WO2005018146A1

WO2005018146A1 - Apparatus and method of authentication for user of fixed network terminal

Info

Publication number: WO2005018146A1
Application number: PCT/CN2004/000382
Authority: WO
Inventors: Zhongyi Fan
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2003-08-19
Filing date: 2004-04-21
Publication date: 2005-02-24
Also published as: HK1074936A1; CN100449990C; CN1585331A

Abstract

The invention provides an apparatus and a method of user authentication of fixed network terminal. The invention is that keep the user identification code in smart card, and the fixed network terminal gets the user identification code from the smart card, and completes the user authentication process. Because the user cannot see the user identification code and authentication key stored in smart card, it can efficiently keep the user account out of being embezzled and imitated, and can surely guarantee the advantage of runners and user. In addition, the invention more conveniently provides a better authentication mechanism in the network communication by improving the technique of the smart card processing module, and updating the user authentication information stored in the smart card, and can directly get corresponded improvement in the smart card processing module to realize many kinds of service, it is conveniently for the network runners to expand their service.

Description

User authentication device of fixed network terminal and method thereof

The present invention relates to the field of network communication technologies, and in particular, to a user authentication device and method for a fixed network terminal. Background technique

In network communication, fixed network terminal devices such as voice terminals, multimedia terminals, Ephone terminals, IAD (Integrated Acces s Device) terminals, MTA (Mul timedi a Termina l Adapter) terminals, and intelligent terminal devices The cost is relatively low and users can easily obtain it, so it is gradually widely used by network users, and is mainly used to access IP (Internet Protocol) networks and obtain corresponding services through IP networks. IP network is an open network structure. Network services that can be enjoyed after users obtain corresponding rights by paying corresponding fees are easily stolen by other fixed network end users. Therefore, strict and effective fixed network end users are provided. The authentication and authentication mechanism is particularly important for voice terminals, multimedia terminals, Ephone terminals, IAD terminals, and intelligent terminal equipment. At the same time, effective authentication and authentication of fixed network terminal users can also provide good protection to the network. Serving the interests of network operators.

Generally, in order to effectively perform user authentication and authentication processing, first of all,

During the process of registering a fixed network terminal device such as an AD / smart terminal with a management device, other users cannot intentionally or unintentionally obtain the user's key authentication information, so the user's authentication key (I.e. user password) and authentication algorithms are not transmitted on the Internet. Instead, user identification codes, challenge words, and authentication words are exchanged between the terminal and the management device through a unique authentication process to complete user authentication and authentication. And to prevent the theft of user information. At the same time, in order to further ensure the security of the user identification code and the authentication key, it is also necessary to perform corresponding security treatment on its storage method. Based on this need, the current user authentication and authentication mechanisms provided by various fixed network terminals usually include the following: Two types:

The first type: the user identification code and the authentication key are directly stored in the non-volatile memory inside the fixed network terminal device, and the user or the operator can modify it as needed; a certain user of the fixed network terminal device reports to the management device During registration, the internally stored user identification code and authentication key are used to perform data interaction with the management device to implement user authentication and authentication for fixed network terminal devices. For users who pass the authentication, they can use the network to provide various items Service

The second type: The user identification code and authentication key are not retained on the fixed network terminal. When the user under the fixed network terminal device registers with the management device, the user is first prompted to enter the identification code and user password (that is, the authentication key). Then, the fixed network terminal uses the information to perform data interaction with the management device to implement authentication and authentication processing for the user, and for the authenticated user, the network can be used to provide various services.

The above-mentioned two types of authentication and authentication methods realize the authentication and authentication processing for the end users of the fixed network, so as to ensure that only the users who pass the authentication and authentication can normally use the services provided by the network. However, the above two methods of authentication also have the following disadvantages:

1. If the user identification code and the authentication key are stored in a non-volatile memory inside the fixed network terminal device, the user identification code and the authentication key are easier to read, Rewriting and misappropriation cannot guarantee the security of network communication; at the same time, it also affects the mobility of users, that is, when users use other terminals, they need to reset the user identification code and the authentication key.

2. If the user enters the corresponding user identification code and authentication key, because the user knows the identification code and the authentication key, the same user identification code can be used by multiple people and multiple places, and the user identity cannot be achieved. Identification, and at the same time, the interests of operators are impaired.

3. At the same time, the two authentication methods also have the disadvantage of poor scalability, that is, it is inconvenient to update and upgrade the authentication algorithm, and it is not convenient to provide a more effective authentication algorithm for fixed network terminal users; The above two methods of authentication and authentication also make the services provided by the network operator limited to the functions provided by the fixed network terminal itself, and cannot conveniently carry out various new types of services. Summary of the invention

In view of the problems existing in the prior art, an object of the present invention is to provide a user authentication device and method for a fixed network terminal, so as to effectively prevent the theft of user accounts and provide operators with management of the fixed network terminal and corresponding users. It's convenient.

The object of the present invention is achieved by the following technical solutions:

A user authentication device for a fixed network terminal according to the present invention includes: a smart card processing module: configured to store authentication information of a user of the fixed network terminal, and perform data according to the saved user authentication information and the authentication and authentication processing module. Interaction; authentication and authentication processing module: calling the authentication information of the user of the fixed network terminal stored in the smart card processing module, and exchanging data with the smart card processing module, and Data interaction with the management device authenticates the fixed network terminal.

The smart card processing module includes:

Smart card: Built-in computing unit and storage unit, used to store the authentication information of the user of the fixed network terminal and complete the authentication operation;

Authentication information processing sub-module: It is used to send the user's authentication information in the smart card to the authentication and authentication processing module, or to the smart card to process the authentication information according to the information sent by the authentication and authentication processing module. The information is sent to the authentication and authentication processing module.

The authentication information in the smart card is stored in a storage component, and the storage component also serves as a carrier of a user application program for providing value-added services.

The authentication information processing sub-module includes a CPU (Central Processing Unit) chip. The smart card and the authentication information processing sub-module are detachably movable connections. The smart card processing module is built in or external to the fixed network terminal device, and is connected to the authentication and authentication processing module in the fixed network terminal device.

When the smart card processing module is externally connected to a fixed network terminal device, the smart card processing module communicates with the fixed network terminal through a wired or wireless interface such as a USB (Universal Serial Bus) interface, a serial interface, an infrared interface, and a Bluetooth interface. The authentication and authentication processing modules in the device are connected.

The present invention further provides a user authentication method for a fixed network terminal based on the apparatus of claim 1, comprising: A. The authentication and authentication processing module of the fixed network terminal obtains the user's authentication information from the smart card processing module, and sends the authentication information to the management device;

B. The management device generates a corresponding challenge word based on the user's authentication information and sends it back to the smart card processing module through the authentication and authentication processing module;

C. The smart card processing module sends the challenge word received to the smart card, and the smart card uses the internally saved user authentication information to perform arithmetic processing to generate the corresponding authentication word and return it to the management device;

D. The management device performs user identity authentication according to the received authentication word, and returns the authentication result to the fixed network terminal.

The authentication information includes a user identification code, an authentication key, and an authentication algorithm. The step A is: the authentication and authentication processing module of the fixed network terminal obtains the user identification code from the smart card processing module, and applies the The user identification code is sent to the management device. The step C is: the smart card processing module sends the received challenge word to the smart card, and the smart card uses the internally stored user's authentication key and authentication algorithm to perform arithmetic processing to generate corresponding Authentication word and return it to the management device.

The step C further includes:

The smart card can generate an encryption key for encrypting business communication data and send it to the fixed network terminal based on the challenge word received and the user authentication information stored internally.

It can be seen from the technical solution provided by the present invention that the present invention uses a smart card to store the corresponding user identification code and authentication key. The fixed network terminal can obtain the user identification code through the smart card and send it to the management device for user authentication. And authentication processing. Therefore, compared with the prior art solutions, the present invention has the following advantages: 1. Since the user's identification code and authentication key are stored in the smart card, others cannot get it, and the smart card is not designed to read the authentication key, so it can effectively prevent the user account from being stolen, impersonated, and guaranteed. The interests of users are not infringed;

2. The present invention realizes perfect authentication, authentication, and data encryption technologies through cooperation with smart cards, so that fixed network terminals can be operated, managed, and the interests of operators can be well protected;

3. Through the technical improvement of the smart card processing module and the update of the user's authentication information stored in the smart card therein, it can more conveniently provide a better authentication and authentication mechanism in network communication; and, it can also directly in the smart card Corresponding improvements are made in the processing module to implement a variety of services, such as high-performance CPUs and large-capacity memories can be integrated in smart cards, and electronic banking can be implemented on terminals by running corresponding programs, thus ensuring IAD / intelligence Fixed network terminals such as terminals do not need to be upgraded and provided richer services in the network, which facilitates network operators to better expand their services. BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a schematic structural diagram 1 of a user authentication device for a fixed network terminal according to the present invention; Fig. 2 is a schematic structural diagram of a user authentication device for a fixed network terminal according to the present invention; A flowchart of a method of user authentication. detailed description

The core of the user authentication device and method of the fixed network terminal according to the present invention is In order to ensure the security of user identification codes and authentication keys to ensure that the interests of network operators and users are not infringed, for this reason, the reliable storage and application of user identification codes and authentication keys ensure that they are not arbitrarily rewritten, Misappropriation has become an important prerequisite and guarantee for the operation and management of fixed network terminals.

The invention adopts a user authentication device and method for a fixed network terminal combining a fixed network terminal and a smart card. The smart card stores a user identification code and an authentication key, and the used smart card includes a commonly used SIM (Subscr iber) Identity Module (user identification module) card, user (identifier module) card, IC (Integrated Circuit) card, memory card, microprocessor card, etc., using smart cards and corresponding authentication information processing The module cooperates with the fixed network terminal to perform authentication, authentication, and data encryption technology processing, which solves many problems existing in the existing technology, facilitates network operators' operation and management of the fixed network terminal, and guarantees the user's Interests are not violated.

The specific implementation of the device according to the present invention is shown in FIG. 1 and FIG. 2, and includes an authentication and authentication processing module and a smart card processing module, where:

The authentication and authentication processing module is set in a fixed network terminal. The fixed network terminal obtains user authentication information, that is, a user identification code, and initiates an authentication process to a management device to verify whether the identity of the user is legal. The authentication and authentication processing module is used to transfer data information involved in the authentication process between the management device responsible for the user's authentication and authentication processing and the smart card processing module;

The smart card processing module further includes a smart card and an authentication information processing sub-module, wherein: The smart card has a built-in computing component and a storage component for storing user authentication information and performing authentication operations. The authentication information usually includes a user identification code, an authentication key, and an authentication algorithm, and the user identification code in the smart card Authentication information such as authentication keys, authentication keys, and algorithms can be processed using methods stored in the smart card storage component. The design makes it impossible for any user to steal or modify the authentication information. The authentication information processing sub-modules use removable removable connections, that is, connections such as SIM cards and mobile phones;

The authentication information processing sub-module is used to send the user's authentication information in the smart card to the authentication and authentication processing module. If the user needs to perform identity authentication, the authentication information processing sub-module calls up the user's authentication information and sends it. Process the authentication information to the authentication or authentication processing module, or according to the information sent by the authentication and authentication processing module (usually, the authentication operation based on the authentication algorithm stored in the smart card), and process the obtained information. The information is sent to the authentication and authentication processing module, and the authentication and authentication processing module sends the information that needs to be sent to the management device to the management device, that is, the authentication information processing submodule is used to implement the driving of the smart card, the reading and writing of authentication information, and data. Encryption and other functions.

The specific implementation manner of the device according to the present invention may include two specific implementation schemes: As shown in FIG. 1, a scheme is adopted in which a smart card processing module is combined with a fixed network terminal such as an IAD terminal and a smart terminal, that is, the smart card is processed. The authentication information processing module in the module, which is used to complete the user's authentication information reading and writing function, is directly integrated into the fixed network terminal, and the CPU in the fixed network terminal can be used to implement the corresponding function of the authentication information processing module. The clock line, the reset line and the data line are connected, and the smart card and the fixed network terminal adopt a removable removable connection, and the user can In order to install your own smart card in a fixed network terminal and pass the corresponding identity authentication, you can normally use the services provided by the network operator to the user through the communication network; therefore, in this solution, you need The smart card socket is installed inside the smart terminal. The size can refer to the size of the SIM card socket, and the I / O (input / output) interface of the CPU in the fixed network terminal is directly or indirectly connected to the contact on the smart card. Through the fixed network terminal Its own CPU implements the functions of smart card driving, reading and writing, and data encryption processing;

As shown in FIG. 2, another solution is a solution in which a smart card processing module is externally installed on a fixed network terminal, that is, the smart card processing module is connected to the fixed network terminal through a wire or wirelessly, and is connected with the fixed network terminal The authentication or authentication processing module communicates. The wired or wireless connection includes connection with a fixed network terminal through a USB interface, a serial port, an infrared interface, a Bluetooth interface, etc., and the corresponding function of the authentication information processing module in the smart card processing module can be passed through the CPU. The chip is implemented. At the same time, the authentication information processing module further includes an interface driver for communicating with the authentication and authentication processing module. In this solution, the smart card and the authentication information processing module are detachable. Active connection, that is, the smart card can be removed from the authentication information processing module to facilitate use in other fixed network terminals.

As can be seen from the above two specific implementation schemes, in the present invention, the user can easily replace the fixed network terminal used by himself after a physical location change, and can also ensure that the user's own interests and the interests of the network operator are equal. Will not be harmed.

Therefore, the present invention proposes a highly secure authentication and authentication mechanism for fixed network terminals such as voice terminals, multimedia terminals, IAD (integrated access device) terminals, and intelligent terminals; In addition, the present invention utilizes the perfect authentication, authentication, and data encryption technologies of smart cards such as SIM cards to relatively easily implement operability and management of fixed network terminals and the like.

The fixed network terminal according to the present invention includes, but is not limited to, various voice terminals, multimedia terminals, Ephone terminals, IAD terminals, MTA terminals, intelligent terminals, computer terminals, and the like.

The smart card of the present invention includes, but is not limited to, various IC (Integrated Circuit) cards, memory cards, microprocessor cards, SIM cards, UIM cards, and the like.

Based on the above-mentioned device of the present invention, the present invention also provides a user authentication method for a fixed network terminal. The specific implementation of the method is shown in FIG. 3 and includes the following steps: Step 31: When a user needs to obtain through a communication network When providing various services provided by the network operator, the management device of the communication network first needs to authenticate the identity of the user. At this time, the fixed network terminal device needs to read the user identification code from the smart card of the smart card processing module in order to perform the corresponding operation. Authentication processing.

Step 32: The fixed network terminal initiates an authentication request to the management device according to the user identification code.

Step 33: After receiving the user's identification code, the management device sends a randomly generated challenge word or random number back to the fixed network terminal.

Step 34: The fixed network terminal sends the challenge word to the authentication information processing module of the smart card processing module for the next authentication operation processing.

Step 35: The authentication information processing module sends the challenge word to the smart card after receiving the challenge word, and the smart card uses the challenge word and the internally stored authentication key, authentication algorithm, etc. to perform internal operations to obtain Corresponding authentication words and encryption keys, and And the encryption key are returned to the fixed network terminal; the authentication word is used to send to the management device to complete user authentication, and the encryption key can be used for data encryption during subsequent business communications.

Step 36: The fixed network terminal sends the authentication word to the management device, and the management device compares the authentication words calculated by using the same authentication algorithm and the authentication key according to itself, so as to implement user authentication and authentication. deal with.

Step 37: The authentication result is sent back to the fixed network terminal. The authentication result includes two types of authentication success and failure. For a user who has passed the authentication (that is, the authentication is successful), the fixed network terminal can be used to carry out corresponding services, such as voice. The terminal can then use the communication network to carry out voice services.

In the present invention, the user identification code and the authentication key in the smart card are unknowable to the user, so it can effectively ensure that the corresponding authentication information is not stolen or modified; moreover, the smart card rights can only be provided to The use of a certain user can effectively prevent the use of a single identity and multiple users, ensuring the interests of network operators and users; at the same time, only random numbers, authentication words, and encrypted data are transmitted on the public network, so During the transmission process, the user's authentication information is also impossible to be stolen.

Claims

Rights request

1. A user authentication device for a fixed network terminal, comprising: a smart card processing module: configured to store authentication information of a user of the fixed network terminal, and perform data according to the saved user authentication information and the authentication and authentication processing module. Interaction; Authentication and authentication processing module: Call the authentication information of the user of the fixed network terminal stored in the smart card processing module, and authenticate the fixed network terminal through data interaction with the smart card processing module and data interaction with the management device . The smart card processing module includes:

Authentication information processing submodule: It is used to send the user's authentication information in the smart card to the authentication and authentication processing module, and to the smart card to process the authentication information according to the information sent by the authentication and authentication processing module. The information is sent to the authentication and authentication processing module.

3. The user authentication device for a fixed network terminal according to claim 2, wherein the authentication information in the smart card is stored in a storage component, and the storage component is also used to provide value-added services. User application vector.

4. The user authentication device for a fixed network terminal according to claim 2, wherein the authentication information processing sub-module includes a CPU (Central Processing Unit) chip.

5. The user authentication device for a fixed network terminal according to claim 2, wherein the smart card and the authentication information processing sub-module are detachably movable connections. 6. The user authentication device for a fixed network terminal according to claim 1 or 2, wherein the smart card processing module is built in or external to the fixed network terminal device, and communicates with the fixed network terminal. The authentication and authentication processing modules in the device are connected.

7. A user authentication device for a fixed network terminal according to claim 6, characterized in that:

8. A user authentication method for a fixed network terminal based on the device according to claim 1, comprising:

A. The authentication and authentication processing module of the fixed network terminal obtains the user's authentication information from the smart card processing module, and sends the authentication information to the management device; returns the authentication and authentication processing module to the smart card processing module;

D. The management device performs user identity authentication according to the received authentication word, and returns the authentication result to the fixed network terminal. 9. The user authentication method for a fixed network terminal according to claim 8, wherein:

The authentication information includes a user identification code, an authentication key, and an authentication algorithm. The step A is: the authentication and authentication processing module of the fixed network terminal obtains the user identification code from the smart card processing module, and applies the The user identification code is sent to the management device. The step C is: the smart card processing module sends the received challenge word to the smart card, and the smart card uses the internally stored user's authentication key and authentication algorithm to perform arithmetic processing to generate corresponding Authentication word and return it to the management device. It is characterized in that the step C further includes:

The smart card generates an encryption key for encrypting business communication data and sends it to the fixed network terminal based on the challenge word received and the user's authentication information stored internally.