WO2013056619A1

WO2013056619A1 - Method, idp, sp and system for identity federation

Info

Publication number: WO2013056619A1
Application number: PCT/CN2012/082471
Authority: WO
Inventors: 夏正雪; 郝振武; 张孟旺
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-10-19
Filing date: 2012-09-29
Publication date: 2013-04-25
Also published as: CN103067337A; CN103067337B

Abstract

The embodiments of the invention disclose a method, an IdP, an SP and a system for identity federation, so that the provider is able to provide single sign-in services for users. The method comprises: when a UE is accessing a service provided by the SP, the IdP located in the network of the provider determines that the identification of the UE is finished, and then generates an UE ID in the IdP for the UE, associates the UE ID in the IdP with the ID of the SP, generates an acknowledgement and sends the acknowledgement to the SP; the SP receives the acknowledgement and validates the legality of the acknowledgement, then checks that an associated local account is not existed, and initiates a challenge of requiring sign-in to UE. After the UE finishes the sign-in, the SP associates the local UE ID in the SP and the ID of the IdP with the UE ID in the IdP.

Description

Method for identity association, IdP, SP and system

Technical field

The present invention relates to the field of network communications, and in particular, to a method for identity association, an IdP, an SP, and a system.

Background technique

In the TCP/IP system, the core of the network layer is the IP protocol at the network layer, which enables mutual access between users through IP addresses. Various applications, such as web browsing, mail sending and receiving, instant messaging, etc., are carried on top of the application layer protocol.

Before using these services, users must access the Internet through the basic network provided by the telecom operators. Different users may have different access methods, such as xDSL, optical fiber, mobile access, and so on. In general, the user terminal will obtain an IP address, and the user then accesses various applications on the Internet through the IP address, which is equivalent to the temporary identity of the user.

Since the prefix part of the IP address indicates the subnet where the user is currently located, when the user's location changes, different IP addresses must be assigned. Otherwise, the router cannot correctly forward the data packet to the user. Because the IP address has the dual attributes of identity and location, and the IP address obtained by the user is not necessarily the same every time, and thus cannot be used as the long-term identity of the user, the application system on the Internet must establish a user identity identification system. This is the so-called user account system.

It can be seen that there is a secondary authentication when the user accesses the application on the Internet, and the operator performs authentication once when the user accesses the Internet, and the application system on the Internet performs its own authentication when the user accesses.

With the rapid development of information technology and network technology, there are more and more application systems on the Internet. Since these applications are independent of each other, users must register before using each system and log in according to their respective identities. For this reason, users must remember the username and password of each application system, which brings a lot of users. Big trouble. Summary of the invention The embodiments of the present invention provide a method for identity association, an IdP, an SP, and a system, so that an operator can provide a single sign-on service for a user.

The method for identity association provided by the embodiment of the present invention includes:

In the service process provided by the UE to access the service providing server (SP), the identity providing server (IdP) located in the operator network generates an identity of the IdP for the UE after confirming that the terminal passes the authentication, and associates the identity of the UE with the IdP. Identification and SP identity, generate a positive assertion sent to the SP;

After receiving the positive assertion and verifying the validity of the SP, the SP checks whether the associated local account is not present, and then initiates a challenge to the UE. After the UE successfully logs in, the SP identifies the identity of the UE in the SP and the identity of the IdP. The identity, and the identity of the UE in the IdP are associated.

Preferably, the identity of the UE generated by the IdP at the IdP is a permanent identity or a temporary identity.

Preferably, when the identity of the IdP is a temporary identity, the IdP further generates a lifetime for the temporary identity.

Preferably, after the IdP confirms that the UE passes the authentication, generating, by the UE, the identity of the terminal user in the IdP includes:

After the IdP confirms that the UE passes the authentication, it actively generates an identity identifier of the terminal user at the IdP for the UE; or

The IdP establishes a security association with the SP, and confirms that after the UE passes the authentication, after receiving the authentication request sent by the SP, the identity of the IdP is generated for the UE.

Preferably, before the SP initiates a challenge to the user to request login, the method further includes:

The SP first asks whether the UE is willing to associate with the local account, and after the UE agrees, initiates a challenge to the UE to request login.

Preferably, before the IdP confirms that the UE passes the authentication, the method further includes: after the UE performs access authentication with the access service node (ASR) and the authentication center, generating a master session key with the ASR; When the terminal performs authentication, the UE is authenticated by the access identifier of the UE and the primary session key. Preferably, the authentication request sent by the SP includes a random number, and the random number is used to temporarily identify the identity information of the UE in the SP and used to prevent replay attacks.

Preferably, the IdP actively generates an identity of the IdP for the UE, and generates a positive assertion sent to the SP, where the positive assertion includes a random number, and the random number is used to prevent a replay attack.

Preferably, when the UE accesses the service provided by the SP again, the IdP does not interact with the UE for authentication, and the SP no longer requests the UE to log in.

An identity providing server (IdP) for implementing identity federation is provided by the embodiment of the present invention. The IdP is located in an operator network, and includes an authentication module, an identity identifier generating module, an association module, and an assertion generating module, where:

The authentication module is configured to confirm whether the UE passes the authentication process during the service provided by the UE accessing the service providing server (SP);

The identity identifier generating module is configured to: after the authentication module confirms that the UE passes the authentication, generate an identity of the IdP for the UE;

The association module is configured to associate an identity of the UE with the IdP and an identity of the SP; the assertion generation module is configured to generate a positive assertion and send the SP to the SP.

Preferably, the identifier of the IdP generated by the identity identifier generating module for the UE is a permanent identity identifier; or

The identifier generated by the identity identifier generating module for the UE in the IdP is a temporary identity, and the lifetime of the temporary identity is generated.

Preferably, the identity identifier generating module is configured to: after the authentication module confirms that the terminal passes the authentication in the following manner, generate an identity identifier of the terminal user in the IdP for the UE:

After the authentication module confirms that the UE passes the authentication, the identity generation module actively generates an identity of the IdP for the UE; or

The identity identifier generating module establishes a security association between the IdP and the SP, and confirms that after the UE passes the authentication, after receiving the authentication request sent by the SP, the identity identifier of the terminal user in the IdP is generated for the UE. Preferably, the authentication module is configured to authenticate the UE by: authenticating the UE by using an access identifier of the UE and a primary session key, where the primary session key is the UE and the access service node ( ASR) and the authentication center generated after access authentication.

Preferably, the affirmative assertion generated by the assertion generation module includes a random number, and the random number is used to prevent a replay attack.

The service providing server (SP) for implementing identity association provided by the embodiment of the present invention includes an authentication check module and an association module, where:

The authentication check module is configured to, after receiving the positive assertion sent by the identity providing server (IdP) and verifying the validity of the authentication, check whether the challenge of requesting login is sent to the UE if there is no associated local account;

The association module is configured to associate the identity of the UE in the SP, the identity of the IdP, and the identity of the UE in the IdP after the user successfully logs in.

Preferably, the authentication check module is further configured to ask the UE whether to associate with the local account before initiating the challenge of requesting the login to the UE, and after the UE agrees, initiate a challenge to the user to request login.

Preferably, the authentication check module is further configured to send an authentication request to the IdP after the IdP establishes a security association with the SP, where the authentication request includes a random number, and the random number is used to temporarily identify the identity information of the UE in the SP. Used to protect against replay attacks.

The system for implementing identity association provided by the embodiment of the present invention includes an identity providing server (IdP) and a service providing server (SP) located in an operator network, where:

The IdP is set to be used in the service process provided by the UE to access the SP, after the UE is authenticated, the identity of the terminal user in the IdP is generated for the UE, and the identity of the UE in the IdP and the identity of the SP are associated with the IdP. Generate a positive assertion sent to the SP;

The SP is configured to, after receiving the positive assertion and verifying the validity of the policy, check if the associated local account is not present, and then initiate a challenge requesting the login to the UE. After the UE successfully logs in, the SP sets the identity of the UE locally in the SP. Identification, IdP identity, and the identity of the UE in the IdP Line association.

The embodiment of the present invention deploys the IdP in the carrier network, and associates the identity of the user in the bearer layer of the operator with the identity of the user in the SP service layer, thereby implementing the identity of the user at the operator and the identity at the SP. The union between the logos. The identity of the user at the bearer layer of the operator may be a terminal identifier (such as IMSI, MSISDN, etc. in the mobile network), or an ADSL account in the fixed network. The embodiment of the present invention combines the identity association technology, so that the operator can provide the single sign-on service for the user, and the user can inherit the original account information. On the one hand, it improves security, on the other hand, it ensures the continuity of user services and improves the user experience.

BRIEF abstract

FIG. 1 is a schematic structural diagram of a network element according to an embodiment of the present invention;

2 is a schematic flowchart of a method for identity association according to Embodiment 1 of the present invention;

FIG. 3 is a schematic flowchart of a method for identity association initiated by an SP according to Embodiment 2 of the present invention; FIG. 4 is a schematic flowchart of a method for identity association initiated by an IdP according to Embodiment 3 of the present invention; FIG. 5 is a schematic diagram of an IdP and an SP according to Embodiment 4 of the present invention; Schematic diagram of the structure.

Preferred embodiment of the invention

Since the user naturally needs to access the carrier network before accessing the Internet application, the identity providing server can be deployed in the carrier network. It has the following advantages: Access authentication through the carrier network can ensure security. At the same time, the identity providing server IdP is deployed on the carrier network, which does not require users to re-register, is easy to use, and has high quality and mature. User consumer groups.

On the other hand, since the user may already have a registered account in a major different Internet application system, and the registered account already carries some information useful to the user, in this case, the user usually wants to be able to use the single sign-on technology in combination. In the case of convenience, continue to use the relevant information in the original account.

Therefore, when the identity providing server IdP in the identity management technology is deployed in the carrier network, The identity association technology can be used to temporarily or permanently associate the identity of the user in the bearer layer of the operator with the identity of the application account of the user in the Internet application system, so that the operator can provide the single sign-on service for the user, and the user can inherit the original Some account information improves security on the one hand, and ensures continuity of user services and improves user experience on the other hand.

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

FIG. 1 is a schematic structural diagram of a network element according to an embodiment of the present invention.

The network element 101 is a user equipment (UE), and the terminal accessing the network may be one or more of a mobile terminal and a fixed terminal, such as a mobile phone, a fixed telephone, a computer, and an application server;

The network element 102 is an access service router (ASR), which is used for providing access services for the user terminal, maintaining the connection between the terminal and the network, assigning a RID (Routing Identifier) to the terminal, and registering with the ILR/PTF. Register and query the RID of the terminal, maintain the AID (Access Identifier)-RID mapping information, and implement routing and forwarding of data packets.

The network element 103 is an authentication center, and is used for recording attribute information of the network terminal user, such as user category, authentication information, and user service level, and completing access authentication and authorization for the terminal, and may also have a charging function. The certificate authority supports two-way authentication between the terminal and the network, and can generate user security information for authentication, integrity protection, and confidentiality protection;

The network element 104 is an identity providing server (IdP), which provides an authentication assertion to the terminal user to the service providing server SP, and authenticates to the SP to check the legality of the SP. Query the corresponding attribute information of the terminal user through the interface with the authentication center, and map the server with the name.

The NMS interface provides the pseudonym service of the end user;

The network element 105 is an Interconnect Service Router (ISR), which is used for querying and maintaining AID-RID mapping information of the network terminal, encapsulating, routing, and forwarding data between the network and the traditional IP network. The interworking function between the network and the traditional IP network, including a format conversion module, for the network included in the data packet sent by the traditional IP network Converting the IPv4/IPv6 address of the terminal into a corresponding AID, and converting the AID of the network terminal into an IPv4/IPv6 address format, and then transmitting the terminal to the terminal of the traditional IP network;

The network element 106 is a Service Provider (SP), which is an application system for providing services to terminal users on the Internet.

For a detailed description of the identity providing server IdP and the service providing server SP, see Embodiment 4 and FIG.

Example 1

2 is a schematic flowchart of a method for identity association according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:

In the process of accessing the service provided by the SP, the terminal confirms that the terminal is authenticated by the IdP of the operator network, and generates an identity of the terminal user in the IdP for the terminal user, and associates the identity identifier of the terminal user with the IdP. The SP's identity, generated a positive assertion sent to the SP;

Specifically, the assertion includes the identity of the SP, the identity of the IdP, and the end user.

IdP's identity, as well as the authentication result (as long as the positive assertion is received, the terminal authentication is successful), the signature algorithm, the signature result, etc., the purpose is to tell the SP that the user or terminal has successfully passed the IdP authentication, which is trusted. And these identity information, SP can be used for subsequent local association processes. The above identity, signature information, etc. are for the SP to verify the integrity of the message, that is, the assertion message has not been tampered with or forged, and is a legal assertion message.

After the IdP associates the identity of the SP with the identity of the IdP, the IdP can no longer authenticate the next time the user accesses the service provided by the SP.

The generated end user's identity in the IdP can be either a permanent identifier or a temporary identifier. If it is a temporary identifier, it can also generate a lifetime for the temporary identity.

After the terminal accesses the service provided by the SP, the IdP can confirm that the terminal is authenticated, and the IdP can actively generate the identity of the terminal user in the IdP. Alternatively, the IdP can establish a security association with the SP during the service process provided by the terminal accessing the SP. After receiving the authentication request sent by the SP, the identity of the terminal user in the IdP is generated and associated. Step 202: After receiving the positive assertion and verifying the validity of the SP, the SP checks whether there is a related local account, and then initiates a challenge to the user to log in. After the user successfully logs in, the SP identifies the end user in the SP local identity. , the IdP identity, and the identity of the end user in the IdP.

After receiving the positive assertion and verifying its legality, the SP checks if there is an associated local account, and directly provides services for the user. Before checking whether there is no associated local account, the SP may first ask the user whether to associate with the local account before initiating the challenge of requesting the login. If the user agrees, the association is performed. If the user does not agree, the normal login process is performed. .

Through the above process, the association between the identity of the user at the operator and the identity of the identity at the SP is achieved. In this way, the operator can provide the single sign-on service for the user, and the user can inherit the original account information. After the association, when the user accesses the same SP, the IdP does not perform the mutual authentication process with the UE. After the local authentication is confirmed, the UE is redirected to the SP. The SP provides services for the UE according to the associated account information, and the UE is no longer required to perform the UE. log in. Users reduce the number of logins or no longer need to enter a username and password to log in, which improves security. On the other hand, due to the association, the continuity of the user's service is ensured, and the user experience is improved.

Example 2

FIG. 3 is a schematic diagram of the process of implementing Embodiment 2 initiated by the SP. As shown in FIG. 3, the following steps are included:

Step 301: The user terminal UE and the access service node ASR, and the authentication center perform access authentication. After the authentication is passed, the identity location separation network allocates an access identifier AID to the user.

Thereafter, the >3⁄4 text sent by the user terminal is transmitted through the AID, the ASR allocates the RID to the end user, and the routing is selected by the RID to find the ISR, and the ISR obtains the AID of the terminal user from the ^艮 text, and converts it into an IPv4/IPv6 address. To the traditional IP network.

Step 302: The UE and the ASR derive a primary session key MSK according to the user access authentication, and are used for subsequent terminal authentication.

Step 303: The UE initiates a service access request to the SP.

Step 304: The SP acquires a corresponding IdP address, and generates an authentication request message. Note that the manner of obtaining the IdP address can be implemented by a UE selection or an IdP discovery mechanism or the like. Step 305: The SP establishes a security association (SA) between itself and the IdP, and the two parties generate a shared key for subsequent positive assertion message signature and verification;

Step 306: The SP redirects the authentication request message to the IdP, where the redirection message includes an authentication request assertion, and the assertion includes an SP identity identifier, an IdP identity identifier, and a random number nonce;

The random number nonce is used to temporarily identify the identity information of the user in the SP and to prevent replay attacks.

Step 307: The IdP authenticates the terminal UE by using the terminal identifier AID and the master session key MSK.

Since the IdP and the ASR are in the same identification domain, the primary session key MSK can be securely obtained from the ASR.

In addition, since the session key (e.g., confidentiality key CK/integrity key IK) is negotiated between the UE and the network through access authentication, communication between the UE and the IdP is protected.

Step 308: The IdP confirms that the terminal passes the authentication, and generates the temporary identity (or permanent identity) UEidp of the terminal user, and the terminal identifier (such as AID, MSISDN, etc.), SP identity (identity), and IdP generated terminal user. The temporary identity UEidp of the IdP is associated (as shown in the following table), and a signed SAML positive assertion is generated;

Note: If UEidp is the terminal permanent identifier, the lifetime field value is null.

Step 309: The IdP redirects the SAML positive assertion to the SP, and the IdP identity identifier, the temporary identity of the terminal user in the IdP, the UEidp, the lifetime, the identity of the SP, and the random number nonce;

Step 310: The SP checks that the SAML asserts the validity of the assertion. After the verification is passed, it checks whether the UEidp has an associated SP local user account on the SP. If not, the user is prompted whether to associate the account number. If the association is required, the user is required to log in;

The checking process is as follows: 1) The random number nonce, whether the SP identity and the IdP identity are consistent with the identity of the requesting authentication; 2) whether the random number nonce is repeatedly received; 3) by signature Verify that the assertion message itself has been tampered with. If the above checks pass, then confirm that the assertion message is validated. Otherwise 3 failed.

Step 311: The SP initiates a challenge requesting login to the user terminal.

Step 312: The user terminal initiates a user login response to the SP, and the response may be a login mode such as a username/password or a token.

Step 313: After the user successfully logs in, the SP associates the IdP identity identifier, the identity identifier of the terminal user on the SP, and the temporary identity identifier of the terminal user on the IdP (as shown in the following table);

Step 314: The SP returns a service access response to the user terminal. Thereafter, during the lifetime of the life, the terminal that logs in through the IdP does not need to re-enter the username/password, or token, etc. in the SP, and can directly use the original account. Operation, etc.

Example 3

FIG. 4 is a schematic diagram of the process of implementing Embodiment 2 initiated by the SP. As shown in FIG. 4, the following steps are included:

Step 401: The user terminal UE and the access service node ASR, and the authentication center perform access authentication. After the authentication is passed, the identity location separation network allocates an access identifier AID to the user.

Thereafter, the >3⁄4 text sent by the end user is transmitted by the AID, the ASR allocates the RID to the end user, and the routing is selected by the RID to find the ISR, and the ISR obtains the AID of the terminal user from the ^艮 text, and converts it into an IPv4/IPv6 address. To the traditional IP network.

Step 402: The UE and the ASR derive a primary session key MSK according to the user access authentication.

Step 403: The UE initiates a service access request to the IdP.

Step 404: The UE selects an SP to be accessed on an interface provided by the IdP.

Step 405: A security association is established between the IdP and the SP, and the two parties generate a shared key for subsequently performing a positive disconnection message signature.

Step 406: The IdP recognizes the terminal UE by using the terminal identifier AID and the master session key MSK. Certificate

Step 407: The IdP confirms that the terminal passes the authentication, and generates the temporary identity (or permanent identity) UEidp of the terminal user in the IdP, and the terminal identifier (such as AID, MSISDN, etc.), the SP identity, and the terminal user on the IdP. The temporary or permanent identity UEidp is associated (as shown in the following table) and produces a signed SAML positive assertion;

Step 408: The IdP redirects the SAML positive assertion to the SP, and the IdP identity identifier, the temporary identity of the terminal user on the IdP, the UEidp, the lifetime, the SP identity, and the random number nonce;

The random number in this embodiment is generated by IdP. Since the identity of the UE or the user is carried in the assertion, the random number in this embodiment is only used to let the SP determine whether the message is used by the attacker for the replay attack by whether the received random number is repeated.

Step 409: The SP checks that the SAML asserts the validity of the assertion. After the verification is passed, it checks whether the UEidp has an associated SP local user account on the SP. If not, the user is prompted to associate the account number. If the association is required, the user is required to log in.

The checking process is as follows: 1) Whether the SP identity, the IdP identity and the SP and IdP identity stored on the SP are consistent; 2) whether the random number nonce is repeatedly received; 3) verifying by the signature that the message itself has been tampered with, if If the check passes, then confirm that the assertion message is verified. Otherwise the verification fails.

Step 410: The SP initiates a challenge requesting login to the user terminal.

Step 411: The user terminal initiates a user login response to the SP, and the response may be a login mode such as a username/password or a token;

Step 412: After the user successfully logs in, the SP identifies the IdP identity and the end user on the SP. The identity and the temporary identity of the end user on the IdP are associated (as shown in the following table);

Step 413: The SP returns a service access response to the user terminal. Thereafter, during the lifetime of the life, the terminal that logs in through the IdP does not need to re-enter the username/password, or token, etc. in the SP, and can directly use the original account. Operation, etc.

Example 4

This embodiment introduces IdP and SP implementing the above method, and a system including the IdP and SP. As shown in FIG. 5, the system for implementing identity aggregation includes an identity providing server (IdP) and a service providing server (SP) located in a carrier network, where:

The IdP is used in the service process provided by the terminal to access the SP. After confirming that the terminal passes the authentication, the terminal identifies the identity of the terminal user in the IdP, and associates the identity identifier of the terminal user with the identity of the SP and the identity of the SP. , generating a positive assertion sent to the SP;

The SP is configured to: after receiving the positive assertion and verifying the validity of the policy, if the local account is not associated, the user is required to initiate a login request. After the user successfully logs in, the SP identifies the terminal user in the local state of the SP. The identity, the identity of the IdP, and the identity of the end user in the IdP are associated.

Specifically, the IdP includes an authentication module, an identity generation module, a first association module, and a assertion generation module, where: the authentication module is configured to confirm, in the service process provided by the terminal, whether the terminal passes the authentication;

The identity generation module is configured to: after the authentication module confirms that the terminal passes the authentication, generate an identity of the terminal user in the IdP for the terminal user;

The first association module is configured to associate the identity identifier of the terminal user with the ID of the SP and the identity of the SP;

The assertion generation module is set to generate a positive assertion and send to the SP. Preferably, the identity identifier generated by the identity identifier generating module for the terminal user is a permanent identity identifier of the terminal user in the IdP; or the identity identifier of the terminal user generated by the terminal user in the IdP is a temporary identity identifier, and Generate the lifetime of the temporary identity.

Preferably, the identity identifier generating module is configured to: after the authentication module confirms that the terminal passes the authentication in the following manner, generate an identity identifier of the terminal user in the IdP for the terminal user: after the authentication module confirms that the terminal passes the authentication, actively The terminal user generates the identity of the terminal user in the IdP; or, after the IdP establishes a security association with the SP, and confirms that the terminal passes the authentication, after receiving the authentication request sent by the SP, the terminal user is generated for the terminal user at the IdP. Identity.

Preferably, the authentication module is configured to authenticate the terminal in the following manner: authenticating the terminal by using an access identifier of the terminal and a primary session key, where the primary session key is a terminal and an access service node (ASR) And generated by the certification center after access authentication.

Preferably, the positive assertion generated by the assertion generation module includes a random number for preventing replay attacks.

The SP includes an authentication check module and a second association module, where:

The authentication check module is configured to: after receiving the positive assertion sent by the IdP and verifying that the legality is passed, checking that if there is no associated local account, the user is required to initiate a login request; the second association module is set to After the user logs in successfully, the identity of the end user in the SP, the identity of the IdP, and the identity of the terminal user in the IdP are associated.

Preferably, the authentication check module is further configured to ask the user whether to associate with the local account before initiating the challenge of requesting the login to the user, and after the user agrees, initiate a challenge requesting the login to the user.

Preferably, the authentication check module is further configured to send an authentication request to the IdP after the IdP establishes a security association with the SP, where the authentication request includes a random number, and the random number is used to temporarily identify the identity information of the user in the SP. For protection against replay attacks.

One of ordinary skill in the art can understand that all or part of the above steps can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, such as read only. Memory, disk or disc, etc. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

It is a matter of course that the invention may be embodied in various other forms and modifications without departing from the spirit and scope of the invention.

Industrial Applicability The embodiment of the present invention combines the identity association technology, so that the operator can provide the single sign-on service for the user, and the user can inherit the original account information. On the one hand, it improves security, on the other hand, it ensures the continuity of user services and improves the user experience.

Claims

Claim

1. A method of identity association, comprising:

The user terminal (UE) accesses the service provided by the service providing server (SP), and the identity providing server (IdP) located in the operator network generates an identity of the IdP for the UE after confirming that the UE passes the authentication. The identity identifier of the UE in the IdP and the identity of the SP are generated and sent to the SP by a certain assertion;

2. The method of claim 1 wherein:

The identity of the UE generated by the IdP at the IdP is a permanent identity or a temporary identity.

3. The method of claim 2, wherein:

When the identity of the IdP is a temporary identity, the IdP also generates a lifetime for the temporary identity.

4. The method of claim 1 or 2 or 3, wherein:

After the IdP confirms that the UE is authenticated, generating the identity of the IdP for the UE includes: after the IdP confirms that the UE passes the authentication, actively generating an identity of the IdP for the UE; or

5. The method of claim 1 or 2 or 3, wherein:

Before the SP initiates a challenge to the UE to request login, the method further includes:

6. The method of claim 1 or 2 or 3, wherein:

Before the IdP confirms that the UE passes the authentication, the method further includes: the UE and the access service node (ASR) And the authentication center performs the access authentication, and generates a master session key with the ASR. When the IdP authenticates the UE, the IdP authenticates the UE by using the access identifier of the UE and the primary session key.

7. The method of claim 4, wherein:

The authentication request sent by the SP includes a random number, where the random number is used to temporarily identify the UE in the

SP identity information and used to prevent replay attacks.

8. The method of claim 4, wherein:

The IdP actively generates an identity of the IdP for the UE, generates a positive assertion and sends it to the SP, and the affirmative assertion includes a random number, and the random number is used to prevent a replay attack.

9. The method of claim 1 or 2 or 3, wherein:

When the UE accesses the service provided by the SP again, the IdP does not interact with the UE for authentication, and the SP no longer requests the UE to log in.

An identity providing server (IdP) for implementing identity federation, where the IdP is located in an operator network, including an authentication module, an identity generating module, an associating module, and an assertion generating module, where: the authentication module is set to: The terminal (UE) accesses the service provided by the service providing server (SP) to confirm whether the UE passes the authentication;

The association module is configured to: associate an identity of the UE with the IdP and an identity of the SP; the assertion generation module is configured to: generate a positive assertion and send to the SP.

11. The identity providing server of claim 10, wherein:

The identity identifier generated by the identity identifier generating module for the UE is a permanent identity identifier of the IdP or

The identity identifier generated by the identity identifier generating module for the UE is a temporary identity identifier, and generates a lifetime of the temporary identity identifier.

12. An identity providing server according to claim 10 or 11, wherein:

The identity generation module is configured to confirm that the UE passes the authentication module in the following manner After authentication, the identity of the IdP is generated for the UE:

The identity identifier generating module establishes a security association between the IdP and the SP, and confirms that after the UE passes the authentication, after receiving the authentication request sent by the SP, the identity identifier of the IdP is generated for the UE.

13. An identity providing server according to claim 10 or 11, wherein:

The authentication module is configured to authenticate the UE by: authenticating the UE by using an access identifier of the UE and a primary session key, where the primary session key is a UE and an access service node (ASR) and authentication Generated after the center performs access authentication.

14. The identity providing server of claim 12, wherein:

The affirmative assertion generated by the assertion generation module includes a random number, and the random number is used to prevent a replay attack.

15. A service providing server (SP) for implementing identity federation, comprising an authentication check module and an associated module, wherein:

The authentication check module is configured to: after receiving the positive assertion sent by the identity providing server (IdP) and verifying the validity of the authentication, check if there is no associated local account, and then send a challenge to the UE requesting login;

The association module is configured to: after the user terminal (UE) successfully logs in, associate the identity of the UE in the SP, the identity of the IdP, and the identity of the UE in the IdP.

16. The service providing server according to claim 15, wherein:

The authentication check module is further configured to: before initiating a challenge requesting the login to the UE, first query the UE whether it is willing to associate with the local account, and after the UE agrees, initiate a challenge requesting the login to the UE.

17. The service providing server according to claim 15 or 16, wherein:

The authentication check module is further configured to: after the IdP establishes a security association with the SP, send an authentication request to the IdP, where the authentication request includes a random number, where the random number is used to temporarily identify the identity information of the UE in the SP and is used for preventing Replay attack.

18. A system for implementing identity federation, including an identity providing server located on a carrier network (IdP) and Service Provisioning Server (SP), where:

The IdP is set to: when the user terminal (UE) accesses the service provided by the SP, after confirming that the UE passes the authentication, generates an identity of the IdP for the UE, and associates the identity of the UE with the IdP and the identity of the SP. , generating a positive assertion sent to the SP;

The SP is set to: after receiving a positive assertion and verifying that the legality is passed, checking that if there is no associated local account, the UE is required to initiate a login challenge. After the UE successfully logs in, the SP sets the UE local to the SP. The identity, the identity of the IdP, and the identity of the UE in the IdP are associated.

19. The system of claim 18, wherein:

The IdP includes an authentication module, an identity generation module, a first association module, and an assertion generation module, where:

The authentication module is configured to: determine, in the service process provided by the UE accessing the SP, whether the UE passes the authentication;

The first association module is configured to: associate an identity identifier of the UE with the IdP and an identity identifier of the SP;

The assertion generation module is configured to: generate a positive assertion and send to the SP.

20. The system of claim 18 or 19, wherein:

The second association module is configured to: after the UE successfully logs in, associate the identity identifier of the UE in the SP, the identity of the IdP, and the identity of the UE in the IdP.