique identifier of the application layer common key _K2 . The second request message may be encrypted by the shared key Ks_NAF. Optionally, the second request message can also be encrypted by the common key _K2 . When encrypted with the common key _K2 , the second key identifier may not be encrypted. The second key identifier can be used as an instruction to enable the server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier. Optionally, the second request message may not include the second key identifier, and the first server may try to use the first key or the second key to decrypt the second request message. The first server can determine whether the second key has been derived according to the boot session ID, and if yes, the first server encrypts the second request-response message with the second key and sends it to the terminal. The terminal can decrypt the second request-response message through the second key.

In the embodiment of the present invention, the step 203 may include the following sub-steps: sub-step S2031, the second request message is encrypted by the first key; specifically, the first key is the common key Ks_NAF. The second request message may be encrypted by the shared key Ks_NAF.

Step 204, the terminal receives the second request response message sent by the first server.

Specifically, the first server may be an application server, which may also be called NAF. The second request response message sent by the first server to the terminal may be encrypted by the application layer shared key _K2 . Optionally, the second request response message may include the second key identifier. The identification part of the second key may not be encrypted. The terminal may use the corresponding application layer shared key _K2 to decrypt the second request response message according to the second key identifier; in the embodiment of the present invention, the step 204 may include the following sub-steps: sub-step S2041, the terminal Deleting the first key; specifically, the first server may be an application server, also called NAF. The first key may be the shared key Ks_NAF. When both the terminal and the first server have the application layer shared key _K2 , there is no need to store the shared key Ks_NAF. Therefore, the terminal can delete the shared key Ks_NAF after receiving the second request response message. Optionally, if the application layer shared key _K2 is used for encryption in the first application request message, the terminal may delete the shared key Ks_NAF after receiving the first request response message.

Referring to FIG. 3 , it shows a flow chart of the steps of Embodiment 2 of a communication method between a terminal and a server according to the present invention, which may specifically include the following steps: Step 301, the first server receives the first request message sent by the terminal, The first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; specifically, the first server is an application server, which can also be called NAF . The first request message may be an application request. The application request carries a bootstrap session identifier (B-TID). optional Alternatively, the application request may also include application layer data payload. Before sending the first request message, the terminal can derive the shared key Ks_NAF according to the shared key Ks generated by the AKA protocol. And the first request message is encrypted by the shared key Ks_NAF. The bootstrap session identifier (B-TID) in the first request message may not be used as an encrypted part. The second server may be BSF. The first key may be the shared key Ks_NAF. After receiving the first request message, the NAF sends an authentication request (Authentication Request) to the BSF, and the authentication request includes a bootstrap session identifier and optionally, a NAF identifier (NAF-Id). The BSF finds the shared key Ks generated during the AKA negotiation with the terminal according to the bootstrap session identifier. And the shared key Ks_NAF is derived according to the shared key Ks. Then the BSF sends an authentication response message (Authentication Answer) to the first server, and the response message includes the shared key Ks_NAF. Optionally, the authentication response message may also include a Ks_NAF lifetime (key_lifetime). When the trial period expires, the terminal needs to re-generate a new shared key Ks_NAF through the shared key Ks with the BSF. After receiving the shared key Ks_NAF, the first server stores the shared key Ks_NAF. And the shared key Ks_NAF is used between the terminal and the first server to encrypt and decrypt air interface messages.

In the embodiment of the present invention, the step 301 may include the following sub-steps:

In sub-step S3011, the first server receives the first request message sent by the terminal, the first request message includes a second key identifier, and the second key identifier is used to enable the first server to pass through the first request message. A request response message sends the second key to the terminal; specifically, the second key identifier may be an identifier of the application layer common key _K2 . The second key identifier can be preset on the terminal. The second key identifier may be included in the first request message sent by the terminal to the first server. And the first server may be instructed to send the second key corresponding to the second key identifier to the terminal through the first request response message corresponding to the first request message. Optionally, the first server may first obtain the common key K ₂ from the application layer key management server. And the shared key K ₂ is sent to the terminal through the first request response message.

Step 302, the first server sends a first request response message corresponding to the first request message to the terminal, and the first request response message includes the second key; specifically, the first request response message may be an application response ( Application Answer) message. The second key may be an application layer common key K ₂ . The common key _K2 may be managed by the first server itself. It can also be managed by an application layer key management server. When the application layer key management server is used for management, the first server first obtains the common key K ₂ from the application layer key management server by sending a request message. And the shared key K ₂ is sent to the terminal through the first request response message. At the same time, the first server also stores the common key K ₂ . Optionally, the first request-response message may be encrypted by the first key, ie, the common key Ks_NAF. Since both the NAF and the terminal have the shared key Ks_NAF, the first request response message can be encrypted by the shared key Ks_NAF and sent to the terminal, and decrypted by the terminal.

In the embodiment of the present invention, the step 302 may include the following sub-steps: Sub-step S3021, the first request response message includes the second key identifier; specifically, the first request response message may be an Application Answer (Application Answer )message. The second key identifier may be the identifier of the application layer common key _K2 . The second key identifier can be used as an instruction to enable the first server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier. Optionally, the second key identifier may instruct the first server to use the second key to encrypt the second request response message.

Step 303, the first server receives a second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server according to the The second key corresponding to the second key identifier generates a second request response message corresponding to the second request message; specifically, the second request message may be an application request message. The second key identifier may be a unique identifier of the application layer common key _K2 . The second request message may be encrypted by the shared key Ks_NAF. Optionally, the second request message can also be encrypted by the common key _K2 . When encrypted with the common key _K2 , the second key identifier may not be encrypted. The second key identifier can be used as an instruction to enable the server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier. Optionally, the second request message may not include the second key identifier, and the first server may try to use the first key or the second key to decrypt the second request message. The first server can determine whether the second key has been derived according to the boot session ID, and if yes, the first server encrypts the second request-response message with the second key and sends it to the terminal. The terminal can decrypt the second request-response message through the second key.

In the embodiment of the present invention, after the step 303, the following sub-steps may be included before the step 304: sub-step S3031, the first server decrypts the second request message according to the first key; specifically Alternatively, the second request message may be an application request message. The first key is the common key Ks_NAF. The second request message may be encrypted by the shared key Ks_NAF. Optionally, the second request message can also be encrypted by the common key _K2 . When encrypted with the common key _K2 , the second key identifier may not be encrypted. The second key identifier can be used as an instruction to enable the server to decrypt the second request message with the shared key K ₂ corresponding to the second key identifier.

Sub-step S3032, the first server encrypts the second request response message according to the second key corresponding to the second key identifier in the second request message; specifically, the second key identifier may be an application The unique identification of the layer common key _K2 . The second key is the application layer common key K ₂ . The first server obtains the unique identifier of the application layer shared key _K2 in the application request message, and encrypts the application response message corresponding to the application request message with the application layer shared key _K2 corresponding to the unique identifier of the application layer shared key _K2 .

In the embodiment of the present invention, the step 203 may include the following sub-steps: sub-step S3033, the second request message is encrypted with the first key; specifically, the second request information may be an application request message. The first key may be the common key Ks_NAF. The second request message may be encrypted by the shared key Ks_NAF. Optionally, the second request message may also be encrypted by the application layer shared key _K2 .

Step 304, the first server sends a second request response message to the terminal.

Specifically, the first server may be an application server, which may also be called NAF. The second request response message sent by the first server to the terminal may be encrypted by the application layer shared key _K2 . Optionally, the second request response message may include the second key identifier. The identification part of the second key may not be encrypted. The terminal can use the corresponding application layer shared key _K2 to decrypt the second request response message according to the second key identifier.

In the embodiment of the present invention, the step 304 may include the following sub-steps: sub-step S3041, the first server deletes the first key; specifically, the first server may be an application server, or It's called NAF. The first key may be the shared key Ks_NAF. When both the terminal and the first server have the application layer shared key _K2 , there is no need to store the shared key Ks_NAF. Therefore, the first server can delete the shared key Ks_NAF after sending the second request response message. Optionally, if the application layer shared key _K2 is used for encryption in the first application request message, the first server may delete the shared key Ks_NAF after sending the first request response message.

Referring to FIG. 4 , it shows a flow chart of the steps of Embodiment 3 of a communication method between a terminal and a server according to the present invention, which may specifically include the following steps:

Step 401, the terminal sends a third request message to the third server, the third request message is used to make the third server send an authentication request to the fourth server, and obtain the third key from the fourth server ; Specifically, the third server is an application layer key management server. FIG. 5 shows the system architecture of Embodiment 3. The terminal can first generate the shared key Ks through the AKA protocol. Afterwards, the secret channel between the terminal and the application layer key management server can be established through the common key Ks_NAF derived from Ks. The application layer key management server can be used to manage key distribution among multiple application servers. The application server key can also be the root key. The application layer key management server can replace the shared key Ks_NAF with the application layer shared key _K2 to establish a secure channel between the terminal and the application layer key management server. Afterwards, the application layer key management server can deliver the key or root key of the application server to the terminal through a secure channel, so that the terminal can establish a secure connection with multiple application servers.

The third request message may be an application request. The application request carries a bootstrap session identifier (B-TID). Optionally, the application request may also include application layer data payload. Before sending the third request message, the terminal can derive the shared key Ks_NAF according to the shared key Ks generated by the AKA protocol. And the third request message is encrypted by the common key Ks_NAF. The bootstrap session identifier (B-TID) in the third request message may not be used as an encrypted part. The fourth server may be BSF. The third key may be the common key Ks_NAF. After receiving the third request message, the application layer key management server sends an authentication request (Authentication Request) to the BSF. The authentication request includes the boot session identifier and optionally, the application layer key management server identifier. BSF finds the Shared key Ks generated in AKA negotiation. And the shared key Ks_NAF is derived according to the shared key Ks. Then the BSF sends an authentication response message (Authentication Answer) to the third server, and the response message includes the shared key Ks_NAF. Optionally, the authentication response message may also include a Ks_NAF lifetime (key_lifetime). When the trial period expires, the terminal needs to re-generate a new shared key Ks_NAF through the shared key Ks with the BSF. After receiving the shared key Ks_NAF, the third server stores the shared key Ks_NAF. And between the terminal and the third server, the shared key Ks_NAF is used to encrypt and decrypt the air interface message.

In the embodiment of the present invention, the step 401 may include the following sub-steps: sub-step S4011, the terminal sends a third request message to the third server, the third request message includes the fourth key identifier, the The fourth key identifier is used to make the third server send the fourth key to the terminal through the third request response message; specifically, the fourth key identifier may be an identifier of the application layer common key _K2 . The fourth key identifier may be preset on the terminal. The fourth key identifier may be included in the third request message sent by the terminal to the third server. And the third server may be instructed to send the fourth key corresponding to the fourth key identifier to the terminal through the third request response message corresponding to the third request message. Optionally, the third server may first obtain the common key K ₂ from the application layer key management server. And the shared key K ₂ is sent to the terminal through the third request response message.

Step 402, the terminal receives the third request response message corresponding to the third request message sent by the third server, the third request response message includes the fourth key; specifically, the third server is an application layer Key management server. The third request response message may be an application answer (Application Answer) message. The fourth key may be an application layer common key K ₂ . The application layer shared key _K2 can be managed by the application layer key management server. The application key management server can deliver the application layer shared key _K2 to the terminal, so that a secure channel can be established between the terminal and the application layer key management server through the application layer shared key _K2 .

In the embodiment of the present invention, the step 402 may include the following sub-steps: sub-step S4021, the third request response message includes the fourth key identifier; specifically, the third request response message may be an Application Answer (Application Answer )message. The fourth key identifier may be the identifier of the application layer common key _K2 . When sending the fourth request message, the terminal can enable the application layer key management server to decrypt the fourth request message through the fourth key corresponding to the fourth key identifier by carrying the fourth key identifier. Optionally, the fourth key identifier may also be used to instruct the application layer key management server to use the fourth key corresponding to the fourth key identifier to encrypt the fourth request response message.

Step 403, the terminal sends a fourth request message to the third server, the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server The fourth key corresponding to the key identifier generates a fourth request response message corresponding to the fourth request message; specifically, the fourth request message may be an application request message. The fourth key identifier may be the unique identifier of the application layer common key _K2 . The fourth request message may be encrypted by the shared key Ks_NAF. Optionally, the fourth request message can also be encrypted by the shared key _K2 . When the common key _K2 is used for encryption, the fourth key identifier may not be encrypted. The fourth key identifier can be used as an instruction to enable the server to decrypt the fourth request message with the shared key K ₂ corresponding to the fourth key identifier. Optionally, the fourth request message may include an application server identifier. The application server identifier is used to instruct the application layer key management server to obtain the application server key (AppKey) from the application server corresponding to the application server identifier. The application layer key management server may send a request message to the application server after receiving the fourth application request message, and obtain the application server key (AppKey) according to the response message corresponding to the request message. Optionally, the application server key can also be called an application key. The application server ID may also be called an application ID. The application layer key management server can determine the application server ID and the corresponding address according to the mapping relationship between the application ID and the application server ID, and send a request message to the application server. The request message may be a key request message.

In the embodiment of the present invention, the step 403 may include the following sub-steps: sub-step S4031, the fourth request message is encrypted by the fourth key; specifically, the fourth request message may be an application request message. The fourth key may be an application layer common key K ₂ . The application request message can be encrypted by the application layer shared key _K2 . Optionally, the application request message can also be encrypted by the shared key Ks_NAF.

Step 404, the terminal receives the fourth request response message sent by the third server, the fourth request response message includes a fifth key, and the fifth key is received by the third server and sent by the terminal After the fourth request message of , send a request to the fifth server and obtain it from the fifth server.

Specifically, the third server may be an application layer key management server. The fifth server may be an application server. The fifth key may be the key of the application layer server or the root key. The application layer key management server may send a request message to the application server after receiving the fourth application request message, and obtain the application server key (AppKey) according to the response message corresponding to the request message. Optionally, the application server key can also be called an application key. The application server ID may also be called an application ID. The application layer key management server can determine the application server ID and the corresponding address according to the mapping relationship between the application ID and the application server ID, and send a request message to the application server. The request message may be a key request message. The fourth request response message sent by the third server to the terminal may be encrypted by the application layer shared key _K2 . Optionally, the fourth key identifier may be included in the second request response message. The identification part of the fourth key may not be encrypted. The terminal can use the corresponding application layer shared key _K2 to decrypt the second request response message according to the second key identifier.

In the embodiment of the present invention, the step 404 may include the following sub-steps: sub-step S4041, the terminal deletes the third key and the fourth key; specifically, the third key may be the common key Ks_NAF . When both the terminal and the application server have the application server key Appkey, there is no need to store the shared key Ks_NAF and the application layer shared key K ₂ . Therefore, the terminal may delete the shared key Ks_NAF and the application layer shared key K ₂ after receiving the fourth request response message. Optionally, if the application layer shared key _K2 is used for encryption in the third application request message, the terminal may delete the shared key Ks_NAF after receiving the first request response message. And after receiving the fourth request response message, delete the application layer common key K ₂ .

Referring to FIG. 6 , it shows a flow chart of the steps of Embodiment 3 of a communication method between a terminal and a server according to the present invention, which may specifically include the following steps:

Step 501, the third server receives the third request message sent by the terminal, the third request message is used to make the third server send an authentication request to the fourth server, and obtain the third gold from the fourth server. key; specifically, the third server is an application layer key management server. FIG. 5 shows the system architecture of Embodiment 3. The terminal can first generate the shared key Ks through the AKA protocol. Afterwards, the secret channel between the terminal and the application layer key management server can be established through the common key Ks_NAF derived from Ks. The application layer key management server can be used to manage key distribution among multiple application servers. The application server key can also be the root key. The application layer key management server can replace the shared key Ks_NAF with the application layer shared key _K2 to establish a secure channel between the terminal and the application layer key management server. Afterwards, the application layer key management server can deliver the key or root key of the application server to the terminal through a secure channel, so that the terminal can establish a secure connection with multiple application servers.

The third request message may be an application request. The application request carries a Bootstrapping Transaction Identifier (B-TID). The bootstrap session ID is used to bind the signing identity and keying material. Optionally, the application request may also include application layer data payload. Before sending the third request message, the terminal can derive the shared key Ks_NAF according to the shared key Ks generated by the AKA protocol. And the third request message is encrypted by the common key Ks_NAF. The bootstrap session identifier (B-TID) in the third request message may not be used as an encrypted part. The fourth server may be BSF. The third key may be the common key Ks_NAF. After receiving the third request message, the application layer key management server sends an authentication request (Authentication Request) to the BSF. The authentication request includes the boot session identifier and optionally, the application layer key management server identifier. The BSF finds the shared key Ks generated during the AKA negotiation with the terminal according to the bootstrap session identifier. And the shared key Ks_NAF is derived according to the shared key Ks. Then the BSF sends an authentication response message (Authentication Answer) to the third server, and the response message includes the shared key Ks_NAF. Optionally, the authentication response message may also include a Ks_NAF lifetime (key_lifetime). When the trial period expires, the terminal needs to re-generate a new shared key Ks_NAF through the shared key Ks with the BSF. After receiving the shared key Ks_NAF, the third server stores the shared key Ks_NAF. And between the terminal and the third server, the shared key Ks_NAF is used to encrypt and decrypt the air interface message.

In the embodiment of the present invention, the step 501 may include the following sub-steps: sub-step S5011, the third server receives the third request message sent by the terminal, the third request message includes the fourth key identifier , the fourth key identifier is used to make the third server send the fourth key to the terminal through the third request response message; specifically, the fourth key identifier may be an application layer shared key K ₂ logo. The fourth key identifier may be preset on the terminal. The fourth key identifier may be included in the third request message sent by the terminal to the third server. And the third server may be instructed to send the fourth key corresponding to the fourth key identifier to the terminal through the third request response message corresponding to the third request message. Optionally, the third server may first obtain the common key K ₂ from the application layer key management server. And the shared key K ₂ is sent to the terminal through the third request response message.

Step 502, the third server sends a third request response message corresponding to the third request message to the terminal, and the third request response message includes a fourth key; specifically, the third server is an application layer key key management server. The third request response message may be an application answer (Application Answer) message. The fourth key may be an application layer common key K ₂ . The application layer shared key _K2 can be managed by the application layer key management server. The application key management server can deliver the application layer shared key _K2 to the terminal, so that a secure channel can be established between the terminal and the application layer key management server through the application layer shared key _K2 .

In the embodiment of the present invention, the step 502 may include the following sub-steps: sub-step S5021, the third request response message includes the fourth key identifier; specifically, the third request response message may be an Application Answer (Application Answer )message. The fourth key identifier may be the identifier of the application layer common key _K2 . When sending the fourth request message, the terminal can enable the application layer key management server to decrypt the fourth request message through the fourth key corresponding to the fourth key identifier by carrying the fourth key identifier. Optionally, the fourth key identifier may also be used to instruct the application layer key management server to use the fourth key corresponding to the fourth key identifier to encrypt the fourth request response message.

Step 503, the third server receives a fourth request message sent by the terminal, the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server according to the The fourth key corresponding to the fourth key identifier generates a fourth request response message corresponding to the fourth request message; specifically, the fourth request message may be an application request message. The fourth key identifier may be the unique identifier of the application layer common key _K2 . The fourth request message may be encrypted by the shared key Ks_NAF. Optionally, the fourth request message can also be encrypted by the shared key _K2 . When the common key _K2 is used for encryption, the fourth key identifier may not be encrypted. The fourth key identifier can be used as an instruction to enable the server to decrypt the fourth request message with the shared key K ₂ corresponding to the fourth key identifier. Optionally, the fourth request message may include an application server identifier. The application server identifier is used to instruct the application layer key management server to obtain the application server key (AppKey) from the application server corresponding to the application server identifier. The application layer key management server may send a request message to the application server after receiving the fourth application request message, and obtain the application server key (AppKey) according to the response message corresponding to the request message. Optionally, the application server key can also be called an application key. The application server ID may also be called an application ID. The application layer key management server can determine the application server ID and the corresponding address according to the mapping relationship between the application ID and the application server ID, and send a request message to the application server. The request message may be a key request message.

In the embodiment of the present invention, the step 403 may include the following sub-steps: sub-step S4031, the fourth request message is encrypted by the fourth key; specifically, the fourth request message may be an application request message. The fourth key may be an application layer common key K ₂ . The application request message can be encrypted by the application layer shared key _K2 . Optionally, the application request message can also be encrypted by the shared key Ks_NAF.

Step 504, the third server sends the fourth request-response message to the terminal, the fourth request-response message includes a fifth key, and the fifth key is the fourth key received by the third server from the terminal. After the request message, a request is sent to the fifth server and obtained from the fifth server.

Specifically, the third server may be an application layer key management server. The fifth server may be an application server. The fifth key may be the key of the application layer server or the root key. The application layer key management server may send a request message to the application server after receiving the fourth application request message, and obtain the application server key (AppKey) according to the response message corresponding to the request message. Optionally, the application server key can also be called an application key. The application server ID may also be called an application ID. The application layer key management server can determine the application server ID and the corresponding address according to the mapping relationship between the application ID and the application server ID, and send a request message to the application server. The request message may be a key request message. The fourth request response message sent by the third server to the terminal may be encrypted by the application layer shared key _K2 . Optionally, the fourth key identifier may be included in the second request response message. The identification part of the fourth key may not be encrypted. The terminal can use the corresponding application layer shared key _K2 to decrypt the second request response message according to the second key identifier.

In the embodiment of the present invention, the step 504 may include the following sub-steps: sub-step S5041, the third server deletes the third key and the fourth key; specifically, the third key may be a shared Key Ks_NAF. When both the terminal and the application server have the application server key AppKey, there is no need to store the shared key Ks_NAF and the application layer shared key K ₂ . Therefore, the third server may delete the shared key Ks_NAF and the application layer shared key K ₂ after sending the fourth request response message. Optionally, if the application layer shared key _K2 is used for encryption in the third application request message, the third server may delete the shared key Ks_NAF after sending the first request response message. And after the fourth request response message is sent, the application layer common key K ₂ is deleted.

Referring to FIG. 8 , it shows a structural block diagram of Embodiment 1 of a communication device between a terminal and a server according to the present invention, which may specifically include the following modules: a receiving module 2002 located in the first server for receiving the terminal The first request message sent, the first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; The module 2001 is configured to send a first request response message corresponding to the first request message to the terminal, the first request response message includes the second key; the receiving module 2002 located in the first server is configured to receive The second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server identify the corresponding second key according to the second key identifier. key to generate a second request response message corresponding to the second request message, the second request message is encrypted by the first key; the processing module 2003 located in the first server is used to decrypt according to the first key The second request message; the processing module 2003 located in the first server, configured to encrypt the second request response message according to the second key corresponding to the second key identifier in the second request message The sending module 2001 located in the first server is used to send the second request response message to the terminal; the processing module 2003 located in the first server is used to delete the first key.

Referring to FIG. 7 , it shows a structural block diagram of Embodiment 2 of a communication device between a terminal and a server according to the present invention, which may specifically include the following modules: a sending module 1001 located at the terminal, used to send a message to the first server sending a first request message, the first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; the receiving module 1002 located at the terminal, It is used to receive a first request response message corresponding to the first request message sent by the first server, the first request response message includes the second key; the sending module 1001 located at the terminal is used to send the second key A server sends a second request message, the second request message includes a second key identifier, and the second key identifier is used to make the first server identify the corresponding second key according to the second key identifier Generate a second request response message corresponding to the second request message; a receiving module 1002 located at the terminal is configured to receive the second request response message sent by the first server.

In the embodiment of the present invention, the device may further include: the second request message is encrypted by a first key.

In the embodiment of the present invention, the device may further include: the first request response message includes the second key identifier; in the embodiment of the present invention, the device may further include: a sending A module, configured to send a first request message to the first server, the first request message includes a second key identifier, and the second key identifier is used to make the first server respond through the first request A message sends the second key to the terminal; in the embodiment of the present invention, the device may further include: the terminal deletes the first key.

Referring to FIG. 8 , it shows a structural block diagram of Embodiment 2 of a communication device between a terminal and a server according to the present invention, which may specifically include the following modules: a receiving module 2002 located in the first server for receiving the terminal The first request message sent, the first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; The module 2001 is configured to send a first request response message corresponding to the first request message to the terminal, the first request response message includes the second key; the receiving module 2002 located in the first server is configured to receive The second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server identify the corresponding second key according to the second key identifier. The key generates a second request response message corresponding to the second request message; the sending module 2001 located in the first server is configured to send the second request response message to the terminal.

In the embodiment of the present invention, the device may further include: a processing module located in the first server, configured to decrypt the second request message according to the first key; A processing module of the device, configured to encrypt the second key according to the second key corresponding to the second key identifier in the second request message A request response message; in the embodiment of the present invention, the device may further include: the second request message is encrypted by a first key.

In the embodiment of the present invention, the device may further include: the first request response message includes the second key identifier; in the embodiment of the present invention, the device may further include: The receiving device of the server is used to receive the first request message sent by the terminal, the first request message includes a second key identifier, and the second key identifier is used to make the first server respond through the first request A message sends the second key to the terminal; in the embodiment of the present invention, the device may further include: a processing module located in the first server, configured to delete the first key.

Referring to FIG. 7 , it shows a structural block diagram of Embodiment 3 of a communication device between a terminal and a server according to the present invention, which may specifically include the following modules: a sending module 1001 located at the terminal, used to send data to the third server sending a third request message, the third request message is used to make the third server send an authentication request to the fourth server, and obtain the third key from the fourth server; the receiving module 1002 located at the terminal, For receiving a third request response message corresponding to the third request message sent by the third server, the third request response message includes the fourth key; the sending module 1001 located at the terminal is used for sending the 3. The server sends a fourth request message, the fourth request message includes a fourth key identifier, The fourth key identifier is used to make the third server generate a fourth request response message corresponding to the fourth request message according to the fourth key corresponding to the fourth key identifier; Group 1002, configured to receive the fourth request-response message sent by the third server, the fourth request-response message includes a fifth key, and the fifth key is received by the third server from the terminal After the fourth request message, a request is sent to the fifth server and obtained from the fifth server.

In the embodiment of the present invention, the device may further include: the fourth request message is encrypted by a fourth key.

In the embodiment of the present invention, the device may further include: the third request response message includes the fourth key identifier; in the embodiment of the present invention, the device may further include: a sending A module, configured to send a third request message to a third server, the third request message includes a fourth key identifier, and the fourth key identifier is used to make the third server respond through the third request Send the fourth key to the terminal via a message; in the embodiment of the present invention, the device may further include: a processing module 1003 located at the terminal, configured to delete the third key and the fourth key .

Referring to FIG. 8 , it shows a structural block diagram of Embodiment 3 of a communication device between a terminal and a server according to the present invention, which may specifically include the following modules: a receiving module 2002 located in the third server for receiving the terminal The third request message sent, the third request message is used to make the third server The server sends an authentication request to the fourth server, and obtains a third key from the fourth server; the sending module 2001 located in the third server is configured to send the third request message corresponding to the terminal to the terminal. Three request response messages, the third request response message includes a fourth key; the receiving module 2002 located in the third server is used to receive the fourth request message sent by the terminal, the fourth request message Including the fourth key identification, the fourth key identification is used to make the third server generate the fourth request response message corresponding to the fourth request message according to the fourth key corresponding to the fourth key identification; The sending module 2001 of the third server is configured to send the fourth request response message to the terminal, the fourth request response message includes a fifth key, and the fifth key is for the third server to receive the terminal After the fourth request message is sent, a request is sent to the fifth server and obtained from the fifth server.

In the embodiment of the present invention, the device may further include: the fourth request message is encrypted by a fourth key.

In the embodiment of the present invention, the device may further include: the third request response message includes the fourth key identifier; in the embodiment of the present invention, the device may further include: A receiving module of the device, configured to receive a third request message sent by the terminal, the third request message includes a fourth key identifier, and the fourth key identifier is used to enable the third server to pass through the first 3. sending the fourth key to the terminal in a request response message; In the embodiment of the present invention, the device may further include: a processing module 2003 located in the third server, configured to delete the third key and the fourth key.

As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

An embodiment of the present invention also provides an apparatus, including: one or more processors; and one or more machine-readable media storing instructions thereon, which, when executed by the one or more processors, cause the The device executes the method described in the embodiment of the present invention.

The embodiment of the present invention also provides one or more machine-readable media, on which instructions are stored, and when executed by one or more processors, the device executes the method described in the embodiment of the present invention.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, devices, or computer program products. Accordingly, embodiments of the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present invention may employ a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) having computer-usable program code embodied therein form.

Embodiments of the present invention are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and combinations of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to general-purpose computers, special-purpose computers, embedded processors, or processors of other programmable data processing terminal equipment to produce a machine that can be executed by a processor of a computer or other programmable data processing terminal equipment The instructions produce means for realizing the functions specified in one or more steps of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal to operate in a specific manner, so that the instructions stored in the computer-readable memory generate product, the instruction device realizes the function specified in one or more steps of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded into a computer or other programmable data processing terminal equipment, so that a series of operation steps are executed on the computer or other programmable data processing terminal equipment to produce computer-implemented processing, so that the computer or other programmable data processing terminal The instructions executed on the terminal device are designed to provide steps for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

While a preferred embodiment of the present invention has been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, the appended patent scope means It is intended to be construed as including the preferred embodiment and all changes and modifications falling within the scope of the embodiment of the present invention.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or terminal equipment comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements identified, or also include elements inherent in such a process, method, article, or terminal equipment. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or terminal device comprising said element.

A communication method between a terminal and a base station, a communication device between a terminal and a base station, a method for connecting a terminal to a network, and a device for connecting a terminal to a network provided by the present invention have been described above in detail. In this paper, specific examples are applied to the present invention. The principle and the implementation mode of the present invention have been set forth, and the description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those with ordinary knowledge in the technical field of the present invention, according to the thought of the present invention, in the implementation There will be changes in examples and scope of application. To sum up, the contents of this specification should not be construed as limiting the present invention.

Claims (15)

A communication method between a terminal and a server, comprising: a first server receiving a first request message sent by the terminal, the first request message is used to make the first server send an authentication request to the second server, and obtain the first key from the second server; the first server sends a first request response message corresponding to the first request message to the terminal, and the first request response message includes the second key; the first server The server receives the second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server identify the corresponding second key according to the second key identifier. key to generate a second request response message corresponding to the second request message, the second request message is encrypted by the first key; the first server decrypts the second request message according to the first key; the first server The server encrypts the second request response message according to the second key corresponding to the second key identifier in the second request message; the first server sends the second request response message to the terminal; and the first The server deletes the first key. A communication method between a terminal and a server, comprising: the terminal sends a first request message to a first server, the first request message is used to make the first server send an authentication request to a second server, and obtaining the first key from the second server; The terminal receives a first request response message corresponding to the first request message sent by the first server, the first request response message includes a second key; the terminal sends a second request message to the first server, the The second request message includes a second key identifier, and the second key identifier is used to make the first server generate a second request corresponding to the second request message according to the second key corresponding to the second key identifier a response message; and the terminal receives the second request response message sent by the first server. According to the method described in claim 2, wherein the first request message further includes the second key identifier, and the step of the terminal sending the first request message to the first server includes: sending the terminal to the first server The server sends the first request message, the first request message includes the second key identifier, and the second key identifier is used to make the first server send the second key to the terminal through the first request response message key. A communication method between a terminal and a server, comprising: a first server receiving a first request message sent by the terminal, and the first request message is used to make the first server send an authentication request to a second server , and obtain the first key from the second server; the first server sends a first request response message corresponding to the first request message to the terminal, and the first request response message includes the second key; The first server receives the second request message sent by the terminal, the second request message includes a second key identifier, and the second key identifier is used to make the first server identify the corresponding The second key generates a second request response message corresponding to the second request message; and the first server sends the second request response message to the terminal. The method according to claim 4, wherein, after the first server receives the second request message sent by the terminal, before the first server sends the second request response message to the terminal, further comprising: The first server decrypts the second request message according to the first key; and the first server encrypts the second request according to the second key corresponding to the second key identifier in the second request message Answer the message. A communication method between a terminal and a server, comprising: the terminal sends a third request message to a third server, the third request message is used to make the third server send an authentication request to a fourth server, and obtain a third key from the fourth server; the terminal receives a third request response message corresponding to the third request message sent by the third server, and the third request response message includes the fourth key; the terminal sending a fourth request message to the third server, where the fourth request message includes the fourth key identifier, and the fourth key identifier is used to make the third server correspond to the fourth key identifier according to the fourth key identifier. The four keys yield the a fourth request-response message corresponding to the fourth request message; and the terminal receives the fourth request-response message sent by the third server, the fourth request-response message includes a fifth key, the fifth key is the third server After receiving the fourth request message sent by the terminal, the server sends a request to the fifth server, and obtains it from the fifth server. According to the method described in claim 6, wherein the third request message further includes the fourth key identifier, the step of the terminal sending the third request message to the third server includes: sending the terminal to the third server The server sends the third request message, the third request message includes the fourth key identification, and the fourth key identification is used to make the third server send the fourth key to the terminal through the third request response message key. A communication method between a terminal and a server, comprising: a third server receiving a third request message sent by the terminal, the third request message being used to make the third server send an authentication request to a fourth server , and obtain a third key from the fourth server; the third server sends a third request response message corresponding to the third request message to the terminal, and the third request response message includes the fourth key; The third server receives the fourth request message sent by the terminal, the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server correspond to the fourth request message according to the fourth key identifier. The four key generates a fourth request response message corresponding to the fourth request message; and The third server sends the fourth request response message to the terminal, the fourth request response message includes a fifth key, and the fifth key is sent to the third server after receiving the fourth request message sent by the terminal. A request is sent to the fifth server, and it is fetched from the fifth server. According to the method described in claim 8, wherein, the third request message further includes the fourth key identifier, and the step of the third server receiving the third request message sent by the terminal includes: the third server receiving The third request message sent by the terminal, the third request message includes the fourth key identifier, and the fourth key identifier is used to make the third server send the third request message to the terminal through the third request response message Four keys. A server for communicating with a terminal, characterized in that it includes: a receiving module located in the first server, used to receive a first request message sent by the terminal, and the first request message is used to make the first server send a request to the second The second server sends an authentication request, and obtains the first key from the second server; the sending module located in the first server is used to send a first request response message corresponding to the first request message to the terminal, the The first request response message includes the second key; the receiving module located at the first server is used to receive the second request message sent by the terminal, the second request message includes the second key identifier, and the second key The key identification is used to make the first server according to the second key identification The corresponding second key generates a second request response message corresponding to the second request message, the second request message is encrypted by the first key; the processing module located in the first server is used to a key to decrypt the second request message; the processing module located in the first server is used to encrypt the second request response according to the second key corresponding to the second key identifier in the second request message a message; a sending module on the first server, used to send the second request response message to the terminal; and a processing module on the first server, used to delete the first key. A terminal for communicating with a server, characterized in that it includes: a sending module located in the terminal, used to send a first request message to a first server, and the first request message is used to make the first server send a request message to a second server. The second server sends an authentication request, and obtains the first key from the second server; the receiving module located at the terminal is used to receive the first request response message corresponding to the first request message sent by the first server , the first request response message includes a second key; the sending module located at the terminal is configured to send a second request message to the first server, the second request message includes a second key identifier, and the second The key identifier is used to make the first server generate a second request response message corresponding to the second request message according to the second key corresponding to the second key identifier information; and a receiving module located at the terminal for receiving the second request response message sent by the first server. The terminal according to claim 11, wherein the first request message further includes the second key identifier, and the step of the terminal sending the first request message to the first server includes: a sending module located in the terminal , used to send the first request message to the first server, the first request message includes the second key identifier, and the second key identifier is used to make the first server pass the first request response message sending the second key to the terminal. A server for communicating with a terminal, characterized in that it includes: a receiving module located at the first server, used to receive a first request message sent by the terminal, and the first request message is used to make the first server send The second server sends an authentication request, and obtains the first key from the second server; the sending module located in the first server is used to send the first request response message corresponding to the first request message to the terminal , the first request response message includes a second key; the receiving module located at the first server is configured to receive the second request message sent by the terminal, the second request message includes a second key identifier, and the first The second key identifier is used to make the first server generate the second request response corresponding to the second request message according to the second key corresponding to the second key identifier a reply message; and a sending module located at the first server, configured to send the second request reply message to the terminal. A terminal for communicating with a server, characterized in that it includes: a sending module located in the terminal, used to send a third request message to a third server, and the third request message is used to make the third server send the third request message to the third server. The fourth server sends an authentication request, and obtains a third key from the fourth server; the receiving module located at the terminal is used to receive a third request response message corresponding to the third request message sent by the third server , the third request response message includes a fourth key; the sending module located at the terminal is used to send a fourth request message to the third server, the fourth request message includes a fourth key identifier, and the fourth The key identifier is used to make the third server generate a fourth request response message corresponding to the fourth request message according to the fourth key corresponding to the fourth key identifier; and a receiving module located at the terminal is used to receive The fourth request response message sent by the third server, the fourth request response message includes the fifth key, and the fifth key is sent to the fifth server after receiving the fourth request message sent by the terminal. The server sends the request and gets it from the fifth server. A server communicating with a terminal, characterized in that it includes: The receiving module located in the third server is used to receive the third request message sent by the terminal, the third request message is used to make the third server send an authentication request to the fourth server, and from the fourth server The server obtains the third key; the sending module located on the third server is used to send the third request response message corresponding to the third request message to the terminal, and the third request response message includes the fourth key; The receiving module of the third server is configured to receive a fourth request message sent by the terminal, the fourth request message includes a fourth key identifier, and the fourth key identifier is used to make the third server according to the The fourth key corresponding to the fourth key identifier generates a fourth request response message corresponding to the fourth request message; and a sending module located at the third server, configured to send the fourth request response message to the terminal, The fourth request response message includes a fifth key, which is obtained from the fifth server after the third server receives the fourth request message sent by the terminal and sends a request to the fifth server. .

Images