WO2010000185A1 - 一种网络认证的方法、装置、系统及服务器 - Google Patents

一种网络认证的方法、装置、系统及服务器 Download PDF

Info

Publication number
WO2010000185A1
WO2010000185A1 PCT/CN2009/072447 CN2009072447W WO2010000185A1 WO 2010000185 A1 WO2010000185 A1 WO 2010000185A1 CN 2009072447 W CN2009072447 W CN 2009072447W WO 2010000185 A1 WO2010000185 A1 WO 2010000185A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
user
function entity
security domain
management function
Prior art date
Application number
PCT/CN2009/072447
Other languages
English (en)
French (fr)
Inventor
宫小玉
李洪广
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP09771955A priority Critical patent/EP2293611A4/en
Publication of WO2010000185A1 publication Critical patent/WO2010000185A1/zh
Priority to US12/962,352 priority patent/US20110078442A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/061—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information

Definitions

  • the present invention relates to a network technology in the field of communications, and in particular to a method, device, system and server for network authentication.
  • NGN Network, NGN emphasizes the convergence of fixed and mobile networks. Based on this converged network, when users switch to new network attachment points, security authentication is required from a security perspective. After the user passes the security authentication, the user can be accepted by the network. At the same time, a subkey is established between the user and the network to protect the information exchange between the subsequent user and the network. Therefore, when users move between different network attachment points, it provides users with a better business experience, and seamless switching between fast and low latency is very necessary.
  • Network Attachment Control Network Attachment Control
  • NACF Network Access Functions
  • Similar network attachment functions such as NASS are implemented, and mobile authentication uses separate authentication function entities. to realise.
  • mobile users solve network access authentication and mobile authentication simultaneously through a single authentication system. Once the user is authenticated, the network access authentication and mobile authentication are considered to pass, and the user can access the network and move between networks. Since the user's authentication in the target switching network is also a network access authentication during the mobile process, there is a certain internal correlation between the two, so the method based on the fusion authentication is more acceptable.
  • the above authentication process requires multiple interactions between the authenticator and the network-side authentication function entity. Especially in mobile scenarios, users need to switch between the same or even heterogeneous access networks. If a complex and complete authentication process is required each time, users will be very embarrassed and safe to switch between domains and domains. Poor performance leads to packet loss of the user's business and even temporarily interrupts the service, affecting the user's experience.
  • the main purpose of the embodiments of the present invention is to provide a method, a device, a system, and a server for network authentication, which are used to solve the problem that a user switches between domains and domains, which is long-consuming and has poor security.
  • a network authentication method comprising: when a user attaches from a first access management function entity to
  • the second access management function entity includes: receiving a user authentication request forwarded by the second access management function entity; obtaining the second access management function entity according to the user authentication request The authentication key of the security domain; the user is authenticated according to the authentication key of the security domain of the second access management function entity.
  • a network authentication system comprising: an access management function entity, a transport layer authentication function entity proxy; the access management function entity, configured to perform information interaction with a transport layer authentication function entity proxy, and send a user authentication request to a transport layer authentication function entity proxy; the transport layer authentication function entity proxy, configured to obtain an authentication key of the security domain attached to the user according to the user authentication request; and according to the authentication key of the security domain attached by the user, The user authenticates.
  • a transport layer authentication function entity proxy device comprising: a storage unit, configured to store an authentication key of a security domain of the access management function entity; a processing unit, configured to use the authentication key stored by the storage unit Deriving a key to the information exchange between other access management function entities and users of the security domain, and The derived key is sent to the authentication unit; the authentication unit is configured to authenticate the user according to the derived key sent by the processing unit.
  • a network authentication server comprising: a request receiving unit, configured to receive a user authentication request; a request response unit, configured to respond to the user authentication request, and send response information to the transport layer authentication function entity agent, the response
  • the information includes the authentication result attached by the user, the root authentication key attached by the user, and the authentication key of the security domain to which the access management function entity belongs.
  • the authentication key of the security domain is attached by the user to the root key information and the security domain. Identification ID, domain name information derived.
  • the embodiments of the present invention can solve the problem that the user switches between the intra-domain and the inter-domain in the prior art, which is time-consuming and insecure, resulting in packet loss of the user service or even temporarily interrupting the service, and realizing the user in the domain or
  • the security authentication of inter-domain mobility improves the security and reliability of user authentication.
  • FIG. 1-1 is a schematic diagram of networking of a cross-security domain according to an embodiment of the present invention.
  • Figure 1-2 is a schematic diagram of networking in a security domain according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a network authentication method across a security domain according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a network authentication method in a security domain according to an embodiment of the present invention
  • FIG. 4 is a structural diagram of a network authentication system according to an embodiment of the present invention.
  • FIG. 5 is a structural diagram of a proxy device for a transport layer authentication function according to an embodiment of the present invention.
  • FIG. 6 is a structural diagram of a network authentication server according to an embodiment of the present invention.
  • the embodiment of the present invention provides a network authentication method, when a user attaches from an access management function entity to a second access management function entity, and receives a user authentication request forwarded by the second access management function entity. Obtaining an authentication key of the security domain of the second access management function entity according to the user authentication request; and authenticating the user according to the authentication key of the security domain of the second access management function entity.
  • the authentication request is specifically: the first authentication of the user accessing the security domain and the re-authentication of the user in the security domain; the authentication key of the security domain of the second access management function entity is specifically according to the first access management. Whether the functional entity and the second access management function entity belong to the same security domain are different.
  • the application scenario of the embodiment of the present invention is that the user's service is contracted to the home network (Home)
  • the user's mobile service related information is stored in the home network, and when the user roams to the Visited Network, the intra-domain handover and the inter-domain (ie, inter-domain) handover are performed at the visited place.
  • the mobile service related information is configuration information, a shared key (ie, a original session negotiation key), and a mobile service configuration parameter.
  • the security domain also referred to as an "access management domain" of the visited network is divided according to a domain consisting of a unique set of management entities, and the management entity group includes a Mobility Management Control Function (Mobility Management Control Functions).
  • MMCF MMCF
  • TAA-FE Transport Authentication Funneling Entity
  • Access Management Functional Entity Access Management Functional
  • FIG. 2 a cross-security domain networking diagram is introduced.
  • FIG. 2 a flow chart of a cross-security domain network authentication method in the embodiment of the present invention is specifically introduced.
  • FIG. 1-1 is a schematic diagram of networking of the user 10 from the first security domain 20 to the second security domain 30.
  • AM-FE 1 Access Management Function Entity 3002 (AM-FE3) moving to the second security domain 30, Transport Layer Authentication Authorization Function Entity Agent 3006 of the second security domain 30 (Transport Authentication and Authorization Functional)
  • the authentication key of the second security domain is determined according to the full authentication request sent by the user, and the user is fully authenticated according to the authentication key of the second security domain.
  • the method of network authentication is further described in detail in conjunction with FIG.
  • step S200 the user (UE) initiates a full authentication request.
  • the user initiates a Layer 2 link scan to the perimeter and discovers the surrounding access points.
  • AP peripheral access point
  • Base station Base
  • the 2 in the embodiment of the present invention is a scenario in which the AM-FE 1 and the AM-FE3 are in different security domains, that is, the inter-domain handover authentication, that is, the full authentication request is initiated.
  • the user is a mobile user, such as a mobile phone terminal, etc.; the full authentication request is Pre-Authentication.
  • the authentication request includes a username, a password, initial user gating information, home domain information, a user identity, and the like.
  • Step S202 The AM-FE1 sends the full authentication request to the AM-FE3, and the AM-FE3 forwards the message to the TAA-FE proxy2o.
  • Step S204 the TAA-FE
  • the proxy 2 carries the user-related information in the authentication request, and determines and sends the full authentication request to the TAA-FE sever for security authentication.
  • the authentication server TAA-FE sever is located in the home network, TAA-FE
  • Proxy2 is located in the second security domain of the visited network, so the TAA-FE
  • p rOX y2 sends the full authentication request to the TAA-FE sever of the home network according to the home network information in the received full authentication request information and AM-
  • the authentication request includes: an identifier (ID) of the security domain to which the user is attached or any combination of one or more of the domain name information, and may also include information such as a serial number (SEQ) negotiated by the user.
  • ID an identifier
  • SEQ serial number
  • Step S205 the TAA-FE
  • the sever Based on the authentication request, the sever interacts with the transport layer user configuration library function entity (TUP-FE) in the first security domain to confirm whether the user is a legitimate user.
  • TUP-FE transport layer user configuration library function entity
  • the authentication server performs information interaction with the transport layer user configuration library function entity (TUP-FE) in the first security domain according to the authentication request, and acquires mobile configuration information of the TUP-FE in the first security domain.
  • TUP-FE transport layer user configuration library function entity
  • the transport layer user configuration library functional entity stores the mobile configuration information of the user,
  • the mobile configuration information includes: one or more types of information such as a transmission user identifier, a supported authentication method list, a key, a mobile user's network configuration information (eg, an IP address), a maximum access bandwidth, and a network switching policy.
  • Step S206 The TAA-FE
  • the sever Based on the user information carried in the security authentication request and the domain ID or domain name of the security domain where the AM-FE3 is located, the sever generates the user-added root key information and derives the authentication key (DSRK) of the security domain, and stores the current domain.
  • the authentication key, and the authentication key of the security domain are returned to the TAA-FE proxy2.
  • the sever generates an authentication key (DSRK) of the security domain where the AM-FE3 is located according to the user information carried in the security authentication request and the domain ID or domain name of the security domain where the AM-FE3 is located, and sends the authentication key to the
  • the second transport layer authentication function entity in the second security domain is a proxy TAA-FE proxy2.
  • the authentication key between the user and other functional entities of the security domain is generated hierarchically by the TAA-FE p rOX y2, so that the system can conveniently manage and store the authentication key information of the security domain.
  • the proxy 2 authenticates the user according to the authentication key returned by the authentication server.
  • the proxy 2 receives the authentication key (DSRK) of the current security domain and saves it.
  • the TAA-FE proxy 2 negotiates with the user according to the authentication key (DSRK) to generate the user and the second security. a subkey between other functional entities within the domain; and configuring the corresponding subkey to the corresponding functional entity, ie the TAA-FE
  • the proxy2 generates a subkey between the user and the NAC-FE according to the authentication key (DSRK) of the current domain, and generates a subkey between the user and the MMCF; meanwhile, the TAA-FE
  • p rOX y2 configures the corresponding sub-keys to the corresponding functional entities, establishes a secure channel between the user and each functional entity, and completes initial user authentication to fully ensure the security and reliability of subsequent process information interaction.
  • the subkey can also be understood as a security association between the user and other functional entities within the second security domain.
  • the other functional entities in the second security domain include at least: a network address configuration function entity NAC-FE, and a mobility management function subsystem MMCF, that is, complete user complete authentication, to fully ensure the security and reliability of subsequent process information interaction. .
  • the user detects that the first access management function entity and the second access management function entity belong to different security domains, and initiates a full authentication request to the authentication server located in the home domain;
  • the server generates an authentication key (the authentication key DSRK of the security domain) of the attached security domain according to the user information carried by the transport layer authentication function entity agent and the identifier (ID) or domain name of the domain to which the second access management function entity belongs.
  • the transport layer authentication function entity agent of the security domain interacts with the user and generates a subkey for protecting the user and other functional entity information interaction, and completes the cross-domain full authentication of the user.
  • the authentication delay of the user in the mobile domain is reduced, so that the user experiences a smoother network switching effect.
  • FIG. 1-2 Please refer to FIG. 1-2 for a networking diagram in a security domain.
  • FIG. 3 a flowchart of a network authentication method in a security domain according to an embodiment of the present invention is specifically introduced.
  • the figure 1-2 is an access management function entity 2002 (Access Management Functional) in which the user 10 is located in the first security domain 20
  • Entity TAA-FEproxyl
  • Step S300 When the user is attached from the AM-FE1 to the first security domain in the first security domain
  • AM-FE2 ⁇ the user sends a re-authentication request.
  • the user initiates a Layer 2 link scan to the perimeter and discovers the surrounding access points.
  • AP peripheral access point
  • Base station Base
  • AM-FE2 information if the user judges the result, it detects that AM-FE1 and AM-FE2 are in the same security.
  • the user initiates a re-authentication request; the authentication request includes: an identifier (ID) of the security domain to which the user is attached or any combination of one or more of the domain name information, and may also include a serial number (SEQ) negotiated by the user, etc. information.
  • Step S302 The AM-FE1 sends the re-authentication request to the AM-FE2, and the AM-FE2 forwards the message to the TAA-FE proxy1.
  • Step S304 the TAA-FE
  • the proxy1 After receiving the re-authentication request sent by the user, the proxy1 is based on the authentication key of the first security domain.
  • the proxyl After receiving the re-authentication request sent by the user, the proxyl directly searches for the user and the TAA-FE according to the re-authentication request of the user.
  • the authentication key negotiated in the attachment process before the proxyl that is, the authentication key of the domain where the AM-FE1 is located; and the functional entity NAC-FE and the MMCF are negotiated according to the authentication key to generate a corresponding plurality of subkeys. And configure multiple subkeys to the corresponding functional entities, enabling TAA-FE
  • Proxyl establishes a subkey between the user and each functional entity, and completes the re-authentication of the user from the AM-FE1 to the AM-FE2 in the first security domain in the first security domain to fully ensure the security of the subsequent process information interaction. Sex and reliability.
  • the authentication key of the first security domain is the first time that the user accesses the security domain and completes the complete authentication process, and is generated by the authentication server and sent to the TAA-FE proxy1, the TAA-FE.
  • the proxy1 saves the authentication key of the first security domain.
  • the user moves from the AM-FE1 in the same security zone to the AM-FE2, the user directly queries the authentication key of the security domain where the AM-FE1 is located, and derives other sub-keys. Keys (such as the transfer subkey of the user and the network, the interaction subkey of the user and the NAC-FE, the interaction subkey of the user and the mobility management function MMCF) and so on.
  • proxyl Based on the authentication key (DSRK) of the user's domain, proxyl performs intra-domain authentication on the user. After the user successfully authenticates once in the domain, the user can pass the mobile service authentication to ensure the security and reliability of the user moving within the domain. On the basis of this, the re-authentication delay of the user in the intra-domain movement is reduced, so that the user experiences a smoother network switching effect.
  • FIG. 4 is a schematic structural diagram of a network authentication system according to an embodiment of the present invention.
  • a network authentication system 40 comprising: an access management function entity 402, a transport layer authentication function entity agent 404.
  • the access management function entity 402 is configured to perform information interaction with the transport layer authentication function entity proxy 404, and send a user authentication request to the transport layer authentication function entity proxy 404. Further, the access management function entity The pre-authentication of the user network access is supported by the user, and the pre-authentication is the user re-authentication and the full-user authentication mentioned in the embodiment of the present invention.
  • the transport layer authentication function entity proxy 404 is configured to forward the user authentication request, and obtain an authentication key of the security domain that the user attaches; and generate a user according to the authentication key of the security domain that the user attaches Subkeys that interact with each network entity (such as the transfer subkey of the user and the network, the interaction subkey of the user and the NAC-FE, the interaction subkey of the user and the mobility management function MMCF) and authenticate the user. That is, the subkey is derived by the transport layer authentication function entity agent of the security domain according to the authentication key of the security domain.
  • the security domain to which the user is attached is a security domain of another access management function entity that is the same as the security domain of the access management function entity; and/or the security domain to which the user is attached is the access management function entity The security domain of the other access management function entities that are different from the security domain.
  • the transport layer authentication function entity proxy 404 supports multiple association binding states from different access management functional entities for a user session. Among the multiple associated binding states, one is the Active state, the other is the Proactive state, and the associated state transition can be performed according to the state of the mobile switching state.
  • the system further includes: an authentication server 406, and/or other functional entity 408.
  • the authentication server 406 is configured to receive a user authentication request, and send response information to the transport layer authentication function entity proxy 404 according to the user authentication request, where the response information includes an authentication result attached by the user, and an access attached by the user.
  • the authentication key is generated according to the identification ID and/or domain name information of the security domain and the user-attached root key information.
  • the other functional entity 408 has a subkey derived from the authentication key between the user and the user, where the other functional entity 408 includes a network address configuration function entity and a transport layer.
  • the user configures one or more functional entities of the functional entity and the mobility management functional subsystem.
  • the network address configuration function entity is configured to implement IP address and access parameter configuration; the transport layer user configuration function entity is configured to save user mobility related configuration information and user customized configuration files, for example: The maximum access bandwidth allowed by the access technology, the network switching policy, the mobile location manager address, etc.; the mobility management function subsystem, configured to implement the address binding update function of the user; and may further include: a delivery location management function entity For supporting multiple association binding states of a user session, and performing state transition according to the situation of the mobile handover, and setting location information of the target or candidate access point (such as access point AP information or base station BS information) And the information of the target or alternative access management function entity or the information of the access router), as the location information, is provided to the resource admission control function subsystem.
  • a delivery location management function entity For supporting multiple association binding states of a user session, and performing state transition according to the situation of the mobile handover, and setting location information of the target or candidate access point (such as access point AP information or base station BS information) And the information of the target or alternative
  • FIG. 5 is a schematic structural diagram of a composition structure of a transport layer authentication function entity proxy device according to an embodiment of the present invention, including:
  • the storage unit 502 is configured to store an authentication key of the security domain to which the first access management function entity belongs, where the authentication key is used by the authentication server TAA-Server
  • the processing unit 504 is configured to: according to the authentication key stored by the storage unit, derive a key for information interaction between another access management function entity and the user of the security domain, and use the derived key Sent to the authentication unit;
  • Authentication unit 506 Authenticating the user according to the derived key sent by the processing unit.
  • FIG. 6 is a schematic structural diagram of a network authentication server according to an embodiment of the present invention.
  • a network authentication server 60 comprising: a request receiving unit 602, configured to receive a user authentication request; a request response unit 604, configured to respond to the user authentication request, and proxy to a transport layer authentication function entity Sending response information, where the response information includes an authentication result attached by the user, and a domain authentication key of the security domain to which the access management function entity belongs to the user; wherein the authentication key of the security domain is attached by the user
  • the key information and the security domain's identification ID, domain name and other information are derived.
  • the embodiment of the present invention provides a method, a device, a system, and a server for network authentication, which overcomes the problem that the user switches between the domain and the domain in the prior art, which is long-consuming and has poor security.
  • the problem of packet loss or even interruption of the service of the user service enables fast and secure authentication of the user to move within the domain or between domains, which reduces the re-authentication delay of the user during the mobile process and improves the security of the user authentication. , reliability, ensuring a seamless, smoother network switching effect.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供了一种网络认证的方法、装置、系统及服务器。本发明所述方法包括：当用户从第一接入管理功能实体附着到第二接入管理功能实体时，接收来自所述第二接入管理功能实体转发的用户认证请求；根据所述用户认证请求，获得所述第二接入管理功能实体的安全域的认证密钥；根据所述认证密钥，对用户进行认证。解决了现有技术中用户在域内和域间切换时，耗时长，且安全性差，导致用户业务的丢包甚至暂时中断业务的问题，实现了用户在域内或者域间移动的安全的认证，提高了用户认证的安全性、可靠性。

Description

一种网络认证的方法、 装置、 系统及服务器
[1] 本申请要求于 2008年 06月 30日提交中国专利局、 申请号为 200810068193.9、 发 明名称为"一种网络认证的方法、 装置、 系统及服务器 "的中国专利申请的优先权 ， 其全部内容通过引用结合在本申请中。
[2] 技术领域
[3] 本发明涉及通信领域的网络技术， 具体指一种网络认证的方法、 装置、 系统及 服务器。
[4] 发明背景
Figure imgf000002_0001
Network, NGN) 的网络架构中， 强调了固定和移动的网络融合， 基于这个融合 的网络， 当用户切换到新的网络附着点的吋候， 从安全角度考虑需要进行安全 认证。 当用户通过安全认证之后， 才能够被网络接纳， 同吋， 在用户和网络之 间建立子密钥， 保护后续用户和网络侧的信息交互。 因此， 当用户在不同网络 附着点间移动的吋候， 给用户提供更好的业务体验， 快速、 低吋间延迟的无缝 切换是非常有必要的。
对于移动用户， 存在两种认证需求。 一个是网络接入认证 (network access service authentication)需求,另 ^ ^个是移云力认证 (mobility service
authentication) 网络接入认证已经在 ITU、 TISAPAN
都有相应的标准， 称为网络附着子系统 （Network Attachment Control
Functions , NACF) ， 规定了用户在接入到网络之前所需要的认证， 例如用户的 I P地址分配， 向用户设备发布其他的网络配置参数等过程。 移动认证是移动业务 认证， 通过移动认证的用户， 才可以在网络间进行漫游和切换。 从二者实现方 式上看， 可以分为融合式和独立式两种。 独立式是指网络接入认证和移动认证 各自独立， 釆用不同的认证系统独立认证互不影响。 网络接入认证就用现在 ITU Y.NACF, TISPAN
NASS等类似的网络附着功能来实现， 移动认证则另外釆用独立的认证功能实体 来实现。 在融合式模式下， 移动用户通过一套认证系统一次认证来同吋解决网 络接入认证和移动认证。 一旦用户被认证通过， 即可认为网络接入认证和移动 认证都通过了， 用户可以接入到网络， 可以在网络间进行移动。 由于用户在移 动过程中在目标切换网络的认证相对目标网络来讲， 也是一次网络接入认证， 因此二者存在一定的内在关联， 故而基于融合式认证的方法更容易被接受。
[7] 在实现本发明的过程中， 发明人发现现有技术至少存在如下问题：
[8] 上述的认证过程， 需要被认证者和网络侧认证功能实体多次交互才能完成。 特 别是在移动场景中， 用户需要在同种甚至异种接入网络中进行切换， 如果每次 都需要复杂的完整的认证过程， 那么用户在域内和域间切换吋就会非常耗吋， 且安全性差， 导致用户业务的丢包甚至暂吋中断业务， 影响用户的体验。
[9] 发明内容
[10] 有鉴于此， 本发明实施例的主要目的在于提供一种网络认证的方法、 装置、 系 统及服务器， 用以解决用户在域内和域间切换吋， 耗吋长， 且安全性差的问题
[11] 为实现上述目的， 本发明实施例提供如下的技术方案：
[12] 一种网络认证方法， 包括： 当用户从第一接入管理功能实体附着到第
[13] 二接入管理功能实体吋， 所述方法包括： 接收来自所述第二接入管理功能实体 转发的用户认证请求； 根据所述用户认证请求， 获得所述第二接入管理功能实 体的安全域的认证密钥； 根据所述第二接入管理功能实体的安全域的认证密钥 ， 对用户进行认证。
[14] 一种网络认证系统， 包括： 接入管理功能实体、 传送层认证功能实体代理； 所 述接入管理功能实体， 用于与传送层认证功能实体代理进行信息交互， 发送用 户认证请求给传送层认证功能实体代理； 所述传送层认证功能实体代理， 用于 根据所述用户认证请求， 获得用户附着的安全域的认证密钥； 根据所述用户附 着的安全域的认证密钥， 对用户进行认证。
[15] —种传送层认证功能实体代理装置， 包括： 存储单元， 用于存储接入管理功能 实体的安全域的认证密钥； 处理单元， 用于根据存储单元存储的认证密钥， 为 所述安全域的其他接入管理功能实体和用户之间的信息交互派生密钥， 并将所 述派生的密钥发送给认证单元； 认证单元： 用于根据处理单元发送的所述派生 的密钥， 对用户进行认证。
[16] —种网络认证服务器， 包括： 请求接收单元， 用于接收用户认证请求； 请求响 应单元， 用于响应所述用户认证请求， 并向传送层认证功能实体代理发送响应 信息， 所述响应信息包括用户附着的认证结果、 用户附着的根认证密钥、 接入 管理功能实体所属安全域的认证密钥； 所述安全域的认证密钥由所述用户附着 根密钥信息和安全域的标识 ID、 域名信息派生。
[17] 本发明实施例能够解决现有技术中用户在域内和域间切换吋， 耗吋长， 且安全 性差， 导致用户业务的丢包甚至暂吋中断业务的问题， 实现了用户在域内或者 域间移动的安全认证， 提高了用户认证的安全性、 可靠性。
[18] 附图简要说明
[19] 图 1-1为本发明实施方式中一种跨安全域的组网示意图；
[20] 图 1-2为本发明实施方式中一种安全域内的组网示意图；
[21] 图 2为本发明实施方式中一种跨安全域的网络认证方法流程图；
[22] 图 3为本发明实施方式中一种安全域内的网络认证方法流程图；
[23] 图 4为本发明实施方式中一种网络认证系统的结构图；
[24] 图 5为本发明实施方式中一种传送层认证功能实体代理装置结构图；
[25] 图 6为本发明实施方式中一种网络认证服务器的组成结构图。
[26] 实施本发明的方式
[27] 为使本发明的目的、 技术方案和优点更加清楚， 下面将结合附图对本发明的实 施例作进一步地详细描述。
[28] 本发明实施例提供了一种网络认证方法， 当用户从接入管理功能实体附着到第 二接入管理功能实体吋， 接收来自所述第二接入管理功能实体转发的用户认证 请求； 根据所述用户认证请求， 获得所述第二接入管理功能实体的安全域的认 证密钥； 根据所述第二接入管理功能实体的安全域的认证密钥， 对用户进行认 证。 所述认证请求具体为： 用户第一次接入安全域的完全认证和用户在安全域 内的重新认证； 所述第二接入管理功能实体的安全域的认证密钥具体根据第一 接入管理功能实体和所述第二接入管理功能实体是否属于同一安全域而不同。 [29] 本发明实施例的应用场景为， 用户的业务签约地在家乡网 （Home
Network) ， 所述用户的移动业务相关信息存储在家乡网， 当用户漫游到拜访网 (Visited Network) ， 在拜访地进行域内切换和跨域 （即域间） 切换。
[30] 所述移动业务相关信息为配置信息， 共享密钥 （即原始会话协商密钥） ， 移动 业务配置参数等信息。 所述拜访网的安全域 （也称 "接入管理域"） 是根据每个域 按照唯一一组管理实体组成来划分的， 所述管理实体组包括移动管理功能子系 统 (Mobility Management Control Functions
， MMCF) 、 传送层认证授权功能实体 (Transport Authentication Funtional Entity, TAA-FE) 、 接入管理功能实体 (Access Management Functional
Entity, AM-FE) 的一种或几种的组合。
[31] 下面具体结合下面的附图进行详细说明
[32] 请参阅图 1-1所示一种跨安全域的组网示意图， 结合图 2对本发明实施方式中一 种跨安全域的网络认证方法流程图作具体介绍。
[33] 所述图 1-1为用户 10从所在第一安全域 20附着至第二安全域 30的组网示意图。
用户 10从所在第一安全域 20的接入管理功能实体 2002 (Access Management
Functional
Entity, AM-FE 1) 移动至第二安全域 30的接入管理功能实体 3002 (AM-FE3) ， 第二安全域 30的传送层认证授权功能实体代理 3006 (Transport Authentication and Authorization Functional
Entity, TAA-FEproxy2) 根据用户发送的完全认证请求， 确定第二安全域的认证 密钥， 根据所述第二安全域的认证密钥， 对所述用户进行完全认证。 结合图 2对 网络认证的方法作进一步地详细描述。
[34] 在步骤 S200中， 用户 （UE) 发起完全认证请求。
[35] 用户在跨域认证前需要判断附着点 AM-FE1和 AM-FE3是在同一安全域内还是在 不同的安全域， 具体判断步骤如下：
[36] 用户向周边发起二层链路扫描， 发现周边的接入点，
并获得周边接入点 (Access Point, AP) 或基站 (Base
Station, BS) 的标识； 然后用户携带备选或目标接入点的标识信息， 向当前所 在网络发起査询， 获得备选或目标接入点所属的接入域信息， 即本发明实施例 中 AM-FE3的信息； 若用户根据査询结果， 检测到 AM-FE1和 AM-FE3在不同的安 全域， 则用户发起完全认证请求； 若 AM-FE1和 AM-FE3在相同的安全域， 则用 户发起重新认证请求。 本发明实施例的图 2流程图即为 AM-FE 1和 AM-FE3在不同 的安全域， 即域间切换认证的场景， 即发起完全认证请求。 所述用户为移动用 户， 例如手机终端等； 所述完全认证请求为预先完全认证 （Pre- Authentication) 。 所述认证请求包括用户名、 密码、 用户初始门控信息、 家乡域信息、 用户标 识等。
[37] 步骤 S202中： AM-FE1将所述完全认证请求发送给 AM-FE3 , 所述 AM-FE3转发 给 TAA-FE proxy2o
[38] 步骤 S204中： 所述 TAA-FE
proxy2将用户相关的信息承载在所述认证请求中， 判断并发送所述完全认证请求 给 TAA-FE sever进行安全认证。
[39] 所述认证服务器 TAA-FE sever位于家乡网， TAA-FE
proxy2位于拜访网的第二安全域中， 因此所述 TAA-FE
prOXy2根据接收的完全认证请求信息中的家乡网信息将所述完全认证请求发送给 家乡网的 TAA-FE sever并将 AM-
FE3的域名或域标识 (ID)等用户相关的信息承载在所述完全认证请求中。
[40] 所述认证请求包括： 用户附着的安全域的标识 （ID) 或者域名信息的一种或多 种的任意组合， 也可以包括用户协商的序列号 （SEQ) 等信息。
[41] 步骤 S205中： 所述 TAA-FE
sever根据认证请求， 与第一安全域内的传送层用户配置库功能实体 （TUP-FE) 进行信息交互， 确认用户是否为合法用户。
[42] 具体为： 所述认证服务器根据认证请求， 与第一安全域内的传送层用户配置库 功能实体 （TUP-FE) 进行信息交互， 获取第一安全域内 TUP-FE的移动配置信息
； 根据所述移动配置信息， 通过挑战字协商， 原始共享密钥等对所述用户身份 信息 （ID) 进行认证， 确认所述用户是否为合法用户。
[43] 所述传送层用户配置库功能实体 （TUP-FE) 存储所述用户的移动配置信息， 所述移动配置信息包括： 传送用户标识、 支持的认证方法列表、 密钥、 移动用 户的网络配置信息 (如： IP地址)、 最大接入带宽、 网络切换策略等信息的一种或 多种。
[44] 步骤 S206: 所述 TAA-FE
sever根据所述安全认证请求携带的用户信息和 AM-FE3所在安全域的域 ID或域名 ， 生成用户附着根密钥信息并派生出所在安全域的认证密钥 （DSRK) ， 并存储 当前域的认证密钥， 同吋， 将所述安全域的认证密钥返回给 TAA-FE proxy2。
[45] 具体为： 所述 TAA-FE
sever根据所述安全认证请求中携带的用户信息和 AM-FE3所在安全域的域 ID或域 名， 生成 AM-FE3所在安全域的认证密钥 （DSRK) ， 将所述认证密钥发送给所 述第二安全域内的第二传送层认证功能实体代理 TAA-FE proxy2。 由 TAA-FE prOXy2分层次生成该用户和本安全域的其他功能实体之间的认证密钥， 使得系统 便于统一管理和存储安全域的认证密钥信息。
[46] 步骤 S208: TAA-FE
proxy2根据认证服务器返回的认证密钥， 对用户进行认证。
[47] 所述 TAA-FE
proxy2接收到当前安全域的认证密钥 （DSRK) 并保存， 同吋， 所述 TAA-FE proxy2根据所述认证密钥 (DSRK), 与用户进行协商， 生成所述用户和所述第二 安全域内的其他功能实体之间的子密钥； 并将相应的子密钥配置到相应的功能 实体， 即所述 TAA-FE
proxy2根据接收到当前域的认证密钥 （DSRK) ， 生成用户与 NAC-FE之间的子 密钥， 以及生成用户与 MMCF之间的子密钥； 同吋， 所述 TAA-FE
prOXy2将相应的子密钥分别配置到相应的功能实体上， 建立起用户到各个功能实 体之间的安全通道， 完成初始化用户认证， 以充分保证后续过程信息交互的安 全性和可靠性。 所述子密钥也可以理解为所述用户和所述第二安全域内的其他 功能实体之间的安全联盟。 所述第二安全域内的其他功能实体至少包括： 网络 地址配置功能实体 NAC-FE、 和移动管理功能子系统 MMCF, 即完成用户的完全 认证， 以充分保证后续过程信息交互的安全性和可靠性。 [48] 在本发明实施例中， 通过用户检测到第一接入管理功能实体与第二接入管理功 能实体属于不同安全域吋， 向位于家乡域的认证服务器发起完全认证请求； 所 述认证服务器根据传送层认证功能实体代理携带的用户信息和第二接入管理功 能实体所属的域的标识 （ID) 或者域名， 生成所属附着安全域的认证密钥 (该安 全域的认证密钥 DSRK), 并发送给该安全域的传送层认证功能实体代理， 该安 全域的传送层认证功能实体代理与用户交互并生成保护用户与其它各功能实体 信息交互子密钥， 完成用户跨域的完全认证， 在充分保证了用户在域间移动的 安全性和可靠性的基础上， 降低了用户在域内移动中的认证延吋， 使得用户体 验到更为平滑的网络切换效果。
[49] 请参阅图 1-2为一种安全域内的组网示意图， 结合图 3对本发明实施方式中一种 安全域内的网络认证方法流程图作具体介绍。
[50] 所述图 1-2为用户 10从所在第一安全域 20内的接入管理功能实体 2002 (Access Management Functional
Entity, AM-FE1) 附着至第一安全域 20内的接入管理功能实体 2004
(AM-FE2) 吋的组网示意图。 传送层认证授权功能实体代理 2006 (Transport Authentication and Authorization Functional
Entity, TAA-FEproxyl) 根据所述用户 10发送的重新认证请求， 确定第一安全域 20的认证密钥； 根据所述认证密钥对用户进行重新认证， 结合图 3对网络认证的 方法作进一步地详细描述。
[51] 步骤 S300: 当用户在第一安全域内从 AM-FE1附着至第一安全域内的
[52] AM-FE2吋， 用户发送重新认证请求。
[53] 具体为： 用户在域内认证前需要判断附着点 AM-FE1和 AM-FE2是否在同一安全 域内， 具体判断步骤如下：
[54] 用户向周边发起二层链路扫描， 发现周边的接入点，
并获得周边接入点 (Access Point, AP) 或基站 (Base
Station, BS) 的标识； 然后用户携带备选或目标接入点的标识信息， 向当前所 在网络发起査询， 获得备选或目标接入点所属的接入域信息， 即本发明实施例 中 AM-FE2的信息； 若用户通过判断结果， 检测到 AM-FE1和 AM-FE2在相同的安 全域， 则用户发起重认证请求； 所述认证请求包括： 用户附着的安全域的标识 (ID) 或者域名信息的一种或多种的任意组合， 也可以包括用户协商的序列号 (SEQ) 等信息。
[55] 步骤 S302中： AM-FE1将所述重新认证请求发送给 AM-FE2, 所述 AM-FE2转发 给 TAA-FE proxyl。
[56] 步骤 S304中： 所述 TAA-FE
proxyl接收到所述用户发送的重新认证请求吋， 根据所述第一安全域的认证密钥
， 对用户进行认证。
[57] TAA-FE
proxyl接收到所述用户发送的重新认证请求吋， 根据所述用户的重新认证请求， 直接査找出所述用户与 TAA-FE
proxyl之前的附着过程中协商好的认证密钥， 即 AM-FE1所在域的认证密钥； 根 据所述认证密钥， 与功能实体 NAC-FE、 MMCF进行协商， 生成相应的多个子密 钥， 并将多个子密钥配置到相应的功能实体， 使得通过 TAA-FE
proxyl , 建立起用户到各个功能实体之间的子密钥， 完成用户在第一安全域内从 AM-FE1附着至第一安全域内的 AM-FE2的重新认证， 以充分保证后续过程信息 交互的安全性和可靠性。
[58] 其中， 所述第一安全域的认证密钥是用户首次接入安全域吋完成完全认证过程 中， 由认证服务器生成并发送给 TAA-FE proxyl , 所述 TAA-FE
proxyl保存所述第一安全域的认证密钥， 当用户从同一安全域内的 AM-FE1移动 到 AM-FE2吋， 直接査询获取 AM-FE1所在安全域的认证密钥， 并派生出其他子 密钥 （如用户和网络的传送子密钥， 用户和 NAC-FE的交互子密钥， 用户和移动 管理功能 MMCF的交互子密钥） 等等。
[59] 在本发明实施例中， 通过 TAA-FE
proxyl根据用户所在域的认证密钥 （DSRK) ， 对用户进行域内认证， 实现了用 户在域内一次认证成功后即可通过移动业务认证， 使其在保证用户在域内移动 的安全性和可靠性的基础上， 降低了用户在域内移动中的重认证延吋， 使得用 户体验到更为平滑的网络切换效果。 [60] 请参阅图 4， 为本发明实施方式中一种网络认证系统的组成结构示意图。
[61] —种网络认证系统 40， 包括： 接入管理功能实体 402、 传送层认证功能实体代 理 404。
[62] 所述接入管理功能实体 402， 用于与传送层认证功能实体代理 404进行信息交互 ， 发送用户认证请求给传送层认证功能实体代理 404; 进一步而言， 所述接入管 理功能实体 402支持用户网络接入的预认证， 所述预认证为本发明实施例提到的 用户重新认证和用户完全认证。
[63] 所述传送层认证功能实体代理 404， 用于转发所述用户认证请求， 并获得用户 附着的安全域的认证密钥； 根据所述用户附着的安全域的认证密钥， 生成用户 与各个网络实体交互的子密钥 （如用户和网络的传送子密钥， 用户和 NAC-FE的 交互子密钥， 用户和移动管理功能 MMCF的交互子密钥） 并对用户进行认证。 即所述子密钥由所述安全域的传送层认证功能实体代理根据安全域的认证密钥 派生。 所述用户附着的安全域为与所述接入管理功能实体的安全域相同的其它 接入管理功能实体的安全域； 和 /或所述用户附着的安全域为与所述接入管理功 能实体的安全域不相同的其它接入管理功能实体的安全域。
[64] 所述传送层认证功能实体代理 404支持对一个用户会话的， 来自不同的接入管 理功能实体的多个关联绑定状态。 多个关联绑定状态中， 有一个是 Active状态， 其他是 Proactive状态， 并能根据移动切换状态的情况进行关联状态转换。
[65] 所述系统进一步还包括： 认证服务器 406， 和 /或其它功能实体 408。
[66] 所述认证服务器 406: 用于接收用户认证请求， 根据用户认证请求向所述传送 层认证功能实体代理 404发送响应信息， 所述响应信息包括用户附着的认证结果 、 用户附着的接入管理功能实体的安全域的认证密钥的一种或多种。 所述认证 密钥根据安全域的标识 ID和 /或域名信息以及用户附着根密钥信息而生成。
[67] 所述其它功能实体 408， 所述其它功能实体 408与用户之间具有基于所述认证密 钥派生的子密钥， 其中， 所述其它功能实体 408包括网络地址配置功能实体、 传 送层用户配置功能实体和移动管理功能子系统的一个或多个功能实体。 其中， 网络地址配置功能实体， 用于实现 IP地址和接入参数的配置； 传送层用户配置功 能实体， 用于保存用户移动相关的配置信息及用户订制的配置文件， 例如： 不 同接入技术下允许支持的最大接入带宽， 网络切换策略， 移动位置管理器地址 等； 移动管理功能子系统， 用于实现用户的地址绑定更新功能； 还可以包括： 传送位置管理功能实体， 用于支持一个用户会话的多个关联绑定状态， 并能根 据移动切换的情况， 进行状态转化， 并将目标或备选接入点的位置信息 （如接 入点 AP信息或基站 BS信息， 以及目标或备选接入管理功能实体的信息或接入路 由器的信息） ， 作为位置信息， 提供给资源接纳控制功能子系统。
[68] 请参阅图 5， 为本发明实施方式中一种传送层认证功能实体代理装置的组成结 构示意图， 包括：
[69] 存储单元 502: 用于存储第一接入管理功能实体所属安全域的认证密钥， 所述 认证密钥由认证服务器 TAA-Server
在用户认证通过后生成的用户附着根密钥信息生成；
[70] 处理单元 504: 用于根据存储单元存储的所述认证密钥， 为本安全域的其他接 入管理功能实体和用户之间的信息交互派生密钥， 并将所述派生的密钥发送给 认证单元；
[71] 认证单元 506: 用于根据处理单元发送的所述派生的密钥， 对用户进行认证。
[72] 请参阅图 6， 为本发明实施方式中一种网络认证服务器的组成结构示意图。
[73] 一种网络认证服务器 60， 其特征在于， 包括： 请求接收单元 602， 用于接收用 户认证请求； 请求响应单元 604， 用于响应所述用户认证请求， 并向传送层认证 功能实体代理发送响应信息， 所述响应信息包括用户附着的认证结果、 用户附 着的接入管理功能实体所属安全域的域认证密钥； 其中， 所述安全域的认证密 钥由所述用户附着的根密钥信息和安全域的标识 ID、 域名等信息派生而来。
[74] 综上所述， 本发明实施例提出了一种网络认证的方法、 装置、 系统及服务器， 克服了现有技术中用户在域内和域间切换吋， 耗吋长， 且安全性差， 导致用户 业务的丢包甚至暂吋中断业务的问题， 实现了用户在域内或者域间移动的快速 、 安全的认证， 降低了用户在移动过程中的重新认证延吋， 提高了用户认证的 安全性、 可靠性， 确保了无缝的、 更为平滑的网络切换效果。
[75] 以上所述， 仅为本发明较佳的具体实施方式， 但本发明的保护范围并不局限于 此， 任何熟悉本技术领域的技术人员在本发明揭露的技术范围内， 可轻易想到 的变化或替换， 都应该涵盖在本发明的保护范围之内。 因此， 本发明的保护范 围应该以权利要求的保护范围为准。

Claims

权利要求书
[1] 一种网络认证方法， 其特征在于， 当用户从第一接入管理功能实体
附着到第二接入管理功能实体吋， 所述方法包括：
接收来自所述第二接入管理功能实体转发的用户认证请求； 根据所述用户认证请求， 获得所述第二接入管理功能实体的安全域的认证 密钥；
根据所述第二接入管理功能实体的安全域的认证密钥， 对用户进行认证。
[2] 根据权利要求 1所述的网络认证方法， 其特征在于， 所述第一接入管理功能 实体， 所述第二接入管理功能实体属于不同安全域， 所述获得所述第二接 入管理功能实体的安全域的认证密钥的步骤具体包括：
根据所述第二接入管理功能实体的安全域的标识 ID和 /或域名信息生成所述 第二接入管理功能实体的安全域的认证密钥； 和 /或
将所述第二接入管理功能实体的安全域的标识 ID和 /或域名信息发送给认证 服务器， 并接收所述认证服务器返回的所述第二接入管理功能实体的安全 域的认证密钥。
[3] 根据权利要求 1所述的网络认证方法， 其特征在于， 所述第一接入管理功能 实体和所述第二接入管理功能实体属于同一安全域， 所述获得所述第二接 入管理功能实体的安全域的认证密钥的步骤具体包括：
获得所述第一接入管理功能实体的安全域的认证密钥， 将获得的所述第一 接入管理功能实体的安全域的认证密钥作为所述第二接入管理功能实体的 安全域的认证密钥。
[4] 根据权利要求 1所述的网络认证方法， 其特征在于， 所述方法进一步包括： 根据所述认证密钥， 与用户进行协商， 生成所述用户和其他功能实体之间 的子密钥； 所述其他功能实体包括网络地址配置功能实体、 传送层用户配 置功能实体和移动管理功能子系统的一个或多个功能实体。
[5] —种网络认证系统， 其特征在于， 包括： 接入管理功能实体、 传送层认证 功能实体代理；
所述接入管理功能实体， 用于与传送层认证功能实体代理进行信息交互， 发送用户认证请求给传送层认证功能实体代理；
所述传送层认证功能实体代理， 用于根据所述用户认证请求， 获得用户附 着的安全域的认证密钥； 根据所述用户附着的安全域的认证密钥， 对用户 进行认证。
[6] 根据权利要求 5所述的网络认证系统， 其特征在于， 所述用户附着的安全域 为其它接入管理功能实体的安全域， 其中， 所述其它接入管理功能实体的 安全域与所述接入管理功能实体的安全域相同和 /或不同。
[7] 根据权利要求 5所述的网络认证系统， 其特征在于， 所述系统进一步包括： 认证服务器： 用于接收用户认证请求， 根据用户认证请求向所述传送层认 证功能实体代理发送响应信息， 所述响应信息包括用户附着的认证结果、 用户附着的接入管理功能实体所属安全域的认证密钥。
[8] 根据权利要求 5、 6或 7所述的网络认证系统， 其特征在于， 所述安全域的认 证密钥由安全域的标识 ID和 /或域名信息以及用户附着根密钥信息确定。
[9] 根据权利要求 5所述的网络认证系统， 其特征在于， 所述系统进一步包括其 它功能实体， 所述其它功能实体与用户之间具有基于所述认证密钥的子密 钥， 其中， 所述其它功能实体包括网络地址配置功能实体、 传送层用户配 置功能实体和移动管理功能子系统的一个或多个功能实体； 所述子密钥由所述安全域的传送层认证功能实体代理根据安全域的认证密 钥派生。
[10] 一种传送层认证功能实体代理装置， 其特征在于， 包括：
存储单元： 用于存储接入管理功能实体所属安全域的认证密钥； 处理单元： 用于根据存储单元存储的认证密钥， 为所述安全域的其他接入 管理功能实体和用户之间的信息交互派生密钥， 并将所述派生的密钥发送 给认证单元；
认证单元： 用于根据处理单元发送的所述派生的密钥， 对用户进行认证。
[11] 一种网络认证服务器， 其特征在于， 包括：
请求接收单元， 用于接收用户认证请求；
请求响应单元， 用于响应所述用户认证请求， 并向传送层认证功能实体代 理发送响应信息， 所述响应信息包括用户附着的认证结果、 用户附着的接 入管理功能实体所属安全域的认证密钥； 所述安全域的认证密钥由所述用 户附着根密钥信息和安全域的标识 ID、 域名信息派生。
PCT/CN2009/072447 2008-06-30 2009-06-25 一种网络认证的方法、装置、系统及服务器 WO2010000185A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP09771955A EP2293611A4 (en) 2008-06-30 2009-06-25 METHOD, DEVICE, SYSTEM AND SERVER FOR NETWORK AUTHENTICATION
US12/962,352 US20110078442A1 (en) 2008-06-30 2010-12-07 Method, device, system and server for network authentication

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200810068193A CN101621374A (zh) 2008-06-30 2008-06-30 一种网络认证的方法、装置、系统及服务器
CN200810068193.9 2008-06-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/962,352 Continuation US20110078442A1 (en) 2008-06-30 2010-12-07 Method, device, system and server for network authentication

Publications (1)

Publication Number Publication Date
WO2010000185A1 true WO2010000185A1 (zh) 2010-01-07

Family

ID=41465496

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/072447 WO2010000185A1 (zh) 2008-06-30 2009-06-25 一种网络认证的方法、装置、系统及服务器

Country Status (5)

Country Link
US (1) US20110078442A1 (zh)
EP (1) EP2293611A4 (zh)
KR (1) KR20110021945A (zh)
CN (1) CN101621374A (zh)
WO (1) WO2010000185A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120077461A1 (en) * 2010-09-27 2012-03-29 Infosys Technologies Ltd. Method and system for preauthenticating a mobile node

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101321395B (zh) * 2008-06-24 2012-01-11 中兴通讯股份有限公司 下一代网络中支持移动性安全的方法与系统
CN101730093B (zh) * 2009-02-20 2013-01-16 中兴通讯股份有限公司 安全切换方法及系统
CN102131192B (zh) * 2010-01-15 2016-06-15 中兴通讯股份有限公司 Ngn中保护三层移动性用户面数据安全的方法和系统
US8719568B1 (en) * 2011-06-30 2014-05-06 Cellco Partnership Secure delivery of sensitive information from a non-communicative actor
US20130074158A1 (en) * 2011-09-20 2013-03-21 Nokia Corporation Method and apparatus for domain-based data security
CN103312499B (zh) 2012-03-12 2018-07-03 西安西电捷通无线网络通信股份有限公司 一种身份认证方法及系统
CN103312670A (zh) * 2012-03-12 2013-09-18 西安西电捷通无线网络通信股份有限公司 一种认证方法及系统
CN103490887B (zh) 2012-06-14 2017-06-13 中兴通讯股份有限公司 一种网络设备及其认证和密钥管理方法
FR3007920A1 (fr) * 2013-06-28 2015-01-02 France Telecom Procede de changement de cle d'authentification
CN103634796B (zh) * 2013-12-06 2017-02-01 北京航空航天大学 一种空天信息网络漫游可信安全接入方法
US9264900B2 (en) * 2014-03-18 2016-02-16 Huawei Technologies Co., Ltd. Fast authentication for inter-domain handovers
CN105991602A (zh) * 2015-02-26 2016-10-05 北京神州泰岳信息安全技术有限公司 数据访问方法及数据访问系统
CN104916101B (zh) * 2015-04-14 2018-07-06 北京网河时代科技有限公司 蓝牙4.0墙壁开关控制系统
ES2896057T3 (es) * 2015-10-08 2022-02-23 Ericsson Telefon Ab L M Nodo para su uso en una red de comunicación y método para operar el mismo
CN106209374B (zh) * 2016-06-24 2019-02-15 西安电子科技大学 基于卫星网络安全域的节点证书颁布方法
CN113766498B (zh) * 2020-06-01 2023-03-21 中国电信股份有限公司 密钥分发方法、装置、计算机可读存储介质及基站

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005015938A1 (en) * 2003-08-01 2005-02-17 Ntt Docomo, Inc. Inter-domain handover
CN1794682A (zh) * 2005-07-11 2006-06-28 华为技术有限公司 一种在无线接入网中建立安全通道的方法
CN1905734A (zh) * 2005-07-25 2007-01-31 华为技术有限公司 一种目标基站获取鉴权密钥的方法及系统
CN1921379A (zh) * 2005-08-25 2007-02-28 华为技术有限公司 一种目标鉴权者/密钥提供者获取密钥的方法
JP2008015696A (ja) * 2006-07-04 2008-01-24 Softbank Mobile Corp 認証方法、移動通信端末装置、ドメインシステム、ホームドメインシステム及び認証システム

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7461248B2 (en) * 2004-01-23 2008-12-02 Nokia Corporation Authentication and authorization in heterogeneous networks
KR100755394B1 (ko) * 2006-03-07 2007-09-04 한국전자통신연구원 Ｕｍｔｓ와 무선랜간의 핸드오버 시 ｕｍｔｓ에서의 빠른재인증 방법
US20080072047A1 (en) * 2006-09-20 2008-03-20 Futurewei Technologies, Inc. Method and system for capwap intra-domain authentication using 802.11r

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005015938A1 (en) * 2003-08-01 2005-02-17 Ntt Docomo, Inc. Inter-domain handover
CN1794682A (zh) * 2005-07-11 2006-06-28 华为技术有限公司 一种在无线接入网中建立安全通道的方法
CN1905734A (zh) * 2005-07-25 2007-01-31 华为技术有限公司 一种目标基站获取鉴权密钥的方法及系统
CN1921379A (zh) * 2005-08-25 2007-02-28 华为技术有限公司 一种目标鉴权者/密钥提供者获取密钥的方法
JP2008015696A (ja) * 2006-07-04 2008-01-24 Softbank Mobile Corp 認証方法、移動通信端末装置、ドメインシステム、ホームドメインシステム及び認証システム

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2293611A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120077461A1 (en) * 2010-09-27 2012-03-29 Infosys Technologies Ltd. Method and system for preauthenticating a mobile node
US9491619B2 (en) * 2010-09-27 2016-11-08 Infosys Technologies Ltd. Method and system for preauthenticating a mobile node

Also Published As

Publication number Publication date
CN101621374A (zh) 2010-01-06
US20110078442A1 (en) 2011-03-31
EP2293611A1 (en) 2011-03-09
KR20110021945A (ko) 2011-03-04
EP2293611A4 (en) 2011-06-22

Similar Documents

Publication Publication Date Title
WO2010000185A1 (zh) 一种网络认证的方法、装置、系统及服务器
EP1597866B1 (en) Fast re-authentication with dynamic credentials
EP1707024B1 (en) Improvements in authentication and authorization in heterogeneous networks
EP2103077B1 (en) Method and apparatus for determining an authentication procedure
JP4586071B2 (ja) 端末へのユーザポリシーの提供
KR100602260B1 (ko) 고속 핸드오버 방법
EP1693995B1 (en) A method for implementing access authentication of wlan user
WO2019017837A1 (zh) 网络安全管理的方法及装置
EP2939391B1 (en) Method and system for secure network access
KR20100054178A (ko) 이동 통신 시스템에서 단말 보안 능력 관련 보안 관리 방안및 장치
US20080026724A1 (en) Method for wireless local area network user set-up session connection and authentication, authorization and accounting server
US8611859B2 (en) System and method for providing secure network access in fixed mobile converged telecommunications networks
JP4687788B2 (ja) 無線アクセスシステムおよび無線アクセス方法
US8661510B2 (en) Topology based fast secured access
JP2013533535A (ja) パケットネットワークにおけるアプリケーションレイヤ認証
WO2013166934A1 (zh) 一种实现漫游切换的方法和装置
JP2008537644A (ja) 無線ネットワークにおけるモバイルユニットの高速ローミングの方法およびシステム
WO2011137823A1 (zh) 密钥隔离方法和装置
WO2010069202A1 (zh) 认证协商方法及系统、安全网关、家庭无线接入点
Sharma et al. Improved IP multimedia subsystem authentication mechanism for 3G-WLAN networks
WO2013152740A1 (zh) 用户设备的认证方法、装置及系统
US9137661B2 (en) Authentication method and apparatus for user equipment and LIPA network entities
JP2006041594A (ja) 移動通信システムおよび移動端末の認証方法
Chen et al. A seamless handoff mechanism for DHCP-based IEEE 802.11 WLANs
KR20100021690A (ko) 이동 통신 시스템의 인증과 비계층 프로토콜 보안 운영을 효율적으로 지원하는 관리 방법 및 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09771955

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2009771955

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20107029076

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE