WO2011022963A1

WO2011022963A1 - Method for protecting the security of data transmission, authentication server and terminal

Info

Publication number: WO2011022963A1
Application number: PCT/CN2010/071206
Authority: WO
Inventors: 王鸿彦; 韦银星
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-08-31
Filing date: 2010-03-23
Publication date: 2011-03-03
Also published as: CN102006591A

Abstract

A method for protecting the security of data transmission, authentication server and terminal are disclosed in the present invention. The method includes: the authentication server receives an authentication request from the terminal and performs authentication with the terminal; the authentication server generates key information, and after the authentication is successful, it sends the key information to an access network function module so that the access network function module can establish a connection with and/or transmit data to the terminal by using the key information. With the invention, the problem is solved that there is no security protection between the terminal and the access network node in the existing NGN (next generation network) network in related technologies, and thus the security is improved when the terminal accesses the network node.

Description

The present invention relates to the field of communications, and in particular to a data transmission security protection method, an authentication server, and a terminal. BACKGROUND OF THE INVENTION Next Generation Network (NGN) is receiving more and more attention as an evolved packet switching based network framework. The International Telecommunications Union-Telecommunications Standardization Sector (ITU-T) and other regional standards organizations have conducted extensive research and standardization work on NGN framework models, services, and related fields.

NGN can support heterogeneous network access, inter-network roaming, and seamless handover. When the user terminal performs data communication and handover, the continuity of the service needs to be ensured, and at the same time, the privacy and integrity of the signaling data and the user data between the mobile user terminal and the NGN network access point are guaranteed. In the current NGN network, there is no security protection between the user terminal and the access network node, which may have many security problems. For example, unencrypted data of the unlicensed user terminal and the access network node may be eavesdropped. The user's network behavior may also be monitored, which has a great impact on the user's privacy. SUMMARY OF THE INVENTION The present invention has been made in view of the security problem in the prior art that there is no security protection between the user terminal and the access network node in the current NGN network. Therefore, the main purpose of the present invention is to provide a data transmission security protection solution. To solve at least one of the above problems. In order to achieve the above object, according to an aspect of the present invention, a data transmission security protection method is provided. The data transmission security protection method according to the present invention is applied to a next generation network, including: the authentication server receives an authentication request from the terminal, and performs authentication with the terminal; the authentication server generates key information, and after the authentication succeeds Send the key information to the access network function module for easy access The incoming network function module establishes a connection with the terminal through key information and/or performs data transmission. Further, the sending, by the authentication server, the key information to the access network function module includes: the authentication server sends the key information to the access network function module via the access management function module. Further, the sending, by the authentication server, the key information to the access network function module includes: sending, by the authentication server, the key information to the access network function module via the access forwarding function module. Further, the generating the key information by the authentication server includes: the authentication server cooperates with other types of servers to generate key information, wherein the other types of servers include the transmission user information server. Further, after the authentication server generates the key information, the method further includes: authenticating the server and the terminal to save the key information. In order to achieve the above object, according to another aspect of the present invention, an authentication server is also provided. The authentication server according to the present invention is applied to a next generation network, and includes: a first receiving module, configured to receive an authentication request from the terminal; an authentication module, configured to perform authentication with the terminal; and a key module, configured to generate key information The first sending module is configured to send the key information to the access network function module after the authentication succeeds, so that the access network function module establishes a connection with the terminal through the key information and/or performs data transmission. Further, the first sending module is specifically configured to send the key information to the access network function module via the access management function module, where the access management function module is configured to perform at least the following functions:: terminating the layer 2 transmission link, Obtain access network information, forward authentication request, and obtain network configuration information. Further, the first sending module is specifically configured to send the key information to the access network function module via the access forwarding function module, where the access forwarding function module is configured to perform at least one of the following functions: access and/or forwarding Network configuration information of the terminal, authentication request for accessing and/or forwarding terminals, and adding local configuration information. Further, the key module is specifically configured to cooperate with other types of servers to generate key information, where other types of servers include a transport user information server, and other types of servers are used to perform at least one of the following functions: maintaining user information, generating User authentication vector, generating key information. In order to achieve the above object, according to another aspect of the present invention, a terminal is also provided. The terminal according to the present invention is applied to a next generation network, and includes: a second sending module, configured to send an authentication request to the authentication server; a second receiving module, configured to receive key information from the authentication server; and a saving module, It is used to save key information, so as to establish a connection and/or data transmission with the access network function module through the key information. Through the invention, the terminal and the authentication server perform authentication and generate key information, and the access network function module communicates with the terminal securely with the key information, and solves the related technology in which the user terminal is in the current NGN network. There is no security protection between network nodes, and there are security problems, which improves the security of the terminal when accessing the network node. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a flowchart of a data transmission security protection method according to an embodiment of the present invention; FIG. 2 is a schematic diagram of obtaining a key material by an access forwarding function module in a next generation network according to an embodiment of the present invention; It is a flowchart of obtaining key material from an access forwarding function module in the same domain according to an embodiment of the present invention; FIG. 4 is a slave access management function module in the same domain of an access network function module according to an embodiment of the present invention; A flowchart of obtaining a key material; FIG. 5 is a flowchart of obtaining key material in different domains of an access network function module according to an embodiment of the present invention; FIG. 6 is an access network function in an ITU-T NGN according to an embodiment of the present invention; FIG. 7 is a structural block diagram of an authentication server according to an embodiment of the present invention; and FIG. 8 is a structural block diagram of a terminal according to an embodiment of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. In the following embodiments, the steps shown in the flowchart of the accompanying drawings may be performed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some In this case, the steps shown or described may be performed in a different order than the ones described herein. Method Embodiment According to an embodiment of the present invention, a data transmission security protection method is provided, which is applied to a next generation network, and the method can be applied to a transmission layer. 1 is a flowchart of a data transmission security protection method according to an embodiment of the present invention. The method includes the following steps S2 to S4: Step S2: The authentication server receives an authentication request from the terminal, and performs authentication with the terminal. Step S4: The authentication server generates key information, and after the authentication succeeds, sends the key information to the access network function module, so that the access network function module establishes a connection with the terminal through the key information and/or performs data transmission. Through the above steps S2 and S4, the access network function module can establish a connection with the terminal through the key information and/or perform data transmission, thereby improving the security of data transmission. Preferably, in step S4, the authentication server may send the key information to the access network function module via the access management function module, where the access management function module should have, but is not limited to, the following functions: Terminating the Layer 2 transport link, Obtain access network information (for example, link layer parameters, identifiers, terminal locations, etc.), forward authentication request, and obtain network configuration information; or send key information to the access network function module via the access forwarding function module. The access forwarding function module should have, but is not limited to, the following functions: accessing and forwarding the terminal authentication request. To access and forward the network configuration information of the terminal, you can add local configuration information. Preferably, in step S4, the authentication server may separately generate key information, or may cooperate with other types of servers to generate key information, wherein other types of servers may include a transmission user information server. After the authentication server generates the key information, the authentication server may save the key information and send the key information to the terminal for the terminal to save. The data transmission security protection scheme of this embodiment will be described in detail below. Step S22: The terminal performs authentication with the authentication server. Step S24, after the authentication is successful, the terminal and the authentication server have shared key material (ie, key information). The shared key material is generated during the authentication process. Step S26: The authentication server sends the shared key material to the access network function module, where the access network function module should have, but is not limited to, at least one of the following functions: a border node on the network side, responsible for data transmission with the terminal. Step S28: The access network function module uses the shared key material to perform secure communication with the terminal. In step S28, the authentication server may derive the subkey material using the shared key material. The terminal derives the shared key material from the obtained key key material. Then, the authentication server sends the derived subkey material to the access network function module, and the access network function module uses the subkey material from the authentication server to perform secure communication with the terminal. In step S22, the authentication server performs user authentication, may generate key material, or may cooperate with other servers (for example, a transmission user information server) to jointly generate key materials, wherein other servers (for example, transmitting user information servers) There should be, but are not limited to, at least one of the following functions: Maintain user information, generate a user authentication vector, and generate key material. The implementation process of the embodiment of the present invention will be described in detail below with reference to examples. 2 is a schematic diagram of obtaining key material by an access forwarding function module in a next generation network according to an embodiment of the present invention. The terminal 150 and the authentication server 130 perform authentication. After the authentication succeeds, both the terminal 150 and the authentication server 130 are authenticated. Get the shared key material. The authentication server 130 can send the shared key material to the access network function module in two ways. In the first mode, the authentication server 130 sends the shared key material to the access management function module 100, and the access management function module 100 delivers the shared key material to the access network function module 120. In the second mode, the authentication server 130 sends the shared key material to the access forwarding function module 110, and the access forwarding function module 110 delivers the shared key material to the access network function module 120. 3 is an access network function module accessing a forwarding function in the same domain according to an embodiment of the present invention; The flow chart of the key module is obtained by the module, and the process includes the following steps S302 to S308: Step S302: The terminal and the authentication server perform authentication, and the shared key material of the terminal and the authentication server is generated in the authentication process. Step S304: The authentication server sends the key material to the access forwarding function module. It should be noted that the step S304 may be performed in the authentication process or may be performed after the authentication process, but the step must be performed if the authentication is successful. Step S306, the access network function module obtains the key material from the access forwarding function module. Step S308: The terminal and the access forwarding function module share a key material, and the shared key can be used to establish a security alliance to secure communication between the terminal and the access forwarding function module. 4 is a flowchart of obtaining key material from an access management function module in the same domain in the same domain according to an embodiment of the present invention. The process includes the following steps S402 to S408: Step S402, the terminal and the authentication server perform authentication, The shared key material authentication process of the terminal and the authentication server is generated. Step S404: The authentication server sends the key material to the access management function module. It should be noted that the step S404 may be performed in the authentication process or may be performed after the authentication process. However, this step must be performed only if the authentication is successful. Step S406, the access network function module obtains the shared key material from the access management function module. Step S408: The terminal and the access forwarding function module both share a key material, and the shared key can be used to establish a security alliance to secure communication between the terminal and the access forwarding function module. FIG. 5 is a flowchart of obtaining key material in different domains of an access network function module according to an embodiment of the present invention. The process includes the following steps: Step S502: The terminal and the destination domain authentication server perform authentication, and the terminal and destination domain authentication are performed. The server's shared key material is generated during the authentication process. The authentication process may involve the original access forwarding function module, the original access management function module, the original authentication server, the destination domain access forwarding function module, and the destination domain access management function module. Step S504, the destination domain access network function module has two ways to obtain the shared key material. In the first mode, in step S504a, the destination domain authentication server sends the shared key material to the destination domain for access. The forwarding function module, the destination domain access forwarding function module sends the shared key material to the destination domain access network module; and the second method, that is, step S504b, the destination domain authentication server sends the shared key material to the destination domain access management function module, and the purpose is The domain access management function module sends the shared key material to the destination domain access network module. It should be noted that the step S604 may be performed in the authentication process or may be performed after the authentication process, but the step must be performed if the authentication is successful. Step S506: The terminal and the destination domain access forwarding function module both share a key material, and the shared key can be used to establish a security association, and the communication security between the terminal and the destination domain access forwarding function module is protected. 6 is a schematic diagram of an access network function module obtaining a key in an ITU-T NGN according to an embodiment of the present invention. A UE indicates a user equipment, and an AM-FE (Access Management Function Entity) indicates an access management function module, TAA. The transport authentication and authorization functional entity (FE) indicates the function of the transmission authentication function, and the AR-FE (Access relay functional entity) indicates the function of transmitting the user information. The user information may be stored in the TUP, and an authentication vector may be generated, and then sent to the TAA to perform a user authentication process with the TAA. The process includes the following steps: Step S602: The access network function module obtains key material from the access management function module. Step S604, the access network function module obtains the key material from the access forwarding function module. The device embodiment provides an authentication server for use in a next generation network according to an embodiment of the present invention. FIG. 7 is a structural block diagram of an authentication server according to an embodiment of the present invention. The authentication server includes: A receiving module 72, an authentication module 74, a key module 76, and a first transmitting module 78 are described in detail below. The first receiving module 72 is configured to receive an authentication request from the terminal; the authentication module 74 is connected to the first receiving module 72 for performing authentication with the terminal; and the key module 76 is connected to the authentication module 74 for generating key information. The first sending module 78 is connected to the key module 76, and is configured to send the key information to the access network function module after the authentication succeeds, so that the access network function module establishes a connection with the terminal through the key information and/or performs data transmission. Preferably, the first sending module 78 may be specifically configured to use a key through the access management function module. The information is sent to the access network function module, where the access management function module is configured to perform at least one of the following functions: terminating the layer 2 transmission link, obtaining the access network information, forwarding the authentication request, and obtaining the network configuration information. Preferably, the first sending module 78 is specifically configured to send the key information to the access network function module via the access forwarding function module, where the access forwarding function module is configured to perform at least one of the following functions: access and/or Forward the network configuration information of the terminal, the authentication request of the access and/or forwarding terminal, and add the local configuration information. Preferably, the key module 76 is specifically configured to cooperate with other types of servers to generate key information, wherein other types of servers include a transport user information server, and other types of servers are used to perform at least one of the following functions: maintaining user information, Generate a user authentication vector and generate key information. According to an embodiment of the present invention, a terminal is further provided for use in a next-generation network, and FIG. 8 is a structural block diagram of a terminal according to an embodiment of the present invention. As shown in FIG. 8, the terminal includes: a second sending module 82. The second receiving module 84 and the saving module 86 are described in detail below. The second sending module 82 is configured to send an authentication request to the authentication server. The second receiving module 84 is connected to the second sending module 82 for receiving key information from the authentication server. The saving module 86 is connected to the second receiving module 84. It is used to save key information, so as to establish a connection and/or data transmission with the access network function module through the key information. In summary, the foregoing embodiments of the present invention solve the problem that the user terminal does not have security protection between the user terminal and the access network node in the current NGN network, and there is a security problem, thereby improving the terminal accessing the network node. safety. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device, or they may be separately fabricated into individual integrated circuit modules, or they may be Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modification, equivalent substitution, improvement, etc. made within the "God and Principles" of the present invention shall be included in the protection of the present invention. Within the scope.

Claims

A data transmission security protection method is applied to a next generation network, and the method includes: the authentication server receives an authentication request from the terminal, and performs authentication with the terminal; generates key information, and authenticates After the success, the key information is sent to the access network function module, so that the access network function module establishes a connection with the terminal and/or performs data transmission by using the key information. The method according to claim 1, wherein the sending, by the authentication server, the key information to the access network function module comprises:

The authentication server transmits the key information to the access network function module via an access management function module. The method according to claim 1, wherein the sending, by the authentication server, the key information to the access network function module comprises:

The authentication server sends the key information to the access network function module via the access forwarding function module. The method according to any one of claims 1 to 3, wherein the generating, by the authentication server, the key information comprises:

The authentication server cooperates with other types of servers to generate the key information, wherein the other types of servers include a transport user information server. The method according to any one of claims 1 to 3, wherein after the authentication server generates the key information, the method further comprises:

The authentication server and the terminal save the key information. The authentication server is applied to the next generation network, and is characterized in that: the first receiving module is configured to receive an authentication request from the terminal;

An authentication module, configured to perform authentication with the terminal; and a key module, configured to generate key information; a first sending module, configured to send the key information to an access network function module after the authentication succeeds, so that the access network function module establishes a connection with the terminal by using the key information, and/or Data transfer. The authentication server according to claim 6, wherein the first sending module is specifically configured to send the key information to the access network function module via an access management function module, where the The ingress management function module is configured to perform at least one of the following functions: Terminating a Layer 2 transport link, obtaining access network information, forwarding an authentication request, and obtaining network configuration information. The authentication server according to claim 6, wherein the first sending module is configured to send the key information to the access network function module via an access forwarding function module, where the The ingress forwarding function module is configured to perform at least one of: accessing and/or forwarding network configuration information of the terminal, accessing and/or forwarding an authentication request of the terminal, and adding local configuration information. The authentication server according to any one of claims 6 to 8, wherein the key module is specifically configured to generate the key information in cooperation with other types of servers, wherein the other types of servers include The user information server is transmitted, and the other type of server is configured to perform at least one of the following functions: maintaining user information, generating a user authentication vector, and generating key information. A terminal, applied to a next generation network, characterized in that:

a second sending module, configured to send an authentication request to the authentication server;

a second receiving module, configured to receive key information from the authentication server, and a saving module, configured to save the key information, so as to establish a connection and/or perform connection with the access network function module by using the key information. data transmission.