WO2012151933A1

WO2012151933A1 - Owned service authentication method and system

Info

Publication number: WO2012151933A1
Application number: PCT/CN2011/082573
Authority: WO
Inventors: 梁国和
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-07-27
Filing date: 2011-11-21
Publication date: 2012-11-15
Also published as: CN102905258B; CN102905258A

Abstract

Disclosed are an owned service authentication method and system. The method includes: user equipment initiating a service access request toward an owned service server of a second network via a first network; and a service authentication server of the second network directly performing service authentication on the user equipment. The technical solution provided by the present invention solves the problem that the existing owned service authentication requires the user to perform a large amount of additional operations, thereby realizing the effects of avoiding repeated authentication and improving user experience.

Description

TECHNICAL FIELD The present invention relates to the field of communications, and in particular to a method and system for accessing a self-owned service. BACKGROUND OF THE INVENTION In a wireless communication system, in addition to a cellular communication system, such as GSM (Global System for Mobile)

Communication, global communication mobile systems, UMTS (Universal Mobile Telecommunications System) and LTE (long term evolution), as well as WLAN (Wireless Local). WLAN networks are mobile, easy to install, highly flexible, and scalable, and can be deployed in areas with limited coverage, such as independent stores, shopping centers, trains, bus stations, office buildings, hotels, and more. Operators can deploy WLAN hotspots as an extension of traditional wired networks, and can also use WLAN networks as an important offloading network for cellular communication systems. In addition to basic telecommunications services, cellular communication systems offer more and more packet-based domain-based services such as multimedia services, location services, gaming and Internet services. Users can enjoy the services provided by the cellular communication system through the WLAN network. Unlike ordinary Internet services, these value-added services generally have to pay a certain fee, so reliable security mechanisms are needed to ensure business security and accurate billing; and basic smart card authentication cannot provide security mechanisms for these services.

WLAN network security control is mainly reflected in access control and data encryption. However, the corresponding business certification is not specified. Many services require authentication between the user and the business server before communication. In the prior art, the user identity of the self-owned service is generally further verified by the user's own participation, so as to ensure that the user uses the service, such as using the user name + basic password + anti-theft password. This approach requires the user to perform an extra large number of operations, which undoubtedly increases the workload. At the same time, the user who has passed the access authentication needs to perform the service authentication again by the user to access the requested service, so that the repeated authentication not only affects the user experience, but also does not guarantee that the account information is not cracked, thereby the account information of the user. Security poses a threat. In response to these problems, no effective solution has been proposed yet. SUMMARY OF THE INVENTION The present invention provides a self-owned service authentication method and system to solve at least one of the above problems. According to an aspect of the present invention, a service authentication method is provided, including: a user terminal initiates a service access request to a self-service server of a second network through a first network; and a service authentication server of the second network directly performs a service to the user terminal Certification. Before the user terminal initiates a service access request to the second network's own service server by using the first network, the method further includes: the user terminal completing the access authentication of the first network by using the access authentication server of the first network; The network completes the access authentication of the second network via the access authentication server of the second network. The service authentication server of the second network directly performs service authentication on the user terminal, including: after receiving the service access request, the service server submits a service authentication application to the service authentication server of the second network; the service authentication server obtains the user information of the user terminal, Establishing a secure channel directly with the user terminal, establishing a security association between the user terminal and the own service server; the service authentication server performs security negotiation with the user terminal according to the information input by the user received by the user terminal through the secure channel; As a result, the service is authenticated, security information is generated and distributed to the user terminal and its own service server. Before the service authentication server performs security negotiation with the user terminal according to the information input by the user terminal through the secure channel, the method further includes: when the user terminal opens the service provided by the own service server, the authentication level is selected. After the service authentication server obtains the user information of the user terminal, directly establishes a secure channel with the user terminal, and establishes a security association between the user terminal and the own service server, the method further includes: the user terminal selects or modifies the authentication level according to the operation of the user. . The certification level includes at least one of the following: no authentication, automatic authentication, user terminal confirmation authentication, digital signature authentication. According to another aspect of the present invention, a free service authentication system is provided, including: a user terminal, a first network, and a second network, where the user terminal includes: a client, where the second network includes: a service authentication server, and a self-owned The service server, where the client includes: a request initiation module, configured to initiate a service access request to the own service server of the second network through the first network; the service authentication server includes: a service authentication module, configured to directly perform service on the user terminal Certification. The first network includes: a first access authentication server, configured to complete access authentication of the first network of the user terminal. The second network further includes: a second access authentication server, configured to complete access authentication of the second network of the user terminal by using the first network. The self-owned service server includes: an application submission module, configured to submit a service authentication application to the service authentication server after receiving the service access request of the user terminal. The service authentication server further includes: a channel establishment module, configured to acquire user information of the user terminal, directly establish a secure channel with the user terminal, establish a security association between the user terminal and the own service server; and the security negotiation module is set to pass security The channel performs security negotiation with the user terminal according to the information input by the user terminal, and the service authentication module is further configured to perform service authentication according to the result of the security negotiation, generate security information, and distribute the security information to the user terminal and the own service server. The client further includes: an input prompting module, configured to display a prompt message to the user, and request the user to input information. The smart card includes at least one of the following: a level selection module, configured to perform an authentication level selection when opening a self-owned service provided by the own service server; and a level modification module configured to set the authentication level according to the user operation after the security channel is established. Make a selection or modify. According to the present invention, when the user terminal initiates a service access request to the own service server of the second network through the first network, the service authentication server of the second network directly authenticates the user terminal that initiates the request, and solves the existing solution. The self-owned service authentication requires the user to perform an additional large number of operations, thereby achieving the effect of avoiding repeated authentication and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, 1 is a flowchart of a method for authenticating a self-owned service according to an embodiment of the present invention; FIG. 2 is a schematic diagram of a functional structure required for an own service authentication method according to an example of the present invention; FIG. 3 is an example according to the present invention. FIG. 4 is a structural block diagram of a self-owned service authentication system according to an embodiment of the present invention; FIG. 5 is a structural diagram of a self-owned service authentication system according to an embodiment of the present invention; FIG. 6 is a schematic flowchart of performing service authentication by an own service authentication system according to an example of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. 1 is a flow chart of a method for authenticating a self service according to an embodiment of the present invention. As shown in FIG. 1, the method for authenticating a self-owned service according to an embodiment of the present invention includes: Step S102: A user terminal initiates a service access request to an own service server of a second network by using a first network; Step S104, a service of the second network The authentication server directly performs service authentication on the user terminal. In this embodiment, in order to prevent the user from repeating the authentication to improve the user experience, the method of performing service authentication on the user terminal directly by the second network is adopted, although the user is the self-service server of the second network through the first network. The service request initiated by the service, but in terms of service authentication, the service authentication server of the second network directly authenticates the user terminal, thereby avoiding repeated input of the user authentication information and reducing unnecessary operations of the user. At the same time, the security of user authentication information is improved and the user experience is improved. The premise of the step S102 is: First, the user terminal establishes a connection with the first network; secondly, the user establishes a connection with the second network through the first network. In a specific implementation process, the relationship between the user terminal, the first network, and the second network is diverse, and the user terminal may establish a connection with the first network, and establish a connection with the second network through the first network, and the user terminal and The first network establishes a connection and establishes a connection with the second network through the first network, or the user terminal does not establish a connection with the first network or the second network. In the preferred embodiment, a third embodiment is taken as an example to give a preferred embodiment, and other cases can be analogized. Preferably, the following processing may also be included before step S102:

(1) the user terminal completes access authentication of the first network via the access authentication server of the first network;

(2) The user terminal completes the access authentication of the second network through the access authentication server of the second network through the first network. Through the above processing, it can be ensured that the user terminal establishes a connection with the first network and establishes a connection with the second network through the first network, providing a basis for execution for subsequent processing. In the step S104, the service authentication server of the second network directly performs service authentication on the user terminal. The preferred embodiment provides a preferred implementation manner. Preferably, step S104 may further include the following processing: (1) After receiving the service access request, the own service server submits a service authentication application to the service authentication server of the second network;

(2) The service authentication server obtains the user information of the user terminal, establishes a secure channel directly with the user terminal, and establishes a security association between the user terminal and the own service server; (3) the service authentication server receives the security channel according to the user terminal. User-entered information and security negotiation with the user terminal;

(4) Perform service authentication according to the result of security negotiation, generate security information and distribute it to the user terminal and its own service server. In the preferred embodiment, after receiving the service access request, the self-owned service server submits a service authentication application to the service authentication server, requesting the service authentication server to perform service verification on the user terminal that initiates the service access request; To obtain the user information of the user terminal, and then use the original connection that can be established with the user terminal to switch to a service authentication connection or create a new connection dedicated to service authentication to establish a secure channel, and establish a secure connection with the user terminal, so that the user The terminal establishes a security association with its own service server. After the security channel is established, the service can be authenticated on the basis of the secure channel. First, security negotiation is performed with the user terminal according to the authentication information input by the user, and then the service is performed according to the result of the negotiation. After the authentication succeeds, the corresponding security information is generated, such as the key and the certificate. The security information generated after the authentication succeeds is the basis for the end user terminal to access the self-owned service provided by the own service server. The ultimate purpose of the authentication is to end the authentication. use The user terminal can access the self-owned service provided by the own service server according to the security information. Preferably, in the foregoing preferred embodiment, the service authentication server may further include the following processing before the security negotiation with the user terminal according to the information input by the user received by the user terminal through the secure channel: the user terminal displays the prompt information to the user, requesting The user enters information. The above processing further facilitates the use of the user and improves the user experience. Preferably, before the step S102, the method further includes the following process: the user terminal performs the authentication level selection when the service provided by the own service server is activated. In the preferred embodiment, the concept of an authentication level is proposed, that is, different authentication methods are adopted for different services to improve the efficiency of authentication. The authentication level can be determined according to the specificity of the service when the user opens the service. In order to further facilitate the user's use, in addition to the authentication level selection when the service is opened, the opportunity to select and modify the authentication level can be given once again. Preferably, the service authentication server acquires user information of the user terminal, After the security channel is directly established with the user terminal, and the security association between the user terminal and the own service server is established, the following processing may be further included: The user terminal selects or modifies the authentication level according to the operation of the user. The above processing further increases the flexibility of the user and improves the user experience. Preferably, the foregoing authentication level may include at least one of the following: no authentication, automatic authentication, user terminal confirmation authentication, digital signature authentication. The preferred embodiment provides a preferred authentication level dividing method. In a specific implementation process, the following authentication levels may be set: no authentication, automatic authentication, user terminal confirmation authentication, and digital signature authentication. In the case of free services, no authentication is performed; in the monthly subscription service, automatic authentication without user terminal intervention is performed; in the case of the secondary fee, the user terminal confirms the authentication; and in the case of the user terminal support, the digital signature and other non-repudiation authentication can be simultaneously performed. . The authentication level division method is not unique and can be divided according to different needs. The above preferred embodiments will be described in detail below with reference to examples. This example provides a service authentication method for a user terminal to access a second network's own service through the first network, and includes the following steps: Step 1: The user terminal completes the access authentication server in the second network and the second network. Access authentication. Generally, the access authentication ensures that the network accessed by the user terminal is a legal network, and at the same time, the free and legal user terminal can access the network. The user terminal that has passed the access authentication can access the Internet through the first network and directly access the Internet service. Step 2: When the user terminal accesses the own service server of the second network via the first network, the user terminal establishes a secure channel with the service authentication server through the second network (not through the first network), and establishes security with the own service server. Association. And perform service authentication based on the secure channel. Step 3: After the service authentication succeeds, the key or certificate is distributed, and the key or certificate is sent to the user terminal and the own service server. Step 4: Authorize the user terminal to access the own service of the second network via the first network. On the basis of the above example, the authentication level function is added in the example, that is, the service authentication is hierarchically managed through the cooperation of the user terminal, and the interface is provided for the user, so that the user can perform the authentication level selection, so that the service authentication can be performed securely and flexibly. . The function of providing the authentication level in this example is described as follows: According to the provision of own business security requirements, subscription information, user terminal selection, etc., the authentication hierarchical management is performed. The authentication level can be divided into non-authentication, automatic authentication, and user terminal. Certification, and digital signatures supported by the terminal. The authentication level can correspond to different services and authentication methods. For example, in the case of free service, no authentication is performed; in the monthly service, automatic authentication without user terminal intervention is performed; in the case of the secondary fee, the user terminal is confirmed and authenticated; in the case of user terminal support, digital signature can be simultaneously performed. Responsible for certification. The user terminal can perform authentication level selection after the self-owned service is activated or after establishing a secure channel. The user terminal provides the user interface to provide the authentication level selection. In the service authentication process (requires user participation), the user can actively establish a secure channel, establish a security association with the own service server, and perform authentication level selection or change. Service authentication can be implemented on the client (user terminal including the client, smart card, etc.) or on the smart card (part of the user terminal). In the smart card to achieve business authentication, confidentiality and negotiation and other related security calculation processes are implemented on the smart card, the security is higher, and it is easy for the operator to master, and the terminal requirements are lower. It is preferred to implement service authentication on the smart card. The self-owned service authentication method with the added authentication level function includes the following steps: Step 1: The user terminal accesses the own service server, and the own service server submits the authentication application to the service authentication server. Step 2: The service authentication server determines the service authentication level. The authentication level can be divided into non-authentication, automatic authentication, user terminal confirmation authentication, and digital signature with terminal support. Step 3. Establish a secure channel. Establish a secure channel between the user terminal and the service authentication server, and establish a security association with the own service server. The secure channel can be based on data short message or BIP (Bearer Independent Protocol). Step 4 provides user selection and security negotiation. After the security association is established, the authentication level can be selected through the user terminal. The user terminal can provide a user interface, prompt user information, request user input or provide authentication level selection. It can be provided by smart card based STK (SIM Tool Kit) / SCWS (Smart Card Web Server) and client mode. Step 5: Perform service authentication according to negotiation. In the case of free services, no authentication is performed; in the monthly subscription service, automatic authentication without user terminal intervention is adopted, and AKA (Authentication and Key Agreement) is adopted. Key negotiation method; In the case of pay-per-view, the user terminal confirms the authentication, and uses the EAP (Extensible Authentication Protocol) - SIM (Subscriber Identity Module) / AKA mode; In the case of non-repudiation certification such as digital signature, digital certificate can be used. Step 6. The service authentication succeeds in distributing the corresponding key or certificate. Step 7: Authorize the user terminal to access the service provided by the own service server. 2 is a schematic diagram showing the functional structure required for a self-owned service authentication method according to an example of the present invention. In order to more clearly explain the authentication process of its own business, Figure 2 modularizes the functions required for its own business authentication and points out the execution subject corresponding to the function. In this example, the WLAN network is the first network, and the cellular communication system is the second network, that is, the user terminal accesses the streaming media service of the cellular communication system through the WLAN network. In this example, the service authentication can be implemented on the client or on the smart card. In the smart card to achieve business authentication, confidentiality and negotiation and other related security calculation processes are implemented on the smart card, the security is higher, and it is easy for the operator to master, and the terminal requirements are lower. It is preferred to implement service authentication on the smart card. As shown in FIG. 3, the entire process includes: Step S302: A client accesses a streaming media server corresponding to a self-owned service of a cellular communication system. Step S304, the streaming media server submits a service authentication application to the service authentication server. Step S306, the hierarchical authentication management in the service authentication server determines the authentication level according to the submitted application, the related user information, the contract information, and the like. It is assumed that the streaming media service is a pay-per-view fee, and the authentication level is that the user terminal confirms the authentication, and the user terminal is required to participate. Establish a secure channel between the smart card and the service authentication server, and securely associate with the streaming server. Each of the smart card and the service authentication server has a secure channel management responsible for establishing a secure channel. The two-way identity authentication is completed based on the smart card. If one party is not legal, the interaction is interrupted; if the identification process is passed, a series of keys are generated to establish a secure channel. The bearer adopts the BIP mode. When the smart card needs to communicate with the streaming media server through TCP/IP, the streaming media server is marked by an IP address. When the BIP channel is opened, the user terminal acts as a gateway and communicates with the streaming server using TCP/IP, see ETSI (European Telecommunications Standards Institute) TS 102 127. Step S308, after establishing a security association, performing user selection and security negotiation. The amount of consumption of the streaming media service is prompted by the STK technology of the smart card for the user to confirm. The user terminal confirms the current streaming service. And the confirmation of the transaction information is sent to the network through a secure channel. This example supports the selection of the authentication level after the user terminal is securely associated with the streaming media service server. If the user thinks that each time the user confirms the trouble, the local user selects the option STK menu of the authentication level, and selects the automatic authentication mode as the authentication mode of the streaming media service. The user selects the authentication mode to the network-side security application management through the secure channel, and the security application management stores the corresponding user selection information, and the subsequent streaming media service selects the authentication level according to the user. In addition, the user terminal can also actively establish a secure channel for authentication level selection or change. Step S310, authentication and key management. Each of the smart card and the service authentication server has a service authentication management module for authentication and key management. The implementation supports multiple authentication modes and key management. The service authentication includes at least two authentication mechanisms and allows the user to negotiate. One is based on shared secrets between entities, and the other is based on key pairs. The service authentication server completes the corresponding key management. This includes setting the local validity of the key according to the local policy; detecting the life cycle of the key and taking measures with the user terminal to ensure the key is refreshed. Step S312, after the authentication is successful, the key or certificate is distributed. Distribute the key or certificate to the client or its own business server. The client can operate on a mobile terminal or a PC terminal. The client needs to establish a secure local access interface with the smart card to ensure data validity. The streaming media server has a communication interface with the service authentication server, and can obtain a security key and security settings between the client and the service authentication server. Step S314, the authorized client accesses the streaming media service of the cellular communication system. 4 is a structural block diagram of a self-owned service authentication system according to an embodiment of the present invention. As shown in FIG. 4, the self-owned service authentication system according to the embodiment of the present invention includes: a user terminal 42, a first network 44, and a second network 46. The user terminal 42 includes: a client 422, and the second network 46 includes: The service authentication server 462, the self-service server 464, wherein the client 422 includes: a request initiation module 4222, configured to initiate a service access request to the own service server 464 of the second network 46 through the first network 44; the service authentication server 462 The method includes: a service authentication module 4622, configured to directly perform service authentication on the user terminal 42. In the self-owned service authentication system according to the embodiment of the present invention, in order to prevent the user from repeating the authentication to improve the user experience, the manner in which the user authentication is directly performed on the user terminal 42 by the second network 46 is adopted, although the user terminal 42 is adopted. The first network 44 sends a service request to the own service server 464 of the second network 46, but in terms of service authentication, the service authentication server 462 of the second network 46 directly terminates the user. The authentication performed by the terminal 42 avoids repeated input of the user authentication information, reduces unnecessary operations of the user, improves the security of the user authentication information, and improves the user experience. Preferably, the first network 44 may include: a first access authentication server, configured to complete access authentication of the first network of the user terminal 42; the second network 46 may further include: a second access authentication server, configured to pass The first network completes access authentication of the second network of the user terminal. The first access authentication server and the second access authentication server ensure that the user terminal 42 establishes a connection with the first network 44 and establishes a connection with the second network 46 via the first network 44, providing a basis for execution for subsequent processing. Preferably, the self-owned service server 462 may include: an application submission module, configured to submit a service authentication request to the service authentication server 462 after receiving the service access request of the user terminal 42; the service authentication server 462 may further include: a channel establishment module And setting the user information of the user terminal 42 to establish a secure channel directly with the user terminal 42 to establish a security association between the user terminal 42 and the own service server 464. The security negotiation module is configured to pass through the secure channel according to the user terminal 42. The received information input by the user is in security negotiation with the user terminal 42. The service authentication module 4622 is further configured to perform service authentication according to the result of the security negotiation, generate security information, and distribute the security information to the user terminal 42 and the own service server 464. In the preferred embodiment, after receiving the service access request, the self-owned service server 464 submits a service authentication application to the service authentication server 462, requesting the service authentication server 462 to perform service verification on the user terminal 42 that initiates the service access request; The service authentication server 462 first acquires the user information of the user terminal 42 and then uses the original connection that can be established with the user terminal to be used as a service authentication connection or a new connection dedicated to service authentication to construct a secure channel, and the user terminal. 42. Establish a secure connection, and establish a security association between the user terminal 42 and the own service server 464. After the secure channel is established, the service authentication can be performed on the basis of the secure channel, firstly, according to the authentication information input by the user and the user terminal 42. Security negotiation, and then performing service authentication according to the result of the negotiation. After the authentication succeeds, corresponding security information, such as a key and a certificate, is generated. The security information generated after the authentication succeeds is that the end user terminal 42 can access the self-owned service server 464. Have a business foundation, certification The final purpose is to make the end user terminal 42 can access its own service server 464 of its own service provided by the security information. Preferably, the client 422 may further include: an input prompting module, configured to display prompt information to the user, and request the user to input information. The function of the input prompt module facilitates the user's use and improves the user experience. Preferably, the user terminal 42 may further include a smart card, and the smart card may include at least one of the following: a level selection module configured to perform an authentication level selection when the self-owned service provided by the own service server 464 is opened. The level modification module is set to select or modify the authentication level according to the user's operation after the secure channel is established. In the preferred embodiment, the level selection module and the level modification module provide an authentication level function, that is, adopt different authentication methods for different services to improve the efficiency of authentication. The authentication level can be determined by the level selection module according to the specific service when the user opens the service, or the user information of the user terminal 42 can be obtained at the service authentication server 462, and a secure channel is established directly with the user terminal 42 to establish a security channel. After the security association between the user terminal 42 and the own service server 464, the selection or modification is performed by the level modification module. The above modules further increase the flexibility of user use and improve the user experience. The above preferred embodiments will be described in detail below with reference to examples. In this example, the self-owned service authentication system includes a user terminal and a network. The user terminal includes a client and a smart card. The client can run on the mobile terminal or PC terminal, and the client needs to establish a secure local access interface with the smart card to ensure data validity. The user terminal has the ability to access the first network and the second network. Business authentication can be implemented on the client or on a smart card. The smart card implements service authentication, and the related security calculation processes such as confidentiality and negotiation are implemented on the smart card. The security is higher, and it is easier for the operator to grasp. The terminal has lower requirements, and the service authentication is preferably implemented on the smart card. The user terminal establishes a secure channel with the service authentication server through the second network, and establishes a security association with the own service server. The secure channel bearer can be based on data short message mode or BIP mode. Based on the secure channel, the user terminal performs security negotiation and service authentication with the service authentication server located in the second network. The user terminal can provide a user interface, prompt the user information, and request the user to input. It can be provided by smart card based STK/SCWS and client mode. The network includes systems such as a first network and a second network. The second network includes an access authentication server, a service authentication server, and a plurality of own service servers. After being authenticated by the access terminal, the user terminal can directly access the Internet service through the first network. After the service is authenticated, the user terminal can access the self-owned service of the second network. The self-owned service server mainly provides various service services based on the second network, and provides services with user terminal authentication requirements, such as packet domain services of the cellular communication system. There is one server per service, so the user terminal and the service authentication server may have multiple own service authentications. Before the establishment of the secure channel, the user terminal does not establish a security association with its own service server. The secure communication interface between the self-owned service server and the service authentication server can obtain security information such as a security key or a certificate reached by the user terminal and the service authentication server. The access authentication server completes the access authentication of the user terminal to access the second network through the first network. Generally, the access authentication ensures that the network accessed by the user terminal is a legal network, and only a legitimate user terminal can access the network. The service authentication server completes the service authentication between the user terminal and the own service server. The service authentication server obtains user-related information from the second network (such as the home subscriber server/home location register in the cellular communication system), establishes a secure channel through the second network, and establishes a security association between the user terminal and the own service server. The service authentication server performs security negotiation and authentication based on the established secure channel. Provide user interface to prompt user information or require user input to perform security negotiation; perform authentication and key management according to the result of negotiation; and pass security information such as key to its own service server after successful authentication. At the same time, the service authentication server completes the corresponding key management, including setting the key validity according to the local policy; detecting the life cycle of the key and taking measures with the user terminal to ensure the key is refreshed. Based on the above examples, the authentication level function is added in this example. That is, the smart card provides a user interface based on STK/SCWS or client mode, prompts user information, requires user input or provides authentication level selection, and can perform authentication level selection during service authentication process (requires user participation) or active security channel establishment. Or change. The smart card performs the two-way identity authentication with the network as the authentication entity of the user terminal. If one party is not legal, the interaction is interrupted; if the identification process passes, a series of keys are generated to establish a secure channel; the bearer may be based on data short message mode or BIP mode. After establishing a secure channel, the user terminal establishes a security association with its own service server. Preferably, the BIP mode is adopted. When the smart card needs to communicate with the service authentication server through TCP/IP, the service authentication server is marked by an IP address. When the BIP channel is open, the terminal acts as a gateway, communicating with the service authentication server using TCP/IP, following ETSI TS 102 127. In this example, the service authentication server is mainly responsible for completing service authentication between the user terminal and the own service server. The service authentication server includes functions such as hierarchical authentication management, secure channel management, and service authentication management. The hierarchical authentication management submits a service authentication application according to its own service server, calls relevant user information, contract information, etc., determines the authentication level, and performs hierarchical authentication management. The authentication level can be divided into non-authentication, automatic authentication, user terminal confirmation authentication, and digital signature with terminal support. Hereinafter, the WLAN network is used as the first network, and the cellular communication system is the second network. The structure of the self-owned service authentication system according to the example is explained with reference to FIG. In this example, there is a service authentication system including a user terminal and a network. The first network is a WLAN network, and the WLAN network includes an AP (Access Point) and an Access Controller (AC). The AC connects and manages the wireless AP through the wireless interface to form a core layer of the WLAN network. It is also interconnected with an external network. The user terminal includes a client and a smart card. User terminals have the ability to simultaneously access WLAN networks and cellular communication systems. The client can operate on the mobile terminal or PC terminal, and the client and the smart card have a secure local access interface to ensure data validity. Business authentication can be implemented on the client or on a smart card. In the smart card to achieve business authentication, confidentiality and negotiation and other related security calculation processes are implemented on the smart card, the security is higher, and it is easy for the operator to master, and the terminal requirements are lower. It is preferred to implement service authentication on the smart card. As a local authentication module, the smart card establishes a secure channel with the service authentication server. After establishing a secure channel, the user terminal establishes a security association with its own service server. The network includes WLAN networks, cellular communication systems, the Internet, and the like. The cellular communication system includes an access authentication server, a service authentication server, and a plurality of own service servers. The WLAN network includes APs and ACs. The access authentication server completes the access authentication of the cellular communication system through the WLAN network, and may adopt

EAP-SIM/AKAo 3⁄4|Λ 3GPP AAA (Authentication Authorization and Accounting) Server, establishes connection with HSS (Home Subscriber Server) / HLR (Home Location Register); AP / AC supports EAP-SIM/AKA, and the same terminal also needs to support EAP-SIM/AKA protocol. EAP-SIM/AKA see related protocols. Access the authentication server to complete the corresponding billing, billing, and management functions. The 3GPP AAA Server and the WLAN cooperate to complete the unified authentication, and the authentication directly accesses the Internet. For example, the user name/password mode can be charged. At the same time, it can distinguish between direct access to Internet traffic and subsequent traffic that may be connected to the packet domain. The 3GPP AAA Server accepts the charging information collected from the WLAN, generates a bill file according to the local policy, and provides it to the billing system, the billing system performs the batch accounting processing, and produces the final bill. The service authentication server completes the service authentication between the user terminal and the own service server. The service authentication server obtains user-related information from the cellular communication system, establishes a secure channel, and enables the user terminal to perform security association with the own service server. And providing a user interface to prompt user information or requesting input by the smart card on the secure channel, performing security negotiation; performing authentication and key management according to the result of the negotiation; and transmitting the session key and security settings to the own service server. At least two authentication mechanisms are included in this example. One is based on shared secrets between entities, and the other is based on key pairs. There are several authentication protocols based on the shared secret mechanism between entities. Commonly used are pre-shared key TLS (Transport Layer Security), IKE with pre-shared key and preferential use of username and password mechanism (Internet Key Exchange, Internet) Key exchange) protocol, and AKA. The main problem with this type of authentication mechanism is how to be consistent on pre-shared secrets. This authentication method is symmetrical. At present, mobile terminals adopt this method more. The other is to authenticate based on asymmetric ciphers. This authentication method requires that the entity that requires authentication has a password pair and a corresponding digital certificate. Including PGP (Pretty Good Privacy), HTTPS (Secure Hypertext Transfer Protocol, refer to RFC2818). Compared with the symmetric key, this type of asymmetric key authentication method has a relatively large amount of computation and a high requirement for the terminal. The self-owned service server mainly provides various business services to the user terminal, and provides services with user terminal authentication requirements. Packet domain based services such as multimedia services, location services, gaming and internet services are included in cellular communication systems. Before the establishment of the secure channel, the user terminal does not establish a security association with its own service server. In this example, hierarchical authentication management is supported, business authentication is hierarchically managed, and a user interface is provided for authentication level selection. FIG. 6 is a schematic flowchart of performing service authentication by a self-owned service authentication system according to an example of the present invention. As shown in FIG. 6, the process of performing service authentication in the foregoing system includes the following steps: Step S602: The client performs access authentication with an access authentication server in the cellular communication system via the WLAN network. Step S604, after the access authentication is successful, the user terminal can access the Internet through the WLAN network and directly access the Internet service. Step S606, the client accesses the own service server of the cellular communication system via the WLAN network (through tunnel technology). Step S608, the self-owned service server submits a service authentication application to the service authentication server. The service authentication server submits an application according to its own service, and calls related user information, contract information, etc., to determine the authentication level. Step S610: The service authentication server establishes a secure channel with the user terminal, so that the user terminal performs security association with the own service server. The two-way identity authentication is completed based on the smart card. If one party is not legal, the interaction is interrupted; if the identification process is passed, a series of keys are generated to establish a secure channel. The bearer adopts the BIP mode. When the smart card needs to communicate with the service authentication server through TCP/IP, the service authentication server is marked by an IP address. When the BIP channel is opened, the user terminal acts as a gateway, communicating with the service authentication server using TCP/IP, following ETSI TS 102 127. Step S612, after establishing a security association, performing user selection and security negotiation. The smart card provides a user interface that prompts the user for information and requires the user to enter. Users can provide it via smart card-based STK/SCWS and client. The smart card provides the user interface to provide the authentication level selection. In the service authentication process (requires user participation), or when the security channel is established actively, and the security association is established with the own service server, the authentication level is selected or changed. Step S614, performing authentication and key management according to the result of the negotiation. Includes two authentication mechanisms and allows users to negotiate. One is based on shared secrets between entities, and the other is based on key pairs. The service authentication server completes the corresponding key management, including: setting the local valid condition of the key according to the local policy; detecting the life cycle of the key and taking measures to ensure the key refreshing with the user terminal. Step S616, performing secret key or certificate distribution. After the authentication is successful, the key or certificate is distributed to the client or its own business server. The client can operate on a mobile terminal or a PC terminal. The client needs to establish a secure local access interface with the smart card to ensure data validity. The secure communication interface between the self-owned service server and the authentication server can obtain the security key and security settings reached by the corresponding client and the authentication server. Step S618, the authorized client accesses the own service of the cellular communication system through the WLAN network. From the above description, it can be seen that the technical solution provided by the present invention re-consides the access and service authentication mechanism of the wireless communication system, which ensures that the user terminal can flexibly use various access technologies to provide the user terminal. Flexible and secure authentication options also avoid duplicate service authentication, ensuring business security and improving user experience. It should be noted that the present invention is applicable not only to multi-communication system access and service grading authentication, but also to single-communication system service authentication. The user terminal can perform service authentication after completing the first network access authentication, or perform security authentication separately. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, thereby Storing them in a storage device is performed by a computing device, and in some cases, the steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or Multiple of these modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

1. A method of self-owned business authentication, including:

The user terminal initiates a service access request to the self-service server of the second network through the first network; the service authentication server of the second network directly performs service authentication on the user terminal.

The method according to claim 1, wherein before the user terminal initiates a service access request to the own service server of the second network by using the first network, the method further includes:

The user terminal completes access authentication of the first network via an access authentication server of the first network;

The user terminal completes access authentication of the second network by using an access authentication server of the second network by using the first network.

The method according to claim 1, wherein the service authentication server of the second network directly performs service authentication on the user terminal, including:

After receiving the service access request, the own service server submits a service authentication application to the service authentication server of the second network;

The service authentication server obtains the user information of the user terminal, establishes a secure channel with the user terminal, and establishes a security association between the user terminal and the own service server; a secure channel, performing security negotiation with the user terminal according to information input by the user received by the user terminal;

The service is authenticated according to the result of the security negotiation, and the security information is generated and distributed to the user terminal and the own service server.

The method according to claim 3, wherein before the service authentication server performs security negotiation with the user terminal according to the information input by the user terminal, the service authentication server further includes:

The user terminal displays prompt information to the user, and requests the user to input information.

The method of claim 3, wherein before the user terminal initiates a service access request to the own service server of the second network by using the first network, the method further includes: When the user terminal opens the service provided by the own service server, the user terminal performs an authentication level selection. The method according to claim 5, wherein the service authentication server acquires user information of the user terminal, directly establishes a secure channel with the user terminal, and establishes a relationship between the user terminal and the own service server. After the security association, it also includes:

The user terminal selects or modifies the authentication level according to an operation of the user. The method according to claim 5 or 6, wherein

The authentication level includes at least one of the following: no authentication, automatic authentication, user terminal confirmation authentication, digital signature authentication. A self-owned service authentication system includes: a user terminal, a first network, and a second network, where the user terminal includes: a client, where the second network includes: a service authentication server and a self-service server, where

The client includes:

And the request initiating module is configured to initiate a service access request to the own service server of the second network by using the first network;

The business authentication server includes:

The service authentication module is configured to directly perform service authentication on the user terminal. The system according to claim 8, wherein the first network comprises:

a first access authentication server, configured to complete an access authentication of the first network of the user terminal;

The second network further includes:

And a second access authentication server, configured to complete access authentication of the second network of the user terminal by using the first network. The system according to claim 8, wherein the self-owned service server comprises:

The application submission module is configured to submit a service authentication application to the service authentication server after receiving the service access request of the user terminal; The service authentication server further includes:

a channel establishing module, configured to acquire user information of the user terminal, establish a secure channel directly with the user terminal, establish a security association between the user terminal and the own service server, and set a security negotiation module to pass The secure channel performs security negotiation with the user terminal according to information input by the user received by the user terminal;

The service authentication module is further configured to perform service authentication according to the result of the security negotiation, generate security information, and distribute the information to the user terminal and the own service server.

The system according to claim 10, wherein the client further comprises:

The input prompt module is set to display a prompt message to the user, and the user is required to input information.

The system of claim 10, wherein the user terminal further comprises: a smart card, wherein the smart card comprises at least one of the following:

a level selection module, configured to perform an authentication level selection when the self-owned service provided by the own service server is opened;

The level modification module is configured to select or modify the authentication level according to a user operation after the security channel is established.