WO2010124490A1 - 获取无线局域网鉴别和保密基础结构证书的方法及系统 - Google Patents

获取无线局域网鉴别和保密基础结构证书的方法及系统 Download PDF

Info

Publication number
WO2010124490A1
WO2010124490A1 PCT/CN2009/074019 CN2009074019W WO2010124490A1 WO 2010124490 A1 WO2010124490 A1 WO 2010124490A1 CN 2009074019 W CN2009074019 W CN 2009074019W WO 2010124490 A1 WO2010124490 A1 WO 2010124490A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
terminal
authentication server
authentication
server
Prior art date
Application number
PCT/CN2009/074019
Other languages
English (en)
French (fr)
Inventor
康望星
施元庆
梁洁辉
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2010124490A1 publication Critical patent/WO2010124490A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present invention relates to the field of wireless local area network technologies, and in particular, to a method and system for obtaining a wireless local area network authentication and privacy infrastructure certificate.
  • WAPI WLAN Authentication and Privacy Infrastructure
  • WAI WLAN Authentication and Privacy Infrastructure
  • WPI WLAN Privacy Infrastructure
  • WAI is a security solution for identity authentication and key management in wireless LANs.
  • WPI It is a security solution for data transmission protection in wireless LANs, including data encryption, data authentication and playback protection.
  • a typical WAPI system mainly includes a discriminator entity (AE), an authentication requester entity (ASUE), and an authentication server entity (ASE), where:
  • the authentication requester entity is an entity that requests an authentication operation before accessing the service, and resides in the STA (Wireless Client), which can be understood as a terminal.
  • the discriminator entity provides an authentication operation for the authentication requester entity to access the service, typically in an AP (access point) or STA.
  • the authentication server entity provides mutual authentication services for the discriminator entity and the authentication requester entity.
  • the WAPI process mainly includes: After the terminal negotiates with the AP for the 802.11 link, the AP initiates a WAI authentication process for the terminal, and cooperates with the authentication server to complete the mutual authentication with the terminal. After the authentication, the AP initiates key agreement with the terminal, and uses the negotiated key to provide the user with encryption and decryption services through the WPI.
  • the discriminator entity supports WAI authentication and password management in two ways, one is based on a certificate, and the other is based on a shared key. Identify the requester when using a certificate-based approach The terminal where the entity is located needs to attach its own to the access authentication request sent to the discriminator entity.
  • the discriminator entity determines whether to complete the verification of the WAPI certificate by itself or the authentication service unit to complete the verification according to the field in the access authentication request, and then authenticate the authentication requester entity.
  • WAPI is similar to Public Key Infrastructure ( ⁇ ).
  • the authentication service unit in the WAPI system has the same function as the Certificate Authority (CA) in the PKI.
  • CA Certificate Authority
  • the authentication service unit must also have the same certificate application, issuance, periodic release of certificate invalidation list, and response to user certificate revocation.
  • the terminal obtains the certificate and the corresponding private key in offline mode. You need to manually save the certificate by using the storage device, and then store the saved certificate in the terminal. After the expiration of the validity period, the user needs to complete the certificate again offline. Update, very inconvenient to use.
  • the present invention provides a method and system for obtaining a WAPI certificate, which solves the problem of inconvenient to obtain a certificate in an offline manner, and realizes that the terminal conveniently obtains a WAPI certificate.
  • the present invention provides a method for obtaining a WLAN authentication and privacy infrastructure certificate, including: the terminal sending a certificate delivery request to the authentication server;
  • the authentication server searches for the user's wireless local area network authentication and privacy infrastructure WAPI certificate according to the user account of the terminal carried in the received certificate issuing request, and sends the found WAPI certificate to the terminal.
  • the terminal sends a certificate delivery request to the authentication server through the IP multimedia subsystem IMS core network, and the authentication server sends the found WAPI certificate to the terminal through the IMS core network.
  • the process for the terminal to send a certificate delivery request to the authentication server through the IMS core network includes:
  • the terminal sends a certificate delivery request to the registration server of the IMS core network
  • the registration server After receiving the certificate delivery request, the registration server queries the authentication server address of the terminal from the home subscriber server HSS of the IMS core network, and forwards the certificate delivery request to the authentication server according to the queried authentication server address. Further, the process for the authentication server to send the found WAPI certificate to the terminal through the IMS core network includes:
  • the authentication server sends the found WAPI certificate to the registration server;
  • the registration server forwards the received WAPI certificate to the terminal.
  • the process for the registration server to query the authentication server address of the terminal from the HSS includes: the registration server sends a query message to the HSS, where the query message carries the user account of the terminal;
  • the HSS After receiving the query message, the HSS searches for the authentication server address of the terminal from the corresponding relationship between the saved user account and the authentication server address, and sends the found address to the registration server.
  • the terminal uses the HTTP GET message as a certificate to send the request;
  • the authentication server sends the WAPI certificate to the terminal through the HTTP 200 OK response message, and the terminal parses the received HTTP 200 OK response message to obtain the WAPI certificate.
  • the present invention also provides an authentication server that supports obtaining a wireless local area network authentication and security infrastructure certificate, and the authentication server is configured to search for a user's WAPI certificate according to the user account of the terminal carried in the received certificate delivery request, and search for The WAPI certificate to be sent to the terminal.
  • the present invention further provides a system for supporting acquisition of a wireless local area network authentication and privacy infrastructure certificate, comprising: the authentication server, the registration server of the IMS core network, and the HSS as described above, wherein the registration server is configured to receive the transmission by the terminal.
  • the certificate is sent, the certificate is queried from the HSS of the IMS core network, and the certificate is sent to the authentication server according to the queried authentication server address.
  • the authentication server is configured to be found by the registration server
  • the WAPI certificate is sent to the terminal
  • the registration server is further configured to receive the WAPI certificate sent by the authentication server, and forward the received WAPI certificate to the terminal.
  • the HSS is configured to receive the query message of the registration server, search for the authentication server address corresponding to the terminal from the correspondence between the saved user account and the authentication server address, and send the found authentication server address to the The registration server; wherein the query message carries a user account of the terminal.
  • the present invention accesses an IMS (IP Multimedia Subsystem) network through a 3G (3rd Generation Mobile Communication Technology) RAN (Access Network), through the IMS network and the authentication server, before the terminal performs the first certificate authentication.
  • the signaling interaction is performed to obtain the WAPI certificate.
  • the present invention avoids the inconvenience of obtaining the certificate by the offline mode, and simplifies the certificate management process of the user and the operator.
  • the terminal can run the process of obtaining the certificate in the background, thereby improving the user experience.
  • FIG. 1 is an interaction diagram of a method for obtaining a WAPI certificate according to the present invention
  • FIG. 2 is an architectural diagram of a system for obtaining a WAPI certificate according to the present invention.
  • the IP Multimedia Subsystem is a set of specifications that describe the architecture of the Next Generation Network (NGN), which is used to implement IP-based telephony and multimedia services.
  • NTN Next Generation Network
  • IMS defines a complete architecture and framework that allows aggregation of voice, video, data and mobile network technologies over IP-based infrastructure using SIP (Session Initiation Protocol) with access-independent features .
  • SIP Session Initiation Protocol
  • the terminal accesses the IMS network through the 3G RAN and sends an HTTP message to the registration server to obtain a WAPI certificate after the registration is successful.
  • the registration server forwards the HTTP message to the authentication server corresponding to the terminal, and the authentication server registers with the authentication server.
  • the server returns the WAPI certificate, and the registration server forwards the WAPI certificate to the terminal.
  • the terminal can perform the certificate authentication process with the AP or the authentication server.
  • the mapping between the user account and the authentication server address needs to be configured in the home subscriber server (HSS) of the IMS core network, and the registration server of the IMS network is configured in the terminal.
  • HSS home subscriber server
  • Information such as address, port, and local port.
  • FIG. 1 is a schematic diagram of a method for a terminal to obtain a WAPI certificate according to the present invention, including the following steps:
  • the terminal After the terminal accesses the IMS through the 3G RAN, the terminal sends a registration request message (SIP REGISTER message) to the registration server of the IMS core network, requesting to register; 102: After receiving the registration request message, the registration server returns a 401 response message to the terminal, requesting authentication of the terminal.
  • a registration request message SIP REGISTER message
  • the terminal After receiving the 401 response message, the terminal calculates the authentication information according to the authentication field carried in the 401 response message, and sends the authentication information to the registration server by using a SIP REGISTER message;
  • the registration server After receiving the SIP REGISTER message carrying the authentication information, the registration server authenticates the terminal according to the authentication information. If the terminal successfully authenticates the terminal, the device returns a 200 OK message to notify the terminal that the registration is successful.
  • the terminal After receiving the 200 OK message, the terminal sends a certificate delivery request (HTTP GET message) to the registration server, requesting the registration server to issue a certificate, and carrying the user account in the certificate delivery request;
  • a certificate delivery request HTTP GET message
  • the registration server After receiving the request for issuing the certificate, the registration server sends an inquiry message to the HSS, and queries the address of the authentication server corresponding to the terminal, and carries the user account in the query message;
  • the HSS After receiving the query message, the HSS searches for the authentication server address of the terminal in the correspondence between the user account and the authentication server address, and finds the address of the corresponding authentication server, and then sends the address to the registration server;
  • the HSS If the HSS does not find the corresponding authentication server address, it returns an error message to the registration server, and the registration server returns a response to the terminal that failed to obtain the certificate.
  • the registration server forwards the certificate issuing request to the authentication server according to the received authentication server address;
  • the authentication server forwards the received certificate delivery request to the certificate management module, and the certificate management module searches for the corresponding WAPI certificate according to the user account, and sends the WAPI certificate to the registration server through the HTTP 200 OK response message;
  • the certificate management module does not find the WAPI certificate of the terminal, the value of the Content-Length field in the HTTP 200 OK response message is set to 0 and sent to the registration server.
  • Step 110 After receiving the HTTP 200 OK message, the registration server forwards the message to the terminal.
  • the terminal After receiving the HTTP 200 OK message, the terminal invokes its certificate management module to parse the message to obtain a WAPI certificate, and initiates an access authentication process with the AP.
  • FIG. 2 is a system for obtaining a WAPI certificate according to the present invention, including: a terminal, an IMS core network, and The authentication server, the IMS core network includes a registration server and an HSS, where:
  • the terminal is configured to send a registration request message (SIP REGISTER message) to the registration server to request registration; after receiving the 401 response message, calculate the authentication information according to the authentication field carried in the 401 response message, and pass the authentication information
  • SIP REGISTER message is sent to the registration server.
  • the server After receiving the 200 OK message, the server sends a certificate delivery request (HTTP GET message) to the registration server, requests the registration server to issue a certificate, and carries the user account in the certificate delivery request; After the 200 OK message, the certificate management unit is called to parse the message to obtain the WAPI certificate.
  • HTTP GET message HTTP GET message
  • a registration server configured to: after receiving the registration request message, return a 401 response message to the terminal, requesting authentication of the terminal; and after receiving the SIP REGISTER message carrying the authentication information, authenticating the terminal according to the authentication information, if After the authentication of the terminal is successful, the device returns a 200 OK message to notify the terminal that the registration is successful.
  • the device After receiving the certificate delivery request, it sends an inquiry message to the HSS to query the address of the authentication server corresponding to the terminal. After receiving the authentication server address And forwarding the certificate delivery request to the authentication server according to the address; after receiving the error message of the HSS, returning the response to the failure of obtaining the certificate to the terminal; after receiving the HTTP 200 OK message, forwarding the message to the terminal.
  • the HSS is configured to save the correspondence between the user account and the authentication server address; after receiving the query message, look up the authentication server address of the terminal in the correspondence between the user account and the authentication server address, and find the corresponding authentication server address, The address is sent to the registration server; if the corresponding authentication server address is not found, an error message is returned to the registration server.
  • the authentication server is configured to forward the received certificate delivery request to the certificate management module, and the certificate management module searches for the corresponding WAPI certificate according to the user account, and sends the WAPI certificate to the registration server through the HTTP 200 OK response message;
  • the WAPI certificate to the terminal sets the value of the Content-Length field in the HTTP 200 OK response message to 0 and sends it to the registration server.
  • the above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person familiar with the technology may easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention.
  • Industrial Applicability The present invention avoids the inconvenience of a user acquiring a certificate in an offline manner, and simplifies the certificate management process of the user and the operator.
  • the terminal can run the process of obtaining a certificate in the background, thereby improving the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

获取无线局域网鉴别和保密基础结构证书的方法及系统
技术领域
本发明涉及无线局域网技术领域， 尤其涉及一种获取无线局域网鉴别和 保密基础结构证书的方法及系统。
背景技术
WAPI ( WLAN Authentication and Privacy Infrastructure , 无线局 i或网鉴别 和保密基础结构）是中国提出的以 802.11无线协议为基础的无线安全标准。 WAPI协议包括两个部分： WAI ( WLAN Authentication Infrastructure， 无线局 域网鉴别基础结构）和 WPI ( WLAN Privacy Infrastructure, 无线局域网保密 基础结构。 WAI是用于无线局域网中身份鉴别和密钥管理的安全方案。 WPI 是用于无线局域网中数据传输保护的安全方案， 包括数据加密、 数据鉴别和 重放保护等功能。
典型的 WAPI系统主要包括鉴别器实体（AE )、鉴别请求者实体（ASUE ) 和鉴别服务器实体（ASE ) ， 其中：
鉴别请求者实体是在接入服务之前请求进行鉴别操作的实体， 驻留在 STA (无线客户端） 中， 可以理解为终端。
鉴别器实体为鉴别请求者实体在接入服务之前提供鉴别操作， 一般驻留 在 AP (接入点）或 STA中。
鉴别服务器实体为鉴别器实体和鉴别请求者实体提供相互鉴别的服务。
WAPI的过程主要包括： 终端与 AP进行 802.11链路协商后， AP为该终 端发起 WAI鉴别过程，配合鉴别服务器完成与终端的双向认证。通过认证后， AP发起与终端的密钥协商， 并使用协商出的密钥通过 WPI向该用户提供加 密和解密服务。
鉴别器实体通过两类方式支持 WAI鉴别及密码管理，一类是基于证书的 方式， 一类是基于共享密钥的方式。 当釆用基于证书的方式时， 鉴别请求者 实体所在的终端在发送给鉴别器实体的接入鉴别请求中， 需要附带自己的
WAPI证书， 鉴别器实体根据接入鉴别请求中的字段， 决定由其自身完成 WAPI证书的验证还是交由鉴别服务单元完成验证， 进而对鉴别请求者实体 进行认证。
WAPI与公开密钥基础设施（ Public Key Infrastructure , ΡΚΙ )相似， WAPI 系统中的鉴别服务单元与 PKI中的认证中心（ Certificate Authority, CA )的作 用相同， 当 WAI釆用 X.509 v3证书时， 鉴别服务单元也必须具有与 CA相同 的证书申请、签发、定期发布证书失效列表和响应用户证书吊销等功能。 WAPI 中终端釆用离线方式获取证书和对应的私有密钥， 需要人工使用存储设备保 存证书， 再将保存的证书存储到终端中， 证书在有效期满失效后， 用户还需 要再次通过离线方式完成证书更新， 使用非常不便。
发明内容
为解决上述技术问题， 本发明提供一种获取 WAPI证书的方法及系统， 解决釆用离线方式获取证书不方便的问题，实现终端便捷地获取 WAPI证书。
本发明提供一种获取无线局域网鉴别和保密基础结构证书的方法，包括： 终端向鉴别服务器发送证书下发请求；
鉴别服务器根据接收到的证书下发请求中携带的终端的用户帐号查找用 户的无线局域网鉴别和保密基础结构 WAPI证书， 并将查找到的 WAPI证书 发送给终端。
进一步地，终端通过 IP多媒体子系统 IMS核心网向鉴别服务器发送证书 下发请求， 鉴别服务器通过 IMS核心网将查找到的 WAPI证书发送给终端。
进一步地， 终端通过 IMS核心网向鉴别服务器发送证书下发请求的过程 包括：
终端将证书下发请求发送给 IMS核心网的注册服务器；
注册服务器接收到证书下发请求后， 从 IMS核心网的归属用户服务器 HSS中查询终端的鉴别服务器地址， 根据查询到的鉴别服务器地址将证书下 发请求转发给鉴别服务器。 进一步地， 鉴别服务器通过 IMS核心网将查找到的 WAPI证书发送给终 端的过程包括：
鉴别服务器将查找到的 WAPI证书发送给注册服务器；
注册服务器将接收到的 WAPI证书转发给终端。
进一步地， 注册服务器从 HSS查询终端的鉴别服务器地址的过程包括： 注册服务器向 HSS发送查询消息， 在查询消息中携带终端的用户帐号；
HSS接收到查询消息后， 从保存的用户帐号与鉴别服务器地址的对应关 系中查找终端的鉴别服务器地址， 并将查找到的地址发送给注册服务器。
进一步地， 终端釆用 HTTP GET消息作为证书下发请求；
鉴别服务器通过 HTTP 200 OK响应消息将 WAPI证书发送给终端，终端 解析接收到的 HTTP 200 OK响应消息， 获得 WAPI证书。
本发明还提供一种支持获取无线局域网鉴别和保密基础结构证书的鉴别 服务器， 所述鉴别服务器设置成根据接收到的证书下发请求中携带的终端的 用户帐号查找用户的 WAPI证书， 并将查找到的 WAPI证书发送给终端。
本发明还提供一种支持获取无线局域网鉴别和保密基础结构证书的系 统， 包括： 如上所述的鉴别服务器、 IMS核心网的注册服务器和 HSS, 其中， 所述注册服务器设置成接收到终端发送的证书下发请求后， 从 IMS核心 网的 HSS中查询终端的鉴别服务器地址， 根据查询到的鉴别服务器地址将证 书下发请求转发给鉴别服务器。
进一步地， 所述鉴别服务器是设置成通过所述注册服务器将查找到的
WAPI证书发送给终端；
所述注册服务器还设置成接收鉴别服务器发送的 WAPI证书， 并将接收 到的 WAPI证书转发给终端。
进一步地， 所述 HSS设置成接收所述注册服务器的查询消息， 从保存的 用户帐号与鉴别服务器地址的对应关系中查找所述终端对应的鉴别服务器地 址， 并将查找到的鉴别服务器地址发送给所述注册服务器； 其中， 所述查询 消息中携带终端的用户帐号。 综上所述， 本发明在终端进行第一次证书鉴别之前， 通过 3G (第三代移 动通信技术 ) RAN (接入网 )接入 IMS ( IP多媒体子系统）网络， 通过 IMS 网络与鉴别服务器进行信令交互获得 WAPI证书， 本发明避免了用户通过离 线方式获取证书的不便， 并简化了用户和运营商的证书管理流程， 终端可以 在后台运行获取证书的过程， 从而提升了用户体验。
附图概述
图 1为本发明获取 WAPI证书的方法的交互图；
图 2为本发明获取 WAPI证书的系统的架构图。
本发明的较佳实施方式
IP多媒体子系统是一组规范，用于描述下一代网络（NGN )的体系结构， NGN用于实现基于 IP的电话和多媒体服务。 IMS定义了一套完整的体系结 构和框架， 允许在基于 IP的基础设施上对声音、 视频、 数据和移动网络技术 进行聚合， 其釆用 SIP (会话初始协议） ， 具有与接入无关的特性。
本发明中， 终端通过 3G RAN接入 IMS网络并在注册成功后， 向注册服 务器发送 HTTP消息获取 WAPI证书， 注册服务器接收到 HTTP消息后， 将 其转发给终端对应的鉴别服务器，鉴别服务器向注册服务器返回 WAPI证书， 注册服务器将 WAPI证书转发给终端， 终端接收到 WAPI证书后， 即可进行 与 AP或鉴别服务器的证书鉴别过程。
下面结合附图对本发明的具体实施方式进行说明。
为保证终端能够通过 IMS系统请求鉴别服务器下发 WAPI证书， 需要在 IMS核心网的归属用户服务器（HSS ) 中配置用户帐号与鉴别服务器地址的 对应关系， 并在终端内配置 IMS网络的注册服务器的地址、 端口以及本地端 口等信息。
图 1所示为本发明中终端获取 WAPI证书的方法， 包括如下步骤：
101 : 终端通过 3G RAN接入 IMS后， 向 IMS核心网的注册服务器发送 注册请求消息 （SIP REGISTER消息） ， 请求进行注册； 102: 注册服务器接收到注册请求消息后， 向终端返回 401应答消息， 要 求对终端进行鉴权；
103: 终端接收到 401应答消息后， 根据 401应答消息中携带的鉴权字段 计算出鉴权信息， 将鉴权信息通过 SIP REGISTER ( SIP 注册）消息发给注册 服务器；
104: 注册服务器接收到携带鉴权信息的 SIP REGISTER消息后， 根据鉴 权信息对终端进行鉴权， 如果对终端鉴权成功， 则向终端返回 200 OK消息， 通知终端注册成功；
105:终端接收到 200 OK消息后，向注册服务器发送证书下发请求（ HTTP GET消息） ， 请求注册服务器下发证书， 在证书下发请求中携带用户帐号；
106: 注册服务器接收到证书下发请求后， 向 HSS发送查询消息， 查询 该终端对应的鉴别服务器地址， 在查询消息中携带用户帐号；
107: HSS接收到查询消息后，在用户帐号与鉴别服务器地址的对应关系 中查找终端的鉴别服务器地址， 查找到对应的鉴别服务器地址后， 将地址发 送给注册服务器；
若 HSS没有查找到对应的鉴别服务器地址， 则向注册服务器返回错误消 息， 注册服务器向终端返回获取证书失败的应答。
108:注册服务器根据接收到的鉴别服务器地址向鉴别服务器转发证书下 发请求；
109: 鉴别服务器将接收到的证书下发请求转发给其证书管理模块， 其证 书管理模块根据用户帐号查找对应的 WAPI证书 ,通过 HTTP 200 OK响应消 息将 WAPI证书发送给注册服务器；
如果证书管理模块未查找到终端的 WAPI证书，则将 HTTP 200 OK响应 消息中的 Content-Length (内容-长度）字段的值置为 0, 发送给注册服务器。
110: 注册服务器接收到 HTTP 200 OK消息后， 将该消息转发至终端；
111 : 终端接收到 HTTP 200 OK消息后， 调用其证书管理模块对该消息 进行解析获取到 WAPI证书， 可以发起与 AP的接入鉴别流程。
图 2所示为本发明获取 WAPI证书的系统， 包括： 终端、 IMS核心网和 鉴别服务器， IMS核心网包括注册服务器和 HSS, 其中：
终端， 用于向注册服务器发送注册请求消息 （SIP REGISTER 消息） ， 请求进行注册； 在接收到 401应答消息后， 根据 401应答消息中携带的鉴权 字段计算出鉴权信息，将鉴权信息通过 SIP REGISTER消息发给注册服务器； 在接收到 200 OK消息后， 向注册服务器发送证书下发请求（HTTP GET消 息） ， 请求注册服务器下发证书， 在证书下发请求中携带用户帐号； 接收到 HTTP 200 OK消息后， 调用证书管理单元对该消息进行解析获取到 WAPI证 书。
注册服务器， 用于在接收到注册请求消息后， 向终端返回 401应答消息， 要求对终端进行鉴权； 接收到携带鉴权信息的 SIP REGISTER消息后， 根据 鉴权信息对终端进行鉴权，如果对终端鉴权成功，则向终端返回 200 OK消息， 通知终端注册成功； 接收到证书下发请求后， 向 HSS发送查询消息， 查询该 终端对应的鉴别服务器的地址； 在接收到鉴别服务器地址后， 根据地址向鉴 别服务器转发证书下发请求； 在接收到 HSS的错误消息后， 向终端返回获取 证书失败的应答； 接收到 HTTP 200 OK消息后， 将该消息转发至终端。
HSS, 用于保存用户帐号与鉴别服务器地址的对应关系； 在接收到查询 消息后， 在用户帐号与鉴别服务器地址的对应关系中查找终端的鉴别服务器 地址， 查找到对应的鉴别服务器地址后， 将地址发送给注册服务器； 若没有 查找到对应的鉴别服务器地址， 则向注册服务器返回错误消息。
鉴别服务器， 用于将接收到的证书下发请求转发给其证书管理模块， 其 证书管理模块根据用户帐号查找对应的 WAPI证书 ,通过 HTTP 200 OK响应 消息将 WAPI证书发送给注册服务器； 如果未查找到终端的 WAPI证书， 则 将 HTTP 200 OK响应消息中的 Content-Length字段的值置为 0 , 发送给注册 服务器。
以上所述， 仅为本发明较佳的具体实现方式， 但本发明的保护范围并不 局限与此， 任何熟悉该技术的人， 在本发明所揭露的技术范围内， 可轻易想 到的变化或替换， 都应涵盖在本发明的保护范围之内。 工业实用性 本发明避免了用户通过离线方式获取证书的不便， 并简化了用户和运营 商的证书管理流程， 终端可以在后台运行获取证书的过程， 从而提升了用户 体验。

Claims

权 利 要 求 书
1、 一种获取无线局域网鉴别和保密基础结构证书的方法， 包括： 终端向鉴别服务器发送证书下发请求；
所述鉴别服务器根据接收到的证书下发请求中携带的终端的用户帐号查 找用户的无线局域网鉴别和保密基础结构 WAPI证书， 并将查找到的 WAPI 证书发送给所述终端。
2、如权利要求 1所述的方法，其中，所述终端通过 IP多媒体子系统 IMS 核心网向鉴别服务器发送所述证书下发请求， 所述鉴别服务器通过所述 IMS 核心网将所述查找到的 WAPI证书发送给所述终端。
3、 如权利要求 2所述的方法， 其中， 所述终端通过所述 IMS核心网向 鉴别服务器发送所述证书下发请求的所述步骤包括：
所述终端将所述证书下发请求发送给所述 IMS核心网的注册服务器； 所述注册服务器接收所述证书下发请求， 从所述 IMS核心网的归属用户 服务器 HSS中查询所述终端对应的鉴别服务器地址， 根据查询到的鉴别服务 器地址将所述证书下发请求转发给所述鉴别服务器。
4、 如权利要求 3所述的方法， 其中， 所述鉴别服务器通过所述 IMS核 心网将查找到的 WAPI证书发送给所述终端的所述步骤包括：
所述鉴别服务器将查找到的 WAPI证书发送给所述注册服务器； 所述注册服务器将接收到的 WAPI证书转发给所述终端。
5、 如权利要求 3所述的方法， 其中， 从所述 IMS核心网的 HSS中查询 所述终端的鉴别服务器地址的所述步骤包括：
所述注册服务器向所述 HSS发送查询消息， 在查询消息中携带所述终端 的用户帐号；
所述 HSS接收到所述查询消息后， 从保存的用户帐号与鉴别服务器地址 的对应关系中查找所述终端的鉴别服务器地址， 并将查找到的地址发送给所 述注册服务器。
6、 如权利要求 4所述的方法， 其中， 所述终端釆用 HTTP GET消息作为所述证书下发请求；
所述鉴别服务器通过 HTTP 200 OK响应消息将查找到的 WAPI证书发送 给所述终端， 所述终端接收并解析所述 HTTP 200 OK响应消息， 获得所述终 端的 WAPI证书。
7、一种支持获取无线局域网鉴别和保密基础结构证书的鉴别服务器， 所 述鉴别服务器设置成接收终端发送的证书下发请求， 根据接收到的证书下发 请求中携带的终端的用户帐号查找用户的 WAPI证书， 并将查找到的 WAPI 证书发送给终端。
8、 一种支持获取无线局域网鉴别和保密基础结构证书的系统， 包括： 根 据权利要求 7所述的鉴别服务器、 IMS核心网的注册服务器和 HSS, 其中， 所述注册服务器设置成接收终端发送的证书下发请求， 从所述 IMS核心 网的 HSS中查询所述终端对应的鉴别服务器地址， 并根据查询到的鉴别服务 器地址将所接收到的证书下发请求转发给所述鉴别服务器。
9、 如权利要求 8所述的系统， 其中，
所述鉴别服务器是设置成通过所述注册服务器将查找到的 WAPI证书发 送给终端；
所述注册服务器还设置成接收鉴别服务器发送的 WAPI证书， 并将接收 到的 WAPI证书转发给终端。
10、 如权利要求 8所述的系统， 其中，
所述 HSS设置成接收所述注册服务器的查询消息， 从保存的用户帐号与 鉴别服务器地址的对应关系中查找所述终端对应的鉴别服务器地址， 并将查 找到的鉴别服务器地址发送给所述注册服务器； 其中， 所述查询消息中携带 终端的用户帐号。
PCT/CN2009/074019 2009-04-30 2009-09-18 获取无线局域网鉴别和保密基础结构证书的方法及系统 WO2010124490A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910136174.X 2009-04-30
CN200910136174XA CN101540679B (zh) 2009-04-30 2009-04-30 获取无线局域网鉴别和保密基础结构证书的方法及系统

Publications (1)

Publication Number Publication Date
WO2010124490A1 true WO2010124490A1 (zh) 2010-11-04

Family

ID=41123684

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/074019 WO2010124490A1 (zh) 2009-04-30 2009-09-18 获取无线局域网鉴别和保密基础结构证书的方法及系统

Country Status (2)

Country Link
CN (1) CN101540679B (zh)
WO (1) WO2010124490A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113691519A (zh) * 2021-08-18 2021-11-23 绿能慧充数字技术有限公司 一种云服务统一管理访问权限的离网设备集控方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102158849A (zh) * 2010-12-21 2011-08-17 东莞宇龙通信科技有限公司 一种获取证书的方法及移动终端
CN102315996B (zh) * 2011-10-21 2015-04-01 北京海西赛虎信息安全技术有限公司 网络准入控制方法及系统
CN104113547B (zh) * 2014-07-23 2017-04-26 中国科学院信息工程研究所 一种sip安全防范视频监控入网控制系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030169713A1 (en) * 2001-12-12 2003-09-11 Hui Luo Zero-configuration secure mobility networking technique with web-base authentication interface for large WLAN networks
CN1697370A (zh) * 2004-05-14 2005-11-16 华为技术有限公司 一种无线局域网移动终端申请证书的方法
CN101013940A (zh) * 2006-12-22 2007-08-08 西安电子科技大学 一种兼容802.11i及WAPI的身份认证方法
CN101018174A (zh) * 2007-03-15 2007-08-15 北京安拓思科技有限责任公司 用于wapi的获取公钥证书的网络系统和方法
CN101030908A (zh) * 2007-02-06 2007-09-05 西安西电捷通无线网络通信有限公司 无线局域网wapi安全机制中证书的申请方法
CN101123501A (zh) * 2006-08-08 2008-02-13 西安电子科技大学 一种wapi认证和密钥协商方法和系统
US7441043B1 (en) * 2002-12-31 2008-10-21 At&T Corp. System and method to support networking functions for mobile hosts that access multiple networks

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030169713A1 (en) * 2001-12-12 2003-09-11 Hui Luo Zero-configuration secure mobility networking technique with web-base authentication interface for large WLAN networks
US7441043B1 (en) * 2002-12-31 2008-10-21 At&T Corp. System and method to support networking functions for mobile hosts that access multiple networks
CN1697370A (zh) * 2004-05-14 2005-11-16 华为技术有限公司 一种无线局域网移动终端申请证书的方法
CN101123501A (zh) * 2006-08-08 2008-02-13 西安电子科技大学 一种wapi认证和密钥协商方法和系统
CN101013940A (zh) * 2006-12-22 2007-08-08 西安电子科技大学 一种兼容802.11i及WAPI的身份认证方法
CN101030908A (zh) * 2007-02-06 2007-09-05 西安西电捷通无线网络通信有限公司 无线局域网wapi安全机制中证书的申请方法
CN101018174A (zh) * 2007-03-15 2007-08-15 北京安拓思科技有限责任公司 用于wapi的获取公钥证书的网络系统和方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113691519A (zh) * 2021-08-18 2021-11-23 绿能慧充数字技术有限公司 一种云服务统一管理访问权限的离网设备集控方法
CN113691519B (zh) * 2021-08-18 2023-09-01 绿能慧充数字技术有限公司 一种云服务统一管理访问权限的离网设备集控方法

Also Published As

Publication number Publication date
CN101540679B (zh) 2011-09-21
CN101540679A (zh) 2009-09-23

Similar Documents

Publication Publication Date Title
JP5143125B2 (ja) ドメイン間情報通信のための認証方法、システム、およびその装置
US9385863B2 (en) System and method for authenticating a communication device
KR101343039B1 (ko) 인증 시스템, 방법 및 장치
WO2008006306A1 (fr) Procédé et dispositif de dérivation d'une clé interface locale
WO2012103726A1 (zh) 基于ott的媒体数据传输方法、装置及系统
WO2009062415A1 (en) An authentication method for request message and the apparatus thereof
WO2020088026A1 (zh) 一种基于通用引导架构gba的认证方法及相关设备
WO2010081313A1 (zh) Wapi终端接入ims网络的安全管理方法及系统
WO2008000192A1 (fr) Procédé d'accès au réseau de terminaux, système d'accès au réseau et équipement de passerelle
WO2007003140A1 (fr) Procede d'authentification de sous-systeme multimedia sous protocole ip
WO2011022999A1 (zh) 一种终端对视频会议数据进行加密的方法及系统
WO2011095039A1 (zh) 一种端对端会话密钥协商方法、系统和装置
EP2659646A1 (en) System and method of provisioning or managing device certificates in a communication network
WO2006125359A1 (fr) Procede d'implementation de la securite de domaine d'acces d'un sous-systeme multimedia ip
WO2009135445A1 (zh) 一种基于wapi的漫游认证方法
WO2012058896A1 (zh) 单点登录方法及系统
WO2007028328A1 (fr) Procede, systeme et dispositif de negociation a propos d'une cle de chiffrement partagee par equipement utilisateur et equipement externe
WO2010127539A1 (zh) 一种流媒体业务的接入认证方法及系统
WO2006072209A1 (fr) Procede de negociation d'une cle dans un sous-systeme multimedia ip
WO2007022731A1 (fr) Procede, systeme et equipement de negociation de cle de cryptage dans une trame de verification universelle amelioree
WO2011038691A1 (zh) 鉴权方法及装置
WO2010124490A1 (zh) 获取无线局域网鉴别和保密基础结构证书的方法及系统
WO2006072219A1 (fr) Systeme d'authentification d'un reseau de sous-systeme multimedia ip et procede associe
WO2009138038A1 (zh) 提供mbms服务的方法、系统、相应装置及通信终端
WO2010133073A1 (zh) 一种证书状态信息的获取方法及证书状态管理系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09843902

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09843902

Country of ref document: EP

Kind code of ref document: A1