WO2007095806A1

WO2007095806A1 - A general authentication system and a method for accessing the network application facility of the system

Info

Publication number: WO2007095806A1
Application number: PCT/CN2006/003153
Authority: WO
Inventors: Yanmei Yang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-02-23
Filing date: 2006-11-23
Publication date: 2007-08-30
Also published as: CN100563159C; CN101026453A

Abstract

A general authentication system includes a raoming client, a general authentication entity in the roaming network and a network application facility. A method for accessing the network application facility of the said general authentication system enables the roaming client to have the GBA function. The home network of the roaming client doesn't support the general authentication architecture (GAA), but the roaming network supports the situation of GAA of the roaming network in which the roaming client locates. The method realizes that the roaming client performs the mutual authentication operation in the roaming network,thereby accessing the NAF service of the roaming network is implemented.

Description

Universal authentication system and method for accessing network service application in the system

The present invention relates to general authentication techniques, and more particularly to a universal authentication system and a method of accessing a network service application (NAF) in a roaming network. Background of the invention

In the third generation wireless communication standard, the universal authentication system, also known as the Common Authentication Framework (GAA), is a general structure used by various application service entities to complete the verification of user identity, applying a universal authentication framework. It can check and verify the identity of users of the application service. The foregoing multiple application services may be a multicast/broadcast service, a user certificate service, an information immediate service, or a proxy service.

FIG. 1 is a schematic structural diagram of a general authentication framework of the prior art. As shown in FIG. 1 , a universal authentication framework is generally performed by a user, a Bootstrapping Service Function (BSF) entity that performs initial authentication of a user identity, a Home Subscriber Server (HSS), and a network. Business Application (NAP) entity composition. Hereinafter, the BSF entity cartridge is referred to as a BSF, and the NAF entity is simply referred to as a NAF. The BSF is used to perform mutual authentication with the user, that is, mutually authenticate the identity, and simultaneously generate a shared key between the BSF and the user. This process is also called a Bootstrapping process or a GBA process, and the user who can implement the GBA process with the BSF has the GBA. User of the function; the HSS stores a profile file for describing user information, and the HSS also has the function of generating authentication information; NAF can represent different network service application entities, and when the user wants to implement a certain service, Accessing the NAF corresponding to the service and communicating with the NAP. The interface between the entities is as shown in Figure 1. The BSF and the NAF are connected through the Zn interface. The user connects to the BSF or NA through the user terminal (UE), and the UE and the BSF are connected through the Ub interface. The UE and the NAF are connected through the Ua interface.

If the user needs to use a certain service to access the NAF corresponding to the service, if the user knows that the service needs to be authenticated to the BSF for mutual authentication, the user directly performs the Bootstrapping process to the BSF through the UE; otherwise, the user first initiates the NAF corresponding to the service. The connection request, if the NAF supports the GAA function using the common authentication framework, and finds that the user who initiated the connection request has not yet authenticated to the BSF, the user initiating the connection request is notified to the BSF to perform the Bootstrapping process.

Then, the user performs mutual authentication by performing a Bootstrapping process between the UE and the BSF. After the Bootstrapping process is successfully completed, the UE and the BSF mutually authenticate the identity and generate a shared key Ks. The BSF defines an expiration date for the shared key Ks. (Key-lifetime) and assign a session transaction identifier (B-TID) to the user; the BSF and the UE respectively save the shared key Ks, B-TID and validity period. When the user wants to communicate with the NAF, the connection request is sent to the NAF, and the B-TID is carried in the request message, and the user calculates the derived key NAF specific key according to the shared key Ks by using a preset derivative algorithm.

After the NAF receives the connection request, if the NAF cannot query the B-TID locally, the NAF sends a request query message carrying its own identity and the B-TID to the BSF for query. If the BSF cannot query the B-TID locally, the NAF is notified that there is no information about the user. At this time, the NAF will notify the user to perform mutual authentication to the BSF. If the BSF queries the B-TID, the same as the user side is used. The derivative algorithm calculates the derived key of the shared key Ks, and then sends a success response message to the NAF, where the successful response carries the B-TID, the derived key corresponding to the B-TID, and the validity period of the shared key Ks. . After receiving the success response message of the BSF, the NAF considers that the user is a legitimate user who has passed the BSF authentication, and the NAF shares the derived key calculated by the shared key Ks, and the generated key is shared with the user. The key Ks is calculated to be consistent with the derived key. The user uses the derived key to protect the second in the subsequent access to NAJF. Communication between people.

When the user finds that the shared key Ks is about to expire, or the NAF requires the user to re-authenticate to the BSF, the user repeats the above mutual authentication step and then re-authenticates to the BSF to obtain a new shared key Ks and B-TID.

In the GAA described above, the process of the user accessing the NAF is applicable to the case where the NAF is located in the user's home network. For the case where the user accesses the NAF located in the roaming network, the prior art processing is: the BSF that performs mutual authentication with the user is also the BSF of the home network, and the NAF of the roaming network needs to pass through a D-proxy and the home network. The BSF is connected, and the derived key is obtained from the BSF of the home network, and then the derived key is used to communicate with the user. This situation is the case where both the home network and the roaming network support GAA.

However, if the home network where a GBA-enabled UE is located does not support GAA, and when the UE roams to a GAA-enabled roaming network, according to the currently provided universal authentication architecture and access to the NAF through the universal authentication architecture. In the method, the BSF that is mutually authenticated by the user is the BSF of the home network, and the home network to which the UE belongs does not support the GAA. Therefore, the UE cannot use the NAF service provided by the roaming network. Summary of the invention

In view of this, the main object of the present invention is to provide a universal authentication system that enables roaming users to access NAF services in a roaming network.

Another object of the present invention is to provide a method for accessing a network service application in the universal authentication system, so that a roaming user can access the NAF service in the roaming network.

In order to achieve the above object, the technical solution of the present invention is specifically implemented as follows:

A universal authentication system, the system includes: a roaming user, a roaming network service application V-NAF entity, and a universal authentication entity for implementing mutual authentication with the roaming user, where The roaming user initiates a mutual authentication request to the universal authentication entity; the universal authentication entity receives a mutual authentication request from the roaming user, obtains authentication information from the home network of the roaming user, and performs mutual authentication with the roaming user. ;

The roaming user uses the mutual authentication result to protect the communication between the roaming user and the V-NAJF entity. The system specifically includes:

Receiving, by the V-NAF entity, a connection request from a roaming user, notifying the roaming user to perform mutual authentication or querying the universal authentication entity for a derived key of the roaming user; receiving a derived secret from the universal authentication entity Key, and using the derived key to communicate with the roaming user;

The roaming user sends a connection request to the V-NA entity; if the V-NAF requires a GBA signing or receives a mutual authentication notification from the V-NAF entity, sending a mutual authentication request to the universal authentication entity, The universal authentication entity implements mutual authentication and generates a derivative key; and communicates with the V-NAF entity by using the generated derivative key;

The universal authentication entity receives the mutual authentication request from the roaming user, and obtains the mutual authentication between the universal authentication entity and the roaming user by connecting with the home network to which the roaming user belongs. The required authentication information, and mutual authentication with the roaming user; receiving a query request from the V-NAF entity, generating a derivative key and transmitting the key to the V-NAF.

The universal authentication entity is: a Bootstrapping service function V-BSF entity that performs initial user authentication verification in the roaming network.

The home network to which the roaming user belongs includes a subscription database as a home subscriber server HSS, and the V-BSF entity and the HSS are connected by using a Zh interface using a Diameter protocol;

Or the subscription database of the home network to which the user belongs is the home location register HLR, and the V-BSF entity is connected to the HLR through the Gr interface. Or other types of HLR/HSS external interfaces.

The home network to which the roaming user belongs includes an authentication proxy that authenticates the V-BSF entity, and the V-BSF entity is connected to the HSS through an authentication proxy;

The universal authentication entity includes: a serving GPRS support node SGSN located in the roaming network, and a Bootstrapping service function V-BSF entity performing user identity initial check verification.

The subscription database of the home network to which the roaming user belongs is an HSS/HLR, and the SGSN is connected to the HLR/HSS through a Gr interface, and the V-BSF entity and the SGSN are connected through a Zx interface.

The V-BSF entity is two or more. The universal authentication entity further includes: a B-agent B-pmxy for connecting all V-BSF entities and a home network to which the roaming user belongs.

Each V-BSF entity is connected to the B-proxy through a Zx interface;

The subscription database of the home network to which the roaming user belongs is an HSS, and the B-proxy and the HSS are connected through an interface of Zh; or the subscription database of the home network to which the user belongs is an HLR, and the B-proxy and the HLR are Connected via the Gr interface.

The B-proxy is an independent entity or a functional module of any V-BSF entity in all V-BSF entities.

The V-BSF entity is two or more, and one V-BSF entity in all V-BSF entities is a main V-BSF entity;

The primary V-BSF entity includes a B-proxy B-proxy for connecting the V-BSF entity to the home network to which the roaming user belongs.

The primary V-BSF is connected to the remaining V-BSF through a Zx interface;

The subscription database of the home network to which the user belongs is an HSS, and the B-proxy and the HSS are connected through an interface of Zh; or the subscription database of the home network to which the user belongs is an HLR. The B-proxy and the HLR are connected by a Gr interface.

The V-BSF entity is connected to the V-NAF entity through a Zn interface, and the roaming user is connected to the V-BSF entity through a Ub interface and to the V-NAF entity through a Ua interface.

A method for accessing a network service application NAF entity in a universal authentication system, the universal authentication system comprising: a roaming user, a roaming network service application V-NAF entity, and a mutual authentication and a V- The NAF entity provides a generic authentication entity that derives the key, and the method includes the following steps:

A. The roaming user initiates a mutual authentication request to the universal authentication entity;

The universal authentication entity obtains the authentication information from the subscription database of the home network to which the roaming user belongs according to the user information carried in the mutual authentication request;

After the universal authentication entity and the roaming user perform mutual authentication according to the authentication information, the roaming user accesses the network service application V-NAF.

Before the roaming user initiates the mutual authentication request to the universal authentication entity in step A, the method further includes:

And obtaining, by the roaming user, a mutual authentication address of the universal authentication entity by using the mobile country code and the mobile network code of the roaming network that are known;

Or the roaming user carries a flag indicating that the roaming user is a roaming user in the connection request sent to the V-NAF entity, and the V-NAF entity learns that the current user is a roaming user and determines that the roaming user does not perform mutual authentication. The mutual authentication address of the universal authentication entity in the roaming network is carried in the GBA indication and returned to the roaming user.

The universal authentication entity is a V-BSF, and the step C specifically includes:

C. The roaming user and the V-BSF entity mutually authenticate the identity and generate a shared key Ks, the V-BSF entity defines an expiration date for the shared key Ks and allocates a B-TID, the V-BSF The entity and the roaming user respectively have the shared key Ks, B-TID and Save the validity period;

C2. The roaming user carries the B-TID to the V-NAF entity, and the roaming user calculates the derivative key according to the shared key Ks by using a preset derivative algorithm;

C3. The V-NAF entity, according to the receiving the connection request, if the B-TID cannot be queried locally, the self-identification and the B-TID are carried in the request query message and sent to the V- BSF entity;

C4. If the V-BSF entity queries the B-TID, and uses the same derivative algorithm as the user side to calculate the derived key of the shared key Ks, and the generated B-TID, and the generated derived key And being carried in the success response message and sent to the V-NAF entity, where the roaming user and the V-NAF entity use the derived key to communicate.

In step C4, if the V-BSF entity cannot query the B-TID locally, the V-BSF entity notifies the V-NAF entity that the information of the roaming user is not queried; The NAF entity notifies the roaming user to return to step A again.

In step C3, if the V-BSF entity is two or more, the V-NAF entity sends a request query message carrying its own identifier and the B-TID to all V-BSF entities for query.

The subscription database of the home network to which the roaming user belongs is an HSS/HLR.

The method further includes:

When the roaming user leaves the roaming network, the UE deletes the shared key Ks, the derived key, and the B-TID assigned to the roaming user.

The method further includes:

The roaming user moves to another roaming network, and if the NAF entity in another roaming network requests the roaming network for the secure communication information of the roaming user, the V-BSF entity in the roaming network refuses to The derived key of the roaming user is returned to another roaming network The NAF entity in .

After the home network receives the request from the roaming network in step B, the method further includes:

Certification of many multi-family V-BSFs;

The authentication is done by the home network HLR/HSS or by a specially configured authentication agent.

As can be seen from the above technical solutions, the universal authentication system of the present invention includes a roaming user, a universal authentication entity located in the roaming network for implementing mutual authentication with the roaming user and providing a derived key to the V-NAF, and a network service application. The method for accessing the network service application in the universal authentication system has the GBA function for the roaming user, and the home network to which the roaming user belongs does not support the GAA. When the roaming user is in the roaming network supporting the GAA, the method is implemented. The roaming user completes the mutual authentication process in the roaming network, thereby realizing access to the NAF service in the roaming network. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic structural diagram of a prior art universal authentication framework;

2 is a schematic structural diagram of a universal authentication system of the present invention;

3a is a schematic structural diagram of Embodiment 1 of a universal authentication entity of the present invention;

Figure 3b is a schematic structural diagram of Embodiment 2 of the universal authentication entity of the present invention;

4a is a schematic structural diagram of Embodiment 1 of a general authentication entity when multiple BSFs exist in a roaming network according to the present invention;

4b is a schematic structural diagram of Embodiment 2 of a general authentication entity when multiple BSFs exist in a roaming network according to the present invention;

Figure 5 is a flow chart of a method for accessing NAF of the present invention;

6 is a flowchart of Embodiment 1 of the present invention for accessing a NAF; FIG. 7 is a flowchart of Embodiment 2 of the present invention for accessing a NAF. Mode for carrying out the invention

The core idea of the present invention is: in a general authentication system consisting of a roaming user, a universal authentication entity located in a roaming network, and a roaming network service application, after the roaming user receives the mutual authentication notification from the network service application, The universal authentication entity in the roaming network initiates a mutual authentication request; the universal authentication entity obtains the authentication information from the subscription database of the home network to which the roaming user belongs according to the user information carried in the mutual authentication request; The authentication entity and the user perform mutual authentication according to the obtained authentication information and generate a derivative key, and the roaming user accesses the network service application by using the derivative key.

The present invention will be further described in detail below with reference to the accompanying drawings and preferred embodiments.

The present invention is particularly applicable to a roaming user having a GBA function, the home network to which the roaming user belongs does not support GAA, and the roaming network in which the roaming user is located supports GAA; and the roaming network and the home network have signed a corresponding service agreement to enable attribution. The network opens an interface for the roaming network to implement the mutual authentication process, so that the roaming network can access the home network through the relevant interface and obtain the required authentication data from the home network.

2 is a schematic structural diagram of a universal authentication system of the present invention. As shown in FIG. 2, the universal fattening system of the present invention includes a roaming user, a universal authentication entity located in a roaming network, and a roaming NAF (V-NAF), each entity The interface between the common authentication entity and the NAF is connected through the Zn interface. The universal authentication entity is connected to the subscription database in the home network of the roaming user through the relevant interface. For details, see Figure 3a and Figure 3b. The description of FIG. 4a and FIG. 4b; the roaming user is connected to the universal answering entity and the V-NAF through the UE, the UE and the universal authentication entity are connected through the Ub interface, and the V-NAF is connected through the Ua interface.

Among them, V-NAF can represent different network business application entities, users need to achieve some kind of In the case of a service, the NAF corresponding to the service must be accessed and communicated with the NAF. The V-NAF receives the connection request from the user, and if it is determined that the user does not perform mutual authentication, notifies the user to perform mutual authentication; if it is determined that the user has performed mutual authentication and is a roaming user, the general authentication entity is queried to the roaming user. Deriving a key; receiving a derived key from the universal authentication entity, and using the derived key to communicate with the roaming user to implement the service requested by the roaming user;

The roaming user sends a connection request to the V-NAF to request to implement the service; receives the mutual authentication notification from the V-NAF, sends a mutual authentication request to the universal authentication entity, implements mutual authentication with the universal authentication entity, and generates a derivative key; Communicating with the V-NAF by using the generated derivative key to implement the service requested by the roaming user;

The universal authentication entity receives the mutual authentication request from the roaming user, and obtains the authentication information required for the mutual authentication between the universal authentication entity and the roaming user through the connection with the subscription database of the home network to which the roaming user belongs, and implements the authentication information. Mutual authentication of the roaming user; receiving the query request from the V-NAF, generating the derived key and providing it to the V-NAF. The functions of the universal authentication entity include: implementing mutual authentication with the roaming user and providing derivative to the V-NAF Key. The authentication information includes user subscription data identifying the service of the user subscription application, and an authentication vector identifying the identity of the user.

Figures 3a and 3b are implementations of two general-purpose rights-enhancing entities, which are described in detail below. Figure 3a is a schematic structural diagram of Embodiment 1 of the universal authentication entity of the present invention. As shown in Figure 3a, the universal authentication entity includes a BSF in the roaming network, that is, a roaming BSF (V-BSF), and if the authentication information of the roaming user is stored in In the home network HSS (including the case where the HLR is upgraded to the HSS), the V-BSF can obtain the authentication information of the roaming user from the HSS by using the Diameter protocol through the Zh interface, and the subscription database is the HSS; The authentication information is stored in the home location register (HLR) of the home network (the HLR has not been upgraded to the HSS), and the V-BSF can obtain the authentication of the roaming user from the HLR through the Gr interface. Information, at this point the contract database is the HLR. The interface between the universal authentication entity and the other entities of the universal authentication system is as follows: V-BSF and V-NAF are connected through the Zn interface, roaming users are connected to the V-BSF through the Ub interface, and through the Ua interface. V-NAF connection.

In the universal authentication entity shown in FIG. 3a, the V-BSF receives the mutual authentication request from the roaming user, and obtains the mutual authentication entity and the roaming user for mutual authentication by connecting with the subscription database of the home network to which the roaming user belongs. Authentication information, and mutual authentication with the roaming user; receiving a query request from the V-NAF, generating a derivative key and providing it to the V-NAF.

FIG. 3b is a schematic structural diagram of Embodiment 2 of the universal authentication entity of the present invention. As shown in FIG. 3b, the universal authentication entity includes a Serving GPRS Support Node (SGSN) and a V-BSF in a roaming network, and an SGSN in the roaming network. The HL/HSS of the home network is connected through the Gr interface, and the V-BSF and the SGSN are connected through the Zx interface. When the V-BSF needs to obtain the user's authentication information, the SGSN accesses the HLR/HSS of the home network to obtain the authentication information and the GPRS subscription information. The subscription database is the HLR/HSS. The interface between the universal authentication entity shown in Figure 3b and other entities of the universal authentication system is: The V-BSF and the V-NAF in the universal authentication entity are connected through the Zn interface, and the roaming user passes the Ub interface and the V-BSF. Connect, connect to V-NAF through Ua interface.

In the universal authentication entity shown in Figure 3b, the V-BSF receives the mutual authentication request from the roaming user, connects the SGSN with the subscription database of the home network to which the roaming user belongs, and obtains the mutual authentication entity and the roaming user for mutual authentication. The required authentication information, the V-BSF implements mutual authentication with the roaming user; the V-BSF receives the query request from the V-NAF, generates a birth key and provides it to the V-NAF.

It should be noted that, in the present invention, the V-BSF can also obtain the user's GUSS data from the HLR/HSS: if the user's home network register is the HLR, the HLR outputs the GUSS to the BSF by outputting the GPRS subscription data to the SGSN. Or GUSS as part of the GPRS subscription data, sent along with the GPRS subscription data output by the HLR to the BSF To the BSF; if the user's home network register is an HSS, the HSS can obtain authentication and GUSS data from the user's HSS via the Zn interface protocol in an existing manner.

In a roaming network, if there are multiple BSFs, all BSFs may authenticate roaming users, or only one or several BSFs may be used to authenticate roaming users, and the remaining BSFs may only authenticate local users. The BSF of the authentication roaming user and the BSF of the authentication local user can be distinguished by using different domain names. For example, the domain name of the BSF used for authenticating the local user can be set to: BSF bsf.mnc<MNC>.mcc<MCC> .3gppnetwork.org, the domain name of the BSF used to authenticate roaming users can be set to VBSF bsf.mnc<MNC>.mcc<MCC>.3 gppnetwork.org , where <MNC> is filled with mobile network code (MNC) ), <MCC> is filled with the Mobile Country Code (MCC). If the BSF can be used both for authenticating local users and for authenticating roaming users, then the above two domain names can be set for the BSF.

Whether all BSFs can authenticate roaming users, or only one or several BSFs are used to authenticate roaming users, as long as there are two or more BSFs for authenticating roaming users in the roaming network, The BSF is enabled to access the subscription database of the home network through a unified interface. The present invention is implemented by setting a B-proxy (B-proxy) for connecting the V-BSF to the unified interface of the home network of the roaming user. The B-proxy may be a functional module in a BSF in the BSF for authenticating the roaming user, or may be a separate entity. Of course, if the subscription database in the home network supports connection with multiple BSFs, and each BSF for authenticating roaming users is separately connected to the subscription database in the home network, then B-proxy may not be needed. '

FIG. 4 is a schematic structural diagram of Embodiment 1 of a general authentication entity when multiple BSFs exist in a roaming network according to the present invention. As shown in FIG. 4a, there are n V-BSFs for authenticating roaming users in the roaming network. That is, V-BSF1 ~ V-BSFn, n is a positive integer greater than 1. V-BSF1 ~ V-BSFn are connected to V-NAF through Zn interface, respectively, through Zx interface and B-proxy Connected; B-proxy is connected to the subscription database in the home network through Gr/Zh, so that V-BSF1 ~ V-BSFn accesses the subscription database of the home network through a unified Gr/Zh interface; each V-BSF Both provide an Ub interface connected to the roaming user, and the roaming user connects to the V-NAF through the Ua interface.

FIG. 4b is a schematic structural diagram of Embodiment 2 of a universal authentication entity when multiple BSFs exist in a roaming network according to the present invention. As shown in FIG. 4b, there are n V-BSFs for authenticating roaming users in the supporting roaming network. V-BSF1 ~ V-BSFn, where n is a positive integer greater than one. V-BSF1 is the primary V-BSF with B-proxy function at the same time. The primary V-BSF has two domain names, one is the domain name of B-proxy, and the other is the domain name of V-BSF, which can be implemented by pre-setting. V-BSF2 ~ V-BSFn are connected to the V-NAF through the Zn interface, respectively, and connected to the main V-BSF through the Zx interface; the B-proxy in the main V-BSF passes the Gr/Zh, the interface and the subscription database in the home network. Connected, in this way, V-BSF1 ~ V-BSFn access the subscription database of the home network through a unified Gr/Zh interface; each V-BSF provides an Ub interface connected with the roaming user, and the roaming user passes the Ua interface and the V -NAF is connected.

In addition to accessing the V-BSF and the home network subscription database through the interfaces of Figures 3a and 3b, other types of HLR/HSS external interfaces such as the Sh interface can also be accessed. At the same time, before the home network provides data to the V-BSF, the V-BSF can be further authenticated. The authentication can be implemented by the HLR/HSS itself, or an authentication proxy can be set up between the V-BSF and the HLR/HSS for authentication.

The structural composition of the universal authentication system of the present invention is described above. Referring to FIG. 2 and FIG. 5, the method for accessing the NAF in the universal authentication system is further described. FIG. 5 is a flowchart of the method for accessing the NAF according to the present invention. In a general authentication system consisting of a roaming user, a universal authentication entity located in a roaming network, and a network service application, it is assumed that the home network to which the roaming user belongs does not support GAA, and the roaming network in which the roaming user is located supports GAA. The method of the invention comprises the following steps: Step 500: After the roaming user receives the mutual authentication notification from the network service application, since the roaming user home network does not support the GAA, the roaming user initiates the mutual authentication request by using the universal authentication entity of the universal authentication system in the roaming network. .

In accordance with the prior art, the roaming user requests to implement the service by sending a connection request to the V-NAF. If the V-NAF finds that the roaming user that initiated the connection request does not perform mutual authentication, the robin user may issue a GB A indication to the roaming user. The roaming user is notified to perform the mutual authentication process, that is, the Bootstrapping process.

In the present invention, since the home network of the roaming user does not support the GAA, according to the pre-signed service agreement between the roaming network and the home network, the roaming user performs mutual authentication through the universal authentication entity of the universal authentication system in the roaming network.

When the roaming user moves to the roaming network, the mobile country code and the mobile network code of the network are known to the roaming user. The specific implementation method is well known to those skilled in the art, and details are not described herein. In the present invention, the roaming user only needs to add the VBSF prefix to the MCC code and the MNC code of the roaming network according to the domain name of the V-BSF used for authenticating the roaming user.

The 3gppnetwork.org suffix gives the address of the V-BSF, the mutual authentication address of the universal authentication entity.

In addition, the roaming user can carry the identifier in the connection request to indicate that the current user is a roaming user, so that the NAF knows that the current user is a roaming user, so that the NAF in the GBA indication will be the general authentication entity in the universal authentication system in the roaming network. The mutual authentication address returns to the roaming user.

Step 501: The universal authentication entity obtains the authentication information from the subscription database of the home network to which the roaming user belongs according to the user information carried in the mutual authentication request.

After receiving the authentication request of the roaming user, the V-BSF determines the user information, such as the identity identifier, carried in the authentication request. If the identity identifier does not belong to the network, the identity identifier determines the home network subscription database of the user requesting the authentication. Such as the address of HSS/HLR, and pass The Zh/Gr interface obtains the authentication information of the roaming user from the home network subscription database. Step 502: The universal authentication entity performs mutual authentication with the user according to the authentication information, and generates a derivative key, and the roaming user uses the derived key to access a network service application in the current roaming network.

The roaming user performs mutual authentication by performing a Bootstrapping process with the V-BSF corresponding to the mutual authentication address. After the Bootstrapping process is successfully completed, the UE and the V-BSF mutually authenticate the identity and generate a shared key Ks. The V-BSF is the same. The shared key Ks defines an expiration date and assigns a B-TID to the roaming user; the V-BSF and the UE respectively store the shared key Ks, the B-TID and the validity period. When the roaming user wants to communicate with the V-NAF, the connection request is re-issued to the V-NAF, and the B-TID is carried in the request message, and the roaming user calculates the derived key according to the shared key Ks by using a preset derivative algorithm.

In addition, in order to distinguish between roaming users and local users, the types of B-TIDs of the two types of users can be distinguished. For example, the B-TID assigned to the local user can be similar to base64encode(RAND)@B SF_servers_domain_name and assigned to roaming users. The B-TID can be indicated by adding a string, such as base64encode(RAND)- Visited@BSF_servers_domain_ name in the "- Visited" string to identify the user as a roaming user.

After the V-NAF receives the connection request, if the V-NAF cannot query the B-TID locally, the V-BSF sends a request query message carrying the self-identity and the B-TID to the V-BSF for querying. A plurality of V-BSFs in the roaming network can authenticate the roaming user. Then, the V-NAF can send a request query message carrying the self identifier and the B-TID to all V-BSFs that can authenticate the roaming user. Inquire. If the V-BSF cannot locally query the B-TID, the V-NAF is notified that the V-NAF does not have the information of the roaming user. At this time, the V-NAF notifies the roaming user to perform mutual authentication, that is, returns to step 500 to re-execute the method flow; If the V-BSF queries the B-TID, the shared algorithm is calculated using the same derivative algorithm as the user side. The derived key of the key Ks is then sent to the V-NAF with a success response message carrying the B-TID, the derived key corresponding to the B-TID, and the validity period of the shared key Ks. After receiving the success response message from the V-BSF, the V-NAF considers that the roaming user is a legitimate user who has performed mutual authentication, and the V-NAF shares the derived key calculated by the shared key Ks. The derivative key is consistent with the roaming user calculating the derived key according to the shared key Ks. The user uses the derived key to protect communication between the two in subsequent access V-NAF.

In addition, in order to ensure that the user does not use the shared communication key, such as the shared key Ks, the generated derived key, and the B-TID, which are currently allocated in the roaming network, to access the NAF in another roaming network, in order to describe Conveniently, the current roaming network is referred to as a first roaming network, and the other roaming network is referred to as a second roaming network. The method of the present invention may further include: when the user leaves the first roaming network, the UE deletes the shared key Ks allocated by the V-BSF in the first roaming network to the user, the generated "generated key" and the B-TID; Of course, if the NAF of the second roaming network requests the first roaming network for the secure communication information of the user, the V-BSF of the first roaming network does not return the secure communication information such as the derived key of the user to the NAF. .

The implementation process of the method of the present invention is specifically described below with reference to the embodiments. FIG. 6 is a flowchart of Embodiment 1 of the present invention for accessing NAF. Referring to FIG. 3a, the general authentication entity in Embodiment 1 is composed of V-BSF. It is assumed that the roaming user does not perform mutual authentication before the UE sends the first connection request to the V-NAF. The embodiment specifically includes the following steps:

Steps 600 to 601: After the V-NAF in the roaming network receives the connection request sent by the roaming user through the UE, the V-NAF finds that the UE has not performed mutual authentication, and sends a GBA indication to the UE to notify the UE to perform The mutual authentication process is the Bootstrapping process. The specific implementation of this step is completely consistent with the prior art, and details are not described herein again.

Step 602 to step 604: The UE sends an authentication request carrying the user information to the V-BSF in the roaming network, and the V-BSF determines the home network subscription database address to which the UE belongs according to the user information, and obtains the UE from the user subscription database. Authentication information.

In this step, it is assumed that the roaming user has learned the MCC code and the MNC code of the roaming network, and according to the domain name of the V-BSF used for authenticating the roaming user, the MCC code and the MNC code of the roaming network are added with the VBSF prefix and "3gppnetwork. The org" suffix.

Step 605 - Step 606: The mutual authentication and key agreement process between the UE and the V-BSF is a mutual authentication process, and the UE and the V-BSF mutually authenticate the identity and generate a shared key Ks, where the V-BSF is The shared key Ks defines an expiration date and allocates a B-TID to the roaming user; the V-BSF and the UE respectively store the shared key Ks, B-TID and the validity period; the UE adopts a preset derivation algorithm according to the shared key Ks. Calculate the derived key and save it.

If you need to distinguish between local users and roaming users, the types of the two user B-TIDs can also be distinguished. For example, the B-TID assigned to the local user can be similar to base64encode(RAND)@BSF_server_domain_name, and the B-TID for the roaming user can be indicated by adding a string, such as base64encode(RAND) The "- Visited" string is added to the Visited@BSF_servers-domain-name to identify the user as a roaming user.

Step 607 - Step 609: The UE carries the obtained B-TID in the connection request, and initiates a service request to the V-NAF. The V-NAF sends the V-NAF ID and the B-TID to the V-BSF. Requesting a query message to query the derived key of the UE; the V-BSF queries the B-TID carried in the message according to the request, and if there is a shared key Ks stored in association with the B-TID, according to the shared key Ks, The derived derivative algorithm is calculated by the same preset derivative algorithm as the user side.

In this step, if the shared key Ks stored in association with the B-TID does not exist in the V-BSF, Then, the V-NAF is notified that there is no authentication information of the UE.

In addition, in this step, if the V-NAF cannot locally query the B-TID, the V-NAJF initiates a request query message to the V-BSF. Otherwise, the request query message may be omitted, which is consistent with the prior art.

Step 610 to step 611: The V-BSF carries the generated derivative key, the B-TID, and the validity period stored in association with the B-TID in the request query response message, and returns it to the V-NAF. The derived key is obtained for secure communication.

FIG. 7 is a flowchart of Embodiment 2 of the present invention for accessing NAF. Referring to FIG. 3b, the general authentication entity in Embodiment 2 is composed of V-BSF and SGSN, compared with Embodiment 1 shown in FIG. There are two different processes. One is that the UE acquires the mutual authentication address in the universal authentication system differently; the other is that the composition of the general authentication entity in the universal authentication system is different. It is assumed that the roaming user has not performed mutual authentication before the first connection request is sent to the V-NAF by the UE. The embodiment specifically includes the following steps:

Step 700 - Step 701: After the V-NAF in the roaming network receives the connection request sent by the roaming user through the UE, the V-NAF finds that the UE has not performed mutual authentication, and sends a GBA indication to the UE to notify the UE to perform The mutual authentication process is the Bootstrapping process.

In this step, it is assumed that the UE carries a flag indicating that the user is a roaming user in the connection request. Therefore, after the NAF learns that the UE is a roaming user, the mutual authentication address of the universal authentication entity in the universal authentication system is carried in the UE. Returned to the UE in the GBA indication.

Step 702: Step 704: The UE sends an authentication request carrying the user information to the V-BSF corresponding to the obtained mutual authentication address, and the V-BSF determines the user subscription database address of the home network to which the UE belongs according to the user information, and signs the subscription from the user through the SGSN. The authentication information of the UE is obtained in the database.

The specific implementation of the steps 705 to 711 is the same as the steps 605 to 611 in the first embodiment, and will not be repeated here. The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included. It is within the scope of the present invention.

Claims

Claim

A universal authentication system, the system comprising: a roaming user, a roaming network service application V-NAF entity, and a universal authentication entity for implementing mutual authentication with the roaming user, where

The roaming user initiates a mutual authentication request to the universal authentication entity;

Receiving, by the universal authentication entity, a mutual authentication request from the roaming user, obtaining authentication information from the home network of the roaming user, and performing mutual authentication with the roaming user;

The roaming user uses the mutual authentication result to protect the communication between the roaming user and the V-NAF entity.

2. The system according to claim 1, wherein the system specifically comprises: the V-NAF entity receiving a connection request from a roaming user, notifying the roaming user of mutual authentication or authenticating to the universal authentication Entity querying a derived key of the roaming user; receiving a derived key from the universal authentication entity, and using the derived key to communicate with the roaming user;

Sending, by the roaming user, a connection request to the V-NAF entity; if the V-NAF requires a GBA signing or receiving a mutual authentication notification from the V-NAF entity, sending a mutual authentication request to the universal authentication entity, The universal authentication entity implements mutual authentication and generates a derived key; communicates with the V-NAF entity by using the generated dirty key;

The system according to claim 2, wherein the universal authentication entity is: Bootstrapping for performing initial identity verification of a user identity in the roaming network Service function V-BSF entity.

The system according to claim 3, wherein the home network to which the roaming user belongs includes a subscription database as a home subscriber server HSS, and the V-BSF entity and the HSS are connected by using a Diameter protocol through a Zh interface;

Or the subscription database of the home network to which the user belongs is the home location register HLR, and the V-BSF entity is connected to the HLR through the Gr interface.

Or other types of HLR/HSS external interfaces.

The system according to claim 3, wherein the home network to which the roaming user belongs includes a subscription database as a home subscriber server HSS, an authentication proxy that authenticates the V-BSF entity, and the V-BSF entity Connected to the HSS through an authentication agent;

The system according to claim 2, wherein the universal authentication entity comprises: a serving GPRS support node SGSN located in the roaming network, and a Bootstrapping service function V-BSF for performing initial identity verification of a user identity entity.

The system according to claim 6, wherein the subscription database of the home network to which the roaming user belongs is an HSS/HLR, and the SGSN and the HLR/HSS are connected by a Gr interface, the V-BSF The entity is connected to the SGSN through a Zx interface.

The system according to claim 3, wherein the V-BSF entity is two or more, and the universal authentication entity further includes: used to connect all V-BSF entities and roaming users B-proxy B-proxy of the home network.

The system according to claim 8, wherein each of the V-BSF entities and the B-proxy are connected through a Zx interface;

10. The system of claim 8 wherein the B-proxy is independent An entity, or a functional module in any of the V-BSF entities.

The system according to claim 3, wherein the V-BSF entity is two or more, and one V-BSF entity is designated as a main V-BSF entity among all V-BSF entities;

The system according to claim 11, wherein the primary V-BSF and the remaining V-BSF are connected by a Zx interface;

The subscription database of the home network to which the user belongs is an HSS, and the B-proxy and the HSS are connected through an interface of Zh; or the subscription database of the home network to which the user belongs is an HLR, and the B-proxy and the HLR pass through Gr interface connection.

The system according to claim 4, 7, 9 or 12, wherein the V-BSF entity is connected to the V-NAF entity through a Zn interface, and the roaming user passes the Ub interface with the V - The BSF entity is connected to the V-NAF entity via a Ua interface.

14. A method for accessing a network service application NAF entity in a universal authentication system, the universal authentication system comprising: a roaming user, a V-NAF entity for roaming network service, and a mutual authentication and roaming user A universal authentication entity that provides a derived key to a V-NAF entity, the method comprising the steps of:

The method according to claim 14, wherein before the roaming user initiates a mutual authentication request to the universal authentication entity, the method further includes: Obtaining, by the roaming user, a mutual authentication address of the universal authentication entity by using the mobile country code and the mobile network code of the roaming network that are known;

The method according to claim 14, wherein the universal authentication entity is a V-BSF, and the step C specifically includes:

C1. The roaming user and the V-BSF entity mutually authenticate each other and generate a shared key Ks, and the V-BSF entity defines an expiration date for the shared key Ks and allocates a B-TID, the V-BSF entity And the roaming user separately saves the shared key Ks, B-TID and the validity period;

The roaming user carries the B-TID in the connection request and sends the connection request to the V-NAF entity, and the roaming user calculates the derivative key according to the shared key Ks by using a preset derivative algorithm;

C3. The V-NAJF entity, if it is unable to locally query the B-TID according to the receiving connection request, carries the self identifier and the B-TID in the request query message and sends the message to the V- BSF entity;

The method according to claim 16, wherein: in step C4, if the V-BSF entity cannot locally query the B-TID, the V-BSF entity notifies the V-NAF The entity does not query the information of the roaming user; the V-NAF entity notification The roaming user returns to perform step A again.

18. The method according to claim 16, wherein: according to C3, if the V-BSF entity is two or more, the V-NAF entity is to all V-BSF entities. Sending a request query message carrying its own identity and the B-TID for querying.

The method according to claim 14, wherein the subscription database of the home network to which the roaming user belongs is an HSS/HLR.

20. The method of claim 14, wherein the method further comprises:

21. The method of claim 14, wherein the method further comprises:

The roaming user moves to another roaming network, and if the NAF entity in another roaming network requests the roaming network for the secure communication information of the roaming user, the V-BSF entity in the roaming network refuses to The derived key of the roaming user is returned to the NAF entity in the other roaming network.

The method according to claim 14, wherein after the home network in step B receives the request from the roaming network, the method further includes:

Certification of many multi-family V-BSFs;