WO2013044766A1 - 无卡终端的业务访问方法及设备 - Google Patents

无卡终端的业务访问方法及设备 Download PDF

Info

Publication number
WO2013044766A1
WO2013044766A1 PCT/CN2012/081805 CN2012081805W WO2013044766A1 WO 2013044766 A1 WO2013044766 A1 WO 2013044766A1 CN 2012081805 W CN2012081805 W CN 2012081805W WO 2013044766 A1 WO2013044766 A1 WO 2013044766A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
cardless
service
user key
card
Prior art date
Application number
PCT/CN2012/081805
Other languages
English (en)
French (fr)
Inventor
路晓明
Original Assignee
中国移动通信集团公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国移动通信集团公司 filed Critical 中国移动通信集团公司
Publication of WO2013044766A1 publication Critical patent/WO2013044766A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a service access method and device for a cardless terminal.
  • the current terminals can be divided into two categories: card terminal and no card. terminal.
  • a SIM/USIM card is inserted in the card terminal, and the card records the personalized user root key of the user logging in to the mobile communication network, and the home side HLR/HSS (Home Location Register/Home Subscriber Server, Home Location Register/Home Subscriber Server) The keys recorded in ) are the same.
  • the most common card terminals are mobile phones. Since the key in the card is already shared between the network side and the terminal side, for the card terminal, mutual authentication of the terminal and the network platform can be implemented based on the key and a shared user key of the service layer can be generated.
  • 3GPP defines a GBA (Generic Bootstrapping Architecture), which is used to share the user key shared by the card terminal with the service platform.
  • GBA Generic Bootstrapping Architecture
  • the terminal Since the SIM/USIM card is not inserted in the cardless terminal, the terminal does not contain any key or secret information that can be used to authenticate the user identity, so the user key shared by the terminal and the service platform cannot be generated through the GBA process like the card terminal. . Therefore, in the existing terminal service access technology, it is difficult for a cardless terminal to directly access the network service by using the GB A process.
  • cardless terminals eg, PCs, laptops, set-top boxes, tablets, e-readers, etc.
  • cardless terminals represented by tablet PCs are becoming more and more popular and popular, and the problem that the cardless terminals cannot directly access the network services by using the GBA process needs to be solved.
  • the embodiments of the present invention provide a service access method and device for a cardless terminal, which are used to solve the problem that a cardless terminal is difficult to directly access a network service by using a GBA process, and enhance the convenience of a cardless terminal to access a network service.
  • the service access method of the cardless terminal provided by the embodiment of the present invention includes the following steps: the card terminal receives the service authentication request sent by the cardless terminal, generates a user key for the cardless terminal according to the service authentication request, and according to the The user key authenticates the cardless terminal by interacting with the network side; after the cardless terminal passes the authentication, the card terminal according to the received service interaction request sent by the cardless terminal The network side performs business interaction.
  • the card terminal provided by the embodiment of the invention includes:
  • the cardless terminal configured to receive a service authentication request sent by the cardless terminal; and receive a service interaction request sent by the cardless terminal; and a security module, configured to generate a user key for the cardless terminal according to the service authentication request And authenticating the cardless terminal by the network side according to the user key; and, after the network side authenticates the cardless terminal, according to the cardless card received by the first receiving module
  • the service interaction request sent by the terminal interacts with the network side.
  • the cardless terminal provided by the embodiment of the present invention includes:
  • the card terminal After receiving the authentication request initiated by the cardless terminal, the card terminal generates a user for the cardless terminal according to the service authentication request.
  • a network access channel can be provided for a cardless terminal that does not have the ability to access the network, so that it can access the service platform, and the convenience of the cardless terminal accessing the network service is enhanced.
  • FIG. 1 is a flow chart of steps of a service access method of a cardless terminal according to an embodiment of the present invention
  • FIG. 2 is a schematic signaling diagram of a service access method of a cardless terminal according to an embodiment of the present invention
  • a user key of a cardless terminal Flow chart of the steps of the boot identification
  • FIG. 4 is a flowchart of a step of generating a verification key of a cardless terminal user key by a BSF according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a card terminal according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a cardless terminal according to an embodiment of the present invention.
  • the service access system framework to which the embodiments of the present invention are applied includes: a card terminal, a cardless terminal, a Network Application Function (NAF), and an initial Bootstrapping server function (BSF).
  • NAF Network Application Function
  • BSF Bootstrapping server function
  • the NAF is mainly used for performing service authentication and service interaction with the card-equipped terminal.
  • the BSF is mainly used to generate a user key of the cardless terminal and send it to the NAF, so that the NAF and the card-equipped terminal perform service authentication.
  • a cardless terminal is a device without a SIM/USIM card, such as a PC, a notebook, a set top box, a tablet, and an e-reader;
  • a card terminal is a device having a SIM/USIM card, such as a mobile phone.
  • the card terminal in the system acts as a proxy for the cardless terminal, and provides functions such as user key generation, user authentication, and network access for the cardless terminal.
  • the cardless terminal does not participate in the functions of user key generation, user authentication, and network access.
  • the service client on the cardless terminal does not need to care about the process of key negotiation, user authentication, and service channel security.
  • the end logic initiates a service interaction process to the card terminal, and then the card terminal sends the message to the NAF through the proxy mechanism.
  • the service access process of the cardless terminal provided by the embodiment of the present invention may be as shown in FIG. 1 , including:
  • Step 101 Establish a secure channel between the cardless terminal and the cardd terminal.
  • the cardless terminal and the carded terminal can mutually authenticate each other and establish a secure channel by using a shared key (PSK) stored therein.
  • PSK shared key
  • Step 102 When the cardless terminal needs to access the NAF for service access, the device sends a service authentication request to the card terminal through the secure channel.
  • Step 103 The card terminal generates a user key for the cardless terminal according to the service authentication request.
  • the service authentication request may carry parameters such as a NAF ID (NAF identifier) and a Device ID (a device identifier of a cardless terminal that initiates the service authentication request), and the card terminal may be based on the service.
  • the NAF ID and Ks carried in the authentication request Ks is the shared key between the card terminal and the BSF, that is, the root key
  • Ks_NAF is calculated, and then the user key is generated according to parameters such as Ks_NAF and Device ID.
  • TempK_NAF and TB-TID, TB-TID is the temporary B-TID
  • Step 104 The card terminal uses the user key to perform service authentication on the cardless terminal through the network side.
  • the card terminal initiates a service authentication request to the NAF, where the TB-TID generated for the cardless terminal is carried, and the NAF initiates a request for acquiring the user key to the BSF, where the TB-TID and the NAF ID are carried;
  • the TB-TID is parsed to obtain the expiration date of the DeviceID, the B-TID, and the user key (Expire Date), and the service access key Ks_NAF is calculated according to the NAF ID and Ks, and then the user key TempK_NAF is generated according to parameters such as Ks_NAF and DevicelD, and Return to the NAF; the service is authenticated between the NAF and the carded terminal based on the TempK_NAF generated for the cardless terminal.
  • Step 105 If the cardless terminal passes the authentication, the cardless terminal may send a service interaction request to the cardd terminal by using a secure channel with the card terminal, and the card terminal sends the service interaction request to the NAF, and After receiving the service response returned by the NAF, the service response is sent to the cardless terminal through the secure channel. Meanwhile, according to the service requirement, the card terminal can encrypt the data sent to the NAF by using the user key TempK_NAF generated by the cardless terminal; the NAF can encrypt and transmit the service response by using the user key TempK_NAF of the cardless terminal. The card terminal is provided. In this case, the card terminal can decrypt the received service response data using the user key TempK_NAF generated by the cardless terminal, and then send the decrypted service response to the cardless terminal.
  • the service platform enhances the convenience of cardless terminals for accessing network services.
  • the cardless terminal does not participate in the process of user key generation, network access, and user authentication. It only needs to initiate a service interaction request to the card terminal, and then the card terminal sends the service to the service platform through the proxy mechanism to implement the card terminal. The agent of the cardless terminal accesses the network access service platform.
  • the cardless terminal uses the card terminal to access the network access service platform through the proxy mode.
  • the network accessed by the card terminal is the same as the network to which the service platform belongs, ensuring the QoS (Quality of Service) of the cardless terminal accessing the service platform link. Quality of Service), signaling delays and packet loss can be reduced through unified network planning and upgrades.
  • QoS Quality of Service
  • the cardless terminal can effectively eliminate the risk of the card terminal Ks_NAF through the TempK_NAF, and improve the security of the service client user key on the card terminal. After the expiration date, the user key generated for the cardless terminal is invalidated. In addition, a secure channel is established between the card terminal and the cardless terminal to ensure the authentication of the device and the confidentiality of the connection.
  • a security module can be deployed on the card terminal and the cardless terminal to implement the service authentication and network access function of the card terminal agent cardless terminal.
  • the SeM module on the cardless terminal includes an interface layer
  • the SeM module on the card terminal includes an interface layer and a middleware.
  • the interface layer can adopt various software or hardware forms to ensure communication security between the middleware of the card terminal and the service client of the cardless terminal.
  • the middleware in the SeM module on the card terminal can provide functions such as user key generation, user authentication, and network access for multiple cardless terminals and multiple service clients.
  • the cardless terminal provided by the embodiment of the present invention.
  • the signaling process of the user key generation, user authentication, network access, and service interaction process can be as shown in FIG. 2.
  • the key operation module in the card terminal negotiates the shared key with the BSF, that is, the GBA key operation module of the card terminal uses the SIM/USIM card to calculate the authentication information and the BSF authentication. Implement the GBA initialization process and generate the root key Ks of the card terminal.
  • the user key generation, user authentication, and service interaction process after the GBA initialization process are described in detail below with reference to FIG. 1 and FIG. 2. As shown in FIG. 2, the process includes:
  • the interface layer of the SeM module of the cardless terminal and the interface layer of the SeM module of the cardless terminal use the shared secret shared by each.
  • the keys (PSK) authenticate each other and establish a secure channel.
  • the shared key may be pre-stored, or may be a password temporarily input by the user.
  • a service authentication process performed by a card terminal agent without a card terminal (corresponding to steps 102-104 in FIG. 1)
  • the NAF client of the cardless terminal initiates an authentication request to the middleware in the SeM module of the card terminal, which carries the network application platform identifier (NAF ID) to be accessed and the No card terminal identification (Device ID).
  • NAF ID network application platform identifier
  • Device ID No card terminal identification
  • the middleware with the card terminal sends a key request to the key operation module in the SIM/USIM of the card terminal to request the service key Ks_NAF of the cardless terminal; the key operation module in the SIM/USIM receives After the key request to the middleware, Ks_NAF is generated and sent to the middleware, and the Ks_NAF corresponds to the service platform identifier NAF ID requested by the cardless terminal.
  • the key operation module of the card terminal generates Ks_NAF by using Ks, NAF ID and IP Multimedia Private Identity (IMI).
  • the key arithmetic module can be either in the SIM/USIM or outside the SIM/USIM, such as software or hardware on the terminal. 5.
  • the middleware with the card terminal generates the user key of the cardless terminal according to the obtained Ks_NAF
  • the middleware with the card terminal initiates a service authentication request to the NAF, which carries the TB-TID generated for the cardless terminal;
  • the NAF After receiving the service authentication request sent by the middleware, the NAF sends a key request to the BSF, where the key request carries its own NAF ID and the TB-TID obtained from the service authentication request.
  • the BSF After receiving the key request, the BSF generates a user key of the cardless terminal TempK_NAF;
  • the middleware with the card terminal and the NAF authenticate the cardless terminal based on the TempK_NAF generated for the cardless terminal, that is, the middleware and the NAF complete the HTTP Digest mutual authentication based on the TempK_NAF, and the card terminal and the NAF after the authentication is passed. Establish a secure channel for business communication.
  • the middleware sends the authentication result to the NAF client of the cardless terminal.
  • the card terminal can prompt the user for the service authentication request of the cardless terminal on the user interface, and wait for the user to select whether to agree. If the rejection information submitted by the user is received, the card terminal rejects the authentication request of the cardless terminal. If the confirmation information submitted by the user is received, the middleware of the card terminal requests the service access key (Ks_NAF) from the key operation module.
  • Ks_NAF service access key
  • the middleware with the card terminal sends the service interaction request to the NAF through the access network with the card terminal (that is, the service interaction request is sent through the service security channel established between the card terminal and the NAF); the NAF receives the request After the business interaction request sent by the card terminal middleware is processed accordingly, and The service response is sent to the middleware with the card terminal; the middleware with the card terminal receives the service response sent by the NAF and sends it to the NAF client of the cardless terminal; the NAF client of the cardless terminal receives the service response and then performs Corresponding business processing operations.
  • the card terminal middleware can select to encrypt the service interaction request received from the cardless terminal by using the TempK_NAF of the cardless terminal, and send the encrypted service interaction request to the NAF according to the security level of the service interaction;
  • the middleware decrypts the service response using the corresponding TempK_NAF, and sends the decrypted service response to the NAF client of the cardless terminal.
  • the middleware In the foregoing step 103, the middleware generates a user key of the cardless terminal and a booting identifier of the user key of the cardless terminal according to the obtained Ks_NAF (see FIG. 3), specifically including the following steps: Step 301, the middleware is based on The policy sets the expiration date for the user key of the cardless terminal.
  • the expiration date of the user key can be flexibly set for different users and different service contents to be accessed to meet the needs of different users and different services.
  • the key validity period can be 1 day, and the Expire Date can be 2010- 3-20 12: 00: 00: 2010-3-21 12: 00: 00; If it is a public PC, the validity period can be 1 hour, then the Expire Date can be 2010-3-20 12: 00: 00: 2010-3-21 13: 00: 00.
  • Step 302 The middleware generates a user key (TempK_NAF) and a boot identifier (TB-TID) of the cardless terminal user key according to Ks_NAF, Expire Date, and Device ID.
  • TempK_NAF KDF (Ks_NAF, Device ID, Expire Date); wherein KDF is a one-way digest function, which includes MD5, SHA1, SHA256, or HMAC algorithm.
  • the key operation module with the card terminal transmits Expire Date and TempK_NAF to the middleware with the card terminal; the middleware with the card terminal is generated according to the validity period, the cardless terminal device identifier and the Bootstrapping transaction identifier (B-TID).
  • the temporary guidance service identifier of the cardless terminal is TB-TID.
  • the temporary guidance service identifier of the cardless terminal is: terminal identifier@valid period@boot service identifier; wherein, B-TID is after the card terminal performs GBA initialization, and the BSF is Generated by the card terminal; B-TID is used to identify the user key Ks of the card terminal.
  • the BSF generates an authentication key of the cardless terminal user key (see FIG. 4), which specifically includes the following steps:
  • Step 401 After receiving the key request sent by the NAF, the BSF parses the TB-TID carried in the key request, and extracts the B-TID, the Device ID, and the Expire Date.
  • Step 402 The BSF determines whether the Expire Date of the TB-TID is still valid. If it is valid, it searches for Ks_NAF according to the B-TID, otherwise, the middleware returns a message that the authentication fails (please confirm whether it is correct).
  • Step 403 The BSF calculates a verification key of the cardless terminal user key according to the Ks_NAF.
  • TempK_NAF KDF ( Ks_NAF, Device ID,, Expire Date ).
  • KDF is a one-way summary function, which includes MD5, SHA1, SHA256, or HMAC algorithm.
  • the function of authenticating and generating the shared user key of the service layer is centralized in the SeM module of the card terminal, and the service client on the cardless terminal does not need to care about the authentication process and the security of the service channel, and reduces the The complexity of the service client on the card terminal reduces the interaction complexity between the card terminal and the cardless terminal SeM module, and improves the functional stability.
  • the middleware in the SeM module of the card terminal can provide authentication process and service channel security for multiple terminals and multiple clients, and reduce the development cost and integration difficulty of each client.
  • an embodiment of the present invention further provides a card terminal.
  • the figure is a schematic structural diagram of a card-equipped terminal according to an embodiment of the present invention, where the card-equipped terminal includes:
  • the first receiving module 501 is configured to receive a service authentication request sent by the cardless terminal, and receive a service interaction request sent by the cardless terminal.
  • the security module 502 is configured to generate a user key for the cardless terminal according to the service authentication request, and And authenticating the cardless terminal by the network side according to the user key; and, after the network card side passes the authentication of the cardless terminal, the service is performed according to the service interaction request sent by the cardless terminal received by the first receiving module 501, and the network side performs the service. Interaction.
  • the security module 502 is specifically configured to: generate a user key and a temporary boot identifier of the user key for the cardless terminal, and initiate a service authentication request to the network application platform NAF, where the temporary boot identifier is carried, so that the NAF will be
  • the temporary boot identifier is sent to the initialization server BSF, and the user key generated by the temporary I guide identifier is obtained from the BSF; the security module 502 is further configured to perform authentication with the NAF based on the user key generated for the cardless terminal.
  • the card terminal provided by the embodiment of the present invention further includes a key operation module 503, configured to generate a service access key Ks_NAF according to the network platform identifier NAF ID of the network side and the shared key Ks of the card side and the network side;
  • the security module 502 is further configured to: set a validity period for the user key of the cardless terminal, generate a user key of the cardless terminal according to the Ks_NAF, the validity period, and the device identifier of the cardless terminal, according to the validity period, the device of the cardless terminal
  • the boot identifier of the identification and user key generates a temporary boot identifier for the user key of the cardless terminal.
  • the card-receiving terminal further includes: a second receiving module 504, configured to receive a service response returned by the network side;
  • the security module 502 is further configured to send the service response received by the second receiving module 504 to the cardless terminal. Specifically, the security module 502 is further configured to: encrypt the received service interaction request by using a user key generated by the cardless terminal, and send the encrypted service interaction request to the network side; and use the cardless terminal. The generated user key decrypts the service response returned by the network side, and sends the decrypted service response to the cardless terminal.
  • the embodiment of the present invention further provides a cardless terminal. Referring to FIG. 6 , it is a schematic structural diagram of a cardless terminal according to an embodiment of the present invention.
  • the cardless terminal includes:
  • a security module 601, configured to establish a secure channel with the card terminal
  • the client module 602 is configured to send a service authentication request to the card terminal through the secure channel, so that the card terminal generates a user key for the cardless terminal according to the service authentication request, and interacts with the network side according to the user key.
  • the cardless terminal is authenticated; and the service interaction request is sent to the cardd terminal through the secure channel, so that the carded terminal performs service interaction with the network side.
  • the client module 602 is further configured to receive a service response returned by the card terminal.
  • the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is a better implementation. the way.
  • the technical solution of the present invention which is essential or contributes to the prior art, can be embodied in the form of a software product.
  • the software product is stored in a storage medium and includes instructions for causing a terminal device (which may be a cell phone, personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.
  • modules in the apparatus in the embodiments may be distributed in the apparatus of the embodiment as described in the embodiment, or may be correspondingly changed in one or more apparatuses different from the embodiment.
  • the modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.
  • the above is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. The scope of protection of the invention should be considered.

Abstract

一种无卡终端的业务访问方法，包括：有卡终端接收无卡终端发送的业务认证请求，根据所述业务认证请求为所述无卡终端生成用户密钥，并根据所述用户密钥，通过与网络侧交互对所述无卡终端进行认证；所述有卡终端在所述无卡终端认证通过后，根据接收到的所述无卡终端发送的业务交互请求与网络侧进行业务交互。本方法用以解决无卡终端难以利用GBA流程直接访问网络业务的问题，增强无卡终端对网络业务访问的便捷性。

Description

无卡终端的业务访问方法及设备
本申请要求于 2011 年 09 月 26 日提交中国专利局、 申请号为 201110287756.5、 发明名称为"无卡终端的业务访问方法及设备"的中国专利申 请的优先权， 其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，特别是涉及一种无卡终端的业务访问方法及设 备。
背景技术
在移动网络环境下， 用户使用终端访问某些业务时， 需要基于用户密钥实 现终端与业务服务器的相互认证并利用用户密钥加密传输某些机密数据，由此 可见， 用户密钥的生成是用户使用此类业务的前提条件。
从用户使用的设备中是否带有 SIM/USIM卡 ( Subscriber Identity Module /Universal Subscriber Identity Module, 用户识别卡 /全球用户识别卡）来区分， 目前的终端可以分为两类： 有卡终端和无卡终端。 有卡终端中插有 SIM/USIM 卡， 卡中记录了用户登录移动通信网络的个性化用户根密钥， 与网络侧 HLR/HSS ( Home Location Register/ Home Subscriber Server, 归属位置寄存器 / 归属用户服务器）中记录的密钥相同。 最常见的有卡终端如手机。 由于卡中的 密钥已经在网络侧和终端侧共享， 所以对于有卡终端， 可以基于该密钥实现终 端与网络平台的相互认证并生成业务层的共享用户密钥。 目前 3GPP 定义了 GBA ( Generic Bootstrapping Architecture, 通用引导架构）， 用于对有卡终端生 成终端与业务平台共享的用户密钥。
由于无卡终端中没有插 SIM/USIM卡，终端中不包含任何能够用于认证用 户身份的密钥或秘密信息， 所以无法像有卡终端这样通过 GBA流程生成终端 与业务平台共享的用户密钥。 因此， 在现有的终端业务访问技术中， 无卡终端 难以利用 GB A流程直接访问网络业务。
随着无卡终端（例如， PC、 笔记本、 机顶盒、 平板电脑和电子阅读器等）， 尤其是以平板电脑为代表的无卡终端越来越流行和普及，由此带来的无卡终端 无法利用 GBA流程直接访问网络业务的问题亟待解决。 发明内容 本发明实施例提供了一种无卡终端的业务访问方法及设备，用以解决无卡 终端难以利用 GBA流程直接访问网络业务的问题， 增强无卡终端对网络业务 访问的便捷性。 本发明实施例提供的无卡终端的业务访问方法， 包括以下步骤： 有卡终端接收无卡终端发送的业务认证请求，根据所述业务认证请求为所 述无卡终端生成用户密钥， 并根据所述用户密钥，通过与网络侧交互对所述无 卡终端进行认证； 所述有卡终端在所述无卡终端认证通过后，根据接收到的所述无卡终端发 送的业务交互请求与网络侧进行业务交互。 本发明实施例提供的有卡终端， 包括：
第一接收模块， 用于接收无卡终端发送的业务认证请求； 以及， 接收无卡 终端发送的业务交互请求； 安全模块， 用于根据所述业务认证请求为所述无卡终端生成用户密钥， 并 根据所述用户密钥， 通过网络侧对所述无卡终端进行认证； 以及， 在网络侧对 所述无卡终端认证通过后，根据所述第一接收模块接收到的所述无卡终端发送 的业务交互请求与网络侧进行业务交互。 本发明实施例提供的无卡终端， 包括：
安全模块， 用于与有卡终端建立安全通道； 客户端模块， 用于通过所述安全通道向有卡终端发送业务认证请求， 以使 有卡终端根据所述业务认证请求为所述无卡终端生成用户密钥，并根据所述用 户密钥， 通过与网络侧交互对所述无卡终端进行认证； 以及， 通过所述安全通 道向有卡终端发送业务交互请求， 以使有卡终端与网络侧进行业务交互。 与现有技术相比， 本发明的上述实施例具有以下有益技术效果： 本发明实施例通过有卡终端在接收到无卡终端发起的认证请求后，根据该 业务认证请求为无卡终端生成用户密钥， 并 ^据该用户密钥，通过网络侧对所 述无卡终端进行认证， 并在网络侧对无卡终端认证通过后，根据接收到的无卡 终端发送的业务交互请求与网络侧进行业务交互，由此可以为不具备访问网络 能力的无卡终端提供网络接入通道，使其可以访问业务平台，增强了无卡终端 对网络业务访问的便捷性。
附图说明
图 1为本发明实施例提供的无卡终端的业务访问方法的步骤流程图； 图 2为本发明实施例提供的无卡终端的业务访问方法的信令示意图； 及无卡终端的用户密钥的引导标识的步骤流程图；
图 4为本发明实施例提供的 BSF生成无卡终端用户密钥的验证密钥的步 骤流程图；
图 5为本发明实施例提供的有卡终端的结构示意图；
图 6为本发明实施例提供的无卡终端的结构示意图。
具体实施方式 下面结合附图对本发明的技术方案进行清楚、 完整的描述， 显然， 所描述 的实施例是本发明一部分实施例， 而不是全部的实施例。基于本发明中的实施 例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施 例， 都属于本发明的保护范围。 本发明实施例所适用的业务访问系统架包括： 有卡终端、 无卡终端、 网络 应用平台（ Network Application Function, NAF )和初始 4匕月良务器 ( Bootstrapping server function, BSF )。 其中， NAF在本实施例中主要用于与有卡终端进行业 务认证以及业务交互； BSF主要用于生成无卡终端的用户密钥并发送给 NAF, 以使 NAF与有卡终端进行业务认证；无卡终端是不带有 SIM/USIM卡的设备， 例如 PC、 笔记本、 机顶盒、 平板电脑和电子阅读器等； 有卡终端是具有 SIM/USIM卡的设备， 例如手机等。
本系统中的有卡终端作为无卡终端的代理， 为无卡终端提供用户密钥生 成、 用户认证、 网络接入等功能。 无卡终端不参与用户密钥生成、 用户认证、 网络接入等功能的实现， 无卡终端上的业务客户端无需关心密钥协商、用户认 证等流程和业务通道安全性，只需要按业务客户端逻辑向有卡终端发起业务交 互流程， 再由有卡终端通过代理机制向 NAF发送。
基于前述系统架构，本发明实施例提供的无卡终端的业务访问流程可如图 1所示， 包括：
步骤 101 , 无卡终端与有卡终端之间建立安全通道。
具体实施时， 无卡终端与有卡终端可利用各自存储的共享密钥（PSK )相 互认证并建立安全通道。
步骤 102, 无卡终端需要接入 NAF进行业务访问时， 通过安全通道向有 卡终端发送业务认证请求。
步骤 103, 有卡终端根据该业务认证请求为该无卡终端生成用户密钥。 具体实施时，所述业务认证请求中可携带 NAF ID ( NAF标识 )、 Device ID (发起该业务认证请求的无卡终端的设备标识 )等参数，有卡终端可根据该业 务认证请求中携带的 NAF ID和 Ks ( Ks是有卡终端与 BSF之间的共享密钥， 即根密钥）计算得到业务访问密钥 Ks_NAF, 然后根据 Ks_NAF、 Device ID 等参数生成用户密钥 TempK_NAF和 TB-TID, TB-TID即临时 B-TID
( Bootstrapping transaction identifier , 引导业务标识 )。
步骤 104, 有卡终端使用该用户密钥， 通过网络侧对该无卡终端进行业务 认证。
具体实施时， 有卡终端向 NAF发起业务认证请求， 其中携带有为该无卡 终端生成的 TB-TID, NAF向 BSF发起获取用户密钥的请求， 其中携带有 TB-TID和 NAF ID; BSF解析 TB-TID得到 DeviceID、 B-TID和用户密钥的效 期（ Expire Date ), 并根据 NAF ID和 Ks计算得到业务访问密钥 Ks_NAF, 然 后根据 Ks_NAF、 DevicelD等参数生成用户密钥 TempK_NAF,并返回给 NAF; NAF和有卡终端之间基于为无卡终端生成的 TempK_NAF对该无卡终端进行 业务认证。 步骤 105, 若该无卡终端认证通过， 则该无卡终端可通过与有卡终端之间 的安全通道向有卡终端发送业务交互请求，该有卡终端将该业务交互请求发送 给 NAF, 并在接收到 NAF返回的业务响应后， 通过该安全通道将该业务响应 发送给该无卡终端。 其间， 根据业务需要， 有卡终端可以使用为该无卡终端生 成的用户密钥 TempK_NAF对发送给 NAF的数据进行加密； NAF可使用该无 卡终端的用户密钥 TempK_NAF对业务响应进行加密后发送给有卡终端，此种 情况下，有卡终端可以使用为该无卡终端生成的用户密钥 TempK_NAF对接收 到的业务响应数据进行解密， 然后将解密后的业务响应发送给无卡终端。
通过以上流程可以看出， 本发明实施例具有以下优点：
1、 为不具备访问网络能力的无卡终端提供网络接入通道， 使其可以访问 业务平台， 增强了无卡终端对网络业务访问的便捷性。
2、 无卡终端不参与用户密钥生成、 网络接入以及用户认证等流程， 只需 要向有卡终端发起业务交互请求， 再由有卡终端通过代理机制向业务平台发 送， 实现有卡终端作为无卡终端的代理接入网络访问业务平台。
3、 无卡终端利用有卡终端通过代理方式接入网络访问业务平台， 有卡终 端接入的网络与业务平台所属网络相同，保证了无卡终端访问业务平台链路的 QoS ( Quality of Service, 服务质量）， 可以通过统一的网络规划和升级来降低 信令响应时延和数据包丟失。
4、 无论 TempK_NAF还是 Ks_NAF都不出有卡终端， 有效消除了无卡终 端通过 TempK_NAF推算出有卡终端 Ks_NAF的风险，提高了有卡终端上业务 客户端用户密钥的安全性。 务， 有效期过后， 为无卡终端生成的用户密钥作废， 另外， 在有卡终端与无卡 终端之间建立安全通道， 以保证设备的认证和连接的保密性。
本发明实施例在具体实施时，可通过在有卡终端和无卡终端上分别部署一 个安全模块（Secure Module, SeM ), 来实现有卡终端代理无卡终端进行业务 认证和网络接入的功能。 无卡终端上的 SeM模块包括接口层， 有卡终端上的 SeM模块包括接口层和中间件。 其中， 接口层可以采用多种软件或硬件形式， 来保证有卡终端上中间件与无卡终端的业务客户端间接口的通信安全。有卡终 端上的 SeM模块中的中间件作为一种通用能力， 可以为多个无卡终端、 多个 业务客户端提供用户密钥生成、 用户认证、 网络接入等功能。
基于以上有卡终端和无卡终端的结构，本发明实施例提供的无卡终端的用 户密钥生成、用户认证、网络接入以及业务交互过程的信令流程可如图 2所示。 其中， 在 GBA初始化过程中， 有卡终端中的密钥运算模块和 BSF之间协 商共享密钥， 即， 有卡终端的 GBA密钥运算模块利用 SIM/USIM卡计算鉴权 信息与 BSF认证， 实现 GBA初始化过程， 并生成有卡终端的根密钥 Ks。
以下结合图 1及图 2详细说明 GBA初始化过程之后的用户密钥生成、 用 户认证以及业务交互过程， 如图 2所示， 该过程包括：
1、 无卡终端和有卡终端之间建立安全通道（对应图 1中的步骤 101 ) 其中， 无卡终端的 SeM模块的接口层与有卡终端的 SeM模块的接口层利 用各自存储的共享密钥（PSK )相互认证并建立安全通道。 其中， 该共享密钥 既可以是预存的， 也可以是用户临时输入的口令等。
有卡终端代理无卡终端进行的业务认证过程（对应图 1中的步骤 102-104 )
2、 无卡终端在需要接入 NAF时， 无卡终端的 NAF客户端向有卡终端的 SeM模块中的中间件发起认证请求， 其中携带有需要访问的网络应用平台标 识（NAF ID )和该无卡终端标识（Device ID )。
3、 有卡终端的中间件向该有卡终端 SIM/USIM中的密钥运算模块发送密 钥请求， 以请求获取该无卡终端的业务密钥 Ks_NAF; SIM/USIM中的密钥运 算模块接收到中间件的密钥请求后生成 Ks_NAF并发送给中间件，该 Ks_NAF 对应无卡终端所请求的业务平台标识 NAF ID。
4、 具体的， 有卡终端的密钥运算模块利用 Ks、 NAF ID及 IP 多媒体私有 标识（ IP Multimedia Private Identity, IMPI )等生成 Ks_NAF。 密钥运算模块 既可以是在 SIM/USIM中，也可以在 SIM/USIM之外， 比如在终端上的软件或 硬件。 5、 有卡终端的中间件根据获得的 Ks_NAF 生成无卡终端的用户密钥
TempK_NAF以及无卡终端的用户密钥的临时 TB-TID。
6、有卡终端的中间件向 NAF发起业务认证请求， 其中携带有为无卡终端 生成的 TB-TID;
7、 NAF接收到中间件发送的业务认证请求后， 向 BSF发起密钥请求， 该密钥请求中携带有自己的 NAF ID以及从业务认证请求中获取到的 TB-TID;
8、 BSF接收到该密钥请求后生成无卡终端的用户密钥 TempK_NAF;
9、 将该无卡终端的 TempK_NAF发送给 NAF;
10、 有卡终端的中间件与 NAF基于为该无卡终端生成的 TempK_NAF为 该无卡终端进行认证， 即， 中间件与 NAF基于 TempK_NAF完成 HTTP Digest 相互认证， 认证通过后在有卡终端和 NAF之间建立业务通信安全通道。
11、 NAF 与有卡终端中间件对无卡终端认证通过后， 中间件将该认证结 果发送给无卡终端的 NAF客户端。 优选的， 有卡终端可以在用户界面上向用户提示无卡终端的业务认证请 求， 并等待用户选择是否同意， 若接收到用户提交的拒绝信息， 则有卡终端拒 绝无卡终端的认证请求， 若接收到用户提交的确认信息， 则有卡终端的中间件 向密钥运算模块请求业务访问密钥 （ Ks_NAF )。 有卡终端代理无卡终端进行的业务交互过程（对应图 1中的步骤 105 )
12、 认证通过后的无卡终端的 NAF客户端向有卡终端中间件发起下一步 业务交互请求；
13、有卡终端的中间件将该业务交互请求通过有卡终端的接入网络发送给 NAF (即通过该有卡终端与 NAF之间建立的业务安全通道发送该业务交互请 求）； NAF接收到有卡终端中间件发来的业务交互请求后进行相应处理， 并将 业务响应发送给有卡终端的中间件； 有卡终端的中间件接收到 NAF发送的业 务响应后将其发送给无卡终端的 NAF客户端；无卡终端的 NAF客户端收到业 务响应后进行相应业务处理操作。 优选的，有卡终端中间件根据业务交互的安全级别，可以选择对从无卡终 端收到的业务交互请求利用该无卡终端的 TempK_NAF进行加密，并将加密后 的业务交互请求发送给 NAF;
务响应， 使用该无卡终端的 TempK_NAF进行加密。
15、如果有卡终端的中间件接收到的业务响应进行了加密处理， 则该中间 件使用对应的 TempK_NAF对该业务响应进行解密，并将解密后的业务响应发 送给无卡终端的 NAF客户端。
在前述步骤 103中，中间件根据获得的 Ks_NAF生成无卡终端的用户密钥 以及无卡终端的用户密钥的引导标识（参见图 3所示）， 具体包括以下步骤： 步骤 301 , 中间件根据策略为无卡终端的用户密钥设置有效期（Expire Date ), 该用户密钥的有效期可针对不同的用户以及需要访问的业务内容不同 而灵活设定， 以满足不同用户、 不同业务的需要。 具体操作时， 根据无卡设备 标识（Device ID )所携带的终端类型进行判断： 如果是机顶盒、 家庭设备等 家庭内的终端，则密钥有效期长度可以为 1天，则 Expire Date可以为 2010-3-20 12: 00: 00: 2010-3-21 12: 00: 00; 如果是公共 PC等设备， 则有效期可以 为 1小时， 则 Expire Date可为 2010-3-20 12: 00: 00: 2010-3-21 13: 00: 00。
步骤 302, 中间件根据 Ks_NAF、 Expire Date和 Device ID生成用户密钥 ( TempK_NAF ) 以及该无卡终端用户密钥的引导标识（ TB-TID )。 具体的， TempK_NAF=KDF ( Ks_NAF, Device ID, Expire Date ); 其中， KDF是单向摘要函数， 其包括 MD5, SHA1、 SHA256, 或者 HMAC算法。 有卡终端的密钥运算模块将 Expire Date及 TempK_NAF传送至有卡终端 的中间件； 有卡终端的中间件根据有效期、无卡终端设备标识及引导业务标识 ( Bootstrapping transaction identifier, B-TID )生成无卡终端的临时 |导标识 TB-TID, 例如无卡终端的临时引导业务标识为： 终端标识@有效期 @引导业 务标识； 其中， B-TID是有卡终端执行过 GBA初始化后， 由 BSF为有卡终端 生成的； B-TID用于标识有卡终端的用户密钥 Ks。
在前述步骤 104中， BSF生成无卡终端用户密钥的验证密钥 （参见图 4 所示）， 具体包括以下步骤：
步骤 401 , BSF接收到 NAF发送的密钥请求后， 解析该密钥请求中携带 的 TB-TID, 取出 B-TID、 Device ID和 Expire Date。
步骤 402, BSF判断该 TB-TID的 Expire Date是否仍然有效， 若有效， 根 据 B-TID查找 Ks_NAF, 否则给中间件返回认证未通过的消息（还请确认是否 正确）。
步骤 403 , BSF根据 Ks_NAF计算无卡终端用户密钥的验证密钥，
TempK_NAF=KDF ( Ks_NAF, Device ID,, Expire Date )。 其中， KDF是单向 摘要函数， 其包括 MD5, SHA1、 SHA256, 或者 HMAC算法。
通过以上流程可以看出， 本发明实施例还具有以下优点：
1、 本发明实施例将认证和生成业务层的共享用户密钥的功能集中在有卡 终端的 SeM模块中， 无卡终端上的业务客户端无需关心认证流程和业务通道 安全性， 降低了无卡终端上业务客户端的复杂度， 减少了有卡终端和无卡终端 SeM模块间交互复杂度， 提高了功能稳定性。 2、 有卡终端 SeM模块中的中间件作为一种通用能力， 可以为多个终端、 多个客户端提供认证流程和业务通道安全性，降低各客户端的开发成本和融合 难度。 中间件基于相同的 GBA方案、 相同的 SIM卡可以为自身业务客户端和 其他若干个无卡终端上的业务客户端产生不同的身份标识和不同的业务密钥， 保证不同的业务客户端可以用不同的身份进行认证。 基于以上方法实施例， 本发明实施例还提供一种有卡终端。 参见图 5, 该图为本发明实施例提供的有卡终端的结构示意图， 该有卡终 端包括：
第一接收模块 501 , 用于接收无卡终端发送的业务认证请求； 以及， 接收 无卡终端发送的业务交互请求； 安全模块 502, 用于根据业务认证请求为无卡终端生成用户密钥， 并根据 用户密钥， 通过网络侧对无卡终端进行认证； 以及， 在网络侧对无卡终端认证 通过后，根据第一接收模块 501接收到的无卡终端发送的业务交互请求与网络 侧进行业务交互。
具体的， 安全模块 502具体用于， 为无卡终端生成用户密钥和该用户密钥 的临时引导标识， 向网络应用平台 NAF发起业务认证请求， 其中携带有临时 引导标识， 以使 NAF将所述临时引导标识发送给初始化服务器 BSF, 并从 BSF获取其 ^据该临时 I导标识生成的用户密钥； 安全模块 502还用于， 与 NAF基于为无有卡终端生成的用户密钥进行认 证。
本发明实施例提供的有卡终端还包括密钥运算模块 503, 用于根据网络侧 的网络平台标识 NAF ID以及有卡终端与网络侧的共享密钥 Ks生成业务访问 密钥 Ks_NAF; 安全模块 502还用于，为无卡终端的用户密钥设置有效期，根据 Ks_NAF、 有效期和无卡终端的设备标识生成无卡终端的用户密钥，根据所述有效期、所 述无卡终端的设备标识和用户密钥的引导标识生成无卡终端的用户密钥的临 时引导标识。
该有卡终端还包括： 第二接收模块 504, 该第二接收模块 504用于接收网 络侧返回的业务响应；
安全模块 502还用于，将所述第二接收模块 504接收的业务响应发送给无 卡终端。 具体的，安全模块 502还用于，使用为无卡终端生成的用户密钥对接收到 的业务交互请求进行加密， 并将加密后的业务交互请求发送给网络侧； 以及， 使用为无卡终端生成的用户密钥对网络侧返回的业务响应进行解密，并将解密 后的业务响应发送给所述无卡终端。 本发明实施例还提供一种无卡终端，参见图 6所示， 为本发明实施例提供 的无卡终端的结构示意图， 该无卡终端包括：
安全模块 601 , 用于与有卡终端建立安全通道；
客户端模块 602, 用于通过安全通道向有卡终端发送业务认证请求， 以使 有卡终端根据业务认证请求为所述无卡终端生成用户密钥， 并根据用户密钥， 通过与网络侧交互对无卡终端进行认证； 以及，通过安全通道向有卡终端发送 业务交互请求， 以使有卡终端与网络侧进行业务交互。 具体的， 客户端模块 602还用于， 接收有卡终端返回的业务响应。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本发明 可借助软件加必需的通用硬件平台的方式来实现， 当然也可以通过硬件，但很 多情况下前者是更佳的实施方式。基于这样的理解， 本发明的技术方案本质上 或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机 软件产品存储在一个存储介质中， 包括若干指令用以使得一台终端设备（可以 是手机， 个人计算机， 服务器， 或者网络设备等）执行本发明各个实施例所述 的方法。
本领域技术人员可以理解，实施例中的装置中的模块可以按照实施例描述 进行分布于实施例的装置中，也可以进行相应变化位于不同于本实施例的一个 或多个装置中。上述实施例的模块可以合并为一个模块，也可以进一步拆分成 多个子模块。 以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通 技术人员来说， 在不脱离本发明原理的前提下， 还可以做出若干改进和润饰， 这些改进和润饰也应视本发明的保护范围。

Claims

权 利 要 求
1、 一种无卡终端的业务访问方法， 其特征在于， 包括：
有卡终端接收无卡终端发送的业务认证请求，根据所述业务认证请求为所 述无卡终端生成用户密钥， 并根据所述用户密钥，通过与网络侧交互对所述无 卡终端进行认证；
所述有卡终端在所述无卡终端认证通过后，根据接收到的所述无卡终端发 送的业务交互请求与网络侧进行业务交互。
2、 如权利要求 1所述的方法， 其特征在于， 所述有卡终端根据所述业务 认证请求为所述无卡终端生成用户密钥， 并 ^据所述用户密钥，通过与网络侧 交互对所述无卡终端进行认证， 包括：
有卡终端为所述无卡终端生成用户密钥和该用户密钥的临时引导标识； 所述有卡终端向网络应用平台 NAF发起业务认证请求， 其中携带有所述 临时引导标识； NAF向初始化服务器 BSF发起密钥请求， 其中携带有所述临 时引导标识；
所述 BSF根据所述临时引导标识生成用户密钥， 并返回给所述 NAF; 所述有卡终端与所述 NAF基于为所述无卡终端生成的用户密钥对所述无 卡终端进行认证。
3、 如权利要求 2所述的方法， 其特征在于， 所述有卡终端为所述无卡终 端生成用户密钥和该用户密钥的临时引导标识， 具体包括：
有卡终端 ^据网络平台标识 NAF ID以及有卡终端与网络侧的共享密钥
Ks生成业务访问密钥 Ks_NAF;
所述有卡终端为无卡终端的用户密钥设置有效期；
所述有卡终端根据 Ks_NAF、所述有效期和所述无卡终端的设备标识生成 无卡终端的用户密钥，根据所述有效期、所述无卡终端的设备标识和用户密钥 的引导标识生成所述无卡终端的用户密钥的临时引导标识； 所述 BSF根据所述临时引导标识生成用户密钥， 具体包括：
BSF通过解析临时引导标识得到无卡终端用户密钥的引导标识、设备标识 和用户密钥的有效期；
所述 BSF判断解析得到的用户密钥的有效期是否有效， 并在判断为有效 时，根据用户密钥的引导标识查找对应的业务访问密钥， 并根据该业务访问密 钥、 无卡终端的设备标识和有效期生成用户密钥。
4、 如权利要求 1所述的方法， 其特征在于， 该方法还包括：
所述有卡终端与网络侧进行业务交互后，将网络侧返回的业务响应发送给 无卡终端。
5、 如权利要求 4所述的方法， 其特征在于， 所述有卡终端根据接收到的 所述无卡终端发送的业务交互请求与网络侧进行业务交互， 包括：
所述有卡终端使用为所述无卡终端生成的用户密钥对接收到的业务交互 请求进行加密， 并将加密后的业务交互请求发送给网络侧；
所述有卡终端将网络侧返回的业务响应发送给无卡终端， 包括：
所述有卡终端使用为所述无卡终端生成的用户密钥对网络侧返回的业务 响应进行解密， 并将解密后的业务响应发送给所述无卡终端。
6、 一种有卡终端， 其特征在于， 包括：
第一接收模块， 用于接收无卡终端发送的业务认证请求； 以及， 接收无卡 终端发送的业务交互请求；
安全模块， 用于根据所述业务认证请求为所述无卡终端生成用户密钥， 并 根据所述用户密钥， 通过网络侧对所述无卡终端进行认证； 以及， 在网络侧对 所述无卡终端认证通过后，根据所述第一接收模块接收到的所述无卡终端发送 的业务交互请求与网络侧进行业务交互。
7、 如权利要求 6所述的有卡终端， 其特征在于， 所述安全模块具体用于， 为所述无卡终端生成用户密钥和该用户密钥的临时引导标识，向网络应用平台 NAF发起业务认证请求， 其中携带有所述临时引导标识， 以使 NAF将所述临 时引导标识发送给初始化服务器 BSF, 并从 BSF获取其根据该临时引导标识 生成的用户密钥；
所述安全模块还用于， 与 NAF基于为所述无有卡终端生成的用户密钥进 行认证。
8、 如权利要求 7所述的有卡终端， 其特征在于， 所述有卡终端， 还包括： 密钥运算模块， 用于根据网络侧的网络平台标识 NAF ID以及有卡终端与 网络侧的共享密钥 Ks生成业务访问密钥 Ks_NAF;
所述安全模块还用于，为无卡终端的用户密钥设置有效期，根据 Ks_NAF、 所述有效期和所述无卡终端的设备标识生成无卡终端的用户密钥，根据所述有 效期、所述无卡终端的设备标识和用户密钥的引导标识生成所述无卡终端的用 户密钥的临时引导标识。
9、 如权利要求 6所述的有卡终端， 其特征在于， 还包括： 第二接收模块； 所述第二接收模块， 用于接收网络侧返回的业务响应；
所述安全模块还用于，将所述第二接收模块接收的业务响应发送给无卡终 端。
10、 如权利要求 9所述的有卡终端， 其特征在于，
所述安全模块还用于，使用为所述无卡终端生成的用户密钥对接收到的业 务交互请求进行加密， 并将加密后的业务交互请求发送给网络侧； 以及， 使用 为所述无卡终端生成的用户密钥对网络侧返回的业务响应进行解密，并将解密 后的业务响应发送给所述无卡终端。
11、 一种无卡终端， 其特征在于， 包括：
安全模块， 用于与有卡终端建立安全通道；
客户端模块， 用于通过所述安全通道向有卡终端发送业务认证请求， 以使 有卡终端根据所述业务认证请求为所述无卡终端生成用户密钥，并根据所述用 户密钥， 通过与网络侧交互对所述无卡终端进行认证； 以及， 通过所述安全通 道向有卡终端发送业务交互请求， 以使有卡终端与网络侧进行业务交互。
12、 如权利要求 11所述的无卡终端， 其特征在于， 所述客户端模块还用 于， 接收有卡终端返回的业务响应。
PCT/CN2012/081805 2011-09-26 2012-09-24 无卡终端的业务访问方法及设备 WO2013044766A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110287756.5 2011-09-26
CN201110287756.5A CN103024735B (zh) 2011-09-26 2011-09-26 无卡终端的业务访问方法及设备

Publications (1)

Publication Number Publication Date
WO2013044766A1 true WO2013044766A1 (zh) 2013-04-04

Family

ID=47972772

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/081805 WO2013044766A1 (zh) 2011-09-26 2012-09-24 无卡终端的业务访问方法及设备

Country Status (2)

Country Link
CN (1) CN103024735B (zh)
WO (1) WO2013044766A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104244241B (zh) * 2013-06-08 2019-03-12 中兴通讯股份有限公司 接入网络的认证方法、装置与终端设备
CN104348801B (zh) * 2013-07-31 2018-05-04 华为技术有限公司 认证方法、生成信任状的方法及相关装置
CN104735606B (zh) * 2015-02-10 2019-03-05 惠州Tcl移动通信有限公司 基于可穿戴设备的通信方法及系统
CN105554751B (zh) * 2015-08-19 2019-06-11 宇龙计算机通信科技(深圳)有限公司 一种无卡终端注册移动网络的方法、设备及系统
CN107623668A (zh) * 2016-07-16 2018-01-23 华为技术有限公司 一种网络认证方法、相关设备及系统
CN111162901B (zh) * 2019-12-11 2022-05-27 上海邮电设计咨询研究院有限公司 非sim终端的应用共享密钥获取方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009111522A1 (en) * 2008-03-04 2009-09-11 Alcatel-Lucent Usa Inc. System and method for securing a base station using sim cards
CN102111759A (zh) * 2009-12-28 2011-06-29 中国移动通信集团公司 一种认证方法、系统和装置
CN102149079A (zh) * 2010-02-08 2011-08-10 中国移动通信集团公司 一种获取用户身份标识的方法、装置和系统
CN102196426A (zh) * 2010-03-19 2011-09-21 中国移动通信集团公司 一种接入ims网络的方法、装置和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009111522A1 (en) * 2008-03-04 2009-09-11 Alcatel-Lucent Usa Inc. System and method for securing a base station using sim cards
CN102111759A (zh) * 2009-12-28 2011-06-29 中国移动通信集团公司 一种认证方法、系统和装置
CN102149079A (zh) * 2010-02-08 2011-08-10 中国移动通信集团公司 一种获取用户身份标识的方法、装置和系统
CN102196426A (zh) * 2010-03-19 2011-09-21 中国移动通信集团公司 一种接入ims网络的方法、装置和系统

Also Published As

Publication number Publication date
CN103024735B (zh) 2015-07-01
CN103024735A (zh) 2013-04-03

Similar Documents

Publication Publication Date Title
KR102018971B1 (ko) 네트워크 액세스 디바이스가 무선 네트워크 액세스 포인트를 액세스하게 하기 위한 방법, 네트워크 액세스 디바이스, 애플리케이션 서버 및 비휘발성 컴퓨터 판독가능 저장 매체
US10638321B2 (en) Wireless network connection method and apparatus, and storage medium
US10411884B2 (en) Secure bootstrapping architecture method based on password-based digest authentication
EP2604017B1 (en) System and method for cognizant transport layer security
US8769289B1 (en) Authentication of a user accessing a protected resource using multi-channel protocol
US8527759B2 (en) IMS user equipment, control method thereof, host device, and control method thereof
US20170054707A1 (en) Method and Apparatus for Trusted Authentication and Logon
KR101309426B1 (ko) 모바일 네트워크에서 재귀 인증을 위한 방법 및 시스템
US20150319156A1 (en) Independent identity management systems
CN1929371B (zh) 用户和外围设备协商共享密钥的方法
US11736304B2 (en) Secure authentication of remote equipment
CN102685749B (zh) 面向移动终端的无线安全身份验证方法
US9608971B2 (en) Method and apparatus for using a bootstrapping protocol to secure communication between a terminal and cooperating servers
MX2008012363A (es) Certificacion de una aplicacion.
WO2012058896A1 (zh) 单点登录方法及系统
WO2022143030A1 (zh) 基于国密标识密码算法的私钥分发系统
WO2013044766A1 (zh) 无卡终端的业务访问方法及设备
JP2016519873A (ja) 汎用ブートストラッピングアーキテクチャを用いてセキュアな音声通信を確立する方法
US20090136043A1 (en) Method and apparatus for performing key management and key distribution in wireless networks
CN113676468B (zh) 一种基于消息验证技术的三方增强认证系统设计方法
CN116633612A (zh) 云手机登录方法、装置、存储介质及电子设备
TWI514189B (zh) 網路認證系統及其方法
CN113727057A (zh) 多媒体会议终端入网认证方法、装置、设备及存储介质
WO2020037958A1 (zh) 基于gba的客户端注册和密钥共享方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12836166

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12836166

Country of ref document: EP

Kind code of ref document: A1