WO2011134395A1 - 认证方法、装置、认证中心及系统 - Google Patents

认证方法、装置、认证中心及系统 Download PDF

Info

Publication number
WO2011134395A1
WO2011134395A1 PCT/CN2011/073352 CN2011073352W WO2011134395A1 WO 2011134395 A1 WO2011134395 A1 WO 2011134395A1 CN 2011073352 W CN2011073352 W CN 2011073352W WO 2011134395 A1 WO2011134395 A1 WO 2011134395A1
Authority
WO
WIPO (PCT)
Prior art keywords
group
information
authentication
node
key
Prior art date
Application number
PCT/CN2011/073352
Other languages
English (en)
French (fr)
Inventor
朱红儒
齐旻鹏
焦文娟
Original Assignee
中国移动通信集团公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国移动通信集团公司 filed Critical 中国移动通信集团公司
Priority to EP11774386.4A priority Critical patent/EP2566204B1/en
Priority to US13/643,958 priority patent/US9137226B2/en
Publication of WO2011134395A1 publication Critical patent/WO2011134395A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/065—Network architectures or network communication protocols for network security for supporting key management in a packet data network for group communications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • the present invention relates to network security technologies in the field of communications, and in particular, to authentication methods, devices, authentication centers, and systems. Background technique
  • the existing communication network authentication mechanism is mostly one-to-one two-way authentication, including a single-key authentication and key agreement (AAA) authentication mechanism, and a public key-based certificate authentication mechanism.
  • AAA single-key authentication and key agreement
  • the single-key authentication mechanism includes: a shared key K is stored between the user node and the corresponding home server HLR/HSS (Home Location Register, Home Subscriber Server, Home Subscriber Database).
  • HLR/HSS Home Location Register, Home Subscriber Server, Home Subscriber Database
  • the user accesses the network, it performs mutual authentication with the corresponding home server node.
  • the left figure in Figure 1 is a schematic diagram of each user's independent authentication.
  • the right picture in Figure 1 is a group of users with associated relationships. The network side can only determine the identity of the user node that performs mutual authentication after the authentication is passed, regardless of whether there is an association relationship between the users.
  • the public key-based certificate authentication mechanism includes: a user and a corresponding home server node can obtain respective identity certificates and corresponding private keys from a trusted third-party digital certificate authority (CA), and The CA certificate is used to verify the identity certificate of the other party.
  • CA trusted third-party digital certificate authority
  • the corresponding home server sends the identity certificate to verify the identity of both parties. After the authentication is passed, the user who owns the legal certificate can access the network.
  • the inventors have found that when the number of terminal nodes is large, the signaling interaction required for a large number of user authentications consumes network resources and computing resources of the server.
  • the existing authentication methods are one-to-one.
  • these terminal nodes sometimes need to access the network at the same time.
  • a large amount of network resources are occupied, and the network resources are increased.
  • Network burden, and a large number of user authentication will increase the computing resources of the server.
  • Existing certification method It does not apply to the Internet of Things and may reduce the availability of IoT services. Summary of the invention
  • a first object of the present invention is to propose an authentication method to implement authentication of a plurality of nodes at a time.
  • a second object of the present invention is to provide an authentication apparatus for implementing authentication of a plurality of nodes at a time.
  • a third object of the present invention is to provide a network-side authentication center to implement authentication of a plurality of nodes at a time.
  • a fourth object of the present invention is to provide an authentication system for implementing authentication of a plurality of nodes at a time.
  • an authentication method including: receiving at least one access request, acquiring subkey information from a received access request; and obtaining subkey information according to the obtained Generate a group key; perform group authentication by interacting with the network side according to the group key.
  • the method further includes: generating a group authentication request carrying the group information according to the pre-stored group identification information; and sending the group authentication request carrying the group information to the network side.
  • the group authentication may be performed by: receiving a feedback message of the network side to the group authentication request according to the group key; and generating a group authentication response sent to the network side according to the feedback message and the group key.
  • the node information of the access request is sent to the network side.
  • the network side performs legality verification on the node information according to the pre-stored group and the identification information of the nodes in the group; the identifier information of the node may include the ID of the node, or the ID of the node and the corresponding sub-key information.
  • generating the group key may include: selecting, from all the acquired subkey information and the locally stored subkey information, t subkey information not greater than the total number n of nodes in the group to generate a group key.
  • the method further includes: marking a node corresponding to the subkey information selected when the group key is generated; and carrying the tag information in the node information sent to the network side.
  • an authentication method including:
  • Performing group authentication on the terminal side according to the group key information Preferably, performing group authentication on the terminal side according to the group key information, specifically: receiving, by the network side, a group authentication request that carries the group information on the terminal side;
  • the method further includes: receiving node information sent by the terminal side;
  • the identifier information of the node includes the ID of the node, or the ID of the node and the corresponding subkey information; the node information includes the ID of the node.
  • an authentication apparatus including: an interface module, configured to receive at least one access request; and a key generation module, configured to receive from an access request The sub-key information is obtained, and the group key is generated according to the obtained sub-key information.
  • the group authentication module is configured to perform group authentication by interacting with the network side according to the group key.
  • the method may further include: a storage module, configured to store group identification information; and a group authentication module, further configured to generate a group authentication request carrying the group information according to the access request and the group identification information, and send the group authentication request to the network side.
  • a storage module configured to store group identification information
  • a group authentication module further configured to generate a group authentication request carrying the group information according to the access request and the group identification information, and send the group authentication request to the network side.
  • the storage module may further store the identifier information of the node in the group
  • the device may further include: a discriminating module, configured to: according to the identifier information of the node in the group, determine, when the node that sends the access request is an out-of-group node, reject or delete Into the request.
  • the group authentication module may include: a requesting subunit, configured to generate a group authentication request, and receive a feedback message of the network side to the group authentication request; and a response subunit, configured to send and send to the network side according to the feedback message and the group key Certification response.
  • the key generation module may include: a key recovery submodule, configured to select, from the obtained subkey information and the locally stored subkey information, t subkey information that is not greater than a total number n of terminal nodes in the group. Generate a group key.
  • the key generation module may further include: a marking sub-module, configured to mark the node corresponding to the key information selected when the group key is generated, and carry the marking information in the node information sent to the network side;
  • the node information may include: The ID of the node, the ID of the node and the corresponding subkey information, or the ID and tag information of the node, or the ID of the node and the corresponding subkey information and tag information.
  • a network-side authentication center including: a storage module, configured to store group information and corresponding group key information; and a group authentication module, configured to The group key information performs group authentication on the terminal side.
  • the group authentication module may include: an interface sub-module, configured to receive a group authentication request on the terminal side, send a feedback message, and receive a group authentication response on the terminal side; and an authentication sub-module, configured to search for a corresponding group key information according to the group authentication request, Generate a feedback message; verify the group authentication response based on the group key.
  • the storage module may further store the group identifier information of the group corresponding to the group, and the interface sub-module is further configured to receive the node information sent by the terminal side, where the authentication sub-module may include: a query sub-unit, configured to use the group information carried in the group authentication request Searching for a corresponding group key from the storage module; a calculation subunit, configured to generate a feedback message of the group authentication request according to the group key information; and a verification subunit, configured to verify the group authentication response of the terminal side according to the group key;
  • the identifier information of the node is used to verify the validity of the node information.
  • the identifier information of the node may include the ID of the node, or the ID of the node and the corresponding subkey information.
  • the node information may include the ID of the node, or the ID of the node and the corresponding sub-density.
  • the key information, the ID of the node and the tag information, or the ID of the node and the corresponding subkey information and tag information, and the tag information is obtained by marking the node corresponding to the subkey information selected when the group key is generated by the terminal side. information.
  • an authentication system including a terminal node, configured to send an access request carrying subkey information;
  • a representative node configured to receive an access request of at least one terminal node, obtain subkey information; and generate a group key according to the subkey information; perform group authentication according to the group key and the network side;
  • the authentication center is configured to store group information and corresponding group key information, and perform group authentication on the representative node according to the group key information.
  • the method, the device, the authentication center, and the system for authenticating the Internet of Things communication in the embodiments of the present invention can be authenticated by a node (representative node) and the network side in a group authentication manner, so that multiple terminal side nodes can be authenticated at one time, which greatly solves the present problem.
  • the invention can also send the node information of the access request accepted by the node (representing the node) to the network side when the group authentication is passed, so that the group interaction authentication can be implemented, and the authentication of the terminal node in the Internet of Things can be applied and the object can be greatly improved.
  • the invention also provides an authentication mechanism when a group of nodes as a whole is connected to the network outside the whole, which ensures the logical association between the group nodes, and solves the internal nodes and externalities of the network caused by the one-to-one authentication in the prior art.
  • the logical relationship of the network is fragmented.
  • the invention can also recover the group key through a number of keys less than the total nodes in the group, and can avoid technical defects that the other group nodes cannot access due to one group member failure.
  • the invention can also verify the validity of the non-participating key recovery node after the authentication is completed, and further verify the authenticity of the access node.
  • FIG. 1 is a schematic diagram of a network authentication method in the prior art
  • Embodiment 3 is a schematic structural diagram of an authentication system in Embodiment 1 of the present invention.
  • FIG. 6 is a schematic structural diagram of an authentication apparatus in Embodiment 4 of the present invention.
  • FIG. 7 is a schematic structural diagram of an authentication center in Embodiment 5 of the present invention. detailed description
  • FIG. 2 is a flowchart of an authentication method according to Embodiment 1 of the present invention. As shown in FIG. 2, this embodiment includes:
  • Step S201 The network side pre-assembles the terminal nodes having the same behavior characteristic/behavior capability in the Internet of Things into a group. Specifically, the monitoring devices having the shooting and capturing characteristics form the same group; and the information in different groups is saved. , such as a group, a group node, and a group key for authenticating the group, the group key may be equivalent to a shared key saved by the terminal node and the network side in the prior art, and may be in each group. Setting at least one representative node;
  • Step S202 The representative node in the group receives an access request of the at least one terminal node carrying the subkey, and generates a group key according to the subkey;
  • the generation of the group key according to the subkey may specifically be:
  • the representative node may acquire at least one subkey from the received at least one access request, and generate a group key according to the at least one subkey;
  • the representative node may also obtain at least one subkey from the received at least one access request, plus the locally saved subkey, and the representative node may acquire at least two subkeys, and generate a group according to the at least two subkeys. Key
  • the representative node may also obtain multiple subkeys from the multiple access requests, and generate a group key according to the obtained multiple subkeys, in the generating group. You can use your own subkey that is saved locally or not.
  • the representative node after receiving the access request sent by the at least one terminal node, the representative node enters the subsequent authentication process with the network side, so that the terminal node that sends the access request and the total number of itself are obtained through the processing of one authentication process. Authentication of at least 2 terminal nodes.
  • Step S203 The representative node in the group performs group authentication according to the group key and the network side. Specifically, after receiving the access request sent by at least the set number of terminal nodes, the group authentication process may be started. Starting from the receipt of the first access request, after a set period of time, the group authentication process is initiated according to all access requests received within the set time period.
  • the network side obtains the group key according to the stored group information, and performs subsequent authentication with the representative node on the terminal side (for example, an authentication vector and an authentication response). If the network side does not pass the verification of the representative node, the network side notifies the representative node of the result of the verification failure. After the authentication of the representative node and the network side is passed, the representative node sends the information of each node that performs group authentication to the network. Side, so the network side confirms which nodes can access the network according to the node information.
  • the multiple nodes can be authenticated by interacting with the network side authentication at one time, thereby avoiding the network resource consumption problem that occurs when the existing communication network authentication mechanism is authenticated in a large-scale network in the future, and the authentication method is applied to In the Internet of Things, it can be applied to the authentication of terminal nodes in the Internet of Things and can greatly improve the availability of IoT services.
  • the network authentication of the existing sensor is only the authentication inside the sensor network.
  • the group authentication method proposed in this embodiment is an authentication scheme when a group of nodes is connected as a whole to the network outside the whole, and the group nodes are ensured.
  • the logical correlation solves the defect that the logical relationship between the internal nodes of the network and the external network is separated by the one-to-one authentication in the prior art.
  • FIG. 3 is a schematic structural diagram of an authentication system in Embodiment 1 of the present invention.
  • the system shown in Figure 3 includes:
  • the network side authentication center such as a home location register HomeA, stores the group A identifier, the node identifier in the group A (the ID information of the UE1-UE7), the group key K A , and the representative node ID information of the group A, and the like.
  • the information related to the group can be stored in the ID center as a list of IDs. For details, see Table 1 below:
  • Table 1 Group information stored by the network side authentication center Node ID in the group key group represents the section notes
  • group A standard K A (ID1, K1), (ID2, K2), ... (ID7, K7) ID6, for node identification or ID1JD2, ... ID7 ID7 selection, group Key and node identification required group B B (ID8, K8), (ID9, K9), ... (ID12, K12) ID10,
  • UE1, UE2, ..., UE7 consisting of UE1, UE2, ..., UE7, where UE6, UE7 are representative nodes of the group.
  • UE1, ..., UE5 are terminal nodes, and may include:
  • a storage module configured to store subkey information and at least one representative node information, such as UE6 and UE7;
  • a requesting module configured to select one of the representative nodes from the representative node information, and send an access request to the selected representative node.
  • the authentication method of the present invention is exemplified below by the schematic diagram of FIG. 3:
  • All nodes UE1, UE2, ..., UE7 in group A can communicate with each other through a proprietary protocol, but select nodes with strong terminal capabilities, such as sensor gateway or machine communication (Machine to Machine, referred to as ⁇ 2 ⁇ )
  • the terminal performs group authentication as a representative node.
  • UE6 or UE7 has the function of network access authentication, and can be used as a representative node (also called an authentication node).
  • all nodes will send an access request to the representative node. For example, UE1...
  • UE7 transmits its subkey share and corresponding ID, such as (ID1, K1), (ID2, K2), ... (ID7, K7) to the representative node, representing The node synthesizes the group key K A by using a threshold mechanism, and the representative node can restore the group key K A as long as it obtains a sub-key that is greater than or equal to t (t ⁇ 7, t can be set according to network specific conditions). This avoids the problem of the entire group being unavailable due to the unavailability of a node in the group.
  • Group A according to the physical environment of the group, node utilization and other conditions, according to certain principles, such as the rotation principle, load balancing principle, etc. through the private protocol communication, select the node UE6 or UE7 as the authentication node to represent the entire group for network access Authentication, where the representative node can carry the identifier of the group A or its own ID in the group authentication request, so that the network side can query the corresponding group key information and generate an authentication vector to facilitate subsequent authentication.
  • terminal nodes having the same behavior characteristic/behavior capability in the Internet of Things can be grouped into one group, and nodes having stronger terminal capabilities are selected as representatives of the authentication node in the group. Certification.
  • the authentication center of the core network side stores the group information of the group, the group key K, and the identity information of the users in the group.
  • the group key K is divided into several sub-keys and stored by the terminal nodes in the group respectively.
  • n is the total number of nodes in the group
  • these sub-keys can recover the group key K, thereby enabling It is guaranteed that the group key information can be recovered from the group node so that the representative node can perform mutual authentication on behalf of the entire group member node and the authentication center on the core network side, and can avoid being unable or unwilling to accept a group member due to damage, no power, and the like.
  • the incoming network causes other members of the group to access the network.
  • FIG. 4 is a flowchart of an authentication method in Embodiment 2 of the present invention.
  • the authentication process may be understood by referring to FIG. 3:
  • Step 401 UE B UE 2 , ..., UE 7 constitutes a structured logic hierarchy according to a proprietary protocol, such as a minimum spanning tree protocol, such as forming a tree structure.
  • the UE 7 is a tree root, UE UEz, ..., and UE 7 is the same group;
  • Step 402 UEi, ..., UE 6 uses its own ID and subkey ( ⁇ , ⁇ ⁇ , ⁇ ), ... ID 6 , K 6 ; Transmitted to UE 7 ;
  • the UE 8 transmits its own ID and sub-key (ID 8 , K 8 ) to the UE 7.
  • the UE 7 determines that the UE 8 is not a node within the group according to the stored node identification information, and therefore directly returns a rejection response, such as "Illegal user access";
  • Step 403 The UE 7 selects any part of the total of 7 copies according to the accepted 6 and local subkeys, and calculates the group key K A according to the recovery key algorithm in the threshold mechanism.
  • the following is based on the AKA algorithm.
  • the process of performing group authentication based on the shared group key K A is described in detail. In other embodiments, other authentication algorithms may be used for group authentication based on the group key K A .
  • the UE 7 initiates an authentication request to the home A , where the authentication request carries the group identification information of the group A, and the group identification information may specifically be the representative node. ID information.
  • UE 7 records the node ID of the received subkey, and marks the subkey used to generate the group key K A and its ID, and sends this information to the core network side for online after AKA authentication is completed. User registration.
  • Step 404 the Home A receives the authentication request from the representative set of nodes, according to the group identification information of the group or a representative node ID information carried in the authentication request, finds the corresponding group key K A, calculates the session key (Cryptographic key, Acronym CK) / Integrated Key (IK) and authentication vector, Home A sends the authentication vector as a feedback message to UE 7 ;
  • Step 405 The UE 7 performs authentication on the network side based on the group key K A and the information carried in the received authentication vector, and calculates a corresponding authentication response according to the authentication vector and the group key K A , and sends it to Home A.
  • Home A authenticates group A based on the group key K A and the information carried in the received authentication response, and UE 7 also needs to calculate the corresponding CK/IK according to the authentication vector. In order to ensure security, UE 7 should discard K A immediately after completing the calculation;
  • the representative node UE 7 does not receive the authentication failure message of the network side within a predetermined time, it indicates that the group authentication is passed, and the UE 7 encrypts all the node IDs and subkey information for group authentication by using the session key CK, and The encrypted node information is sent to the home A for registration, and the sent node information is used to verify the identity of the node on the network side.
  • the node information may include the node ID and the subkey, and may also include the step 403 b) Marking information, facilitating subsequent network side-entry One step verification.
  • Step 406 The home A performs online user registration, which may be, after the home A authenticates the group A based on the information carried in the group key K A and the received authentication response, according to the node sent by the received UE 7 The information is registered online, and the UE 7 is notified after the registration is completed.
  • the home A stores the node identification information in the group A and the group A (the ID of the UE1-UE7, or the ID of the UE1-UE7 and the corresponding subkey information), and the group key K A , which may be as shown in the table. One is shown.
  • Home A confirms the legitimacy of the marked node according to the tag, and further verifies the legitimacy of the node without tagging. Specifically, for the node information without tag, for example, only the node ID, or the node ID and its corresponding subkey information. You can verify the legitimacy of the node by comparing with the node ID stored in the node to determine whether the node ID or subkey information is consistent. Specifically, performing verification according to the node information and the content of the identifier information of the node stored on the network side includes the following implementation manners:
  • the node ID can be directly compared with the node ID in the node identifier stored in the home A , and it is determined whether the node ID in the node information is saved in the node identifier in the group. This is used for legal verification.
  • the node information also carries the subkey information and there is no tag information
  • the node ID and the subkey of the node information and the node identifier stored in the home A are compared for legal verification.
  • the node information can only verify the node information without the tag, such as only verifying the node ID, or the node ID and the corresponding subkey, etc., according to the content of the node information. 1 or 2nd way corresponding legality verification.
  • Step 407 The UE 7 sends the session key CK to the UE 1; UE 6 . UE 1; ..., UE 7 can use CK to encrypt and transmit user data.
  • the authentication center HomeA divides the group key K A of the group A into n shares, and stores the ID of the node in the group and the corresponding key share in the user identity information in the group, that is, the node identification information includes the ID. Information and subkey information.
  • each will The self-subkey is transmitted to the group authentication representative node, and the representative node selects t shares from the n pieces of key information according to the threshold mechanism algorithm, and sends the group key to the core network for authentication.
  • the out-of-group node does not have a corresponding sub-key, the group key K cannot be obtained, and thus the network cannot be accessed through the group authentication; meanwhile, due to the particularity of the threshold mechanism algorithm and the limitation of parameter selection here. If more than nt keys are missing, they cannot pass the authentication. Therefore, when receiving the legal group authentication request, the network side can determine that the group authentication includes at least t legal nodes. After the single key authentication ends, the representative nodes will be authenticated. The ID and key information of all the accepted nodes are transmitted to the certificate authority, and the certificate center records this information, and thereby confirms the identity information of all the nodes participating in the authentication and the legality of the nodes not participating in the key recovery node. This embodiment can reduce resource consumption for simultaneous authentication of a large number of nodes and maintain logical association between nodes.
  • FIG. 5 is a flowchart of the authentication method in Embodiment 3 of the present invention.
  • the authentication method in Embodiment 3 is similar to the authentication method in Embodiment 2 shown in FIG. 4.
  • the specific process includes:
  • Step 501 UEj, UE 2, ... ..., UE 7 constituting the structured logic levels according to a protocol (such as minimum spanning tree protocol), configured as a tree structure.
  • a protocol such as minimum spanning tree protocol
  • the UE 7 is a tree root, UE UEz, ..., and UE 7 are the same group;
  • Step 502 UEi, ..., UE 5 will have its own ID and sub-key ( ⁇ , ⁇ ), (ID 2 , K 2 ), ...
  • ID 5 , K 5 is transmitted to the UE 7 by using a tree structure; in addition, a node UE 8 outside the group transmits its own ID and subkey (ID 8 , K 8 ) to the UE 7 ;
  • Step 503 The UE 7 selects 4 of the received sub-keys from the received sub-keys, and adds the stored sub-keys K 7 to calculate the group key ⁇ ⁇ according to the recovery key algorithm in the threshold mechanism.
  • algorithm as an example, the subsequent shared key-based group ⁇ ⁇ group certification process for a detailed description, other embodiments may also be performed using other authentication set group key authentication algorithm ⁇ ⁇ .
  • the UE 7 initiates a group authentication request to the home A , where the authentication request carries the group identification information of the group A, and the group identification information may specifically be the representative.
  • the ID information of the node may specifically be the representative.
  • Step 504 after receiving an authentication request from the Home A representative node of the authentication, in accordance with group information, the group identification information such as ID information of the group or a representative node carried in the authentication request, finds the corresponding group key K A, since the UE 7 to generate group key by UEi, ... ..., UE 5, UE 7, UE 8 choose 4 parts generated, the UE 7 to generate the set key, there are two cases:
  • the UE 8 When the group key is generated, the UE 8 is not selected, but the UEi, ..., UE 5 , and UE 7 are selected to generate the group key. Therefore, the group key is still correct, Home A Calculating the session key CK/full key IK and the authentication vector, the home A sends the authentication vector as a feedback message to the UE 7 , step 505 is performed;
  • Step 505 The UE 7 authenticates the network side based on the group key K A and the information carried in the received authentication vector, and according to the authentication vector and the group. The key calculates a corresponding group authentication response and sends it to Home A.
  • the home A authenticates the group A based on the group key K A and the information carried in the received authentication response, and the UE 7 also needs to calculate the corresponding according to the authentication vector. CK/IK. In order to ensure security, UE 7 should discard K A immediately after completing the calculation;
  • the UE 7 encrypts the node ID of the received key information by using the session key CK, and sends the encrypted node ID information to the Home A for registration, and the transmitted node information is used for verifying the identity of the node on the network side. .
  • Step 506 The home A authenticates the group authentication response, that is, the group A is authenticated based on the group key K A and the information carried in the received authentication response.
  • the verification fails, the authentication failure message is sent to the UE 7 for authentication. End.
  • the group authentication is passed, the node information sent by the representative node is registered by the online user.
  • the verification according to the node information and the content of the identifier information of the node stored on the network side includes the following implementation manners:
  • the node information only carries the node ID information, the node ID can be directly compared with the node ID in the node identifier stored in the home A , and it is determined whether the node ID in the node information is saved in the node identifier in the group. This is used for legal verification. 2. If the node information also carries the subkey information and there is no tag information, the node ID and the subkey of the node information and the node identifier stored in the home A , such as (ID1, K1), (ID2) , K2), ... (ID7, K7), etc. are compared for legal verification.
  • the node information can only verify the node information without the tag, such as only verifying the node ID, or the node ID and the corresponding subkey, etc., according to the content of the node information. 1 or 2nd way corresponding legality verification.
  • the UE 8 is verified as an illegal user in the legal verification step, thereby registering other users, and notifying the UE 7 .
  • Step 507 UE 7 is sent to the session key CK UEi, ... ..., UE 5.
  • UE b ... UE 5 UE 7 can encrypt and transmit user data by using CK.
  • the validity of the group authentication is ensured.
  • the representative node directly denies the access in FIG. 4, and the subsequent verification is performed in the authentication center as shown in FIG.
  • the legitimacy of the ingress node is determined again, and the validity of the group key recovery node is not determined after the authentication is completed, thereby ensuring the reliability and accuracy of the group authentication and avoiding the "false" access of other non-group nodes.
  • FIG. 6 is a schematic structural diagram of an authentication apparatus according to Embodiment 4 of the present invention.
  • the apparatus may be located in a representative node of a group of groups in the Internet of Things, as shown in FIG. 3 and FIG.
  • This device includes:
  • the interface module 61 is configured to receive an access request of the at least one terminal node.
  • the key generation module 62 is configured to obtain subkey information from the received access request, and generate a group key according to the obtained subkey information;
  • the group authentication module 63 is configured to perform group authentication by interacting with the network side according to the group key.
  • the device may further include a storage module 64, configured to store group identification information, and a group authentication module, configured to generate a group authentication request carrying group information according to the access request and the group identification information, and send the group authentication request to the network side.
  • the group authentication module 63 can also send the node information of the access request to the network when the group authentication is passed. Collateral side.
  • the group authentication module 63 can include:
  • the requesting sub-unit 631 is configured to send a group authentication request that includes the group information or the self-ID information.
  • the storage module may store the feedback message (the interface authentication vector) of the group-side authentication request.
  • the response sub-unit 632 is configured to generate an authentication response sent to the network side according to the feedback message and the group key, for example, when receiving the authentication vector of the network side group authentication request by the interface module, calculating the corresponding group according to the group key.
  • the authentication response is sent to the network side.
  • the response sub-unit 632 can also delete the group key after calculating the completion group authentication response.
  • the key generation module 62 may include: a key recovery sub-module 621, configured to select, from the subkey information carried by the accepted access request and the subkey information stored by itself, not greater than the total number of terminal nodes in the group.
  • the t subkey information generates a group key.
  • the key generation module 62 may further include: a marking sub-module 622, configured to mark a node corresponding to the key information selected when the group key is generated, and carry the marking information in the node information sent to the network side; the node information includes : Node ID information, node ID information, and corresponding tag information.
  • the device storage module 64 may further store the identification information of the nodes in the group.
  • the method further includes: a determining module 65, configured to determine, according to the identification information of the nodes in the group, the node that sends the access request is an out-of-group node, and refuses or deletes the access.
  • the request can be stored in the following table as follows:
  • the terminal side represents the group information stored by the node.
  • the node identifier in the group represents the section.
  • the storage module only stores the group identification information, as shown in the method embodiment of FIG. 5, the access request of the out-of-group node is not directly rejected; if the storage module further stores the intra-group node identifier as shown in Table 2, As shown, the access request is directly judged according to the node ID, so that the access of the out-of-group node is directly discarded/rejected, and only the access request of the node in the group is accepted for group authentication.
  • FIG. 7 is a schematic structural diagram of an authentication center in Embodiment 4 of the present invention.
  • the center can be located in the Home Location Register (HLR) and the Home Subscriber Server (HSS), as shown in Figure 3, as shown in Figure 7, including:
  • HLR Home Location Register
  • HSS Home Subscriber Server
  • the storage module 71 is configured to save group information (group identifier), group key information, and identifier information of each node in the group; the module may further store a representative node ID corresponding to the group information, as shown in Table 1, and search for a corresponding group according to the group authentication request.
  • group and group key group information (group identifier), group key information, and identifier information of each node in the group;
  • the group authentication module 72 is configured to perform group authentication on the terminal side according to the group key information.
  • the group authentication module 72 can include:
  • the interface sub-module 721 is configured to receive a group authentication request on the terminal side, send a feedback message of the group authentication request, such as an authentication vector, and receive a group authentication response, node information, and the like on the terminal side;
  • the authentication sub-module 722 is configured to search for the corresponding group key information according to the group information carried in the group authentication request, and generate an authentication vector feedback message of the group authentication request; and verify the group authentication response according to the group key, if the storage module 71 stores the group
  • the internal node identification information the authentication sub-module 722 can further verify the legality of the node information, for example, the group authentication response can be verified according to the group key, and the legality of the node information is verified according to the identification information of the node, according to the identification information of the storage module node.
  • the node containing the tag information performs legality verification.
  • the authentication submodule 722 may include:
  • the query subunit 7221 is configured to search for corresponding group key information from the storage module according to the group information carried in the group authentication request.
  • a calculation subunit 7222 configured to calculate a feedback message, such as a group authentication vector, according to the group key, and send the message to the terminal side;
  • the verification subunit 7223 is configured to verify the group authentication response of the terminal side according to the group key, and verify the validity of the node information according to the identification information of the nodes in the group, as shown in FIG. 4-5.

Description

认证方法、 装置、 认证中心及系统
技术领域
本发明涉及通信领域中网络安全技术， 具体地， 涉及认证方法、 装置、 认证中心及系统。 背景技术
现有通信网络认证机制， 多为一对一的双向认证方式， 包括基于单钥的 认证和密钥协商 （ Authentication and Key Agreement, 简称 AKA )认证机制， 和基于公钥的证书认证机制。
如图 1所示，单钥认证机制包括：用户节点与对应的归属服务器 HLR/HSS ( Home Location Register, 归属位置哥存器 / Home Subscriber Server, 归属用 户数据库） 节点间保存共享的密钥 K, 用户接入网络时与对应的归属服务器 节点进行交互认证， 图 1 中的左图为相互独立的各用户分别进行认证的示意 图， 图 1 中的右图为存在关联关系的一组用户分别进行认证的示意图， 无论 用户之间是否存在关联关系， 在认证通过后， 网络侧只能确定进行交互认证 的该用户节点的身份。
基于公钥的证书认证机制包括： 用户与对应的归属服务器节点都可从可 信的第三方数字证书认证中心 （ Certificate Authority , 简称 CA )处取得各自 对应的身份证书和对应的私钥， 并可取得 CA证书用于验证对方的身份证书； 用户接入网络时， 与对应的归属服务器通过发送各自的身份证书验证双方身 份； 认证通过后， 拥有此合法证书的用户可以接入网络。
在实现本发明过程中， 发明人发现， 在终端节点数量庞大时， 大量用户 认证所需的信令交互会消耗网络资源及服务器的计算资源。 具体的， 现有的 认证方式都是一对一， 当网络中具有相同行为特性的终端节点数量规模很大 时， 这些终端节点有时需要同时接入网络， 此时， 将占用大量网络资源， 增 加网络负担， 并且大量用户认证会增加服务器的计算资源。 现有的认证方式 并不适用物联网， 且有可能降低物联网业务的可用性。 发明内容
本发明的第一目的是提出一种认证方法， 以实现一次认证多个节点。 本发明的第二目的是提出一种认证装置， 以实现一次认证多个节点。 本发明的第三目的是提出一种网络侧的认证中心， 以实现一次认证多个 节点。
本发明的第四目的是提出一种认证系统， 以实现一次认证多个节点。 为实现上述第一目的， 根据本发明的一个方面， 提供了一种认证方法， 包括： 接收至少一个接入请求， 从接收的接入请求中获取子密钥信息； 根据 获取的子密钥信息生成组密钥； 根据组密钥与网络侧交互进行组认证。
其中， 接收至少一个接入请求之后还可以包括： 根据预存的组标识信息 生成携带组信息的组认证请求； 将携带组信息的组认证请求发送至网络侧。
其中， 根据组密钥与网络侧交互进行组认证可以包括： 接收网络侧对组 认证请求的反馈消息； 根据反馈消息及组密钥生成发送至网络侧的组认证响 应。
优选地， 当组认证通过时， 发送接入请求的节点信息至网络侧。 网络侧 根据预存的组及组内节点的标识信息对节点信息进行合法性验证； 节点的标 识信息可以包括节点的 ID、 或者节点的 ID及对应的子密钥信息。
优选地， 生成组密钥可以包括： 从获取的所有子密钥信息及本地存储的 子密钥信息中选择不大于组内节点总数目 n的 t个子密钥信息生成组密钥。
优选地， 进一步可以包括： 对生成组密钥时选择的子密钥信息对应的节 点进行标记； 在发送至网络侧的节点信息中携带标记信息。
为实现上述第一目的， 根据本发明的一个方面， 还提供了一种认证方法， 包括：
网络侧存储组信息及对应的组密钥信息；
根据所述组密钥信息对终端侧进行组认证。 优选地， 根据所述组密钥信息对终端侧进行组认证， 具体包括： 网络侧接收终端侧携带组信息的组认证请求；
根据所述组认证请求查找对应的组密钥信息， 生成反馈消息， 并将所述 反馈消息发送给终端侧；
接收终端侧的组认证响应 , 并根据所述组密钥验证所述组认证响应。 优选地， 在根据所述组密钥验证所述组认证响应通过后， 还包括： 接收终端侧发送的节点信息；
根据预存的组及组内节点的标识信息对所述节点信息进行合法性验证； 节点的标识信息包括节点的 ID、 或者节点的 ID及对应的子密钥信息； 所述节点信息包括节点的 ID及标记信息、 或者节点的 ID及对应的子密 钥信息和所述标记信息， 所述标记信息为终端侧对生成组密钥时选择的子密 钥信息对应的节点进行标记得到的信息。
为实现上述第二目的， 根据本发明的另一个方面， 提供了一种认证装置， 包括： 接口模块， 用于接收至少一个接入请求； 密钥生成模块， 用于从接收 的接入请求中获取子密钥信息， 并根据获取的子密钥信息生成组密钥； 组认 证模块， 用于根据组密钥与网络侧交互进行组认证。
还可以包括： 存储模块， 用于存储组标识信息； 组认证模块， 还进一步 用于根据接入请求及组标识信息生成携带组信息的组认证请求， 发送至网络 侧。
优选地， 存储模块还可以存储组内节点的标识信息， 该装置进一步可以 包括： 判别模块， 用于根据组内节点的标识信息判断发送接入请求的节点为 组外节点时， 拒绝或删除接入请求。
其中， 组认证模块可以包括： 请求子单元， 用于生成组认证请求， 并接 收网络侧对组认证请求的反馈消息； 响应子单元， 用于根据反馈消息及组密 钥生成发送至网络侧的认证响应。
密钥生成模块可以包括： 密钥恢复子模块， 用于从获取的子密钥信息及 本地存储的子密钥信息中选择不大于组内终端节点总数目 n的 t个子密钥信息 生成组密钥。
密钥生成模块还可以包括： 标记子模块， 用于对生成组密钥时选择的密 钥信息对应的节点进行标记， 并在发送至网络侧的节点信息中携带标记信息； 节点信息可以包括： 节点的 ID、 或者节点的 ID及对应的子密钥信息、 或者节 点的 ID及标记信息、 或者节点的 ID及对应的子密钥信息和标记信息。
为实现上述第三目的， 根据本发明的另一个方面， 提供了一种网络侧的 认证中心， 包括： 存储模块， 用于存储组信息及对应的组密钥信息； 组认证 模块， 用于根据组密钥信息对终端侧进行组认证。
组认证模块可以包括： 接口子模块， 用于接收终端侧的组认证请求， 发 送反馈消息， 接收终端侧的组认证响应； 认证子模块， 用于根据组认证请求 查找对应的组密钥信息， 生成反馈消息； 根据组密钥验证组认证响应。
存储模块还可以存储组对应的组内节点标识信息， 接口子模块， 还用于 接收终端侧发送的节点信息， 认证子模块可以包括： 查询子单元， 用于根据 组认证请求中携带的组信息从存储模块查找对应的组密钥； 计算子单元， 用 于根据组密钥信息生成组认证请求的反馈消息； 验证子单元， 用于根据组密 钥验证终端侧的组认证响应； 根据组内节点的标识信息验证节点信息的合法 性，节点的标识信息可以包括节点的 ID、或者节点的 ID及对应的子密钥信息； 节点信息可以包括节点的 ID、或者节点的 ID及对应的子密钥信息、或者节点 的 ID及标记信息、 或者节点的 ID及对应的子密钥信息和标记信息， 标记信 息为终端侧对生成组密钥时选择的子密钥信息对应的节点进行标记得到的信 息。
为实现上述第四目的， 根据本发明的另一个方面， 提供了一种认证系统， 包括终端节点， 用于发送携带子密钥信息的接入请求；
代表节点， 用于接收至少一个终端节点的接入请求， 获取子密钥信息； 并根据子密钥信息生成组密钥； 根据组密钥与网络侧进行组认证；
认证中心， 用于存储组信息及对应的组密钥信息， 并根据组密钥信息对 代表节点进行组认证。 本发明各实施例的物联网通讯认证方法、 装置、 认证中心和系统， 由于 可以通过组认证方式由一个节点 （代表节点） 与网络侧交互， 可以实现一次 认证多个终端侧节点， 大大解决现有一对一认证方式大量节点同时认证的网 络资源消耗问题和服务器网络负荷的技术缺陷。 本发明还可以在组认证通过 时将本节点 （代表节点）接受的接入请求的节点信息发送至网络侧， 因此可 以实现组交互认证， 可以适用物联网中终端节点的认证并可以大大提高物联 网业务的可用性。
本发明还提供了将一组节点作为整体接入整体之外网络时的认证机制， 保证了群组节点之间的逻辑关联性， 解决现有技术中一对一认证所引起网络 内部节点与外部网络的逻辑关系被割裂的缺陷。
本发明还可以通过若干少于组内总节点的密钥恢复组密钥， 可以避免因 一个组成员故障造成其他组内节点无法接入的技术缺陷。 本发明还可以在认 证完成后， 网络侧再次验证未参加密钥恢复节点的合法性， 进一步验证接入 节点的真实性。
本发明的其它特征和优点将在随后的说明书中阐述， 并且， 部分地从说 明书中变得显而易见， 或者通过实施本发明而了解。 本发明的目的和其他优 点可通过在所写的说明书、 权利要求书、 以及附图中所特别指出的结构来实 现和获得。
下面通过附图和实施例， 对本发明的技术方案做进一步的详细描述。 附图说明
附图用来提供对本发明的进一步理解， 并且构成说明书的一部分， 与本 发明的实施例一起用于解释本发明， 并不构成对本发明的限制。 在附图中： 图 1为现有技术中的网络认证方式示意图；
图 2为本发明实施例 1中的认证方法的流程图；
图 3为本发明实施例 1中的认证系统的结构示意图；
图 4为本发明实施例 2中的认证方法的流程图； 图 5为本发明实施例 3中的认证方法的流程图；
图 6为本发明实施例 4中的认证装置的结构示意图；
图 7为本发明实施例 5中的认证中心的结构示意图。 具体实施方式
以下结合附图， 以在物联网中节点认证为例， 对本发明的优选实施例进 行说明， 应当理解， 此处所描述的优选实施例仅用于说明和解释本发明， 并 不用于限定本发明。
实施例 1 :
图 2为根据本发明实施例 1 中的认证方法的流程图， 如图 2所示， 本实 施例包括：
步骤 S201 : 网络侧预先将物联网中具有同一行为特性 /行为能力的终端节 点组成一个群组， 具体地， 如具有拍摄、 抓取特性的监控设备组成同一个组； 并保存不同组内的信息， 如组、 组内节点、 及该组进行认证的组密钥等信息， 该组密钥可以相当于现有技术中终端节点与网络侧均保存的共享密钥， 并可 以在每个组内设置至少一个代表节点；
步骤 S202: 组内的代表节点接收至少一个终端节点的携带子密钥的接入 请求， 根据子密钥生成组密钥；
根据子密钥生成组密钥具体可以为：
代表节点可以从接收的至少一个接入请求中获取至少一个子密钥， 并根 据这至少一个子密钥生成组密钥；
代表节点还可以从接收的至少一个接入请求中获取至少一个子密钥， 加 上本地保存的自身的子密钥， 代表节点可以获取至少两个子密钥， 根据这至 少两个子密钥生成组密钥；
当接收到多个终端节点分别发送的接入请求时， 代表节点还可以从这多 个接入请求中获取多个子密钥， 并根据获取的这多个子密钥生成组密钥， 在 生成组密钥时可以使用本地保存的自身的子密钥， 也可以不使用。 本实施例中， 代表节点在接收到至少一个终端节点发送的接入请求后， 才进入后续与网络侧的认证流程， 从而通过一次认证流程的处理， 实现发送 接入请求的终端节点和自身共计至少 2个终端节点的认证。
步骤 S203: 组内的代表节点根据组密钥与网络侧进行组认证， 具体的， 可以是在接收到至少设定数量个终端节点发送的接入请求后， 启动组认证流 程； 也可以是在从接收到第一个接入请求开始， 在经过设定时间段后， 根据 在该设定时间段内接收的所有接入请求， 启动组认证流程。
认证过程中网络侧根据存储的组信息， 获得组密钥， 并进行后续与终端 侧该代表节点的认证（如， 认证向量、 认证响应）。 在网络侧对该代表节点验 证不通过的情况下， 网络侧将验证不通过的结果通知代表节点， 当代表节点 与网络侧的认证通过后， 代表节点将进行组认证的各节点信息发送至网络侧， 从而网络侧根据节点信息确认哪些节点可以接入网络。
本实施例具有如下优点： 可以通过一次与网络侧认证交互认证多个节点， 从而避免了现有通信网络认证机制在未来大规模网络中认证时出现的网络资 源消耗问题， 将该认证方法应用于物联网时， 可以适用物联网中终端节点的 认证并可以大大提高物联网业务的可用性。 现有的传感器等网络认证只是传 感器网络内部的认证， 本实施例提出的组认证方法是将一组节点作为一个整 体接入此整体之外的网络时的认证方案， 保证了群组节点之间的逻辑关联性， 解决现有技术中一对一认证所引起网络内部节点与外部网络的逻辑关系被割 裂的缺陷。
图 3为本发明实施例 1中的认证系统的结构示意图。 如图 3所示的系统， 包括：
网络侧认证中心， 如一个归属位置寄存器 HomeA, 存储有组 A标识、 组 A内的节点标识（UE1-UE7的 ID信息）、 组密钥 KA, 还可以存储组 A的代 表节点 ID信息等与组相关的信息， 具体实现时可以在认证中心以 ID列表方 式存在， 具体可参见下表一：
表一 网络侧认证中心存储的组信息 组 组密钥 组内节点标识 代表节 备注
占、 组 A标 KA (ID1,K1),(ID2,K2), ... ... (ID7,K7) ID6, 代表节点备 识 或 ID1JD2, ... ... ID7 ID7 选， 组密钥 和节点标识 必选 组 B标 KB (ID8,K8),(ID9,K9),…… (ID12,K12) ID10,
识 或 ID8JD9, …… ID12 ID11
* .. * .. * .. * .. 组 Α, 由 UE1,UE2, ... ... , UE7组成， 其中 UE6、 UE7为该组群的代表节 点。 UE1, ... ,UE5为终端节点， 可以包括：
存储模块， 用于存储子密钥信息及归属的至少一个代表节点信息， 如 UE6、 UE7;
请求模块， 用于从代表节点信息中选取其中一个代表节点， 并向选取的 该代表节点发送接入请求。
下面通过图 3的示意图对本发明的认证方法举例说明：
1 )组群 A与归属节点 HomeA共享组密钥 KA, HomeA利用门限机制算 法， 如 Asmuth-Bloom门限方案， 将 KA分成 7份子密钥 Kl, K2, ... ... K7, 通过预分配的方式分发给组群 A中的所有节点 UE1,UE2, ... ... , UE7并分别保 存。
2 )组群 A中的所有节点 UE1,UE2, ... ... , UE7都可以通过私有协议相互 通信， 但选择终端能力较强的节点， 如传感器网关或机器通讯（Machine to Machine , 简称 Μ2Μ )终端作为代表节点进行群组认证 ,如本实施例只有 UE6 或 UE7拥有网络接入认证的功能， 可作为代表节点（也称认证节点）。 组群中 的代表节点可以为多个， 根据组群情况及私有协议选取其中一个代表整个组 群进行网络接入认证。 3 )认证时， 所有节点将发送接入请求至代表节点。 如 UE1...... UE7将其 子密钥份额及相应的 ID, 如 (ID1,K1),(ID2,K2), ...... (ID7,K7)传至代表节点， 代表节点利用门限机制合成组密钥 KA, 代表节点只要获取大于等于 t (t<7, t 可以根据网络具体情况设置）份子密钥即可恢复组密钥 KA。 从而避免因组群 中的某个节点不可用造成的整个组群不可用的问题。
4 )组群 A根据组内物理环境、 节点利用率等条件， 按照一定的原则， 如 轮换原则， 负载平衡原则等通过私有协议通信， 选取节点 UE6或 UE7作为认 证节点代表全组进行网络接入认证， 其中代表节点可以在组认证请求中携带 组 A的标识，或者自身的 ID从而方便网络侧查询相应的组密钥信息及生成认 证向量便于后续认证。
本领域技术人员应了解， 釆用本实施例， 可以将物联网中具有同一行为 特性 /行为能力的终端节点组成一个群组 , 群组中选择终端能力较强的节点作 为认证节点代表进行群组认证。 核心网络侧的认证中心中存有该组的组群信 息、 组密钥 K, 以及组内用户的身份信息等。 组密钥 K被分成若干份子密钥 由组群中的终端节点分别保存， 只有大于等于 t小于 n(n为组内总节点数目） 份这些子密钥才能恢复组密钥 K, 从而既能保证能够从组群节点中恢复组密 钥信息使得代表节点可以代表全组成员节点与核心网络侧的认证中心交互认 证， 又能避免因一个组成员因损坏、 没电等原因不能或不愿接入网络造成组 内其他成员也无法接入网络。
实施例 2:
图 4为本发明实施例 2中的认证方法的流程图， 本实施例可参考图 3理 解认证过程：
步骤 401: UEBUE2, ...... , UE7根据私有协议， 如最小生成树协议构成结 构化逻辑层次， 如构成树形结构。 其中 UE7为树根， UE UEz, ...... , UE7为同 一组群；
步骤 402: UEi, ...... ,UE6将自己的 ID 及子密钥（Π^,ΚΟ Π^,ΚΖ), ...... ID6,K6;)利用树形结构传送给 UE7; UE8将自己的 ID及子密钥 (ID8,K8)传送给 UE7, UE7根据存储的组内节点 标识信息， 判断 UE8非本组内节点， 因此， 直接返回拒绝响应， 如 "非法用 户接人"；
步骤 403: UE7根据接受的 6份及本地的子密钥，共 7份中选取任意 t份， 根据门限机制中的恢复密钥算法， 计算得出组密钥 KA, 下面以 AKA算法为 例， 对后续基于共享的组密钥 KA进行组认证的流程做详细描述， 其他实施例 中也可以基于组密钥 KA使用其它的认证算法进行组认证。
a ) 当组群 A与网络侧认证中心 HomeA进行鉴权时 , 由 UE7向 HomeA发 起认证请求， 该认证请求中携带组群 A的组标识信息， 该组标识信息具体可 以是该代表节点的 ID信息。
b ) UE7记录收到的子密钥的节点 ID, 并标记生成组密钥 KA时所使用的 子密钥及其 ID, 并将此信息在 AKA认证完成后发送至核心网侧进行在线用 户注册。
步骤 404： HomeA收到来自代表节点的组认证请求后，根据组认证请求中 携带的组标识信息或代表节点 ID信息， 找到对应的组密钥 KA,计算会话密钥 ( Cryptographic key , 简称 CK ) /完整密钥 （ Integrated Key,简称 IK )和认证 向量， HomeA将认证向量作为反馈消息发送给 UE7;
步骤 405: UE7基于组密钥 KA和接收的认证向量中携带的信息， 对网络 侧进行认证， 并根据认证向量及组密钥 KA算出对应的认证响应， 并发送给 HomeA, 由 HomeA基于组密钥 KA和接收的认证响应中携带的信息对组群 A 进行认证， UE7还需要根据认证向量计算对应的 CK/IK。 为了保证安全， UE7 在完成计算后应立刻丟弃 KA;
如果代表节点 UE7在预定时间内没有接收到网络侧的认证不通过消息， 则表示组认证通过， UE7利用会话密钥 CK加密所有进行组认证的节点 ID以 及子密钥信息， 并将此加密后的节点信息发送给 HomeA进行注册， 所发送的 节点信息用于网络侧对节点的身份进行验证； 优选地， 节点信息可以包括节 点 ID及子密钥， 还可以包含步骤 403 b ) 中的标记信息， 便于后续网络侧进 一步验证。
步骤 406: HomeA进行在线用户注册， 具体可以为， HomeA在基于组密钥 KA和接收的认证响应中携带的信息对组群 A进行认证通过后， 根据接收的 UE7所发送的节点信息进行在线用户注册， 注册完成后通知 UE7。 本实施例中 HomeA存储有组 A、组 A内的节点标识信息（ UE1-UE7的 ID、或者 UE1-UE7 的 ID及对应的子密钥信息）、 组密钥 KA, 具体可如表一所示。
HomeA根据标记确认有标记的节点合法性， 并进一步验证没有标记的节 点合法性， 具体地， 对没有标记的节点信息， 例如只有节点 ID、 或者有节点 ID还有其对应的子密钥信息， 可以通过与自身存储的节点标识进行对比， 判 断节点 ID或子密钥信息是否一致从而验证节点的合法性。 具体地， 根据节点 信息及网络侧存储的节点的标识信息的内容进行验证包括如下几种实现方 式：
1. 如果节点信息只携带有节点 ID信息，则可以直接将节点 ID与 HomeA 存储的组内节点标识中的节点 ID进行比较， 判断节点信息中的节点 ID是否保存在组内节点标识中， 以此进行合法验证。
2. 如果节点信息中还携带有子密钥信息且均没有标记信息， 则可以将节 点信息的节点 ID 及子密钥与 HomeA存储的组内节点标识， 如 (ID1,K1),(ID2,K2), ... ... (ID7,K7)等进行比较， 以此进行合法验证。
3. 如果节点信息中除了节点 ID还携带有标记信息， 可以只验证没有标 记的节点信息， 如只验证节点 ID、 或者节点 ID及对应子密钥等等， 具体根据节点信息的内容进行上面第 1或第 2种方式相应的合法性验 证。
步骤 407: UE7将会话密钥 CK发送给 UE1; ... ... ,UE6。 UE1; ... ... ,UE7就可 以利用 CK将用户数据加密并传输。
本实施例管理密钥的认证中心 HomeA将组 A的组密钥 KA分成 n份， 并 在组内用户身份信息中存储组内节点的 ID及相应的密钥份额， 即节点标识信 息包括 ID信息及子密钥信息。 当组内的终端节点进行接入网络认证时， 将各 自的子密钥传至组认证代表节点， 由代表节点按照门限机制算法从 n份密钥 信息中选取 t份恢复出组密钥， 发送至核心网络侧进行认证。
由图 4可知， 由于组外节点没有对应的子密钥， 所以无法获得组密钥 K, 进而无法通过该组认证接入网络； 同时， 由于门限机制算法的特殊性以及此 处参数选择的限定， 导致多于 n-t份密钥的缺失， 都无法通过认证， 所以网络 侧在接到合法的组认证请求时就可以认定组认证时至少包含了 t个合法节点， 单钥认证结束后代表节点将接受的所有节点的 ID 及密钥信息传送给认证中 心， 认证中心记录此信息， 并以此来确认参与认证的所有节点的身份信息和 组内未参与密钥恢复节点的合法性。 本实施例可降低大量节点同时认证的资 源消耗， 并保持节点间的逻辑关联性。
实施例 3:
图 5为本发明实施例 3中的认证方法的流程图， 本实施例 3中的认证方 法与图 4所示实施例 2中的认证方法类似， 具体过程包括：
步骤 501 : UEj , UE2, ... ... , UE7根据协议（如最小生成树协议）构成结 构化逻辑层次， 如构成树形结构。 其中 UE7为树根， UE UEz, ... ... , UE7为同 一组群；
步骤 502: UEi, ... ... ,UE5将自己的 ID及子密钥 (Π^,Ι^), (ID2,K2), ... ...
(ID5,K5)利用树形结构传送给 UE7; 另外，组外的一节点 UE8将自己的 ID及子 密钥 (ID8,K8)传送给 UE7;
步骤 503 : UE7从接收的 6份子密钥， 加上自身存储的子密钥 K7选取其 中 4份， 根据门限机制中的恢复密钥算法， 计算得出组密钥 ΚΑ, 下面以 ΑΚΑ 算法为例， 对后续基于共享的组密钥 ΚΑ进行组认证的流程做详细描述， 其他 实施例中也可以基于组密钥 ΚΑ使用其它的认证算法进行组认证。
a ) 当组群 A与网络侧认证中心 HomeA进行鉴权时 , 由 UE7向 HomeA发 起组认证请求， 该认证请求中携带组群 A的组标识信息， 该组标识信息具体 可以是该代表节点的 ID信息。
b ) UE7记录收到的子密钥的成员 ID, 并标记恢复组密钥 KA时所使用的 节点 ID, 并将此信息在 AKA认证完成后发送至核心网侧进行在线用户注册。 步骤 504: HomeA收到来自认证代表节点的认证请求后， 根据组群信息， 如组认证请求中携带的组标识信息或代表节点 ID信息， 找到对应的组密钥 KA, 由于 UE7生成的组密钥是通过 UEi, ... ... ,UE5, UE7, UE8选取 4份生成， 则 UE7生成的组密钥有两种情况：
①生成组密钥时没有选取 UE8, 而是选取 UEi, ... ... ,UE5 ,UE7,中任意 4份 生成组密钥， 因此， 组密钥仍是正确的， HomeA计算会话密钥 CK/完整密钥 IK和认证向量， HomeA将认证向量作为反馈消息发送给 UE7, 执行步骤 505;
②生成组密钥时选取 UE8的子密钥， 因此， 组密钥与网络侧存储的不一 致， 此时 HomeA将认证向量作为反馈消息发送给 UE7, 执行步骤 505 , 但步 骤 505发送的认证响应必定错误， 因此会在步骤 506网络侧认证失败而结束； 步骤 505: UE7基于组密钥 KA和接收的认证向量中携带的信息， 对网络 侧进行认证， 并根据认证向量及组密钥算出对应的组认证响应， 并发送给 HomeA, 由 HomeA基于组密钥 KA和接收的认证响应中携带的信息对组群 A 进行认证， UE7还需要根据认证向量计算对应的 CK/IK。 为了保证安全， UE7 在完成计算后应立刻丟弃 KA;
UE7利用会话密钥 CK加密所收到的密钥信息的节点 ID, 并将此加密后 的节点 ID信息发送给 HomeA进行注册，所发送的节点信息用于网络侧对节点 的身份进行验证。
步骤 506: HomeA对组认证响应进行验证， 即基于组密钥 KA和接收的认 证响应中携带的信息对组群 A进行认证， 当验证失败时， 会发送验证失败消 息给 UE7,认证结束。如果组认证通过则对代表节点发送的节点信息进行在线 用户注册， 具体地， 根据节点信息及网络侧存储的节点的标识信息的内容进 行验证包括如下几种实现方式：
1. 如果节点信息只携带有节点 ID信息，则可以直接将节点 ID与 HomeA 存储的组内节点标识中的节点 ID进行比较， 判断节点信息中的节点 ID是否保存在组内节点标识中， 以此进行合法验证。 2. 如果节点信息中还携带有子密钥信息且均没有标记信息， 则可以将节 点信息的节点 ID 及子密钥与 HomeA存储的组内节点标识， 如 (ID1,K1),(ID2,K2), ... ... (ID7,K7)等进行比较， 以此进行合法验证。
3. 如果节点信息中除了节点 ID还携带有标记信息， 可以只验证没有标 记的节点信息， 如只验证节点 ID、 或者节点 ID及对应子密钥等等， 具体根据节点信息的内容进行上面第 1或第 2种方式相应的合法性验 证。
如本实施例即使步骤 504生成的组密钥正确组认证通过， 也在此合法验 证步骤中验证 UE8为非法用户， 从而注册完成其他用户， 并通知 UE7。
步骤 507: UE7将会话密钥 CK发送给 UEi, ... ... ,UE5。 UEb ... ... UE5,UE7 便可利用 CK将用户数据加密并传输。
通过上述实施例可看出， 保证了组认证的合法性， 对于不是本组内节点 的接入可釆用图 4由代表节点直接拒绝接入， 还可以如图 5在认证中心进行 后续验证接入节点的合法性， 并在认证完成后再次判断未参加组密钥恢复节 点的合法性，从而保证组认证的可靠性和准确性，避免其他非组内节点的 "假" 接入。
实施例 4:
图 6为本发明实施例 4中的认证装置的结构示意图， 该装置可以位于物 联网中一组群的代表节点内， 如图 3-图 5所示的代表节点 UE7, 如图 6所示， 本装置包括：
接口模块 61 , 用于接收至少一个终端节点的接入请求；
密钥生成模块 62, 用于从接收的接入请求中获取子密钥信息， 并根据获 取的子密钥信息生成组密钥；
组认证模块 63 , 用于根据组密钥与网络侧交互进行组认证。
该装置还可以包括存储模块 64, 用于保存组标识信息； 组认证模块， 还 用于根据接入请求及组标识信息生成携带组信息的组认证请求， 发送至网络 侧。 组认证模块 63 , 还可以在组认证通过时， 发送接入请求的节点信息至网 络侧。
组认证模块 63可以包括：
请求子单元 631 , 用于发送包含组信息或自身 ID信息的组认证请求， 此 时存储模块可以存储如下表二所示， 并接收网络侧对组认证请求的反馈消息 ( ^口认证向量 );
响应子单元 632,用于根据反馈消息及组密钥生成发送至网络侧的认证响 应， 如用于通过接口模块接收到网络侧对组认证请求的认证向量时， 根据组 密钥计算对应的组认证响应， 并发送至网络侧。 为保证安全性， 响应子单元 632还可以在计算完成组认证响应后删除组密钥。
其中， 密钥生成模块 62可以包括： 密钥恢复子模块 621 , 用于从接受的 接入请求携带的子密钥信息及自身存储的子密钥信息中选择不大于组内终端 节点总数目 n的 t个子密钥信息生成组密钥。
密钥生成模块 62还可以包括： 标记子模块 622, 用于对生成组密钥时选 择的密钥信息对应的节点进行标记， 并在发送至网络侧的节点信息中携带标 记信息； 节点信息包括： 节点 ID信息、 节点 ID信息和对应的标记信息。
该装置存储模块 64还可以保存组内节点的标识信息； 并进一步包括： 判 别模块 65, 用于根据组内节点的标识信息判断发送接入请求的节点为组外节 点时， 拒绝或删除接入请求， 具体的可参见下表二方式存储：
终端侧代表节点存储的组信息 组 组内节点标识 代表节 备注
点自身
信息
组 A标 ID1JD2, ... ... ID6 ID7,K7 组内节点标 识 识备选，组 A
标识和自身 信息必选
* .. * .. * .. 如果存储模块只存储有组标识信息， 则如图 5 方法实施例， 不直接拒绝 组外节点的接入请求； 如果存储模块如表二所示还存储有组内节点标识， 则 可如图 4所示， 直接根据节点 ID对接入请求进行判断， 以直接丟弃 /拒绝组外 节点的接入， 只接受本组内节点的接入请求进行组认证。
实施例 5:
图 7为本发明实施例 4中的认证中心的结构示意图。 该中心可以位于归 属位置寄存器 （Home Location Register , HLR )、 归属用户数据库 （Home Subscriber Server, HSS ), 如图 3-图 5所示的认证中心 HomeA, 如图 7所示， 包括：
存储模块 71 , 用于保存组信息（组标识）、 组密钥信息及组内各节点的标 识信息； 该模块还可以存储组信息对应的代表节点 ID, 如表一， 根据组认证 请求查找对应的组及组密钥；
组认证模块 72, 用于根据组密钥信息对终端侧进行组认证。
组认证模块 72可以包括：
接口子模块 721 , 用于接收终端侧的组认证请求，发送组认证请求的反馈 消息， 如认证向量， 并接收终端侧的组认证响应、 节点信息等；
认证子模块 722,用于根据组认证请求中携带的组信息查找对应的组密钥 信息， 生成组认证请求的认证向量反馈消息； 根据组密钥验证组认证响应， 如果存储模块 71存储有组内节点标识信息， 认证子模块 722可以进一步验证 节点信息的合法性， 如可以根据组密钥验证组认证响应， 根据节点的标识信 息验证节点信息的合法性， 根据存储模块节点的标识信息对未含有标记信息 的节点进行合法性验证。
具体认证交互过程可参见图 2-图 5所示的认证 HomeA, 认证子模块 722 可以包括：
查询子单元 7221 , 用于根据组认证请求中携带的组信息从存储模块查找 对应的组密钥信息； 计算子单元 7222, 用于根据组密钥计算反馈消息， 如组认证向量， 并发 送至终端侧；
验证子单元 7223 , 用于根据组密钥对终端侧的组认证响应进行验证， 根 据组内节点的标识信息验证节点信息的合法性， 具体可见图 4-图 5。
上述方法发明的各个实施例可以在具备图 6-图 7结构图所示结构的装置 中实现。
本领域普通技术人员可以理解： 实现上述方法实施例的全部或部分步骤 可以通过程序指令相关的硬件来完成， 前述的程序可以存储于一计算机可读 取存储介质中， 该程序在执行时， 执行包括上述方法实施例的步骤； 而前述 的存储介质包括： ROM、 RAM, 磁碟或者光盘等各种可以存储程序代码的介 最后应说明的是： 以上所述仅为本发明的优选实施例而已， 并不用于限 制本发明， 尽管参照前述实施例对本发明进行了详细的说明， 对于本领域的 技术人员来说， 其依然可以对前述各实施例所记载的技术方案进行修改， 或 者对其中部分技术特征进行等同替换。 凡在本发明的精神和原则之内， 所作 的任何修改、 等同替换、 改进等， 均应包含在本发明的保护范围之内。

Claims

权 利 要 求
1、 一种认证方法， 其特征在于， 包括：
接收至少一个接入请求， 从所述接入请求中获取子密钥信息；
根据获取的子密钥信息生成组密钥；
根据所述组密钥与网络侧交互进行组认证。
2、 根据权利要求 1所述的认证方法， 其特征在于， 进一步包括： 当所述组认证通过时， 发送所述接入请求的节点信息至网络侧。
3、根据权利要求 1所述的认证方法， 其特征在于， 所述生成组密钥包括： 从获取的所有子密钥信息和本地存储的子密钥信息中选择不大于组内节 点总数目 n的 t个子密钥信息生成组密钥。
4、 根据权利要求 3所述的认证方法， 其特征在于， 进一步包括： 对生成组密钥时选择的子密钥信息对应的节点进行标记；
当所述组认证通过时， 发送所述接入请求的节点信息至网络侧， 所述节 点信息中携带标记信息。
5、 根据权利要求 4所述的认证方法， 其特征在于， 发送所述接入请求的 节点信息至网络侧之后还包括：
所述网络侧根据预存的组及组内节点的标识信息对所述节点信息进行合 法性 3全证；
节点的标识信息包括节点的 ID、 或者节点的 ID及对应的子密钥信息； 所述节点信息包括节点的 ID及所述标记信息、 或者节点的 ID及对应的 子密钥信息和所述标记信息。
6、 根据权利要求 1所述的认证方法， 其特征在于， 接收至少一个接入请 求之后还包括：
根据预存的组标识信息生成携带组信息的组认证请求；
将所述携带组信息的组认证请求发送至网络侧；
根据所述组密钥与网络侧交互进行组认证包括： 接收网络侧对所述组认证请求的反馈消息；
根据所述反馈消息及所述组密钥生成发送至网络侧的组认证响应。
7、 根据权利要求 1所述的认证方法， 其特征在于， 接收至少一个终端节 点的接入请求之后进一步包括：
根据预存的组内节点的标识信息判断所述接入请求为组外节点发送时， 拒绝或删除所述接入请求。
8、 根据权利要求 1-7任一项所述的认证方法， 其特征在于， 接收至少一 个接入请求之前还包括：
发起所述接入请求的终端节点根据组内网络环境条件， 从预存的组内代 表节点信息中选取其中一代表节点发送所述接入请求。
9、 一种认证方法， 其特征在于， 包括：
网络侧存储组信息及对应的组密钥信息；
根据所述组密钥信息对终端侧进行组认证。
10、 如权利要求 9 所述的方法， 其特征在于， 根据所述组密钥信息对终 端侧进行组认证， 具体包括：
网络侧接收终端侧携带组信息的组认证请求；
根据所述组认证请求查找对应的组密钥信息， 生成反馈消息， 并将所述 反馈消息发送给终端侧；
接收终端侧的组认证响应 , 并根据所述组密钥验证所述组认证响应。
11、 如权利要求 9或 10所述的方法， 其特征在于， 在根据所述组密钥验 证所述组认证响应通过后， 还包括：
接收终端侧发送的节点信息；
根据预存的组及组内节点的标识信息对所述节点信息进行合法性验证； 节点的标识信息包括节点的 ID、 或者节点的 ID及对应的子密钥信息； 所述节点信息包括节点的 ID及标记信息、 或者节点的 ID及对应的子密 钥信息和所述标记信息， 所述标记信息为终端侧对生成组密钥时选择的子密 钥信息对应的节点进行标记得到的信息。
12、 一种认证装置， 其特征在于， 包括：
接口模块， 用于接收至少一个接入请求；
密钥生成模块， 用于从接收的接入请求中获取子密钥信息， 并根据获取 的子密钥信息生成组密钥；
组认证模块， 用于根据所述组密钥与网络侧交互进行组认证。
13、 根据权利要求 12所述的认证装置， 其特征在于， 所述组认证模块进 一步在组认证通过时， 发送所述接入请求的节点信息至网络侧。
14、 根据权利要求 12所述的认证装置， 其特征在于， 所述密钥生成模块 包括：
密钥恢复子模块， 用于从获取的所有子密钥信息及本地存储的子密钥信 息中选择不大于组内终端节点总数目 n的 t个子密钥信息生成组密钥。
15、 根据权利要求 14所述的认证装置， 其特征在于， 所述密钥生成模块 还包括：
标记子模块， 用于对生成组密钥时选择的密钥信息对应的节点进行标记， 并在所述组认证通过时发送至网络侧的节点信息中携带标记信息；
所述节点信息包括节点的 ID及所述标记信息、 或者节点的 ID及对应的 子密钥信息和所述标记信息。
16、 根据权利要求 12所述的认证装置， 其特征在于， 还包括：
存储模块， 用于存储组标识信息；
所述组认证模块， 还用于根据所述接入请求及所述组标识信息生成携带 组信息的组认证请求， 发送至网络侧， 所述组认证模块包括：
请求子单元， 用于生成所述组认证请求， 并接收网络侧对所述组认证请 求的反馈消息；
响应子单元， 用于根据所述反馈消息及所述组密钥生成发送至网络侧的 组认证响应。
17、根据权利要求 12-16任一项所述的认证装置， 其特征在于， 所述存储 模块还存储组内节点的标识信息， 所述装置进一步包括： 判别模块， 用于根据所述组内节点的标识信息判断发送所述接入请求的 节点为组外节点时， 拒绝或删除所述接入请求。
18、 一种认证中心， 其特征在于， 包括：
存储模块， 用于存储组信息及对应的组密钥信息；
组认证模块， 用于根据所述组密钥信息对终端侧进行组认证。
19、 根据权利要求 18所述的认证中心， 其特征在于， 所述认证中心位于 归属位置寄存器 HLR、 归属用户数据库 HSS。
20、 根据权利要求 18或 19所述的认证中心， 其特征在于， 所述组认证 模块包括：
接口子模块， 用于接收终端侧携带组信息的组认证请求， 发送对应的反 馈消息 , 接收终端侧的组认证响应；
认证子模块， 用于根据所述组认证请求查找对应的组密钥信息， 生成所 述反馈消息； 根据所述组密钥验证所述组认证响应。
21、 根据权利要求 20所述的认证中心， 其特征在于， 所述存储模块还存 储组信息对应的组内节点的标识信息；
所述接口子模块， 还用于接收终端侧发送的节点信息；
所述认证子模块包括：
查询子单元， 用于根据所述组认证请求中携带的组信息从所述存储模块 查找对应的组密钥信息；
计算子单元， 用于根据所述组密钥信息计算所述组认证请求的反馈消息； 验证子单元， 用于根据所述组密钥验证终端侧的所述组认证响应； 根据 组内节点的标识信息验证所述节点信息的合法性；
节点的标识信息包括节点的 ID、 或者节点的 ID及对应的子密钥信息； 所述节点信息包括节点的 ID、或者节点的 ID及对应的子密钥信息、或者 节点的 ID及标记信息、或者节点的 ID及对应的子密钥信息和所述标记信息， 所述标记信息为终端侧对生成组密钥时选择的子密钥信息对应的节点进行标 记得到的信息。
22、 一种认证系统， 其特征在于， 包括：
终端节点， 用于发送携带子密钥信息的接入请求；
代表节点， 用于接收至少一个终端节点的接入请求， 获取子密钥信息； 并根据子密钥信息生成组密钥； 根据所述组密钥与网络侧进行组认证；
认证中心， 用于存储组信息及对应的组密钥信息， 并根据组密钥信息对 代表节点进行组认证。
23、根据权利要求 22所述的认证系统， 其特征在于， 所述终端节点包括： 存储模块， 用于存储子密钥信息及归属的至少一个代表节点信息； 请求模块， 用于从代表节点信息中选取其中一代表节点发送所述接入请 求。
PCT/CN2011/073352 2010-04-27 2011-04-27 认证方法、装置、认证中心及系统 WO2011134395A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP11774386.4A EP2566204B1 (en) 2010-04-27 2011-04-27 Authentication method and device, authentication centre and system
US13/643,958 US9137226B2 (en) 2010-04-27 2011-04-27 Authentication method and authentication device for performing group authentication using a group key

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010161805.6A CN102238146B (zh) 2010-04-27 2010-04-27 认证方法、装置、认证中心及系统
CN201010161805.6 2010-04-27

Publications (1)

Publication Number Publication Date
WO2011134395A1 true WO2011134395A1 (zh) 2011-11-03

Family

ID=44860873

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/073352 WO2011134395A1 (zh) 2010-04-27 2011-04-27 认证方法、装置、认证中心及系统

Country Status (4)

Country Link
US (1) US9137226B2 (zh)
EP (1) EP2566204B1 (zh)
CN (1) CN102238146B (zh)
WO (1) WO2011134395A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112218294A (zh) * 2020-09-08 2021-01-12 深圳市燃气集团股份有限公司 基于5g的物联网设备的接入方法、系统及存储介质
CN114079566A (zh) * 2020-08-05 2022-02-22 阿里巴巴集团控股有限公司 物联网设备认证方法、设备及存储介质

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9967149B1 (en) * 2011-05-26 2018-05-08 Electric Imp Incorporated Modularized control system to enable IoT wireless network control and sensing of other devices
CN103249043B (zh) * 2012-02-14 2017-04-12 上海贝尔股份有限公司 传感器节点设备认证和状态认证的方法以及安全协议方法
CN103781026B (zh) * 2012-10-19 2017-05-31 中国移动通信集团公司 通用认证机制的认证方法
CN103647762B (zh) * 2013-11-27 2016-08-17 清华大学 基于访问路径的IPv6物联网节点身份认证方法
KR102267798B1 (ko) * 2014-03-25 2021-06-23 삼성전자주식회사 사용자 단말을 통한 로그인 지원 방법 및 그 장치
US20150382190A1 (en) * 2014-06-25 2015-12-31 Qualcomm Incorporated Enhanced secure identity generation
CN104104745B (zh) * 2014-07-14 2017-10-13 国家电网公司 一种电网终端安全准入方法
KR102209752B1 (ko) * 2014-07-16 2021-01-29 삼성전자주식회사 사물 통신 시스템의 스케줄링 장치 및 방법
CN107251478A (zh) * 2015-02-12 2017-10-13 卡米纳利欧技术有限公司 秘密密钥管理的计算机化系统和方法
US9860221B2 (en) * 2015-03-10 2018-01-02 Intel Corporation Internet of things group formation using a key-based join protocol
US9693178B2 (en) * 2015-03-18 2017-06-27 Intel IP Corporation Procedures to provision and attach a cellular internet of things device to a cloud service provider
CN105187376B (zh) * 2015-06-16 2018-04-17 西安电子科技大学 车联网中汽车内部网络的安全通信方法
US11017375B2 (en) 2015-07-30 2021-05-25 Mastercard International Incorporated Systems and methods for using an internet of things device presence to authenticate a cardholder for a financial transaction
KR102446384B1 (ko) 2015-09-18 2022-09-22 삼성전자주식회사 사용자 단말 및 서버 장치
CN106612205B (zh) * 2015-10-27 2019-12-06 中国移动通信集团公司 一种节点认证方法、系统及代理节点
CN105245547B (zh) * 2015-10-29 2018-08-21 青海金联讯电子科技有限公司 一种基于网关的设备认证方法
CN105610872B (zh) * 2016-03-16 2018-09-07 中国联合网络通信集团有限公司 物联网终端加密方法和物联网终端加密装置
EP3252990A1 (de) * 2016-06-03 2017-12-06 Siemens Aktiengesellschaft Verfahren und vorrichtung zum bereitstellen eines geheimnisses zum authentisieren eines systems und/oder komponenten des systems
WO2018004637A1 (en) 2016-07-01 2018-01-04 Intel Corporation Group management in reconfigurable machine-to-machine systems
US10185550B2 (en) 2016-09-28 2019-01-22 Mcafee, Inc. Device-driven auto-recovery using multiple recovery sources
US10887295B2 (en) * 2016-10-26 2021-01-05 Futurewei Technologies, Inc. System and method for massive IoT group authentication
CN110050474A (zh) 2016-12-30 2019-07-23 英特尔公司 用于物联网网络中的复合对象的子对象的类型命名和区块链
US10382450B2 (en) 2017-02-21 2019-08-13 Sanctum Solutions Inc. Network data obfuscation
CN106937280A (zh) * 2017-04-05 2017-07-07 广东浪潮大数据研究有限公司 传感器节点及传感器节点接入移动通信网络的认证方法
EP3631728A1 (en) 2017-05-22 2020-04-08 Nchain Holdings Limited Trustless deterministic state machine
GB201710176D0 (en) 2017-06-26 2017-08-09 Nchain Holdings Ltd Computer-implemented system and method
US10846392B2 (en) 2017-07-24 2020-11-24 Digicert, Inc. Remote processing of credential requests
GB201715423D0 (en) * 2017-09-22 2017-11-08 Nchain Holdings Ltd Computer-implemented system and method
CN109756451B (zh) 2017-11-03 2022-04-22 华为技术有限公司 一种信息交互方法及装置
US10136320B1 (en) * 2017-11-22 2018-11-20 International Business Machines Corporation Authentication of users at multiple terminals
CN111886884B (zh) * 2018-03-09 2023-03-24 上海诺基亚贝尔股份有限公司 用于通信中的认证的方法、设备和计算机可读介质
US10944557B2 (en) * 2018-04-25 2021-03-09 Nxp B.V. Secure activation of functionality in a data processing system
US11196731B2 (en) * 2019-06-28 2021-12-07 T-Mobile Usa, Inc. Network-authentication control
CN110839068B (zh) * 2019-11-04 2022-02-18 安超云软件有限公司 业务请求处理方法、装置、电子设备及可读存储介质
CN113497812A (zh) * 2020-03-18 2021-10-12 瑞昱半导体股份有限公司 物联网网络组网认证系统及其方法
CN114430328A (zh) * 2020-10-14 2022-05-03 中国移动通信有限公司研究院 密钥协商方法、装置、设备及存储介质
US11973765B2 (en) 2021-05-07 2024-04-30 Cisco Technology, Inc. Group access control

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1801696A (zh) * 2006-01-13 2006-07-12 南京邮电大学 一种网格计算机环境下虚拟组织的密钥管理方案
US7194628B1 (en) * 2002-10-28 2007-03-20 Mobile-Mind, Inc. Methods and systems for group authentication using the naccache-stern cryptosystem in accordance with a prescribed rule

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4581246B2 (ja) * 2000-12-26 2010-11-17 ソニー株式会社 情報処理システム、および情報処理方法、並びにプログラム記録媒体
US7930756B1 (en) * 2001-12-12 2011-04-19 Crocker Steven Toye Multi-level cryptographic transformations for securing digital assets
US20030235309A1 (en) * 2002-03-08 2003-12-25 Marinus Struik Local area network
DE102004049026B4 (de) * 2004-10-05 2007-06-21 Nec Europe Ltd. Verfahren zur Authentifizierung von Elementen einer Gruppe
US8386782B2 (en) * 2006-02-02 2013-02-26 Nokia Corporation Authenticated group key agreement in groups such as ad-hoc scenarios
KR100831327B1 (ko) * 2006-09-28 2008-05-22 삼성전자주식회사 무선 메쉬 네트워크의 인증 처리 방법 및 그 장치
US8060741B2 (en) * 2006-12-29 2011-11-15 Industrial Technology Research Institute System and method for wireless mobile network authentication
GB2451505A (en) * 2007-08-01 2009-02-04 Iti Scotland Ltd Key distribution in a network using key shares in a secret sharing scheme
US8397062B2 (en) * 2009-04-21 2013-03-12 University Of Maryland, College Park Method and system for source authentication in group communications

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7194628B1 (en) * 2002-10-28 2007-03-20 Mobile-Mind, Inc. Methods and systems for group authentication using the naccache-stern cryptosystem in accordance with a prescribed rule
CN1801696A (zh) * 2006-01-13 2006-07-12 南京邮电大学 一种网格计算机环境下虚拟组织的密钥管理方案

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
CHINA MOBILE.: "M2M Group Authentication", 3GPP, 16 April 2010 (2010-04-16), XP050436720, Retrieved from the Internet <URL:URL:HTTP://3gpp.org/ftp/tsg_sa/WG3_Security/TSGS3_59_Lisbon/Docs/S3-100466.zip> *
See also references of EP2566204A4 *
ZHAO ZHIPING ET AL.: "Cluster-based Group Key Management Scheme for Sensor Networks.", COMPUTER ENGINEERING., vol. 34, no. 5, 15 March 2008 (2008-03-15), pages 153 - 154, XP008159451 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114079566A (zh) * 2020-08-05 2022-02-22 阿里巴巴集团控股有限公司 物联网设备认证方法、设备及存储介质
CN112218294A (zh) * 2020-09-08 2021-01-12 深圳市燃气集团股份有限公司 基于5g的物联网设备的接入方法、系统及存储介质
CN112218294B (zh) * 2020-09-08 2021-08-27 深圳市燃气集团股份有限公司 基于5g的物联网设备的接入方法、系统及存储介质

Also Published As

Publication number Publication date
EP2566204B1 (en) 2021-01-13
US20130046983A1 (en) 2013-02-21
CN102238146A (zh) 2011-11-09
EP2566204A1 (en) 2013-03-06
EP2566204A4 (en) 2017-07-12
US9137226B2 (en) 2015-09-15
CN102238146B (zh) 2014-10-08

Similar Documents

Publication Publication Date Title
WO2011134395A1 (zh) 认证方法、装置、认证中心及系统
US11228442B2 (en) Authentication method, authentication apparatus, and authentication system
US11496320B2 (en) Registration method and apparatus based on service-based architecture
US20230007475A1 (en) Method for Performing Verification by Using Shared Key, Method for Performing Verification by Using Public Key and Private Key, and Apparatus
CN106664561B (zh) 用于确保预关联服务发现安全的系统和方法
US8978100B2 (en) Policy-based authentication
US8413221B2 (en) Methods and apparatus for delegated authentication
CN101631113B (zh) 一种有线局域网的安全访问控制方法及其系统
JP2020508017A (ja) サーバ及びユーザ装置間の通信を管理する方法
CN108028829A (zh) 用于获得对网络的初始接入的方法以及相关的无线设备和网络节点
JP2008547304A (ja) 無線携帯インターネットシステム用の認証キー識別子の割り当て方法
CN104956638A (zh) 用于在热点网络中未知设备的受限证书注册
WO2009062415A1 (en) An authentication method for request message and the apparatus thereof
US10979903B2 (en) Key generation and distribution method based on identity-based cryptography
CN115004742A (zh) 在通信网络中用于与服务应用的加密通信的锚密钥生成和管理的方法、设备和系统
CN113572765A (zh) 一种面向资源受限终端的轻量级身份认证密钥协商方法
US9143482B1 (en) Tokenized authentication across wireless communication networks
CN113569210A (zh) 分布式身份认证方法、设备访问方法及装置
WO2007147354A1 (fr) Procédé et système pour extraire une clé de messagerie instantanée
JP5375605B2 (ja) 認証システムおよび認証方法
JP5275468B2 (ja) サービスアクセスの制限を可能にする方法
KR20210126319A (ko) 키 관리 장치 및 방법
CN108183925B (zh) 基于IoT的窄带通信方法
CN114422106B (zh) 一种多服务器环境下的物联网系统安全认证方法及系统
US11223954B2 (en) Network authentication method, device, and system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11774386

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 13643958

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2011774386

Country of ref document: EP