WO2015014171A1

WO2015014171A1 - Authentication method, method of generating credentials, and associated device

Info

Publication number: WO2015014171A1
Application number: PCT/CN2014/080380
Authority: WO
Inventors: 陈璟
Original assignee: 华为技术有限公司
Priority date: 2013-07-31
Filing date: 2014-06-20
Publication date: 2015-02-05
Also published as: CN104348801B; CN104348801A

Abstract

An authentication method, method of generating credentials, and associated device. the authentication method comprising: upon receiving a logon request of an application client and generated according to a first user name and a first credential, searching for a second credential corresponding to the first user name; verifying, according to the second credential, whether the application client has been authenticated; the second credential is generated by the bootstrapping function (BSF) using the same means as that used by the credential-generating client (CGC) when generating the first credential. Also disclosed are a corresponding method and application server (NAF) and CGC for generating credentials. When an application client requests to log on to the NAF, a username can be entered that is easy for a user to remember, and an easy-to-input credential generated in the same manner by the CGC and BSF on any terminal can be inputted; the NAF logon and authentication is completed by means of said user name and credential, thereby avoiding input, by a user, of a complex user name and credential and simplifying the logon process.

Description

Authentication method, method for generating trust, and related device

The present invention relates to the field of communication security technologies, and in particular, to an authentication method, a method for generating a credential, and related devices. Background technique

In the Third Generation Partnership Project ^{(The 3 rd Generation Partnership Project,} 3GPP)

A generic self-booting architecture (GBA) authentication mechanism is introduced in TS33.220. As shown in Figure 1, first, user equipment (User Equipment, UE) and self-booting function device BSF (Bootstrapping Function) perform authentication. Flow, UE and BSF share key Ks and key identifier B-TID, in this process, BSF obtains authentication vector from Home Subscriber Server (HSS)/Home Location Register (HLR) Then, the UE and a Network Application Function (NAF) perform a login authentication process, specifically, an application client installed on the UE, such as a browser, logs in to the application server, and the NAF obtains the login from the BSF according to the B-TID of the user. The NAF key Ks_NAF 1 , the UE side also generates the same Ks_NAF2 of the domain Ks-NAF 1, and the NAF and the UE perform verification based on the same Ks-NAF1 and Ks-NAF2 to determine whether to pass the login authentication. In the GBA authentication mechanism, the UE is a device having a Universal Integrated Circuit Card (UICC), but the UE needs to access the carrier network through a UICC card device such as a personal computer (Personal Computer, PC) or a tablet pad. When the application client on the card device used by the user cannot automatically obtain the B-TID and Ks-NAF, the user needs to manually input the B-TID/Ks-NAF into the form of the application client or the webpage. The format of B-TID is base64encoded(RAND)@B SF—servers—domain—name , which is “24 case-sensitive characters or numbers @ BSF—servers—domain—name. Ks—NAF is a 256-bit binary bit string For the user, manually entering B-TID/Ks-NAF is very inconvenient.

Therefore, how to avoid using the login authentication process of the application server when the application client requests the application server It has become an urgent problem to be solved by the user to enter a complex login to the application server's username and credentials. Summary of the invention

In view of this, the embodiment of the present invention provides an authentication method, a method for generating a credential, and a related device, which are used to solve the problem that the user input is required in the login authentication process of the application client requesting the application server in the prior art. The technical question of logging in to the application server's username and credentials.

In the first aspect, an authentication method is provided, including:

When receiving the login request generated by the application client according to the first username and the first credential, searching for a second credential corresponding to the first username;

Determining, according to the second credential, whether the application client passes the verification;

The second credential is generated by the self-booting function device BSF and the credential generating client CGC to generate the first credential.

In a first possible implementation manner, after the receiving the login request of the application client, and the searching for the second credential corresponding to the first user name, the method further includes:

If the first credential is not valid in the login request, the application client is instructed to obtain the first credential from the CGC, where the CGC is installed in the same manner as the application client. One or different terminals.

With reference to the first aspect, or the first possible implementation manner of the first aspect, in the second possible implementation manner, the searching for the second credential corresponding to the first user name includes:

Finding locally stored second credentials corresponding to the first username; or

Obtaining a second credential corresponding to the first username from the BSF.

With reference to the second possible implementation of the first aspect, in a third possible implementation, the obtaining, by the BSF, the second credential corresponding to the first username includes:

And sending, by the BSF, the second credential obtaining request, where the obtaining request carries a second user name, so that the BSF searches for a key and a key identifier corresponding to the second username, according to the The second password is generated by using a setting algorithm to generate the second credential, wherein the second username is associated with the first username, where the key and the secret are The key identifier is a key Ks and a key identifier B-TID shared with the CGC;

Obtaining the second credential generated by the BSF. In conjunction with the third possible implementation of the first aspect, in a fourth possible implementation, the second user name is an International Mobile Identification Number (IMSI), a Mobile Subscriber International Integrated Services Digital Network Number (MSISDN), or the carrying of the IMSI Or the identifier of the MSISDN. In a second aspect, a method for generating a credential is provided, including:

Receiving an identifier of an application server that the application client requests to log in;

And generating, by using a setting algorithm, an identifier of the application server, a key Ks shared with the self-booting function device BSF, and a key identifier B-TID to generate the first credential, so that the application server obtains according to the BSF Performing login verification on the application client corresponding to the second credential of the first username; wherein the second credential is generated by the BSF in the same manner as the first credential is generated. .

In a first possible implementation manner, the identifier setting algorithm generates a first trust by using an identifier of the application server, a key Ks shared by the self-booting function device BSF, and a key identifier B-TID. Shape, including:

The following algorithm is used to generate the first credential:

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

Wherein, Credential is the first credential, Ks_NAF is generated by the Ks and the identifier of the application server NAF_ID according to a general self-booting architecture GBA flow, and Trunc48 is a low of intercepting 256-bit SHA-256 value 48 Bit, base64encoded for BASE64 encoding.

With reference to the second aspect, or the first possible implementation manner of the second aspect, in a second possible implementation, the identifier of the application server that the receiving application client requests to log in includes:

Receiving an identifier of the application server input by a user;

And after the generating the identifier of the application server, the key shared by the BSF, and the key identifier to generate the first credential, the method further includes:

The first credential is output to the user. With reference to the second aspect, or the first possible implementation manner of the second aspect, in a third possible implementation manner, the identifier of the application server that the receiving application client requests to log in includes:

Receiving a credential obtaining request of the application client, where the credential obtaining request includes an identifier of the application server; And after the generating the identifier of the application server, the key shared by the BSF, and the key identifier to generate the first credential, the method further includes:

Sending the first credential to the application client. In a third aspect, an application server is provided, including:

a first searching unit, configured to: when receiving a login request generated by the application client according to the first username and the first credential, searching for a second credential corresponding to the first username;

a confirmation unit, configured to confirm, according to the second credential, whether the application client passes the verification; wherein the second credential is generated by the self-booting function device BSF and the credential generating client CGC The trust is generated in the same way.

In a first possible implementation manner, the application server further includes:

And the indicating unit, configured to: when the login request indicates that the first credential is not valid, instructing the application client to obtain the first credential from the CGC, where the CGC and the application Clients are installed on the same or different terminals.

With reference to the third aspect, or the first possible implementation manner of the third aspect, in the second possible implementation manner, the first searching unit includes:

a second searching unit, configured to locally search for the stored second credential corresponding to the first username; or

a first obtaining unit, configured to acquire, from the BSF, a second credential corresponding to the first username. With reference to the second possible implementation of the third aspect, in a third possible implementation, the first acquiring unit includes:

a first sending unit, configured to send the second credential obtaining request to the BSF, where the obtaining request carries a second user name, so that the BSF searches for a key and a secret corresponding to the second username Key identifier, the second credential is generated according to the cipher, the key identifier, and the identifier of the application server, where the second username is associated with the first username, where The key and the key identifier are a key Ks and a key identifier B-TID shared with the CGC;

And a second obtaining unit, configured to acquire the second credential generated by the BSF.

In conjunction with the third possible implementation manner of the third aspect, in a fourth possible implementation manner, the second user name is an international mobile identification number IMSI, and a mobile user international integrated service digital network number

The MSISDN or the identifier carrying the IMSI or MSISDN. In a fourth aspect, a credential generating client CGC is provided, including:

a first receiving unit, configured to receive an identifier of an application server that the application client requests to log in; a first generating unit, configured to use a setting algorithm, to share the identifier of the application server with the self-booting function device BSF The key Ks and the key identifier B-TID generate a first credential, so that the application server performs login verification on the application client according to the second credential corresponding to the first username obtained from the BSF;

The second credential is generated by the BSF in the same manner as the first credential is generated.

In a first possible implementation manner, the first generating unit includes:

a second generating unit, configured to generate the first credential by using the following algorithm:

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

With reference to the fourth aspect, or the first possible implementation manner of the fourth aspect, in the second possible implementation manner, the first receiving unit includes:

a second receiving unit, configured to receive an identifier of the application server input by a user; and the CGC further includes:

And an output unit, configured to output the first credential to the user.

With reference to the fourth aspect, or the first possible implementation manner of the fourth aspect, in a third possible implementation manner, the first receiving unit includes:

a third receiving unit, configured to receive a credential obtaining request of the application client, where the credential obtaining request includes an identifier of the application server;

The CGC also includes:

a second sending unit, configured to send the first credential to the application client.

When the application client requests to log in to the application server, the user can input the user name that is easy to remember and input the CGC and BSF on any terminal. The easy-to-enter credential generated in the same way, through the user name and credential to complete the application server login authentication, to avoid the user to enter complex usernames and credentials, Jane This login process has been simplified. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic diagram of a GBA of a general self-booting architecture in the prior art;

2 is a flow chart of an embodiment of an authentication method according to the present invention;

3 is a flow chart showing another embodiment of a further refinement of an embodiment of an authentication method of the present invention shown in FIG. 2;

4 is a flow chart of an embodiment of a method for generating a credential according to the present invention;

Figure 5 is a flow chart showing another embodiment of a further refinement of an embodiment of the method of generating a credential of the present invention shown in Figure 4;

Figure 6 is a flow chart showing still another embodiment of a further refinement of an embodiment of the method of generating a credential of the present invention shown in Figure 4;

7 is a schematic structural diagram of an embodiment of an application server according to the present invention;

Figure 8 is a block diagram showing another embodiment of a further refinement of an embodiment of an application server of the present invention shown in Figure 7;

FIG. 9 is a schematic structural diagram of an embodiment of a credential generating client CGC according to the present invention; FIG. 10 is a schematic structural diagram of another embodiment of further refinement of an embodiment of the CGC of the present invention shown in FIG. ;

Figure 11 is a block diagram showing still another embodiment of a further refinement of an embodiment of a CGC of the present invention shown in Figure 9. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. 2 is a flow chart of one embodiment of an authentication method of the present invention. As shown in FIG. 2, the method includes the following steps:

Step S101: When receiving a login request generated by the application client according to the first user name and the first credential, searching for a second credential corresponding to the first username, where the second credential is self-directed The functional device BSF is generated in the same manner as the credential generation client CGC generates the first credential.

The application client in the embodiment of the present invention is installed on the terminal, and the terminal may be a device having a UICC card, such as a mobile terminal, or a device without a UICC card, such as a PC or a pad. The application client includes OTT (Over The Top) application client such as Weibo and WeChat. It should be noted that the browser is also an application client.

When the user wants to log in to the application server on the application client, the user inputs the first user name on the application client, and the first user name may be the user's mobile phone number or the account registered by the user on the application server. At the same time, the first credential is input, and the first credential is generated by a credential generation client (CGC) set by the application client terminal or other terminal. It should be noted that the first user name may be a user-defined easy-to-remember name, and the first credential is also a credibility that the CGC uses to facilitate the user to memorize after processing with a specific algorithm. The application client logs in to the application server according to the login request generated by the first credential and the first username according to an authentication protocol between the application server and the application server.

Upon receiving the login request of the application client, the login request is parsed, the first username is obtained, the first credential is obtained according to the first username, and then the second credential corresponding to the first username is searched for. If the user has logged in to the application server, the application server may store the second credential locally. Therefore, the second credential generated by the BSF corresponding to the first username may be found locally; if there is no local storage, A second credential corresponding to the first username is obtained from the BSF.

The present invention can use the CGC on any terminal as long as it is a CGC that generates a first credential corresponding to the first username. The BSF first performs the GBA process with the CGC, and negotiates to obtain the same B-TID and Ks, and the Ks is stored by the first user name or other identifier associated with the first user name; and then, according to the identifier of the application server that obtains the request by sending the credential The NAF_ID searches for the corresponding Ks according to the first user name in the acquisition request or the identifier associated with the first user name, and then generates the second credential using the same algorithm as the CGC generates the first credential. The BSF sends the generated second credential to the application server.特定 Using a specific algorithm to make the generated credentials are also user-friendly. Step S102: Confirm, according to the second credential, whether the application client passes the verification. Comparing the first credential and the second credential, if the comparison result is consistent, the verification succeeds, allowing the application client to log in, and returning the login success message to the application client. Otherwise, the verification fails, the application client login is not allowed, and the login failure message is returned to the application client.

According to an authentication method provided by an embodiment of the present invention, when an application client requests to log in to an application server, a user name that is easy for the user to record may be input, and an easy input generated by the CGC and the BSF in any terminal may be input. The credential, through the user name and credential to complete the application server login authentication, to avoid the user to enter complex usernames and credentials, simplifying the login process.

3 is a flow chart of another embodiment of a further refinement of an embodiment of an authentication method of the present invention shown in FIG. 2. As shown in FIG. 3, the method includes the following steps:

Step S201: Receive a first login request of an application client.

In this embodiment, the terminal where the application client is located may be a device such as a PC or a pad without a UICC card or a Universal Subscriber Identity Module (USIM). Therefore, the terminal cannot perform communication authentication with the BSF through the UICC card. The same B-TID and Ks cannot be shared with the BSF. Although the terminal does not have a CGC, the terminal with the UICC card can be used to obtain the first credential corresponding to the first username by using the CGC on it. The terminal may also be a device with a UICC card or a USIM card, and the application client may directly send a first credential obtaining request to the CGC on the terminal.

If the application client can obtain a valid first credential from the terminal, the application client generates the login request according to the first username and the first credential; otherwise, the application client generates the login request according to the first username, And carrying an indication in the login request, indicating that the application client does not have a valid first credential. The first user name is input by the user on the application client, and the first user name may be the user's mobile phone number, or may be a format such as an account registered by the user on the application server, and is user-defined and easy to remember. name.

In step S202, it is determined whether the first login request carries an indication, indicating that the application client does not have a valid first credential. If the indication is not carried, the process goes to step S205; otherwise, the process goes to step S203.

If the login request does not carry the indication that the application client does not have a valid first credential, the application client has a valid first credential, and the process goes to step S205 to continue the following login authentication process; if the login request indicates If there is no valid first credential, then go to step S203.

Step S203, sending a response message that the first credential is invalid to the application client, where The response message instructs the application client to obtain the first credential from the credential generation client CGC. The confirmation login process cannot be continued because the login request is not carried, and the response message that the first credential is invalid is sent to the application client, where the application client is instructed or prompted to obtain the CGC from the CGC. First trust. For example, the user is instructed to input the identifier of the application server, such as the NAF_ID, on the CGC of the mobile terminal to which the UICC card is inserted, and the application server or the BSF may further apply the corresponding application client, terminal, and application server through a short message or the like. The information is sent to the user's mobile terminal with the UICC card inserted to prompt the user that he is trying to access an application server. Knowing the NAF-ID, the CGC generates a first credential according to the algorithm agreed with the BSF according to its B-TID, Ks and the NAF-ID shared with the BSF. If there is no valid Ks or B-TID on the CGC, the CGC needs to perform the GB A process with the B SF to generate valid Ks and B-TIDs.

Step S204: Receive a second login request of the application client.

After obtaining the first credential corresponding to the first user name from the terminal inserted with the UICC card, the application client inputs a first credential on the application client, and regenerates the login request according to the first username and the first credential. And resend to the application server. The application server receives the login request resent by the application client.

Step S205, determining whether a second credential corresponding to the first username is stored locally, and if yes, proceeding to step S206; otherwise, proceeding to step S207.

Step S206: Acquire a locally stored second credential corresponding to the first username.

If the user has successfully logged in to the application server with the first username and the first credential, the application server may locally store the second credential obtained from the BSF for verifying the login request of the user, and the application server may also be the user locally. The identifier class is stored with a plurality of users' trusts. Therefore, it is necessary to find and obtain a second credential corresponding to the first user name according to the first user name. If the second credential corresponding to the first username is not stored locally, then go to step S207 to reacquire the second credential from the BSF.

Step S207: Send the second trust obtaining request to the BSF, where the obtaining request carries a second user name, and the second user name is associated with the first user name.

Step S208: Acquire the second credential generated by the BSF.

First, the first username carried in the login request received from the application client is converted into a BSF. The second user name that can be identified, such as the International Mobile Subscriber Indentification Number (IMSI) or the Mobile Subscriber International ISDN/PSTN number (MSISDN), or the IMSI or MSISDN The identity of the information, since the BSF can only identify IMSI or MSISDN. This second username is used to look up Ks and B-TID on the BSF. Then, the BSF sends the second credential acquisition request to the BSF, and the BSF first searches for the corresponding Ks according to the second user name, where the Ks is the BSF and the CGC that generates the first credential is shared by performing the GBA process, according to the The CGC-defined algorithm generates a second credential for the Ks, the B-TID, and the NAF_ID of the application server that sent the fetch request, and returns it to the application server.

A method of generating a credential (;Credential) is:

Ks NAF = KDF (Ks, NAF-ID);

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

That is, CGC first generates Ks-NAF according to the method in TS 33.220, and then calculates the SHA-256 value of Ks||B-TID. The lower 48 bits of the 256-bit SHA-256 value are truncated for BASE64 encoding, and the final output is 8 bits of case-sensitive English characters or numbers. The generated credential is a trust that the user can easily enter.

Step S209: Confirm, according to the second credential, whether the application client passes the verification. If yes, go to step S210; otherwise, go to step S211.

Compare whether the first credential and the second credential are consistent. If yes, the verification succeeds. If they are inconsistent, the complete certificate fails.

Step S210: Return a login success message to the application client.

Step S211, returning a login failure message to the application client.

If the verification is passed, a login success message is returned to the application client; if the verification fails, a login failure message is returned to the application client.

4 is a flow chart of one embodiment of a method of generating a credential of the present invention. As shown in FIG. 4, the method includes the following steps: Step S301: Receive an identifier of an application server that the application client requests to log in.

The application client in the embodiment of the present invention is installed on the terminal, and the terminal may be a device having a UICC card, such as a mobile terminal, or a device without a UICC card, such as a PC or a pad, and the application client includes a microblog. OTT (Over The Top) application client such as WeChat. It should be noted that the browser is also an application client.

When the application client requests to log in to an application server, it receives the identifier NAF_ID of the application server sent by the application client or directly input by the user.

Step S302, using a setting algorithm, generating an identifier of the application server, a key Ks shared with the self-booting function device BSF, and a key identifier B-TID, so that the application server is configured according to the application server Performing login verification on the application client by using the second credential corresponding to the first user name obtained from the BSF; wherein the second credential is used by the BSF to generate the same as the first credential Way to generate.

When the user wants to log in to the application server on the application client, the user inputs the first user name on the application client, and the first user name may be the user's mobile phone number or the account registered by the user on the application server. At the same time, the first credential is input, and the first credential is generated by the CGC set on the terminal where the application client is located or other terminal. It should be noted that the first username may be a user-defined easy-to-remember name, and the first credential is also a credential that the CGC uses to process the user's memory after processing with a specific algorithm. The application client requests the authentication of the application server according to the login request according to the first user name and the login request generated by the first credential.

If the terminal where the application client is located is a device such as a PC or a pad without a UICC card or a USIM, the terminal cannot communicate with the BSF through the UICC card, and cannot share the same B-TID and Ks with the BSF, although the terminal does not have the same B-TID and Ks. CGC, but with other terminals with UICC cards, the first credential corresponding to the first username can be obtained through the CGC on the terminal. The terminal may also be a device with a UICC card or a USIM card, and the application client may directly send a first credential acquisition request to the CGC on the terminal.

The CGC first performs the GBA process with the BSF to obtain the shared B-TID and Ks; then, based on the received NAF-ID, the first credential is generated using the algorithm agreed with the BSF. A method of generating a credential is:

Ks NAF = KDF (Ks, NAF-ID);

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}. That is, the CGC first generates Ks_NAF according to the method in TS 33.220, and then calculates the SHA-256 value of Ks||B-TID. The lower 48 bits of the 256-bit SHA-256 value are intercepted for BASE64 encoding, and the final output is 8-bit case-sensitive English characters or numbers. The generated credential is a credential that the user can easily enter.

When the BSF performs the GBA process with the CGC, the first user name associated with the first credential, or other identifier associated with the first user name, corresponding to the Ks and B-TID storing the first username or identifier. When the application server receives the login request of the application client, the application server obtains the first user name in the login request, and sends a second credential obtaining request to the BSF according to the username, and the BSF carries the first username or the The other identifier associated with the first username finds the corresponding Ks, and generates a second credential and returns to the application server in the same manner as the CGC generates the first credential, so that the application server verifies the login request.

According to the method for generating a credential provided by the embodiment of the present invention, the credential of any server is generated in the same manner as the BSF, and the credential of the application server can be provided to the application client on any terminal, and the generated trust is generated. User-friendly input.

Figure 5 is a flow diagram of another embodiment of a further refinement of an embodiment of the method of generating a credential of the present invention illustrated in Figure 4. As shown in FIG. 5, the method includes the following steps:

Step S401: Receive an identifier of an application server that the application client input by the user requests to log in. In this embodiment, the terminal where the client is located is a device such as a PC or a pad without a UICC card or a USIM. Therefore, the terminal cannot perform communication authentication with the BSF through the UICC card, and the CGC is not set, and the same B- cannot be shared with the BSF. TID and Ks, although the terminal does not have a CGC, the first credential corresponding to the first username can be obtained by using the CGC on the terminal with other terminals having the UICC card.

Therefore, the user is required to enter an identifier of the application server that needs to log in on the CGC. The input method can be manually input, or the NAF-ID of multiple application servers can be preset on the CGC, and the user can select the corresponding application server.

Step S402, generating a first credential by using the setting algorithm, the identifier of the application server, the key Ks shared with the self-booting function device BSF, and the key identifier B-TID, so that the application server is configured according to Performing login verification on the application client by using the second credential corresponding to the first username and the first credential obtained from the BSF; wherein the second credential is used by the BSF and generated The first credential is generated in the same way.

Step S402 is the same as step S302 of the foregoing embodiment, and details are not described herein again. Step S403, outputting the first credential to the user.

The CGC generates a first credential according to the B-TID, the Ks, and the NAF_ID, and displays the first credential on the terminal screen to the user, so that the user inputs the first credential into the application client of the other terminal, to And causing the application client to generate a login request according to the first credential and the first username, and sending the login request to the application server to request verification.

According to the method for generating a credential provided by the embodiment of the present invention, the credential of any server is generated in the same manner as the BSF, and the application client on the terminal that cannot execute the GB A process can be trusted to log in to the application server. Shape, the generated trust is convenient for user input.

Figure 6 is a flow diagram of still another embodiment of a further refinement of an embodiment of the method of generating a credential of the present invention illustrated in Figure 4. As shown in Figure 6, the method includes the following steps:

Step S501: Receive a credential obtaining request of an application client, where the credential obtaining request includes an identifier of an application server that the application client requests to log in.

In this embodiment, the terminal where the application client is located is a device with a UICC card or a USIM card, and the GBA process can be executed with the BSF. Therefore, the credential acquisition request sent by the application client of the terminal directly includes the identifier of the application server that the application client requests to log in.

Step S502, using a setting algorithm, generating an identifier of the application server, a key Ks shared with the self-booting function device BSF, and a key identifier B-TID, so that the application server is configured according to Performing login verification on the application client by using the second credential corresponding to the first user name obtained from the BSF; wherein the second credential is used by the BSF to generate the same as the first credential Way to generate.

Step S502 is the same as step S302 of the foregoing embodiment, and details are not described herein again.

Step S503: Send the first credential to the application client.

After generating the first credential according to the B-TID, the Ks, and the NAF-ID, the CGC sends the first credential directly to the application client, so that the application client generates the login according to the first credential and the first username. Request, send the login request to the application server to request authentication.

According to the method for generating a credential provided by the embodiment of the present invention, the credential obtaining request of the application client of the terminal may be directly received, and the credential of any server may be generated in the same manner as the BSF, without the user inputting the credential. Convenient application server login.

FIG. 7 is a schematic structural diagram of an embodiment of an application server according to the present invention. As shown in FIG. 7, the application server 1000 includes: The first searching unit 11 is configured to: when receiving the login request generated by the application client according to the first username and the first credential, searching for a second credential corresponding to the first username, where the second trust The shape is generated by the self-booting function device BSF and the credential generating client CGC generating the first credential.

When receiving the login request of the application client, parsing the login request, obtaining the first user name, obtaining the first credential according to the first username, and then the first searching unit 11 searching for the second credential corresponding to the first username . If the user has logged in to the application server, the application server may store the second credential locally. Therefore, the second credential generated by the BSF corresponding to the first username may be found locally; if there is no local storage, A second credential corresponding to the first username is obtained from the BSF.

The present invention can use the CGC on any terminal as long as it generates a CGC corresponding to the first trust of the first username. The BSF first performs the GBA process with the CGC, and negotiates to obtain the same B-TID and Ks, and the Ks is stored by the first user name or other identifier associated with the first user name; and then, according to the identifier of the application server that obtains the request by sending the credential The NAF_ID searches for the corresponding Ks according to the first user name in the acquisition request or the identifier associated with the first user name, and then generates the second credential using the same algorithm as the CGC generates the first credential. The BSF sends the generated second credential to the application server.特定 Using a specific algorithm to make the generated credentials are also user-friendly.

The confirming unit 12 is configured to confirm, according to the second credential, whether the application client passes the verification. Comparing the first credential and the second credential, if the result of the comparison is consistent, the confirming unit 12 confirms that the verification is successful, allows the application client to log in, and returns a login success message to the application client. Otherwise, the confirmation unit 12 confirms that the verification has failed, does not allow the application client to log in, and returns a login failure message to the application client.

According to an application server provided by an embodiment of the present invention, when an application client requests to log in to the application server, the user name that is easy to remember by the user may be input, and the CGC generated by any terminal is generated in the same manner as the BSF. The entered credential completes the login authentication of the application server through the username and the credential, and avoids the user inputting a complicated username and credential, which simplifies the login process.

Figure 8 is a block diagram showing another embodiment of a further refinement of an embodiment of an application server of the present invention shown in Figure 7. As shown in FIG. 8, the application server 2000 includes:

The indicating unit 21 is configured to: when the first credential is not valid, indicating that the application client obtains the first credential from the CGC, where the CGC is The application client is installed on the same or a different terminal.

If the login request does not carry the indication that the application client does not have a valid first credential, the application client has a valid first credential, and then continues to perform login authentication; if the login request indicates that it has no valid first credential The instructing unit 21 instructs the application client to acquire the first credential from the CGC.

The login authentication process cannot be continued because the confirmation login request does not carry a valid first credential. Continued, the instructing unit 21 sends a response message that the first credential is invalid to the application client, in which the application client is instructed or prompted to obtain the first credential from the CGC. For example, the user is instructed to input the identifier of the application server, such as the NAF_ID, on the CGC of the mobile terminal to which the UICC card is inserted, and the application server or the BSF may further apply the corresponding application client, terminal, and application server through a short message or the like. The information is sent to the user's mobile terminal with the UICC card inserted to prompt the user that he is trying to access an application server. Knowing the NAF-ID, the CGC generates a first credential according to the algorithm agreed with the BSF according to its B-TID, Ks and the NAF-ID shared with the BSF. If there is no valid Ks or B-TID on the CGC, the CGC needs to perform the GB A process with the B SF to generate valid Ks and B-TIDs.

The first searching unit 22 is configured to: when receiving the login request generated by the application client according to the first username and the first credential, find a second credential corresponding to the first username.

In this embodiment, the first searching unit 22 includes a second searching unit 221 and a first acquiring unit.

222.

The second searching unit 221 is configured to locally search for the stored second trust corresponding to the first username.

The first obtaining unit 222 is configured to acquire, from the BSF, a second trust corresponding to the first username.

If the user has successfully logged in to the application server with the first username and the first credential, the application server may locally store the second credential obtained from the BSF for verifying the login request of the user, and the application server may also be the user locally. The identifier classification class stores the trusts of the plurality of users. Therefore, the second search unit 221 searches for and acquires the second credential corresponding to the first user name according to the first user name. If the second credential corresponding to the first username is not stored locally, the first credential is retrieved from the BSF by the first obtaining unit 222.

The first obtaining unit 222 further includes a first sending unit 00 and a second acquiring unit 01. a first sending unit 00, configured to send, to the BSF, an acquisition request of the second credential, where Obtaining a request to carry a second user name, so that the BSF searches for a key and a key identifier corresponding to the second user name, and uses a setting algorithm according to the secret language, a key identifier, and an identifier of an application server. Generating the second credential, wherein the second username is associated with the first username, where the key and the key identifier are a key Ks and a key identifier shared with the CGC Character B-TID.

The second obtaining unit 01 is configured to acquire the second credential generated by the BSF.

First, the first user name carried in the login request received from the application client is converted into a second user name that the BSF can recognize, such as an International Mobile Subscriber Indentification Number (IMSI) or a mobile registered user international Mobile Subscriber International ISDN/PSTN number (MSISDN), or an identity that contains IMSI or MSISDN information, since the BSF can only identify IMSI or MSISDN. This second username is used to look up Ks and B-TID on the BSF. Then, the BSF sends the second credential acquisition request to the BSF, and the BSF first searches for the corresponding Ks according to the second user name, where the Ks is the BSF and the CGC that generates the first credential is shared by performing the GBA process, according to the The CGC-defined algorithm generates a second credential for the Ks, the B-TID, and the NAF_ID of the application server that sent the fetch request, and returns it to the application server.

A method of generating a credential (;Credential) is:

Ks NAF = KDF (Ks, NAF-ID);

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

The confirming unit 23 is configured to confirm, according to the second credential, whether the application client passes the verification.

An application server according to an embodiment of the present invention, when an application client requests to log in to the application server, may input a user name that is easy for the user to record, and input CGC and BSF on any terminal. The easy-to-enter credentials generated in the same way complete the login authentication of the application server through the username and the credential, thereby avoiding the user inputting complicated user names and credentials, and simplifying the login process.

FIG. 9 is a schematic structural diagram of an embodiment of a credential generation client CGC according to the present invention. As shown in Figure 9, the CGC3000 includes:

The first receiving unit 31 is configured to receive an identifier of an application server that the application client requests to log in. The application client in the embodiment of the present invention is installed on the terminal, and the terminal may be a device having a UICC card, such as a mobile terminal, or a device without a UICC card, such as a PC or a pad, and the application client includes a microblog. OTT (Over The Top) application client such as WeChat. It should be noted that the browser is also an application client.

When the application client requests to log in to an application server, the first receiving unit 31 receives the identifier NAF_ID of the application server that is sent by the application client or directly input by the user.

The first generating unit 32 is configured to generate, by using a setting algorithm, an identifier of the application server, a key Ks shared with the self-booting function device BSF, and a key identifier B-TID to generate a first credential, so that The application server performs login verification on the application client according to the second credential corresponding to the first user name obtained from the BSF; wherein the second credential is used by the BSF to generate the first The trust is generated in the same way.

CGC first performs the GBA process with the BSF to obtain the shared B-TID and Ks; then, according to The received NAF_ID uses the algorithm agreed with the BSF to generate the first credential. A method of generating a credential is:

Ks NAF = KDF (Ks, NAF-ID);

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

According to the CGC provided by the embodiment of the present invention, the credential of any server is generated in the same manner as the BSF, and the application client on any terminal can be provided with the credential of logging in to the application server, and the generated credential is convenient for the user to input. .

Figure 10 is a block diagram showing another embodiment of a further refinement of an embodiment of a CGC of the present invention shown in Figure 9. As shown in Figure 10, the CGC4000:

The second receiving unit 41 is configured to receive an identifier of the application server that the application client input by the user requests to log in.

In this embodiment, the terminal where the client is located is a device such as a PC or a pad without a UICC card or a USIM. Therefore, the terminal cannot perform communication authentication with the BSF through the UICC card, and the CGC is not set, and the same B- cannot be shared with the BSF. TID and Ks, although the terminal does not have a CGC, the first credential corresponding to the first username can be obtained by using the CGC on the terminal with other terminals having the UICC card.

a first generating unit 42, configured to use a setting algorithm, and identifiers of the application server The key Ks and the key identifier B-TID shared by the boot function device BSF generate a first credential, so that the application server pairs the application client according to the second credential corresponding to the first user name acquired from the BSF Performing login verification; wherein the second credential is generated by the BSF in the same manner as the first credential is generated.

The function of the first generating unit 42 is the same as that of the first generating unit 32 of the foregoing embodiment, and details are not described herein again.

The output unit 43 is configured to output the first credential to the user.

According to the CGC provided by the embodiment of the present invention, the credential of any server is generated in the same manner as the BSF, and the application client on the terminal that cannot execute the GB A process can be provided with the credential of logging in to the application server, and generated. The credibility is convenient for the user to input.

Figure 11 is a block diagram showing still another embodiment of a further refinement of an embodiment of a CGC of the present invention shown in Figure 9. As shown in Figure 11, the CGC5000 includes:

The third receiving unit 51 is configured to receive a credential obtaining request of the application client, where the credential obtaining request includes an identifier of an application server that the application client requests to log in.

a first generating unit 52, configured to generate, by using a setting algorithm, an identifier of the application server, a key Ks shared with the self-booting function device BSF, and a key identifier B-TID to generate a first credential, so that The application server performs login verification on the application client according to the second credential corresponding to the first user name obtained from the BSF; wherein the second credential is used by the BSF to generate the first The trust is generated in the same way.

The function of the first generating unit 52 is the same as that of the first generating unit 32 of the foregoing embodiment, and details are not described herein again.

The second sending unit 53 is configured to send the first credential to the application client.

After the CGC generates the first credential according to the B-TID, Ks, and NAF_ID, the first credential is directly Sending to the application client, so that the application client generates a login request according to the first credential and the first username, and sends the login request to the application server to request verification.

The CGC provided by the embodiment of the present invention can directly receive the credential acquisition request of the application client of the terminal, and generate a credential for logging in to any server in the same manner as the BSF, without the user inputting the credential, facilitating the application server. log in.

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and the equivalent changes made by the claims of the present invention are still within the scope of the present invention.

Claims

claims

1. An authentication method, characterized by including:

When receiving a login request generated based on the first username and the first credential from the application client, search for the second credential corresponding to the first username;

Confirm whether the application client passes verification according to the second credential;

Wherein, the second credential is generated by the bootstrap function device BSF in the same manner as the credential generation client CGC generates the first credential.

2. The method of claim 1, wherein after receiving the login request from the application client and before searching for the second credential corresponding to the first user name, the method further includes: if the When the login request indicates that there is no valid first credential, the application client is instructed to obtain the first credential from the CGC, where the CGC and the application client are installed in the same or different on the terminal.

3. The method according to claim 1 or 2, characterized in that the search for the second credential corresponding to the first user name includes:

Search locally for a second stored credential corresponding to the first username; or

Obtain a second credential corresponding to the first user name from the BSF.

4. The method of claim 3, wherein said obtaining the second credential corresponding to the first user name from the BSF includes:

Send an acquisition request for the second credential to the BSF, where the acquisition request carries a second username, so that the BSF searches for the key and key identifier corresponding to the second username, according to the The secret word, key identifier, and application server identifier are used to generate the second credential using a set algorithm, wherein the second user name is associated with the first user name, and the key and password are The key identifier is the key Ks shared with the CGC and the key identifier B-TID;

Obtain the second credential generated by the BSF.

5. The method of claim 4, wherein the second username is International Mobile Identity Number. Alias IMSI, Mobile Subscriber International Integrated Services Digital Network number MSISDN or an identifier carrying the IMSI or MSISDN.

6. A method of generating a certificate of credence, characterized by including:

The identifier of the application server that receives the application client's login request;

Using a setting algorithm, the identifier of the application server, the key Ks shared with the bootstrap function device BSF and the key identifier B-TID are used to generate a first credential, so that the application server obtains the first credential from the BSF The second credential corresponding to the first user name performs login verification on the application client; wherein, the second credential is generated by the BSF in the same manner as the first credential. .

7. The method of claim 6, wherein the application setting algorithm combines the identifier of the application server, the key Ks shared with the bootstrap function device BSF and the key identifier B- TID generates the first credential, including:

The following algorithm is used to generate the first credential:

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

Wherein, Credential is the first credential, Ks-NAF is generated from the Ks and the identifier NAF-ID of the application server according to the general bootstrap architecture GBA process, and Trunc48 is the 256-bit SHA-256 value intercepted. The lower 48 bits, base64encoded, are BASE64 encoded.

8. The method of claim 6 or 7, wherein the identifier of the application server that receives the application client's request to log in includes:

receiving user input for an identifier of the application server; and

After using the setting algorithm to generate a first credential from the identifier of the application server, the key shared with the BSF and the key identifier, it also includes:

Output the first credential to the user.

9. The method of claim 6 or 7, wherein the identifier of the application server that receives the application client's request to log in includes:

Receive a credential acquisition request from the application client, where the credential acquisition request includes the application client using the server’s identifier; and

Send the first credential to the application client.

10. An application server, characterized by including:

A first search unit configured to search for a second credential corresponding to the first user name when receiving a login request generated by the application client based on the first user name and the first credential;

A confirmation unit, configured to confirm whether the application client passes the verification according to the second credential; wherein the second credential is generated by the self-boot function device BSF and the credential generating client CGC. Credentials are generated in the same manner.

11. The application server according to claim 10, further comprising:

Instruction unit, configured to instruct the application client to obtain the first credential from the CGC if the login request indicates that there is no valid first credential, wherein the CGC and the application Clients are installed on the same or different terminals.

12. The application server according to claim 10 or 11, characterized in that the first search unit includes:

A second search unit configured to locally search for a stored second credential corresponding to the first user name; or

A first obtaining unit, configured to obtain a second credential corresponding to the first user name from the BSF.

13. The application server according to claim 12, characterized in that the first acquisition unit includes:

The first sending unit is configured to send an acquisition request for the second credential to the BSF, where the acquisition request carries a second username, so that the BSF searches for the key and password corresponding to the second username. key identifier, using a setting algorithm to generate the second credential based on the password, the key identifier, and the identifier of the application server, where the second user name is associated with the first user name, where , the key and key identifier are the key Ks and key identifier B-TID shared with the CGC; The second acquisition unit is used to acquire the second credential generated by the BSF.

14. The application server according to claim 13, wherein the second user name is an International Mobile Identity IMSI, a Mobile Subscriber International Integrated Services Digital Network Number MSISDN, or an identifier carrying the IMSI or MSISDN.

15. A credential generation client CGC, which is characterized by including:

The first receiving unit is used to receive the identifier of the application server that the application client requests to log in; the first generating unit is used to use the setting algorithm to share the identifier of the application server with the self-boot function device BSF The key Ks and the key identifier B-TID generate a first credential, so that the application server performs login verification on the application client based on the second credential corresponding to the first user name obtained from the BSF;

Wherein, the second credential is generated by the BSF in the same manner as the first credential.

16. The CGC of claim 15, wherein the first generation unit includes: a second generation unit configured to generate the first credential using the following algorithm:

Credential = base64encoded{Trunc48[SHA-256(Ks_NAF || B-TID)]}.

Among them, Credential is the first credential, Ks_NAF is generated from the Ks and the identifier NAF_ID of the application server according to the general bootstrap architecture GBA process, and Trunc48 is the low 48 of the intercepted 256-bit SHA-256 value. bits, base64encoded for BASE64 encoding.

17. The CGC according to claim 15 or 16, characterized in that the first receiving unit includes:

The second receiving unit is configured to receive the identifier of the application server input by the user; and the CGC also includes:

An output unit, configured to output the first credential to the user.

18. The CGC according to claim 15 or 16, characterized in that, the first receiving unit packet A third receiving unit, configured to receive a credential acquisition request from the application client, where the credential acquisition request includes the identifier of the application server; and

The CGC also includes:

The second sending unit is configured to send the first credential to the application client.