WO2014015759A1 - 一种终端身份验证和服务鉴权的方法、系统和终端 - Google Patents

一种终端身份验证和服务鉴权的方法、系统和终端 Download PDF

Info

Publication number
WO2014015759A1
WO2014015759A1 PCT/CN2013/079552 CN2013079552W WO2014015759A1 WO 2014015759 A1 WO2014015759 A1 WO 2014015759A1 CN 2013079552 W CN2013079552 W CN 2013079552W WO 2014015759 A1 WO2014015759 A1 WO 2014015759A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
user
service provider
code
unique code
Prior art date
Application number
PCT/CN2013/079552
Other languages
English (en)
French (fr)
Inventor
蒋晓
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to CA2879910A priority Critical patent/CA2879910C/en
Priority to EP13823645.0A priority patent/EP2879421B1/en
Priority to US14/417,024 priority patent/US9445269B2/en
Publication of WO2014015759A1 publication Critical patent/WO2014015759A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present invention relates to information security technologies in mobile communication systems, and in particular, to a method, system and terminal for terminal identity authentication and service authentication. Background technique
  • the traditional mobile communication terminal security strategy mainly focuses on the single-host domain, that is, the mobile communication terminal security policy of a single user single host, that is, the user performs security management on the terminal device held by the individual.
  • the above security policies mainly include: User terminal device legality, such as: The user sets the power-on password for the terminal, so that the illegal user cannot be turned on; the function usage rights management, for example: restricting browsing of information stored in the terminal device, and encrypting the privacy information, For example: Encrypting documents, etc. Local security management.
  • These security policies do not involve the wireless delivery of user information, user identification, and service provider authentication of services submitted by users.
  • the main purpose of the embodiments of the present invention is to provide a method, a system, and a terminal for terminal identity authentication and service authentication, so as to ensure the security of the personal privacy information of the terminal user, and prevent malicious interception during wireless transmission. .
  • a method for terminal identity authentication and service authentication comprising:
  • the user unique code is generated according to the user specific information in the SIM card, and the name of the user specific information is encrypted, and sent to the trusted cloud control center together with the user unique code;
  • the service provider generates a unique code according to its specific information, and sends the encrypted name of the specific information to the trusted cloud control center together with the generated unique code;
  • the trusted cloud control center authenticates the terminal and the service provider according to the unique code, and determines that both authentication codes are passed, and the communication code is sent to the terminal and the service provider, and the two communicate according to the communication code to complete the current operation. Good service.
  • the generating process of the user unique code is: the terminal uses a hash algorithm to calculate user specific information in the SIM card, and generates a user unique code; the user specific information in the SIM card is: SIM card storage A subset of the various user-specific information collections.
  • the encrypting the name of the user-specific information is: encrypting the name of the user-specific information by using a personal identification code PIN.
  • the trusted cloud control center authenticates the terminal and the service provider according to the unique code, and is:
  • the trusted cloud control center decrypts the name of the user-specific information sent by the terminal, finds the corresponding user-specific information from its own storage server according to the name of the user-specific information obtained by the decryption, and generates a corresponding character by using a hash algorithm. a string; comparing the calculated string with a user unique code sent by the terminal, and if the comparison result is the same, indicating that the terminal is authenticated Passed; otherwise, the authentication failed;
  • the trusted cloud control center generates a corresponding character string by using a hash algorithm according to the name of the specific information of the service provider obtained by decryption, and compares the string with the unique code sent by the service provider, if If the comparison result is the same, it means that the authentication is passed; otherwise, the authentication fails.
  • the communication code comprises: a one-time key and a digital certificate.
  • the method further includes: after the service is completed, the terminal notifies the service provider and the trusted cloud control center to delete the communication code and the unique code, that is, notify the service provider to delete the communication code and its own unique code;
  • the letter cloud control center deletes the communication code and the unique code of the terminal and service provider.
  • a system for terminal identity authentication and service authentication comprising: a terminal, a service provider, and a trusted cloud control center; wherein
  • the terminal After the terminal is configured to initiate a service request, generate a user unique code according to user-specific information in the SIM card, and encrypt the name of the user-specific information, and send it to the trusted cloud control center together with the unique code of the user. ;
  • the service provider is configured to generate a unique code according to its specific information, and send the encrypted name of the specific information to the trusted cloud control center together with the generated unique code;
  • the trusted cloud control center configured In order to authenticate the terminal and the service provider according to the unique code, and determine that both authentications are passed, the communication code is sent to the terminal and the service provider, and the two communicate according to the communication code to complete the service.
  • the terminal is further configured to notify the service provider and the trusted cloud control center to delete the communication code and the unique code after the service is completed, that is, notify the service provider to delete the communication code and its own unique code, and notify the The letter cloud control center deletes the communication code, and the unique code of the terminal and the service provider; correspondingly,
  • the service provider is further configured to delete the communication code after receiving the notification from the terminal. And its own unique code;
  • the trusted cloud control center is further configured to: after receiving the notification from the terminal, delete the communication code, and the unique code of the terminal and the service provider.
  • a terminal configured to generate a user unique code according to user-specific information in the SIM card after the service request is initiated, and encrypt the name of the user-specific information, and send the same with the unique code of the user.
  • the terminal is further configured to notify the service provider and the trusted cloud control center to delete the communication code and the unique code after the service is completed, that is, notify the service provider to delete the communication code and its own unique code, and notify the trusted cloud control.
  • the center deletes the communication code, as well as the unique code of the terminal and service provider.
  • the method, system and terminal for terminal identity authentication and service authentication provided by the embodiment of the present invention, after the terminal initiates a service request, the user unique code is generated according to the user specific information in the SIM card, and the name of the user specific information is encrypted. And sending the unique code to the trusted cloud control center together with the user unique code; the service provider generates a unique code according to the specific information of the user, and sends the encrypted name of the specific information together with the generated unique code to the trusted cloud control.
  • the trusted cloud control center authenticates the terminal and the service provider according to the unique code, and determines that both authentication codes are passed, and the communication code is sent to the terminal and the service provider, and the two communicate according to the communication code to complete the present Secondary service.
  • the user unique code is generated by using the information carried by the existing SIM card without increasing the existing terminal resources of the user, and the calculation method of the unique code is a hash algorithm, because the algorithm is irreversible, even if the malicious user intercepts The unique code, he can not get any valuable information from it, to ensure that the user information is safe and not impersonated.
  • the communication code encrypts the communication data of both the terminal and the service provider, and the security of the terminal user and the service provider information is also ensured.
  • the method of obtaining a word certificate, completing a digital signature, and the like requires a specific hardware device to support.
  • the embodiment of the present invention relies on the user terminal, the service provider, and the trusted cloud control center to communicate with each other, and does not need to be performed.
  • the user additionally purchases new hardware devices, therefore,
  • the implementation method of the embodiment of the invention can reduce the consumption cost of the user.
  • the terminal After the service is completed, the terminal notifies the service provider and the trusted cloud control center to delete the communication code and the unique code, which further ensures the security of the terminal and the service provider information.
  • FIG. 1 is a schematic flowchart of a method for implementing terminal authentication and service authentication according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a system for terminal identity verification and service authentication according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a service provider according to an embodiment of the present invention. Schematic diagram of the structure of the embodiment;
  • FIG. 4 is a schematic structural diagram of an embodiment of a trusted cloud control center according to an embodiment of the present invention. detailed description
  • the user unique code is generated according to the user specific information in the SIM card, and the name of the user specific information is encrypted, and sent to the trusted cloud together with the unique code of the user.
  • the control center generates a unique code according to its specific information, and sends the encrypted name of the specific information to the trusted cloud control center together with the generated unique code; the trusted cloud control center is based on the unique code pair terminal and
  • the service provider performs authentication and determines that both authentications are passed, the communication code is sent to the terminal and the service provider, and the two communicate according to the communication code to complete the service.
  • the terminal notifies the service provider and the trusted cloud control center to delete the communication code and the unique code.
  • the name of the user specific information is encrypted by using a Personal Identification Number (PIN);
  • the communication code includes: a one-time key and a digital certificate.
  • FIG. 1 is a schematic flowchart of a method for implementing terminal identity verification and service authentication according to an embodiment of the present invention. As shown in FIG. 1 , the implementation steps of the process are as follows: Step 101: After the terminal initiates the service request, the user unique code is generated according to the user specific information in the SIM card, and the name of the user specific information is encrypted, and then sent to the trusted cloud control center together with the user unique code;
  • the terminal initiates a service request to the service provider, according to user-specific information in the SIM card, such as: PIN, International Mobile Subscriber Identity (IMSI), authentication key (KI), and mobile subscriber temporary identifier (TMSI) And so on, use the hash algorithm to generate the user unique code.
  • the user-specific information is based on a subset of various user-specific information sets stored in the SIM card, that is, includes a part of the information stored in the SIM card, and the terminal user can select the application through the application provided by the service provider.
  • the type and number of information in the sub-set for example:
  • This function algorithm may use a hash algorithm, but is not limited to this algorithm.
  • the hash algorithm is preferred because the algorithm is irreversible, and even if a malicious user intercepts the unique code, he cannot obtain any valuable information from it, ensuring that the user information is safe and not impersonated.
  • the hash algorithm is unique. As long as the number of elements or elements in the subset changes, the user will get a different unique code. This ensures that the malicious person cannot falsify the user unique code by tampering with the user-specific subset of information and using the same hashing algorithm.
  • the novel unique code based on the user-specific information in the SIM card of the embodiment of the present invention serves as an important information of the security policy process, and ensures that the user identity is not impersonated, and the user information is not tampered with.
  • the user can regenerate a unique code, that is: each time selects a different combination manner from the user specific information selection interface described above to generate a new subset of the user specific information, and then Using this subset as the object of the hash algorithm calculation, a one-time user unique code is obtained.
  • This user unique code is random.
  • the user's unique code Produce independent of the terminal device, you can use the same SIM card to complete the services on different terminal devices.
  • the name of the user-specific information is encrypted by using the PIN, and sent to the trusted cloud control center together with the unique code of the user.
  • the name of the user-specific information corresponds to the user-specific information selected when the user unique code is generated, that is, if the user-specific information subset includes three user-specific information, the user-specific information to be encrypted here
  • the name is also three.
  • the user-specific information is a specific value, such as:
  • the IMSI value is a 15-digit decimal number
  • the name of the user-specific information is IMSI itself.
  • the name of the user-specific information is sent to the trusted cloud control center, which is used for subsequent authentication by the trusted cloud control center;
  • the encryption algorithm for the name of the user-specific information is an existing encryption algorithm, and the terminal and the The algorithm has been negotiated by the Trusted Cloud Control Center.
  • Step 102 The service provider generates a unique code according to the specific information of the service provider, and sends the encrypted name of the specific information to the trusted cloud control center together with the generated unique code;
  • the service provider generates its own unique code according to specific information that has been registered in the trusted cloud control center, such as ID and QR code, and the generation process is the same as the process of generating the unique code of the user, and also uses Hash algorithm, not detailed here. Similarly, the service provider needs to encrypt the name of its specific information and send it to the trusted cloud control center along with the generated unique code.
  • Step 103 The trusted cloud control center authenticates the terminal and the service provider according to the unique code, and determines that when both authentications are passed, the communication code is sent to the terminal and the service provider, and the two communicate according to the communication code to complete This service;
  • the trusted cloud control center decrypts the name of the user-specific information sent by the terminal, finds the corresponding user-specific information from the storage server according to the name of the user-specific information obtained by the decryption, and uses the same hash algorithm. A corresponding character string is generated, and the calculated character string is compared with the user unique code sent by the terminal. If the comparison result is the same, it indicates that the terminal authentication is passed; otherwise, the authentication fails.
  • the weight process is the same as the terminal authentication process, that is: according to the name of the specific information obtained by decryption, a hash algorithm is used to generate a corresponding string, and the string is compared with the unique code sent by the service provider, if If the comparison result is the same, it means that the authentication is passed; otherwise, the authentication fails.
  • the trusted cloud control center determines that the authentication of the terminal and the service provider is passed, the communication code of the service is separately sent to the terminal and the service provider, and the terminal and the service provider communicate with each other according to the communication code to complete This service.
  • the information includes but is not limited to: a one-time key and a digital certificate.
  • information sent by the terminal and the service provider to each other needs to be encrypted by using a one-time key in the communication code.
  • the one-time key in the communication code may also be one-time, which can ensure the security of the user information and prevent the user information from being maliciously falsified.
  • the end user can also ensure that the service provider's service is authenticated, as described in the following embodiments.
  • the embodiment of the present invention further includes the step 104: after the service is completed, the terminal notifies the service provider and the trusted cloud control center to delete the communication code and the unique code;
  • the service provider and the trusted cloud control center may be notified to delete the communication code and the unique code of the service, that is, the service provider deletes the service.
  • the communication code and its own unique code; the trusted cloud control center deletes the communication code of the current service and the unique code of both the terminal and the service provider. This step further ensures the security and privacy of user information.
  • Step 1 The user terminal enters the application interface provided by the bank to initiate a service process, selects a plurality of user-specific information stored in the SIM card in the bank selection interface, and calculates a user unique code through a hash algorithm; encrypts the user-specific information with the PIN The name, send the two together to the trusted cloud control center, and send the service request information to the bank.
  • Step 2 After receiving the service request information sent by the terminal, the bank uses the same as step one.
  • the hash algorithm obtains the unique code of the bank based on the specific information registered in the Trusted Cloud Control Center, encrypts the name of the specific information, and sends the unique code and the name of the encrypted specific information to the trusted cloud control center.
  • Step 3 The trusted cloud control center obtains the name of the user-specific information and the name of the bank-specific information according to the decryption, finds the specific information from its own storage server, and obtains the characters of the corresponding terminal and the bank by using the same hash algorithm. String, if the corresponding string is the same as the unique code of the terminal and the bank, it is determined that the two are legal, and the one-time key and the digital certificate for encrypting the service information are sent to the terminal and the bank respectively.
  • Step 4 After the terminal receives the pass code, the user performs digital signature, and the terminal sends the digital signature of the user to the bank;
  • the terminal also sends the digital signature to the trusted cloud control center for storage, thereby ensuring the non-repudiation of the entire service process and ensuring the tangible benefits of the user and the bank.
  • Step 5 After receiving the digital signature of the user, the bank completes the identity verification/service authentication of the user; the bank encrypts the service specific information and the identity identification information by using the one-time key issued by the trusted cloud control center, and Sended to the user terminal, the set of encrypted information may be referred to as a function code.
  • Step 6 After receiving the function code, the user terminal decrypts, and can verify the identity of the bank according to the bank identification information obtained by decryption; then further improve the service information, and then send it to the bank after being encrypted.
  • Step 7 The bank completes the verification of the service detailed information and completes the current service.
  • the bank opens the corresponding authority of the user, and sends the encrypted inquiry information to the user terminal, asking whether the user needs to increase the service item within the authority.
  • Step 8 If the user still needs other services, repeat steps 6 to 7. If you agree to complete the entire service, send the encrypted completion code to the bank and the trusted cloud control center to inform them of the key and uniqueness of the service. Code deletion. Step 9: The bank receives the notification confirming the completion of the service, discarding the one-time key and its own unique code.
  • Step 10 After receiving the notification, the Trusted Cloud Control Center discards the one-time key of the service and the unique code of the terminal and the bank.
  • the embodiment of the present invention further provides a system for terminal identity verification and service authentication.
  • the system includes: a terminal 21, a service provider 22, and a trusted cloud control center 23; wherein the terminal 21 After the service request is initiated, the user unique code is generated according to the user-specific information in the SIM card, and the name of the user-specific information is encrypted, and sent to the trusted cloud control center together with the unique code of the user;
  • the service provider 22 is configured to generate a unique code according to its specific information, and send the encrypted name of the specific information to the trusted cloud control center together with the generated unique code; the trusted cloud control center 23 And configured to authenticate the terminal and the service provider according to the unique code, and determine that both authentications are passed, and the communication code is sent to the terminal and the service provider, and the two communicate according to the communication code to complete the service.
  • the terminal 21 is further configured to notify the service provider and the trusted cloud control center to delete the communication code and the unique code after the service is completed, that is, notify the service provider to delete the communication code and its own unique code, and notify the trusted cloud.
  • the control center deletes the communication code, and the unique code of the terminal and the service provider; correspondingly,
  • the service provider 22 is further configured to: after receiving the notification of the terminal, delete the communication code and its own unique code; the trusted cloud control center 23 is further configured to: after receiving the notification from the terminal, delete the communication code, and The unique code of the terminal and service provider.
  • the embodiment of the present invention further provides a terminal, where the terminal is configured to generate a user unique code according to user specific information in the SIM card after initiating a service request, and encrypt the name of the user specific information, and The user unique code is sent to the trusted cloud control center together.
  • the terminal is further configured to notify the service provider and the trusted cloud control center to delete the communication code and the unique code after the service is completed, that is, notify the service provider to delete the communication code and its own unique code, and notify the trusted cloud control.
  • the center deletes the communication code, as well as the unique code of the terminal and service provider.
  • FIG. 3 is a schematic structural diagram of an embodiment of a service provider according to an embodiment of the present invention, including: a communication module 31, a storage server 32, an encryption/decryption operation module 33, and a control center 34.
  • the communication module 31 is configured to communicate with the terminal and the trusted cloud control center, and transmit data between the local data and the terminal and the trusted cloud control center;
  • the storage server 32 is configured to store its own specific information, a communication code, and its own unique code;
  • the encryption/decryption operation module 33 is configured to encrypt a name of the specific information of the self; the control center 34 is configured to generate a unique code according to the specific information of the self, and the name of the encrypted specific information is The communication module is sent to the trusted cloud control center together;
  • the control center 34 is further configured to delete the communication code stored in the storage server and its own unique code after receiving the notification from the terminal.
  • FIG. 4 is a schematic structural diagram of an embodiment of a trusted cloud control center according to an embodiment of the present invention, including: a communication module 41, a storage server 42, an encryption/decryption operation module 43, a certificate generation server 44, a key generation server 45, and a control center. 46.
  • the communication module 41 is configured to communicate with the terminal and the service provider, and transmit data between the local data and the terminal and the service provider;
  • the storage server 42 is configured to store a unique code sent by the terminal and the service provider, a name of the encrypted specific information of the service provider, and a name of the encrypted user-specific information of the terminal; storing the registered end user specific Information and service provider specific information; a communication code generated by the certificate generation server and the key generation server;
  • the encryption/decryption operation module 43 is configured to decrypt the name of the service provider's encrypted specific information and the name of the encrypted user-specific information of the terminal;
  • the certificate generation server 44 is configured to generate a digital certificate in the communication code;
  • the key generation server 45 is configured to generate a one-time key in the communication code;
  • the control center 46 is configured to And the service provider performs authentication to determine that both authentications are passed, and the communication code is sent to the terminal and the service provider via the communication module; the control center 46 is further configured to delete the storage server after receiving the notification from the terminal.
  • the terminal includes, but is not limited to, a Portable Application Description (PAD), a smart phone, an Ultrabook, and can also be applied to a general mobile phone, a data card, etc., which can support a 3G network. Terminal products for services.
  • PAD Portable Application Description
  • the specific implementation steps of the method of the present invention include, but are not limited to, the above process, and may define new process steps or streamline process steps for services of different security levels and application scopes, and achieve flexible use.

Abstract

发明公开了一种终端身份验证和服务鉴权的方法，包括：终端发起服务请求后，根据SIM卡中的用户特定信息生成用户唯一码，并将所述用户特定信息的名称加密后，与所述用户唯一码一同发送到可信云控制中心；服务供应商根据自身的特定信息生成唯一码，并将加密后的自身特定信息的名称与生成的唯一码一同发送到可信云控制中心；可信云控制中心根据唯一码对终端和服务供应商进行鉴权，确定两者鉴权均通过时，将通信码发送给终端和服务供应商，两者依据通信码进行通信以完成本次服务。本发明还同时公开了一种系统和终端，运用该方法、系统和终端可使终端用户个人隐私信息的安全性得到保证，防止在无线传输过程中被恶意拦截。

Description

一种终端身份 和服务鉴权的方法、 系统和终端 技术领域
本发明涉及移动通信系统中的信息安全技术， 尤其涉及一种终端身份 验证和服务鉴权的方法、 系统和终端。 背景技术
传统的移动通信终端安全策略主要集中在单主机领域， 也就是单个用 户单一主机的移动通信终端安全策略， 即： 用户对个人持有的终端设备进 行安全管理。 上述安全策略主要包括： 用户终端设备使用合法性， 如： 用 户为终端设置开机密码， 使得非法用户无法开机； 功能使用权限管理， 例 如： 限制浏览终端设备中所存储的信息， 以及隐私信息加密， 例如： 对文 档进行加密， 等本地安全管理。 这些安全策略不涉及用户信息的无线传递、 用户身份识别和服务供应商对用户提交的服务进行鉴权等方面的内容。
目前， 随着通信技术的发展， 各种无线应用迅速增加， 但因移动通信 领域的信息安全性一直不够完善， 所以终端用户的重要信息在无线传输过 程中经常受到威胁， 暴露出很多终端设备安全策略上的缺陷。 而且， 伴随 着智能终端的普及和第三代移动通信技术（3G )网络的全面覆盖， 经由 3G 网络为用户提供服务的应用越来越多， 这种信息安全状况会更加令人担忧。
现有基于 3G 网络的服务均通过终端用户个人隐私信息的无线传输来 判定服务是否可以执行， 也就是服务供应商通过用户个人隐私信息来对终 端进行身份验证。 但是， 网络黑客或恶意破坏者很容易在无线环境中截获 用户个人隐私信息， 给用户和服务供应商双方均造成巨大的损失。 发明内容
有鉴于此， 本发明实施例的主要目的在于提供一种终端身份验证和服 务鉴权的方法、 系统和终端， 使得终端用户个人隐私信息的安全性得到保 证， 防止在无线传输过程中被恶意拦截。
为达到上述目的， 本发明实施例的技术方案是这样实现的：
一种终端身份验证和服务鉴权的方法， 该方法包括：
终端发起服务请求后，根据 SIM卡中的用户特定信息生成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户唯一码一同发送到可信 云控制中心；
服务供应商根据自身的特定信息生成唯一码， 并将加密后的自身特定 信息的名称与生成的唯一码一同发送到可信云控制中心；
可信云控制中心根据唯一码对终端和服务供应商进行鉴权， 确定两者 鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依据通信码进行 通信以完成本次 Λ良务。
优选的， 所述用户唯一码的生成过程为： 终端釆用散列算法对 SIM卡 中的用户特定信息进行计算， 生成用户唯一码； 所述 SIM卡中的用户特定 信息为： SIM卡内储存的各种用户特定信息集合的一个子集。
优选的， 所述对用户特定信息的名称进行加密， 为： 利用个人识别码 PIN对所述用户特定信息的名称进行加密。
优选的， 所述可信云控制中心根据唯一码对终端和服务供应商进行鉴 权， 为：
可信云控制中心对终端所发的用户特定信息的名称进行解密， 根据解 密所得的用户特定信息的名称， 从自身的存储服务器中找到相应的用户特 定信息， 并使用散列算法生成相应的字符串； 将所述计算所得的字符串与 终端所发的用户唯一码进行比较， 如果比较结果相同， 则表明终端鉴权通 过； 否则， 鉴权未通过；
同样， 可信云控制中心对根据解密得到的服务供应商的特定信息的名 称釆用散列算法生成相应的字符串， 并将所述字符串与服务供应商所发的 唯一码进行比较， 如果比较结果相同， 则表明鉴权通过； 否则， 鉴权未通 过。
优选的， 所述通信码包括： 一次性密钥和数字证书。
优选的， 所述方法还包括： 本次服务完成后， 终端通知服务供应商和 可信云控制中心删除通信码和唯一码， 即： 通知服务供应商删除通信码和 自身的唯一码； 通知可信云控制中心删除通信码， 以及终端和服务供应商 的唯一码。
一种终端身份验证和服务鉴权的系统， 该系统包括： 终端、 服务供应 商和可信云控制中心； 其中，
所述终端， 配置为发起服务请求后， 根据 SIM卡中的用户特定信息生 成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户唯一码 一同发送到可信云控制中心；
所述服务供应商， 配置为根据自身的特定信息生成唯一码， 并将加密 后的自身特定信息的名称与生成的唯一码一同发送到可信云控制中心； 所述可信云控制中心， 配置为根据唯一码对终端和服务供应商进行鉴 权， 确定两者鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依 据通信码进行通信以完成本次服务。
优选的， 所述终端， 还配置为本次服务完成后， 通知服务供应商和可 信云控制中心删除通信码和唯一码， 即： 通知服务供应商删除通信码和自 身的唯一码， 通知可信云控制中心删除通信码， 以及终端和服务供应商的 唯一码； 相应的，
优选的， 所述服务供应商， 还配置为收到终端的通知后， 删除通信码 和自身的唯一码；
优选的， 所述可信云控制中心， 还配置为收到终端的通知后， 删除通 信码， 以及终端和服务供应商的唯一码。
一种终端， 所述终端， 配置为发起服务请求后， 根据 SIM卡中的用户 特定信息生成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述 用户唯一码一同发送到可信云控制中心。
所述终端， 还配置为本次服务完成后， 通知服务供应商和可信云控制 中心删除通信码和唯一码， 即： 通知服务供应商删除通信码和自身的唯一 码， 通知可信云控制中心删除通信码， 以及终端和服务供应商的唯一码。
本发明实施例提供的终端身份验证和服务鉴权的方法、 系统和终端， 终端发起服务请求后， 根据 SIM卡中的用户特定信息生成用户唯一码， 并 将所述用户特定信息的名称加密后， 与所述用户唯一码一同发送到可信云 控制中心； 服务供应商根据自身的特定信息生成唯一码， 并将加密后的自 身特定信息的名称与生成的唯一码一同发送到可信云控制中心； 可信云控 制中心根据唯一码对终端和服务供应商进行鉴权， 确定两者鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依据通信码进行通信以完成本次 服务。 本发明实施例在不增加用户现有终端资源的前提下， 利用已有 SIM 卡携带的信息生成用户唯一码， 唯一码的计算方法为散列算法， 因该算法 具有不可逆性， 即便恶意用户截获唯一码， 他也无法从中获得任何有价值 的信息， 确保用户信息的安全和不被冒充。 同时， 在本发明实施例的整个 服务过程中都有通信码对终端和服务供应商双方的通信数据进行加密， 同 样保证了终端用户以及服务供应商信息的安全性。
与传统应用场景中数获得字证书、 完成数字签名等操作都需要特定硬 件设备支持的方式不同， 本发明实施例是依靠用户终端、 服务供应商和可 信云控制中心相互通信来完成， 不需要用户另外购置新的硬件设备， 因此， 本发明实施例的实现方法可降低用户的消费成本。
此外， 本发明实施例在本次服务完成后， 终端通知服务供应商和可信 云控制中心删除通信码和唯一码， 这进一步确保了终端和服务供应商信息 的安全性。 附图说明
图 1为本发明实施例终端身份验证和服务鉴权的方法实现流程示意图； 图 2为本发明实施例终端身份验证和服务鉴权的系统结构示意图； 图 3为本发明实施例服务供应商的实施例结构示意图；
图 4为本发明实施例可信云控制中心的实施例结构示意图。 具体实施方式
在本发明实施例中： 终端发起服务请求后， 根据 SIM卡中的用户特定 信息生成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户 唯一码一同发送到可信云控制中心； 服务供应商根据自身的特定信息生成 唯一码， 并将加密后的自身特定信息的名称与生成的唯一码一同发送到可 信云控制中心； 可信云控制中心根据唯一码对终端和服务供应商进行鉴权， 确定两者鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依据通 信码进行通信以完成本次服务。
优选的， 本次服务完成后， 终端通知服务供应商和可信云控制中心删 除通信码和唯一码。
这里， 利用个人识别码（ Personal Identification Number, PIN )对所述 用户特定信息的名称进行加密； 所述通信码包括： 一次性密钥和数字证书。
下面结合附图及具体实施例对本发明实施例作进一步详细说明。
图 1为本发明实施例终端身份验证和服务鉴权的方法实现流程示意图， 如图 1所示， 该流程的实现步骤如下： 步骤 101 : 终端发起服务请求后， 根据 SIM卡中的用户特定信息生成 用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户唯一码一 同发送到可信云控制中心；
具体为： 终端向服务供应商发起服务请求后，根据 SIM卡中的用户特定 信息， 如： PIN、 国际移动用户识别号 （IMSI )、 鉴权密钥 （KI )和移动用 户暂时识别码（TMSI )等等， 釆用散列算法生成用户唯一码。 其中， 所述 用户特定信息是基于 SIM卡内储存的各种用户特定信息集合的一个子集， 即： 包括 SIM卡内储存信息的一部分， 终端用户可通过服务供应商提供的应 用程序自行选择所述子集中的信息的种类和数目， 例如： 服务供应商给用 户提供用户特定信息选择界面， 界面中列出各种用户特定信息， 用户可自 行选择其中的几种组合成一个集合， 即上述的子集， 终端根据用户所选的 子集生成用户唯一码 W, W=f(X,Y...,Z), 这个函数算法可以釆用散列算法， 但不限于这一种算法。
这里， 优选散列算法是因为该算法具有不可逆性， 即便恶意用户截获 唯一码， 他也无法从中获得任何有价值的信息， 确保用户信息的安全和不 被冒充。 同时， 散列算法还具有唯一性， 只要子集中的任意元素或元素数 量发生变化， 用户将得到不同的唯一码。 这样， 可以确保恶意者不能通过 篡改用户特定信息子集并使用相同的散列算法伪造用户唯一码。
因此，本发明实施例这种新型的基于 SIM卡中用户特定信息的唯一码作 为安全策略流程的重要信息， 可以确保用户身份不被冒充， 用户信息不会 被篡改。
优选的， 针对每一次不同的服务， 用户都可以重新生成一个唯一码， 即： 每次从上文所述的用户特定信息选择界面选择不同的组合方式生成新 的用户特定信息子集， 然后再将这个子集作为散列算法计算的对象， 得出 一次性的用户唯一码， 这个用户唯一码是随机性的。 此外， 用户唯一码的 产生不依赖终端设备， 完全可以使用同一张 SIM卡在不同的终端设备上完 成各项服务。
终端生成唯一码后， 利用 PIN对所述用户特定信息的名称进行加密， 并与所述用户唯一码一同发送到可信云控制中心。 其中， 所述用户特定信 息的名称与生成用户唯一码时所选的用户特定信息相对应， 也就是说， 如 果用户特定信息子集中包括三个用户特定信息， 则此处需加密的用户特定 信息的名称也为三个。 这里， 用户特定信息为具体数值， 如： IMSI的值为 15位十进制的数字号码， 而用户特定信息的名称为 IMSI本身。
其中， 将用户特定信息的名称发送给可信云控制中心， 是用于后续可 信云控制中心对终端的鉴权； 关于对用户特定信息的名称的加密算法为现 有的加密算法， 终端与可信云控制中心已对所述算法进行协商。
步骤 102: 服务供应商根据自身的特定信息生成唯一码， 并将加密后的 自身特定信息的名称与生成的唯一码一同发送到可信云控制中心；
具体为： 服务供应商根据自身已在可信云控制中心注册过的特定信息， 如： ID和二维码等生成自身的唯一码， 其生成过程与用户唯一码的生成过 程相同， 也釆用散列算法， 此处不再详述。 同样， 服务供应商还需将自身 特定信息的名称加密后， 与生成的唯一码一同发送到可信云控制中心。
步骤 103: 可信云控制中心根据唯一码对终端和服务供应商进行鉴权， 确定两者鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依据通 信码进行通信以完成本次服务；
具体为： 可信云控制中心对终端所发的用户特定信息的名称进行解密， 根据解密所得的用户特定信息的名称从自身的存储服务器中找到相应的用 户特定信息， 并使用相同的散列算法生成相应的字符串， 并将所述计算所 得的字符串与终端所发的用户唯一码进行比较， 如果比较结果相同， 则表 明终端鉴权通过； 否则， 鉴权未通过。 可信云控制中心对服务供应商的鉴 权过程与对终端鉴权过程相同， 即： 根据解密得到的特定信息的名称釆用 散列算法生成相应的字符串， 并将所述字符串与服务供应商所发的唯一码 进行比较， 如果比较结果相同， 则表明鉴权通过； 否则， 鉴权未通过。
可信云控制中心确定终端和服务供应商的鉴权均通过时， 将本次服务 的通信码分别发送到终端和服务供应商， 终端和服务供应商依据该通信码 进行相互间的通信以完成本次服务。 这里， 所述包括但不限于： 一次性密 钥和数字证书， 在通信过程中， 终端和服务供应商互相发送的信息均需用 通信码中的一次性密钥进行加密。
其中， 所述通信码中的一次性密钥也可以是一次性的， 可保证用户信 息的安全性， 避免用户信息被恶意篡改。 当然， 此处也可保证终端用户对 服务供应商的服务进行鉴权， 具体见后续实施例的描述。
优选的， 本发明实施例还包括步骤 104: 本次服务完成后， 终端通知服 务供应商和可信云控制中心删除通信码和唯一码；
具体为： 在本次服务完成后， 终端确定不再需要其它服务时， 可通知 服务供应商和可信云控制中心删除本次服务的通信码和唯一码， 即： 服务 供应商删除本次服务的通信码以及自身的唯一码； 可信云控制中心删除本 次服务的通信码以及终端和服务供应商两者的唯一码。 该步骤可进一步确 保用户信息的安全性和私密性。
下面以商业银行提供的网上银行业务为例， 对本发明实施例的方法进 行描述， 实现步骤如下：
步骤一： 用户终端进入银行提供的应用界面发起服务流程， 在银行的 选择界面中选择 SIM卡中储存的若干个用户特定信息， 并通过散列算法计 算得到用户唯一码； 用 PIN加密用户特定信息的名称， 将这两者一起发送 给可信云控制中心， 同时将服务请求信息发送到银行。
步骤二： 银行收到终端发来的服务请求信息后， 使用与步骤一相同的 散列算法根据身在可信云控制中心注册过的特定信息得到银行的唯一码， 并对特定信息的名称进行加密， 并将唯一码和加密的特定信息的名称发送 给可信云控制中心。
步骤三： 可信云控制中心根据解密得到用户特定信息的名称和银行特 定信息的名称， 从其自身的存储服务器中找到这些特定信息， 并使用相同 的散列算法分别得到对应终端和银行的字符串， 若对应字符串与终端和银 行的唯一码均相同， 则判定两者身份合法， 并将用于服务信息加密的一次 性密钥和数字证书， 即将通行码分别发送给终端和银行。
步骤四： 终端收到通行码后， 用户进行数字签名， 终端将用户的数字 签名发送给银行；
本步骤中， 终端还同时将数字签名发送给可信云控制中心进行保存， 这样， 能够保证整个服务过程的不可否认性， 确保用户和银行的切实利益。
步骤五： 银行收到用户的数字签名后， 完成对用户的身份验证 /服务鉴 权； 银行使用可信云控制中心下发的一次性密钥对服务具体信息和自身身 份标识信息进行加密， 并发送给用户终端， 这组经加密得到的信息可称为 功能码。
步骤六： 用户终端收到功能码后进行解密， 根据解密所得的银行身份 标识信息可以验证银行的身份； 之后进一步完善服务信息， 经加密后发给 银行。
步骤七： 银行完成对服务详细信息的核对， 并完成当前服务； 优选的， 银行开放用户的相应权限， 并发送经加密的询问信息到用户 终端， 询问用户是否需要增加权限内的服务项目。
步骤八： 若用户还需要其它服务， 重复步骤六至步骤七， 若同意完成 整个服务， 则发送经加密的完成码给银行和可信云控制中心， 通知其将此 次服务的密钥和唯一码删除。 步骤九： 银行收到通知确认服务完成， 废弃一次性密钥和自身的唯一 码。
步骤十： 可信云控制中心收到通知后， 废弃此次服务的一次性密钥以 及终端和银行的唯一码。
本发明实施例还提供了一种终端身份验证和服务鉴权的系统， 如图 2 所示， 该系统包括： 终端 21、 服务供应商 22和可信云控制中心 23 ; 其中， 所述终端 21 , 配置为发起服务请求后， 根据 SIM卡中的用户特定信息 生成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户唯一 码一同发送到可信云控制中心；
所述服务供应商 22, 配置为根据自身的特定信息生成唯一码， 并将加 密后的自身特定信息的名称与生成的唯一码一同发送到可信云控制中心； 所述可信云控制中心 23 , 配置为根据唯一码对终端和服务供应商进行 鉴权， 确定两者鉴权均通过时， 将通信码发送给终端和服务供应商， 两者 依据通信码进行通信以完成本次服务。
所述终端 21 , 还配置为本次服务完成后， 通知服务供应商和可信云控 制中心删除通信码和唯一码， 即： 通知服务供应商删除通信码和自身的唯 一码， 通知可信云控制中心删除通信码， 以及终端和服务供应商的唯一码； 相应的，
所述服务供应商 22, 还配置为收到终端的通知后， 删除通信码和自身 的唯一码； 所述可信云控制中心 23 , 还配置为收到终端的通知后， 删除通信码， 以及终端和服务供应商的唯一码。
本发明实施例还提供了一种终端， 所述终端， 配置为发起服务请求后， 才艮据 SIM卡中的用户特定信息生成用户唯一码， 并将所述用户特定信息的 名称加密后， 与所述用户唯一码一同发送到可信云控制中心。 所述终端， 还配置为本次服务完成后， 通知服务供应商和可信云控制 中心删除通信码和唯一码， 即： 通知服务供应商删除通信码和自身的唯一 码， 通知可信云控制中心删除通信码， 以及终端和服务供应商的唯一码。
本发明实施例服务供应商的实施例结构示意图如图 3 所示， 包括： 通 信模块 31、 存储服务器 32、 加密 /解密运算模块 33和控制中心 34。
在实际运行过程中， 所述通信模块 31 , 配置为与终端和可信云控制中 心进行通信， 本地数据与终端和可信云控制中心间数据的传输；
所述存储服务器 32 , 配置为存储自身的特定信息、 通信码和自身的唯 一码；
所述加密 /解密运算模块 33 , 配置为对自身特定信息的名称进行加密； 所述控制中心 34 , 配置为才艮据自身的特定信息生成唯一码， 并与加密 后的自身特定信息的名称经通信模块一同发送到可信云控制中心；
所述控制中心 34 , 还配置为收到终端的通知后， 删除存储服务器中存 储的通信码和自身的唯一码。
本发明实施例可信云控制中心的实施例结构示意图如图 4所示， 包括： 通信模块 41、 存储服务器 42、 加密 /解密运算模块 43、 证书生成服务器 44、 密钥生成服务器 45和控制中心 46。
在实际运行过程中， 所述通信模块 41 , 配置为与终端和服务供应商进 行通信， 本地数据与终端和服务供应商间数据的传输；
所述存储服务器 42 , 配置为存储终端和服务供应商所发的唯一码、 服 务供应商的已加密的特定信息的名称和终端的已加密的用户特定信息的名 称； 存储已注册的终端用户特定信息和服务供应商特定信息； 存储证书生 成服务器和密钥生成服务器共同生成的通信码；
所述加密 /解密运算模块 43 , 配置为对服务供应商的已加密的特定信息 的名称和终端的已加密的用户特定信息的名称进行解密； 所述证书生成服务器 44, 配置为生成通信码中的数字证书； 所述密钥生成服务器 45 , 配置为生成通信码中的一次性密钥； 所述控制中心 46, 配置为根据唯一码对终端和服务供应商进行鉴权， 确定两者鉴权均通过时， 经通信模块将通信码发送给终端和服务供应商； 所述控制中心 46, 还配置为收到终端的通知后， 删除存储服务器中存 储的通信码， 以及终端和服务供应商的唯一码。
需要说明的是， 本发明实施例所述的终端包括但不仅限于 （Portable Application Description, PAD )、 智能手机、 超级本（ Ultra book ), 也可应用 于普通手机、 数据卡等所有可以支持 3G网络服务的终端类产品。 同时， 本 发明方法的具体实施步骤包含但不限于上述的过程， 可以为不同安全等级 和应用范围的服务定义新增的流程步骤或精简流程步骤， 达到灵活运用的 目的。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围。

Claims

权利要求书
1、 一种终端身份验证和服务鉴权的方法， 该方法包括：
终端发起服务请求后，根据 SIM卡中的用户特定信息生成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户唯一码一同发送到可信 云控制中心；
服务供应商根据自身的特定信息生成唯一码， 并将加密后的自身特定 信息的名称与所述生成的唯一码一同发送到可信云控制中心；
可信云控制中心根据唯一码对终端和服务供应商进行鉴权， 确定两者 鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依据通信码进行 通信， 完成本次服务。
2、 根据权利要求 1所述的终端身份验证和服务鉴权的方法， 其中， 所 述用户唯一码的生成过程为：
终端釆用散列算法对 SIM卡中的用户特定信息进行计算， 生成用户唯 一码； 所述 SIM卡中的用户特定信息为： SIM卡内储存的各种用户特定信 息集合的一个子集。
3、 根据权利要求 1所述的终端身份验证和服务鉴权的方法， 其中， 所 述对用户特定信息的名称进行加密， 为：
利用个人识别码 PIN对所述用户特定信息的名称进行加密。
4、 根据权利要求 1所述的终端身份验证和服务鉴权的方法， 其中， 所 述可信云控制中心根据唯一码对终端和服务供应商进行鉴权， 为：
可信云控制中心对终端所发的用户特定信息的名称进行解密， 根据解 密所得的用户特定信息的名称， 从自身的存储服务器中找到相应的用户特 定信息， 并使用散列算法生成相应的字符串； 将所述计算所得的字符串与 终端所发的用户唯一码进行比较， 如果比较结果相同， 则表明终端鉴权通 过； 否则， 鉴权未通过； 可信云控制中心对根据解密得到的服务供应商的特定信息的名称釆用 散列算法生成相应的字符串， 并将所述字符串与服务供应商所发的唯一码 进行比较， 如果比较结果相同， 则表明鉴权通过； 否则， 鉴权未通过。
5、 根据权利要求 1所述的终端身份验证和服务鉴权的方法， 其中， 所 述通信码包括： 一次性密钥和数字证书。
6、 根据权利要求 1至 5中任一项所述的终端身份验证和服务鉴权的方 法， 其中， 该方法还包括：
本次服务完成后， 终端通知服务供应商和可信云控制中心删除通信码 和唯一码， 包括：
通知服务供应商删除通信码和自身的唯一码； 通知可信云控制中心删 除通信码， 以及终端和服务供应商的唯一码。
7、 一种终端身份验证和服务鉴权的系统， 该系统包括： 终端、 服务供 应商和可信云控制中心； 其中，
所述终端， 配置为发起服务请求后， 根据 SIM卡中的用户特定信息生 成用户唯一码， 并将所述用户特定信息的名称加密后， 与所述用户唯一码 一同发送到可信云控制中心；
所述服务供应商， 配置为根据自身的特定信息生成唯一码， 并将加密 后的自身特定信息的名称与所述生成的唯一码一同发送到可信云控制中 心；
所述可信云控制中心， 配置为根据唯一码对终端和服务供应商进行鉴 权， 确定两者鉴权均通过时， 将通信码发送给终端和服务供应商， 两者依 据通信码进行通信， 完成本次服务。
8、 根据权利要求 7所述的终端身份验证和服务鉴权的系统， 其中， 所 述终端， 还配置为本次服务完成后， 通知服务供应商和可信云控制中心删 除通信码和唯一码， 包括： 通知服务供应商删除通信码和自身的唯一码， 通知可信云控制中心删 除通信码， 以及终端和服务供应商的唯一码；
相应的， 所述服务供应商， 还配置为收到终端的通知后， 删除通信码 和自身的唯一码；
所述可信云控制中心， 还配置为收到终端的通知后， 删除通信码， 以 及终端和服务供应商的唯一码。
9、 一种终端， 所述终端， 配置为发起服务请求后， 根据 SIM卡中的用 户特定信息生成用户唯一码， 并将所述用户特定信息的名称加密后， 与所 述用户唯一码一同发送到可信云控制中心。
10、 根据权利要求 9所述的终端， 其中， 所述终端， 还配置为本次服 务完成后， 通知服务供应商和可信云控制中心删除通信码和唯一码， 包括： 通知服务供应商删除通信码和自身的唯一码， 通知可信云控制中心删 除通信码， 以及终端和服务供应商的唯一码。
PCT/CN2013/079552 2012-07-24 2013-07-17 一种终端身份验证和服务鉴权的方法、系统和终端 WO2014015759A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CA2879910A CA2879910C (en) 2012-07-24 2013-07-17 Terminal identity verification and service authentication method, system and terminal
EP13823645.0A EP2879421B1 (en) 2012-07-24 2013-07-17 Terminal identity verification and service authentication method, system, and terminal
US14/417,024 US9445269B2 (en) 2012-07-24 2013-07-17 Terminal identity verification and service authentication method, system and terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210257464.1 2012-07-24
CN201210257464.1A CN102761870B (zh) 2012-07-24 2012-07-24 一种终端身份验证和服务鉴权的方法、系统和终端

Publications (1)

Publication Number Publication Date
WO2014015759A1 true WO2014015759A1 (zh) 2014-01-30

Family

ID=47056158

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/079552 WO2014015759A1 (zh) 2012-07-24 2013-07-17 一种终端身份验证和服务鉴权的方法、系统和终端

Country Status (5)

Country Link
US (1) US9445269B2 (zh)
EP (1) EP2879421B1 (zh)
CN (1) CN102761870B (zh)
CA (1) CA2879910C (zh)
WO (1) WO2014015759A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2499787B (en) 2012-02-23 2015-05-20 Liberty Vaults Ltd Mobile phone
CN102761870B (zh) * 2012-07-24 2015-06-03 中兴通讯股份有限公司 一种终端身份验证和服务鉴权的方法、系统和终端
KR102133450B1 (ko) * 2013-05-30 2020-07-13 삼성전자 주식회사 프로파일 설정 방법 및 장치
GB2517732A (en) * 2013-08-29 2015-03-04 Sim & Pin Ltd System for accessing data from multiple devices
CN105592456B (zh) * 2014-10-20 2018-10-30 中国电信股份有限公司 二维码认证的方法和系统
CN106101068B (zh) * 2016-05-27 2019-06-11 宇龙计算机通信科技(深圳)有限公司 终端通信方法及系统
KR101809974B1 (ko) * 2017-05-22 2017-12-19 주식회사 에프엔에스벨류 다중 사용자의 인증요소를 조합하여 보안키를 생성하는 보안인증시스템 및 보안인증방법
CN107222556A (zh) * 2017-06-28 2017-09-29 中天海洋系统有限公司 一种深海观测安全可信组网系统
CN108932619B (zh) * 2018-06-07 2022-03-22 贵州玛迩比特通信科技有限公司 一种终端离线的收费服务方法及系统
WO2020162739A1 (ko) * 2019-02-08 2020-08-13 주식회사 센스톤 칩 고유값 기반의 가상코드를 이용하여 장치를 식별하는 방법, 프로그램 및 장치
EP3917103A1 (de) * 2020-05-29 2021-12-01 Siemens Aktiengesellschaft Verfahren, system, sender und empfänger zum authentifizieren eines senders
US20220217136A1 (en) * 2021-01-04 2022-07-07 Bank Of America Corporation Identity verification through multisystem cooperation

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1764296A (zh) * 2004-10-22 2006-04-26 北京握奇数据系统有限公司 动态口令认证系统和方法
CN102761870A (zh) * 2012-07-24 2012-10-31 中兴通讯股份有限公司 一种终端身份验证和服务鉴权的方法、系统和终端

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1691578A (zh) * 2004-04-29 2005-11-02 华为技术有限公司 一种设备验证自身合法性的方法
US20060059344A1 (en) * 2004-09-10 2006-03-16 Nokia Corporation Service authentication
NO20050152D0 (no) * 2005-01-11 2005-01-11 Dnb Nor Bank Asa Fremgangsmate ved frembringelse av sikkerhetskode og programmbar anordning for denne
US20070186115A1 (en) 2005-10-20 2007-08-09 Beijing Watch Data System Co., Ltd. Dynamic Password Authentication System and Method thereof
EP1865656A1 (en) * 2006-06-08 2007-12-12 BRITISH TELECOMMUNICATIONS public limited company Provision of secure communications connection using third party authentication
US8640203B2 (en) * 2007-06-04 2014-01-28 Rajesh G. Shakkarwar Methods and systems for the authentication of a user
CN101588579B (zh) * 2008-05-20 2011-09-14 华为技术有限公司 一种对用户设备鉴权的系统、方法及其基站子系统
US8590037B2 (en) 2008-12-23 2013-11-19 Sandisk Technologies Inc. Managing host application privileges
US9166975B2 (en) * 2012-02-16 2015-10-20 Inbay Technologies Inc. System and method for secure remote access to a service on a server computer
US8590022B2 (en) * 2009-02-26 2013-11-19 Blackberry Limited Authentication using a wireless mobile communication device
US8584221B2 (en) 2009-10-23 2013-11-12 Microsoft Corporation Authenticating using cloud authentication
CN102316080B (zh) * 2010-06-30 2016-06-01 百度在线网络技术（北京）有限公司 支持中心认证服务在同一主域下的匿名验证功能
CN102571702B (zh) * 2010-12-22 2014-11-05 中兴通讯股份有限公司 物联网中的密钥生成方法、系统和设备
US8667569B2 (en) * 2011-09-29 2014-03-04 Target Brands, Inc. Credentials management
WO2013122869A1 (en) * 2012-02-13 2013-08-22 Eugene Shablygin Sharing secure data
US20130226812A1 (en) * 2012-02-24 2013-08-29 Mads Landrok Cloud proxy secured mobile payments
US9038137B2 (en) * 2012-06-28 2015-05-19 Cellco Partnership Subscriber authentication using a user device-generated security code

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1764296A (zh) * 2004-10-22 2006-04-26 北京握奇数据系统有限公司 动态口令认证系统和方法
CN102761870A (zh) * 2012-07-24 2012-10-31 中兴通讯股份有限公司 一种终端身份验证和服务鉴权的方法、系统和终端

Also Published As

Publication number Publication date
US20150208238A1 (en) 2015-07-23
CN102761870A (zh) 2012-10-31
EP2879421A1 (en) 2015-06-03
CA2879910C (en) 2018-02-13
EP2879421B1 (en) 2019-09-11
CA2879910A1 (en) 2014-01-30
US9445269B2 (en) 2016-09-13
EP2879421A4 (en) 2015-10-21
CN102761870B (zh) 2015-06-03

Similar Documents

Publication Publication Date Title
WO2014015759A1 (zh) 一种终端身份验证和服务鉴权的方法、系统和终端
KR102134302B1 (ko) 무선 네트워크 접속 방법 및 장치, 및 저장 매체
US8327143B2 (en) Techniques to provide access point authentication for wireless network
US9094823B2 (en) Data processing for securing local resources in a mobile device
US11336641B2 (en) Security enhanced technique of authentication protocol based on trusted execution environment
CN109729523B (zh) 一种终端联网认证的方法和装置
CN101621794A (zh) 一种无线应用服务系统的安全认证实现方法
US8397281B2 (en) Service assisted secret provisioning
WO2014180198A1 (zh) 终端接入方法、系统、设备和计算机存储介质
WO2022111187A1 (zh) 终端认证方法、装置、计算机设备及存储介质
US10091189B2 (en) Secured data channel authentication implying a shared secret
KR101281099B1 (ko) 스마트폰 분실 및 도난의 피해 방지를 위한 인증방법
CN105141629A (zh) 一种基于WPA/WPA2 PSK多密码提升公用Wi-Fi网络安全性的方法
KR101745482B1 (ko) 스마트홈 시스템에서의 통신 방법 및 그 장치
CN109522689B (zh) 移动办公环境下的多因子强身份认证方法
KR102355708B1 (ko) 블록체인 키를 이용한 사용자 인증 기반의 요청 처리 방법, 그 방법이 적용된 시스템
JP2017139026A (ja) 信頼できる認証およびログオンのための方法および装置
JP2015111440A (ja) 信頼できる認証およびログオンのための方法および装置
KR20130046781A (ko) 무선 네트워크 접속 인증 방법 및 그 시스템
KR101431010B1 (ko) 하드웨어 인증 모듈을 이용한 액세스 포인트 인증 장치 및 방법
Guo et al. 2FA Communication Protocol to Secure Metro Control Devices
JP2017108239A (ja) 通信システム、端末装置、通信装置、通信方法、及びプログラム
CN115988496A (zh) 接入认证方法及装置
Hsieh et al. An Improved Mutual Authentication Mechanism for Securing Smart Phones
Nagesha et al. A Survey on Wireless Security Standards and Future Scope.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13823645

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2879910

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 14417024

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2013823645

Country of ref document: EP