WO2015039502A1 - Procédé et appareil d'authentification de communication, et dispositif terminal - Google Patents

Procédé et appareil d'authentification de communication, et dispositif terminal Download PDF

Info

Publication number
WO2015039502A1
WO2015039502A1 PCT/CN2014/083640 CN2014083640W WO2015039502A1 WO 2015039502 A1 WO2015039502 A1 WO 2015039502A1 CN 2014083640 W CN2014083640 W CN 2014083640W WO 2015039502 A1 WO2015039502 A1 WO 2015039502A1
Authority
WO
WIPO (PCT)
Prior art keywords
token
terminal device
authentication system
account
operator
Prior art date
Application number
PCT/CN2014/083640
Other languages
English (en)
Chinese (zh)
Inventor
李靖
简海燕
叶婉玲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2015039502A1 publication Critical patent/WO2015039502A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/53—Network services using third party service providers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a communication authentication method and apparatus, and a terminal device. Background technique
  • Real-time communication (English: Web Real-Time Communications, abbreviation: WebRTC)
  • WebRTC Web Real-Time Communications
  • IMS Internet Protocol Multimedia Subsystem
  • the authentication method of the real-time communication service of the webpage provided by the operator the user needs to use the third-party application server (English: 3 M Party WEB server) account and password to log in to the third-party application website.
  • the user needs to use the WebRTC service for example, the user uses Taobao.
  • the carrier username English: webID
  • password English: Password
  • the technical problem to be solved by the present invention is that when a user uses a service provided by an operator through a third-party application website, multiple logins are required, and the process is complicated.
  • the present invention provides a communication authentication method, including:
  • the third-party authentication system And receiving, by the third-party authentication system, the access authentication request sent by the terminal device, where the access authentication request carries the third-party application identifier and the first token, where the a token is a token allocated by the third-party authentication system according to the account, and the account is an account allocated by the third-party authentication system for the terminal device;
  • Receiving the account corresponding to the first token sent by the third-party authentication system acquiring a user identifier bound to the account, and assigning a second token and an IP address of the gateway according to the user identifier, so as to
  • the terminal device uses the service provided by the operator after the gateway authenticates the second token, and the user identifier is an identifier that the operator authentication system allocates for the user.
  • the first token sent by the third-party authentication system is received in a case where the user identifier bound to the account is not present Before the corresponding account, the obtaining the user identifier bound to the account, the method further includes: sending a user identifier input request to the terminal device;
  • the binding relationship between the account and the user identifier is recorded.
  • Allocating the second token and the IP address according to the user identifier Sending, by the terminal device, the second token and the IP address, so that the terminal device sends an authentication request of the second token to the gateway according to the IP address;
  • the receiving the access authentication request sent by the terminal device includes:
  • the present invention provides a communication authentication method, including:
  • the third-party authentication request carries a first token
  • the first token is a token that is allocated by the third-party authentication system according to an account provided by the terminal device, and the account is An account that is allocated to the terminal device by the third-party authentication system
  • the account corresponding to the first token is sent to the operator authentication system, to And causing the operator authentication system to obtain the user identifier bound to the account.
  • the method before receiving the third-party authentication request sent by the operator authentication system, the method includes:
  • the present invention provides a communication authentication method, including:
  • the terminal device After the third-party authentication system passes the authentication of the account provided by the terminal device, the terminal device sends an access authentication request to the operator authentication system, where the access authentication request carries the third-party application identifier and the first token.
  • the first token is a token that is allocated by the third-party authentication system according to the account of the terminal device, so that the operator authentication system requests the third-party authentication system to the first according to the third-party application identifier.
  • the token is authenticated to obtain the user identifier bound to the account;
  • the gateway After the gateway authenticates the second token, the service provided by the operator is used.
  • the acquiring the user identifier bound to the account includes:
  • the present invention provides a communication authentication apparatus, including:
  • a first receiving module configured to receive an access authentication request sent by the terminal device when the third-party authentication system passes the account verification provided by the terminal device, where the access authentication request carries the third-party application identifier and the a token, the first token is a token allocated by the third-party authentication system according to the account, and the account is an account allocated by the third-party authentication system to the terminal device;
  • a first sending module connected to the first receiving module, configured to apply the identifier to the third party
  • Corresponding third-party authentication system sends a third-party authentication request, where the third-party authentication request carries the first token
  • a second receiving module configured to receive the account corresponding to the first token sent by the third-party authentication system
  • a first processing module configured to be connected to the second receiving module, configured to acquire a user identifier bound to the account, and allocate an IP address of the second token and the gateway according to the user identifier, so that the terminal device is in the After the gateway authenticates the second token, the service provided by the operator is used, and the user identifier is an identifier that is allocated by the communication authentication device to the user.
  • the communication authentication apparatus further includes:
  • a second sending module configured to be connected to the first processing module, configured to send a user identity input request to the terminal device
  • the second processing module is configured to be connected to the second receiving module and the first processing module, and configured to record the binding relationship between the account and the user identifier after receiving the user identifier sent by the terminal device.
  • the first processing module specifically includes:
  • a distribution submodule configured to allocate the second token and the IP address according to the user identifier
  • a first sending submodule connected to the allocation submodule, configured to send the first to the terminal device a second token and the IP address, so that the terminal device sends an authentication request of the second token to the gateway according to the IP address
  • a second sending submodule configured to send the user identifier to the gateway, where the second token is authenticated in the communication authentication device, so that the gateway is located according to the user identifier
  • the core network of the operator initiates user registration, and after the registration is completed, the user is allowed to use the service provided by the operator through the terminal device.
  • the first receiving module is further configured to receive the access authentication request from the terminal device by using an operator authentication portal;
  • the second sending module is further configured to send the user identity input request to the terminal device by using the operator authentication portal;
  • the second processing module specifically includes:
  • a first receiving submodule configured to receive, by the operator authentication portal, the user identifier from the terminal device
  • the recording submodule is connected to the first receiving submodule and configured to record a binding relationship between the account and the user identifier.
  • the present invention provides a communication authentication apparatus, including:
  • a receiving module configured to receive a third-party authentication request sent by the operator authentication system, where the third-party authentication request carries a first token, where the first token is allocated by the communication authentication device according to an account provided by the terminal device a token, where the account is an account allocated by the communication authentication device for the terminal device;
  • a first sending module configured to be connected to the receiving module, configured to send the account corresponding to the first token to the operator authentication system, if the first token is authenticated, to The carrier authentication system obtains the user identifier bound to the account.
  • the device further includes: a verification module, configured to verify an account provided by the terminal device;
  • a second sending module configured to be connected to the verification module, configured to return the first token to the terminal device if the verification module passes the verification.
  • the present invention provides a terminal device, including:
  • a sending module configured to send an access authentication request to the operator authentication system, where the third party authentication system passes the account verification provided by the terminal device, where the access authentication request is Carrying a third-party application identifier and a first token, where the first token is a token allocated by the third-party authentication system according to an account of the terminal device, so that the operator authentication system is based on the third-party application. Identifying that the third-party authentication system authenticates the first token to obtain a user identifier bound to the account;
  • a receiving module configured to receive an IP address of the second token and the gateway sent by the operator authentication system, where the IP address of the second token and the gateway is an order allocated by the operator authentication system according to the user identifier Card and IP address;
  • the control module is connected to the receiving module, and is configured to use the service provided by the operator after the gateway authenticates the second token.
  • the receiving module is further configured to: when the carrier authentication system does not have the user identifier bound to the account, The quotient authentication system receives the user identification input request;
  • the sending module is further configured to send the user identifier input by the user to the operator authentication system, so that the operator authentication system records the binding of the account and the user identifier to the communication authentication of the embodiment.
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user can obtain the authorization of the service registered by the user identifier bound to the account. Thus using the service, the process is simple and the user experience is good.
  • FIG. 1 is a flowchart of a communication authentication method according to Embodiment 1 of the present invention.
  • FIG. 2 is a flowchart of a communication authentication method according to Embodiment 2 of the present invention
  • 3 is a flowchart of a communication authentication method according to Embodiment 3 of the present invention
  • FIG. 4 is a flowchart of a communication authentication method according to Embodiment 4 of the present invention.
  • FIG. 5 is a flowchart of a communication authentication method according to Embodiment 5 of the present invention.
  • FIG. 6 is a structural block diagram of a communication authentication apparatus according to Embodiment 6 of the present invention.
  • FIG. 7 is a structural block diagram of a communication authentication apparatus according to Embodiment 7 of the present invention.
  • Embodiment 8 is a structural block diagram of a communication authentication apparatus according to Embodiment 8 of the present invention.
  • FIG. 9 is a structural block diagram of a terminal device according to Embodiment 9 of the present invention.
  • FIG. 10 is a block diagram showing the structure of a communication authentication apparatus according to Embodiment 10 of the present invention. detailed description
  • the communication authentication method may include:
  • Step S100 Receive an access authentication request sent by the terminal device, where the third-party application identifier and the first token are carried in the access authentication request, where the third-party authentication system passes the account verification provided by the terminal device. .
  • the first token is the third party authentication system according to the account An assigned account, where the account is an account allocated by the third-party authentication system for the terminal device.
  • the user can use a terminal device (English: terminal equipment, abbreviation: TE), for example: mobile phone, personal computer (English: personal computer, abbreviation: PC), tablet, etc., to log in to a third-party application website (for example: Taobao.com) , Sina.com, Dangdang.com, Mushroom Street, etc.).
  • the third-party application website may include its own authentication system, referred to as a third-party authentication system. After the user is authenticated by the third-party authentication system, the third-party application website can be logged in. The third-party application website can then be used to provide services provided by operators (for example, China Mobile, China Unicom, China Telecom, IMS service providers, etc.).
  • the service may be a real-time communication WebRTC service such as a voice service, a video service, a file transmission service, and the like. For example: If you use your mobile phone to log in to Mushroom Street for shopping, you can click on the video displayed on the mushroom street interface to contact the seller's dialog box and the seller for video communication.
  • the third-party application website and the carrier authentication system are two operating systems, after the user logs in to the third-party application website, the operator authentication system needs to authenticate the user's identity.
  • the third-party authentication system can verify whether the account is a legal account assigned by the third-party authentication system for the user. Whether the password corresponding to the account is accurate. Therefore, when the user provides an account to the third-party authentication system through the terminal device, the user can provide the password corresponding to the account to the third-party authentication system. In the case that the third-party authentication system passes the verification, the third-party authentication system may assign the first token corresponding to the account to the user according to the account.
  • the receiving the access authentication request sent by the terminal device includes: receiving, by the operator authentication portal, the access authentication request from the terminal device.
  • the operator authentication portal may receive the access authentication request sent by the terminal device, and then the operator authentication system receives the access authentication request sent by the operator authentication portal.
  • Step S120 Send a third-party authentication request to the third-party authentication system corresponding to the third-party application identifier, where the third-party authentication request carries the first token.
  • An interface device can be set inside or outside the carrier authentication system.
  • the interface device is configured to be external to the operator authentication system, and the interface device forwards information between the operator authentication system and the third-party authentication system, and the operator authentication system sends a third-party authentication request to the interface device.
  • the third-party authentication request is forwarded by the interface device to the third-party authentication system.
  • the interface device is set inside the operator authentication system, and the operator authentication system can directly send a third-party authentication request to the third-party authentication system.
  • the operator authentication system can learn, according to the third-party application identifier carried in the access authentication request, which third-party application website is accessed by the third-party application website, and can use the interface device to apply to the third-party application website.
  • the third-party authentication system sends a third-party authentication request that carries the first token, and may also directly send a third-party authentication request that carries the first token to the third-party authentication system of the third-party application website.
  • the carrier authentication system can learn that the access authentication request is accessed by the Taobao network according to the third-party application identifier, and the third-party authentication request can be sent to the Taobao authentication system through the interface device.
  • the third-party authentication request may be directly sent to the Taobao authentication system, where the third-party authentication request carries the first token corresponding to the user name of the Taobao network allocated by the Taobao authentication system.
  • Step S140 Receive the account corresponding to the first token sent by the third-party authentication system, obtain a user identifier bound to the account, and allocate a second token and an IP address of the gateway according to the user identifier. So that the terminal device uses the service provided by the operator after the gateway authenticates the second token.
  • the user identifier is an identifier assigned by the operator authentication system to the user.
  • the operator authentication system can receive the account sent by the third-party authentication system through the interface device, and the operator authentication system can directly receive the account sent by the third-party authentication system.
  • the account number in the step S140 may include only the account number allocated by the third-party authentication system for the terminal device.
  • the operator authentication system may also receive the first token corresponding to the account through the interface device or directly.
  • the operator authentication system can obtain a user identifier bound to the account according to the account, and the user identifier can include an IP multimedia subsystem.
  • There is a user ID i (English: Internet Protocol Multimedia Subsystem Public User Identity, IMPU), IP Multimedia Subsystem Private User Identity (IMI), and users sign up with operators.
  • the operator authentication system may allocate the IP address of the second token and the gateway according to the obtained user identifier, and send the IP address of the second token and the gateway to the terminal device, so that the terminal device may be in the After the gateway authenticates the second token, the user can directly use the service provided by the operator. For example: If the third-party application website is Taobao, if the first token of the Taobao authentication system is passed, the operator authentication system can directly receive the user name of the Taobao network sent by the Taobao authentication system through the interface device, and then the operator authentication.
  • the system can obtain a user identifier such as a mobile phone number bound to the user name of Taobao. After the subsequent gateway is replaced by the user registration, the user can directly use the terminal device to use the service registered by the operator and the mobile phone number bound to the Taobao user name.
  • a user identifier such as a mobile phone number bound to the user name of Taobao.
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user identity of the account can be obtained through the operator authentication system.
  • the authorization of the registered business, thereby using the service, the process is simple and the user experience is good.
  • FIG. 2 is a flow chart of a communication authentication method according to Embodiment 2 of the present invention.
  • the same steps in Fig. 2 as those in Fig. 1 have the same functions, and a detailed description of these steps will be omitted for the sake of brevity.
  • the method may further include: Step S200: Send a user identifier input request to the terminal device.
  • the operator authentication system may search whether the account is bound with the user identifier. If the user identifier is not associated with the account, the S200 can be performed. The operator authentication system can request the terminal device to send the user identifier. On the other hand, if there is a user identifier bound to the account, the foregoing step S140 can be performed, and the operator authentication system can obtain the user identifier bound to the account.
  • the China Mobile authentication system can be based on the Taobao network.
  • the user name is used to find out whether the user name of the Taobao network is bound to the mobile phone number of the user. If the mobile phone number of the user is not bound, the China Mobile authentication system can request the user to send the mobile phone number through the mobile phone.
  • the sending the user identifier input request to the terminal device includes: sending, by the operator authentication portal, the user identifier input request to the terminal device.
  • the operator authentication system may send a user identity input request to the operator authentication portal, and then the carrier authentication portal sends a user identity input request to the terminal device.
  • Step S220 After receiving the user identifier sent by the terminal device, record a binding relationship between the account and the user identifier.
  • step S220 may specifically include:
  • the operator authentication system may receive the user identifier from the terminal device through the operator authentication portal, and the operator authentication system may record the binding relationship between the account and the user identifier. among them, The user can input only the IMPU or IMPI through the terminal device, and can input both the IMPU and the IMPIo. Because the IMPU has a certain mapping relationship with the IMPI, the operator authentication system can find the corresponding IMPI according to the IMPU input by the user through the terminal device. The user can also input only the user ID that the user has signed with the operator through the terminal device. The operator authentication system cannot authenticate the user ID and can authenticate to the home subscriber server (English: Home Subscriber Server, HSS) in the IMS core network of the operator.
  • HSS Home Subscriber Server
  • the operator authentication system may record the binding relationship between the account and the user identifier.
  • the account may include only the account assigned by the third-party authentication system for the terminal device in step S220. For example: If the user logs in to Taobao through the mobile phone and uses the mobile phone function of China Mobile on Taobao, the China Mobile authentication system can receive the mobile phone number of the user from the mobile phone through the China Mobile Authentication Portal, the China Mobile authentication system can record Taobao. The binding relationship between the username and the user's mobile number. After the subsequent user registration is completed, the service registered by the mobile phone number provided by China Mobile and bound to the Taobao user name can be directly used.
  • Step S240 Allocate the second token and an IP address of the gateway according to the user identifier.
  • Step S260 Send the second token and the IP address to the terminal device, so that the terminal device sends an authentication request of the second token to the gateway according to the IP address.
  • Taobao a third-party application website
  • China Mobile a third-party application website
  • the China Mobile authentication system can assign the second token and the IP address of the gateway (English: gateway) to the mobile phone according to the mobile phone number.
  • the China Mobile authentication system can send the second token and the IP address to the mobile phone, and the mobile phone can find a gateway corresponding to the IP address according to the IP address, and establish a communication channel with the gateway, and the gateway can be sent to China.
  • the mobile authentication system sends a second token authentication request.
  • Step S280 If the second token is authenticated and passed in the operator authentication system, send the user identifier to the gateway, so that the gateway is shipped according to the user identifier.
  • the core network of the business initiates user registration, and after the registration is completed, the user is allowed to use the service provided by the operator through the terminal device.
  • the operator authentication system may allocate the IP address of the second token and the gateway, and send the allocated second token and the IP address of the gateway to the terminal device, where The terminal device may send an authentication request of the second token to the gateway according to the IP address.
  • the gateway may send the second token authentication request to the operator authentication system.
  • the operator authentication system can authenticate whether the second token passes. If the operator authentication system authenticates that the second token passes, the user identifier can be sent to the gateway.
  • the gateway can register according to the user identifier instead of the user to the core network, for example, the IMS core network, and the gateway can indicate that the user of the core network has been authenticated, and the authentication challenge is no longer needed. After the gateway replaces the user registration, the user can directly use the service provided by the operator through the terminal device.
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user identity of the account can be obtained through the operator authentication system.
  • the authorization of the registered business, thereby using the service, the process is simple and the user experience is good.
  • FIG. 3 is a flowchart of a communication authentication method according to Embodiment 3 of the present invention. As shown in FIG. 3, the communication authentication method may include:
  • Step S300 Receive a third-party authentication request sent by the operator authentication system, where the third-party authentication request carries a first token, where the first token is a token that is allocated by the third-party authentication system according to the account provided by the terminal device.
  • the account is allocated by the third-party authentication system for the terminal device. account number.
  • the method before receiving the third-party authentication request sent by the operator authentication system, the method includes: verifying an account provided by the terminal device; and returning to the terminal device if the verification is passed First token.
  • the third-party application website may include its own authentication system, which is referred to as a third-party authentication system, and may also include its own application server, which is referred to as a third-party application server.
  • the third-party authentication system can verify whether the account is a legal account assigned by the third-party authentication system for the user. Whether the password corresponding to the account is accurate. Therefore, when the user provides an account to the third-party authentication system through the terminal device, the user can provide the password corresponding to the account to the third-party authentication system. When the third-party authentication system verifies that the account has passed, the third-party authentication system may assign the first token corresponding to the account to the user according to the account.
  • An interface device can be set inside or outside the third-party authentication system.
  • the interface device is set up outside the third-party authentication system, and the interface device forwards information between the operator authentication system and the third-party authentication system, and the interface device receives the third-party authentication request sent by the operator authentication system.
  • the third-party authentication system receives the third-party authentication request forwarded by the interface device.
  • the interface device is set in the third-party authentication system, and the third-party authentication system can directly receive the third-party authentication request sent by the carrier authentication system.
  • Taobao a third-party application website
  • the Taobao server third-party application server
  • the Taobao network authentication system can verify the Taobao user name. If the Taobao authentication system verifies that the user name of the Taobao network passes, the Taobao authentication system can assign a first token corresponding to the username to the user, and instruct the mobile phone to jump. Go to the Taobao server.
  • step S320 if the first token is authenticated, the account corresponding to the first token is sent to the operator authentication system, so that the operator authentication system obtains the account number.
  • the specified user ID The specified user ID.
  • the third-party authentication system may send an account corresponding to the first token to the operator authentication system through the interface device, and the third-party authentication system may directly authenticate the carrier.
  • the system sends an account corresponding to the first token.
  • the operator authentication system can obtain the user identifier bound to the account according to the account. After the subsequent user registration is completed, the service registered by the operator and the user identifier bound to the account can be directly used.
  • the user only needs to provide an account once to log in once, and the third-party authentication system verifies the account. After the account is verified, the account can be obtained through the operator authentication system. The user identifies the authorization of the registered service, thereby using the service, and the process is simple and the user experience is good.
  • the communication authentication method may include:
  • Step S400 In the case that the account authentication provided by the third-party authentication system for the terminal device passes, the terminal device sends an access authentication request to the operator authentication system, where the access authentication request carries the third-party application identifier and the first order.
  • the first token is a token allocated by the third-party authentication system according to an account of the terminal device, so that the operator authentication system requests the third-party authentication system according to the third-party application identifier.
  • the first token is authenticated to obtain the account The user ID of the number binding.
  • the user may log in to the third-party application website by using the terminal device.
  • the third-party application website may include its own authentication system, which is referred to as a third-party authentication system, and may also include its own application server, which is referred to as a third-party application server. If the third-party authentication system verifies that the account provided by the terminal device passes, the terminal device can receive the first token corresponding to the account assigned by the third-party authentication system. The terminal device may send an access authentication request carrying the third-party application identifier and the first token to the operator authentication system.
  • Taobao a third-party application website
  • the Taobao server third-party application server
  • the Taobao network authentication system can authenticate whether the Taobao user name is passed. If the username of the Taobao network is authenticated, the Taobao authentication system can assign a first token to the user and instruct the mobile phone to jump to the Taobao server. If the user needs to use the service provided by China Mobile, the user can send an access authentication request carrying the Taobao application identifier (third-party application identifier) and the first token to the China Mobile authentication system.
  • the acquiring the user identifier bound to the account includes: if the operator authentication system does not have the user identifier bound to the account, The operator authentication system receives the user identification input request;
  • Taobao a third-party application website
  • China Mobile a third-party application website
  • the mobile phone function of China Mobile (operator) on Taobao finds that there is no binding to the user name of Taobao.
  • the mobile phone number the mobile phone can receive the mobile phone number input request sent by the China Mobile authentication system.
  • the user can send the mobile phone number to the China Mobile authentication system through the mobile phone.
  • China Mobile's authentication system can record the binding relationship between the mobile phone number and the user name of Taobao. After the subsequent user registration is completed, you can directly use China.
  • Step S420 Receive an IP address of a second token and a gateway sent by the operator authentication system, where the IP address of the second token and the gateway is a token and an IP that are allocated by the carrier authentication system according to the user identifier. address.
  • Step S440 After the gateway authenticates the second token, use the service provided by the operator, specifically, the terminal device may receive the second token and the IP address of the gateway sent by the operator authentication system, according to the gateway. The IP address finds the corresponding gateway, and sends an authentication request for the second token to the gateway. And the gateway sends the authentication request of the second token to the carrier authentication system.
  • the operator authentication system After receiving the authentication request of the second token, the operator authentication system may authenticate whether the second token passes, and if the carrier authenticates After the system authenticates that the second token passes, the user identifier may be sent to the gateway, and the gateway may perform user registration according to the user identifier instead of the user. After the gateway is replaced by the user registration, the user can directly use the terminal device to directly register the service registered by the operator with the user ID bound to the account.
  • the communication authentication method is described by taking the operator authentication system, the third-party authentication system, and the terminal device as an example, those skilled in the art can understand that the present invention is not limited thereto, and other names have different functions but similar functions.
  • the ability of the communication device to perform the functions of the present invention is within the scope of the present invention.
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user identity of the account can be obtained through the operator authentication system.
  • the authorization of the registered business, thereby using the service, the process is simple and the user experience is good.
  • FIG. 5 is a flowchart of a communication authentication method according to Embodiment 5 of the present invention.
  • the communication authentication method may include: Step 501: The terminal device sends an HTTP GET (IP address of the third-party application server) command to the third-party application server, where the command indicates that the terminal device obtains the IP address of the third-party application server.
  • HTTP GET IP address of the third-party application server
  • Step 502 The third-party application server sends an HTTP 200 OK (login page of the third-party application server) command to the terminal device, where the command indicates that the terminal device successfully loads the login page of the third-party application server.
  • HTTP 200 OK login page of the third-party application server
  • Step 503 The terminal device sends a POST (Account, Password) command to the third-party authentication system.
  • the command indicates that the user can log in to the third-party application server by using the account and the password corresponding to the account, and clicking to log in to the third-party application server. Then redirect to a third-party authentication system to verify the account.
  • POST Account, Password
  • Step 504 The third-party authentication system sends a 302 (Authentication Pass, Assign First Token) command to the terminal device, where the command indicates that the third-party authentication system verifies the account provided by the user through the terminal device, in the process of verifying, Verify that the account is a legal account assigned to the user by the third-party authentication system. You can also verify that the password corresponding to the account is accurate. Therefore, the user can provide the account corresponding to the account to the third-party authentication system while providing the account to the third-party authentication system through the terminal device. If the third-party authentication system verifies that the account is approved, the third-party authentication system can assign a first token (token1) corresponding to the account to the user, and instruct the terminal device to re-joke to the third-party application server.
  • a 302 Authentication Pass, Assign First Token
  • Step 505 The terminal device sends a POST (authentication pass) to the third-party application server, where the command indicates that the terminal device notifies the third-party application server that the third-party authentication system verifies that the account is approved.
  • POST authentication pass
  • Step 506 The third-party application server sends an HTTP 200 OK command to the terminal device, where the command indicates that the third-party application server notifies the terminal device that the third-party authentication system has verified that the account is approved.
  • the user may log in to the third-party application website by using the terminal device.
  • the third-party application website may include its own authentication system, which is referred to as a third-party authentication system, and may also include its own application server, which is referred to as a third-party application server.
  • the third-party authentication system can assign a first token corresponding to the account to the user, and send the first token to the terminal device.
  • Step 507 The terminal device sends an HTTP GET (Service Request) command to the third-party application server, where the command indicates that the user can send a service request to the third-party application server by using the terminal device, where the service request carries the login service mode and the operator.
  • the identifier of the carrier is the identifier of the carrier to which the service to be used by the user belongs.
  • Step 508 The third-party application server sends an HTTP 200 OK (IP address of the operator authentication portal) command to the terminal device, where the third-party application server obtains the user to log in to the service through the terminal device according to the received service request.
  • the mode is one-time login, and the IP address of the carrier authentication portal can be sent to the terminal device.
  • the third-party application server can receive the service request sent by the user through the terminal device, and obtain the manner in which the user logs in to the service through the terminal device, and if the user needs to use the account once to log in through the terminal device, the device can directly obtain the service request.
  • the third-party application server may send the IP address of the carrier authentication portal to the terminal device.
  • Step 509 The terminal device sends an access authentication request to the operator authentication portal, where the access authentication request carries a third-party application identifier and a first token, where the first token is a third-party authentication system according to the account allocation brand.
  • Step 510 The operator authentication portal sends the foregoing access authentication request to the operator authentication system. Specifically, the operator authentication portal may receive the access authentication request sent by the terminal device, and then the operator authentication system receives the access authentication request sent by the operator authentication portal.
  • Step 511 The operator authentication system sends a third-party authentication request to the third-party authentication system corresponding to the third-party application identifier, where the third-party authentication request carries the first token.
  • An interface device can be set inside or outside the carrier authentication system.
  • the interface device is set outside the operator authentication system, and the interface device forwards information between the operator authentication system and the third-party authentication system, and the operator authentication system sends the third-party authentication request.
  • the third-party authentication request is forwarded to the third-party authentication system by the interface device.
  • the interface device is set inside the operator authentication system, and the operator authentication system can directly send a third-party authentication request to the third-party authentication system.
  • Step 512 The third-party authentication system authenticates the first token. If the third-party authentication system authenticates the first token, the account corresponding to the first token may be sent to the operator authentication system.
  • An interface device can be set inside or outside the third-party authentication system.
  • the interface device is disposed outside the third-party authentication system, and the interface device can receive the account corresponding to the first token sent by the third-party authentication system, and forward the first token to the operator authentication system.
  • the interface device is set in the third-party authentication system, and the third-party authentication system can directly send the account corresponding to the first token to the operator authentication system.
  • Step 513 The operator authentication system searches whether the account is bound to the user identifier.
  • the user identifier may include any one or more of the user names that the IMPU and the IMPK user subscribe to. If the account is not bound to the user identifier, the operator authentication system may send a user identity input request to the operator authentication portal, and perform steps 514 to 516 to request the user to input the user identifier; if the account is bound with the user identifier, execute Step 517: The operator authentication system allocates a second token to the user.
  • Step 514 The operator authentication portal sends a user identity input request to the terminal device, and requests the user to input the user identifier and password.
  • Step 515 The terminal device sends a POST (User Identity, Password) command to the operator authentication portal.
  • the command indicates that the user can input the user identifier and password through the terminal device, and then the terminal device sends the user identifier to the operator authentication portal.
  • the user can input any one or more of the IMPU, the IMPI, and the user name signed by the user and the operator through the terminal device. Since the IMPU has a certain mapping relationship with the IMPI, the operator authentication system can find the corresponding IMPI according to the IMPU input by the user through the terminal device.
  • Step 516 The operator authentication portal sends an HTTP GET authentication (user identification, password) command to the operator authentication system, where the command indicates that the operator authentication system can receive the operator authentication portal.
  • HTTP GET authentication user identification, password
  • step 513 to step 516 if the account is not bound with the user identifier, the terminal device is requested to input the user identifier, and the input user identifier can be authenticated by the operator authentication system, but the operator authentication system cannot be authenticated.
  • the user ID can be authenticated to the HSS. If the HSS authentication user ID is passed, the carrier authentication system can record the binding relationship between the account and the user ID.
  • Step 517 The operator authentication system sends an HTTP 200 OK (second token, IP address of the gateway) command to the operator authentication portal, where the command indicates that the operator authentication system can allocate the second terminal to the terminal device according to the user identifier.
  • the token token2
  • the token token2
  • the IP address of the gateway and send a second token to the carrier authentication portal.
  • Step 518 The operator authentication portal sends an HTTP 200 OK (second token, IP address of the gateway) command to the terminal device, where the command indicates that the operator authentication portal can send the second token and the IP address of the gateway to the terminal device. So that the terminal device can send an authentication request of the second token to the gateway according to the IP address.
  • HTTP 200 OK second token, IP address of the gateway
  • Step 519a The terminal device sends an HTTP GET (Web Socket Request) command to the gateway.
  • Step 519b The gateway sends an HTTP GET (Web Socket Response) command to the terminal device.
  • the commands of step 519a and step 519b indicate that the terminal device can access the gateway corresponding to the IP address according to the IP address of the gateway sent by the operator authentication portal, and establish a web socket (English: websocket) channel with the gateway.
  • Step 520 The terminal device sends an authentication request of the second token to the gateway, where the second token authentication request carries the second token.
  • Step 521 The gateway sends an HTTP GET authentication (second token) command to the operator authentication system, where the command indicates that the gateway can send the second token authentication request to the operator authentication system.
  • HTTP GET authentication second token
  • Step 522 The operator authentication system sends an HTTP 200 OK (second token valid, user identifier, authenticated pass) command to the gateway, where the command indicates that the operator authentication system can authenticate whether the second token sent by the gateway passes.
  • the carrier authentication system authenticates the second token and can go to the gateway. Sending a user identifier corresponding to the second token.
  • Step 523 The gateway sends a SIP Register (User Identity, Passed, Without Challenge Process) command to the core network, for example, the IMS core network, where the command indicates that the gateway can register the user to the core network, and indicates that the user of the core network has Authentication does not require an authentication challenge process.
  • SIP Register User Identity, Passed, Without Challenge Process
  • Step 524 The core network sends a SIP 200 OK command to the gateway, where the command indicates that the core network can notify the gateway that the registration is successful.
  • Step 525 The gateway notifies the user that the authentication is passed, and the user has already registered, and the user can directly use the user-registered service provided by the operator, such as a voice service, a video service, and a data transmission service, through the terminal device.
  • the operator such as a voice service, a video service, and a data transmission service
  • the embodiment may be used for one login, specifically: after the user logs in to the third-party application server by using the account on the terminal device, You can obtain the authorization of the user's registered service without entering the operator's username and password.
  • BP The user only needs to use the account to log in once through the terminal device, and the user can register the service.
  • the communication authentication method is described by using a terminal device, a carrier authentication system, a carrier authentication portal, a third-party application server, a third-party authentication system, a gateway, and a core network as an example, those skilled in the art can understand that The present invention is not limited thereto, and other communication devices having different names but similar functions can perform the functions of the present invention, and are all within the scope of the present invention.
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user identity of the account can be obtained through the operator authentication system.
  • the authorization of the registered business, thereby using the service, the process is simple and the user experience is good.
  • FIG. 6 is a block diagram showing the structure of a communication authentication apparatus according to a sixth embodiment of the present invention.
  • the communication authentication apparatus 600 provided in this embodiment is used to implement the communication authentication method provided in the first embodiment shown in FIG.
  • the communication authentication apparatus 600 can include:
  • the first receiving module 620 is configured to receive an access authentication request sent by the terminal device when the third-party authentication system passes the account verification provided by the terminal device, where the access authentication request carries the third-party application identifier and
  • the first token is a token that is allocated by the third-party authentication system according to the account, and the account is an account that the third-party authentication system allocates for the terminal device.
  • the user can use a terminal device, such as a mobile phone, a personal computer, a tablet computer, etc., to log in to a third-party application website (for example: Taobao, Sina, Dangdang, Mushroom Street, etc.).
  • the third-party application website may include its own authentication system, referred to as a third-party authentication system.
  • the third-party application website can be logged in.
  • the third-party application website can then be used to provide services provided by operators (for example, China Mobile, China Unicom, China Telecom, IMS service providers, etc.).
  • the service may be a real-time communication of a webpage, such as a voice service, a video service, a file transmission service, and the like.
  • a voice service a voice service
  • a video service a file transmission service
  • file transmission service a file transmission service
  • the third-party authentication system can verify whether the account is a legal account assigned by the third-party authentication system for the user. Whether the password corresponding to the account is accurate. Therefore, when the user provides an account to the third-party authentication system through the terminal device, the user can provide the password corresponding to the account to the third-party authentication system. In the case that the third-party authentication system passes the verification, the third-party authentication system may assign the first token corresponding to the account to the user according to the account.
  • the first receiving module 620 is further configured to receive the access authentication request from the terminal device by using an operator authentication terminal.
  • the operator authentication portal may receive the access authentication request sent by the terminal device, and then the first receiving module 620 receives the access authentication request sent by the operator authentication portal.
  • a first sending module 640 connected to the first receiving module 620, configured to send to the third party Sending a third-party authentication request by using the third-party authentication system corresponding to the identifier, where the third-party authentication request carries the first token.
  • An interface device can be provided inside or outside the communication authentication device 600.
  • the interface device is disposed outside the communication authentication device 600, and the interface device forwards information between the communication authentication device 600 and the third-party authentication system, and the first sending module 640 of the communication authentication device 600 sends a third-party authentication request. Sended to the interface device, and the interface device forwards the third-party authentication request to the third-party authentication system.
  • the interface device is disposed inside the communication authentication device 600, and the first sending module 640 of the communication authentication device 600 can directly send a third-party authentication request to the third-party authentication system.
  • the communication authentication apparatus 600 can learn, according to the third-party application identifier carried in the access authentication request received by the first receiving module 620, which third-party application website is accessed by the access authentication request, and can pass the interface.
  • the device sends a third-party authentication request that carries the first token to the third-party authentication system of the third-party application website, and may also send the first-party sending module 640 to the third-party authentication system of the third-party application website.
  • a third-party authentication request for a token For a specific example, refer to the related description of step S120 in the first embodiment.
  • the second receiving module 660 is configured to receive the account corresponding to the first token sent by the third-party authentication system.
  • the first processing module 680 is connected to the second receiving module 660, configured to acquire a user identifier bound to the account, and allocate a second token and an IP address of the gateway according to the user identifier, so that the terminal device After the gateway authenticates the second token, the service provided by the operator is used.
  • the user identifier is an identifier assigned by the communication authentication device 600 to the user.
  • the communication authentication device 600 can receive the account that is sent by the third-party authentication system by using the interface device, and the communication authentication device 600 can also receive the third-party authentication by using the second receiving module 660.
  • the communication authentication device 600 can also receive the first token corresponding to the account by using the interface device or the second receiving module 660.
  • the first processing module 680 can obtain the user identifier bound to the account according to the account, and the user identifier can include any one or more of an IMPU, an IMPI, and a user name signed by the user and the operator. For example, mobile phone number, email address, ID number, etc.
  • the first processing module 680 can allocate the IP address of the second token and the gateway according to the obtained user identifier, and send the IP address of the second token and the gateway to the terminal device, so that the terminal device can After the gateway authenticates the second token, the user can directly use the service provided by the operator.
  • the interface device or the second receiving module 660 can receive the user name of the Taobao network sent by the Taobao authentication system, and then the first The processing module 680 can obtain a user identifier, such as a mobile phone number, bound to the username of the Taobao network. After the subsequent gateway is replaced by the user registration, the user can directly use the terminal device to use the service registered by the operator and the mobile phone number bound to the Taobao user name.
  • the user only needs to provide an account once to perform a login on the terminal device. After the account is verified by the third-party authentication system, the account authentication can be obtained by using the communication authentication device of this embodiment.
  • the user identifies the authorization of the registered service, thereby using the service, the process is simple, and the user experience is good.
  • FIG. 7 is a block diagram showing the structure of a communication authentication apparatus according to a seventh embodiment of the present invention.
  • the communication authentication apparatus 700 provided in this embodiment is used to implement the communication authentication method provided in the second embodiment shown in FIG. 2.
  • the same components in Fig. 7 as those in Fig. 6 have the same functions, and a detailed description of these components will be omitted for the sake of brevity.
  • the communication authentication apparatus 700 shown in FIG. 7 may further include:
  • a second sending module 720 connected to the first processing module 680, for the terminal device Send a user ID input request.
  • the first processing module 680 can search whether the account is bound with the user identifier. If there is no user identifier bound to the account, the second sending module 720 may request the terminal device to send the user identifier. On the other hand, if there is a user identifier bound to the account, the first processing module 680 can obtain the user identifier bound to the account.
  • the processing module 680 can find, according to the user name of the Taobao network, whether the user name of the Taobao network is bound to the mobile phone number of the user. If the mobile phone number of the user is not bound, the second sending module 720 of China Mobile can request the user to send the mobile phone through the mobile phone. cellphone number.
  • the second sending module 720 is further configured to send the user identity input request to the terminal device by using the operator authentication portal.
  • the second sending module 720 may send a user identifier input request to the operator authentication portal, and then the portal authenticates the portal to the terminal.
  • the device sends a user ID input request.
  • the second processing module 740 is connected to the second receiving module 660 and the first processing module 680, and configured to: after receiving the user identifier sent by the terminal device, record the binding of the account and the user identifier. Relationship.
  • the second processing module 740 specifically includes:
  • the first receiving submodule 741 is configured to receive, by using the operator authentication portal, the user identifier from the terminal device;
  • the recording sub-module 742 is connected to the first receiving sub-module 741, and is configured to record a binding relationship between the account and the user identifier.
  • the first receiving submodule 741 can receive from the terminal device through the operator authentication portal.
  • the user identifier the recording submodule 742 can record the binding relationship between the account and the user identifier.
  • the user can input only the IMPU or IMPI through the terminal device, and can input both the IMPU and the IMPI. Because the IMPU has a certain mapping relationship with the IMPI, the communication authentication apparatus 700 can find the corresponding IMPI according to the IMPU input by the user through the terminal device.
  • the user can also input only the user ID that the user has signed with the operator through the terminal device.
  • the communication authentication apparatus 700 cannot authenticate the user identity and can authenticate to the home subscriber server in the operator's IMS core network. If the HSS authenticates the user ID, the recording submodule 742 can record the binding relationship between the account and the user identifier.
  • the related description in step S220 in the second embodiment refer to the related description in step S220 in the second embodiment.
  • the first processing module 680 specifically includes:
  • the distribution submodule 681 is configured to allocate the second token and the IP address according to the user identifier.
  • the first sending submodule 682 is connected to the allocating submodule 681, and configured to send the second token and the IP address to the terminal device, so that the terminal device sends the The gateway sends an authentication request for the second token.
  • the distribution sub-module 681 can assign the second token and the IP address of the gateway to the mobile phone according to the mobile phone number.
  • the first sending submodule 682 can send the second token and the IP address to the mobile phone, and the mobile phone can find a gateway corresponding to the IP address according to the IP address, and establish a communication channel with the gateway.
  • the gateway can send a second token authentication request to the China Mobile Communications Authentication Device 700.
  • a second sending submodule 683 configured to send the user identifier to the gateway, so that the gateway is based on the user identifier, if the second token is authenticated in the communication authentication apparatus 700
  • User registration is initiated to the operator's core network, and after the registration is completed, the user is allowed to use the service provided by the operator through the terminal device.
  • the distribution submodule 681 can allocate the second token and the IP address of the gateway to the terminal device, and the first sending submodule 682 sends the allocated second token and the IP address of the gateway to the terminal device, where the terminal device
  • the authentication request of the second token may be sent to the gateway according to the IP address.
  • the gateway may send the authentication request of the second token to the communication authentication apparatus 700.
  • the communication authentication apparatus 700 can authenticate whether the second token passes. If the communication authentication apparatus 700 authenticates that the second token passes, the second sending submodule 683 can transmit the user identifier to the gateway.
  • the gateway can register the user to the core network, such as the IMS core network, according to the user identifier, and the gateway can indicate that the user of the core network has been authenticated, and the authentication challenge is no longer needed.
  • the user can directly use the communication authentication device of the embodiment of the present invention provided by the operator through the terminal device, and the user only needs to provide an account once to log in once on the terminal device, and the third-party authentication system After the account authentication is passed, the communication authentication device of the embodiment can obtain the authorization of the service registered by the user identifier bound to the account, so that the service is simple, and the user experience is good.
  • FIG. 8 is a block diagram showing the structure of a communication authentication apparatus according to an eighth embodiment of the present invention.
  • the communication authentication apparatus 800 provided in this embodiment is used to implement the communication authentication method provided in the third embodiment shown in FIG.
  • the communication authentication apparatus 800 can include:
  • the verification module 810 is configured to verify an account provided by the terminal device.
  • the second sending module 820 is connected to the verification module 810, and is configured to return the first token to the terminal device if the verification module 810 passes the verification.
  • the user may log in to the third-party application website by using the terminal device.
  • the third-party application website may include its own authentication system, which is referred to as a third-party authentication system, and may also include its own application server, which is referred to as a third-party application server.
  • the verification module 810 of the communication authentication device 800 can verify the account provided by the terminal device. If the verification module 810 verifies that the account is approved, the second sending module 820 can Returning the first token to the terminal device.
  • Taobao a third-party application website
  • the Taobao server third-party application server
  • the verification module 810 of the communication authentication device 800 can verify the user name of the Taobao. If the verification module 810 verifies that the username of the Taobao network passes, the second sending module 820 of the Taobao network may return the first token to the mobile phone.
  • the receiving module 830 is configured to receive a third-party authentication request sent by the operator authentication system, where the third-party authentication request carries a first token, where the first token is an account provided by the communication authentication device 800 according to the terminal device.
  • the assigned token is an account that the communication authentication device 800 allocates for the terminal device.
  • the first sending module 840 is connected to the receiving module 830, and configured to send the account corresponding to the first token to the operator authentication system, if the first token is authenticated, to And causing the operator authentication system to obtain the user identifier bound to the account.
  • an interface device can be provided inside or outside the communication authentication device 800.
  • the interface device is disposed outside the communication authentication device 800, and the interface device forwards information between the operator authentication system and the communication authentication device 800, and the interface device receives the third-party authentication request sent by the operator authentication system.
  • the receiving module 830 receives the third-party authentication request forwarded by the interface device.
  • the interface device is disposed inside the communication authentication device 800, and the receiving module 830 can directly receive the third-party authentication request sent by the operator authentication system.
  • the communication authentication device 800 can directly send the account corresponding to the first token to the operator authentication system by using the first sending module 840, and the communication authentication device 800 can also pass
  • the first sending module 840 sends the account corresponding to the first token to the interface device, and the interface device sends the account to the operator authentication system.
  • the operator authentication system can obtain the user identifier bound to the account according to the account, and the subsequent user is registered.
  • the communication authentication device of the embodiment of the present invention which is registered by the operator and is associated with the account identifier, can be directly used.
  • the user only needs to provide an account once to log in once on the terminal device, and the verification module verifies the account.
  • the service authentication system can obtain the authorization of the service registered by the user ID bound to the account, so that the service is simple, and the user experience is good.
  • FIG. 9 is a structural block diagram of a terminal device according to Embodiment 9 of the present invention.
  • the terminal device 900 provided in this embodiment is used to implement the communication authentication method provided in Embodiment 4 shown in FIG.
  • the terminal device 900 may include:
  • the sending module 920 is configured to send an access authentication request to the operator authentication system, where the third-party application identifier and the first order are carried in the access authentication request, where the third-party authentication system passes the account verification provided by the terminal device.
  • the first token is a token allocated by the third-party authentication system according to an account of the terminal device, so that the operator authentication system requests the third-party authentication system according to the third-party application identifier.
  • the first token is authenticated to obtain a user identifier bound to the account.
  • the user may log in to the third-party application website by using the terminal device.
  • the third-party application website may include its own authentication system, which is referred to as a third-party authentication system, and may also include its own application server, which is referred to as a third-party application server. If the third-party authentication system verifies that the account provided by the terminal device 900 passes, the terminal device 900 can receive the first token corresponding to the account that is allocated by the third-party authentication system.
  • the sending module 920 can send an access authentication request carrying the third-party application identifier and the first token to the operator authentication system.
  • Taobao a third-party application website
  • the Taobao server third-party application server
  • the Taobao authentication system can authenticate whether the user name of the Taobao network passes. If the username of the Taobao network is authenticated, the Taobao authentication system can assign a first token to the user and instruct the mobile phone to jump to the Taobao server. If the user needs to use the service provided by China Mobile, the sending module 920 may send an access authentication request carrying the Taobao application identifier (third-party application identifier) and the first token to the China Mobile authentication system.
  • the receiving module 940 is configured to receive an IP address of the second token and the gateway sent by the operator authentication system, where the IP address of the second token and the gateway is allocated by the carrier authentication system according to the user identifier. Token and IP address.
  • the receiving module 940 is further configured to receive a user from the operator authentication system if the operator authentication system does not have the user identifier bound to the account. Identifies the input request.
  • the sending module 920 is further configured to send the user identifier input by the user to the operator authentication system, so that the operator authentication system records the account and the user identifier. Binding relationship.
  • the receiving module 940 of the mobile phone can receive the mobile phone number input request sent by the China Mobile authentication system. After receiving the mobile phone number input request, the receiving module 940 can send the mobile phone number to the China Mobile authentication system through the sending module 920 of the mobile phone.
  • the China Mobile authentication system can record the binding relationship between the mobile phone number and the user name of Taobao. After the subsequent user registration is completed, the service registered by the mobile phone number bound by the mobile phone name of the Taobao network can be directly used.
  • the control module 960 is connected to the receiving module 940, and is configured to use the service provided by the operator after the gateway authenticates the second token.
  • the receiving module 940 can receive the second token and the gateway sent by the operator authentication system.
  • the IP address of the control module 960 can find the corresponding gateway according to the IP address of the gateway, and send an authentication request of the second token to the gateway.
  • the gateway sends the authentication request of the second token to the carrier authentication system.
  • the operator authentication system may authenticate whether the second token passes, and if the carrier authenticates
  • the user identifier may be sent to the gateway, and the gateway may perform user registration according to the user identifier instead of the user.
  • the gateway is replaced by the user registration, the user can directly use the terminal device to use the service registered by the operator and the user identifier bound to the account.
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user identity system bound to the account can be obtained through the operator authentication system. The authorization of the registered business, thereby using the service, the process is simple and the user experience is good.
  • FIG 10 is a block diagram showing the structure of a communication authentication apparatus according to Embodiment 10 of the present invention.
  • the communication authentication device 1000 may be a host server having a computing capability, a personal computer PC, or a portable computer or terminal that can be carried.
  • the specific embodiment of the present invention does not limit the specific implementation of the computing node.
  • the communication authentication apparatus 1000 includes a processor (English: processor) 1010, a communication interface (English interface: Communications Interface) 1020, a memory (English: memory array) 1030, and a bus 1040.
  • the processor 1010, the communication interface 1020, and the memory 1030 complete communication with each other through the bus 1040.
  • the communication interface 1020 is configured to implement communication between network elements such as a third-party authentication system, a terminal device, and an operator authentication system.
  • the processor 1010 is configured to execute a program.
  • the processor 1010 may be a central processing unit CPU, or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.
  • Memory 1030 can be used to store programs and data.
  • the area storing the program may include an operating system, an application required by at least one of the foregoing modules (for example, the first processing module 680); and the area for storing the data may include the first order allocated by the communication authentication method according to the embodiment. Card, user ID, second token, etc.
  • the memory 1030 may include a high speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.
  • Memory 1030 can also be a memory array.
  • the memory 1030 may also be partitioned, and the blocks may be combined into a virtual volume according to certain rules.
  • the above program may be a program code including computer operating instructions. This program can be used to:
  • the third-party authentication system And receiving, by the third-party authentication system, the access authentication request sent by the terminal device, where the access authentication request carries the third-party application identifier and the first token, where the a token is a token allocated by the third-party authentication system according to the account, and the account is an account allocated by the third-party authentication system for the terminal device;
  • Receiving the account corresponding to the first token sent by the third-party authentication system acquiring a user identifier bound to the account, and assigning a second token and an IP address of the gateway according to the user identifier, so as to
  • the terminal device uses the service provided by the operator after the gateway authenticates the second token, and the user identifier is an identifier that the operator authentication system allocates for the user.
  • the method further includes:
  • the binding relationship between the account and the user identifier is recorded.
  • the IP address of the second token and the gateway is allocated according to the user identifier, so that the terminal device uses the carrier after the gateway authenticates the second token. Services provided, including:
  • the gateway And sending, by the gateway, the user identifier to the gateway, so that the gateway initiates user registration to the core network of the operator according to the user identifier, where the second token is authenticated and passed in the carrier authentication system. After the registration is completed, the user is caused to use the service provided by the operator through the terminal device.
  • the receiving the access authentication request sent by the terminal device includes:
  • the program can also be used to:
  • the third-party authentication request carries a first token
  • the first token is a token that is allocated by the third-party authentication system according to an account provided by the terminal device, and the account is An account that is allocated to the terminal device by the third-party authentication system; in the case that the first token is authenticated, the account corresponding to the first token is sent to the operator authentication system, to Having the operator authentication system acquire the user bound to the account Logo.
  • the method before receiving the third-party authentication request sent by the operator authentication system, the method includes:
  • the first token is returned to the terminal device.
  • the program can also be used to:
  • the terminal device After the third-party authentication system passes the authentication of the account provided by the terminal device, the terminal device sends an access authentication request to the operator authentication system, where the access authentication request carries the third-party application identifier and the first token.
  • the first token is a token that is allocated by the third-party authentication system according to the account of the terminal device, so that the operator authentication system requests the third-party authentication system to the first according to the third-party application identifier.
  • the token is authenticated to obtain the user identifier bound to the account;
  • the gateway After the gateway authenticates the second token, the service provided by the operator is used.
  • the acquiring the user identifier bound to the account includes: if the operator authentication system does not have the user identifier bound to the account, The operator authentication system receives the user identification input request;
  • the user only needs to provide an account once to log in once on the terminal device. After the account is verified by the third-party authentication system, the user identity system bound to the account can be obtained through the operator authentication system. The authorization of the registered business, thereby using the service, the process is simple and the user experience is good.
  • the various exemplary elements and algorithms of the embodiments described herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can select different methods for implementing the described functions for a particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • the function is implemented in the form of computer software and sold or used as a stand-alone product, it may be considered to some extent that all or part of the technical solution of the present invention (for example, a part contributing to the prior art) is It is embodied in the form of computer software products.
  • the computer software product is typically stored in a computer readable storage medium and includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of various embodiments of the present invention. .
  • the foregoing storage medium includes a USB flash drive, a mobile hard disk, a read-only memory (English: Read-Only Memory, abbreviation: ROM), a random access memory (English: Random Access Memory, abbreviation: RAM), a magnetic disk or an optical disk, and the like.
  • ROM Read-Only Memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé et un appareil d'authentification de communication, et un dispositif terminal. Le procédé d'authentification de communication consiste, lorsque la vérification d'un numéro de compte fourni par un système d'authentification tiers est concluante sur un dispositif, à : recevoir une demande d'authentification d'accès envoyée par le dispositif terminal ; envoyer une demande d'authentification tierce au système d'authentification tiers correspondant à un identifiant d'application tierce ; et recevoir un numéro de compte correspondant à un premier jeton envoyé par le système d'authentification tiers, acquérir un identifiant d'utilisateur associé au numéro de compte, et attribuer un second jeton et une adresse IP d'une passerelle d'après l'identifiant d'utilisateur, de sorte que le dispositif terminal utilise un service fourni par un opérateur une fois le second jeton authentifié par la passerelle. Dans les modes de réalisation de la présente invention, l'utilisateur ne doit fournir un numéro de compte qu'une seule fois dans un journal de dispositif terminal. Ensuite, après qu'un système d'authentification tiers a vérifié le numéro de compte, l'utilisateur peut obtenir l'autorisation pour un service enregistré par un identifiant d'un utilisateur associé au numéro de compte via un système d'authentification d'opérateur. Le service peut ainsi être utilisé, le processus est simple et l'expérience de l'utilisateur de bonne qualité.
PCT/CN2014/083640 2013-09-23 2014-08-04 Procédé et appareil d'authentification de communication, et dispositif terminal WO2015039502A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310436691.5 2013-09-23
CN201310436691.5A CN104468487B (zh) 2013-09-23 2013-09-23 通信认证方法及装置、终端设备

Publications (1)

Publication Number Publication Date
WO2015039502A1 true WO2015039502A1 (fr) 2015-03-26

Family

ID=52688189

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/083640 WO2015039502A1 (fr) 2013-09-23 2014-08-04 Procédé et appareil d'authentification de communication, et dispositif terminal

Country Status (2)

Country Link
CN (1) CN104468487B (fr)
WO (1) WO2015039502A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108768991A (zh) * 2018-05-18 2018-11-06 阿里巴巴集团控股有限公司 一种实人认证方法和系统
CN111080253A (zh) * 2019-12-11 2020-04-28 深圳供电局有限公司 随机太阳式输电线路现场作业方法与系统
CN115174161A (zh) * 2022-06-15 2022-10-11 平安银行股份有限公司 账号登录方法、装置、电子设备及存储介质
CN115412331A (zh) * 2022-08-25 2022-11-29 聚好看科技股份有限公司 一种应用登录方法、电子设备及服务器

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107079008B (zh) * 2015-03-27 2020-02-21 华为技术有限公司 用户认证方法、装置及系统
CN105072608B (zh) * 2015-06-30 2019-02-12 青岛海信移动通信技术股份有限公司 一种管理认证令牌的方法及装置
CN105050081B (zh) 2015-08-19 2017-03-22 腾讯科技（深圳）有限公司 网络接入设备接入无线网络接入点的方法、装置和系统
CN106470190A (zh) * 2015-08-19 2017-03-01 中兴通讯股份有限公司 一种Web实时通信平台鉴权接入方法及装置
CN105897675A (zh) * 2015-11-27 2016-08-24 乐视云计算有限公司 视频服务提供方法、访问鉴权方法及服务器和系统
CN108605038B (zh) * 2016-01-26 2022-02-25 金金哲 互联网门户系统及其使用方法
CN107147496A (zh) * 2017-04-28 2017-09-08 广东网金控股股份有限公司 一种面向服务技术框架下不同应用间统一授权认证的方法
CN109474600B (zh) * 2018-11-20 2021-06-18 麒麟合盛网络技术股份有限公司 一种账号绑定方法、系统、装置及其设备
CN110049106B (zh) * 2019-03-22 2022-02-08 口碑(上海)信息技术有限公司 业务请求处理系统及方法
CN112492017A (zh) * 2020-11-24 2021-03-12 航天信息股份有限公司 一种基于token认证的websocket连接方法及系统
CN113037741B (zh) * 2021-03-04 2023-08-11 腾讯科技（深圳）有限公司 一种鉴权方法、鉴权装置、计算机设备及存储介质
CN114268474A (zh) * 2021-12-13 2022-04-01 中国联合网络通信集团有限公司 运营商应用登录控制方法、装置、设备及存储介质
CN115987636B (zh) * 2022-12-22 2023-07-18 北京深盾科技股份有限公司 一种信息安全的实现方法、装置及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101427511A (zh) * 2006-04-07 2009-05-06 戴尔产品有限公司 用于促进接入服务的认证服务
CN102739708A (zh) * 2011-04-07 2012-10-17 腾讯科技（深圳）有限公司 一种基于云平台访问第三方应用的系统及方法
CN103124252A (zh) * 2011-11-18 2013-05-29 华为软件技术有限公司 客户端应用访问鉴权处理方法和装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101350717B (zh) * 2007-07-18 2011-04-27 中国移动通信集团公司 一种通过即时通信软件登录第三方服务器的方法及系统
CN101834834A (zh) * 2009-03-09 2010-09-15 华为软件技术有限公司 一种鉴权方法、装置及鉴权系统
CN102082775A (zh) * 2009-11-27 2011-06-01 中国移动通信集团公司 一种用户身份管理方法、装置和系统
CN103051630B (zh) * 2012-12-21 2016-01-27 微梦创科网络科技（中国）有限公司 基于开放平台实现第三方应用授权的方法、装置及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101427511A (zh) * 2006-04-07 2009-05-06 戴尔产品有限公司 用于促进接入服务的认证服务
CN102739708A (zh) * 2011-04-07 2012-10-17 腾讯科技（深圳）有限公司 一种基于云平台访问第三方应用的系统及方法
CN103124252A (zh) * 2011-11-18 2013-05-29 华为软件技术有限公司 客户端应用访问鉴权处理方法和装置

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108768991A (zh) * 2018-05-18 2018-11-06 阿里巴巴集团控股有限公司 一种实人认证方法和系统
CN108768991B (zh) * 2018-05-18 2020-08-04 阿里巴巴集团控股有限公司 一种实人认证方法和系统
CN111080253A (zh) * 2019-12-11 2020-04-28 深圳供电局有限公司 随机太阳式输电线路现场作业方法与系统
CN111080253B (zh) * 2019-12-11 2023-03-03 深圳供电局有限公司 随机太阳式输电线路现场作业方法与系统
CN115174161A (zh) * 2022-06-15 2022-10-11 平安银行股份有限公司 账号登录方法、装置、电子设备及存储介质
CN115174161B (zh) * 2022-06-15 2023-06-13 平安银行股份有限公司 账号登录方法、装置、电子设备及存储介质
CN115412331A (zh) * 2022-08-25 2022-11-29 聚好看科技股份有限公司 一种应用登录方法、电子设备及服务器

Also Published As

Publication number Publication date
CN104468487A (zh) 2015-03-25
CN104468487B (zh) 2018-10-19

Similar Documents

Publication Publication Date Title
WO2015039502A1 (fr) Procédé et appareil d'authentification de communication, et dispositif terminal
US10594695B2 (en) Authentication arrangement
WO2021057889A1 (fr) Procédé et appareil de traitement de données, dispositif électronique, et support de stockage
US9584615B2 (en) Redirecting access requests to an authorized server system for a cloud service
US8499343B2 (en) Hosted media content service systems and methods
EP2633667B1 (fr) Système et procédé de conversion de protocole à la volée dans l'obtention d'informations de mise en application de politique
TWI477163B (zh) 用於即時通訊之基於使用者之驗證
US20190095598A1 (en) Device, control method of the same, and storage medium
US10834067B2 (en) Method of access by a telecommunications terminal to a database hosted by a service platform that is accessible via a telecommunications network
WO2014131279A1 (fr) Système, client, et procédé d'autorisation bidirectionnelle
US20130007867A1 (en) Network Identity for Software-as-a-Service Authentication
CN110365701B (zh) 客户终端设备的管理方法、装置、计算设备及存储介质
WO2019040658A1 (fr) Signature unique hybride pour applications et services logiciels utilisant des fournisseurs d'identité classiques et modernes
US20120278854A1 (en) System and method for device addressing
KR102645768B1 (ko) 다중 계정 통합 관리 시스템 및 방법
US20200076797A1 (en) System and data processing method
US20240031352A1 (en) Mobile device enabled desktop tethered and tetherless authentication
JP5565408B2 (ja) Ｉｄ認証システム、ｉｄ認証方法、認証サーバ、端末装置、認証サーバの認証方法、端末装置の通信方法、及びプログラム
US20190028460A1 (en) Low-overhead single sign on
US20150101059A1 (en) Application License Verification
CN106161356B (zh) 通过客户端快速登录网站的方法和系统
CN111949959A (zh) Oauth协议中的授权认证方法及装置
CN113038192B (zh) 视频处理方法、装置、电子设备和存储介质
CN110198540B (zh) Portal认证方法及装置
US9742776B2 (en) Contact identification validation via social invitation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14845390

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14845390

Country of ref document: EP

Kind code of ref document: A1