WO2011127732A1 - 下一代网络中多接入认证方法及系统 - Google Patents

下一代网络中多接入认证方法及系统 Download PDF

Info

Publication number
WO2011127732A1
WO2011127732A1 PCT/CN2010/078896 CN2010078896W WO2011127732A1 WO 2011127732 A1 WO2011127732 A1 WO 2011127732A1 CN 2010078896 W CN2010078896 W CN 2010078896W WO 2011127732 A1 WO2011127732 A1 WO 2011127732A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
user terminal
function module
information
key material
Prior art date
Application number
PCT/CN2010/078896
Other languages
English (en)
French (fr)
Inventor
王鸿彦
韦银星
毕以峰
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP10849741.3A priority Critical patent/EP2557727B1/en
Priority to US13/641,018 priority patent/US8949944B2/en
Publication of WO2011127732A1 publication Critical patent/WO2011127732A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use

Definitions

  • the present invention relates to authentication technologies, and in particular, to a multi-access authentication method and system in a Next Generation Network (NGN).
  • NTN Next Generation Network
  • NGN has received increasing attention as an evolved packet-switched network framework.
  • ITU-T Telecommunication Standardization Sector of the International Telecommunications Union and other regional standards organizations
  • ETSI European Telecommunications Standards Institute
  • ATIS World Wireless Communications Solutions Alliance
  • Telecommunications Industry Solution has conducted extensive research and standardization work on the NGN framework model, business and related fields.
  • NGN can support multiple network access.
  • the mobile user terminal performs multiple access, it is required to ensure the continuity of the service, and at the same time reduce the authentication signaling of the mobile user terminal and the NGN network.
  • Five multi-access scenarios are defined in the NGN network.
  • the scenario is as follows: The user has multiple access modules and accesses the same access node at the same time, which can achieve higher speed, provide faster data transmission, optimize the experience, and improve the utilization of wireless resources.
  • users access the same node at the same time, they need to protect the data privacy and integrity of different access modules and network access nodes.
  • different access modules of the terminal To achieve the purpose that different access modules do not interfere with each other, different access modules of the terminal. Different keys should be used.
  • the terminal can generate different keys by using different access modules to authenticate with the NGN network one by one.
  • the main purpose of the present invention is to provide a multi-access authentication method and system in a next-generation network.
  • a key for multi-access information of the user terminal is generated. Material, so as to achieve key protection for each access service.
  • a multi-access authentication method in a next-generation network where the network side is provided with a network-side authentication center and an access node, where the access node includes an access forwarding function module and an access management function module; the method includes:
  • the network side authentication center After receiving the user terminal information sent by the user terminal, the network side authentication center generates an authentication vector; the user terminal information includes the subscription information and the multiple access information of the user terminal;
  • the user terminal After receiving the authentication request sent by the network side authentication center, the user terminal performs authentication on the network side. After the authentication succeeds, the user equipment generates key material and network side authentication information according to the multiple access information of the network, and authenticates the network side. Sending the information to the network side authentication center; where the authentication request includes the authentication information;
  • the network side authentication center authenticates the network side authentication information by using the authentication vector
  • the key material is generated according to the multiple access information of the user terminal.
  • the method further includes:
  • the access forwarding function module acquires the key material from the network side authentication center or the access management function module, and encrypts and accesses the access service information of the user terminal by using the key material.
  • the key material is generated according to the multi-access information of the user terminal itself: the user terminal generates a key material of each access interface according to the multiple access information of the user terminal; After the authentication is successful, the key material is generated according to the multiple access information of the user terminal: the network side authentication center generates the key material of each access interface according to the multiple access information of the user terminal;
  • the access forwarding function module acquires the key material from the network side authentication center as: the network side authentication center directly sends the access forwarding function module, or sends the information to the access management function module The access forwarding function module.
  • the key material is generated according to the multiple access information of the user terminal itself: the user terminal generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the key material is generated according to the multiple access information of the user terminal: the network side authentication center generates a master key, and generates a confidentiality of each access interface according to the multiple access information of the user terminal.
  • the access forwarding function module acquires the key material from the network side authentication center: the network side authentication center directly sends the generated key material to the access forwarding function module, or through the The access management function module sends the access forwarding function module.
  • the key material is generated according to the multiple access information of the user terminal itself: the user terminal generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the key material is generated according to the multiple access information of the user terminal: the network side authentication center generates the key material of each access interface according to the multiple access information of the user terminal;
  • the access forwarding function module acquires the key material from the network side authentication center: the network side authentication center directly sends the generated key material to the access forwarding function module, or through the The access management function module sends the access forwarding function module.
  • the key material is generated according to the multi-access information of the user terminal itself:
  • the user terminal generates a key material of each access interface according to the multiple access information of the user; after the authentication succeeds, the key material is generated according to the multiple access information of the user terminal: the network side authentication center generates one a master key, and generating a key material of each access interface according to the multiple access information of the user terminal;
  • the access forwarding function module acquires the key material from the network side authentication center: the network side authentication center directly sends the generated key material to the access forwarding function module, or through the The access management function module sends the access forwarding function module.
  • the key material is generated according to the multiple access information of the user terminal itself: the user terminal generates a key material of each access interface according to the multiple access information of the user terminal;
  • the multi-access information generating key material of the terminal is: the network-side authentication center generates a master key, and notifies the access management function module; the access management function module is configured according to the master key and the The multiple access information of the user terminal generates the key material of each access interface; wherein the access management function module acquires multiple access information of the user terminal from the user terminal or the network side authentication center;
  • the access forwarding function module acquires the key material from the access management function module, where
  • the access management function module sends the generated key material to the access forwarding function module.
  • the key material is generated according to the multiple access information of the user terminal itself: the user terminal generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the access forwarding function module acquires the key material from the network side authentication center: the network side authentication center generates a master key, and notifies the access management function module; the access management function The module generates a key material of each access interface according to the master key and the multiple access information of the user terminal, where the access management function module is from the user terminal or The network side authentication center acquires multiple access information of the user terminal;
  • the access forwarding function module acquires the key material from the access management function module, where
  • the access management function module sends the generated key material to the access forwarding function module.
  • a multi-access authentication system in a next-generation network comprising a network side and a user terminal, where the network side is provided with a network-side authentication center and an access node, and the access node includes an access forwarding function module and an access management function module.
  • the system further includes a first receiving unit, a first generating unit, a second receiving unit, a first authenticating unit, a second generating unit, a transmitting unit, a second authenticating unit, and a third generating unit, and the second receiving unit
  • the first authentication unit, the second generation unit, and the sending unit are disposed in the user terminal, and the first receiving unit, the first generating unit, the second authentication unit, and the third generating unit are disposed in the network side authentication center. ; among them:
  • a first receiving unit configured to receive user terminal information sent by the user terminal;
  • the user terminal information includes subscription information and multiple access information of the user terminal;
  • a first generating unit configured to generate an authentication vector after the first receiving unit receives the user terminal information
  • a second receiving unit configured to receive an authentication request sent by the network side authentication center, where the first authentication unit is configured to perform authentication on the network side;
  • a second generating unit configured to generate a key material and network side authentication information according to the multiple access information of the user terminal after the first authentication unit is successfully authenticated
  • a sending unit configured to send the network side authentication information to the network side authentication center, where the authentication request includes authentication information
  • a second authentication unit configured to authenticate the network side authentication information by using the authentication vector
  • a third generating unit configured to perform, according to the user end after the second authentication unit is successfully authenticated
  • the multi-access information at the end generates a key material.
  • the access forwarding function module acquires the key material from the network side authentication center or the access management function module; the access forwarding function module uses the key material to the user terminal
  • the access service information is encrypted and decrypted.
  • the second generating unit further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit generates a key material of each access interface according to the multiple access information of the user terminal;
  • the obtaining, by the access forwarding function module, the key material from the network side authentication center is: the third generating unit directly sends the generated key material to the access forwarding function module, or by using the The access management function module sends the access forwarding function module.
  • the second generating unit further generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the third generating unit further generates a master key, and generates a key material of each access interface according to the multiple access information of the user terminal;
  • the obtaining, by the access forwarding function module, the key material from the network side authentication center is: the third generating unit directly sends the generated key material to the access forwarding function module, or by using the The access management function module sends the access forwarding function module.
  • the second generating unit further generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the third generating unit further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the obtaining, by the access forwarding function module, the key material from the network side authentication center is: the third generating unit directly sends the generated key material to the access forwarding function module, or by using the The access management function module sends the access forwarding function module.
  • the second generating unit further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit further generates a master key, and generates a key material of each access interface according to the multiple access information of the user terminal;
  • the obtaining, by the access forwarding function module, the key material from the network side authentication center is: the third generating unit directly sends the generated key material to the access forwarding function module, or by using the The access management function module sends the access forwarding function module.
  • the second generating unit further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit further generates a master key, and sends the master key to the access management function module.
  • the access management function module generates each access according to the master key and the multiple access information of the user terminal. Key material of the interface; wherein the access management function module acquires multiple access information of the user terminal from the user terminal or the network side authentication center;
  • the access forwarding function module acquires the key material from the access management function module as:
  • the access management function module sends the generated key material to the access forwarding function module.
  • the second generating unit further generates a master key, and generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit further generates a master key and sends the key to the access management function module;
  • the access management function module generates a key material of each access interface according to the master key and the multiple access information of the user terminal; wherein the access management function module is from the user terminal or the The network side authentication center acquires multiple access information of the user terminal;
  • the access forwarding function module acquires the key material from the access management function module
  • the access management function module sends the generated key material to the access forwarding function module.
  • the user terminal when the user terminal accesses the NGN network and authenticates with the authentication server in the NGN network, the user terminal notifies the multi-access information supported by the user terminal to the authentication server, and the authentication server uses the same secret as the user terminal side.
  • the key generation method generates a key material for the multiple access information.
  • the service information is encrypted and decrypted by using the corresponding key material, thereby implementing multiple access between the network side and the user terminal. Information is protected.
  • the user terminal multi-access information key material is generated in the authentication process, and it is not necessary to separately authenticate each access service and generate corresponding key material, thereby saving Valuable air interface resources and improve the efficiency of user terminals accessing the network.
  • FIG. 1 is a flowchart of Embodiment 1 of a multi-access authentication method in a next-generation network according to the present invention.
  • FIG. 2 is a flowchart of Embodiment 2 of a multi-access authentication method in a next-generation network according to the present invention.
  • FIG. - Flowchart of the third embodiment of the multi-access authentication method in the generation network
  • FIG. 4 is a flowchart of the fourth embodiment of the multi-access authentication method in the next generation network of the present invention.
  • FIG. 5 is a multi-generation network in the present invention.
  • FIG. 6 is a flowchart of Embodiment 6 of a multi-access authentication method in a lower-generation network according to the present invention.
  • FIG. 7 is a flowchart of a multi-access authentication method in a lower-generation network according to the present invention.
  • FIG. 8 is a schematic diagram showing the structure of a multi-access authentication system in a lower-generation network according to the present invention.
  • the basic idea of the present invention is: when the user terminal accesses the NGN network and authenticates with the authentication server in the NGN network, the user terminal notifies the multi-access information supported by the user terminal to the authentication.
  • the server, the authentication server and the user terminal side generate the key material for the multiple access information by using the same key generation method, and when the user terminal performs the corresponding service with the network side, the service information is encrypted and decrypted by using the corresponding key material, thereby The multi-access information is protected between the network side and the user terminal.
  • the NGN network includes a network side and a user terminal, wherein the network side is provided with a network side authentication center, a user data center, and an access node, and the network side authentication center includes an authentication function server and other network elements having an authentication function, and user information.
  • the center is used for storing data such as subscription information of the user terminal, such as a home location register (HLR, Home Location Register) or a home subscriber server (HSS, Home Subscriber Server); the access node includes a base station and/or a base station.
  • HLR home location register
  • HSS Home Subscriber Server
  • the access node includes a basic function module such as an access forwarding function module and an access management function module, wherein the access forwarding function module is used to forward the access service, and the access management function module is used. Manage the access service accordingly.
  • a basic function module such as an access forwarding function module and an access management function module, wherein the access forwarding function module is used to forward the access service, and the access management function module is used. Manage the access service accordingly.
  • FIG. 1 is a flowchart of Embodiment 1 of a multiple access authentication method in a next generation network according to the present invention. As shown in FIG. 1 , the multiple access authentication method in the next generation network of the present example includes the following steps:
  • Step 110 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal.
  • the authentication server After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector.
  • the authentication vector may be directly generated by the authentication server, and may be directly calculated according to the user registration information reported by the user terminal and the related algorithm using the authentication vector set in advance.
  • calculate the certification direction The basic information involved in the quantity includes various information signed by the user and identification information of the user terminal.
  • the above authentication vector may also generate an authentication vector by interacting with the user information center to obtain the subscription information of the user terminal.
  • Step 120 The authentication server sends an authentication request to the user terminal, where the authentication request includes authentication information, such as a challenge value.
  • the authentication process for the user terminal is implemented, and the authentication process is a process of mutual authentication between the network side and the authentication server. Specifically, the authentication server first initiates an authentication request to the user terminal to implement authentication of the user terminal.
  • Step 130 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, the key material and the network side authentication information are generated according to the multiple access information. The generated network side authentication information is sent to the authentication server.
  • Step 140 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates a key material according to the multiple access information of the user terminal. The authentication server sends the key material to the access forwarding function module, or to the access forwarding function module and the access management function module, or to the access forwarding function module through the access management function module.
  • the multi-access information is protected by the key material.
  • the user terminal is the same as the key generation algorithm for generating the key material by the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal and the authentication server, and the user terminal and the authentication server are the same according to the same.
  • a key generation algorithm that generates a corresponding key based on the same elements. Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption source code (RSA) and other key generation algorithms.
  • DES Data Encryption Standard
  • RSA symmetric encryption source code
  • the user terminal and the authentication server side generate a key material according to the multiple access information of the user terminal, and the key material is applicable to each access interface corresponding to each access service of the user terminal, that is, all the connections.
  • the inbound interface will use the above key material to add business information. Decrypt.
  • FIG. 2 is a flowchart of Embodiment 2 of a multiple access authentication method in a next generation network according to the present invention.
  • the multiple access authentication method in the next generation network of the present example includes the following steps:
  • Step 210 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal. After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector.
  • This step is the same as the aforementioned step 110.
  • Step 220 The authentication server sends an authentication request to the user terminal, where the authentication request includes authentication information such as a challenge value. This step is the same as the aforementioned step 120.
  • Step 230 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, a master key is generated, and the key material of each access interface is generated according to the multiple access information of the user terminal. And generate network side authentication information. The generated network side authentication information is sent to the authentication server.
  • the user terminal In this step, the user terminal generates a master key according to the corresponding key generation algorithm, and then uses the master key to generate a key material for each of the multiple access interfaces, and each access interface uses its own key material. Encryption and decryption processing.
  • Step 240 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates a master key according to the corresponding key generation algorithm, and then generates according to the multiple access information of the user terminal. The key material of each access interface of the user terminal. The authentication server sends the generated key material to the access forwarding function module, or to the access forwarding function module and the access management function module, or to the access forwarding function module through the access management function module. When the user terminal and the network side implement each service, the multi-access information is protected by the key material.
  • the user terminal is the same as the key generation algorithm for generating the key material by the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal and the authentication server, and both the user terminal side and the authentication server are Mr.
  • the master key is generated according to each of the multi-access information of the user terminal, and the key material of the access interface on the user terminal side and the authentication server side is the same.
  • Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption (RSA) and other key generation algorithms.
  • FIG. 3 is a flowchart of Embodiment 3 of a multiple access authentication method in a next generation network according to the present invention.
  • the multiple access authentication method in the next generation network of the present example includes the following steps:
  • Step 310 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal. After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector.
  • This step is the same as the aforementioned step 110.
  • Step 320 The authentication server sends an authentication request to the user terminal, where the authentication request includes the authentication information, such as a challenge value. This step is the same as the aforementioned step 120.
  • Step 330 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, the key material of each access interface is generated according to the multiple access information of the user terminal, and the generated network side is generated. Certification Information. The generated network side authentication information is sent to the authentication server.
  • the user terminal generates a key material according to each of the corresponding key generation algorithm and the multiple access information, and each access interface performs encryption and decryption processing using the respective key material.
  • Step 340 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates the access interfaces of the user terminal according to the corresponding key generation algorithm and the multi-access information of the user terminal. Key material. The authentication server will generate the secret The key material is sent to the access forwarding function module, or sent to the access forwarding function module and the access management function module, or sent to the access forwarding function module through the access management function module. When the user terminal and the network side implement each service, the multi-access information is protected by the key material.
  • the user terminal is the same as the key generation algorithm for generating the key material by the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal and the authentication server, and the user terminal and the authentication server are the same according to the same.
  • a key generation algorithm that generates a corresponding key based on the same elements. Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption (RSA) and other key generation algorithms.
  • the user terminal and the authentication server side respectively generate key materials based on the key generation algorithm and the multiple access information of the user terminal.
  • the key material of each access interface is used for encryption and decryption.
  • FIG. 4 is a flowchart of Embodiment 4 of a multiple access authentication method in a next generation network according to the present invention.
  • the multiple access authentication method in the next generation network of the present example includes the following steps:
  • Step 410 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal. After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector.
  • This step is the same as the aforementioned step 110.
  • Step 420 The authentication server sends an authentication request to the user terminal, where the authentication request includes the authentication information, such as a challenge value. This step is the same as the aforementioned step 120.
  • Step 430 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, a master key is generated, and the key material of each access interface is generated according to the multiple access information of the user terminal. And generate network side authentication information. The generated network side authentication information is sent to the authentication server. In this step, the user terminal generates a master key according to the corresponding key generation algorithm, and then uses the master key to generate a key material for each of the multiple access interfaces, and each access interface uses its own key material. Encryption and decryption processing.
  • Step 440 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates the access interfaces of the user terminal according to the corresponding key generation algorithm and the multi-access information of the user terminal. Key material. The authentication server sends the generated key material to the access forwarding function module, or to the access forwarding function module and the access management function module, or to the access forwarding function module through the access management function module. When the user terminal and the network side implement each service, the multi-access information is protected by the key material.
  • the main difference between this step and the foregoing step 240 is that the master key is no longer generated, but the key material of the corresponding interface is generated by each of the key generation algorithm and the multiple access information.
  • the user terminal is the same as the key generation algorithm for generating the key material by the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal and the authentication server, and the user terminal side becomes the master key.
  • the key material is separately generated according to each of the user terminal multiple access information, and the authentication server directly generates each key material according to the same key generation algorithm and the user terminal multiple access information, so that the user terminal side
  • the key material of the corresponding access interface on the authentication server side is the same.
  • Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption (RSA) and other key generation algorithms.
  • FIG. 5 is a flowchart of Embodiment 5 of a multiple access authentication method in a next generation network according to the present invention.
  • the multiple access authentication method in the next generation network of the present example includes the following steps:
  • Step 510 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal. After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector. This step is the same as the aforementioned step 110.
  • Step 520 The authentication server sends an authentication request to the user terminal, where the authentication request includes the authentication information, such as a challenge value.
  • This step is the same as the aforementioned step 120.
  • Step 530 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, the key material of each access interface is generated according to the multiple access information of the user terminal, and the generated network side is generated. Certification Information. The generated network side authentication information is sent to the authentication server.
  • the user terminal generates a key material according to each of the corresponding key generation algorithm and the multiple access information, and each access interface performs encryption and decryption processing using the respective key material.
  • Step 540 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates a master key according to the corresponding key generation algorithm, and then generates according to the multiple access information of the user terminal. The key material of each access interface of the user terminal. The authentication server sends the generated key material to the access forwarding function module, or simultaneously to the access forwarding function module and the access management function module, or sends the access forwarding function module to the access forwarding function module. When the user terminal and the network side implement each service, the multi-access information is protected by the key material.
  • the user terminal is the same as the key generation algorithm for generating the key material by the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal and the authentication server, and the user terminal side configures the key according to the user.
  • Each of the generation algorithm and the multi-access information of the user terminal directly generates each key material, and the authentication server is a master key, and then generates a key material according to each of the user terminal multiple access information, and the user terminal side
  • the key material of the corresponding access interface on the authentication server side is the same.
  • Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption (RSA) and other key generation algorithms.
  • FIG. 6 is a flowchart of Embodiment 6 of a multiple access authentication method in a next generation network according to the present invention, as shown in FIG. 6 As shown, the multi-access authentication method in the present example of the next generation network includes the following steps:
  • Step 610 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal. After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector.
  • This step is the same as the aforementioned step 110.
  • Step 620 The authentication server sends an authentication request to the user terminal, where the authentication request includes the authentication information, such as a challenge value.
  • This step is the same as the aforementioned step 120.
  • Step 630 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, the key material of each access interface is generated according to the multiple access information of the user terminal, and the generated network side is generated. Certification Information. The generated network side authentication information is sent to the authentication server.
  • the user terminal generates a key material according to each of the corresponding key generation algorithm and the multiple access information, and each access interface performs encryption and decryption processing using the respective key material.
  • Step 640 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates a master key according to the corresponding key generation algorithm, and sends the master key to the access management function module. ;
  • Step 650 The access management function module generates a key material of each access interface according to the master key and the multiple access information of the user terminal, and sends the key material to the access forwarding function module.
  • the access management function module is configured from the user terminal or The network side authentication center acquires multiple access information of the user terminal.
  • the user terminal and the access management function module are the same as the key generation algorithm configured in the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal, the access management function module, and the authentication server.
  • the user terminal side generates a calculation according to the key configured by itself.
  • Each of the multiple access information of the method and the user terminal directly generates each key material, and the authentication server generates only the master key.
  • the access management function module generates a key material according to each of the master key and the user terminal multiple access information, and the key material of the access interface corresponding to the user terminal side and the authentication server side is the same.
  • Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption (RSA) and other key generation algorithms.
  • FIG. 7 is a flowchart of Embodiment 7 of a multiple access authentication method in a next generation network according to the present invention. As shown in FIG. 7, the multiple access authentication method in the next generation network of the present example includes the following steps:
  • Step 710 When the user terminal accesses the network, the access node sends its own related message to the authentication server, and the message sent by the user terminal to the authentication server includes at least the subscription information of the user terminal and the multiple access service supported by the user terminal. Multiple access information, where the multiple access information includes a logo of the multi-access service and multi-interface information of the user terminal. After receiving the related message sent by the user terminal, the authentication server generates a corresponding authentication vector.
  • This step is the same as the aforementioned step 110.
  • Step 720 The authentication server sends an authentication request to the user terminal, where the authentication request includes the authentication information, such as a challenge value.
  • This step is the same as the aforementioned step 120.
  • Step 730 After receiving the authentication request, the user terminal performs authentication on the network side according to the authentication information in the authentication request. After the authentication succeeds, a master key is generated, and the key material of each access interface is generated according to the multiple access information of the user terminal. And generate network side authentication information. The generated network side authentication information is sent to the authentication server.
  • the user terminal In this step, the user terminal generates a master key according to the corresponding key generation algorithm, and then uses the master key to generate a key material for each of the multiple access interfaces, and each access interface uses its own key material. Encryption and decryption processing.
  • Step 740 After receiving the authentication response information, the authentication server authenticates the terminal according to the information in the authentication response. After the authentication succeeds, the authentication server generates a primary key according to the corresponding key generation algorithm. Key, and sent to the access management function module;
  • Step 750 The access management function module generates a key material of each access interface according to the master key and the multiple access information of the user terminal, and sends the key material of each access interface to the access forwarding function module.
  • the access management function module is configured from the user terminal or The network side authentication center acquires multiple access information of the user terminal.
  • the user terminal and the access management function module are the same as the key generation algorithm configured in the authentication server, that is, the same key generation algorithm is configured in advance in the user terminal, the access management function module, and the authentication server.
  • the user terminal first generates a master key, and directly generates each key material according to the key generation algorithm configured by the user and the multiple access information of the user terminal, and the authentication server generates only the master key.
  • the access management function module generates the key material according to each of the master key and the user terminal multiple access information, and the key material of the access interface on the user terminal side and the authentication server side is the same.
  • Key generation algorithms such as Data Encryption Standard (DES), asymmetric encryption (RSA) and other key generation algorithms.
  • the multiple access authentication system includes a network side and a user terminal, and the network side is provided with a network side authentication center and an access node, and the access node includes an access forwarding function module and an access management function module.
  • the access node may be, for example, a network element that provides access to the user terminal, such as a base station or an access gateway.
  • the multiple access authentication system in the next generation network of the present invention further includes a first receiving unit 80, a first generating unit 81, a second receiving unit 82, a first authenticating unit 83, a second generating unit 84, a transmitting unit 85, a second authenticating unit 86, and a third generating unit 87, wherein the second receiving unit 82, the first authenticating unit 83, and the second The generating unit 84 and the sending unit 85 are disposed in the user terminal, and the remaining units are disposed in the network side authentication center; wherein:
  • the first receiving unit 80 is configured to receive user terminal information sent by the user terminal, where the user terminal information includes subscription information and multiple access information of the user terminal;
  • a first generating unit 81 configured to generate after the first receiving unit receives the user terminal information Authentication vector
  • the second receiving unit 82 is configured to receive an authentication request sent by the network side authentication center, where the first authentication unit 83 is configured to perform authentication on the network side.
  • a second generating unit 84 configured to generate a key material and network side authentication information according to the multiple access information of the user terminal after the first authentication unit 83 is successfully authenticated;
  • the sending unit 85 is configured to send the network side authentication information to the network side authentication center, where the authentication request includes the authentication information;
  • a second authentication unit 86 configured to authenticate the network side authentication information by using the authentication vector
  • the third generating unit 87 is configured to generate a key material according to the multiple access information of the user terminal after the second authentication unit 86 is successfully authenticated;
  • the access forwarding function module encrypts and decrypts the access service information of the user terminal according to the key material.
  • the access forwarding function module acquires the key material from the network side authentication center or the access management function module; the access forwarding function module uses the key material to access the service information of the user terminal Perform encryption and decryption.
  • the second generating unit 84 further generates a key material according to the multiple access information of the user terminal;
  • the third generating unit 87 directly generates the key material of the multi-access information of the user terminal; the access forwarding function module acquires the key material from the network-side authentication center as: The generating unit 87 sends the generated key material directly to the access forwarding function module, or sends the access forwarding function module to the access forwarding function module.
  • the second generating unit 84 further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit 87 generates each according to the multiple access information of the user terminal. Key material of the access interface; the access forwarding function module acquires the key material from the network side authentication center: the third generating unit 87 directly sends the generated key material to the access The forwarding function module is sent to the access forwarding function module by using the access management function module.
  • the second generating unit 84 further generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the third generating unit 87 further generates a master key, and generates a key material of each access interface according to the multiple access information of the user terminal, and the access forwarding function module is configured from the network side authentication center. Obtaining the key material: the third generating unit 87 sends the generated key material directly to the access forwarding function module, or sends the access forwarding function module to the access forwarding function module .
  • the second generating unit 84 further generates a master key, and generates key materials of each access interface according to the multiple access information of the user terminal;
  • the third generating unit 87 further generates a key material of each access interface according to the multiple access information of the user terminal; the access forwarding function module acquires the key material from the network side authentication center. The third generating unit 87 sends the generated key material directly to the access forwarding function module, or sends the access forwarding function module to the access forwarding function module.
  • the second generating unit 84 further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit 87 further generates a master key, and generates a key material of each access interface according to the multiple access information of the user terminal; the access forwarding function module authenticates from the network side The obtaining the key material by the center is: the third generating unit 87 sends the generated key material directly to the access forwarding function module, or sends the access forwarding function to the access forwarding function by using the access management function module. Module.
  • the foregoing second generating unit 84 further generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit 87 further generates a master key, and sends the master key to the access management function module.
  • the access management function module generates, according to the master key and the multiple access information of the user terminal. a key material of each access interface; wherein the access management function module acquires multiple access information of the user terminal from the user terminal or the network side authentication center; The access management function module acquires the key material as: the access management function module sends the generated key material to the access forwarding function module.
  • the second generating unit 84 further generates a master key, and generates a key material of each access interface according to the multiple access information of the user terminal;
  • the third generating unit 87 further generates a master key, and sends the master key to the access management function module.
  • the access management function module generates, according to the master key and the multiple access information of the user terminal. a key material of each access interface; wherein the access management function module acquires multiple access information of the user terminal from the user terminal or the network side authentication center; The access management function module acquires the key material as: the access management function module sends the generated key material to the access forwarding function module.
  • the multiple access authentication system in the next generation network shown in FIG. 8 is set to implement the multiple access authentication method in the foregoing next generation network, and the implementation functions of each processing unit in the figure may be referred to. It is understood by the related description of the foregoing method.
  • the functions of the various units in the system shown in Figure 8 can be implemented by programs running on the processor or by specific logic circuits.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Computer And Data Communications (AREA)

Description

下一代网络中多接入认证方法及系统 技术领域
本发明涉及认证技术，尤其涉及一种下一代网络（ NGN, Next Generation Network ) 中多接入认证方法及系统。 背景技术
NGN作为演进的基于分组交换的网络框架受到越来越多的关注。 国际 电信联盟电信标准局 ( ITU-T, Telecommunication Standardization Sector of the International Telecommunications Union )和其他地区标准组织 口欧洲电信 标准化协会 ( ETSI, European Telecommunications Standards Institute )、 世界 无线通讯解决方案联盟 ( ATIS , The Alliance for Telecommunications Industry Solution )等对 NGN框架模型、 业务以及相关领域进行了广泛的研究和标 准化工作。
NGN能够支持多种网络接入。 在移动用户终端进行多接入时， 需要保 证业务的连续性， 同时要减少移动用户终端与 NGN网络的认证信令。 NGN 网络中定义了五种多接入场景。
其中有场景为： 用户有多个接入模块， 同时接入到相同的接入节点， 这样可以达到更高的速率， 提供更快速的数据传输， 优化的体验， 提高无 线资源的利用率。 用户在同时接入到相同的节点时， 需要保护不同接入模 块与网络接入节点的数据私密性和完整性， 要达到不同的接入模块不互相 干扰的目的， 终端的不同的接入模块应使用不同的密钥。 终端可以通过用 不同的接入模块逐一与 NGN 网络进行认证的方式实现生成不同的密钥的 目的。
但是， 这增加了用户终端与 NGN网络的信令交互， 这无疑阻碍了用户 终端接入网络的速度， 对本来就资源紧张的空口资源来讲， 造成很大的资 源浪费。 发明内容
有鉴于此， 本发明的主要目的在于提供一种下一代网络中多接入认证 方法及系统， 在用户终端与网络侧认证中心进行认证过程中， 将会生成用 户终端多接入信息的密钥材料， 从而实现对各接入业务进行密钥保护。
为达到上述目的， 本发明的技术方案是这样实现的：
一种下一代网络中多接入认证方法， 网络侧设置有网络侧认证中心和 接入节点， 所述接入节点中包含接入转发功能模块及接入管理功能模块； 所述方法包括：
网络侧认证中心接收到用户终端发送的用户终端信息后， 生成认证向 量； 所述用户终端信息包含所述用户终端的签约信息及多接入信息；
所述用户终端接收到网络侧认证中心发送的认证请求后， 对网络侧进 行认证， 认证成功后， 根据自身的多接入信息生成密钥材料和网络侧认证 信息， 并将所述网络侧认证信息发送给所述网络侧认证中心； 其中， 所述 认证请求中包含认证信息；
所述网络侧认证中心利用所述认证向量对所述网络侧认证信息进行认 证；
认证成功后根据所述用户终端的多接入信息生成密钥材料。
优选地， 所述方法还包括：
所述接入转发功能模块从所述网络侧认证中心或所述接入管理功能模 块获取所述密钥材料， 并利用所述密钥材料对所述用户终端的接入业务信 息进行加解密。
优选地， 根据所述用户终端自身的多接入信息生成密钥材料为： 所述用户终端根据自身的多接入信息生成各接入接口的密钥材料； 所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心根据所述用户终端的多接入信息生成各接入接口 的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心直接发送给所述接入转发功能模块， 或通过所述 接入管理功能模块发送给所述接入转发功能模块。
优选地， 根据所述用户终端自身的多接入信息生成密钥材料为： 所述用户终端生成主密钥， 并根据自身的多接入信息生成各接入接口 的密钥材料；
所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心生成主密钥， 并根据所述用户终端的多接入信息 生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心将所生成的密钥材料直接发送给所述接入转发功 能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
优选地， 根据所述用户终端自身的多接入信息生成密钥材料为： 所述用户终端生成一个主密钥， 并根据自身的多接入信息生成各接入 接口的密钥材料；
所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心根据所述用户终端的多接入信息生成各接入接口 的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心将所生成的密钥材料直接发送给所述接入转发功 能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
优选地， 根据所述用户终端自身的多接入信息生成密钥材料为： 所述用户终端根据自身的多接入信息生成各接入接口的密钥材料； 所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心生成一个主密钥， 再根据所述用户终端的多接入 信息生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心将所生成的密钥材料直接发送给所述接入转发功 能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
优选地， 根据所述用户终端自身的多接入信息生成密钥材料为： 所述用户终端根据自身的多接入信息生成各接入接口的密钥材料； 所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心生成主密钥， 并通知给所述接入管理功能模块； 所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息生成 各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终端或 所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料， 为；
所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
优选地， 根据所述用户终端自身的多接入信息生成密钥材料为： 所述用户终端生成一个主密钥， 并根据自身的多接入信息生成各接入 接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心生成主密钥， 并通知给所述接入管理功能模块； 所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息生成 各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终端或 所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料， 为；
所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
一种下一代网络中多接入认证系统， 包括网络侧和用户终端， 网络侧 设置有网络侧认证中心和接入节点， 所述接入节点中包含接入转发功能模 块及接入管理功能模块； 所述系统还包括第一接收单元、 第一生成单元、 第二接收单元、 第一认证单元、 第二生成单元、 发送单元、 第二认证单元 和第三生成单元， 所述第二接收单元、 所述第一认证单元、 所述第二生成 单元和发送单元设于用户终端中， 所述第一接收单元、 第一生成单元、 第 二认证单元和第三生成单元设于网络侧认证中心； 其中：
第一接收单元， 用于接收到用户终端发送的用户终端信息； 所述用户 终端信息包含所述用户终端的签约信息及多接入信息；
第一生成单元， 用于在所述第一接收单元接收用户终端信息后生成认 证向量；
第二接收单元， 用于接收到网络侧认证中心发送的认证请求； 第一认证单元， 用于对网络侧进行认证；
第二生成单元， 用于在所述第一认证单元认证成功后， 根据所述用户 终端的多接入信息生成密钥材料和网络侧认证信息；
发送单元， 用于将所述网络侧认证信息发送给所述网络侧认证中心； 其中， 所述认证请求中包含认证信息；
第二认证单元， 用于利用所述认证向量对所述网络侧认证信息进行认 证；
第三生成单元， 用于在所述第二认证单元认证成功后根据所述用户终 端的多接入信息生成密钥材料。
优选地， 所述接入转发功能模块从所述网络侧认证中心或所述接入管 理功能模块获取所述密钥材料； 所述接入转发功能模块利用所述密钥材料 对所述用户终端的接入业务信息进行加解密。
优选地， 所述第二生成单元进一步根据所述用户终端的多接入信息生 成各接入接口的密钥材料；
所述第三生成单元根据所述用户终端的多接入信息生成各接入接口的 密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能 模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
优选地， 所述第二生成单元进一步生成一个主密钥， 并根据所述用户 终端的多接入信息生成各接入接口的密钥材料；
所述第三生成单元进一步生成一个主密钥， 再根据所述用户终端的多 接入信息生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能模 块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
优选地， 所述第二生成单元进一步生成一个主密钥， 并根据所述用户 终端的多接入信息生成各接入接口的密钥材料；
所述第三生成单元进一步根据所述用户终端的多接入信息生成各接入 接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能模 块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。 优选地， 所述第二生成单元进一步根据所述用户终端的多接入信息生 成各接入接口的密钥材料；
所述第三生成单元进一步生成一个主密钥， 再根据所述用户终端的多 接入信息生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能 模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
优选地， 所述第二生成单元进一步根据所述用户终端的多接入信息生 成各接入接口的密钥材料；
所述第三生成单元进一步生成主密钥， 并发送给所述接入管理功能模 块； 所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息 生成各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终 端或所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料 为：
所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
优选地， 所述第二生成单元进一步生成主密钥， 并根据所述用户终端 的多接入信息生成各接入接口的密钥材料；
所述第三生成单元进一步生成主密钥， 并发送给所述接入管理功能模 块；
所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息 生成各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终 端或所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料 所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
本发明中， 在用户终端接入 NGN网络中而与 NGN网络中的认证服务 器进行认证时， 用户终端将自身支持的多接入信息通知给认证服务器， 该 认证服务器与用户终端侧利用相同的密钥生成方式为多接入信息生成密钥 材料， 用户终端与网络侧进行相应业务时， 使用相应的密钥材料对业务信 息进行加解密， 从而在网络侧与用户终端之间实现对多接入信息进行保护。 本发明中， 用户终端在首次接入网络时在认证过程中即实现用户终端多接 入信息密钥材料的生成， 不必为每种接入业务单独进行认证并生成相应的 密钥材料， 从而节约了宝贵的空口资源， 并提高了用户终端接入网络的效 率。 附图说明
图 1为本发明下- -代网络中多接入认证方法实施例一的流程图 图 2为本发明下- -代网络中多接入认证方法实施例二的流程图 图 3为本发明下- -代网络中多接入认证方法实施例三的流程图 图 4为本发明下- -代网络中多接入认证方法实施例四的流程图 图 5为本发明下- -代网络中多接入认证方法实施例五的流程图 图 6为本发明下- -代网络中多接入认证方法实施例六的流程图 图 7为本发明下- -代网络中多接入认证方法实施例七的流程图 图 8为本发明下- -代网络中多接入认证系统的组成结构示意图 具体实施方式
本发明的基本思想为： 在用户终端接入 NGN网络中而与 NGN网络中 的认证服务器进行认证时， 用户终端将自身支持的多接入信息通知给认证 服务器， 该认证服务器与用户终端侧利用相同的密钥生成方式为多接入信 息生成密钥材料， 用户终端与网络侧进行相应业务时， 使用相应的密钥材 料对业务信息进行加解密， 从而在网络侧与用户终端之间实现对多接入信 息进行保护。
为使本发明的目的、 技术方案和优点更加清楚明白， 以下举实施例并 参照附图， 对本发明进一步详细说明。
本发明中， NGN网络包括网络侧和用户终端， 其中， 网络侧设置有网 络侧认证中心、 用户数据中心及接入节点等， 网络侧认证中心包括认证服 务器等具有认证功能的网元， 用户信息中心用于存储用户终端的签约信息 等数据， 如网络侧的归属位置寄存器（ HLR, Home Location Register )或归 属用户服务器（HSS , Home Subscriber Server )等网元； 接入节点包括基站 和 /或基站控制器等网元， 接入节点中包括接入转发功能模块及接入管理功 能模块等基本功能模块， 其中， 接入转发功能模块用于对接入业务进行转 发， 接入管理功能模块用于对接入业务进行相应管理。 由于上述网元均为 现有网元， 其功能与现有网元也未有实质性区别， 不再赘述其具体结构及 功能。 以下， 结合附图， 进一步阐述本发明的技术方案的实质。
图 1为本发明下一代网络中多接入认证方法实施例一的流程图，如图 1 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 110, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。 这里， 认证向量可以直 接在认证服务器本地生成， 具体的， 根据用户终端上报的用户签约信息等 利用事先设置的认证向量的相关算法， 直接计算即可。 这里， 计算认证向 量涉及的基本信息包含用户签约的各种信息及用户终端的标识信息等。 上 述的认证向量， 也可以通过与用户信息中心交互， 获取用户终端的签约信 息后再生成认证向量。
步骤 120,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。
接收到用户终端的相关信息后， 实现对用户终端的认证流程， 该认证 流程将是网络侧及认证服务器双方互认证的过程。 具体的， 认证服务器首 先向用户终端发起认证请求， 实现对用户终端的认证。
步骤 130, 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 根据多接入信息生成密钥材料和网络侧认证 信息。 并将所生成的网络侧认证信息发送给认证服务器。
步骤 140: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据用户终端的多接入信息生成密钥材 料。 认证服务器将密钥材料发送给接入转发功能模块， 或同时发送给接入 转发功能模块和接入管理功能模块， 或者， 通过接入管理功能模块发送给 接入转发功能模块。 用户终端与网络侧实现各业务时， 通过密钥材料对多 接入信息进行保护。
本示例中， 用户终端与认证服务器生成密钥材料的密钥生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端与认证服务器中， 用 户终端及认证服务器根据该相同的密钥生成算法， 并基于相同的元素生成 相应的密钥。 密钥生成算法如数据加密标准 （ DES , Data Encryption Standard ), 非对称加密源代码（RSA )等密钥生成算法。
本示例中， 用户终端及认证服务器侧根据用户终端的多接入信息生成 了一个密钥材料， 该密钥材料适用于用户终端的各接入业务对应的各个接 入接口， 也即所有的接入接口都将使用上述的密钥材料对业务信息进行加 解密。
图 2为本发明下一代网络中多接入认证方法实施例二的流程图，如图 2 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 210, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。
该步骤与前述步骤 110相同。
步骤 220,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。 该步骤与前述步骤 120相同。
步骤 230 , 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 生成一个主密钥， 根据自身的多接入信息生 成各接入接口的密钥材料， 并生成的网络侧认证信息。 将所生成的网络侧 认证信息发送给认证服务器。
本步骤中， 用户终端将根据相应的密钥生成算法生成一个主密钥， 再 利用该主密钥对多接入的接口分别生成密钥材料， 各接入接口将使用各自 的密钥材料进行加解密处理。
步骤 240: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据相应的密钥生成算法生成一个主密 钥， 再根据用户终端的多接入信息生成用户终端各接入接口的密钥材料。 认证服务器将生成的密钥材料发送给接入转发功能模块， 或同时发送给接 入转发功能模块和接入管理功能模块， 或者， 通过接入管理功能模块发送 给接入转发功能模块。 用户终端与网络侧实现各业务时， 通过密钥材料对 多接入信息进行保护。 本示例中， 用户终端与认证服务器生成密钥材料的密钥生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端与认证服务器中， 用 户终端侧及认证服务器均是先生成主密钥， 再根据用户终端多接入信息的 各个分别生成密钥材料， 而用户终端侧及认证服务器侧对应接入接口的密 钥材料是相同的。 密钥生成算法如数据加密标准 （ DES , Data Encryption Standard ), 非对称加密 （RSA )等密钥生成算法。
图 3为本发明下一代网络中多接入认证方法实施例三的流程图，如图 3 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 310, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。
该步骤与前述步骤 110相同。
步骤 320,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。 该步骤与前述步骤 120相同。
步骤 330, 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 根据自身的多接入信息生成各接入接口的密 钥材料， 并生成的网络侧认证信息。 将所生成的网络侧认证信息发送给认 证服务器。
本步骤中， 用户终端将根据相应的密钥生成算法及多接入信息的各个 分别生成密钥材料， 各接入接口将使用各自的密钥材料进行加解密处理。
步骤 340: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据相应的密钥生成算法及用户终端的 多接入信息生成用户终端各接入接口的密钥材料。 认证服务器将生成的密 钥材料发送给接入转发功能模块， 或同时发送给接入转发功能模块和接入 管理功能模块， 或者， 通过接入管理功能模块发送给接入转发功能模块。 用户终端与网络侧实现各业务时， 通过密钥材料对多接入信息进行保护。
本示例中， 用户终端与认证服务器生成密钥材料的密钥生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端与认证服务器中， 用 户终端及认证服务器根据该相同的密钥生成算法， 并基于相同的元素生成 相应的密钥。 密钥生成算法如数据加密标准 （ DES , Data Encryption Standard ), 非对称加密 （RSA )等密钥生成算法。
本示例中， 用户终端及认证服务器侧根据密钥生成算法及用户终端的 多接入信息的各个分别生成密钥材料。 用户终端与网络侧开展相应的接入 业务时， 将利用各接入接口的密钥材料进行加解密。
图 4为本发明下一代网络中多接入认证方法实施例四的流程图，如图 4 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 410, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。
该步骤与前述步骤 110相同。
步骤 420,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。 该步骤与前述步骤 120相同。
步骤 430 , 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 生成一个主密钥， 根据自身的多接入信息生 成各接入接口的密钥材料， 并生成的网络侧认证信息。 将所生成的网络侧 认证信息发送给认证服务器。 本步骤中， 用户终端将根据相应的密钥生成算法生成一个主密钥， 再 利用该主密钥对多接入的接口分别生成密钥材料， 各接入接口将使用各自 的密钥材料进行加解密处理。
步骤 440: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据相应的密钥生成算法及用户终端的 多接入信息生成用户终端各接入接口的密钥材料。 认证服务器将生成的密 钥材料发送给接入转发功能模块， 或同时发送给接入转发功能模块和接入 管理功能模块， 或者， 通过接入管理功能模块发送给接入转发功能模块。 用户终端与网络侧实现各业务时， 通过密钥材料对多接入信息进行保护。 本步骤与前述步骤 240 的主要区别在于， 不再生成主密钥， 而是直接更加 密钥生成算法及多接入信息中的各个分别生成相应接口的密钥材料。
本示例中， 用户终端与认证服务器生成密钥材料的密钥生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端与认证服务器中， 用 户终端侧先生成主密钥， 再根据用户终端多接入信息的各个分别生成密钥 材料， 而认证服务器则是根据该相同的密钥生成算法及用户终端多接入信 息的各个直接生成各个密钥材料， 这样， 用户终端侧及认证服务器侧对应 接入接口的密钥材料是相同的。 密钥生成算法如数据加密标准（DES, Data Encryption Standard ), 非对称加密 （RSA )等密钥生成算法。
图 5为本发明下一代网络中多接入认证方法实施例五的流程图，如图 5 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 510, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。 该步骤与前述步骤 110相同。
步骤 520,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。
该步骤与前述步骤 120相同。
步骤 530, 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 根据自身的多接入信息生成各接入接口的密 钥材料， 并生成的网络侧认证信息。 将所生成的网络侧认证信息发送给认 证服务器。
本步骤中， 用户终端将根据相应的密钥生成算法及多接入信息的各个 分别生成密钥材料， 各接入接口将使用各自的密钥材料进行加解密处理。
步骤 540: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据相应的密钥生成算法生成一个主密 钥， 再根据用户终端的多接入信息生成用户终端各接入接口的密钥材料。 认证服务器将生成的密钥材料发送给接入转发功能模块， 或同时发送给接 入转发功能模块和接入管理功能模块， 或者， 通过接入管理功能模块发送 给接入转发功能模块。 用户终端与网络侧实现各业务时， 通过密钥材料对 多接入信息进行保护。
本示例中， 用户终端与认证服务器生成密钥材料的密钥生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端与认证服务器中， 用 户终端侧根据自身配置的密钥生成算法及用户终端多接入信息的各个直接 生成各个密钥材料， 而认证服务器则是先生成主密钥， 再根据用户终端多 接入信息的各个分别生成密钥材料， 而用户终端侧及认证服务器侧对应接 入接口的密钥材料是相同的。 密钥生成算法如数据加密标准 （DES , Data Encryption Standard ), 非对称加密 （RSA )等密钥生成算法。
图 6为本发明下一代网络中多接入认证方法实施例六的流程图，如图 6 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 610, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。
该步骤与前述步骤 110相同。
步骤 620,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。
该步骤与前述步骤 120相同。
步骤 630 , 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 根据自身的多接入信息生成各接入接口的密 钥材料， 并生成的网络侧认证信息。 将所生成的网络侧认证信息发送给认 证服务器。
本步骤中， 用户终端将根据相应的密钥生成算法及多接入信息的各个 分别生成密钥材料， 各接入接口将使用各自的密钥材料进行加解密处理。
步骤 640: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据相应的密钥生成算法生成一个主密 钥， 并发送给所述接入管理功能模块；
步骤 650:接入管理功能模块根据主密钥及用户终端的多接入信息生成 各接入接口的密钥材料， 并发送给接入转发功能模块； 其中， 接入管理功 能模块从用户终端或网络侧认证中心获取用户终端的多接入信息。
本示例中， 用户终端、 接入管理功能模块与认证服务器中配置的密钥 生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端、 接 入管理功能模块与认证服务器中， 用户终端侧根据自身配置的密钥生成算 法及用户终端多接入信息的各个直接生成各个密钥材料， 而认证服务器则 仅生成主密钥。 接入管理功能模块根据主密钥及用户终端多接入信息的各 个分别生成密钥材料， 而用户终端侧及认证服务器侧对应接入接口的密钥 材料是相同的。 密钥生成算法如数据加密标准 （DES , Data Encryption Standard ), 非对称加密 （RSA )等密钥生成算法。
图 7为本发明下一代网络中多接入认证方法实施例七的流程图，如图 7 所示， 本示例下一代网络中多接入认证方法包括以下步骤：
步骤 710, 用户终端接入网络时， 通过接入节点向认证服务器发送自身 的相关消息， 用户终端发送给认证服务器的消息中， 至少包含该用户终端 的签约信息、 自身所支持的多接入业务的多接入信息， 其中， 多接入信息 包含多接入业务的标志以及用户终端的多接口信息等。 认证服务器收到用 户终端发送的相关消息后， 生成相应的认证向量。
该步骤与前述步骤 110相同。
步骤 720,认证服务器向用户终端发送认证请求， 认证请求包含认证信 息比如挑战值等。
该步骤与前述步骤 120相同。
步骤 730 , 用户终端收到认证请求后， 根据认证请求中的认证信息对网 络侧进行认证， 认证成功后， 生成一个主密钥， 根据自身的多接入信息生 成各接入接口的密钥材料， 并生成的网络侧认证信息。 将所生成的网络侧 认证信息发送给认证服务器。
本步骤中， 用户终端将根据相应的密钥生成算法生成一个主密钥， 再 利用该主密钥对多接入的接口分别生成密钥材料， 各接入接口将使用各自 的密钥材料进行加解密处理。
步骤 740: 认证服务器收到认证响应信息后，根据认证响应中的信息认 证终端， 认证成功后， 认证服务器根据相应的密钥生成算法生成一个主密 钥， 并发送给所述接入管理功能模块；
步骤 750:接入管理功能模块根据主密钥及用户终端的多接入信息生成 各接入接口的密钥材料， 并发送给接入转发功能模块； 其中， 接入管理功 能模块从用户终端或网络侧认证中心获取用户终端的多接入信息。
本示例中， 用户终端、 接入管理功能模块与认证服务器中配置的密钥 生成算法相同， 也即是说， 相同的密钥生成算法事先配置于用户终端、 接 入管理功能模块与认证服务器中， 用户终端侧首先生成主密钥， 再根据自 身配置的密钥生成算法及用户终端多接入信息的各个直接生成各个密钥材 料， 而认证服务器则仅生成主密钥。 接入管理功能模块根据主密钥及用户 终端多接入信息的各个分别生成密钥材料， 而用户终端侧及认证服务器侧 对应接入接口的密钥材料是相同的。 密钥生成算法如数据加密标准（DES , Data Encryption Standard ), 非对称加密 （RSA )等密钥生成算法。
本发明下一代网络中多接入认证系统包括网络侧和用户终端， 网络侧 设置有网络侧认证中心和接入节点， 所述接入节点中包含接入转发功能模 块及接入管理功能模块。 接入节点例如可以是基站、 接入网关等提供用户 终端接入的网元。 网络侧认证中心例如可以是认证服务器等网元。 图 8为 本发明下一代网络中多接入认证系统的组成结构示意图， 如图 8所示， 本 发明下一代网络中多接入认证系统还包括第一接收单元 80、 第一生成单元 81、 第二接收单元 82、 第一认证单元 83、 第二生成单元 84、 发送单元 85、 第二认证单元 86和第三生成单元 87, 其中， 第二接收单元 82、 第一认证 单元 83、 第二生成单元 84和发送单元 85设于用户终端中， 其余各单元设 于网络侧认证中心； 其中：
第一接收单元 80, 用于接收到用户终端发送的用户终端信息； 所述用 户终端信息包含所述用户终端的签约信息及多接入信息；
第一生成单元 81 , 用于在所述第一接收单元接收用户终端信息后生成 认证向量；
第二接收单元 82, 用于接收到网络侧认证中心发送的认证请求； 第一认证单元 83 , 用于对网络侧进行认证；
第二生成单元 84, 用于在所述第一认证单元 83认证成功后，根据所述 用户终端的多接入信息生成密钥材料和网络侧认证信息；
发送单元 85 ,用于将所述网络侧认证信息发送给所述网络侧认证中心； 其中， 所述认证请求中包含认证信息；
第二认证单元 86 , 用于利用所述认证向量对所述网络侧认证信息进行 认证；
第三生成单元 87 ,用于在所述第二认证单元 86认证成功后根据所述用 户终端的多接入信息生成密钥材料；
所述接入转发功能模块根据所述密钥材料对所述用户终端的接入业务 信息进行加解密。
接入转发功能模块从所述网络侧认证中心或所述接入管理功能模块获 取所述密钥材料； 所述接入转发功能模块利用所述密钥材料对所述用户终 端的接入业务信息进行加解密。
上述第二生成单元 84进一步根据所述用户终端的多接入信息生成一个 密钥材料；
对应地， 上述第三生成单元 87直接生成所述用户终端的多接入信息的 密钥材料； 所述接入转发功能模块从所述网络侧认证中心获取所述密钥材 料为： 上述第三生成单元 87将所生成的密钥材料直接发送给所述接入转发 功能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
或者， 上述第二生成单元 84进一步根据所述用户终端的多接入信息生 成各接入接口的密钥材料；
对应地， 上述第三生成单元 87根据所述用户终端的多接入信息生成各 接入接口的密钥材料； 所述接入转发功能模块从所述网络侧认证中心获取 所述密钥材料为： 上述第三生成单元 87将所生成的密钥材料直接发送给所 述接入转发功能模块， 或通过所述接入管理功能模块发送给所述接入转发 功能模块。
或者， 上述第二生成单元 84进一步生成一个主密钥， 并根据所述用户 终端的多接入信息生成各接入接口的密钥材料；
对应地， 上述第三生成单元 87进一步生成一个主密钥， 再根据所述用 户终端的多接入信息生成各接入接口的密钥材料所述接入转发功能模块从 所述网络侧认证中心获取所述密钥材料为： 上述第三生成单元 87将所生成 的密钥材料直接发送给所述接入转发功能模块， 或通过所述接入管理功能 模块发送给所述接入转发功能模块。
或者， 上述第二生成单元 84进一步生成一个主密钥， 并根据所述用户 终端的多接入信息生成各接入接口的密钥材料；
对应地， 上述第三生成单元 87进一步根据所述用户终端的多接入信息 生成各接入接口的密钥材料； 所述接入转发功能模块从所述网络侧认证中 心获取所述密钥材料为： 上述第三生成单元 87将所生成的密钥材料直接发 送给所述接入转发功能模块， 或通过所述接入管理功能模块发送给所述接 入转发功能模块。
或者， 上述第二生成单元 84进一步根据所述用户终端的多接入信息生 成各接入接口的密钥材料；
对应地， 上述第三生成单元 87进一步生成一个主密钥， 再根据所述用 户终端的多接入信息生成各接入接口的密钥材料； 所述接入转发功能模块 从所述网络侧认证中心获取所述密钥材料为： 上述第三生成单元 87将所生 成的密钥材料直接发送给所述接入转发功能模块， 或通过所述接入管理功 能模块发送给所述接入转发功能模块。 或者， 上述第二生成单元 84进一步根据所述用户终端的多接入信息生 成各接入接口的密钥材料；
对应地， 上述第三生成单元 87进一步生成主密钥， 并发送给所述接入 管理功能模块； 所述接入管理功能模块根据所述主密钥及所述用户终端的 多接入信息生成各接入接口的密钥材料； 其中， 所述接入管理功能模块从 所述用户终端或所述网络侧认证中心获取所述用户终端的多接入信息； 所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料 为： 所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
或者， 上述第二生成单元 84进一步生成主密钥， 并根据所述用户终端 的多接入信息生成各接入接口的密钥材料；
对应地， 上述第三生成单元 87进一步生成主密钥， 并发送给所述接入 管理功能模块； 所述接入管理功能模块根据所述主密钥及所述用户终端的 多接入信息生成各接入接口的密钥材料； 其中， 所述接入管理功能模块从 所述用户终端或所述网络侧认证中心获取所述用户终端的多接入信息； 所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料 为： 所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
本领域技术人员应当理解， 图 8所示的下一代网络中多接入认证系统 是为实现前述的下一代网络中多接入认证方法而设置的， 图中的各处理单 元的实现功能可参照前述方法的相关描述而理解。 图 8 所示的系统中各处 理单元的功能可通过运行于处理器上的程序而实现， 也可通过具体的逻辑 电路而实现。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围。

Claims

权利要求书
1、 一种下一代网络中多接入认证方法， 网络侧设置有网络侧认证中心 和接入节点， 所述接入节点中包含接入转发功能模块及接入管理功能模块； 其特征在于， 所述方法还包括：
网络侧认证中心接收到用户终端发送的用户终端信息后， 生成认证向 量； 所述用户终端信息包含所述用户终端的签约信息及多接入信息；
所述用户终端接收到网络侧认证中心发送的认证请求后， 对网络侧进 行认证， 认证成功后， 根据自身的多接入信息生成密钥材料和网络侧认证 信息， 并将所述网络侧认证信息发送给所述网络侧认证中心； 其中， 所述 认证请求中包含认证信息；
所述网络侧认证中心利用所述认证向量对所述网络侧认证信息进行认 证；
认证成功后根据所述用户终端的多接入信息生成密钥材料。
2、 根据权利要求 1所述的方法， 其特征在于， 所述方法还包括： 所述接入转发功能模块从所述网络侧认证中心或所述接入管理功能模 块获取所述密钥材料， 并利用所述密钥材料对所述用户终端的接入业务信 息进行加解密。
3、 根据权利要求 2所述的方法， 其特征在于， 根据所述用户终端自身 的多接入信息生成密钥材料， 具体为：
所述用户终端根据自身的多接入信息生成各接入接口的密钥材料； 所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心根据所述用户终端的多接入信息生成各接入接口 的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心直接发送给所述接入转发功能模块， 或通过所述 接入管理功能模块发送给所述接入转发功能模块。
4、 根据权利要求 2所述的方法， 其特征在于， 根据所述用户终端自身 的多接入信息生成密钥材料， 具体为：
所述用户终端生成主密钥， 并根据自身的多接入信息生成各接入接口 的密钥材料；
所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心生成主密钥， 并根据所述用户终端的多接入信息 生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心将所生成的密钥材料直接发送给所述接入转发功 能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
5、 根据权利要求 2所述的方法， 其特征在于， 根据所述用户终端自身 的多接入信息生成密钥材料， 具体为：
所述用户终端生成一个主密钥， 并根据自身的多接入信息生成各接入 接口的密钥材料；
所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心根据所述用户终端的多接入信息生成各接入接口 的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心将所生成的密钥材料直接发送给所述接入转发功 能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
6、 根据权利要求 2所述的方法， 其特征在于， 根据所述用户终端自身 的多接入信息生成密钥材料， 具体为：
所述用户终端根据自身的多接入信息生成各接入接口的密钥材料； 所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心生成一个主密钥， 再根据所述用户终端的多接入 信息生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心将所生成的密钥材料直接发送给所述接入转发功 能模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
7、 根据权利要求 2所述的方法， 其特征在于， 根据所述用户终端自身 的多接入信息生成密钥材料， 具体为：
所述用户终端根据自身的多接入信息生成各接入接口的密钥材料； 所述认证成功后根据所述用户终端的多接入信息生成密钥材料为： 所述网络侧认证中心生成主密钥， 并通知给所述接入管理功能模块； 所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息生成 各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终端或 所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料， 为；
所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
8、 根据权利要求 1所述的方法， 其特征在于， 根据所述用户终端自身 的多接入信息生成密钥材料， 具体为：
所述用户终端生成一个主密钥， 并根据自身的多接入信息生成各接入 接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述网络侧认证中心生成主密钥， 并通知给所述接入管理功能模块； 所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息生成 各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终端或 所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料， 为；
所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
9、 一种下一代网络中多接入认证系统， 包括网络侧和用户终端， 网络 侧设置有网络侧认证中心和接入节点， 所述接入节点中包含接入转发功能 模块及接入管理功能模块； 其特征在于， 所述系统还包括第一接收单元、 第一生成单元、 第二接收单元、 第一认证单元、 第二生成单元、 发送单元、 第二认证单元和第三生成单元， 所述第二接收单元、 所述第一认证单元、 所述第二生成单元和发送单元设于用户终端中， 所述第一接收单元、 第一 生成单元、 第二认证单元和第三生成单元设于网络侧认证中心； 其中： 第一接收单元， 用于接收到用户终端发送的用户终端信息； 所述用户 终端信息包含所述用户终端的签约信息及多接入信息；
第一生成单元， 用于在所述第一接收单元接收用户终端信息后生成认 证向量；
第二接收单元， 用于接收到网络侧认证中心发送的认证请求； 第一认证单元， 用于对网络侧进行认证；
第二生成单元， 用于在所述第一认证单元认证成功后， 根据所述用户 终端的多接入信息生成密钥材料和网络侧认证信息；
发送单元， 用于将所述网络侧认证信息发送给所述网络侧认证中心； 其中， 所述认证请求中包含认证信息；
第二认证单元， 用于利用所述认证向量对所述网络侧认证信息进行认 证；
第三生成单元， 用于在所述第二认证单元认证成功后根据所述用户终 端的多接入信息生成密钥材料。
10、 根据权利要求 9所述的系统， 其特征在于， 所述接入转发功能模 块从所述网络侧认证中心或所述接入管理功能模块获取所述密钥材料； 所 述接入转发功能模块利用所述密钥材料对所述用户终端的接入业务信息进 行加解密。
11、 根据权利要求 9 所述的系统， 其特征在于， 所述第二生成单元进 一步根据所述用户终端的多接入信息生成各接入接口的密钥材料；
所述第三生成单元根据所述用户终端的多接入信息生成各接入接口的 密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能 模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
12、 根据权利要求 9所述的系统， 其特征在于， 所述第二生成单元进 一步生成一个主密钥， 并根据所述用户终端的多接入信息生成各接入接口 的密钥材料；
所述第三生成单元进一步生成一个主密钥， 再根据所述用户终端的多 接入信息生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能模 块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
13、 根据权利要求 9所述的系统， 其特征在于， 所述第二生成单元进 一步生成一个主密钥， 并根据所述用户终端的多接入信息生成各接入接口 的密钥材料；
所述第三生成单元进一步根据所述用户终端的多接入信息生成各接入 接口的密钥材料； 所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能模 块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
14、 根据权利要求 9所述的系统， 其特征在于， 所述第二生成单元进 一步根据所述用户终端的多接入信息生成各接入接口的密钥材料；
所述第三生成单元进一步生成一个主密钥， 再根据所述用户终端的多 接入信息生成各接入接口的密钥材料；
所述接入转发功能模块从所述网络侧认证中心获取所述密钥材料为： 所述第三生成单元将所生成的密钥材料直接发送给所述接入转发功能 模块， 或通过所述接入管理功能模块发送给所述接入转发功能模块。
15、 根据权利要求 9所述的系统， 其特征在于， 所述第二生成单元进 一步根据所述用户终端的多接入信息生成各接入接口的密钥材料；
所述第三生成单元进一步生成主密钥， 并发送给所述接入管理功能模 块； 所述接入管理功能模块根据所述主密钥及所述用户终端的多接入信息 生成各接入接口的密钥材料； 其中， 所述接入管理功能模块从所述用户终 端或所述网络侧认证中心获取所述用户终端的多接入信息；
所述接入转发功能模块从所述接入管理功能模块获取所述密钥材料 为：
所述接入管理功能模块将所生成的密钥材料发送给所述接入转发功能 模块。
PCT/CN2010/078896 2010-04-13 2010-11-18 下一代网络中多接入认证方法及系统 WO2011127732A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP10849741.3A EP2557727B1 (en) 2010-04-13 2010-11-18 Method and system for multi-access authentication in next generation network
US13/641,018 US8949944B2 (en) 2010-04-13 2010-11-18 Method and system for multi-access authentication in next generation network

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010146342.6 2010-04-13
CN201010146342.6A CN102223347B (zh) 2010-04-13 2010-04-13 下一代网络中多接入认证方法及系统

Publications (1)

Publication Number Publication Date
WO2011127732A1 true WO2011127732A1 (zh) 2011-10-20

Family

ID=44779778

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/078896 WO2011127732A1 (zh) 2010-04-13 2010-11-18 下一代网络中多接入认证方法及系统

Country Status (4)

Country Link
US (1) US8949944B2 (zh)
EP (1) EP2557727B1 (zh)
CN (1) CN102223347B (zh)
WO (1) WO2011127732A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6201835B2 (ja) * 2014-03-14 2017-09-27 ソニー株式会社 情報処理装置、情報処理方法及びコンピュータプログラム
CN105577661A (zh) * 2015-12-23 2016-05-11 浪潮集团有限公司 一种分步式加密存储系统及方法
CN106878199B (zh) * 2016-12-20 2020-02-11 新华三技术有限公司 一种接入信息的配置方法和装置
CN112637128B (zh) * 2020-11-25 2022-07-08 四川新网银行股份有限公司 一种数据中心主机的身份互信方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1668005A (zh) * 2005-02-21 2005-09-14 西安西电捷通无线网络通信有限公司 一种适合有线和无线网络的接入认证方法
US20060242414A1 (en) * 2003-04-02 2006-10-26 Corson M S Security methods for use in a wireless communications system
CN101483521A (zh) * 2008-01-08 2009-07-15 华为技术有限公司 WiMAX网络的多主机接入认证方法及系统
CN101610507A (zh) * 2009-06-16 2009-12-23 天津工业大学 一种接入3g-wlan互联网络的方法

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1265607C (zh) * 2003-12-08 2006-07-19 华为技术有限公司 无线局域网中业务隧道建立的方法
US8726023B2 (en) * 2005-02-03 2014-05-13 Nokia Corporation Authentication using GAA functionality for unidirectional network connections
US8046824B2 (en) * 2005-04-11 2011-10-25 Nokia Corporation Generic key-decision mechanism for GAA
US7738882B2 (en) * 2005-06-13 2010-06-15 Toshiba America Research, Inc. Framework of media-independent pre-authentication improvements: including considerations for failed switching and switchback
CN1984436A (zh) * 2005-12-15 2007-06-20 上海原动力通信科技有限公司 不同接入系统之间移动性管理系统及管理方法
CN101127652B (zh) * 2006-08-17 2011-04-27 华为技术有限公司 一种确定用户终端访问外部网络锚点的方法、装置及系统
WO2008110946A1 (en) * 2007-02-05 2008-09-18 Nokia Corporation Authentication procedure in an intelligent proxy for multi-access devices
US8265593B2 (en) * 2007-08-27 2012-09-11 Alcatel Lucent Method and system of communication using extended sequence number
KR101407573B1 (ko) * 2007-12-18 2014-06-13 한국전자통신연구원 무선 액세스 기술과 이동ｉｐ 기반 이동성 제어 기술이적용된 차세대 네트워크 환경을 위한 통합 핸드오버 인증방법
CN101299888B (zh) * 2008-06-16 2014-06-11 中兴通讯股份有限公司 密钥生成方法、切换方法、移动管理实体和用户设备
CN101321074B (zh) * 2008-06-26 2011-09-14 华为技术有限公司 享用订购业务内容的方法及其系统
CN101610527B (zh) * 2009-06-24 2011-01-26 北京邮电大学 一种用于td-hspa+mimo系统的s-parc单双流选择方法
US20110072512A1 (en) * 2009-09-24 2011-03-24 Electronics And Telecommunications Research Institute Apparatus and method for providing communication service using common authentication

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060242414A1 (en) * 2003-04-02 2006-10-26 Corson M S Security methods for use in a wireless communications system
CN1668005A (zh) * 2005-02-21 2005-09-14 西安西电捷通无线网络通信有限公司 一种适合有线和无线网络的接入认证方法
CN101483521A (zh) * 2008-01-08 2009-07-15 华为技术有限公司 WiMAX网络的多主机接入认证方法及系统
CN101610507A (zh) * 2009-06-16 2009-12-23 天津工业大学 一种接入3g-wlan互联网络的方法

Also Published As

Publication number Publication date
US20130047220A1 (en) 2013-02-21
EP2557727A4 (en) 2017-05-31
CN102223347A (zh) 2011-10-19
EP2557727A1 (en) 2013-02-13
US8949944B2 (en) 2015-02-03
CN102223347B (zh) 2015-01-28
EP2557727B1 (en) 2019-07-24

Similar Documents

Publication Publication Date Title
US11240218B2 (en) Key distribution and authentication method and system, and apparatus
US11122428B2 (en) Transmission data protection system, method, and apparatus
US20190068591A1 (en) Key Distribution And Authentication Method And System, And Apparatus
CN105684344B (zh) 一种密钥配置方法和装置
US20180199205A1 (en) Wireless network connection method and apparatus, and storage medium
US9654284B2 (en) Group based bootstrapping in machine type communication
WO2019153701A1 (zh) 一种获得设备标识的方法及装置
WO2020221252A1 (zh) 发送终端序列号的方法和装置以及认证方法和装置
US20060094401A1 (en) Method and apparatus for authentication of mobile devices
EP3328108A1 (en) Authentication method, re-authentication method and communication apparatus
CN108880813B (zh) 一种附着流程的实现方法及装置
Abdrabou et al. LTE authentication protocol (EPS-AKA) weaknesses solution
JP2011139457A (ja) 無線通信装置とサーバとの間でデータを安全にトランザクション処理する方法及びシステム
KR20080089500A (ko) 모바일 네트워크를 기반으로 하는 엔드 투 엔드 통신에서의 인증을 위한 방법, 시스템 및 인증 센터
WO2012019466A1 (zh) 邻居用户终端间保密通信方法、终端、交换设备及系统
KR20060134774A (ko) 무선 휴대 인터넷 시스템의 ｍａｃ 계층에서 보안 기능을 구현하기 위한 장치 및 이를 이용한 인증 방법
US20190335329A1 (en) Mtc key management for sending key from network to ue
CN110808834B (zh) 量子密钥分发方法和量子密钥分发系统
US10897707B2 (en) Methods and apparatus for direct communication key establishment
Khan et al. Secure authentication and key management protocols for mobile multihop WiMAX networks
WO2021103772A1 (zh) 数据传输方法和装置
WO2023083170A1 (zh) 密钥生成方法、装置、终端设备及服务器
CN112118568B (zh) 一种设备身份鉴权的方法及设备
WO2011127732A1 (zh) 下一代网络中多接入认证方法及系统
JP6621146B2 (ja) 通信装置、通信端末、通信システム、通信制御方法および通信制御プログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10849741

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 13641018

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2010849741

Country of ref document: EP