WO2010048805A1

WO2010048805A1 - An application service accessing authenticity method and an application service accessing authenticity agent server

Info

Publication number: WO2010048805A1
Application number: PCT/CN2009/071728
Authority: WO
Inventors: 王伟
Original assignee: 华为技术有限公司
Priority date: 2008-10-27
Filing date: 2009-05-11
Publication date: 2010-05-06
Also published as: CN101729578A; CN101729578B

Abstract

An application service accessing authenticity method and an application service accessing authenticity agent server are provided. The application service accessing authenticity method includes: an access request transmitted from the registered application service provider terminal is received after registering an application service and obtaining the password of the application service, the password of the application service is carried on the access request, and access authenticity to the application service is preformed based on the password of the application service. The application of the above technique scheme can realize the access authenticity of the single application service, extend the scope of the access authenticity, and increase the open size of the telecommunication service ability.

Description

Application service access authentication method and access authentication proxy server

This application claims the priority of the Chinese patent application filed on October 27, 2008, the Chinese Patent Office, the application number is 200810171219.2, and the invention is entitled "Application Service Access Authentication Method and Access Authentication Agent". The citations are incorporated herein by reference.

Technical field

The present invention relates to the field of communications technologies, and in particular, to an application service access authentication method and an access authentication proxy server.

Background technique

With the development of telecommunications technology, the increasingly open telecom service market continues to enter new competitors. In order to find new business development space, telecom operators have begun to provide ICT (Information Communication Technology) in addition to providing traditional network communication services. , Information and Communication Technology) Yueliang. ICT is a new concept and new technology field formed by the integration of information technology and communication technology. The development of ICT service has become the consensus of information service providers and telecom operators. The key to ICT services is how to better open up telecommunications capabilities, enabling telecommunications capabilities and the rich application services on the Internet to be more convenient and easier to combine, thus providing users with more colorful telecom value-added services.

In 2005 Parlay organized the Parlay X Web Services specification, a powerful but simple, highly abstract standard component of telecommunications network capabilities. Whether developers have telecommunications expertise or not, they can quickly understand Parlay X Web Services and use it to develop unique applications. Parlay/OSA (Parlay/Open Service Architecture, Parlay Development Service Architecture) provides the following access authentication and SLA (Service Level Agreement) policy control mechanisms:

The application service developer (or individual) can apply to the operator as an SP (Service Provider), and the operator assigns the SPID (Service Provider ID) and password to the SP;

When accessing the telecom service capability interface function entity, the SP application service encrypts the SPID + password + time stamp, the form string, and transmits the encrypted string to the telecommunication service capability interface function entity, where the telecommunications The service capability interface function entity may be an Open Service Gateway (OSG);

The telecommunication service capability interface function entity queries the SP password through the SPID passed by the SP, and performs verification using the same encryption algorithm as the SP; The telecommunication service capability interface function entity may perform access control on the application request of the SP according to a preset SLA policy. For example, limiting the number of times the application service of the SP or the SP is used within a prescribed time period, and the like.

In the process of implementing the present invention, the inventor has found that at least the following problems exist in the prior art: According to the existing authentication method, only the access of the SP can be authenticated, so the application service developer (or individual) must first Applying to become an SP can access the telecommunications network, which greatly limits the openness of the telecommunications service capability and is not conducive to the development of telecom value-added services. In addition, direct exposure of telecom service capability interface functional entities (such as OSG) to the public network also poses significant security risks and performance pressures. Summary of the invention

In view of this, the embodiment of the present invention provides an application service access authentication method and an access authentication proxy server, so as to directly perform access authentication on a single application service, and increase the openness of the telecommunication service capability, and the technical solution. as follows:

An application service access authentication method, after registering an application service and obtaining a password of an application service, the method includes:

Receiving an access request sent by the provider of the registered application service, where the access request carries a password of the application service, and performs access authentication on the application service according to the password of the application service.

An application service access authentication proxy server includes:

a registration management unit, configured to register an application service and obtain a password of the application service; and an access authentication unit, configured to receive an access request sent by the provider of the registered application service, where the access request carries the The password of the application service is used to perform access authentication on the application service according to the password of the application service.

By applying the above technical solutions, access authentication for a single application service can be realized, application service development by an ordinary developer, or application for accessing an application service access authentication proxy server and trial use of a telecommunication service capability can be directly expanded. The scope of access authentication has increased the openness of telecommunications services. In addition, the access authentication proxy server is used to complete the access authentication control, so that the telecom service capability interface functional entity is not directly opened to the public network, which improves the security and reduces the performance burden of the telecom service capability interface functional entity.

DRAWINGS

Figure 1 is a flow chart showing a specific embodiment of the method of the present invention; 2 is a schematic structural diagram of an application service access proxy server according to an embodiment of the present invention; FIG. 3 is a schematic structural diagram of a registration management unit according to an embodiment of the present invention;

4 is a schematic structural diagram of an access authentication unit according to an embodiment of the present invention, and FIG. 4a and FIG. 4b are schematic structural diagrams of two different access authentication units;

FIG. 5 is a schematic structural diagram of another application service access authentication proxy server according to an embodiment of the present invention; FIG.

FIG. 6 is another schematic structural diagram of an access authentication unit according to an embodiment of the present invention.

detailed description

First, an application service access authentication method according to an embodiment of the present invention is described:

After the application service is registered and the password of the application service is obtained, the method includes: receiving an access request sent by the provider of the registered application service, where the access request carries a password of the application service, according to the Apply the password of the service to perform access authentication on the application service.

The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

FIG. 1 is a flowchart of a method according to an embodiment of the present invention, which specifically includes the following steps: S101: An application service provider sends an application service registration request to an application service access authentication proxy server, where the registration request carries an application service. The address of the provider and the address of the application service.

The account number may be an SPID assigned by the operator, or may be a mobile phone number or an email address. The address of the application service may be a unique identifier of the application service, which may be a URL (Uniform Resource Locator) corresponding to the application service, or an Internet Protocol address: port number (IP: corresponding to the application service). Port ),, and other forms.

S102. The application service access authentication proxy server generates a password according to an address of the application service. The application service access proxy server generates a password through an irreversible encryption algorithm according to the address of the application service, and saves the correspondence between the generated password and the application service address information and the provider account of the application service. The manner of the storage is as shown in Table 1. It should be noted that the form of Table 1 is merely illustrative, and the embodiment of the present invention does not limit this. Application service address information password account

URL1 Pwdl Namel

URL2 Pwd2 Namel

IP: Portl Pwd3 Name2

IP: Port2 Pwd4 Name3 Table 1

5103. The application service access authentication proxy server sends a registration response to the provider end of the application service, and sends the generated password to the application service provider.

The application service access proxy server can notify the application service provider of the generated password by means of short message or email.

5104. The provider of the application service sends an access request to the application service access authentication proxy server, where the access request carries the password of the application service.

The application service to be accessed should be an already-registered application service. To ensure secure transmission, the access request can be sent to the service access authentication proxy server in accordance with a secure HTTP (Hyper Text Transfer Protocol).

5105. The service access authentication proxy server performs access authentication on the application service according to the access request.

In the access request, the account and the password of the application service are carried, and the service access authentication proxy server queries the corresponding address information according to the account and the password. For example, through Table 1, the account "Namel" can be queried. The address information corresponding to the password "Pwdl" is URL1. The queried address information is matched with the address of the application service that is currently requested to be accessed. If the matching is successful, the access authentication of the application service is performed.

It should be noted that, because the password is generated according to the address of the application service and is generated by using an irreversible algorithm, the access request may also carry only the password of the application service. The service access authentication proxy server can query the corresponding address information only according to the password, and further perform address matching to implement access authentication of the application service.

After the authentication is passed, the access authentication proxy server can send the access request to the telecommunication service capability. The port function entity, such as the OSG, accesses the application service to the telecommunication network by the OSG.

It should be noted that, for convenience of description, the above embodiment includes both the registration process of the application service (S101-S103) and the process of access authentication (S104-S105). In the actual application, if the application service that is ready to access has been successfully registered, the access authentication step of S104-S105 can be directly performed.

In a preferred embodiment of the present invention, after the authentication is passed, the service access authentication proxy server may also perform policy configuration on the application service that is authenticated by access, for example, may set an application service that restricts all access or a single The number of times the application service access is used within a specified time, such as N times/day, or N times/month. If the access authentication proxy server has previously configured the policy for the application service when the application service requests access, in the foregoing S105, after the password matching is successful, the application may be applied according to the pre-configured policy. The service performs a policy check. If the policy check is passed, the access authentication of the application service is considered to pass.

It can be seen that, by applying the above method, access authentication can be implemented for a single application service, and an application service developer can access the telecommunication network without applying to become an SP. Even an application developer developed by an ordinary developer can directly apply for access. The access to the telecom service access authentication proxy server and the trial of the telecommunication service capability expand the scope of access authentication, increase the openness of the telecommunication service capability, and facilitate the provision of richer value-added services to end users. In addition, the access authentication proxy server completes the access authentication control, so that the telecommunication service capability interface function entity is not directly opened to the public network, which improves the security and reduces the performance burden of the telecommunication service capability interface functional entity. The embodiment of the present invention further provides an application service access authentication proxy server, as shown in FIG. 2, including:

The registration management unit 201 is configured to register an application service and obtain a password of the application service. The access authentication unit 202 is configured to receive an access request sent by the provider of the registered application service, where the access request is carried in the access request. The password of the application service is used to perform access authentication on the application service according to the password of the application service.

Referring to FIG. 3, the registration management unit 201 may specifically include:

The password generating sub-unit 301 is configured to receive a registration request sent by the provider of the application service, where the registration request carries an account of the provider end of the application service and an address of the application service, according to the application industry. The address of the service generates a password;

The password management sub-unit 302 is configured to save a correspondence between the password generated by the password generating sub-unit 301 and the application service address information and the provider account of the application service;

The password sending subunit 303 is configured to send the password generated by the password generating subunit 302 to the provider end of the application service.

As shown in FIG. 4a, the access authentication unit 202 may specifically include:

The first password query sub-unit 401 is configured to receive an access request sent by the provider of the registered application service, and query the corresponding address information according to the password of the application service carried in the access request and the corresponding relationship;

The first password matching sub-unit 402 is configured to match the address information queried by the first cryptographic query sub-unit 401 with the address of the application service, and if the matching is successful, access authentication through the application service .

The access request received by the cipher generation sub-unit 301 further includes an account of the Provider of the application service, and the composition of the access authentication unit may also be as shown in FIG. 4b, specifically including: The query sub-unit 403 is configured to receive an access request sent by the provider of the registered application service, according to the account of the application end of the application service carried in the access request, the password of the application service, and the corresponding relationship, and the corresponding query is performed. Address information;

The second password matching sub-unit 404 is configured to match the address information queried by the second cryptographic query sub-unit 403 with the address of the application service, and if the matching is successful, access authentication through the application service . The embodiment of the present invention further provides another application service access authentication proxy server. Referring to FIG. 5, compared with the application service access authentication proxy server shown in FIG. 2, the difference is that the access profile is The proxy server further includes:

a policy configuration unit 503, configured to perform policy configuration on an application service authenticated by the access authentication unit 502;

The registration management unit 501 is the same as the registration management unit 201 described above;

As shown in FIG. 6, the access authentication unit 502 may specifically include:

The password query subunit 601 is configured to receive the access sent by the provider of the registered application service. And requesting, according to the password of the application service carried in the access request and the corresponding relationship, querying the corresponding address information;

a password matching subunit 602, configured to match address information queried by the password query subunit with an address of the application service;

The policy check sub-unit 603, if the password matching sub-units are successfully matched, perform a policy check on the application service according to a policy pre-configured by the policy configuration unit 503, and if the policy check passes, pass the application service. Access authentication.

For the device embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment. The above application service access authentication proxy server can provide functions such as registration management, access authentication, and policy management of the application service. Access authentication can be implemented for a single application service, thereby expanding the scope of access authentication and increasing the openness of the telecommunications service capability. When the authentication proxy server can be deployed as a module, the telecom service capability interface function entity can be directly opened to the public network, which improves security and reduces the performance burden of the telecom service capability interface functional entity.

It should be noted that the authentication proxy server provided by the embodiment of the present invention may be deployed as a single module or as an extended function module of a telecommunication service capability interface functional entity, where the registration management unit, the access authentication unit or the policy The configuration unit can be used as part of the telecommunications service capability interface functional entity function. The units described as the separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. . Some or all of the modules may be selected according to actual needs to achieve the objectives of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without the creative labor.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

The above is only a specific embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

Rights request

An application service access authentication method, characterized in that after registering an application service and obtaining a password of an application service, the method includes:

The method according to claim 1, wherein the registering the application service and obtaining the password of the application service includes:

Receiving a registration request sent by the provider of the application service, where the registration request carries an account of the provider of the application service and an address of the application service, and generates the password according to the address of the application service;

Corresponding relationship between the generated password and the application service address information and the provider account of the application service is saved, and the generated password is sent to the provider end of the application service.

The method according to claim 2, wherein the performing access authentication on the application service according to the password of the application service includes:

Querying the corresponding address information according to the password and the corresponding relationship carried in the access request, and matching the queried address information with the address of the application service. If the matching succeeds, the application service is adopted. Access authentication.

The method according to claim 3, wherein the access request further carries an account of the provider of the application service, and the method further includes:

And authenticating the provider end of the application service according to the account of the provider end of the application service.

The method according to claim 2, further comprising: performing policy configuration on an application service that is authenticated by access.

The method according to claim 5, wherein the performing the policy configuration on the application service that is authenticated by the access includes: configuring the number of times the application service is used within a specified time.

The method according to claim 5 or 6, wherein the performing access authentication on the application service according to the password of the application service includes:

According to the password and the corresponding relationship, query the corresponding address information, and match the queried address information with the address of the application service; if the matching is successful, according to the pre-configured policy The policy check is performed on the application service. If the policy check is passed, the access authentication of the application service is performed.

8. An application service access authentication proxy server, comprising:

The access authentication proxy server according to claim 8, wherein the registration management unit comprises:

a password generating subunit, configured to receive a registration request sent by the provider of the application service, where the registration request carries an account of the provider end of the application service and an address of an application service, and generates the identifier according to the address of the application service. Password

a password management subunit, configured to store a correspondence between a password generated by the password generation subunit and an application service address information and a provider account of the application service;

a password sending subunit, configured to send a password generated by the password generating subunit to a provider end of the application service.

The access authentication proxy server according to claim 9, wherein the access authentication unit comprises:

The first password query sub-unit is configured to receive an access request sent by the provider of the registered application service, and query the corresponding address information according to the password of the application service carried in the access request and the corresponding relationship;

The first password matching sub-unit is configured to match the address information queried by the first cryptographic query sub-unit with the address of the application service, and if the matching is successful, pass the access authentication of the application service.

The access authentication proxy server according to claim 9, wherein the access request received by the cryptographic generating subunit further carries an account of the Provider of the application service, and the access The authentication unit, including:

a second password query sub-unit, configured to receive an access request sent by the provider of the registered application service, according to the account of the application end of the application service carried in the access request, the password of the application service, and the Corresponding relationship, querying the corresponding address information;

The second password matching sub-unit is configured to match the address information queried by the second cryptographic query sub-unit with the address of the application service, and if the matching is successful, pass the access authentication of the application service.

The access authentication proxy server according to claim 9, wherein the access authentication proxy server further comprises:

The policy configuration unit is configured to perform policy configuration on the application service authenticated by the access authentication unit.

The access authentication proxy server according to claim 12, wherein the access authentication unit comprises:

a password query subunit, configured to receive an access request sent by a provider of the registered application service, and query the corresponding address information according to the password of the application service carried in the access request and the corresponding relationship;

a password matching subunit, configured to match address information queried by the password query subunit with an address of the application service;

a policy check sub-unit, if the password matching sub-units are successfully matched, performing a policy check on the application service according to a policy pre-configured by the policy configuration unit, and if the policy check passes, accessing the application service Authentication.