WO2010105469A1

WO2010105469A1 - Authentication method and system for mobile multimedia broadcasting conditional access

Info

Publication number: WO2010105469A1
Application number: PCT/CN2009/073976
Authority: WO
Inventors: 宋玉林
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-03-17
Filing date: 2009-09-16
Publication date: 2010-09-23
Also published as: CN101505462B; BRPI0923999A2; CN101505462A

Abstract

The invention discloses an authentication method and a system for mobile multimedia broadcasting conditional access, and the authentication method includes the following steps: a front end authenticates a terminal which requests a special key, and when the authentication is successful, the front end groups the special key and transmits the special key to the terminal through a two-way channel and a one-way channel. The system includes the front end and the terminal. The invention enables the data transmission in the authentication process through the method of combining the two-way channel with the one-way channel, and improves the security of the information transmission.

Description

Authentication method and system for mobile multimedia broadcast conditional reception

Technical field

The present invention relates to the field of mobile multimedia broadcasting in China, and in particular, to an authentication method and system for receiving mobile multimedia broadcast conditions.

Background technique

China Mobile Multimedia Broadcasting (CMMB) is the industry standard led and recommended by the State Administration of Radio, Film and Television. The CMMB is a broadcast one-way data transmission channel, so that in addition to audio and video signals that can transmit television programs and broadcast programs, various electronic data can be transmitted through it. CMMB mainly provides broadcast TV services for small-screen portable handheld terminals such as mobile phones and PDAs, as well as terminals such as car TVs.

At present, CMMB terminal playback clearing is relatively simple; for playing encrypted stream, CMMB proposes "Mobile multimedia broadcasting-Conditional Access System (MMB-CAS), MMB-CAS can be mobile multimedia broadcasting service. Provides protection during transmission, that is, protection for unidirectional channels and bidirectional channels of services. Mobile multimedia broadcast operators usually add MMB-CAS conditional access control mechanisms for mobile multimedia services during broadcast. MMMMB-CAS, mobile The multimedia broadcast operator can authorize the specified user or user group for the service or service package, so that only authorized users or user groups can receive related services.

MMB-CAS is divided into two parts: the front-end subsystem and the terminal subsystem. The location in the mobile multimedia broadcasting system is shown in Figure 1. Among them, the bidirectional channel (such as the short message channel) is optional, and can provide a point-to-point data interaction channel between the front end and the mobile multimedia receiving terminal. The conditional access system defined and specified in this section can be applied to both unidirectional channels (such as broadcast channels) and to the combination of unidirectional channels and bidirectional channels.

In the case of a unidirectional channel or a unidirectional terminal, the MMB-CAS can authorize the user through the front-end authorization information to the terminal, or use the encryption authorization and the electronic wallet function together, and realize the user self-authorization through the terminal local interaction mode. . In the case that both the unidirectional channel and the bidirectional channel and the bidirectional terminal are available, the MMB-CAS can also use the bidirectional channel to communicate with the terminal in a peer-to-peer manner. User authorization.

MMB-CAS is based on a four-layer key model. As shown in Figure 2, a key security management and authorization control management and distribution mechanism is established, and the scrambling technology is used to implement conditional reception of services. The entire key model includes the user registration layer, authorization/security management layer, authorization control layer, and service scrambling layer. The model is characterized by key layer protection; each key has its own life cycle; the lower layer key is encrypted by the upper layer key and transmitted.

The user registration layer implements the preset of the user key (UK) in the terminal security module, or implements user key distribution in the two-way registration mode. The UK is used to encrypt/decrypt the Service Encryption Key (SEK).

Authorize the management layer to implement the secure transfer of data from the front-end to the terminal. The front end uses the UK to encrypt the SEK information, generates an EMM, transmits it to the terminal through a broadcast or two-way channel, and the terminal decrypts to obtain the SEK.

The SEK is used to encrypt/decrypt the control word (CW, Control Word).

The security management layer implements secure transmission of system signaling data from the front end to the terminal. The system signaling is usually encapsulated in the EMM by using UK encryption, transmitted to the terminal through a broadcast or bidirectional channel, and the terminal decrypts to obtain system signaling. Use system signaling for system security control, key management, function management, and more.

The authorization control layer implements secure transfer of authorization control information (ECM) data from the front end to the terminal. The front end uses the SEK to encrypt the CW, generates the ECM, transmits it to the terminal through the broadcast channel, and decrypts the terminal to obtain the CW. CW is used to scramble/descramble the transmitted traffic.

The service scrambling layer implements secure transmission of business data from the front end to the terminal. The front end uses CW to scramble the service and transmit it to the terminal through the broadcast channel. The terminal uses CW to descramble the scrambled service.

The Entitlement Manager Message (EMM) carrying the service key is distributed through the broadcast channel, and can also be distributed through the bidirectional channel under the condition of an optional bidirectional channel.

The user key can be preset in the security module of the MMB-CAS terminal in Figure 1, and can be distributed through the bidirectional channel in the case of an optional bidirectional channel.

As can be seen from Figure 2, UK and SEK can be sent in one direction or two directions, and single channel transmission is easy to be eavesdropped during transmission, thus affecting the security of information transmission. Summary of the invention

The technical problem to be solved by the present invention is to solve the problem of low security of data transmission using a single channel in a mobile multimedia broadcast condition receiving system.

To solve the above technical problem, the present invention provides an authentication method for mobile multimedia broadcast condition receiving, the method comprising:

The front end authenticates the terminal requesting the specific key. When the authentication succeeds, the front end group specifies the specific key and sends the specific key to the terminal through the bidirectional channel and the unidirectional channel.

Further, in the above method, the process of authenticating the terminal by the front end is as follows: the front end sends an authentication parameter to the terminal, and the terminal sends the authentication response result after obtaining the authentication parameter And the front end determines, according to the result of the authentication response, whether the authentication is successful.

Further, in the above method, when the front end sends the authentication parameter to the terminal, the front end sends the authentication parameter to the terminal through the bidirectional channel and the unidirectional channel.

Further, before the step of sending the authentication parameter to the terminal at the front end, the method further includes:

The front end generates a random value corresponding to the terminal when the terminal opens an account and sends the random value to the terminal;

The front end analyzes the random value to obtain the number of authentication parameters and the number of transmission authentication parameters of each channel, and according to the obtained number of authentication parameters and the number of transmission parameters transmitted by each channel, randomness A specific authentication parameter delivered by the bidirectional channel and delivered through the unidirectional channel is determined.

Further, in the above method, the authentication response result includes an authentication parameter and an authentication response value, and determining whether the authentication succeeds is performed according to the following process: the front end first determines the received authentication parameter and the front end storage Whether the authentication parameters are consistent, if not, the terminal is considered to be illegal, and the authentication fails. If the agreement is consistent, the front end further calculates an authentication response value according to the authentication parameter, and the front end determines the calculated authentication response value. Whether the authentication response value sent by the terminal is consistent. If the authentication is successful, the authentication succeeds. If the authentication is inconsistent, the authentication fails.

Further, in the above method, the front end transmits the authentication parameter, the specific key to the terminal, and the terminal sends an authentication response result to the front end, and one end of the sending information passes The random value is encrypted after the transmitted information is sent, and the received information is received. The terminal decrypts the received information by the random value.

Further, in the above method, the specific key is a user key or a bearer service key. Further, in the above method, the bidirectional channel is a short message channel, and the unidirectional channel is a broadcast channel.

The invention further provides a system for receiving mobile multimedia broadcast conditions, the system comprising: a front end and a terminal, the front end comprising a front end service control module, a first bidirectional channel transmission and reception module and a unidirectional channel transmission module The terminal includes a terminal service control module, a second bidirectional channel transmission and reception module, and a unidirectional channel receiving module, where:

The terminal service control module is configured to: after the terminal opens the account, send information that is requested by the specific key to the front end, and after the terminal obtains the authentication parameter from the front end, pass the authentication response result Transmitting and receiving the first bidirectional channel sending and receiving module sent by the second bidirectional channel transmitting and receiving module to the front end;

The front-end service control module is configured to send an authentication parameter to the terminal and receive the authentication response result at the front end after the front end receives the information sent by the terminal requesting the specific key. And determining, according to the result of the authentication response, whether the authentication is successful, and if the authentication is successful, sending, by the first bidirectional channel sending and receiving module and the unidirectional channel sending module, the specific key to the corresponding end of the terminal. The second bidirectional channel transmitting and receiving module and the unidirectional channel receiving module.

Further, in the above system, the front end includes a front end random value generation and maintenance module, and the front end random value generation and maintenance module is configured to generate a random value corresponding to the terminal when the terminal opens an account and pass the first The bidirectional channel transmitting and receiving module sends the random value to the second bidirectional channel transmitting and receiving module of the terminal; the front end service control module is further configured to analyze the random value to obtain the number of authentication parameters and transmit authentication of each channel. The number of parameters, and according to the number of the obtained authentication parameters and the number of transmission authentication parameters of each channel, randomly determine the sending and receiving module sent by the first bidirectional channel and the unidirectional channel sending module Specific authentication parameters.

The present invention further provides a front end for mobile multimedia broadcast conditional reception, the front end includes a front end service control module, a first bidirectional channel transmission and reception module, and a unidirectional channel transmission module, where The front-end service control module is configured to: after the front end receives the information sent by the terminal requesting the specific key, send the authentication parameter to the terminal; and

After the front end receives the authentication response result, it is determined whether the authentication is successful according to the result of the authentication response. If the authentication succeeds, the first bidirectional channel sending and receiving module and the unidirectional channel sending module send the specific secret. The key is sent to the second bidirectional channel transmitting and receiving module and the unidirectional channel receiving module of the terminal.

Further, the front end further includes a front end random value generation and maintenance module, where the front end random value generation and maintenance module is configured to generate a random value corresponding to the terminal and send and receive through the first bidirectional channel when the terminal opens an account. Sending, by the module, the generated random value to the second bidirectional channel sending and receiving module of the terminal;

The front-end service control module is further configured to analyze the random value to obtain the number of authentication parameters and the number of transmission authentication parameters of each channel, and transmit the authentication parameters according to the obtained number of authentication parameters and each channel. The number, the specific authentication parameter sent by the first bidirectional channel sending and receiving module and sent by the unidirectional channel sending module is determined.

The present invention also provides a mobile multimedia broadcast condition receiving terminal, the terminal includes a terminal service control module, a second bidirectional channel transmission and reception module, and a unidirectional channel receiving module, wherein the terminal service control module is configured to: After the terminal is opened, the information sent by the specific key is sent to the front end, and after the terminal obtains the authentication parameter from the front end, the authentication response result is sent to the second bidirectional channel sending and receiving module. The first bidirectional channel of the front end transmits and receives a module.

Compared with the prior art, the present invention implements data transmission in the authentication process by combining a unidirectional channel and a bidirectional channel, thereby improving the security of information transmission.

BRIEF abstract

1 is a block diagram of a conventional mobile multimedia broadcast condition receiving system;

2 is a schematic diagram of a four-layer key of a conventional mobile multimedia broadcast condition receiving system; 3 is a block diagram of a system for receiving mobile multimedia broadcast conditions according to a preferred embodiment of the present invention; FIG. 4 is a flow chart showing the operation of the system of FIG.

FIG. 5 is a flow chart of an authentication method for mobile multimedia broadcast conditional reception according to a preferred embodiment of the present invention.

Preferred embodiment of the invention

The invention provides an authentication method and system for mobile multimedia broadcast condition receiving, which realizes data transmission in the authentication process, and performs data transmission than a single broadcast channel or a simple bidirectional channel, and the authentication security is higher. The invention will now be described in detail in conjunction with the drawings and embodiments.

Referring to FIG. 3, a system for receiving a mobile multimedia broadcast condition according to a preferred embodiment of the present invention includes a

The MMB-CAS front end 32 and an MMB-CAS terminal 31, the MMB-CAS front end 32 includes a front end RAND generation maintenance module 321, a front end service control module 322, a first short message transmission and reception module 323, and a broadcast transmission module 324. . The MMB-CAS terminal 31 includes a terminal RAND maintenance module 311, a terminal service control module 312, a second short message transmission and reception module 313, and a broadcast receiving module 314. The front end RAND generation maintenance module 321 is configured to generate and store RAND (random value), and the front end service control module 322 is configured to control the front end business operation. When the MMB-CAS terminal 31 is opened, the RAND generation module 321 of the MMB-CAS front end 32 generates a RAND corresponding to the MMB-CAS terminal 31.

RAND has a certain validity period. If the RAND expires, the front end RAND generation maintenance module 321 of the MMB-CAS front end 32 sends a text message to the MMB-CAS terminal 31, and the number of authentication parameters that the RAND knows after analysis and each channel The information of the number of transmission authentication parameters, RAND is used to encrypt or decrypt the transmitted information.

The present invention is mainly directed to the security protection performed when the user registration layer and the authorization key of the authorization and security management layer are authenticated. The protection principle applied in the two layers is the same. The authentication process is described in detail below.

4 is a flow chart showing the operation of a mobile multimedia broadcast conditional receiving system according to a preferred embodiment of the present invention, the process comprising the steps of:

S401: When the MMB-CAS terminal 31 is opened, the front end of the MMB-CAS front end 32 is RAND The maintenance module 321 generates the RAND and sends the RAND to the second short message sending and receiving module 313 of the MMB-CAS terminal 31 by the first short message sending and receiving module 323 by SMS;

S402: If the MMB-CAS terminal 31 is to request a specific key (user key or service key), the terminal service control module 312 sends the first request to the MMB-CAS front end 32 by using the second short message sending and receiving module 313 by short message. SMS sending and receiving module 323;

S403: After the MMB-CAS front end 32 receives the short message, the front end service control module 322 determines that there are several authentication parameters and the number of each channel transmission authentication parameter according to the RAND analysis, and the first sending of the first short message is performed by the broadcast sending module 324. The sending and receiving module 323 sends the number of the authentication parameters, and the RAND of the maintenance module 321 is used to encrypt the authentication parameters by the RAND of the front end RAND, so that the confidentiality of the information sent by the two channels can be ensured, and the information is not easily captured by the other party. ;

S404: After receiving the broadcast and short message channel information, the broadcast service receiving module 314 and the second short message sending and receiving module 313 of the MMB-CAS terminal 31, the terminal service control module 312 analyzes the number of RAND analysis authentication parameters stored by the terminal RAND maintenance module 311, and The number of identification parameters transmitted by each channel, so that the complete content of the message can be effectively obtained, and after the authentication parameters are completely received, the required original text is obtained by RAND decryption. After obtaining the original text, an authentication response value is calculated by an algorithm negotiated with the MMB-CAS front end 32, and then the authentication response result (all authentication parameters and the authentication response value) is encrypted by RAND and sent through the second short message. The receiving module 313 sends the short message to the first short message sending and receiving module 323 of the MMB-CAS front end 32;

By analyzing RAND, you can know the complete content of the message. For example: The MMB-CAS front end generates a specific five parameters, and the five parameters are different. The analysis RAND can know the number of two channels sent, and the specific allocation is random. The MMB-CAS terminal 31 can obtain all the parameters according to the total number of authentication parameters and the number of transmissions of the two channels;

The specific operation is to obtain the authentication response value corresponding to the authentication parameter through some algorithms. For example: The MMB-CAS front end 32 generates five authentication parameters: al, a2, 23, a4, a5. The algorithm uses these parameters as input parameters. Do some operations, such as the function F( );

Al, a2, 23, a4, a5 -> F(al, a2, 23, a4, a5) - >responce value;

S405: After receiving the authentication parameter and the authentication response value from the MMB-CAS terminal 31, the front end service control module 322 decrypts all the authentication parameters according to the RAND and the MMB-CAS front end 32. The authentication response value is compared with the authentication parameter stored by the front-end service control module 322. If the parameters are inconsistent, the MMB-CAS terminal 31 is considered to be illegal, and the request of the MMB-CAS terminal 31 is directly rejected. If consistent, the front-end service control module 322 calculates an authentication response value according to the same algorithm of the MMB-CAS terminal 31 according to the authentication parameter, if the authentication response value calculated by the MMB-CAS front end 32 and the MMBA-CAS terminal 31 calculate the The weighted response values are equal, indicating that the authentication is successful, and the specific key is grouped by an algorithm. The RAND is encrypted and then sent by the broadcast sending module 324 and sent by the first short message sending and receiving module 323 to deliver the grouped specific key. After the MMB-CAS terminal receives the specific key, the terminal service control module 312 reassembles the encrypted specific key by the same algorithm and decrypts the RAND to obtain the original specific key. If the authentication parameters are valid, the authentication response values are not equal, and the request of the MMB-CAS terminal 31 is also rejected.

FIG. 5 is a flow chart of an authentication method for mobile multimedia broadcast conditional reception according to a preferred embodiment of the present invention, the method comprising the steps of:

S501: MMB-CAS terminal opening account;

S502: The MMB-CAS front end generates RAND and sends RAND to the MMB-CAS terminal through the short message channel;

S503: The MMB-CAS terminal requests a specific key (user key or service key), and sends a request to the MMB-CAS front end through the short message channel;

S504: After receiving the request message, the MMB-CAS front end determines the number of authentication parameters sent by the broadcast channel and sent through the short message channel according to the number of the authentication parameters and the number of the transmission authentication parameters of each channel. The encryption parameter is encrypted by RAND before being sent, so that the confidentiality of the information sent by the two channels can be ensured, and it is not easy to be captured by the other party;

S505: When the MMB-CAS terminal receives the authentication parameter, the number of the authentication parameter is analyzed according to the RAND and the number of the authentication parameters transmitted by each channel, so that the complete content of the message can be effectively obtained, and after the authentication parameter is completely received, RAND decrypts to get the original text you need.

S506: After obtaining the original text, calculate an authentication response value by using an algorithm negotiated with the MMB-CAS front end, and then encrypt the authentication response result (all authentication parameters and the authentication response value) by RAND and send through the short message channel. Give the MMB-CAS front end;

The specific operation is to obtain the authentication response value corresponding to the authentication parameter through some algorithms, for example: The MMB-CAS front end 32 generates five authentication parameters: al, a2, 23, a4, a5. The algorithm performs some operations on these parameters as input parameters, such as the function F( );

Al, a2, 23, a4, a5 -> F(al, a2, 23, a4, a5) - >response value;

S507: After receiving the authentication parameter and the authentication response value from the MMB-CAS terminal, the MMB-CAS front end decrypts all the authentication parameters and the authentication response value according to the RAND, and then receives the authentication parameter and the MMB-CAS. Comparison of authentication parameters stored in the front end. If the parameters are inconsistent, the MMB-CAS terminal is considered illegal and directly rejects the request of the MMB-CAS terminal. If consistent, the front end MMB-CAS uses the same algorithm as the MMB-CAS terminal according to the authentication parameters. Calculate an authentication response value. If the authentication response value calculated by the MMB-CAS front end is equal to the authentication response value calculated by the MMB-CAS terminal, the authentication is successful. If the authentication parameters are valid, the authentication response values are not equal. Reject the request from the MMB-CAS terminal.

S508: After the authentication succeeds, the MMB-CAS front end uses an algorithm to group the specific key, and then uses RAND encryption to deliver the grouped specific key through the broadcast channel and the short message channel, for example: a 200-byte specific key It is divided into several packets, each packet has information about the upper and lower two packets, and then these packets are randomly transmitted through two channels, so that the terminal can be packaged once after receiving the terminal.

S509: After receiving the specific key, the MMB-CAS terminal reassembles the encrypted specific key and decrypts it by RAND to obtain the original specific key.

Through the technical solution of the present invention, the use of the broadcast channel and the short message channel authentication makes the UK and the SEK are issued safely and effectively improves the security of information transmission.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Industrial applicability

Compared with the prior art, the present invention realizes data transmission in an authentication process by combining a unidirectional channel and a bidirectional channel, thereby improving the security of information transmission.

Claims

Claim

1. An authentication method for mobile multimedia broadcast condition receiving, comprising:

2. The authentication method for mobile multimedia broadcast conditional reception according to claim 1, wherein said step of performing authentication comprises:

The front end sends the authentication parameter to the terminal, and the terminal sends the authentication response result to the front end after the terminal obtains the authentication parameter, and the front end determines whether the authentication is successful according to the result of the authentication response.

The method for authenticating mobile multimedia broadcast conditional access according to claim 2, wherein when the front end sends the authentication parameter to the terminal, the terminal sends the authentication parameter to the terminal through the bidirectional channel and the unidirectional channel.

The authentication method for mobile multimedia broadcast conditional reception according to claim 3, wherein the method further comprises: before the step of sending the authentication parameter to the terminal by the front end, the front end is at the terminal Generating a random value corresponding to the terminal when the account is opened and transmitting the random value to the terminal;

The front end analyzes the random value to obtain the number of authentication parameters and the number of transmission authentication parameters of each channel, and randomly determines the number of the authentication parameters according to the number of the obtained authentication parameters and the number of transmission authentication parameters of each channel. The specific authentication parameters delivered by the bidirectional channel and delivered by the unidirectional channel are described.

The authentication method for mobile multimedia broadcast conditional reception according to claim 2, wherein the authentication response result comprises an authentication parameter and an authentication response value;

The step of determining whether the authentication is successful includes: determining, by the front end, whether the received authentication parameter is consistent with the authentication parameter stored by the front end, and if not, the terminal is considered to be illegal, and the authentication fails. Consistently, the front end further calculates an authentication response value according to the authentication parameter, and determines whether the calculated authentication response value is consistent with the authentication response value sent by the terminal. If the authentication is consistent, the authentication succeeds, and if the authentication is inconsistent, the authentication fails. .

The authentication method for mobile multimedia broadcast conditional reception according to claim 5, wherein the front end sends an authentication response result to the terminal and the terminal by transmitting an authentication parameter and a specific key. In the process of the front end, one end of the sending information encrypts the sent information by using the random value, and then sends the information, and one end of the received information decrypts the received information by using the random value.

The authentication method for mobile multimedia broadcast conditional reception according to claim 1, wherein the specific key is a user key or a bearer service key.

The authentication method for mobile multimedia broadcast conditional reception according to claim 1, wherein the bidirectional channel is a short message channel, and the unidirectional channel is a broadcast channel.

A mobile multimedia broadcast condition receiving system, comprising a front end and a terminal, the front end comprising a front end service control module, a first bidirectional channel transmitting and receiving module and a unidirectional channel sending module, wherein the terminal comprises a a terminal service control module, a second bidirectional channel transmission and reception module, and a unidirectional channel receiving module, where: the terminal service control module is configured to: send the information requested by the specific key to the terminal after the terminal is opened a front end, and after the terminal obtains an authentication parameter from the front end, sending an authentication response result to the first bidirectional channel transmitting and receiving module sent by the second bidirectional channel sending and receiving module to the front end;

The front-end service control module is configured to: after the front end receives the information sent by the terminal requesting the specific key, send the authentication parameter to the terminal, and receive the authentication response result at the front end And determining, according to the result of the authentication response, whether the authentication is successful, and if the authentication is successful, sending, by the first bidirectional channel sending and receiving module and the unidirectional channel sending module, a specific key to the second bidirectional channel of the terminal. a transmitting and receiving module and the unidirectional channel receiving module.

The system of claim 9, wherein the front end further comprises a front end random value generation and maintenance module, and the front end random value generation and maintenance module is configured to generate a random corresponding to the terminal when the terminal opens an account And transmitting, by the first bidirectional channel sending and receiving module, the random value to the second bidirectional channel transmitting and receiving module of the terminal;

The front-end service control module is further configured to analyze the random value to obtain the number of authentication parameters and the number of transmission authentication parameters of each channel, and transmit the authentication parameters according to the obtained number of authentication parameters and each channel. The number of the packets is determined by the first bidirectional channel transmitting and receiving module and the specific authentication parameter sent by the unidirectional channel sending module.

A front end for mobile multimedia broadcast conditional reception, the front end includes a front end service control module, a first bidirectional channel transmission and reception module, and a unidirectional channel transmission module, where

The front-end service control module is configured to: after the front end receives the information sent by the terminal requesting the specific key, send the authentication parameter to the terminal; and

The front end according to claim 9, wherein the front end further comprises a front end random value generation maintenance module.

The front-end random value generation and maintenance module is configured to generate a random value corresponding to the terminal when the terminal opens an account, and send the generated random value to the second bidirectional channel of the terminal by using the first bidirectional channel transmission and reception module to send the generated random value. Receiving module

A terminal for receiving a mobile multimedia broadcast condition, the terminal comprising a terminal service control module, a second bidirectional channel transmission and reception module, and a unidirectional channel receiving module, wherein

The terminal service control module is configured to: after the terminal opens the account, send the information that is requested by the specific key to the front end, and after the terminal obtains the authentication parameter from the front end, pass the authentication response result through the The second bidirectional channel transmitting and receiving module sends the first bidirectional channel transmitting and receiving module to the front end.