WO2011131002A1

WO2011131002A1 - Method and system for identity management

Info

Publication number: WO2011131002A1
Application number: PCT/CN2010/078832
Authority: WO
Inventors: 孙翼舟; 黄兵; 江华
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-04-22
Filing date: 2010-11-17
Publication date: 2011-10-27
Also published as: CN102238148A; CN102238148B

Abstract

A method and a system for identity management are provided in the present invention, the method and system are realized based on the identification network, the terminals and identity management IDP server of said identification network have identity identifiers AIDs for indicating the identity in the identification network; said method includes: when a terminal originates an identity service flow, an access service node ASN of said identification network using the AID of the terminal and the AID of the IDP server to which the terminal belongs sends the identity service request of the terminal to the IDP server to which the terminal belongs, the IDP server to which the terminal belongs implements the identity management of the terminal according to the identity service request. The present invention can simplify the management of the identity management system.

Description

Identity management method and system

Technical field

The present invention relates to the field of communications technologies, and in particular, to an identity management method and system.

Background technique

Identity management system

Identity management (IDM) is not a new thing. Today's social life-related household identity card management, passport management, enterprise organization code management, and device number management are all IDMs. Most of the IDM systems on the Internet are now provided by service providers or enterprises, such as the telecom operator's account management system, Taobao's Alipay, online game operator's account management system, etc. IDM for different enterprises and different businesses. The system is different.

There are some problems with this IDM system provided by a service provider or enterprise:

1) Security risks. Users do not use real identity, are not traceable, and have security risks. In addition, enterprises do not pay enough attention to the protection of users' private information, which often causes user identity information to be leaked.

2) Repeat registration. Each company's various services, users need to register separately, use trouble.

3) Information between IDM systems is not shared and does not interact. A user information of an IDM system has changed and cannot be synchronized to other IDM systems.

To this end, the ITU-T standards organization established the IDM Focus Working Group at the 2006 SG17 meeting to propose a common IDM functional architecture. The core idea is to introduce the concept of identity provider (IDP) on the Internet in addition to users and service providers (SPs). IDP provides users and SPs with identity services. The schematic diagram of IDM's system is shown in Figure 1.

IDP provides identity authentication services for SPs and is responsible for managing user identity information. For example, the user's registration request is accepted, and the user's identity attribute is managed (identity attribute change, revocation, etc.) to ensure the security of the user identity information.

The identity services provided by IDP include the following four categories: 1) Identification. The identity can be any tag that can be used to represent an entity's identity. For example: user ID, email address, pseudonym, group name, and so on.

2) Trust. Identity security credentials, usually used to identify the security parameters of a claimed identity. The credential can be a password, a token, a security prompt, or a PKI. For example: key, authentication, signature authentication, and password information.

3) Properties. An identity attribute is a description of an entity's characteristics, such as the entity type, preferred IP address, domain name, address information, phone number, and so on. Attributes can also include permissions, proxy lists, and some special restrictions.

4) Identity mode. The identity mode refers to the user's reputation, reputation, trust record, and historical access record.

In the case of multiple IDP systems, the user and the SP do not know which IDP to provide identity service. In this case, an IDP discovery system is needed to find a suitable IDP to provide services for the user. In addition, identity information not only involves the privacy of users, but also involves social security and national security. The IDP system must be effectively supervised. Therefore, it is necessary to establish a government-level IDM supervision center to provide IDP discovery system functions and assume responsibility for IDP supervision. The business process for users to apply for identity services is shown in Figure 2:

(201) The user requests a service or resource from the SP and provides IDP related information.

(202) The SP requests the IDM supervision center to perform address resolution on the domain name of the IDP server submitted by the user, and obtains the network address of the user IDP.

( 203 ) The IDM Supervisory Center sends the IDP network address to the SP.

( 204 ) The SP locates the IDP based on the network address.

( 205 ) IDP sends a login interface to the user, allowing the user to enter an account number and password, as well as other login information for the risk certificate.

(206) The user enters an account number and password, and other login information.

(207) After the IDP verification is passed, an instruction to verify the pass (reject) is sent to the SP.

(208) The SP provides the requested service to the user.

At present, an unresolved main problem of the IDM system is what is used as an identity identifier. Includes user ID and IDP ID. User ID can be used with user ID, email address, pseudonym, group name, and randomness. There is no uniform identifier. In addition, the IDP logo is used for the IDP supervision center, SP, and user addressing of the IDP server. Now the IDM standard discussion group proposes to use the URL (Uniform I Universal Resource Locator, also known as the web address) for IDP. Addressing, but the URL is based on the DNS domain name resolution system. The resolution of the global root domain name is in the United States. The United States can monitor IDP activities in other countries and endanger national information security. Therefore, it is necessary to establish a user identity and an IDP identifier that are automatically controlled by each country.

Identification network technology and identity

The TCP/IP protocol widely used on the existing Internet does not support mobility. When the terminal location moves, the terminal IP address will change, causing an interruption in the application and connection. The essential reason why the IP protocol does not support mobility is that the IP address contains both the identity and location attributes.

Identity attribute of the IP address: In the TCP/IP protocol stack, the IP address is used to identify the communication peer;

Location attribute of the IP address: The IP address represents which network segment the user is on and is the basis of the route. In a fixed network, there is no problem in the location and identity of the IP address. Because the location of the terminal is unchanged, the IP address will not change and the identity attribute will not change.

When it comes to the mobile Internet, the movement of the terminal location causes the IP address to change. If it does not change, it cannot be routed. The change of the IP address will cause the upper layer TCP/UDP connection to be disconnected and the service will be interrupted. It is unacceptable for many applications.

The concept of the identification network is to separate the terminal IP address into an identity by identity attribute and location attribute.

AID and location identifier RID, the specific mechanism is as follows:

1) The IP address of the edge router where the terminal is located is used as the location identifier of the terminal, which is called the RID of the terminal. When the terminal location changes, the RID changes.

2) Introduce a new namespace as the identity of the terminal, called the AID of the terminal, and the AID of the terminal remains unchanged for life.

3) The terminal only perceives its own AID and the AID of the communication peer, and does not perceive the RID information. All upper layer connections are established based on the AID. That is, TCP/AID and UDP/AID are used instead of TCP/IP and UDP/IP. 4) The terminal sends the data packet with the destination AID and the source AID as the destination and the source address, and the edge router converts the AID into the RID after receiving the data packet; the RID is the format of the IP address, and can be addressed to the communication on the existing Internet. The peer edge router; the peer edge router converts the RID in the packet into an AID and sends it to the other terminal.

The AID encoding format can be defined by the service provider or government agency, but it can be used but is not limited to: IPv4/IPv6. The advantage of using the IP address encoding format is that the existing terminal on the market does not need to be modified to support the identification network.

Summary of the invention

The present invention provides an identity management method and system to simplify identity management.

To solve the above technical problem, the present invention provides an identity management method, characterized in that the method is implemented based on an identification network, and the terminal and identity management (IDP) server of the identification network has an identity (AID) indicating an identity in the identification network. The method includes: when the terminal initiates the identity service process, the access service node (ASN) of the identity network sends the identity service request of the terminal to the IDP of the terminal by using the terminal and the AID of the IDP server to which the terminal belongs. The server, by which the IDP server to which the terminal belongs, implements identity management of the terminal according to the identity service request.

In the above method, when the terminal knows the IDP to which the terminal belongs, the terminal and the AID of the IDP server to which the terminal belongs may be provided to the ASN by the terminal when transmitting the identity service request.

If the terminal is not aware of the IDP server to which the terminal belongs, the AID of the terminal may be provided by the terminal to the ASN when the identity service request is sent, and the ASN may query the monitoring center (IDM) for the IDP server that provides the identity service for the terminal, and obtain the identity of the terminal. The AID of the IDP server.

The IDP server to which the terminal belongs may perform the process of identity management on the terminal by: sending a login indication to the terminal, inputting identity information in the terminal, performing identity verification according to the input identity information, and sending an identity service response to the terminal through the ASN, where Validation results.

The identity service may include any one or more of identity authentication, identity information query, identity information modification, identity information registration, and identity information revocation.

The method may further include: when the terminal submits a service request to the service server, the service server initiates an identity authentication process, where the identity authentication process includes: (a) The service server sends an identity authentication request to the IDP to which the terminal belongs, where the terminal carries

AID;

(b) The IDP server to which the terminal belongs checks whether the terminal has passed the verification according to the AID of the terminal, and if it has passed the verification, step (e) is performed, and if the verification fails, the authentication challenge is sent to the terminal;

(c) the terminal sends identity information to the home IDP server;

(d) verifying the identity information by the IDP server to which the terminal belongs;

(e) The IDP server to which the terminal belongs sends an identity authentication response to the service server, where the terminal carries the AID and the identity authentication result;

(f) The service server determines whether to authorize the service request of the terminal according to the identity authentication result of the terminal.

The present invention also provides an identity management system, which is implemented based on an identification network, including an ASN, a terminal, and an identity management (IDP) server, where:

The terminal has an identity (AID) indicating an identity in the network, and the terminal is configured to: send an identity service request to the IDP server to which the terminal belongs by using the ASN, where the identity service request carries the AID of the terminal; And sending identity information to the home IDP server; the ASN is configured to implement an identity service request and an identity service response route between the terminal and the home IDP server according to the AID of the terminal and the AID of the IDP server to which the terminal belongs. Forward

The IDP server has an AID indicating an identity in the identification network, and the IDP server is configured to: receive an identity service request forwarded by the ASN, verify identity information sent by a terminal that belongs to the IDP server, and send the identity information to the ASN. The identity service response carries the AID and the verification result information of the terminal belonging to the IDP server.

In the above system, if the terminal knows the IDP to which the terminal belongs, the identity service request sent by the terminal may also carry the AID of the IDP server to which the terminal belongs.

The system may further include a monitoring center (IDM), the IDM may be configured to manage a correspondence between the IDP server and a terminal belonging to the IDP server; the ASN may also be configured to: if the terminal does not know the owned IDP server, according to The AID of the terminal in the identity service request queries the IDM for the IDP server that provides the identity service for the terminal, and obtains the identity of the IDP server to which the terminal belongs. Logo.

The system may further include a service server, where the service server may be configured to send an identity authentication request to the IDP server to which the terminal belongs when the terminal requests the service, where the AID of the terminal is carried; and the identity authentication response sent by the IDP server to which the terminal belongs is received. Carrying the AID of the terminal and the identity authentication result; and determining whether to authorize the service request of the terminal according to the identity authentication result of the terminal; the IDP server may also be configured to, when receiving the identity authentication request sent by the service server, according to the attribution to the present The AID of the terminal of the IDP server determines whether to initiate an authentication challenge to the terminal. The IDP server checks whether the identity authentication result information of the terminal belonging to the IDP server is already present, and if yes, may directly send an identity authentication response to the service server according to the identity authentication result information, and if not, may initiate authentication to the terminal. challenge.

The terminal may be configured to send the identity information to the home IDP server according to the login indication or authentication challenge sent by the home IDP server.

The method and system of the present invention are implemented based on an identification network, and the AID representing the identity is used as the identity management identifier, which can simplify the management of the identity management system.

BRIEF abstract

Figure 1 Schematic diagram of the IDM system;

Figure 2 Business flow chart of the user applying for identity service;

Figure 3 is a schematic diagram of identity management based on the identification network;

Figure 4 is based on the identification network IDM system service flow chart 1;

Figure 5 is based on the identification network IDM system service flow chart 2;

Figure 6 Single sign-on service flow chart.

Preferred embodiment of the invention

The invention will now be further described with reference to the accompanying drawings and embodiments. The identity management method and system of the present invention is implemented based on an identification network. The terminal and identity management (IDP) server has an identity (AID) indicating an identity within the identity network, and the access service node (ASN) of the identity network utilizes the terminal and the IDP server. The AID implements an identity service interaction between the terminal and the IDP server, and the IDP implements identity management of the terminal according to the identity information provided by the terminal.

The technical solution of the present invention will be described in more detail below with reference to the accompanying drawings and embodiments.

The topographical schematic shown in Figure 3 depicts key features of the system architecture associated with the present invention. The main network elements and functional entities of the identity network management system based on the identification network technology (hereinafter referred to as the present architecture) include:

ASN: Access Service Node, access service node. The ASN maintains the connection relationship between the terminal and the network, allocates RIDs to the terminals, processes the handover process, processes the registration process, processes the accounting and authentication processes, and maintains and queries the AID-RID mapping relationship of the communication peer.

The ASN encapsulates, routes, and forwards data packets sent by the terminal or terminal.

When receiving the data packet sent by the terminal MN, the ASN queries the AID-RID mapping table in the local cache according to the AIDc of the destination CN in the data packet: If the AIDc-RIDc mapping entry corresponding to the AIDc is found, The RIDc is encapsulated in the packet header as the destination address, and the RIDm corresponding to the MN source address AIDm is encapsulated in the packet header and forwarded to the generalized forwarding plane. If the AIDc-RIDc mapping entry corresponding to the AIDc is not found, The data packet is encapsulated and then forwarded to the mapping forwarding plane, and the process of querying the AIDc-RIDc mapping relationship is sent to the mapping forwarding plane.

When receiving the data packet sent by the network to the terminal, the ASN decapsulates the data packet, strips the RID encapsulation of the data packet header, and retains the AID as the data packet header to be sent to the terminal.

CR: Common Router, general purpose router. Routes and forwards data packets with the RID format as the source or destination address. The function of this general purpose router is no different from that of the prior art routers.

ILR/PTF: Identity Location Register/Packet Transfer Function, ILR is an identity location register that maintains and saves the AID-RID mapping relationship of users in the architecture network. Implement the registration function and process the location query process of the communication peer. Broke ILR is mainly used to visit ILR and attribution Signaling between transit ILRs when there is no direct connection between ILRs.

PTF is a packet forwarding function. After receiving the data packet sent by the ASN, the mapping forwarding plane routes and forwards the PTF according to the destination AID in the mapping forwarding plane. After the PTF node in the mapping forwarding plane finds the mapping relationship of the destination AID-RID, the RID information corresponding to the mapping relationship is encapsulated in the data packet header and forwarded to the generalized forwarding plane, which is routed by the generalized forwarding plane and forwarded to the communication peer. .

IDP: Identity provider, identity service provider. The IDP records user attributes of the network, including user categories, authentication information, and user service levels, and generates user security information for authentication, integrity protection, and encryption, and performs access control and authorization when the user accesses. . IDP supports two-way authentication between the terminal and the network.

IDM Monitoring Center: IDM's regulatory entity provides IDP query services for users and service providers (SPs), namely IDP discovery, and is also responsible for authorizing IDP server qualifications.

In connection with the present invention,

The identity management system of the present invention is implemented based on an identification network, including an ASN, a terminal, and an identity management (IDP) server, where:

The terminal has an identity (AID) indicating an identity within the identification network, and is set to:

The ASN sends an identity service request to the IDP server, where the identity service request carries the AID of the terminal; and sends identity information to the IDP server;

The ASN is configured to implement an identity service request and an identity service response route forwarding between the terminal and the IDP server according to the AID of the terminal and the AID of the IDP server;

The specific route forwarding method is determined according to the specific network mechanism of the identification network, and the present invention is not specifically described herein.

The IDP server has an AID that identifies an identity in the network, and is configured to: receive an identity service request forwarded by the ASN, verify identity information sent by the terminal, and send an identity service response to the ASN, where the identifier is carried. The AID of the terminal and the verification result information.

In the case that the terminal is known to belong to the IDP server, the identity service request sent by the terminal further carries the AID of the IDP server to which the terminal belongs.

Further, the system further includes a monitoring center (IDM), and the IDM is configured to: manage a correspondence between the IDP server and a terminal belonging to the IDP server; The ANS is further configured to: if the terminal does not know the IDP server to which the terminal belongs, query the IDM for the IDP server that provides the identity service for the terminal according to the AID of the terminal in the identity service request, and obtain the AID of the IDP server.

The identity service according to the present invention includes any one or more of identity authentication, identity information query, identity information modification, identity information registration, and identity information revocation.

Further, the system of the present invention further includes a service server, the service server is configured to: when the terminal makes a service request, send an identity authentication request to the IDP server to which the terminal belongs, where the AID of the terminal is carried; and the receiving IDP server sends The identity authentication response, wherein the AID of the terminal and the identity authentication result of the terminal are carried; the service server is further configured to determine whether to request authorization for the service of the terminal according to the identity authentication result of the terminal; the IDP server It is further arranged to decide whether to initiate an authentication challenge to the terminal according to the AID of the terminal.

Specifically, the IDP server checks whether the identity authentication result information of the terminal is already present, and if yes, directly sends an identity authentication response to the service server according to the identity authentication result information, and if not, sends the identity authentication response to the terminal. Certification challenge.

The terminal sends the identity information to the IDP server according to the login indication sent by the IDP server or the authentication challenge sent by the IDP server.

The identity management method of the present invention is implemented based on an identification network. The terminal and identity management (IDP) server has an identity (AID) indicating an identity within the identity network. When the terminal initiates an identity service process, the access service node (ASN) of the identity network utilizes The AID of the terminal and the IDP server sends the identity service request of the terminal to the IDP server to which the terminal belongs, and the IDP server to which the terminal belongs implements identity management of the terminal according to the identity service request.

In the identity management system architecture based on the identification network technology of the present invention, the identity identifier AID of the terminal user during the valid legal existence period remains unchanged. When an end user accesses the network, he needs to apply for an identity authentication service to the IDP server. IDP's authentication method for user identity uses different methods according to different network systems. It can directly authenticate the user access identifier AID, or it can identify other types of users that identify users in the network (for example, international mobile users). Identify IMSI, network user identification NAI, etc. for authentication. After the user passes the authentication of the IDP server, the user can enter the legal user list of the ASN to access the network resources. In addition to the identity authentication service, users can also apply to IDP for other identity services, such as querying, modifying, registering, and revoking identity information.

The process of identity management of the terminal by the IDP server includes:

The IDP server sends a login indication to the terminal, the terminal inputs the identity information, and the IDP server performs identity verification according to the identity information input by the terminal;

The IDP server sends an identity service response to the terminal through the ASN, which carries the verification result. Application example 1 :

In the case where the terminal is known to belong to the IDP server, the terminal and the AID of the IDP server to which the terminal belongs are provided to the ASN by the terminal when transmitting the identity service request. The business process of the terminal applying for identity service is shown in Figure 4, including:

(401) The terminal M requests an identity service from the ASN, and provides the identity identifier of the terminal, AIDm, and the identity identifier AIDn of the IDP server to which the terminal belongs;

(402) The ASN requests an identity service from an IDP server to which the terminal belongs.

(403) The IDP server sends a login indication to the terminal M, and causes the terminal M to input an account number and password, and other identity information for verification.

( 404 ) Terminal M enters an account number and password, and other identity information.

(405) After the IDP server verifies the information input by the terminal, it sends an instruction to the ASN to verify (reject).

(406) The ASN provides the requested service to the terminal M.

If the terminal is not aware of the IDP server to which the terminal belongs, the AID of the terminal is provided by the terminal to the ASN when the identity service request is sent, and the ASN queries the regulatory center (IDM) to provide an identity service for the terminal. The IDP server obtains the AID of the IDP to which the terminal belongs. The business process of the terminal applying for identity service is shown in Figure 5, including:

(501) The terminal M requests an identity service from the ASN, and provides an identity of the terminal, AIDm. ( 502 ) The ASN requests the IDM supervisory center to find the IDP that provides the identity service for the terminal M, and obtains the identity identifier AIDn of the IDP server.

( 503 ) The IDM Supervisory Center sends the ID AID of the IDP server to the ASN. (504) The ASN requests an identity service from the IDP server according to the identifier AIDn.

(505) The IDP server sends a login indication to the terminal M, and causes the terminal M to input an account number and password, and other login information for verification.

( 506 ) Terminal M Enter the account number and password, and other login information.

(507) After the IDP server verifies the information input by the terminal, it sends an instruction to the ASN to verify (reject).

(508) The ASN provides the requested service to the terminal M.

The identity management system architecture of the present invention can also implement the single sign-on function, that is, after the terminal passes the identity authentication of the IDP, the terminal can access multiple services without logging in to the network during the effective validity of the terminal identity.

The method further includes: when the terminal submits a service request to the service server, the service server initiates an identity authentication process, where the identity authentication process includes:

(a) the service server sends an identity authentication request to the IDP server, where the AID of the terminal is carried;

(b) the IDP server checks whether the terminal has passed the verification according to the AID of the terminal, and if the verification has passed, the step (e) is performed, and if the verification fails, the authentication challenge is sent to the terminal;

(c) the terminal sends identity information of the terminal to the IDP;

(d) the IDP server authenticating the identity information;

(e) The IDP server sends an identity authentication response to the service server, where the AID of the terminal and the identity authentication result of the terminal are carried;

Application example 3

The following is an application example of the terminal requesting services from three service servers. The specific process is shown in Figure 6, including:

( 601) The terminal submits a service request to the service server of the service C (such as the IPTV service), and the carried parameter includes the identity identifier AID of the terminal; (602) The service server of the service C requests the identity authentication service from the IDP server, and the carried parameter includes the identity identifier AID of the terminal;

(603) The IDP server issues an authentication challenge to the terminal;

(604) The terminal requests authentication from the IDP server, and carries the identity information such as the identity AID, password, and credential of the terminal;

(605) the IDP server verifies the authentication parameters;

( 606) the IDP server feeds back the authentication result of the terminal to the service server of the service C, and carries the identity AID of the terminal with the parameter;

( 607) The service server of the service C determines whether the service request of the terminal is authorized according to the authentication result of the IDP server;

(608) if authorized, establishing an access link of the terminal to the service server of the service C;

(609) Start a session between the terminal and the service server of the service C, or the service C server starts to provide the service to the terminal.

(610) The terminal further requests the service B (such as the data service), and the terminal sends a service request to the service server of the service B, and the parameter carried by the terminal has the identity identifier AID of the terminal;

(612) The service server of the service B requests the identity authentication service from the IDP server, and the carried parameter has the identity identifier AID of the terminal;

(613) The IDP server checks whether the AID of the terminal has been verified;

(614) The IDP server feeds back the authentication result of the terminal user to the service server of the service B, and carries the parameter AID of the terminal;

(615) The service server of service B determines whether the service request of the terminal is authorized according to the verification result of the IDP server;

(616) if authorized, establishing an access link of the terminal to the service server of service B;

(617) starting a session between the terminal and the service server of the service B, or the service server of the service B starts to provide the service to the terminal;

(618) The terminal further requests the service A (such as the VOIP service), and the terminal sends a service request to the service server of the service A, and the parameter carried by the terminal has the identity identifier AID of the terminal; (619) The service server of the service A requests the identity authentication service from the IDP server, and the parameter carried is the identity identifier AID of the terminal;

(620) The IDP server checks whether the AID of the terminal has been verified;

(621) The IDP server feeds back the authentication result of the terminal user to the service server of the service A, and carries the parameter AID of the terminal;

(622) The service server of service A establishes an access link of the terminal to the service server of service A according to the verification result of the IDP server;

(623) Start a session between the terminal and the service server of the service A, or the service server of the service A starts to provide the service to the terminal.

First, in the existing identity management system, the user identifier has no unified form, and may be a user name, an email address, or a mobile phone number that the user himself takes. Different identity management systems have different forms of user identification. Therefore, the method of the present invention Uniformity with the system uses the AID that represents the identity as an identifier, which simplifies the management of the identity management system. Secondly, the IDP identifier in the existing identity management system is located in the URL and DNS domain name service system, and the final control right is in the United States. The ID is used to identify the IDP, which can ensure the national information security. Third, the user identity and IDP identifier of the existing identity management system cannot be used for addressing on the Internet, and the AID of the present invention can be used in the form of IPv4/IPv6, that is, the identifier of the IDP is encoded by the AID, and can be directly used for Internet search. site.

Industrial applicability

Compared with the prior art, the invention is implemented based on the identification network, and the AID representing the identity is used as the identity management identifier, which can simplify the management of the identity management system.

Claims

Claim

An identity management method, wherein the method is implemented based on an identity network, where the terminal of the identity network and the identity management IDP server have an identity identifier AID indicating an identity in the identity network; the method includes:

When the terminal initiates the identity service process, the access service node ASN of the identity network sends the identity service request of the terminal to the IDP server to which the terminal belongs, by using the AID of the terminal and the AID of the IDP server to which the terminal belongs, by the terminal. The home IDP server implements identity management of the terminal according to the identity service request.

2. The method according to claim 1, wherein the terminal knows an IDP server to which the terminal belongs;

The method further includes: when the terminal initiates the identity service process, the AID of the terminal and the AID of the IDP server to which the terminal belongs are provided to the ASN by using an identity service request.

3. The method according to claim 1, wherein the terminal does not know an IDP server to which the terminal belongs;

The method further includes: the terminal providing an AID of the terminal to the ASN by using an identity service request, and the ASN querying the IDP server to which the terminal belongs to obtain the IDP server by using the identity center IDM. AID.

4. The method according to claim 1, 2 or 3, wherein the IDP server to which the terminal belongs performs identity management on the terminal by:

The IDP server to which the terminal belongs sends a login indication to the terminal, and after the terminal inputs the identity information, performs identity verification according to the input identity information;

The IDP server to which the terminal belongs sends an identity service response to the terminal through the ASN, and the identity service response carries the verification result.

5. The method according to claim 1, wherein the identity service comprises any one or more of identity authentication, identity information query, identity information modification, identity information registration, and identity information revocation.

The method of claim 1, further comprising: the terminal submitting a service request to the service server, where the service server initiates an identity authentication process, where the identity authentication process includes: (a) the service server sends an identity authentication request to the IDP server to which the terminal belongs, where the identity authentication request carries the AID of the terminal;

(b) the IDP server to which the terminal belongs checks whether the terminal has passed the verification according to the AID of the terminal, and if it has passed the verification, performs step (e), and if not, sends an authentication challenge to the terminal;

(c) the terminal sends the identity information of the terminal to an IDP server to which the terminal belongs;

(d) verifying, by the IDP server to which the terminal belongs, the identity information;

(e) the IDP server to which the terminal belongs sends an identity authentication response to the service server, where

Business request authorization.

An identity management system, wherein the system is implemented based on an identification network, where the system includes an access service node ASN, a terminal, and an identity management IDP server, where

The terminal has an identity identifier AID indicating an identity in the identification network, and the terminal is configured to: send an identity service request to the home IDP server by using the ASN, where the identity service request carries the AID of the terminal; The home IDP server sends identity information;

The ASN is configured to: implement an identity service request and a route forwarding of the identity service response between the terminal and the IDP server to which the terminal belongs according to the AID of the terminal and the AID of the IDP server to which the terminal belongs;

The IDP server has an AID indicating an identity in the identification network, and the IDP server is configured to: receive an identity service request forwarded by the ASN, verify identity information sent by a terminal that belongs to the IDP server, and send the identity information to the ASN. The identity service responds, and the identity service response carries the AID and the verification result information of the terminal belonging to the IDP server.

8. The system according to claim 7, wherein, in the case that the terminal is known to belong to the IDP server, the identity service request sent by the terminal further carries the AID of the IDP server to which the terminal belongs.

9. The system of claim 7, further comprising a supervisory center IDM, the IDM being configured to: manage a correspondence between the IDP server and a terminal belonging to the IDP server; The ASN is further configured to: if the terminal does not know the IDP server to which the terminal belongs, query the IDM of the terminal to the IDM server according to the AID of the terminal in the identity service request, and obtain the AID of the IDP server.

10. The system according to claim 7, wherein the identity service comprises any one or more of identity authentication, identity information query, identity information modification, identity information registration, or identity information revocation.

11. The system of claim 7 further comprising a service server, said service server being configured to:

Sending an identity authentication request to the IDP server to which the terminal belongs, the identity authentication request carrying the AID of the terminal; receiving an identity authentication response sent by the IDP server to which the terminal belongs, the identity authentication The response carries the AID of the terminal and the identity authentication result of the terminal; and, according to the identity authentication result of the terminal, determines whether to request authorization for the service of the terminal; the IDP server is further configured to receive the When the service server sends an identity authentication request, it determines whether to initiate an authentication challenge to the terminal according to the AID of the terminal that belongs to the IDP server.

12. The system according to claim 11, wherein the IDP server is configured to determine whether to initiate an authentication challenge to a terminal belonging to the IDP server by: checking whether the terminal belonging to the IDP server is already present. The identity authentication result information, if yes, directly sends an identity authentication response to the service server according to the identity authentication result information, and if not, initiates an authentication challenge to the terminal.

13. The system of claim 7, wherein the terminal is configured to send identity information to a home IDP server based on a login indication or an authentication challenge sent by the home IDP server.