WO2015165325A1 - 终端安全认证方法、装置及系统 - Google Patents

终端安全认证方法、装置及系统 Download PDF

Info

Publication number
WO2015165325A1
WO2015165325A1 PCT/CN2015/075986 CN2015075986W WO2015165325A1 WO 2015165325 A1 WO2015165325 A1 WO 2015165325A1 CN 2015075986 W CN2015075986 W CN 2015075986W WO 2015165325 A1 WO2015165325 A1 WO 2015165325A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
terminal
digital certificate
access
serial number
Prior art date
Application number
PCT/CN2015/075986
Other languages
English (en)
French (fr)
Inventor
杜宗鹏
薛莉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2015165325A1 publication Critical patent/WO2015165325A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the embodiments of the present invention relate to communication technologies, and in particular, to a terminal security authentication method, apparatus, and system.
  • GSM Global System for Mobile Communication
  • SIMs Subscriber Identity Modules
  • the soft SIM it may be more difficult to place the soft SIM in the terminal.
  • the GSM Association and the 3rd Generation Partnership Project (3GPP) all have standardization work on soft SIM.
  • the biggest problem is that the hardware SIM card uses a special hardware processing method to ensure that the private key part is not available. Read, soft SIM does not have the above functions to ensure the security of the key is more difficult.
  • the prior art is to ensure the secure distribution and use of the soft SIM through a security environment provided by the operating system of the terminal.
  • the security environment is provided by an operating system level driver or a virtual machine, and does not provide information such as a soft SIM key. It is guaranteed that the soft SIM cannot be copied.
  • this method relies too much on the security capabilities of the operating system of the terminal, and the absolute security of the current operating system cannot be proved to have been achieved.
  • the embodiment of the invention provides a terminal security authentication method, device and system, which solves the problem that the terminal access authentication using the software user identification information is too dependent on the security capability of the operating system of the terminal.
  • an embodiment of the present invention provides a terminal security authentication method, including:
  • the user identification information includes a serial number and a key that uniquely identify the user identity
  • the performing, by the access server, performing access authentication, according to the digital certificate of the terminal and the user identity information Information interaction including:
  • the security authentication string includes a time string and a random string
  • the method further includes:
  • the method before the acquiring the user identity information that is distributed by the operator server, the method further includes:
  • the digital certificate according to the terminal and the user identity information, and the access server Perform information interaction for implementing access authentication, including:
  • an embodiment of the present invention provides a terminal security authentication method, including:
  • the access authentication success information is sent to the terminal.
  • the obtaining, by the access authentication request, the verification information of the terminal includes:
  • the security authentication string includes a time string and a random string
  • the verification information includes a data packet and a digital signature of the terminal, where the data packet includes a serial number and a security authentication string in the user identification information, and the user identification
  • the information includes a key and the serial number
  • Determining, according to the verification information, a request for user identity verification to a carrier authentication server where include:
  • User identity verification is requested to the operator authentication server according to the serial number and the digital signature.
  • the requesting, by the serial number and the digital signature, the user identity requesting the user identity After verification it also includes:
  • the obtaining, by the access authentication request, the verification information of the terminal includes:
  • the requesting the user identity verification from the operator authentication server according to the verification information includes:
  • the method further includes:
  • an embodiment of the present invention provides a terminal security authentication method, including:
  • the user identity verification request includes a data packet and a digital signature sent by the terminal, where the data packet includes a serial number and a security authentication string in the user identification information, and the user identity
  • the identification information includes a key and the serial number
  • the security authentication string includes a time string and a random string
  • the digital signature is the number through which the terminal passes The signature of the data packet by the private key corresponding to the word certificate
  • the obtaining, by the identity verification request, the digital certificate of the terminal includes:
  • the obtaining, by the identity verification request, the digital certificate of the terminal includes:
  • the digital certificate is verified based on the root certificate obtained from the digital certificate authority.
  • an embodiment of the present invention provides a terminal security authentication method, including:
  • the method further includes:
  • an embodiment of the present invention provides a terminal, including:
  • An information obtaining module configured to acquire user identification information distributed by an operator service device, where The user identification information includes a serial number and a key;
  • a request sending module configured to send an access authentication request to the access service device
  • An authentication interaction module configured to perform information interaction with the access service device for implementing access authentication according to the digital certificate of the terminal and the user identification information;
  • the access module is configured to receive access authentication success information sent by the access service device, and access the network by using the access service device and use the network service provided by the network.
  • the authentication interaction module is configured to receive the identifier request information and the security authentication string sent by the access service device, where the security authentication is performed.
  • the string includes a time string and a random string; according to the identification request information, the data packet is signed by the private key corresponding to the digital certificate to obtain a digital signature, and the data packet includes the serial number and the security An authentication string; the data packet and the digital signature are sent to the access service device.
  • the method further includes:
  • a first digital certificate processing module configured to receive a digital certificate request message sent by the access service device, and send the digital certificate to the access service device.
  • the method further includes:
  • a second digital certificate processing module configured to receive a digital certificate request message sent by the operator service device; and send the digital certificate to the operator service device;
  • the information acquiring module is specifically configured to receive the serial number sent by the operator service device and the encrypted key.
  • the authentication interaction module is specifically configured to receive the identifier request information sent by the access service device;
  • the identifier request information sends the sequence number to the access service device, and receives an authentication message sent by the access service device, where the authentication message includes a random string and an authentication code; Decrypting the encrypted key by using a private key, and executing a preset algorithm to generate a session key according to the decrypted key and the random string, and using the session key to check The message authentication code is verified.
  • an embodiment of the present invention provides an access service apparatus, including:
  • a receiving module configured to receive an access authentication request sent by the terminal
  • the verification information obtaining module is configured to acquire the verification information of the terminal according to the access authentication request;
  • a verification module configured to request, according to the verification information, the user authentication service device to perform user identity verification
  • the access module is configured to send the access authentication success information to the terminal after the user identity verification is passed.
  • the verification information acquiring module is configured to send the identifier request information and the security authentication string to the terminal, where the security authentication string includes a time string and a random string; receiving the verification information sent by the terminal, the verification information comprising a data packet and a digital signature of the terminal, the data packet including a serial number and a security authentication in the user identification information a string, the user identification information including a key and the serial number;
  • the verification module is specifically configured to request user identity verification according to the serial number and the digital signature to the operator authentication service device.
  • the method further includes:
  • a digital certificate forwarding module configured to receive a digital certificate request message sent by the operator authentication service device, and send the digital certificate request message to the terminal; receive the digital certificate sent by the terminal, and The digital certificate is sent to the operator authentication service device.
  • the verification information acquiring module is configured to send the identifier request information to the terminal, and receive the verification information sent by the terminal.
  • the verification information includes the serial number in the user identification information, and the user identification information includes a key and the serial number;
  • the verification module is specifically configured to obtain from the operator authentication service device according to the serial number
  • the authentication message is taken, and the authentication message includes a random string and an authentication code.
  • the method further includes:
  • An authentication feedback module configured to send the authentication message to the terminal.
  • the seventh aspect of the present invention provides an operator authentication service apparatus, including:
  • a receiving module configured to receive a user identity verification request sent by the access service device, where the user identity verification request includes a data packet and a digital signature sent by the terminal, where the data packet includes a serial number and a security authentication word in the user identity identification information.
  • the user identification information includes a key and the serial number
  • the security authentication string includes a time string and a random string
  • the digital signature is a private key pair corresponding to the terminal by the digital certificate The signature of the data packet;
  • a certificate obtaining module configured to acquire a digital certificate of the terminal according to the user identity verification request
  • a verification module configured to verify the digital signature according to the digital certificate, and perform information interaction with the access service device after the verification is passed to complete the access authentication.
  • the certificate obtaining module is configured to send the serial number to a user database, and obtain the digital certificate bound to the serial number.
  • the certificate obtaining module is configured to send the serial number to a user database, and receive a digital certificate request message sent by the user database; The digital certificate request message is forwarded to the access service device; the digital certificate sent by the access service device is received; and the digital certificate is verified according to the root certificate obtained from the digital certificate authority.
  • an embodiment of the present invention provides a user database, including:
  • a receiving module configured to receive a serial number in the user identification information of the terminal sent by the operator authentication service device, where the user identity identification information includes a key and the serial number;
  • a determining module configured to determine whether the serial number has been bound to a digital certificate
  • a certificate processing module configured to: if the determining module determines that the serial number has been bound to a digital certificate, And transmitting, to the operator authentication service device, a digital certificate bound to the serial number.
  • the certificate processing module is further configured to: if the determining module determines that the serial number is not bound to a digital certificate, to the operation
  • the quotient authentication service device sends a digital certificate request message; receives the serial number uploaded by the operator authentication service device and the digital certificate, and saves a binding relationship between the serial number and the digital certificate.
  • a ninth aspect the embodiment of the present invention provides a terminal security authentication system, including: a terminal, an access service device, an operator authentication service device, a user database, and an operator service device, where the terminal adopts a fifth aspect, a terminal according to any one of the first to fourth possible implementations of the fifth aspect, wherein the access service device adopts any one of the first to fourth aspects of the sixth aspect, the sixth aspect
  • the apparatus described in the possible implementation manner wherein the operator authentication service apparatus adopts the apparatus described in any one of the first aspect to the second aspect of the seventh aspect; the user
  • the first aspect of the database adopting the eighth aspect or the eighth aspect is the apparatus described in the implementation manner;
  • the operator service device is configured to distribute the user identity information to the terminal.
  • the terminal performs access authentication through the digital certificate and the user identification information, realizes the terminal identification and the user identification to be double-authenticated, and uses the digital certificate to ensure that even if the user identification information is copied or replaced, the terminal None of them can pass authentication, so that access authentication no longer depends on the security capabilities of the terminal's operating system.
  • Embodiment 1 is a flowchart of Embodiment 1 of a terminal security authentication method according to the present invention
  • Embodiment 2 is a flowchart of Embodiment 2 of a terminal security authentication method according to the present invention
  • Embodiment 3 is a flowchart of Embodiment 3 of a terminal security authentication method according to the present invention.
  • Embodiment 4 is a flowchart of Embodiment 4 of a terminal security authentication method according to the present invention.
  • Embodiment 5 is a flowchart of Embodiment 5 of a terminal security authentication method according to the present invention.
  • Embodiment 6 is a flowchart of Embodiment 6 of a terminal security authentication method according to the present invention.
  • Embodiment 7 is a flowchart of Embodiment 7 of a terminal security authentication method according to the present invention.
  • Embodiment 8 is a flowchart of Embodiment 8 of a terminal security authentication method according to the present invention.
  • Embodiment 9 is a schematic structural diagram of Embodiment 1 of a terminal according to the present invention.
  • Embodiment 2 of a terminal according to the present invention is a schematic structural diagram of Embodiment 2 of a terminal according to the present invention.
  • FIG. 11 is a schematic structural diagram of Embodiment 3 of a terminal according to the present invention.
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of an access service apparatus according to the present invention.
  • FIG. 13 is a schematic structural diagram of Embodiment 2 of an access service apparatus according to the present invention.
  • FIG. 14 is a schematic structural diagram of Embodiment 3 of an access service apparatus according to the present invention.
  • FIG. 15 is a schematic structural diagram of an embodiment of an operator authentication service apparatus according to the present invention.
  • 16 is a schematic structural diagram of an embodiment of a user database according to the present invention.
  • FIG. 17 is a schematic structural diagram of Embodiment 4 of a terminal according to the present invention.
  • FIG. 18 is a schematic structural diagram of an embodiment of a terminal security authentication system according to the present invention.
  • the terminal access authentication process of the present invention uses the EAP-SIM authentication process as a framework, and on this basis, the interaction information or interaction process related to the digital certificate and the user identification information in the present invention is added.
  • FIG. 1 is a flowchart of Embodiment 1 of a terminal security authentication method according to the present invention. As shown in FIG. 1 , the method in this embodiment may include:
  • Step 101 Acquire user identification information distributed by an operator server.
  • the executor of this embodiment may be a terminal, and the terminal may be any terminal that can access the network, such as a mobile phone, a tablet computer, a personal computer, or the like.
  • the terminal needs to obtain the user identification information from the operator server.
  • the user's mobile phone access network first obtains a Subscriber Identity Module (SIM) from the operator, and includes an international mobile user identification in the SIM card.
  • An International Mobile Subscriber Identification Number (IMSI) is used to uniquely identify the user.
  • SIM Subscriber Identity Module
  • IMSI International Mobile Subscriber Identification Number
  • the user identification information in the present invention may be a software SIM, and the software SIM can support more terminal forms than the SIM card, and can be adapted to a terminal without a SIM card slot, and includes a unique one in the software SIM.
  • the serial number of the user is identified, and the related information required for the user to perform the access authentication, that is, the key.
  • Step 102 Send an access authentication request to the access server.
  • the terminal has a digital certificate for signing distributed by a digital certificate authority (CA), and the digital certificate may be built in the device or may be set through the universal serial bus.
  • the (Universal Serial Bus, USB for short) interface is connected to the external device on the terminal.
  • the key part of the digital certificate is protected by hardware processing technology and cannot be read, modified, updated or deleted.
  • the terminal is carried at the factory.
  • Digital certificate, digital certificate is the unique identifier of the terminal, and the terminal supports the function of signing by digital certificate.
  • the terminal needs to use the digital certificate and the user identification information (software SIM) to send the access authentication request to the access server.
  • the terminal needs to send the access authentication request to the access server when the terminal first activates the software SIM or the terminal restarts. After passing, you can use the web service.
  • Step 103 Perform information interaction with the access server for implementing access authentication according to the digital certificate of the terminal and the user identification information.
  • the terminal interacts with the information about the access authentication performed by the access server according to the digital certificate and the user identification information.
  • the process may use an Extensible Authentication Protocol (EAP) EAP-SIM authentication process. No detailed description will be given.
  • EAP Extensible Authentication Protocol
  • Step 104 Receive access authentication success information sent by the access server, and access the network through the access server and use the network service provided by the network.
  • the authentication success information sent by the access server such as EAP-Success
  • the terminal can access the server after the subsequent online operation is completed. Access the network and use the network services provided by the network.
  • the terminal performs access authentication by using the digital certificate and the user identification information to implement dual authentication of the terminal identifier and the user identifier, and the digital certificate ensures that even if the user identification information is copied or replaced, the terminal cannot be authenticated and the access authentication is enabled. No longer depends on the security capabilities of the terminal's operating system.
  • Embodiment 2 is a flowchart of Embodiment 2 of a terminal security authentication method according to the present invention. As shown in FIG. 2, the method in this embodiment may include:
  • Step 201 Acquire user identity information distributed by an operator server.
  • the terminal obtains the user identity information that is distributed by the operator server
  • the specific implementation method may be: copying the user identity information distributed by the operator server by using an external storage device; or The specified webpage of the merchant server obtains the user identification information.
  • the terminal can use an external storage device, such as a USB flash drive (U disk), copy the user identification information (software SIM), or directly download the user identification information by using the USB data cable to connect the relevant device provided by the operator (software) SIM).
  • an external storage device such as a USB flash drive (U disk)
  • the terminal does not perform access authentication, so if the terminal wants to use the network service, it will be redirected to the designated webpage of the operator, and the terminal logs in to the webpage to download the user identification information (software SIM).
  • Step 202 Send an access authentication request to the access server.
  • the terminal may send an EAPoL-Start to the access server to initiate access authentication or initiate access authentication under the request of the access server, and the terminal sends the access authentication to the access server according to the pre-stored digital certificate and the user identification information.
  • the process of initiating the access authentication is similar to the step 102 of the foregoing method embodiment, and details are not described herein again.
  • Step 203 Receive identifier request information and a security authentication string sent by the access server.
  • the security authentication string includes a time string and a random string
  • the access server triggers the access authentication according to the EAPoL-Start sent by the terminal or other manner, and randomly generates a random
  • the machine string carries the random string and the time string when replying to the identification request information to the terminal, so as to ensure that the digital signature of the terminal is different each time, and the identification request information may be EAP in the EAP-SIM authentication process. -Request/Identity.
  • Step 204 According to the identifier request information, sign the data packet by using a private key corresponding to the digital certificate to obtain a digital signature.
  • the data packet includes a serial number and a security authentication string in the user identification information, and after receiving the identification request information of the access server, the terminal uses the private key corresponding to the locally stored digital certificate to identify the user identification information.
  • the data packet consisting of the serial number, the random string, and the time string is signed. The signature process already exists in the prior art and will not be described here.
  • Step 205 Send the data packet and a digital signature to the access server.
  • the terminal sends the data packet and the digital signature to the access server, and the access server requests the user authentication server to verify the identity of the user according to the serial number in the user identification information in the data packet, and enables the operator to authenticate.
  • the server obtains a digital certificate bound to the serial number in the user identification information from the user database, and verifies the digital signature according to the digital certificate.
  • the access server encapsulates the serial number and the security authentication string in the user identification information in a Remote Authentication Dial In User Service (RADIUS) message to the operator authentication server, and the carrier authentication server.
  • RADIUS Remote Authentication Dial In User Service
  • the user database is queried according to the serial number in the user identification information, and the digital certificate bound to the serial number in the user identification information is obtained, the user database supports the transmission of the digital certificate, and the operator authentication server verifies the terminal by using the public key in the digital certificate. Digital signature.
  • Step 206 Perform, according to the digital certificate and the user identity information, information interaction for implementing access authentication with the access server.
  • the EAP-SIM authentication process may be adopted in this process, and is not described in detail herein.
  • Step 207 Receive access authentication success information sent by the access server, and access the network through the access server and use the network service provided by the network.
  • the terminal receives the access authentication success information sent by the access server, and accesses the network through the access server and uses the network service provided by the network to process the foregoing Step 104 of the method embodiment is similar, and details are not described herein again.
  • the terminal performs access authentication by using the digital certificate and the user identification information to implement dual authentication of the terminal identifier and the user identifier, and the digital certificate ensures that even if the user identification information is copied or replaced, the terminal cannot be authenticated and the access authentication is enabled. No longer depends on the security capabilities of the terminal's operating system.
  • step 205 of the foregoing method embodiment if the operator authentication server does not obtain the digital certificate bound to the serial number in the user identification information from the user database, it indicates that this is the initial access authentication of the terminal, so the user The database does not store the binding information of the digital certificate of the terminal and the serial number in the user identification information.
  • the method further includes: receiving, sending, sending, by the access server Digital certificate request message; transmitting the digital certificate to the access server, so that the access server sends the digital certificate to the operator authentication server, and causes the operator authentication server to
  • the root certificate obtained by the certificate authority verifies the digital certificate, and after verifying the digital certificate, verifying the digital signature according to the digital certificate, and uploading the digital certificate to the office after verifying the digital signature Decoding a user database to bind the serial number in the user identification information and the Digital certificates.
  • the operator authentication server sends a digital certificate request message to the access server, and the access server uses the number.
  • the certificate request message is forwarded to the terminal, and the terminal sends its own digital certificate to the access server, and the access server forwards the digital certificate to the operator authentication server, and the carrier authentication server stores the root certificate obtained from the digital certificate authority.
  • the root certificate is used to verify the digital certificate of the terminal, and after verifying, the digital signature of the terminal is verified by using the public key in the digital certificate.
  • the operator authentication server uploads the digital certificate to the user database to bind the user identification information. Serial number and digital certificate.
  • the carrier server can also be directly after the user database. Binding the serial number and digital certificate in the user identification information, for example, when the operator server sends the user identification information, it binds according to the number of the digital certificate or digital certificate obtained from the terminal (only the number needs to be downloaded) Corresponding digital certificate).
  • the operator directly sells the terminal that has been bound with the user identification information, and binds the serial number and the digital certificate in the user identification information before selling.
  • the operator may also use the process in FIG. 7 to bind the user's digital certificate and user identification information.
  • the terminal may have two digital certificates, one for signature (bind with the digital certificate when binding) One) is used for encryption (the digital certificate is used when the user identification information is issued).
  • the carrier server can also manage the serial number and digital certificate binding relationship in the user identification information, such as binding, unbinding, or changing the binding object.
  • the digital certificate of the terminal is 1:1 bound to the user identification information, or 1:n binding. If the user applies for a multi-number service, the operator also supports binding the serial number in the user identification information with the digital certificate of multiple terminals to provide the first-number multi-machine service for the customer.
  • the digital certificate pre-stored in the terminal in addition to performing access network authentication, can also be used in a scenario such as online shopping or mobile office to determine the identity of the user.
  • FIG. 3 is a flowchart of Embodiment 3 of a terminal security authentication method according to the present invention. As shown in FIG. 3, the method in this embodiment may include:
  • Step 301 Receive a digital certificate request message sent by an operator server.
  • the operator server in order to ensure the security of the user identification information (software SIM), the operator server requires the terminal to provide a digital certificate when distributing the user identification information, and the operator server uses the key in the user identification information.
  • the public key of the digital certificate is encrypted and sent to the user, so the terminal initially receives the digital certificate request message sent by the operator server.
  • Step 302 Send a digital certificate to the operator server.
  • the terminal provides its own digital certificate to the operator server, or the user provides the number of its own digital certificate, and the operator server downloads the corresponding digital certificate from the digital certificate authority.
  • the operator server verifies the digital certificate of the terminal according to the locally stored root certificate, and after the verification, carries the digital certificate to request the user identification information to the user database, and the user database first binds the digital certificate and the user identification information after receiving the digital certificate.
  • Serial number and digital certificate The public key encrypts the key in the user identification information, and then sends the encrypted user identification information to the operator server.
  • Step 303 Receive the sequence number sent by the operator server and the encrypted key.
  • the terminal obtains the user identification information sent by the operator server until the step, and the key in the user identification information has been encrypted by the public key in the digital certificate.
  • Step 304 Send an access authentication request to the access server.
  • the process of the terminal initiating the access authentication to the access server according to the pre-stored digital certificate and the user identity information is similar to the step 102 in the foregoing method embodiment, and details are not described herein again.
  • Step 305 Receive identifier request information sent by the access server.
  • Step 306 Send the sequence number to the access server according to the identifier request information.
  • the terminal sends the serial number in the user identification information to the access server, and the access server obtains the authentication message from the operator authentication server according to the serial number, where the authentication message includes a random string generated by the operator authentication server. And message authentication code.
  • Step 307 Receive an authentication message sent by the access server.
  • Step 308 Decrypt the encrypted key by using a private key corresponding to the digital certificate, and execute a preset algorithm to generate a session key according to the decrypted key and the random string.
  • the session key checks the message authentication code
  • the terminal first decrypts the encrypted key in the user identification information acquired in step 303 by using the private key corresponding to the digital certificate, and then performs pre-processing according to the decrypted key and the random string in the authentication message. Let the algorithm generate a session key and use the session key to verify the message authentication code in the authentication message.
  • Step 309 Perform interaction with the access server to perform access authentication according to the digital certificate and the user identification information.
  • the EAP-SIM authentication process may be adopted in this process, and is not described in detail herein.
  • Step 310 Receive access authentication success information sent by the access server, and access the network through the access server and use the network service provided by the network.
  • the process of the terminal receiving the access authentication success information sent by the access server, and accessing the network by using the access server and using the network service provided by the network is similar to step 104 of the foregoing method embodiment. , will not repeat them here.
  • the terminal obtains the encrypted user identification information from the operator server through the digital certificate, and performs access authentication through the key in the user identification information, thereby realizing the dual authentication of the terminal identifier and the user identifier, and ensuring even the user with the digital certificate. If the identity information is copied or replaced, the terminal cannot pass the authentication, so that the access authentication no longer depends on the security capabilities of the terminal's operating system.
  • Embodiment 4 is a flowchart of Embodiment 4 of a terminal security authentication method according to the present invention. As shown in FIG. 4, the method in this embodiment may include:
  • Step 401 Receive an access authentication request sent by the terminal.
  • the execution body of this embodiment may be an access server.
  • the access server receives an access authentication request sent by the terminal, such as EAPoL-Start.
  • Step 402 Acquire verification information of the terminal according to the access authentication request.
  • Step 403 Request, according to the verification information, a user identity verification to the operator authentication server.
  • the access server and the carrier authentication server use the RADIUS format message to exchange information. Therefore, after obtaining the digital certificate or user identity information of the terminal, the access server encapsulates the RADIUS message in the RADIUS message and forwards it to the operation.
  • the authentication server is used to enable the carrier authentication server to perform user authentication on the digital certificate or user identification information.
  • the access server performs user identity verification with the carrier authentication server according to the verification information.
  • Step 404 After the user identity verification is passed, send the access authentication success information to the terminal.
  • the access server sends the access authentication success information to the terminal after the authentication is passed according to the authentication result of the operator authentication server, so that the terminal accesses the network and uses the network service provided by the network.
  • the access server performs access authentication on the terminal according to the digital certificate of the terminal and the user identification information, and implements dual authentication of the terminal identifier and the user identifier, and the digital certificate ensures that even if the user identification information is copied or replaced, the terminal cannot be authenticated. Through, the access authentication is no longer dependent on the security capabilities of the terminal's operating system.
  • the step 402 of the foregoing method is used to obtain the verification information of the terminal according to the access authentication request
  • the specific implementation method may be: sending the identifier request information and the security authentication string to the terminal, where the security is performed.
  • the authentication string includes a time string and a random string; receiving the verification information sent by the terminal, the verification information including a data packet and a digital signature of the terminal, the data packet including a sequence in the user identification information And a security authentication string, the user identification information including a key and the serial number.
  • Step 403 of the foregoing method embodiment is required to perform user identity verification according to the verification information to the operator authentication server.
  • the specific implementation method may be: requesting the user from the carrier authentication server according to the serial number and the digital signature. Authentication.
  • the access server After receiving the access authentication request of the terminal, the access server returns an identifier request information, such as EAP-Request/Identity, to the terminal, and the information may also carry a security authentication string.
  • the string includes a time string and a random string.
  • the random string is randomly generated by the access server. The purpose is to ensure that the terminal has different signatures each time.
  • the terminal After receiving the identification request information, the terminal sets its own user identification information.
  • the serial number, time string and random string form a data packet, and the data packet is signed with the private key corresponding to the digital certificate, and the data packet and the digital signature are sent to the access server.
  • the access server requests the user authentication from the operator authentication server according to the serial number and the digital signature in the user identification information, and the operator authentication server obtains the digital certificate of the terminal from the user database according to the serial number, and uses the digital certificate.
  • the public key verifies the digital signature.
  • the access server receives the operator.
  • the authentication server requests the digital certificate of the terminal, and the specific implementation method may be: receiving the digital certificate request message sent by the operator authentication server, And sending the digital certificate request message to the terminal; receiving the digital certificate sent by the terminal, and sending the digital certificate to the operator authentication server. .
  • the access server forwards the digital certificate request message sent by the received carrier authentication server to the terminal, and the terminal returns its digital certificate to the access server, and the access server encapsulates the digital certificate in the RADIUS message.
  • the carrier authentication server first verifies the digital certificate of the terminal with the local root certificate.
  • the root certificate is obtained by the carrier authentication server from the digital certificate authority, and the public key in the digital certificate after the verification is passed.
  • the digital signature of the terminal is verified, and after the verification is passed, the digital certificate is uploaded to the user database to bind the serial number and the digital certificate in the user identification information.
  • the step 402 of the foregoing method is used to obtain the verification information of the terminal according to the access authentication request
  • the specific implementation method may be: sending the identifier request information to the terminal; and receiving the Verification information, the verification information including the serial number in the user identification information, the user identification information including a key and the serial number.
  • the step 403 of the foregoing method is used to perform the user identity verification according to the verification information to the operator authentication server.
  • the specific implementation method may be: obtaining an authentication message from the operator authentication server according to the sequence number, the authentication message. Includes random strings and authentication codes. After that, the method further includes: sending the authentication message to the terminal.
  • the access server sends the identifier request information (EAP-Request/Identity) to the terminal, receives the sequence number in the user identification information sent by the terminal, and sends the sequence number to the operator authentication server to obtain the authentication message.
  • the authentication message includes a random string and an authentication code generated by the operator authentication server, and may also include subscription information of the user.
  • the access server sends the authentication message to the terminal, and the terminal first decrypts the encrypted key in the user identification information by using the private key corresponding to the digital certificate, and verifies the authentication code after generating the session key.
  • FIG. 5 is a flowchart of Embodiment 5 of a terminal security authentication method according to the present invention. As shown in FIG. 5, the method in this embodiment may include:
  • Step 501 Receive a user identity verification request sent by an access server.
  • the execution entity of this embodiment may be an operator authentication server, and the user identity verification request includes The data packet and the digital signature sent by the terminal, the data packet includes a serial number and a security authentication string in the user identification information, and the security authentication string includes a time string and a random string randomly generated by the access server, and the digital signature is passed by the terminal.
  • the signature of the data packet by the private key corresponding to the digital certificate.
  • the carrier authentication server receives the RADIUS message sent by the access server, that is, the identity verification request.
  • Step 502 Acquire a digital certificate of the terminal according to the user identity verification request.
  • the operator authentication server requests the digital certificate of the terminal from the user database according to the serial number in the user identification information. If the digital certificate returned by the user database can be obtained, the terminal is not the initial verification, and vice versa. If the quotient authentication server does not obtain a digital certificate from the user database, it indicates that the terminal is the initial authentication.
  • Step 503 Verify the digital signature according to the digital certificate, and perform information interaction with the access server after the verification is passed to complete the access authentication.
  • the operator authentication server obtains the digital certificate of the terminal from the user database, and verifies the digital signature of the terminal by using the public key in the certificate.
  • the operator authentication server performs access authentication on the terminal according to the digital certificate of the terminal and the user identification information, and implements dual authentication of the terminal identifier and the user identifier, and the digital certificate ensures that even if the user identification information is copied or replaced, the terminal cannot After the authentication is passed, the access authentication is no longer dependent on the security capabilities of the operating system of the terminal.
  • the step 502 of the foregoing method embodiment is to obtain the digital certificate of the terminal according to the user identity verification request
  • the specific implementation method may be: sending the serial number to a user database; acquiring the binding with the serial number.
  • the digital certificate may further be: sending the serial number to a user database; receiving a digital certificate request message sent by the user database; forwarding the digital certificate request message to an access server; and receiving the digital certificate sent by the access server The digital certificate is verified based on the root certificate obtained from the digital certificate authority.
  • the operator authentication server obtains the digital certificate of the terminal from the user database library. If the terminal is initially authenticated by the network, the user database does not have the required digital certificate, and the operator authentication server receives the digital certificate request message sent by the user database. And sending a digital certificate request message to the access server to obtain the digital certificate of the terminal. If it is not the initial access network authentication of the terminal, then The user database has the required digital certificate, and the operator authentication server can obtain the digital certificate directly from the user database. After receiving the digital certificate, the carrier authentication server first verifies the digital certificate with the local root certificate, that is, verifies whether the digital certificate is issued by the digital certificate authority that it trusts. After the verification is passed, the public key in the digital certificate is used for verification.
  • the digital certificate is uploaded to the user database to bind the serial number and the digital certificate in the user identification information, and then the information is exchanged with the access server to complete the access authentication.
  • This process can adopt EAP- The SIM authentication process is not described in detail here.
  • FIG. 6 is a flowchart of Embodiment 6 of a terminal security authentication method according to the present invention. As shown in FIG. 6, the method in this embodiment may include:
  • Step 601 Receive a sequence number in user identification information of the terminal sent by the operator authentication server.
  • the execution body of this embodiment may be a user database, and the user identification information includes a key and the serial number.
  • Step 602 Determine whether the serial number has been bound to a digital certificate.
  • the user database determines whether the serial number in the user identification information has been bound to the digital certificate, that is, whether the digital certificate associated with the serial number is queried.
  • Step 603 If yes, send a digital certificate bound to the serial number to the operator authentication server.
  • the digital certificate is directly sent to the operator authentication server, so that the operator authentication server performs user identity verification according to the digital certificate.
  • the user database stores the digital certificate of the terminal, and saves the binding relationship between the serial number and the digital certificate, so as to avoid frequent transmission and reception of the digital certificate when the terminal repeatedly accesses, and improve the security of the digital certificate of the terminal.
  • the method further includes: if the user database does not find the digital certificate bound to the serial number, sending a digital certificate request message to the operator authentication server; receiving the carrier authentication server Uploading the serial number and the digital certificate, And saving the binding relationship between the serial number and the digital certificate.
  • the user database if the terminal is the first access authentication, the user database does not have the information record of the terminal, so the digital certificate bound to the serial number cannot be found, so the user database sends the digital certificate request message to the operator authentication server. Receive the serial number and digital certificate uploaded by the carrier authentication server, and save the binding relationship between the serial number and the digital certificate.
  • FIG. 7 is a flowchart of Embodiment 7 of a terminal security authentication method according to the present invention. As shown in FIG. 7, the method in this embodiment may include:
  • the terminal acquires user identity information distributed by the operator server.
  • the user identity identification information includes a serial number and a key.
  • the terminal sends an access authentication request to the access server.
  • the access server sends the identifier request information and the security authentication string to the terminal.
  • the security authentication string includes a random string, and the security authentication string may further include a time string.
  • the terminal signs the data packet by using a private key corresponding to the digital certificate of the terminal, and obtains a digital signature.
  • the data includes the sequence number and the security authentication string, and the digital signature may be carried in the data packet.
  • the terminal sends the data packet and the digital signature to an access server.
  • the access server requests the operator authentication server to perform user identity verification according to the sequence number and the digital signature.
  • the carrier authentication server sends the sequence number to the user database.
  • the user database determines whether the serial number has been bound to the digital certificate, if not, then go to s609, and if so, then go to s617;
  • the user database sends a digital certificate request message to the operator authentication server.
  • the user database may also send some and user identifications to the operator authentication server.
  • Information related to the certificate such as authentication vectors and user subscription information.
  • the carrier authentication server sends a digital certificate request message to the access server.
  • the access server sends a digital certificate request message to the terminal.
  • the access server receives the digital certificate sent by the terminal.
  • the access server sends the digital certificate to the operator authentication server.
  • the carrier authentication server verifies the digital certificate according to the root certificate obtained from the digital certificate authority, and verifies the digital signature according to the digital certificate after the verification is passed;
  • the carrier authentication server uploads the serial number and the digital certificate to the user database.
  • the user database saves the binding relationship between the serial number and the digital certificate, and then goes to s619;
  • the carrier authentication server acquires, according to the sequence number, a digital certificate bound to the serial number from a user database.
  • the operator authentication server may further obtain the information related to the user authentication according to the serial number
  • the operator authentication server verifies the digital signature according to the digital certificate, and if it passes the verification, executes s619;
  • S620 The terminal receives the access authentication success information sent by the access server, and accesses the network through the access server and uses the network service provided by the network.
  • FIG. 8 is a flowchart of Embodiment 8 of a terminal security authentication method according to the present invention. As shown in FIG. 8, the method in this embodiment may include:
  • the terminal connects to the operator server to apply for a soft SIM, and receives a digital certificate request message sent by the operator server.
  • S702 The terminal sends a digital certificate of the terminal to the operator server.
  • the carrier server verifies the digital certificate according to the root certificate.
  • the request message for requesting user identity information carries a digital certificate
  • the user database After receiving the request message for requesting user identification information, the user database allocates user identification information, and encrypts the key in the user identification information by using the public key of the digital certificate to obtain an encrypted key. ;
  • the user database may also bind the serial number in the digital certificate and the user identification information, so that the user database saves the binding relationship between the distributed soft SIM and the digital certificate of the terminal, thereby supporting the user to repeatedly apply for the prompt and the user. Retransmission after loss of soft SIM, identification of stolen terminal, management of No. 1 multi-machine, etc.
  • the user database sends the serial number and the encrypted key to the operator server;
  • the terminal receives the sequence number sent by the operator server and the encrypted key.
  • the terminal sends an access authentication request to the access server.
  • the access server sends the identifier request information to the terminal.
  • the terminal sends the sequence number to the access server.
  • the access server forwards the serial number to the operator authentication server
  • the carrier authentication server acquires information related to user authentication from the user database according to the sequence number.
  • the information related to the user authentication may be, for example, an authentication vector, user subscription information, or the like.
  • S713 The carrier authentication server sends the authentication message to the access server.
  • the terminal receives an authentication message sent by the access server.
  • the authentication message includes a random string and an authentication code.
  • the terminal decrypts the encrypted key by using a private key corresponding to the digital certificate, and executes a preset algorithm to generate a session key according to the decrypted key and the random string, and performs session key verification.
  • Message authentication code
  • the terminal, the access server, and the operator authentication server perform information exchange for access network authentication
  • the terminal receives the network access authentication success information sent by the access server, and accesses the network through the access server and uses the network service provided by the network.
  • FIG. 9 is a schematic structural diagram of Embodiment 1 of the terminal of the present invention.
  • the apparatus in this embodiment may include: an information acquiring module 11, a request sending module 12, an authentication interaction module 13, and an access module 14, wherein the information
  • the obtaining module 11 is configured to obtain user identification information distributed by the operator service device, where the user identity identification information includes a serial number and a key, and the request sending module 12 is configured to send an access authentication request to the access service device;
  • the interaction module 13 is configured to perform information interaction with the access service device to implement access authentication according to the digital certificate of the terminal and the user identity information, and the access module 14 is configured to receive the connection. Access authentication success information sent by the serving device, and accessing the network through the access service device and using the network service provided by the network.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 10 is a schematic structural diagram of a second embodiment of the terminal according to the present invention.
  • the device in this embodiment may further include: a first digital certificate processing module 15 on the basis of the device structure shown in FIG.
  • the authentication interaction module 13 is specifically configured to receive the identifier request information and the security authentication string sent by the access service device, where the security authentication string includes a time string and a random string; and according to the identifier request information, Decrypting the data packet by the private key corresponding to the digital certificate, obtaining a digital signature, the data packet including the serial number and the security authentication string; and sending the data packet and the digital signature to the access service device;
  • the first digital certificate processing module 15 is configured to receive a digital certificate request message sent by the access service device, and send the digital certificate to the access service device.
  • the device of this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , FIG. 2 or FIG. 7 , and the implementation principle and technical effects thereof are similar, and details are not described herein again.
  • FIG. 11 is a schematic structural diagram of a third embodiment of the terminal according to the present invention.
  • the device of the present embodiment further includes: a second digital certificate processing module 16 according to the device structure shown in FIG. And a method for receiving a digital certificate request message sent by the operator service device; and sending the digital certificate to the operator service device.
  • the information obtaining module 11 is configured to receive the serial number sent by the operator service device and the encrypted key
  • the authentication interaction module 13 is specifically configured to receive the identifier request information sent by the access service device.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , FIG. 3 or FIG. 8 , and the implementation principle and the technical effect are similar, and details are not described herein again.
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of an access service device according to the present invention.
  • the device in this embodiment may include: a receiving module 21, a verification information acquiring module 22, a verification module 23, and an access module 24,
  • the receiving module 21 is configured to receive an access authentication request sent by the terminal, where the verification information acquiring module 22 is configured to obtain the verification information of the terminal according to the access authentication request, and the verification module 23 is configured to The authentication information is sent to the operator authentication service device for user identity verification.
  • the access module 24 is configured to send the access authentication success information to the terminal after the user identity verification is passed.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 4, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 13 is a schematic structural diagram of Embodiment 2 of an access service device according to the present invention.
  • the device in this embodiment is further configured to include: a digital certificate forwarding module 25, based on the device structure shown in FIG. .
  • the verification information obtaining module 22 specifically sends the identifier request information and the security authentication string to the terminal, where the security authentication string includes a time string and a random string;
  • the verification information sent by the terminal, the verification information includes a data packet and a digital signature of the terminal, the data packet includes a serial number and a security authentication string in the user identification information, and the user identification information includes a secret a key and the serial number;
  • the verification module 23 is configured to request, according to the serial number and the digital signature, the user authentication service device to perform user identity verification;
  • the digital certificate forwarding module 25 is configured to receive the operation Determining, by the service authentication device, a digital certificate request message, and transmitting the digital certificate request message to the terminal; receiving the digital certificate sent by the terminal, and transmitting
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 4 or FIG. 7.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 14 is a schematic structural diagram of Embodiment 3 of an access service device according to the present invention.
  • the device in this embodiment may further include: an authentication feedback module 26, based on the device structure shown in FIG.
  • the verification information obtaining module 22 is specifically configured to send the identifier request information to the terminal, and receive the verification information sent by the terminal, where the verification information includes the serial number in the user identification information, and the user identifier is The information includes a key and the serial number; the verification module 23 is specifically configured to acquire an authentication message from the operator authentication service device according to the serial number, where the authentication message includes a random string and an authentication code; the authentication feedback module 26.
  • the method is configured to send the authentication message to the terminal.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 4 or FIG. 8.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 15 is a schematic structural diagram of an embodiment of an operator authentication service apparatus according to the present invention.
  • the apparatus in this embodiment may include: a receiving module 31, a certificate obtaining module 32, and a verification module 33, wherein the receiving module 31 uses Receiving a user identity verification request sent by the access service device, where the user identity verification request includes a data packet and a digital signature sent by the terminal, where the data packet includes a serial number and a security authentication string in the user identification information, The user identification information includes a key and the serial number, the security authentication string includes a time string and a random string, and the digital signature is the data packet of the terminal by using the private key corresponding to the digital certificate.
  • a signature obtained by the certificate obtaining module 32 configured to acquire a digital certificate of the terminal according to the user identity verification request;
  • the module 33 is configured to verify the digital signature according to the digital certificate, and perform information interaction with the access service device after the verification is passed to complete the access authentication.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 5, FIG. 7 or FIG. 8.
  • the implementation principle and the technical effect are similar, and details are not described herein again.
  • the certificate obtaining module 32 is specifically configured to send the serial number to a user database, and obtain the digital certificate bound to the serial number.
  • the certificate obtaining module 32 is specifically configured to send the serial number to a user database, receive a digital certificate request message sent by the user database, forward the digital certificate request message to an access service device, and receive the And the digital certificate sent by the access service device; and the digital certificate is verified according to the root certificate obtained from the digital certificate authority.
  • FIG. 16 is a schematic structural diagram of an embodiment of a user database according to the present invention.
  • the apparatus in this embodiment may include: a receiving module 41, a determining module 42, and a certificate processing module 43, wherein the receiving module 41 is configured to receive operations. a serial number in the user identification information of the terminal sent by the quotient authentication service device, where the user identification information includes a key and the serial number; the determining module 42 is configured to determine whether the serial number has been bound to the digital certificate; The certificate processing module 43 is configured to: if the determining module determines that the serial number has been bound to the digital certificate, send the digital certificate bound to the serial number to the operator authentication service device.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 6, FIG. 7 or FIG. 8.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • the certificate processing module 43 is further configured to: if the determining module determines that the serial number does not have a bound digital certificate, send a digital certificate request message to the operator authentication service device; and receive the operator authentication. The serial number uploaded by the service device and the digital certificate, and the binding relationship between the serial number and the digital certificate is saved.
  • FIG. 17 is a schematic structural diagram of Embodiment 4 of the terminal of the present invention.
  • the device in this embodiment may include: an interface 51, a memory 52, and a processor 53.
  • the interface 51, the memory 52 and the processor 53 are connected by a bus.
  • the interface 51 can be one or more of the following: a network interface controller that provides a wired interface (English: Network interface controller (abbreviation: NIC), such as Ethernet NIC; NIC providing wireless interface, such as wireless local area network (abbreviation: WLAN) NIC.
  • NIC Network interface controller
  • WLAN wireless local area network
  • the memory 52 stores the program code and transmits the stored program code to the processor 53.
  • the memory 52 may be a volatile memory (English: volatile memory), such as random access memory (English: random-access memory, abbreviation: RAM); or non-volatile memory (English: non-volatile memory), for example Flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviated: HDD) or solid state drive (English: solid-state drive, abbreviation: SSD); or a combination of the above types of memory.
  • volatile memory such as random access memory (English: random-access memory, abbreviation: RAM); or non-volatile memory (English: non-volatile memory), for example Flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviated: HDD) or solid state drive (English: solid-state drive, abbreviation: SSD); or a combination of the above types of memory.
  • the processor 53 obtains the program code stored in the memory 52, and executes the technical solution of the method embodiment of any one of FIGS. 1 to 3 and 7 to 8 in accordance with the obtained program code.
  • the processor 53 may be a central processing unit (English: central processing unit, abbreviated: CPU) or a combination of a CPU and a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (abbreviated as PLD), or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field-programmable gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array Logic, abbreviation: GAL) or a combination thereof.
  • the access server, the carrier authentication server, and the user database may all adopt the hardware configuration described above with reference to FIG. 17, except that the program codes stored in the memory 52 are different.
  • the processor 53 of the access server obtains the program code stored in the memory 52, and executes the technical solution of the method embodiment of any one of FIG. 4 and FIG. 7 to FIG. 8 according to the obtained program code;
  • the processor of the carrier authentication server Obtaining the program code stored in the memory 52, and executing the technical solution of the method embodiment of any one of FIG. 5 and FIG. 7 to FIG. 8 according to the obtained program code;
  • the processor 53 of the user database obtains the program code stored in the memory 52, The technical solution of the method embodiment of any one of FIG. 6 to FIG. 8 is executed according to the obtained program code.
  • FIG. 18 is a schematic structural diagram of an embodiment of a terminal security authentication system according to the present invention.
  • the system in this embodiment includes: a terminal 61, an access server 62, an operator authentication server 63, and a user.
  • Both the database 64 and the carrier server 65 can adopt the hardware configuration shown in FIG.
  • the terminal 61 can perform the technical solutions of the method embodiments in any of the embodiments of FIG. 1 to FIG. 3 and FIG. 7 to FIG. 8.
  • the implementation principle and the technical effects are similar, and details are not described herein again;
  • the access server 62 can execute FIG. 4 and FIG.
  • the technical solution of any one of the method embodiments of FIG. 8 is similar to the technical effect, and is not described herein again.
  • the carrier authentication server 63 can perform the technology of any one of the method embodiments of FIG. 5 and FIG. 7 to FIG. The implementation principle and the technical effect are similar, and are not described here again; the user database 64 can perform the technical solutions of any of the method embodiments in FIG. 6 to FIG. 8 , and the implementation principle and technical effects are similar, and details are not described herein again;
  • the operator server 65 is configured to distribute the user identification information to the terminal.
  • the system of this embodiment can be used as an application scenario of the method embodiment shown in FIG. 7 or FIG. 8.
  • the terminal 61 can be a PC, a mobile phone, a tablet, a set top box, or the like.
  • the terminal 61 can access the network through the fixed network or the mobile network. Therefore, a residential gateway (RG), an access point (AP), and a digital user can be disposed between the terminal 61 and the access server 62.
  • a device such as a Digital Subscriber Line Access Multiplexer (DSLAM) or an Optical Line Terminal (OLT).
  • DSLAM Digital Subscriber Line Access Multiplexer
  • OLT Optical Line Terminal
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例提供一种终端安全认证方法、装置及系统。本发明终端安全认证方法，包括：获取运营商服务器分发的用户身份识别信息，所述用户身份识别信息包括唯一标识用户身份的序列号和密钥；向接入服务器发送接入认证请求；根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互；接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务。本发明实施例实现终端标识与用户标识双重认证，解决使用软件用户身份识别信息的终端接入认证过于依赖于终端的操作系统的安全能力的问题。

Description

终端安全认证方法、装置及系统
本申请要求于2014年4月28日提交中国专利局、申请号为CN201410175826.1、发明名称为“终端安全认证方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信技术，尤其涉及一种终端安全认证方法、装置及系统。
背景技术
第二代全球移动通信系统(Global System for Mobile Communication，简称GSM)手机和用户身份识别卡(Subscriber Identity Module，简称SIM)的出现使得用户不必再像机卡一体时代那样频繁地的更换手机或更换号码，也使得手机技术飞速发展，样式层出不穷，同时移动通信网络运营商借助机卡分离技术，灵活的扩展了SIM卡发行渠道，保障了网络基础密钥的安全使用，带来了今天的手机用户规模和丰富的移动业务，并沿用到第三代手机终端中。而在物联网应用中，由于终端对使用环境的特殊要求，以及终端集成和发行流程多样化，传统硬件SIM卡已不能满足除手机外其它终端的需求，此时在终端中放置软SIM可能更加适合，GSM协会和第三代合作伙伴计划(3rd Generation Partnership Project，简称3GPP)都有关于软SIM的标准化工作，最大的问题在于硬件SIM卡使用了特殊的硬件加工方式，保证了私钥部分不可读出，软SIM不具备上述功能要保证密钥的安全性比较困难。
现有技术是通过终端的操作系统提供的安全环境来保证软SIM的安全分发和使用，这种安全环境由操作系统级别的驱动或者虚拟机来提供，不对外提供软SIM的密钥等信息，保证了该软SIM不可复制。但是这种方法过于依赖终端的操作系统的安全能力，而目前操作系统的绝对安全还不能证明已实现。
发明内容
本发明实施例提供一种终端安全认证方法、装置及系统，以解决使用软件用户身份识别信息的终端接入认证过于依赖于终端的操作系统的安全能力的问题。
第一方面，本发明实施例提供一种终端安全认证方法，包括：
获取运营商服务器分发的用户身份识别信息，所述用户身份识别信息包括唯一标识用户身份的序列号和密钥；
向接入服务器发送接入认证请求；
根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互；
接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务。
结合第一方面，在第一方面的第一种可能的实现方式中，所述根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互，包括：
接收所述接入服务器发送的标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；
根据所述标识请求信息，通过所述数字证书对应的私钥对数据包进行签名，得到数字签名，所述数据包包括所述序列号和所述安全认证字串；
向所述接入服务器发送所述数据包和数字签名。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述向所述接入服务器发送所述数据包和数字签名之后，还包括：
接收所述接入服务器发送的数字证书请求消息；
向所述接入服务器发送所述数字证书。
结合第一方面，在第一方面的第三种可能的实现方式中，所述获取运营商服务器分发的用户身份识别信息之前，还包括：
接收所述运营商服务器发送的数字证书请求消息；
向所述运营商服务器发送所述数字证书；
所述获取运营商服务器分发的用户身份识别信息，包括：
接收所述运营商服务器发送的所述序列号和加密后的所述密钥。
结合第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互，包括：：
接收所述接入服务器发送的标识请求信息；
根据所述标识请求信息向所述接入服务器发送所述序列号；
接收所述接入服务器发送的认证消息，所述认证消息包括随机字串和鉴权码；
通过所述数字证书对应的私钥对所述加密后的所述密钥进行解密，并根据解密后的密钥和所述随机字串执行预设算法生成会话密钥，用所述会话密钥校验所述消息鉴权码。
第二方面，本发明实施例提供一种终端安全认证方法，包括：
接收终端发送的接入认证请求；
根据所述接入认证请求，获取所述终端的验证信息；
根据所述验证信息向运营商认证服务器请求进行用户身份验证；
在所述用户身份验证通过后，向所述终端发送接入认证成功信息。
结合第二方面，在第二方面的第一种可能的实现方式中，所述根据所述接入认证请求，获取所述终端的验证信息，包括：
向所述终端发送标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；
接收所述终端发送的所述验证信息，所述验证信息包括数据包和所述终端的数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号；
所述根据所述验证信息向运营商认证服务器请求进行用户身份验证，包 括：
根据所述序列号和所述数字签名向所述运营商认证服务器请求进行用户身份验证。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述根据所述序列号和所述数字签名向所述运营商认证服务器请求进行用户身份验证之后，还包括：
接收所述运营商认证服务器发送的数字证书请求消息，并将所述数字证书请求消息发送给所述终端；
接收所述终端发送的所述数字证书，并将所述数字证书发送给所述运营商认证服务器。
结合第二方面，在第二方面的第三种可能的实现方式中，所述根据所述接入认证请求，获取所述终端的验证信息，包括：
向所述终端发送标识请求信息；
接收所述终端发送的所述验证信息，所述验证信息包括用户身份识别信息中的所述序列号，所述用户身份识别信息包括密钥和所述序列号；
所述根据所述验证信息向运营商认证服务器请求用户身份验证，包括：
根据所述序列号从所述运营商认证服务器获取认证消息，所述认证消息包括随机字串和鉴权码。
结合第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，所述根据所述序列号从所述运营商认证服务器获取认证消息之后，还包括：
向所述终端发送所述认证消息。
第三方面，本发明实施例提供一种终端安全认证方法，包括：
接收接入服务器发送的用户身份验证请求，所述用户身份验证请求包括终端发送的数据包和数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号，所述安全认证字串包括时间字串和随机字串，所述数字签名为所述终端通过所述数 字证书对应的私钥对所述数据包进行的签名；
根据所述用户身份验证请求获取所述终端的数字证书；
根据所述数字证书验证所述数字签名，验证通过后与所述接入服务器进行信息交互以完成接入认证。
结合第三方面，在第三方面的第一种可能的实现方式中，所述根据所述身份验证请求获取所述终端的数字证书，包括：
向用户数据库发送所述序列号；
获取与所述序列号绑定的所述数字证书。
结合第三方面，在第三方面的第二种可能的实现方式中，所述根据所述身份验证请求获取所述终端的数字证书，包括：
向用户数据库发送所述序列号；
接收所述用户数据库发送的数字证书请求消息；
将所述数字证书请求消息转发给接入服务器；
接收所述接入服务器发送的所述数字证书；
根据从数字证书管理机构获取到的根证书验证所述数字证书。
第四方面，本发明实施例提供一种终端安全认证方法，包括：
接收运营商认证服务器发送的终端的用户身份识别信息中的序列号，所述用户身份识别信息包括密钥和所述序列号；
判断所述序列号是否已经绑定数字证书；
若是，则向所述运营商认证服务器发送与所述序列号绑定的数字证书。
结合第四方面，在第四方面的第一种可能的实现方式中，所述判断所述序列号是否已经绑定数字证书之后，还包括：
若否，则向所述运营商认证服务器发送数字证书请求消息；
接收所述运营商认证服务器上传的所述序列号和所述数字证书，并保存所述序列号和所述数字证书的绑定关系。
第五方面，本发明实施例提供一种终端，包括：
信息获取模块，用于获取运营商服务装置分发的用户身份识别信息，所 述用户身份识别信息包括序列号和密钥；
请求发送模块，用于向接入服务装置发送接入认证请求；
认证交互模块，用于根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务装置进行用于实现接入认证的信息交互；
接入模块，用于接收所述接入服务装置发送的接入认证成功信息，并通过所述接入服务装置接入网络并使用所述网络提供的网络服务。
结合第五方面，在第五方面的第一种可能的实现方式中，所述认证交互模块，具体用于接收所述接入服务装置发送的标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；根据所述标识请求信息，通过所述数字证书对应的私钥对数据包进行签名，得到数字签名，所述数据包包括所述序列号和所述安全认证字串；向所述接入服务装置发送所述数据包和数字签名。
结合第五方面的第一种可能的实现方式，在第五方面的第二种可能的实现方式中，还包括：
第一数字证书处理模块，用于接收所述接入服务装置发送的数字证书请求消息；向所述接入服务装置发送所述数字证书。
结合第五方面，在第五方面的第三种可能的实现方式中，还包括：
第二数字证书处理模块，用于接收所述运营商服务装置发送的数字证书请求消息；向所述运营商服务装置发送所述数字证书；
所述信息获取模块，具体用于接收所述运营商服务装置发送的所述序列号和加密后的所述密钥。
结合第五方面的第三种可能的实现方式，在第五方面的第四种可能的实现方式中，所述认证交互模块，具体用于接收所述接入服务装置发送的标识请求信息；根据所述标识请求信息向所述接入服务装置发送所述序列号；接收所述接入服务装置发送的认证消息，所述认证消息包括随机字串和鉴权码；通过所述数字证书对应的私钥对所述加密后的所述密钥进行解密，并根据解密后的密钥和所述随机字串执行预设算法生成会话密钥，用所述会话密钥校 验所述消息鉴权码。
第六方面，本发明实施例提供一种接入服务装置，包括：
接收模块，用于接收终端发送的接入认证请求；
验证信息获取模块，用于根据所述接入认证请求，获取所述终端的验证信息；
验证模块，用于根据所述验证信息向运营商认证服务装置请求进行用户身份验证；
接入模块，用于在所述用户身份验证通过后，向所述终端发送接入认证成功信息。
结合第六方面，在第六方面的第一种可能的实现方式中，所述验证信息获取模块，具体用于向所述终端发送标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；接收所述终端发送的所述验证信息，所述验证信息包括数据包和所述终端的数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号；
所述验证模块，具体用于根据所述序列号和所述数字签名向所述运营商认证服务装置请求进行用户身份验证。
结合第六方面的第一种可能的实现方式，在第六方面的第二种可能的实现方式中，还包括：
数字证书转发模块，用于接收所述运营商认证服务装置发送的数字证书请求消息，并将所述数字证书请求消息发送给所述终端；接收所述终端发送的所述数字证书，并将所述数字证书发送给所述运营商认证服务装置。
结合第六方面，在第六方面的第三种可能的实现方式中，所述验证信息获取模块，具体用于向所述终端发送标识请求信息；接收所述终端发送的所述验证信息，所述验证信息包括用户身份识别信息中的所述序列号，所述用户身份识别信息包括密钥和所述序列号；
所述验证模块，具体用于根据所述序列号从所述运营商认证服务装置获 取认证消息，所述认证消息包括随机字串和鉴权码。
结合第六方面的第三种可能的实现方式，在第六方面的第四种可能的实现方式中，还包括：
认证反馈模块，用于向所述终端发送所述认证消息。
第七方面，本发明实施例提供一种运营商认证服务装置，包括：
接收模块，用于接收接入服务装置发送的用户身份验证请求，所述用户身份验证请求包括终端发送的数据包和数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号，所述安全认证字串包括时间字串和随机字串，所述数字签名为所述终端通过所述数字证书对应的私钥对所述数据包进行的签名；
证书获取模块，用于根据所述用户身份验证请求获取所述终端的数字证书；
验证模块，用于根据所述数字证书验证所述数字签名，验证通过后与所述接入服务装置进行信息交互以完成接入认证。
结合第七方面，在第七方面的第一种可能的实现方式中，所述证书获取模块，具体用于向用户数据库发送所述序列号；获取与所述序列号绑定的所述数字证书。
结合第七方面，在第七方面的第二种可能的实现方式中，所述证书获取模块，具体用于向用户数据库发送所述序列号；接收所述用户数据库发送的数字证书请求消息；将所述数字证书请求消息转发给接入服务装置；接收所述接入服务装置发送的所述数字证书；根据从数字证书管理机构获取到的根证书验证所述数字证书。
第八方面，本发明实施例提供一种用户数据库，包括：
接收模块，用于接收运营商认证服务装置发送的终端的用户身份识别信息中的序列号，所述用户身份识别信息包括密钥和所述序列号；
判断模块，用于判断所述序列号是否已经绑定数字证书；
证书处理模块，用于若所述判断模块判断所述序列号已经绑定数字证书， 则向所述运营商认证服务装置发送与所述序列号绑定的数字证书。
结合第八方面，在第八方面的第一种可能的实现方式中，所述证书处理模块，还用于若所述判断模块判断所述序列号没有经绑定数字证书，则向所述运营商认证服务装置发送数字证书请求消息；接收所述运营商认证服务装置上传的所述序列号和所述数字证书，并保存所述序列号和所述数字证书的绑定关系。
第九方面，本发明实施例提供一种终端安全认证系统，包括：终端、接入服务装置、运营商认证服务装置、用户数据库以及运营商服务装置，其中，所述终端采用第五方面、第五方面的第一种至第四种中任一种可能的实现方式中所述的终端，所述接入服务装置采用第六方面、第六方面的第一种至第四种中任一种可能的实现方式中所述的装置，所述运营商认证服务装置采用第七方面、第七方面的第一种至第二种中任一种可能的实现方式中所述的装置；所述用户数据库采用第八方面或第八方面的第一种可能的是实现方式中所述的装置；
所述运营商服务装置，用于向所述终端分发所述用户身份识别信息。
本发明实施例终端安全认证方法、装置及系统，终端通过数字证书和用户身份识别信息进行接入认证，实现终端标识与用户标识双重认证，以数字证书保证即使用户身份识别信息被复制或更换终端都无法认证通过，使接入认证不再依赖于终端的操作系统的安全能力。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明终端安全认证方法实施例一的流程图；
图2为本发明终端安全认证方法实施例二的流程图；
图3为本发明终端安全认证方法实施例三的流程图；
图4为本发明终端安全认证方法实施例四的流程图；
图5为本发明终端安全认证方法实施例五的流程图；
图6为本发明终端安全认证方法实施例六的流程图；
图7为本发明终端安全认证方法实施例七的流程图；
图8为本发明终端安全认证方法实施例八的流程图；
图9为本发明终端实施例一的结构示意图；
图10为本发明终端实施例二的结构示意图；
图11为本发明终端实施例三的结构示意图；
图12为本发明接入服务装置实施例一的结构示意图；
图13为本发明接入服务装置实施例二的结构示意图；
图14为本发明接入服务装置实施例三的结构示意图；
图15为本发明运营商认证服务装置实施例的结构示意图；
图16为本发明用户数据库实施例的结构示意图；
图17为本发明终端实施例四的结构示意图；
图18为本发明终端安全认证系统实施例的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明的终端接入认证过程以EAP-SIM认证流程为框架，在此基础上增加本发明中与数字证书和用户身份识别信息相关的交互信息或交互流程。
图1为本发明终端安全认证方法实施例一的流程图，如图1所示，本实施例的方法可以包括：
步骤101、获取运营商服务器分发的用户身份识别信息；
本实施例的执行主体可以是终端，该终端可以是任意一个能够接入网络的终端，例如手机、平板电脑、个人电脑等。终端需要从运营商服务器获取用户身份识别信息，现有技术中，用户的手机入网要先从运营商获取客户识别模块(Subscriber Identity Module，简称SIM)，在SIM卡中包含了一个国际移动用户识别码(International Mobile Subscriber Identification Number，简称IMSI)，用于唯一标识该用户。本发明中的用户身份识别信息可以是软件SIM，而该软件SIM比SIM卡可以支持更多样的终端形式，可以适应于没有SIM卡卡槽的终端，在软件SIM中也包括一个用于唯一标识用户的序列号，还包括用户进行接入认证需要的相关信息，即密钥。
步骤102、向接入服务器发送接入认证请求；
本实施例中，终端有一个由数字证书认证中心(Certificate Authority，简称CA)分发的用于签名的数字证书，该数字证书可以是内置在设备中的，也可以是设置在通过通用串行总线(Universal Serial Bus，简称USB)接口连接终端上的外部设备上的，数字证书的密钥部分由硬件加工工艺进行安全保护，不可读出、修改、更新或删除，终端在出厂的时候就携带有数字证书，数字证书是终端的唯一标识，终端支持通过数字证书签名的功能。终端向接入服务器发送接入认证请求需要用到数字证书和用户身份识别信息(软件SIM)，通常情况下，终端初次激活软件SIM或者终端重启都需要向接入服务器发送接入认证请求，认证通过后才可以使用网络服务。
步骤103、根据终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互；
本实施例中，终端根据数字证书和用户身份识别信息与接入服务器进行接入认证的信息交互，这个过程可以采用可扩展身份验证协议(Extensible Authentication Protocol，简称EAP)EAP-SIM认证流程，此处不做详细描述。
步骤104、接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务。
本实施例中，终端的数字证书和用户身份识别信息被接入服务器认证通过后，接收接入服务器发送的认证成功信息，例如EAP-Success，终端即可在后续上线操作完成后通过接入服务器接入网络并使用网络提供的网络服务。
本实施例，终端通过数字证书和用户身份识别信息进行接入认证，实现终端标识与用户标识双重认证，以数字证书保证即使用户身份识别信息被复制或更换终端都无法认证通过，使接入认证不再依赖于终端的操作系统的安全能力。
图2为本发明终端安全认证方法实施例二的流程图，如图2所示，本实施例的方法可以包括：
步骤201、获取运营商服务器分发的用户身份识别信息；
本实施例中，终端获取运营商服务器分发的用户身份识别信息，具体的实现方法可以是：通过外部存储设备拷贝所述运营商服务器分发的所述用户身份识别信息；或者，通过登录所述运营商服务器的指定网页获取所述用户身份识别信息。
具体来讲，终端可以使用外部存储设备，例如USB闪存驱动器(U盘)，拷贝用户身份识别信息(软件SIM)，或者直接用USB数据线连接运营商提供的相关设备下载用户身份识别信息(软件SIM)。可选的，终端由于还没有进行接入认证，因此终端如果想要使用网络服务一定会被重定向至运营商的指定网页，终端登录该网页下载用户身份识别信息(软件SIM)。
步骤202、向接入服务器发送接入认证请求；
本实施例中，终端可以向接入服务器发送EAPoL-Start以发起接入认证或者在接入服务器的要求下发起接入认证，终端根据预存的数字证书和所述用户身份识别信息向接入服务器发起接入认证的过程与上述方法实施例的步骤102类似，此处不再赘述。
步骤203、接收所述接入服务器发送的标识请求信息和安全认证字串；
本实施例中，安全认证字串包括时间字串和随机字串，接入服务器根据终端发送的EAPoL-Start或者其他方式触发接入认证，在本地随机生成一个随 机字串，在向终端回复标识请求信息时携带上该随机字串及时间字串，以保证终端每次的数字签名都是不一样的，标识请求信息可以是EAP-SIM认证流程中的EAP-Request/Identity。
步骤204、根据所述标识请求信息，通过数字证书对应的私钥对数据包进行签名，得到数字签名；
本实施例中，数据包包括用户身份识别信息中的序列号和安全认证字串，终端收到接入服务器的标识请求信息后，用本地保存的数字证书对应的私钥对由用户身份识别信息中的序列号、随机字串、时间字串组成的数据包进行签名，该签名过程现有技术中已存在，此处不再赘述。
步骤205、向所述接入服务器发送所述数据包和数字签名；
本实施例中，终端把数据包和数字签名都发送给接入服务器，接入服务器根据数据包中的用户身份识别信息中的序列号向运营商认证服务器请求用户身份验证，并使得运营商认证服务器从用户数据库获取与用户身份识别信息中的序列号绑定的数字证书，根据数字证书验证所述数字签名。接入服务器将用户身份识别信息中的序列号和安全认证字串一起封装在远程认证拨号用户服务(Remote Authentication Dial In User Service，简称RADIUS)消息中发送给运营商认证服务器，运营商认证服务器则根据用户身份识别信息中的序列号查询用户数据库，获取与用户身份识别信息中的序列号绑定的数字证书，用户数据库支持数字证书的发送，运营商认证服务器用数字证书中的公钥验证终端的数字签名。
步骤206、根据所述数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互；
本实施例中，这个过程可以采用EAP-SIM认证流程，此处不做详细描述。
步骤207、接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务。
本实施例中，终端接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务的过程与上述方 法实施例的步骤104类似，此处不再赘述。
本实施例，终端通过数字证书和用户身份识别信息进行接入认证，实现终端标识与用户标识双重认证，以数字证书保证即使用户身份识别信息被复制或更换终端都无法认证通过，使接入认证不再依赖于终端的操作系统的安全能力。
进一步的，上述方法实施例的步骤205中，若运营商认证服务器没有从用户数据库获取到与用户身份识别信息中的序列号绑定的数字证书，表示这是终端的初次接入认证，因此用户数据库中没有存储终端的数字证书与用户身份识别信息中的序列号的绑定信息，因此终端向所述接入服务器发送所述数据包和数字签名后，还包括：接收所述接入服务器发送的数字证书请求消息；向所述接入服务器发送所述数字证书，以使所述接入服务器将所述数字证书发送给所述运营商认证服务器，并使得所述运营商认证服务器根据从数字证书管理机构获取到的根证书验证所述数字证书，对所述数字证书验证通过后再根据所述数字证书验证所述数字签名，对所述数字签名验证通过后将所述数字证书上传给所述用户数据库以绑定所述用户身份识别信息中的所述序列号和所述数字证书。
具体来讲，运营商认证服务器没有从用户数据库获取到与用户身份识别信息中的序列号绑定的数字证书，则运营商认证服务器向接入服务器发送数字证书请求消息，接入服务器将该数字证书请求消息转发给终端，终端将自己的数字证书发送给接入服务器，接入服务器再将该数字证书转发给运营商认证服务器，运营商认证服务器存储了从数字证书管理机构获取到的根证书，用根证书验证终端的数字证书，验证通过后在用数字证书中的公钥验证终端的数字签名，再次验证通过后，运营商认证服务器将数字证书上传给用户数据库以绑定用户身份识别信息中的序列号和数字证书。
进一步的，运营商将用户身份识别信息中的序列号和数字证书的绑定的方法，除了上述的通过终端的初次接入网络认证触发绑定用户身份识别信息中的序列号和数字证书以外，运营商服务器也可以通过用户数据库直接在后 台绑定用户身份识别信息中的序列号和数字证书，例如运营商服务器在下发用户身份识别信息时，根据从终端获取到的数字证书或数字证书的编号进行绑定(只有编号时需要去下载对应的数字证书)。可选的，运营商直接出售已经绑定用户身份识别信息的终端，在出售前先绑定用户身份识别信息中的序列号和数字证书。可选的，运营商也可以使用附图7中的流程绑定用户的数字证书和用户身份识别信息，此时终端可以有两个数字证书，一个用于签名(绑定时与该数字证书绑定)，一个用于加密(用户身份识别信息下发时使用该数字证书)。运营商服务器还可以对用户身份识别信息中的序列号和数字证书绑定关系进行管理，例如进行绑定、解绑定，或者改变绑定对象等。
前述方案中，终端的数字证书与用户身份识别信息为1：1绑定，或者1：n绑定。如果用户申请了一机多号的业务，运营商确认之后，还支持将用户身份识别信息中的序列号与多个终端的数字证书绑定，为客户提供一号多机的业务。另外，终端中预存的数字证书，除了进行接入网络认证，还可以使用在网上购物或者移动办公等场景中，用于确定用户的身份。
图3为本发明终端安全认证方法实施例三的流程图，如图3所示，本实施例的方法可以包括：
步骤301、接收运营商服务器发送的数字证书请求消息；
本实施例中，为了保证用户身份识别信息(软件SIM)的安全性，运营商服务器在分发用户身份识别信息的时候，要求终端提供数字证书，运营商服务器将用户身份识别信息中的密钥用数字证书的公钥加密，再发给用户，因此终端一开始就是接收运营商服务器发送的数字证书请求消息。
步骤302、向所述运营商服务器发送数字证书；
本实施例中，终端向运营商服务器提供自己的数字证书，或者用户提供自己的数字证书的编号，运营商服务器从数字证书管理机构下载对应的数字证书。运营商服务器根据本地存储的根证书验证终端的数字证书，验证通过后携带数字证书向用户数据库请求用户身份识别信息，用户数据库在收到数字证书后先绑定数字证书和用户身份识别信息中的序列号，并用数字证书的 公钥对用户身份识别信息中的密钥加密，再将加密后的用户身份识别信息发给运营商服务器。
步骤303、接收所述运营商服务器发送的所述序列号和加密后的所述密钥；
本实施例中，到这一个步骤为止，终端获取到运营商服务器发送的用户身份识别信息，该用户身份识别信息中的密钥已经用数字证书中的公钥加密过。
步骤304、向接入服务器发送接入认证请求；
本实施例中，终端根据预存的数字证书和所述用户身份识别信息向接入服务器发起接入认证的过程与上述方法实施例的步骤102类似，此处不再赘述。
步骤305、接收所述接入服务器发送的标识请求信息；
步骤306、根据所述标识请求信息向所述接入服务器发送所述序列号；
本实施例中，终端把用户身份识别信息中的序列号发送给接入服务器，接入服务器根据该序列号从运营商认证服务器获取认证消息，该认证消息包括运营商认证服务器生成的随机字串和消息鉴权码。
步骤307、接收所述接入服务器发送的认证消息；
步骤308、通过所述数字证书对应的私钥对所述加密后的所述密钥进行解密，并根据解密后的密钥和所述随机字串执行预设算法生成会话密钥，用所述会话密钥校验所述消息鉴权码；
本实施例中，终端先用数字证书对应的私钥对步骤303中获取的用户身份识别信息中的加密后的密钥解密，再根据解密后的密钥和认证消息中的随机字串执行预设算法生成会话密钥，并用会话密钥校验认证消息中的消息鉴权码。
步骤309、根据所述数字证书和所述用户身份识别信息与所述接入服务器进行接入认证的信息交互；
本实施例中，这个过程可以采用EAP-SIM认证流程，此处不做详细描述。
步骤310、接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务。
本实施例中，终端接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务的过程与上述方法实施例的步骤104类似，此处不再赘述。
本实施例，终端通过数字证书从运营商服务器获取加密的用户身份识别信息，并通过用户身份识别信息中的密钥进行接入认证，实现终端标识与用户标识双重认证，以数字证书保证即使用户身份识别信息被复制或更换终端都无法认证通过，使接入认证不再依赖于终端的操作系统的安全能力。
图4为本发明终端安全认证方法实施例四的流程图，如图4所示，本实施例的方法可以包括：
步骤401、接收终端发送的接入认证请求；
本实施例的执行主体可以是接入服务器。接入服务器接收终端发送的接入认证请求，例如EAPoL-Start。
步骤402、根据所述接入认证请求，获取所述终端的验证信息；
步骤403、根据所述验证信息向运营商认证服务器请求进行用户身份验证；
本实施例中，接入服务器与运营商认证服务器之间采用RADIUS格式的消息进行交互，因此接入服务器在获取到终端的数字证书或用户身份识别信息后将其封装在RADIUS消息中转发给运营商认证服务器，以使运营商认证服务器对数字证书或用户身份识别信息进行用户身份验证。接入服务器根据验证信息与运营商认证服务器进行用户身份验证。
步骤404、在所述用户身份验证通过后，向所述终端发送接入认证成功信息。
本实施例中，接入服务器根据运营商认证服务器的认证结果，在验证通过后向终端发送接入认证成功信息，以使终端接入网络并使用所述网络提供的网络服务。
本实施例，接入服务器根据终端的数字证书和用户身份识别信息对终端进行接入认证，实现终端标识与用户标识双重认证，以数字证书保证即使用户身份识别信息被复制或更换终端都无法认证通过，使接入认证不再依赖于终端的操作系统的安全能力。
进一步的，上述方法实施例的步骤402根据所述接入认证请求，获取所述终端的验证信息，具体的实现方法可以是：向所述终端发送标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；接收所述终端发送的所述验证信息，所述验证信息包括数据包和所述终端的数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号。上述方法实施例的步骤403根据所述验证信息向运营商认证服务器请求进行用户身份验证，具体的实现方法可以是：根据所述序列号和所述数字签名向所述运营商认证服务器请求进行用户身份验证。
具体来讲，接入服务器在收到终端的接入认证请求后，即给终端返回一个标识请求信息，例如EAP-Request/Identity，同时该信息中还可以携带一个安全认证字串，该安全认证字串中包括时间字串和随机字串，随机字串是接入服务器随机生成的，目的是为了保证终端每次签名都不一样，终端收到标识请求信息后，将自己的用户身份识别信息中的序列号、时间字串和随机字串组成数据包，用自己的数字证书对应的私钥对数据包进行签名并把数据包和数字签名发送给接入服务器。接入服务器根据以用户身份识别信息中的序列号和数字签名向运营商认证服务器请求用户身份验证，运营商认证服务器根据该序列号从用户数据库获取到该终端的数字证书，并用该数字证书中的公钥验证数字签名。
进一步的，上述过程若运营商认证服务器没有从用户数据库获取到与用户身份识别信息中的序列号绑定的数字证书，说明这是终端的初次接入认证，则接入服务器会接收到运营商认证服务器请求终端的数字证书的消息，具体的实现方法可以是，接收所述运营商认证服务器发送的数字证书请求消息， 并将所述数字证书请求消息发送给所述终端；接收所述终端发送的所述数字证书，并将所述数字证书发送给所述运营商认证服务器。。
具体来讲，接入服务器把收到的运营商认证服务器发送的数字证书请求消息转发给终端，终端将自己的数字证书返回给接入服务器，接入服务器再将该数字证书封装在RADIUS消息中转发给运营商认证服务器，运营商认证服务器先用本地的根证书验证终端的数字证书，根证书是运营商认证服务器从数字证书管理机构获取到的，验证通过后在用数字证书中的公钥对终端的数字签名进行验证，验证通过后将数字证书上传给用户数据库以绑定用户身份识别信息中的序列号和数字证书。
进一步的，上述方法实施例的步骤402根据所述接入认证请求，获取所述终端的验证信息，具体的实现方法可以是：向所述终端发送标识请求信息；接收所述终端发送的所述验证信息，所述验证信息包括用户身份识别信息中的所述序列号，所述用户身份识别信息包括密钥和所述序列号。上述方法实施例的步骤403根据所述验证信息向运营商认证服务器请求进行用户身份验证，具体的实现方法可以是：根据所述序列号从所述运营商认证服务器获取认证消息，所述认证消息包括随机字串和鉴权码。在此之后，还包括：向所述终端发送所述认证消息。
具体来讲，接入服务器向终端发送标识请求信息(EAP-Request/Identity)，接收终端发送的用户身份识别信息中的序列号，将该序列号发送给运营商认证服务器以获取认证消息，该认证消息包括运营商认证服务器生成的随机字串和鉴权码，还可以包括用户的签约信息。接入服务器将认证消息发送给终端，终端先用数字证书对应的私钥对用户身份识别信息中的加密后的密钥解密，在生成会话密钥后对鉴权码进行验证。
图5为本发明终端安全认证方法实施例五的流程图，如图5所示，本实施例的方法可以包括：
步骤501、接收接入服务器发送的用户身份验证请求；
本实施例的执行主体可以是运营商认证服务器，用户身份验证请求包括 终端发送的数据包和数字签名，数据包包括用户身份识别信息中的序列号和安全认证字串，安全认证字串包括时间字串和接入服务器随机生成的随机字串，数字签名为终端通过数字证书对应的私钥对数据包进行的签名。运营商认证服务器接收接入服务器发送的RADIUS消息，即身份验证请求。
步骤502、根据所述用户身份验证请求获取所述终端的数字证书；
本实施例中，运营商认证服务器根据用户身份识别信息中的序列号向用户数据库请求终端的数字证书，若可以获取到用户数据库返回的数字证书，则表示该终端不是初次验证，反之，如果运营商认证服务器没有从用户数据库获取到数字证书，则表示该终端是初次验证。
步骤503、根据所述数字证书验证所述数字签名，验证通过后与所述接入服务器进行信息交互以完成接入认证。
本实施例中，运营商认证服务器从用户数据库获取到终端的数字证书，并用该证书中的公钥验证终端的数字签名。
本实施例，运营商认证服务器根据终端的数字证书和用户身份识别信息对终端进行接入认证，实现终端标识与用户标识双重认证，以数字证书保证即使用户身份识别信息被复制或更换终端都无法认证通过，使接入认证不再依赖于终端的操作系统的安全能力。
进一步的，上述方法实施例的步骤502根据所述用户身份验证请求获取所述终端的数字证书，具体的实现方法可以是：向用户数据库发送所述序列号；获取与所述序列号绑定的所述数字证书。还可以是：向用户数据库发送所述序列号；接收所述用户数据库发送的数字证书请求消息；将所述数字证书请求消息转发给接入服务器；接收所述接入服务器发送的所述数字证书；根据从数字证书管理机构获取到的根证书验证所述数字证书。
具体来讲，运营商认证服务器从用户数据库库获取终端的数字证书，若是终端的初次接入网认证，则用户数据库中没有需要的数字证书，运营商认证服务器接收用户数据库发送的数字证书请求消息，再向接入服务器发送数字证书请求消息以获取终端的数字证书。若不是终端的初次接入网认证，则 用户数据库中有需要的数字证书，运营商认证服务器可以直接从用户数据库获取到数字证书。运营商认证服务器收到数字证书后，先用本地的根证书验证数字证书，即验证该数字证书是否是其信任的数字证书管理机构颁发的，验证通过后，再用数字证书中的公钥验证终端的数字签名，通过后将数字证书上传给用户数据库以绑定用户身份识别信息中的序列号和数字证书，然后再与接入服务器进行信息交互以完成接入认证，这个过程可以采用EAP-SIM认证流程，此处不做详细描述。
图6为本发明终端安全认证方法实施例六的流程图，如图6所示，本实施例的方法可以包括：
步骤601、接收运营商认证服务器发送的终端的用户身份识别信息中的序列号；
本实施例的执行主体可以是用户数据库，用户身份识别信息包括密钥和所述序列号。
步骤602、判断所述序列号是否已经绑定数字证书；
本实施例中，用户数据库判断用户身份识别信息中的序列号是否已经与数字证书绑定，即查询是否有与序列号关联的数字证书。
步骤603、若是，则向所述运营商认证服务器发送与所述序列号绑定的数字证书。
本实施例中，如果用户数据库找到与序列号绑定的数字证书，则直接将该数字证书发送给运营商认证服务器，以使运营商认证服务器根据该数字证书进行用户身份验证。
本实施例，用户数据库存储终端的数字证书，并保存序列号和数字证书的绑定关系，避免终端重复接入时数字证书的频发收发，提高终端的数字证书的安全性。
进一步的，上述方法实施例的步骤602之后，还包括：若用户数据库没有找到与序列号绑定的数字证书，则向所述运营商认证服务器发送数字证书请求消息；接收所述运营商认证服务器上传的所述序列号和所述数字证书， 并保存所述序列号和所述数字证书的绑定关系。
具体来讲，如果终端是初次接入认证，则用户数据库中还没有该终端的信息记录，因此无法超找到与序列号绑定的数字证书，因此用户数据库向运营商认证服务器发送数字证书请求消息，接收到运营商认证服务器上传的序列号和数字证书，并保存序列号和数字证书的绑定关系。
下面采用两个具体的实施例，对图1～图6中任一个方法实施例的技术方案进行详细说明。
图7为本发明终端安全认证方法实施例七的流程图，如图7所示，本实施例的方法可以包括：
s601、终端获取运营商服务器分发的用户身份识别信息；
本实施例中，所述用户身份识别信息包括序列号和密钥。
s602、终端向接入服务器发送接入认证请求；
s603、接入服务器向终端发送标识请求信息和安全认证字串；
本实施例中，所述安全认证字串包括随机字串，所述安全认证字串还可以进一步包括时间字串。
s604、终端通过终端的数字证书对应的私钥对数据包进行签名，得到数字签名；
本实施例中，所述数据包括所述序列号和所述安全认证字串，所述数字签名可以被携带在所述数据包中。
s605、终端向接入服务器发送所述数据包和所述数字签名；
s606、接入服务器根据所述序列号和所述数字签名向运营商认证服务器请求进行用户身份验证；
s607、运营商认证服务器向用户数据库发送所述序列号；
s608、用户数据库判断该序列号是否已经绑定数字证书，若否，则转去s609，若是，则转去s617；
s609、用户数据库向运营商认证服务器发送数字证书请求消息；
本实施例中，用户数据库还可以向运营商认证服务器发送一些和用户认 证相关的信息，例如认证向量和用户签约信息等。
s610、运营商认证服务器向接入服务器发送数字证书请求消息；
s611、接入服务器将数字证书请求消息发送给终端；
s612、接入服务器接收终端发送的数字证书；
s613、接入服务器将数字证书发送给运营商认证服务器；
s614、运营商认证服务器根据从数字证书管理机构获取到的根证书验证所述数字证书，并且在验证通过后再根据所述数字证书验证数字签名；
s615、若验证通过，则运营商认证服务器将所述序列号和所述数字证书上传给用户数据库；
s616、用户数据库保存所述序列号和所述数字证书的绑定关系，转去s619；
s617、运营商认证服务器根据所述序列号从用户数据库获取与所述序列号绑定的数字证书；
本实施例中，运营商认证服务器还可以根据所述序列号获取所述和用户认证相关的信息；
s618、运营商认证服务器根据数字证书验证数字签名，如果通过验证，则执行s619；
s619、终端、接入服务器以及运营商认证服务器进行接入网认证的信息交互；
s620、终端接收接入服务器发送的接入认证成功信息，并通过接入服务器接入网络并使用网络提供的网络服务。
本实施例的各步骤的详细过程和原理在上述方法实施例中均有说明，此处不再赘述。
图8为本发明终端安全认证方法实施例八的流程图，如图8所示，本实施例的方法可以包括：
s701、终端连接到运营商服务器申请软SIM，并接收运营商服务器发送的数字证书请求消息；
s702、终端向运营商服务器发送终端的数字证书；
s703、运营商服务器根据根证书验证数字证书；
s704、运营商服务器验证通过后，向用户数据库发送用于请求用户身份识别信息的请求消息；
本实施例中，所述用于请求用户身份识别信息的请求消息携带数字证书；
s705、用户数据库在收到所述用于请求用户身份识别信息的请求消息后，分配用户身份识别信息，并用数字证书的公钥对用户身份识别信息中的密钥加密，得到经过加密的密钥；
本实施例中，用户数据库还可以将数字证书和用户身份识别信息中的序列号绑定，以便用户数据库保存分发的软SIM和终端的数字证书的绑定关系，从而支持用户重复申请提示、用户丢失软SIM后的重发、被盗终端识别、一号多机管理等。
s706、用户数据库将所述序列号和所述经过加密的密钥发给运营商服务器；
s707、终端接收运营商服务器发送的所述序列号和所述经过加密的密钥；
s708、终端向接入服务器发送接入认证请求；
s709、接入服务器向终端发送标识请求信息；
s710、终端向接入服务器发送所述序列号；
s711、接入服务器将所述序列号转发给运营商认证服务器；
s712、运营商认证服务器根据所述序列号从用户数据库获取和用户认证相关的信息；
本实施例中，和用户认证相关的信息，例如可以是认证向量和用户签约信息等。
s713、运营商认证服务器将认证消息发送给接入服务器；
s714、终端接收接入服务器发送的认证消息；
本实施例中，所述认证消息包括随机字串和鉴权码。
s715、终端通过数字证书对应的私钥对所述经过加密的密钥进行解密，并根据解密后的密钥和随机字串执行预设算法生成会话密钥，用会话密钥校验 消息鉴权码；
s716、终端、接入服务器以及运营商认证服务器进行接入网认证的信息交互；
s717、终端接收接入服务器发送的网络接入认证成功信息，并通过接入服务器接入网络并使用网络提供的网络服务。
本实施例的各步骤的详细过程和原理在上述方法实施例中均有说明，此处不再赘述。
图9为本发明终端实施例一的结构示意图，如图9所示，本实施例的装置可以包括：信息获取模块11、请求发送模块12、认证交互模块13以及接入模块14，其中，信息获取模块11，用于获取运营商服务装置分发的用户身份识别信息，所述用户身份识别信息包括序列号和密钥；请求发送模块12，用于向接入服务装置发送接入认证请求；认证交互模块13，用于根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务装置进行用于实现接入认证的信息交互；接入模块14，用于接收所述接入服务装置发送的接入认证成功信息，并通过所述接入服务装置接入网络并使用所述网络提供的网络服务。
本实施例的装置，可以用于执行图1所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图10为本发明终端实施例二的结构示意图，如图10所示，本实施例的装置在图9所示装置结构的基础上，进一步地，还可以包括：第一数字证书处理模块15。认证交互模块13，具体用于接收所述接入服务装置发送的标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；根据所述标识请求信息，通过所述数字证书对应的私钥对数据包进行签名，得到数字签名，所述数据包包括所述序列号和所述安全认证字串；向所述接入服务装置发送所述数据包和数字签名；第一数字证书处理模块15，用于接收所述接入服务装置发送的数字证书请求消息；向所述接入服务装置发送所述数字证书。
本实施例的装置，可以用于执行图1、图2或图7所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图11为本发明终端实施例三的结构示意图，如图11所示，本实施例的装置在图9所示装置结构的基础上，进一步地，还可以包括：第二数字证书处理模块16，用于接收所述运营商服务装置发送的数字证书请求消息；向所述运营商服务装置发送所述数字证书。信息获取模块11，具体用于接收所述运营商服务装置发送的所述序列号和加密后的所述密钥；认证交互模块13，具体用于接收所述接入服务装置发送的标识请求信息；根据所述标识请求信息向所述接入服务装置发送所述序列号；接收所述接入服务装置发送的认证消息，所述认证消息包括随机字串和鉴权码；通过所述数字证书对应的私钥对所述加密后的所述密钥进行解密，并根据解密后的密钥和所述随机字串执行预设算法生成会话密钥，用所述会话密钥校验所述消息鉴权码。
本实施例的装置，可以用于执行图1、图3或图8所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图12为本发明接入服务装置实施例一的结构示意图，如图12所示，本实施例的装置可以包括：接收模块21、验证信息获取模块22、验证模块23、以及接入模块24，其中，接收模块21，用于接收终端发送的接入认证请求；验证信息获取模块22，用于根据所述接入认证请求，获取所述终端的验证信息；验证模块23，用于根据所述验证信息向运营商认证服务装置请求进行用户身份验证；接入模块24，用于在所述用户身份验证通过后，向所述终端发送接入认证成功信息。
本实施例的装置，可以用于执行图4所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图13为本发明接入服务装置实施例二的结构示意图，如图13所示，本实施例的装置在图12所示装置结构的基础上，进一步地，还可以包括：数字证书转发模块25。验证信息获取模块22，具体向所述终端发送标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；接收所述终 端发送的所述验证信息，所述验证信息包括数据包和所述终端的数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号；验证模块23，具体用于根据所述序列号和所述数字签名向所述运营商认证服务装置请求进行用户身份验证；数字证书转发模块25，用于接收所述运营商认证服务装置发送的数字证书请求消息，并将所述数字证书请求消息发送给所述终端；接收所述终端发送的所述数字证书，并将所述数字证书发送给所述运营商认证服务装置。
本实施例的装置，可以用于执行图4或图7所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图14为本发明接入服务装置实施例三的结构示意图，如图14所示，本实施例的装置在图12所示装置结构的基础上，进一步地，还可以包括：认证反馈模块26。验证信息获取模块22，具体用于向所述终端发送标识请求信息；接收所述终端发送的所述验证信息，所述验证信息包括用户身份识别信息中的所述序列号，所述用户身份识别信息包括密钥和所述序列号；验证模块23，具体用于根据所述序列号从所述运营商认证服务装置获取认证消息，所述认证消息包括随机字串和鉴权码；认证反馈模块26，用于向所述终端发送所述认证消息。
本实施例的装置，可以用于执行图4或图8所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图15为本发明运营商认证服务装置实施例的结构示意图，如图15所示，本实施例的装置可以包括：接收模块31、证书获取模块32以及验证模块33，其中，接收模块31，用于接收接入服务装置发送的用户身份验证请求，所述用户身份验证请求包括终端发送的数据包和数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号，所述安全认证字串包括时间字串和随机字串，所述数字签名为所述终端通过所述数字证书对应的私钥对所述数据包进行的签名；证书获取模块32，用于根据所述用户身份验证请求获取所述终端的数字证书；验证 模块33，用于根据所述数字证书验证所述数字签名，验证通过后与所述接入服务装置进行信息交互以完成接入认证。
本实施例的装置，可以用于执行图5、图7或图8所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
进一步的，上述证书获取模块32，具体用于向用户数据库发送所述序列号；获取与所述序列号绑定的所述数字证书。
进一步的，上述证书获取模块32，具体用于向用户数据库发送所述序列号；接收所述用户数据库发送的数字证书请求消息；将所述数字证书请求消息转发给接入服务装置；接收所述接入服务装置发送的所述数字证书；根据从数字证书管理机构获取到的根证书验证所述数字证书。
图16为本发明用户数据库实施例的结构示意图，如图16所示，本实施例的装置可以包括：接收模块41、判断模块42以及证书处理模块43，其中，接收模块41，用于接收运营商认证服务装置发送的终端的用户身份识别信息中的序列号，所述用户身份识别信息包括密钥和所述序列号；判断模块42，用于判断所述序列号是否已经绑定数字证书；证书处理模块43，用于若所述判断模块判断所述序列号已经绑定数字证书，则向所述运营商认证服务装置发送与所述序列号绑定的数字证书。
本实施例的装置，可以用于执行图6、图7或图8所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
进一步的，上述证书处理模块43，还用于若所述判断模块判断所述序列号没有经绑定数字证书，则向所述运营商认证服务装置发送数字证书请求消息；接收所述运营商认证服务装置上传的所述序列号和所述数字证书，并保存所述序列号和所述数字证书的绑定关系。
图17为本发明终端实施例四的结构示意图，如图17所示，本实施例的设备可以包括：接口51，存储器52和处理器53。其中，接口51，存储器52和处理器53之间通过总线连接。
接口51可以为以下一种或多种：提供有线接口的网络接口控制器(英文： network interface controller，缩写：NIC)，例如以太网NIC；提供无线接口的NIC，例如无线局域网(英文：wireless local area network，缩写：WLAN)NIC。
存储器52，存储程序代码，并将存储的程序代码传输给处理器53。
存储器52，可以是易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；或者非易失性存储器(英文：non-volatile memory)，例如快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)；或者上述种类的存储器的组合。
处理器53，获得存储器52中存储的程序代码，并按照获得的程序代码执行图1～图3、图7～图8中任一方法实施例的技术方案。
处理器53可以是中央处理器(英文：central processing unit，缩写：CPU)，或者是CPU和硬件芯片的组合。上述硬件芯片可以是专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)，可编程逻辑器件(英文：programmable logic device，缩写：PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic，缩写：GAL)或其组合。
进一步的，接入服务器、运营商认证服务器以及用户数据库都可以采用图17上述的硬件结构，区别在于存储器52中存储的程序代码不同。另外，接入服务器的处理器53获得存储器52中存储的程序代码，并按照获得的程序代码执行图4、图7～图8中任一方法实施例的技术方案；运营商认证服务器的处理器53获得存储器52中存储的程序代码，并按照获得的程序代码执行图5、图7～图8中任一方法实施例的技术方案；用户数据库的处理器53获得存储器52中存储的程序代码，并按照获得的程序代码执行图6～图8中任一方法实施例的技术方案。
图18为本发明终端安全认证系统实施例的结构示意图，如图18所示，本实施例的系统包括：终端61、接入服务器62、运营商认证服务器63、用户 数据库64以及运营商服务器65，均可以采用图17所示的硬件结构。终端61可以执行图1～图3、图7～图8中任一方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述；接入服务器62可以执行图4、图7～图8中任一方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述；运营商认证服务器63可以执行图5、图7～图8中任一方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述；用户数据库64可以执行图6～图8中任一方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述；运营商服务器65，用于向所述终端分发所述用户身份识别信息。本实施例的系统可以作为图7或图8所示的方法实施例的应用场景。
可选的，终端61可以是PC、手机、平板电脑、机顶盒等。终端61接入网络可以通过固网或移动网络，因此在终端61和接入服务器62之间还可以设置住宅网关(Residential Gateway，简称RG)、接入点(Access Point，简称AP)、数字用户线路接入复用器(Digital Subscriber Line Access Multiplexer，简称DSLAM)、光线路终端(Optical Line Terminal，简称OLT)等设备。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (31)

  1. 一种终端安全认证方法，其特征在于，包括：
    获取运营商服务器分发的用户身份识别信息，所述用户身份识别信息包括序列号和密钥；
    向接入服务器发送接入认证请求；
    根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互；
    接收所述接入服务器发送的接入认证成功信息，并通过所述接入服务器接入网络并使用所述网络提供的网络服务。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互，包括：
    接收所述接入服务器发送的标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；
    根据所述标识请求信息，通过所述数字证书对应的私钥对数据包进行签名，得到数字签名，所述数据包包括所述序列号和所述安全认证字串；
    向所述接入服务器发送所述数据包和数字签名。
  3. 根据权利要求2所述的方法，其特征在于，所述向所述接入服务器发送所述数据包和数字签名之后，还包括：
    接收所述接入服务器发送的数字证书请求消息；
    向所述接入服务器发送所述数字证书。
  4. 根据权利要求1所述的方法，其特征在于，所述获取运营商服务器分发的用户身份识别信息之前，还包括：
    接收所述运营商服务器发送的数字证书请求消息；
    向所述运营商服务器发送所述数字证书；
    所述获取运营商服务器分发的用户身份识别信息，包括：
    接收所述运营商服务器发送的所述序列号和加密后的所述密钥。
  5. 根据权利要求4所述的方法，其特征在于，所述根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务器进行用于实现接入认证的信息交互，包括：：
    接收所述接入服务器发送的标识请求信息；
    根据所述标识请求信息向所述接入服务器发送所述序列号；
    接收所述接入服务器发送的认证消息，所述认证消息包括随机字串和鉴权码；
    通过所述数字证书对应的私钥对所述加密后的所述密钥进行解密，并根据解密后的密钥和所述随机字串执行预设算法生成会话密钥，用所述会话密钥校验所述消息鉴权码。
  6. 一种终端安全认证方法，其特征在于，包括：
    接收终端发送的接入认证请求；
    根据所述接入认证请求，获取所述终端的验证信息；
    根据所述验证信息向运营商认证服务器请求进行用户身份验证；
    在所述用户身份验证通过后，向所述终端发送接入认证成功信息。
  7. 根据权利要求6所述的方法，其特征在于，所述根据所述接入认证请求，获取所述终端的验证信息，包括：
    向所述终端发送标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；
    接收所述终端发送的所述验证信息，所述验证信息包括数据包和所述终端的数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号；
    所述根据所述验证信息向运营商认证服务器请求进行用户身份验证，包括：
    根据所述序列号和所述数字签名向所述运营商认证服务器请求进行用户身份验证。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述序列号和所述数字签名向所述运营商认证服务器请求进行用户身份验证之后，还包括：
    接收所述运营商认证服务器发送的数字证书请求消息，并将所述数字证书请求消息发送给所述终端；
    接收所述终端发送的所述数字证书，并将所述数字证书发送给所述运营商认证服务器。
  9. 根据权利要求6所述的方法，其特征在于，所述根据所述接入认证请求，获取所述终端的验证信息，包括：
    向所述终端发送标识请求信息；
    接收所述终端发送的所述验证信息，所述验证信息包括用户身份识别信息中的所述序列号，所述用户身份识别信息包括密钥和所述序列号；
    所述根据所述验证信息向运营商认证服务器请求用户身份验证，包括：
    根据所述序列号从所述运营商认证服务器获取认证消息，所述认证消息包括随机字串和鉴权码。
  10. 根据权利要求9所述的方法，其特征在于，所述根据所述序列号从所述运营商认证服务器获取认证消息之后，还包括：
    向所述终端发送所述认证消息。
  11. 一种终端安全认证方法，其特征在于，包括：
    接收接入服务器发送的用户身份验证请求，所述用户身份验证请求包括终端发送的数据包和数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号，所述安全认证字串包括时间字串和随机字串，所述数字签名为所述终端通过所述数字证书对应的私钥对所述数据包进行的签名；
    根据所述用户身份验证请求获取所述终端的数字证书；
    根据所述数字证书验证所述数字签名，验证通过后与所述接入服务器进行信息交互以完成接入认证。
  12. 根据权利要求11所述的方法，其特征在于，所述根据所述身份验证 请求获取所述终端的数字证书，包括：
    向用户数据库发送所述序列号；
    获取与所述序列号绑定的所述数字证书。
  13. 根据权利要求11所述的方法，其特征在于，所述根据所述身份验证请求获取所述终端的数字证书，包括：
    向用户数据库发送所述序列号；
    接收所述用户数据库发送的数字证书请求消息；
    将所述数字证书请求消息转发给接入服务器；
    接收所述接入服务器发送的所述数字证书；
    根据从数字证书管理机构获取到的根证书验证所述数字证书。
  14. 一种终端安全认证方法，其特征在于，包括：
    接收运营商认证服务器发送的终端的用户身份识别信息中的序列号，所述用户身份识别信息包括密钥和所述序列号；
    判断所述序列号是否已经绑定数字证书；
    若是，则向所述运营商认证服务器发送与所述序列号绑定的数字证书。
  15. 根据权利要求14所述的方法，其特征在于，所述判断所述序列号是否已经绑定数字证书之后，还包括：
    若否，则向所述运营商认证服务器发送数字证书请求消息；
    接收所述运营商认证服务器上传的所述序列号和所述数字证书，并保存所述序列号和所述数字证书的绑定关系。
  16. 一种终端，其特征在于，包括：
    信息获取模块，用于获取运营商服务装置分发的用户身份识别信息，所述用户身份识别信息包括序列号和密钥；
    请求发送模块，用于向接入服务装置发送接入认证请求；
    认证交互模块，用于根据所述终端的数字证书和所述用户身份识别信息，与所述接入服务装置进行用于实现接入认证的信息交互；
    接入模块，用于接收所述接入服务装置发送的接入认证成功信息，并通 过所述接入服务装置接入网络并使用所述网络提供的网络服务。
  17. 根据权利要求16所述的终端，其特征在于，所述认证交互模块，具体用于接收所述接入服务装置发送的标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；根据所述标识请求信息，通过所述数字证书对应的私钥对数据包进行签名，得到数字签名，所述数据包包括所述序列号和所述安全认证字串；向所述接入服务装置发送所述数据包和数字签名。
  18. 根据权利要求17所述的终端，其特征在于，还包括：
    第一数字证书处理模块，用于接收所述接入服务装置发送的数字证书请求消息；向所述接入服务装置发送所述数字证书。
  19. 根据权利要求16所述的终端，其特征在于，还包括：
    第二数字证书处理模块，用于接收所述运营商服务装置发送的数字证书请求消息；向所述运营商服务装置发送所述数字证书；
    所述信息获取模块，具体用于接收所述运营商服务装置发送的所述序列号和加密后的所述密钥。
  20. 根据权利要求19所述的终端，其特征在于，所述认证交互模块，具体用于接收所述接入服务装置发送的标识请求信息；根据所述标识请求信息向所述接入服务装置发送所述序列号；接收所述接入服务装置发送的认证消息，所述认证消息包括随机字串和鉴权码；通过所述数字证书对应的私钥对所述加密后的所述密钥进行解密，并根据解密后的密钥和所述随机字串执行预设算法生成会话密钥，用所述会话密钥校验所述消息鉴权码。
  21. 一种接入服务装置，其特征在于，包括：
    接收模块，用于接收终端发送的接入认证请求；
    验证信息获取模块，用于根据所述接入认证请求，获取所述终端的验证信息；
    验证模块，用于根据所述验证信息向运营商认证服务装置请求进行用户身份验证；
    接入模块，用于在所述用户身份验证通过后，向所述终端发送接入认证成功信息。
  22. 根据权利要求21所述的装置，其特征在于，所述验证信息获取模块，具体用于向所述终端发送标识请求信息和安全认证字串，所述安全认证字串包括时间字串和随机字串；接收所述终端发送的所述验证信息，所述验证信息包括数据包和所述终端的数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号；
    所述验证模块，具体用于根据所述序列号和所述数字签名向所述运营商认证服务装置请求进行用户身份验证。
  23. 根据权利要求22所述的装置，其特征在于，还包括：
    数字证书转发模块，用于接收所述运营商认证服务装置发送的数字证书请求消息，并将所述数字证书请求消息发送给所述终端；接收所述终端发送的所述数字证书，并将所述数字证书发送给所述运营商认证服务装置。
  24. 根据权利要求21所述的装置，其特征在于，所述验证信息获取模块，具体用于向所述终端发送标识请求信息；接收所述终端发送的所述验证信息，所述验证信息包括用户身份识别信息中的所述序列号，所述用户身份识别信息包括密钥和所述序列号；
    所述验证模块，具体用于根据所述序列号从所述运营商认证服务装置获取认证消息，所述认证消息包括随机字串和鉴权码。
  25. 根据权利要求24所述的装置，其特征在于，还包括：
    认证反馈模块，用于向所述终端发送所述认证消息。
  26. 一种运营商认证服务装置，其特征在于，包括：
    接收模块，用于接收接入服务装置发送的用户身份验证请求，所述用户身份验证请求包括终端发送的数据包和数字签名，所述数据包包括用户身份识别信息中的序列号和安全认证字串，所述用户身份识别信息包括密钥和所述序列号，所述安全认证字串包括时间字串和随机字串，所述数字签名为所述终端通过所述数字证书对应的私钥对所述数据包进行的签名；
    证书获取模块，用于根据所述用户身份验证请求获取所述终端的数字证书；
    验证模块，用于根据所述数字证书验证所述数字签名，验证通过后与所述接入服务装置进行信息交互以完成接入认证。
  27. 根据权利要求26所述的装置，其特征在于，所述证书获取模块，具体用于向用户数据库发送所述序列号；获取与所述序列号绑定的所述数字证书。
  28. 根据权利要求26所述的装置，其特征在于，所述证书获取模块，具体用于向用户数据库发送所述序列号；接收所述用户数据库发送的数字证书请求消息；将所述数字证书请求消息转发给接入服务装置；接收所述接入服务装置发送的所述数字证书；根据从数字证书管理机构获取到的根证书验证所述数字证书。
  29. 一种用户数据库，其特征在于，包括：
    接收模块，用于接收运营商认证服务装置发送的终端的用户身份识别信息中的序列号，所述用户身份识别信息包括密钥和所述序列号；
    判断模块，用于判断所述序列号是否已经绑定数字证书；
    证书处理模块，用于若所述判断模块判断所述序列号已经绑定数字证书，则向所述运营商认证服务装置发送与所述序列号绑定的数字证书。
  30. 根据权利要求29所述的装置，其特征在于，所述证书处理模块，还用于若所述判断模块判断所述序列号没有经绑定数字证书，则向所述运营商认证服务装置发送数字证书请求消息；接收所述运营商认证服务装置上传的所述序列号和所述数字证书，并保存所述序列号和所述数字证书的绑定关系。
  31. 一种终端安全认证系统，其特征在于，包括：终端、接入服务装置、运营商认证服务装置、用户数据库以及运营商服务装置，其中，所述终端采用权利要求16～20中任一项所述的终端，所述接入服务装置采用权利要求21～25中任一项所述的装置，所述运营商认证服务装置采用权利要求26～28中任一项所述的装置；所述用户数据库采用权利要求29或30所述的装置；
    所述运营商服务装置，用于向所述终端分发所述用户身份识别信息。
PCT/CN2015/075986 2014-04-28 2015-04-07 终端安全认证方法、装置及系统 WO2015165325A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410175826.1A CN105101194B (zh) 2014-04-28 2014-04-28 终端安全认证方法、装置及系统
CN201410175826.1 2014-04-28

Publications (1)

Publication Number Publication Date
WO2015165325A1 true WO2015165325A1 (zh) 2015-11-05

Family

ID=54358150

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/075986 WO2015165325A1 (zh) 2014-04-28 2015-04-07 终端安全认证方法、装置及系统

Country Status (2)

Country Link
CN (1) CN105101194B (zh)
WO (1) WO2015165325A1 (zh)

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106740205A (zh) * 2016-12-23 2017-05-31 苏州精控能源科技有限公司 电动汽车的动力电池组安全数据采集终端及数据传输方法
CN110995516A (zh) * 2019-12-30 2020-04-10 国网北京市电力公司 数据传输网络的构建方法、装置、存储介质和处理器
CN111901780A (zh) * 2016-01-20 2020-11-06 Oppo广东移动通信有限公司 车联网系统中用于数据传输的方法、终端设备及存储介质
CN112134831A (zh) * 2019-06-25 2020-12-25 中兴通讯股份有限公司 接入请求的发送、处理方法及装置
CN112654039A (zh) * 2019-09-25 2021-04-13 北京紫光青藤微系统有限公司 一种终端的合法性鉴别方法、装置及系统
CN113190813A (zh) * 2021-05-25 2021-07-30 数字广东网络建设有限公司 双认证处理方法、装置、设备及介质
CN113542094A (zh) * 2021-06-07 2021-10-22 新华三信息安全技术有限公司 访问权限的控制方法及装置
CN113727297A (zh) * 2020-05-11 2021-11-30 上汽通用汽车有限公司 一种车联安全接入方法和系统
CN113852681A (zh) * 2021-09-22 2021-12-28 深信服科技股份有限公司 一种网关认证方法、装置及安全网关设备
CN114095546A (zh) * 2021-10-27 2022-02-25 许昌许继软件技术有限公司 一种基于mqtt协议的报文监视方法及装置
CN114599033A (zh) * 2022-05-10 2022-06-07 中移(上海)信息通信科技有限公司 一种通信鉴权处理方法及装置
CN115412362A (zh) * 2022-09-06 2022-11-29 中国联合网络通信集团有限公司 基于碳排放的数据采集方法、服务器和终端
CN115835194A (zh) * 2023-02-15 2023-03-21 信联科技(南京)有限公司 一种nb-iot物联网终端安全接入系统及接入方法
WO2023071751A1 (zh) * 2021-10-29 2023-05-04 华为技术有限公司 一种认证方法和通信装置
CN117278334A (zh) * 2023-11-22 2023-12-22 深圳市脉山龙信息技术股份有限公司 一种物联网智能运维管理方法及系统

Families Citing this family (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105657705A (zh) * 2016-04-11 2016-06-08 东信和平科技股份有限公司 一种基于国密公钥证书实现虚拟sim卡的方法及系统
CN107645381B (zh) * 2016-07-21 2021-07-13 阿里巴巴集团控股有限公司 安全验证实现方法及装置
CN106453269B (zh) * 2016-09-21 2021-06-25 东软集团股份有限公司 车联网安全通信方法、车载终端、服务器及系统
CN106656953A (zh) * 2016-09-23 2017-05-10 焦点科技股份有限公司 一种基于互联网的系统间安全调用接口实现方法
CN106793005B (zh) * 2016-11-14 2020-05-12 深圳市唯传科技有限公司 基于LoRa的物联网设备的漫游通信方法及系统
CN106878020A (zh) * 2017-01-24 2017-06-20 广州弘度信息科技有限公司 网络系统、网络设备的认证方法和装置
CN107302535A (zh) * 2017-06-28 2017-10-27 深圳市欧乐在线技术发展有限公司 一种接入鉴权方法及装置
CN109428875B (zh) * 2017-08-31 2024-03-12 华为技术有限公司 基于服务化架构的发现方法及装置
CN109428874B (zh) * 2017-08-31 2020-10-09 华为技术有限公司 基于服务化架构的注册方法及装置
CN109992949B (zh) * 2017-12-29 2021-04-16 中移（杭州）信息技术有限公司 一种设备认证方法、空中写卡方法及设备认证装置
CN108512862B (zh) * 2018-05-30 2023-12-05 博潮科技（北京）有限公司 基于无证书标识认证技术的物联网终端安全认证管控平台
CN109361697B (zh) * 2018-11-29 2020-12-25 深圳市安信认证系统有限公司 基于sim卡加载pki实现可信身份认证的方法
WO2021031054A1 (zh) * 2019-08-18 2021-02-25 华为技术有限公司 通信方法及装置
CN112787979A (zh) * 2019-11-07 2021-05-11 北京地平线机器人技术研发有限公司 物联网设备访问控制方法及物联网设备访问控制装置
CN111212422B (zh) * 2020-01-10 2022-08-26 中国联合网络通信集团有限公司 认证方法、微基站和终端
CN111612443B (zh) * 2020-04-30 2024-04-16 沈阳数云科技有限公司 一种公积金业务办理方法、系统、设备及可读存储介质
CN111787540B (zh) * 2020-06-29 2023-07-07 百度在线网络技术（北京）有限公司 接入物联网的方法、装置、电子设备及可读存储介质
CN111935213B (zh) * 2020-06-29 2023-07-04 杭州创谐信息技术股份有限公司 一种基于分布式的可信认证虚拟组网系统及方法
CN111885600B (zh) * 2020-09-02 2023-04-07 中国联合网络通信集团有限公司 双卡终端的接入方法、终端及服务器
CN114679293A (zh) * 2021-06-15 2022-06-28 腾讯云计算（北京）有限责任公司 基于零信任安全的访问控制方法、设备及存储介质
CN115567920A (zh) * 2021-06-30 2023-01-03 华为技术有限公司 认证的方法和装置
CN113543123B (zh) * 2021-07-23 2024-02-20 闻泰通讯股份有限公司 无线网路动态设定权限方法与装置
CN113630405B (zh) * 2021-07-30 2023-05-02 北京达佳互联信息技术有限公司 入网认证方法、装置、电子设备及存储介质
CN113726796B (zh) * 2021-08-31 2023-10-27 深圳平安智慧医健科技有限公司 基于医疗物联网的数据交互方法、装置、设备及介质
CN113778759B (zh) * 2021-11-05 2022-03-25 北京泰策科技有限公司 一种数据分发过程中的失败检测及恢复方法
CN114040401B (zh) * 2021-11-08 2024-04-12 中国联合网络通信集团有限公司 终端认证方法及系统
CN114900342B (zh) * 2022-04-25 2024-04-12 矩阵时光数字科技有限公司 一种基于密钥分发系统的分发机认证方法
CN114786179B (zh) * 2022-05-25 2024-02-06 中国电信股份有限公司 非蜂窝终端鉴权方法、装置、设备及介质
CN114900874B (zh) * 2022-06-10 2023-08-29 中国联合网络通信集团有限公司 网络接入设备、方法和系统
CN115314226A (zh) * 2022-09-13 2022-11-08 深圳市丛文安全电子有限公司 一种基于证书队列的低成本非对称加密证书管理方法
CN115473655B (zh) * 2022-11-07 2023-01-10 南京易科腾信息技术有限公司 接入网络的终端认证方法、装置及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101330420A (zh) * 2008-07-24 2008-12-24 中兴通讯股份有限公司 鉴权方法及装置、移动终端
CN101610241A (zh) * 2008-06-16 2009-12-23 华为技术有限公司 一种绑定认证的方法、系统和装置
CN102404112A (zh) * 2010-09-08 2012-04-04 清大安科（北京）科技有限公司 一种可信终端接入认证方法
WO2013055255A1 (ru) * 2011-10-12 2013-04-18 Нейрон.Ком.Лимитед Способ и система предоставления услуг абонентам мобильной связи
CN103415017A (zh) * 2013-08-23 2013-11-27 深圳市中兴物联科技有限公司 虚拟sim卡的方法、装置及移动终端

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101610241A (zh) * 2008-06-16 2009-12-23 华为技术有限公司 一种绑定认证的方法、系统和装置
CN101330420A (zh) * 2008-07-24 2008-12-24 中兴通讯股份有限公司 鉴权方法及装置、移动终端
CN102404112A (zh) * 2010-09-08 2012-04-04 清大安科（北京）科技有限公司 一种可信终端接入认证方法
WO2013055255A1 (ru) * 2011-10-12 2013-04-18 Нейрон.Ком.Лимитед Способ и система предоставления услуг абонентам мобильной связи
CN103415017A (zh) * 2013-08-23 2013-11-27 深圳市中兴物联科技有限公司 虚拟sim卡的方法、装置及移动终端

Cited By (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111901780B (zh) * 2016-01-20 2023-01-17 Oppo广东移动通信有限公司 车联网系统中用于数据传输的方法、终端设备及存储介质
CN111901780A (zh) * 2016-01-20 2020-11-06 Oppo广东移动通信有限公司 车联网系统中用于数据传输的方法、终端设备及存储介质
CN106740205A (zh) * 2016-12-23 2017-05-31 苏州精控能源科技有限公司 电动汽车的动力电池组安全数据采集终端及数据传输方法
CN106740205B (zh) * 2016-12-23 2024-04-09 苏州精控能源科技股份有限公司 电动汽车的动力电池组安全数据采集终端及数据传输方法
CN112134831A (zh) * 2019-06-25 2020-12-25 中兴通讯股份有限公司 接入请求的发送、处理方法及装置
CN112134831B (zh) * 2019-06-25 2023-02-21 中兴通讯股份有限公司 接入请求的发送、处理方法及装置
CN112654039A (zh) * 2019-09-25 2021-04-13 北京紫光青藤微系统有限公司 一种终端的合法性鉴别方法、装置及系统
CN112654039B (zh) * 2019-09-25 2024-03-01 紫光同芯微电子有限公司 一种终端的合法性鉴别方法、装置及系统
CN110995516A (zh) * 2019-12-30 2020-04-10 国网北京市电力公司 数据传输网络的构建方法、装置、存储介质和处理器
CN113727297A (zh) * 2020-05-11 2021-11-30 上汽通用汽车有限公司 一种车联安全接入方法和系统
CN113190813A (zh) * 2021-05-25 2021-07-30 数字广东网络建设有限公司 双认证处理方法、装置、设备及介质
CN113542094A (zh) * 2021-06-07 2021-10-22 新华三信息安全技术有限公司 访问权限的控制方法及装置
CN113852681A (zh) * 2021-09-22 2021-12-28 深信服科技股份有限公司 一种网关认证方法、装置及安全网关设备
CN114095546B (zh) * 2021-10-27 2024-03-01 许昌许继软件技术有限公司 一种基于mqtt协议的报文监视方法及装置
CN114095546A (zh) * 2021-10-27 2022-02-25 许昌许继软件技术有限公司 一种基于mqtt协议的报文监视方法及装置
WO2023071751A1 (zh) * 2021-10-29 2023-05-04 华为技术有限公司 一种认证方法和通信装置
CN114599033A (zh) * 2022-05-10 2022-06-07 中移(上海)信息通信科技有限公司 一种通信鉴权处理方法及装置
CN114599033B (zh) * 2022-05-10 2022-08-16 中移(上海)信息通信科技有限公司 一种通信鉴权处理方法及装置
CN115412362A (zh) * 2022-09-06 2022-11-29 中国联合网络通信集团有限公司 基于碳排放的数据采集方法、服务器和终端
CN115412362B (zh) * 2022-09-06 2024-05-14 中国联合网络通信集团有限公司 基于碳排放的数据采集方法、服务器和终端
CN115835194A (zh) * 2023-02-15 2023-03-21 信联科技(南京)有限公司 一种nb-iot物联网终端安全接入系统及接入方法
CN117278334A (zh) * 2023-11-22 2023-12-22 深圳市脉山龙信息技术股份有限公司 一种物联网智能运维管理方法及系统
CN117278334B (zh) * 2023-11-22 2024-03-15 深圳市脉山龙信息技术股份有限公司 一种物联网智能运维管理方法及系统

Also Published As

Publication number Publication date
CN105101194A (zh) 2015-11-25
CN105101194B (zh) 2019-07-09

Similar Documents

Publication Publication Date Title
WO2015165325A1 (zh) 终端安全认证方法、装置及系统
US11849048B2 (en) Mutually authenticated ECDHE key exchange for a device and a network using multiple PKI key pairs
US11777719B2 (en) Public key exchange with authenicated ECDHE and security against quantum computers
KR102013091B1 (ko) 보안 통신 채널을 설정하기 위한 방법들 및 장치
KR102134059B1 (ko) 보조 디바이스를 사용한 서비스 승인
CN110770695A (zh) 物联网(iot)设备管理
JP2019537871A (ja) デバイスプロビジョニングプロトコル（ｄｐｐ）のためのコンフィギュレータ鍵パッケージ
EP3425842B1 (en) Communication system and communication method for certificate generation
CN112187709B (zh) 鉴权方法、设备及服务器
JP6096785B2 (ja) 第１のエンティティから第２のエンティティにセキュリティモジュールの制御を移行する方法
JP2010532107A (ja) ソフトｓｉｍクレデンシャルのセキュア転送
EP2879421A1 (en) Terminal identity verification and service authentication method, system, and terminal
KR20200028786A (ko) Ssp 단말과 서버가 디지털 인증서를 협의하는 방법 및 장치
CN109361681B (zh) 国密证书认证方法、装置及设备
WO2018129753A1 (zh) 一种签约信息集的下载方法、装置以及相关设备
WO2018099407A1 (zh) 账户认证登录方法及装置
WO2018018419A1 (zh) 一种配置文件批量获取、下载方法、服务器及终端
WO2023240587A1 (zh) 一种设备权限配置方法及装置、终端设备
US20240187262A1 (en) Encrypted and authenticated firmware provisioning with root-of-trust based security
JP7312279B2 (ja) モバイルネットワークアクセスシステム、方法、記憶媒体及び電子機器
WO2013067792A1 (zh) 智能卡的访问方法、装置及系统
US20240031805A1 (en) Download of a subscription profile to a communication device
US20220256349A1 (en) Provision of Application Level Identity
CN114006696A (zh) 通信方法、装置、系统及计算机可读存储介质
WO2023237187A1 (en) Provisioning of a subscription profile to a subscriber module

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15785892

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15785892

Country of ref document: EP

Kind code of ref document: A1