WO2016015510A1

WO2016015510A1 - Method and device for terminal authentication for use in mobile communication system

Info

Publication number: WO2016015510A1
Application number: PCT/CN2015/079305
Authority: WO
Inventors: 周明宇
Original assignee: 北京佰才邦技术有限公司
Priority date: 2014-07-28
Filing date: 2015-05-19
Publication date: 2016-02-04
Also published as: CN104469766A

Abstract

Disclosed are a method and device for terminal authentication for use in a mobile communication system. The method for terminal authentication for use in the mobile communication system comprises: a terminal acquires first credential information inputted by a user, where the first credential information is information successfully verified by target software; the terminal determines first authentication information on the basis of the first credential information; the terminal transmits the first authentication information to an authentication terminal, where the authentication terminal is used for authenticating the terminal on the basis of the first authentication information; and, when the terminal is successfully authenticated by the authentication terminal on the basis of the first authentication information, the terminal accesses a mobile communication network. By means of the present invention, solved is the problem in the related art in which a SIM card restricts development of thin and lightweight terminals.

Description

Terminal authentication method and device for use in mobile communication system

Technical field

The present invention relates to the field of communications, and in particular to a terminal authentication method and apparatus for use in a mobile communication system.

Background technique

At present, in the related art, in order to obtain mobile communication services, users often need to apply for a Subscriber Identity Module (SIM) card to a mobile communication service provider (such as China Mobile, China Unicom, China Telecom, etc.). Then, the communication service corresponding to the SIM card is paid, so that the mobile communication service (such as making a call, sending a text message, accessing the Internet, etc.) can be obtained by inserting the SIM card into the terminal. The mobile communication service provider charges according to the usage or resource occupation of the mobile communication by the user. Wherein, the SIM card information can be used to authenticate the terminal to the mobile communication network.

With the development of mobile broadband services and the emergence of more and more intelligent terminals (such as smart phones), users can more fully enjoy the intelligent services brought by mobile broadband services.

For example, smartphones are currently moving in a lighter and thinner direction. In the related art, the SIM card-based mobile communication requires a SIM card slot to be preset on the mobile phone, which restricts the development of the thin and light of the smart phone.

In order to alleviate the restriction of the SIM card on the thin and light development of the smart phone, in the related art, a micro SIM card and a Nano SIM card having a size smaller than that of the conventional SIM card are provided. However, the above solution cannot fundamentally solve the problem.

In view of the problem that the SIM card in the related art restricts the development of the thin and light of the terminal, an effective solution has not been proposed yet.

Summary of the invention

A main object of the present invention is to provide a terminal authentication method and apparatus for use in a mobile communication system to solve the problem that the SIM card in the related art restricts the development of the terminal.

In order to achieve the above object, according to an aspect of the present invention, a terminal authentication method for use in a mobile communication system is provided. The method includes: the terminal acquiring the first credential information input by the user, where the first credential information is information verified by the target software; the terminal determines the first credential information according to the first credential information; An authentication information is sent to the authentication end, where the authentication end is used to authenticate the terminal according to the first authentication information; and after the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network.

In order to achieve the above object, according to another aspect of the present invention, another terminal authentication apparatus for use in a mobile communication system is provided. The device includes: a first obtaining unit, configured to enable the terminal to acquire first credential information input by the user, where the first credential information is information verified by the target software; and the first determining unit is configured to enable the terminal to use the first credential information according to the first credential information Determining the first authentication information, the first sending unit, configured to: send the first authentication information to the authentication end, where the authentication end is used to authenticate the terminal according to the first authentication information; and the access unit is configured to enable After the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network.

In order to achieve the above object, according to still another aspect of the present invention, a storage medium for storing the program code executed by the terminal authentication method for use in a mobile communication system is also provided.

The first credential information input by the user is obtained by the terminal, wherein the first credential information is information verified by the target software; the terminal determines the first authentication information according to the first credential information; and the terminal sends the first credential information to the authentication. End, wherein the authentication end is used to authenticate the terminal according to the first authentication information; and after the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network, and the SIM card is restricted in the related technology. The problem of thin and light development has reached the effect of facilitating the development of thin and light terminals.

DRAWINGS

The accompanying drawings, which are incorporated in the claims In the drawing:

1 is a flowchart of a terminal authentication method for use in a mobile communication system according to an embodiment of the present invention;

2 is a schematic diagram of a terminal authentication system for use in a mobile communication system according to an embodiment of the present invention;

3 is a schematic diagram of an interface for setting a terminal function according to an embodiment of the present invention;

4 is a schematic diagram of an authentication information generating process according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of another authentication information generating process according to an embodiment of the present invention; FIG.

6 is a schematic diagram of authenticating a terminal according to an embodiment of the present invention;

7 is a flow chart of another method for terminal authentication in a mobile communication system according to an embodiment of the present invention;

8 is a schematic diagram of an authentication process of a terminal by a mobile communication server according to an embodiment of the present invention;

9 is a schematic diagram of an authentication process of a terminal by a third-party software server according to an embodiment of the present invention;

FIG. 10 is a schematic diagram of a terminal authentication apparatus for use in a mobile communication system according to an embodiment of the present invention;

11 is a schematic diagram of another terminal authentication apparatus for use in a mobile communication system according to an embodiment of the present invention.

detailed description

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The invention will be described in detail below with reference to the drawings in conjunction with the embodiments.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is an embodiment of the invention, but not all of the embodiments. All other embodiments obtained under the premise that no one skilled in the art can make creative work based on the embodiments of the present invention should fall within the protection scope of the present invention.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order. It is to be understood that the data so used may be interchanged where appropriate, so that the embodiments of the invention described herein can be implemented in a sequence other than those illustrated or described herein. Moreover, the terms "comprising" and "having" and "the" are intended

According to an embodiment of the present invention, there is provided a terminal authentication method for use in a mobile communication system, the terminal authentication method for use in a mobile communication system for authenticating a terminal in a mobile communication system according to authentication information of a target software Certification. The terminal authentication method for use in a mobile communication system can operate on a computer processing device.

1 is a flow chart of a method for terminal authentication in a mobile communication system according to an embodiment of the present invention.

As shown in FIG. 1, the method includes the following steps S102 to S108:

Step S102: The terminal acquires first credential information input by the user. The first credential information is information verified by the target software.

Step S104: The terminal determines the first authentication information according to the first credential information.

Step S106: The terminal sends the first authentication information to the authentication end. The authentication end is configured to authenticate the terminal according to the first authentication information.

Step S108: After the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network.

Specifically, when the terminal enters the coverage area of the mobile communication network, the terminal can automatically communicate with the mobile communication network according to the first credential information and authenticate the terminal identity. After the authentication, the authentication end can send the authentication result to the mobile communication network. If the authentication is passed, the terminal can access the mobile communication network and obtain the mobile communication service; if the authentication fails, the terminal cannot access the mobile communication network, and thus cannot obtain the mobile communication service. The mobile communication network may send an authentication information request to the terminal before the terminal sends the first authentication information to the authentication end. After receiving the authentication information request, the terminal sends the first authentication information to the authentication end according to the authentication information request.

It should be noted that whether the terminal enters the coverage area of the mobile communication network can be determined based on the detection of the terminal. For example, the base station periodically transmits a CRS (Common Reference Signal), and the terminal detects the strength of the CRS. For example, the LTE (Long Term Evolution) system calculates the RSRP based on the measurement of the CRS (Reference Signal Received Power). , reference signal received power) or RSRQ (Reference Signal Received Quality), after the strength of the CRS reaches a certain threshold, it is determined that the terminal has entered the mobile network coverage area. For example, a base station deployed by an operator periodically transmits system-related information (such as bandwidth-related, base station antenna number, and other physical layer-related information, and PLMN (Public Land Mobile Network, or public land mobile network). The signal is detected by the terminal, and when the information carried by the signal is accurately detected, it is determined that the terminal has entered the network coverage area of the operator.

The user only needs to input the credential information to the terminal once, and as long as the terminal enters the coverage area of the mobile communication network, the terminal automatically communicates with the mobile communication network according to the first credential information and authenticates the terminal; as a preferred embodiment, the user inputs credential information to the terminal. After that, the credential information will be stored in the terminal for subsequent authentication. In this way, when the terminal enters two mobile network coverage areas that do not overlap each other at different times, it automatically communicates with the mobile communication network according to the credential information and authenticates the terminal, thereby improving the user experience.

It should be noted that, in practice, in order to improve the security, the terminal may also prompt the user to input the credential information according to the preset condition. For example, when the terminal restarts and the flight mode is changed from the open state to the closed state, the user may be prompted to input the credential. information. It should be noted that, here, the user is still not required to re-enter the credential information each time he enters the new network coverage area.

It should be noted that the terminal may include not only a mobile phone or a mobile phone, but also other devices capable of transmitting and receiving wireless signals. For example, the terminal may be a smart home appliance, or may be a device that can spontaneously communicate with the mobile communication network without the operation of a person.

The first authentication information can be used to authenticate the terminal in target software developed by a third party other than the user and the mobile communication service provider. For example, the target software may be "WeChat" software or "QQ" software developed by Tencent, or "Mi Chat" software developed by Xiaomi Company. The user can input the first credential information to the terminal in various manners. For example, the user can input the first credential information by typing on the terminal through a physical keyboard or a virtual keyboard or by scanning.

The mobile communication network and the third-party target software are in different networks, and the two networks control the data transmission through the gateway to ensure the security of the respective information. As shown in FIG. 2, the terminal communicates with a base station in a mobile communication network, and the base station is connected to a third-party network through a gateway in the mobile communication network, wherein the third-party network includes a third-party software server and a third-party gateway.

As a preferred embodiment, the first authentication information may be a username, a password, or a combination of both of the target software. For example, the first credential information may be a WeChat ID (Identity), or a WeChat ID and password, or a Mi Chat ID, or a Mi Chat ID and password. The form of the username and password may include a plurality of types, and is not limited herein. For example, it may be biometric information (such as fingerprint information, retinal information, palm print information, iris information, facial feature information, voice feature information, signature feature information, DNA (Deoxyribonucleic acid) information, etc.); It can be certificate information; it can also be sound, audio, symbols, lines, and the like. It should be noted that the first credential information may be any combination of the foregoing information forms. For example, the user may also input the facial feature information while inputting the fingerprint information, or may input the sound information after inputting the fingerprint information.

It should be noted that the first credential information is used as the information verified by the target software, and the target software can be authenticated and the service is obtained. For example, the user can use the first credential information to use the client software of Tencent QQ on a PC (Personal Computer).

According to the embodiment of the present invention, the biometric information such as the fingerprint, the retina, and the sound is used as the voucher information, so that the user can freely communicate without being bound by the SIM card. And the credential information of the software designed by the third party is used as the authentication basis for the terminal to access the mobile communication network, so that the SIM slot does not need to be set in the terminal, and the SIM card does not need to be inserted, thereby avoiding the development of the traditional large-size SIM card to the terminal. The restrictions brought about is beneficial to the thin and light design of the terminal, and the credential information of the software designed by the third party is used to authenticate the mobile communication network, so that the software designed by the third party can become the entrance of the mobile communication network, which is beneficial to the development of the mobile Internet and Innovation.

As a preferred embodiment, in the embodiment of the present invention, the terminal may include one or more terminals. For example, the terminal may include the first terminal and the second terminal, so that when the user inputs the first terminal and the second terminal respectively, The same credential information, for example, after the second terminal authenticates according to the credential information, if the first terminal also performs authentication according to the same credential information, the first terminal and the second terminal may be authenticated by mode 1 or mode 2. :

method one:

S2. The first terminal acquires first credential information input by the user.

S4. The first terminal determines the first authentication information according to the first credential information.

S6. The first terminal sends the first authentication information to the authentication end.

S8. The authentication end receives the first authentication information sent by the first terminal.

S10. The authentication end authenticates the first terminal according to the first authentication information sent by the first terminal.

S12. The authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal.

S14. If the authentication end determines that the second terminal has successfully authenticated according to the first authentication information sent by the first terminal, the mobile communication network interrupts the connection between the second terminal and the mobile communication network.

S16: After the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal, the first terminal accesses the mobile communication network.

In the first method, after the first terminal passes the authentication of the mobile communication network, the second terminal cannot maintain communication with the mobile communication network. That is, if the second terminal first authenticates successfully in the mobile communication network through a certain credential information, and then the mobile communication network detects that the credential information is used to authenticate the first terminal, after the first terminal successfully authenticates, the mobile communication The network authorizes the first terminal to communicate with the mobile communication network and interrupts communication between the second terminal and the mobile communication network.

As a preferred embodiment, after the second terminal communicates with the mobile communication network, the user information stored on the second terminal may be automatically deleted, or the user information on the second terminal may be remotely deleted on the first terminal. The user information may include at least one of the following information: a short message, a call record, an address book, a photo, a mail, a memo, data stored by the user on the application software, and the like.

As a preferred embodiment, on the basis of the first method, before the connection of the second terminal to the mobile communication network in S14, the following steps may be performed:

S18. The authentication end determines whether the network access priority of the first terminal is higher than the network access priority of the second terminal.

S20. If the authentication end determines that the network access priority of the first terminal is higher than the network access priority of the second terminal, the second terminal interrupts the connection with the mobile communication network.

S22: If the authentication end determines that the network access priority of the first terminal is not higher than the network access priority of the second terminal, the authentication end fails to authenticate the first terminal according to the interruption indication sent by the second terminal.

The priority judgment may be based on: the mobile communication network may send a request response to the first terminal and the second terminal, and authorize the first responding terminal to have a higher priority.

Method 2:

S24. The first terminal acquires first credential information input by the user.

S26. The first terminal determines the first authentication information according to the first credential information.

S28. The first terminal sends the first authentication information to the authentication end.

S30. The authentication end receives the first authentication information sent by the first terminal.

S32. The authentication end authenticates the first terminal according to the first authentication information sent by the first terminal.

S34. The authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal.

S36. If the authentication end determines that the second terminal has successfully authenticated according to the first authentication information sent by the first terminal, the second terminal maintains a connection with the mobile communication network.

S38: After the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal, the first terminal accesses the mobile communication network.

S40. The first terminal acquires a first type of mobile communication service provided by the mobile communication network.

S42. The second terminal acquires a second type of mobile communication service provided by the mobile communication network.

In the second mode, the first terminal and the second terminal can simultaneously maintain communication with the mobile communication network. It should be noted that, in the second mode, the mobile communication network may send a message to the two terminals to prompt that other terminals use the same credential information for authentication.

It should be noted that the first type of mobile communication service and the second type of mobile communication service may be different. The first type of mobile communication service may have more service categories than the second type of mobile communication service. For example, the first type of mobile communication service may include services of a CS (Circuit Switch) domain and a PS (Packet Switch) domain, and the second type of mobile communication service may include only services of the PS domain, or vice versa. The service in the CS domain may be a voice call, so that a plurality of terminals can be answered when someone else pages the voucher information. Or the first terminal can perform voice, video, data transmission and the like communication with the mobile communication network, and the second terminal can perform voice communication with the mobile communication network.

It should be noted that the first terminal has the function of viewing the geographic location of the second terminal, and the second terminal does not have the function of viewing the geographic location of the first terminal. And the first terminal has the function of controlling the security of the second terminal, and the second terminal does not have the function of controlling the security of the first terminal, for example, the function that the first terminal can authorize the second terminal to access the information corresponding to the credential information .

As a preferred embodiment, the user may select a communication function and a communication service for the first terminal and the second terminal on the terminal, and may set on the setting interface of the terminal, or may log in to the application software or webpage of the mobile communication service provider. Make settings. For example, on the second terminal, the user can enable/disable different types of services for the first terminal and the second terminal. As shown in FIG. 3, “√” indicates that the corresponding service is started.

As a preferred embodiment, the mobile communication network may charge for the mobile communication service based on the credential information. When multiple terminals use the same credential information authentication in different time periods, the mobile communication network can charge the same credential according to all mobile communication services used by multiple terminals. For example, the second terminal downloads 100 Mbits of content in the first time period, and the first terminal downloads 200 Mbits of content in the second time period, and the mobile communication network calculates the 300 Mbit traffic of the voucher in the two time periods. fee. In this way, the user experience can be improved.

No need to report loss: If a user's terminal (such as a mobile phone) is lost, there is no need to reissue the SIM card, and the user can continue to obtain the mobile communication service by inputting his own credential information on another terminal.

Intelligent anti-theft: If a user's mobile phone is stolen, the user can enter his or her voucher information on another terminal to view the geographical location of the terminal using the same voucher information, thereby locating the stolen mobile phone and remotely deleting it. Voucher information on the stolen mobile phone to avoid information leakage.

Traffic sharing: Multiple terminals can input the same credential information at the same time, so that the traffic corresponding to the same credential information can be shared.

Security credential: when the first terminal uses a certain credential information to obtain the mobile communication service, if the network detects that the second terminal also uses the same credential information to access the network, it sends a message to the first terminal to remind the user holding the first terminal to pay attention. The security of your own voucher information.

Convenient communication: As long as there is a terminal, it is convenient to use the above credential information to access the mobile communication network and enjoy the mobile communication service. For example, the user may not carry the mobile phone with him or her. When communication is required, the mobile communication network can be accessed by simply pressing a finger on the public communication terminal; wherein the public communication terminal can only support the CS voice call service, so that it does not leak too much. Multiple person information, thereby facilitating the user's shackles from the mobile terminal. For another example, when the first user communicates with the terminal of the second user, the first user can access the mobile communication network through the retina information, and the mobile communication network charges the retina voucher information of the first user, so that the second user There will be no cost issues, which will facilitate terminal sharing.

For another example, the user can carry the small screen terminal with him or her. When the video communication is required, the public large screen terminal can be borrowed, and the mobile communication network can be accessed through the facial recognition information, and the mobile communication network can recognize the face for the traffic on the large screen. The voucher information corresponding to the information is charged, and after ending the large-screen communication, the same facial recognition information is used to authenticate the small-screen terminal, so that the personal information saved on the large-screen terminal is automatically deleted.

The terminal may directly use the credential information input by the user as the authentication information, and may send all or part of the information of the authentication information to the mobile communication network, and the terminal may first process the credential information to obtain the authentication information, and then all or all of the authentication information. Part of the information is sent to the mobile communication network. For example, the terminal can encrypt the voucher information.

Specifically, in the embodiment of the present invention, the terminal may determine the first authentication information according to the first credential information in multiple manners:

example 1

First, the terminal determines the identification data based on the first credential information.

Then, the terminal generates first authentication information based on the identification data.

Specifically, the terminal side may include an identification data generating device, configured to generate corresponding identification data according to the first credential information input by the user, where the identification data is used to generate the authentication information by using the terminal authentication information generating device, such as Figure 4 shows.

Since the format of the credential information of the target software that can be used to authenticate the third-party design is irregular, for example, the credential information may be an email address, a string of digital symbols, etc., and in the communication authentication, the identification data needs to have a fixed format, for example, a conventional The key Ki code stored in the SIM card is a fixed-length code (such as a secondary code of length 64 or 128, and the total length of the International Mobile Subscriber Identification Number (IMSI) is no more than 15 bits. ～9 digits), so by example 1, can be used to put any credential information Convert to formatted identification data. For example, the identification data generating means can convert the voucher information input by the user into the same code as the Ki code format.

In addition, since the user's authentication information needs to be transmitted over the network, it is insecure. In the embodiment of the present invention, since the "identification data generating device" is adopted, the network only needs to transmit the authentication information generated according to the identification data, and cannot obtain the credential information input by the user, such as the biometric information of the user, thereby avoiding the user's biological The disclosure of feature information eliminates the user's concerns.

Optionally, the identification data generating device may generate the identification data immediately according to the current credential information, or may pre-store one or more identification data in the terminal. When the user inputs the credential information, the terminal may search for the corresponding information according to the first credential information. The data is identified, and the found identification data generation authentication information is sent to the mobile communication network. When the credential information input by the user cannot be matched to pre-store one or more identification data, the terminal does not generate the authentication information. The identification data of the plurality of credential information can be stored in the terminal, so that the terminal can flexibly exchange the credential information. For example, a plurality of identification data of a family member may be stored in the terminal, so that it is convenient for the family members to switch to the terminal.

Here, the identification data stored in the terminal may be stored in the terminal by way of user input or download. For example, the user manually inputs the identification data corresponding to the credential information; or after the user inputs the credential information in the environment with the wifi connection, the terminal automatically downloads the corresponding identification data according to the credential information; or the user can pass NFC (Near Field Communication, near Field communication) downloads identification data to the terminal. Specifically, the identification data may be first downloaded to the identification data device, and the terminal reads the identification data from the identification data device through the NFC. It should be noted that the operation can be performed only once.

Optionally, the identification data generating device may be configured to determine according to the credential information input by the user and the preset function, and the different types of credential information correspond to different functions. For example, if the format of the credential information input by the user is an email address, the first function is adopted; if the format of the credential information input by the user is a string of numbers, the second function is adopted; Alternatively, the corresponding function may be set according to the target software corresponding to the credential information. For example, if the credential information is a WeChat ID, it corresponds to the first function, and if the credential information is a Micha ID, it corresponds to the second function. In this way, by controlling different functions corresponding to different types of credential information, the identification data of the same format can be generated for any credential information, and no conflict of the identification data is caused. For example, the identification data corresponding to any WeChat ID does not conflict with the identification data corresponding to any of the Micha IDs, so that the uniqueness of the identity of the credential information can be guaranteed. The different functions described above may be stored in the terminal in advance, or may be downloaded to the terminal immediately.

Example 2

First, the terminal receives an authentication request that is sent by the authentication end and includes a random number.

Wherein, the step can be performed before the foregoing step S102.

Then, the terminal determines the first authentication information according to the first credential information and the random number.

For the security of the network transmission, the authentication information request sent by the mobile communication network to the terminal may include a random number, and the terminal may determine the authentication information according to the random number and the first credential information input by the user, using the first authentication function, and The authentication information is transmitted to the mobile communication network, and as shown in FIG. 5, the first authentication function is implemented in the terminal authentication information generating device. The mobile communication network side has the information of the random number and the first authentication function, and after receiving the authentication information of the terminal, the terminal can be authenticated accordingly. In this way, since the random number is only used for the current authentication, even if the authentication information sent by the terminal is intercepted by others, since the interceptor does not know the random number, the credential information input by the user cannot be obtained in reverse, and the user credential information is guaranteed. Security.

As a preferred embodiment, in the embodiment of the present invention, in addition to authenticating the user terminal by using one of the foregoing credential information (ie, the first credential information), another credential information (such as the second credential may be passed). The information is combined with the first credential information to authenticate the user terminal. For example, prior to performing authentication according to the first credential information, preliminary authentication may be performed through the second credential information. Specifically, before the foregoing step S102, “the terminal acquires the first credential information input by the user”, the following steps may be performed:

S44. The terminal acquires the second credential information by using a subscriber identity module SIM connected to the terminal. and / or

S46. The terminal acquires the second credential information by using the embedded storage module.

S48. The terminal determines the second authentication information according to the second credential information.

S50. The terminal sends the second authentication information to the authentication end. At this time, the authentication end may be configured to authenticate the terminal according to the second authentication information.

S52. After the authentication end successfully authenticates the terminal according to the second authentication information, the terminal accesses the mobile communication network to obtain the third type of mobile communication service.

S54. After the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service.

As a preferred embodiment, in the embodiment of the present invention, the terminal can access the mobile communication network through the LIPA (Local IP Access) protocol to obtain the third type of mobile communication service. The terminal can access the mobile communication network through the SIPTO (Selected IP Traffic Offload) protocol to obtain the fourth type of mobile communication service.

Through the LIPA protocol, the terminal can directly access other IP-capable devices in the coverage area of the base station. For the Home evolved Node B (HeNB), the terminal can directly access the user's home network or other network in the enterprise network through the LIPA protocol. IP-capable devices, so that there is no need to transit through the core network, which helps to reduce the burden on the core network.

Through the SIPTO protocol, the terminal can directly access the Internet through the HeNB or the macro base station, which is also beneficial for reducing the burden on the core network. Unlike LIPA, the terminal can access other networks than the local network through the SIPTO protocol.

As shown in FIG. 6, the communication between the "terminal 1" and the Internet requires traditional communication through the core network; the communication between the "terminal 2" and the Internet is a communication via the SIPTO protocol; the communication between the "terminal 3" and the local device is through the LIPA protocol. Communication.

As a preferred embodiment, in the embodiment of the present invention, when the terminal accesses the mobile communication network according to different credential information and acquires different types of mobile communication services, the terminal may generate corresponding reminder information to remind the user of the currently available mobile communication. service. For example, after the terminal accesses the mobile communication network to obtain the third type of mobile communication service, the terminal may generate the first reminder information; after the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service, the terminal may Generate a second reminder message. The first reminder information may be different from the second reminder information.

The second credential information may be the SIM card information. When the terminal passes the authentication according to the SIM card information, the terminal sends the first reminder information. When the first credential information is authenticated, the terminal sends the second reminder information, so that the user can know the current The type of mobile communication service available.

For example, if the user has not input the first credential information on a certain terminal, when the terminal enters the coverage area of the mobile communication network, the user can only use the third type of mobile communication service, and the terminal will send the first reminder information. For example, if the mobile phone displays “Welcome to the xx mobile coverage area, you can get the xx service”; if the terminal does not send the second reminder information, the user can know the status of his service, so if you want to obtain the fourth type of mobile communication service, The application can be made by payment. After the application is successful, the terminal will send a second reminder message. For example, the mobile phone displays “You are xx mobile advanced user, free Internet traffic is left xx”, or mobile APP (Application) Changed from gray to color.

It should be noted that, in practical applications, the combination of the method proposed by the present invention and the method based on traditional SIM card communication is not limited. For example, the terminal using the present invention may include a traditional SIM card slot for the user to insert at the same time. The traditional SIM card can also obtain the first credential information input by the user, wherein the terminal can authenticate according to the traditional SIM card through the traditional mobile communication network, or can use the method of the present invention to use the novel mobile communication network of the present invention. Certification.

The third type of mobile communication service may be at least one of the following: accessing a cache of the local base station, viewing an advertisement, acquiring information near a geographical area, paying for a fourth type of mobile communication service, and accessing a website of a part of the enterprise. In this way, any qualified user who joins the mobile communication network (whether paying or arrears) can enjoy the third type of mobile communication service as long as he enters the coverage area of the mobile communication network, thereby attracting more users to join the mobile communication network, and Bringing advertising revenue to mobile communication service providers, and at the same time bringing more convenience to users. For example, when a user enters a shopping mall, he can obtain the number of all the restaurants in the shopping mall, so as to avoid whether a restaurant can immediately ask whether it can be immediately Eating, it improves the user experience. When any user joining the mobile communication network can pay for the fourth type of mobile communication service, the user's payment limit can be reduced, and the user can self-pay. When any qualified user joining the mobile communication network can access the websites of some enterprises, it can help the mobile communication service providers to help the enterprises to promote the business, and also help to enhance the value of the mobile communication service providers for these enterprises.

According to an embodiment of the present invention, another terminal authentication method for use in a mobile communication system is provided.

7 is a flow chart of another method for terminal authentication in a mobile communication system according to an embodiment of the present invention.

As shown in FIG. 7, the method includes the following steps S702 to S706:

Step S702, the authentication end acquires the first authentication information sent by the terminal. The terminal may be configured to obtain first credential information input by the user, and determine first authentication information according to the first credential information, where the first credential information is information verified by the target software.

Step S704, the authentication end authenticates the terminal according to the first authentication information.

Step S706, after the authentication end successfully authenticates the terminal according to the first authentication information, the mobile communication network authorizes the terminal to access the mobile communication network.

The authentication end receives the first authentication information sent by the terminal according to the first credential information input by the user, and authenticates the terminal according to the first authentication information. If the authentication passes, the mobile communication network provides the mobile communication service for the terminal. Wherein, the first credential information can be used to authenticate the user in software (target software) developed by a third party other than the user and the mobile communication service provider.

It should be noted that the foregoing operations may be performed by different mobile communication network devices. For example, the base station may be configured to receive authentication information, and provide a mobile communication service for the terminal, where the authentication center is used to authenticate the terminal; The same mobile communication network device performs, for example, the base station can be used for communication, authentication, and transceiving signals.

As a preferred embodiment, in the embodiment of the present invention, the authentication end may be an authentication center in a mobile communication network, or it may be a mobile communication server in a mobile communication network (such as AAA (Authentication, Authorization, Accounting, Authentication, Authorization, accounting)), or it may be a cloud platform with authentication side functionality in a mobile communication network. Alternatively, the authentication end may also be a software server corresponding to the target software developed by the third party (hereinafter referred to as a third-party software server). The authentication center, the mobile communication server, and the software server can respectively authenticate the terminal by:

Authentication Center:

S56. The authentication center acquires user data used by the target software to verify the first credential information.

S58. The authentication center receives the first authentication information sent by the terminal.

S60. The authentication center authenticates the terminal according to the user data and the first authentication information.

S62. After the authentication center successfully authenticates the terminal according to the first authentication information and the user data, the authentication end authorizes the terminal to access the mobile communication network.

Mobile communication server:

The authentication mode of the mobile communication server is similar to that of the authentication center, and is not described here.

Since the authentication center, the mobile communication server (such as the AAA server), and the cloud platform all authenticate within the mobile communication network, the authentication process is fast, which is not necessary to be repeatedly forwarded to the third-party software server, which helps to improve the user experience. In particular, the third party software server encrypts the user data using the first key and sends it to the mobile communication network. In this way, since the mobile communication service provider does not know the first key, the user data information held by the third-party software server cannot be obtained in reverse, and the security of the user data grasped by the third party is protected.

For the first credential information sent by the terminal to the mobile communication network, the first key may also be used for encryption, so that the mobile communication network device only needs to determine whether the credential information sent by the user is encrypted with the user data sent by the third-party software server. The authentication process can be achieved by matching; in this case, the software involved in the user inputting the credential information on the terminal is also developed by a third party (such as Tencent), for example, the WeChat APP developed by the user on the mobile phone through Tencent. Enter the username and password. The APP automatically encrypts the username and password using the first key and sends it to the mobile communication network device. The latter can directly use the encrypted information to authenticate the terminal.

For the credential information sent by the terminal to the mobile communication network, the second key different from the first key may also be used for encryption, thereby having higher confidentiality. For example, the authentication algorithm employed by the mobile communication network is associated with the first key and the second key, thereby enabling authentication, and since the mobile communication network does not know the first key and the second key, the user data cannot be acquired. Different third-party credential information uses different keys and can be more confidential. For example, WeChat and Mi Chat use different keys.

In the embodiment of the present invention, the authentication process of the mobile communication server to the terminal may specifically include: first, the mobile communication network acquires user data from a third party, for example, obtains user data related to the user name and password of the user, and then the user is at the terminal. Entering the user name and password, when the terminal enters the coverage area of the mobile communication network, the terminal automatically sends the credential information to the mobile communication network according to the user name and password input by the user, and the mobile communication network obtains the user data obtained from the third party and the obtained from the terminal. The authentication information authenticates the terminal and provides a mobile communication service to the terminal according to the authentication result. The entire process is shown in Figure 8, and the authentication process is completed in numerical order.

Software server:

First, the software server obtains the first authentication information sent by the terminal.

Then, the software server authenticates the terminal according to the first authentication information.

Then, after the software server successfully authenticates the terminal according to the first authentication information, the mobile communication network authorizes the terminal to access the mobile communication network.

When the authentication of the terminal is completed on the third-party software server, the third-party software server transmits the authentication result to the mobile communication network, and the mobile communication network provides the mobile communication service to the terminal according to the authentication result.

Specifically, after the terminal sends the authentication information to the mobile communication network, the mobile communication network directly sends or processes the authentication information to the third-party network device (such as a third-party software server), and finally the third-party network device authenticates the terminal. (According to the user data reserved when the user registers as a third-party software user before the process); if the authentication is passed, the mobile communication network is notified, and the mobile communication network will provide the mobile communication service for the terminal. The entire process is shown in Figure 9, and the authentication process is completed in numerical order.

The voucher information 1, the voucher information 2, and the voucher information 3 may be the same or different. For example, different encryption processing or the like is performed in different processes, the second credential information is generated by the first credential information, and the third credential information is generated by the second credential information.

As a preferred embodiment, in the embodiment of the present invention, the terminal may include multiple terminals. For example, the terminal may include the first terminal and the second terminal, so that the authentication terminal may use the first terminal or the second terminal in the first mode or the second mode. The second terminal performs authentication:

method one:

S64. The authentication end acquires the first authentication information sent by the first terminal.

S66. The authentication end authenticates the first terminal according to the first authentication information sent by the first terminal.

S68. The authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal.

S70. If the authentication end determines that the second terminal successfully authenticates according to the first authentication information sent by the first terminal, the second terminal interrupts the connection with the mobile communication network.

S72: After the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal, the authentication end authorizes the first terminal to access the mobile communication network.

As a preferred embodiment, in the embodiment of the present invention, before the second terminal interrupts the connection with the mobile communication network, the following steps may be further included:

S74. The authentication end determines whether the network access priority of the first terminal is higher than the network access priority of the second terminal.

S76. If the authentication end determines that the network access priority of the first terminal is higher than the network access priority of the second terminal, the second terminal interrupts the connection with the mobile communication network.

S78. If the authentication end determines that the network access priority of the first terminal is not higher than the network access priority of the second terminal, the authentication end fails to authenticate the first terminal according to the first credential information sent by the first terminal.

Method 2:

S80. The authentication end receives the first authentication information sent by the first terminal.

S82. The authentication end authenticates the first terminal according to the first authentication information sent by the first terminal.

S84. The authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal.

S86. If the authentication end determines that the second terminal successfully authenticates according to the first authentication information sent by the first terminal, the second terminal maintains a connection with the mobile communication network.

S88. After the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal, the mobile communication network authorizes the first terminal to access the mobile communication network.

The first terminal may be used to obtain the first type of mobile communication service provided by the mobile communication network. The second terminal can be used to obtain a second type of mobile communication service provided by the mobile communication network.

As a preferred embodiment, in the embodiment of the present invention, before the authentication end acquires the first authentication information sent by the terminal, the terminal authentication method may further include: the authentication end sends an authentication request including a random number to the terminal, where the terminal may And configured to determine, according to the first credential information input by the user, the first credential information according to the first credential information and the random number.

The detailed description of the authentication process of the first terminal and the second terminal is the same as that of the foregoing method, and details are not described herein again.

As a preferred embodiment, in the embodiment of the present invention, the authentication end can authenticate the user terminal by using one of the foregoing credential information (ie, the first credential information), and can also pass another credential information (such as The second voucher information is combined with the first credential information to authenticate the user terminal. For example, prior to performing authentication according to the first credential information, preliminary authentication may be performed through the second credential information. Specifically, the terminal may be configured to obtain the second credential information, and determine the second credential information according to the second credential information, and send the second authentication information to the authentication end, so that, in the foregoing step S202, the authentication end acquires the sent by the terminal. Before the first authentication information, the following steps can be performed:

S90. The authentication end acquires the second authentication information sent by the terminal. The terminal may be configured to obtain the second credential information by using the user identification module SIM connected to the terminal; and/or the terminal may obtain the second credential information by using the embedded storage module.

S92. The authentication end authenticates the terminal according to the second authentication information.

S94: After the authentication end successfully authenticates the terminal according to the second authentication information, the mobile communication network authorizes the terminal to access the mobile communication network to obtain the third type of mobile communication service.

S96: After the authentication end successfully authenticates the terminal according to the first authentication information, the mobile communication network authorizes the terminal to access the mobile communication network to obtain the fourth type of mobile communication service.

The above authentication method is a two-level authentication method: the terminal pre-stores the second credential information of the user, and acquires first credential information input by the user, where the first credential information can be used in addition to the user and the mobile communication service provider. The user authenticated by the software developed by the three parties; when the terminal enters the coverage area of the mobile communication network, it first automatically communicates with the mobile communication network according to the second credential information and authenticates the terminal, and then communicates and authenticates with the mobile communication network according to the first credential information. If the terminal passes the authentication according to the second credential information of the user, the third type of mobile communication service is obtained through the mobile communication network; if the authentication according to the first credential information is passed, the fourth type of mobile communication service is further obtained through the mobile communication network.

The source of the second authentication information is as described above, and details are not described herein again. The second authentication information includes at least one of the following: an International Mobile Subscriber Identification Number (IMSI), an authentication key (Ki), a security algorithm (such as A3, A8 algorithm), and other key information (such as Ki-derived Kc information), Location Area Identity (LAI), Mobile Subscriber Temporary Identity (TMSI), Public Access Network Code forbidden access, Personal Identification Number (PIN, Personal Identification) Number), unlock code (PUK, PIN Unlocking Key), billing rate, user's phone number information.

In the present invention, the authentication based on the first credential information or the second authentication information based on the information similar to the information included in the conventional SIM card may be two-way authentication, that is, the mobile communication network may authenticate the terminal through the process, after the authentication is passed The communication service is provided to the terminal; the terminal can also authenticate the network through this process, and the user information is sent to the mobile communication network after the authentication is passed. The two-way authentication mechanism enables the two communication peers of the terminal and the network to establish a higher trust, thereby improving the security of the communication.

It should be noted that the third type of mobile communication service provided by the mobile communication network may be a free service, thereby attracting more users to join the mobile communication network; the fourth type of mobile communication service provided by the mobile communication network is a paid service, wherein The object may be a user and a third party. For example, the user directly pays the mobile communication network, or after the user reaches a certain condition by viewing the advertisement, the third party pays the user for the mobile communication service.

As a preferred embodiment, in the embodiment of the present invention, the mobile communication network may authorize the terminal to access the mobile communication network through the LIPA protocol to obtain the third type of mobile communication service. The mobile communication network can authorize the terminal to access the mobile communication network through the SIPTO protocol to obtain the fourth type of mobile communication service. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

As a preferred embodiment, the present invention provides a mobile communication service using an unlicensed frequency band. The existing wireless communication includes wireless communication on the licensed band and on the Unlicensed band, and wireless communication on the licensed band, such as the communication provided by the current mobile communication carrier, the frequency band occupied by such wireless communication is Used by a mobile communication carrier alone; and wireless communication on the Unlicensed band, such as the current wifi, this spectrum can be used freely. Due to the openness of the Unlicensed frequency, the mobile communication network can provide mobile communication services for terminals through the Unlicensed frequency band when authentication is performed by the software server. The spectrum and the authentication process are both open and beneficial to the opening of the communication service platform. Business Innovation.

According to an embodiment of the present invention, there is provided a terminal authentication apparatus for use in a mobile communication system for terminal authentication apparatus in a mobile communication system for authenticating in accordance with authentication information of a target software to a mobile communication system End authentication. It should be noted that the terminal authentication method for the mobile communication system provided by the embodiment of the present invention may be performed by the terminal authentication apparatus used in the mobile communication system according to the embodiment of the present invention, and is used for moving in the embodiment of the present invention. The terminal authentication apparatus in the communication system can also be used to execute the terminal authentication method in the mobile communication system of the embodiment of the present invention.

As shown in FIG. 10, the apparatus includes: a first acquisition unit 10, a first determination unit 20, a first transmission unit 30, and an access unit 40.

The first obtaining unit 10 may be configured to enable the terminal to acquire first credential information input by the user, where the first credential information is information verified by the target software.

The first determining unit 20 may be configured to enable the terminal to determine the first authentication information according to the first credential information.

The first sending unit 30 may be configured to enable the terminal to send the first authentication information to the authentication end, where the authentication end is configured to authenticate the terminal according to the first authentication information.

The access unit 40 can be configured to enable the terminal to access the mobile communication network after the authentication end successfully authenticates the terminal according to the first authentication information.

Specifically, when the terminal enters the coverage area of the mobile communication network, the terminal can automatically communicate with the mobile communication network according to the first credential information and authenticate the terminal identity. After the authentication, the authentication end can send the authentication result to the mobile communication network. If the authentication is passed, the terminal can access the mobile communication network and obtain the mobile communication service; if the authentication fails, the terminal cannot access the mobile communication network, and thus cannot obtain the mobile communication service. The mobile communication network may send an authentication information request to the terminal before the terminal sends the first authentication information to the authentication end. After receiving the authentication information request, the terminal sends the first authentication information to the authentication end according to the authentication information request. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

method one:

The first obtaining unit 10 is further configured to enable the first terminal to acquire the first credential information input by the user.

The first determining unit 20 is further configured to enable the terminal to determine the first authentication information according to the first credential information, where the first terminal determines the first authentication information according to the first credential information.

The first sending unit 30 is further configured to enable the terminal to send the first authentication information to the authentication end, where the first terminal sends the first authentication information to the authentication end.

The terminal authentication apparatus may further include: a first receiving unit, a first authentication unit, a first determining unit, and a first interrupting unit.

The first receiving unit may be configured to: after the first terminal sends the first authentication information to the authentication end, the authentication end receives the first authentication information sent by the first terminal. The first authentication unit may be configured to enable the authentication end to authenticate the first terminal according to the first authentication information sent by the first terminal. The first determining unit may be configured to enable the authentication end to determine whether the first authentication information that has been sent according to the first terminal is The second terminal is successfully authenticated; the first interrupting unit may be configured to enable the mobile communication network to interrupt the second terminal and the mobile communication network if the authentication terminal determines that the second terminal has successfully authenticated according to the first authentication information sent by the first terminal. The connection unit, wherein the access unit is further configured to enable the first terminal to access the mobile communication network after the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal.

In the first method, after the first terminal passes the authentication of the mobile communication network, the second terminal cannot maintain communication with the mobile communication network. That is, if the second terminal first authenticates successfully in the mobile communication network through a certain credential information, and then the mobile communication network detects that the credential information is used to authenticate the first terminal, after the first terminal successfully authenticates, the mobile communication The network authorizes the first terminal to communicate with the mobile communication network and interrupts communication between the second terminal and the mobile communication network. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

As a preferred embodiment, on the basis of the first method, the terminal authentication device may include: a second determining unit.

The second determining unit may be configured to: before the second terminal interrupts the connection with the mobile communication network, the authentication end determines whether the network access priority of the first terminal is higher than the network access priority of the second terminal, where the first interrupting unit further The second terminal may terminate the connection with the mobile communication network when the authentication end determines that the network access priority of the first terminal is higher than the network access priority of the second terminal; and the first authentication unit may also be used to enable authentication. When the terminal determines that the network access priority of the first terminal is not higher than the network access priority of the second terminal, the authentication end fails to authenticate the first terminal according to the interruption indication sent by the second terminal. The priority judgment may be based on: the mobile communication network may send a request response to the first terminal and the second terminal, and authorize the first responding terminal to have a higher priority.

Method 2:

The terminal authentication apparatus may further include: a second obtaining unit, a second determining unit, a second sending unit, a second receiving unit, a second authentication unit, a third determining unit, a holding unit, an access unit, a third acquiring unit, and The fourth acquisition unit. The second obtaining unit may be configured to enable the first terminal to acquire the first credential information input by the user; the second determining unit may be configured to enable the first terminal to determine the first credential information according to the first credential information; the second sending unit may be configured to enable The first terminal sends the first authentication information to the authentication terminal; the second receiving unit may be configured to enable the authentication terminal to receive the first authentication information sent by the first terminal, and the second authentication unit may be configured to enable the authentication terminal to send according to the first terminal. The first authentication information is used to authenticate the first terminal; the third determining unit may be configured to enable the authentication end to determine whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal; the holding unit may be configured to enable the authentication terminal Determining that the second terminal successfully authenticates according to the first authentication information sent by the first terminal, the second terminal maintains a connection with the mobile communication network; the access unit may be configured to enable the first end sent by the authentication terminal according to the first terminal. After the credential information is successfully authenticated by the first terminal, the first terminal accesses the mobile communication network; the third acquiring unit may A first terminal for obtaining a first class of such mobile communication service provided by mobile communication network; and a fourth acquiring unit may be configured such that the second terminal to obtain a second type mobile communication service provided by mobile communication network.

In the second mode, the first terminal and the second terminal can simultaneously maintain communication with the mobile communication network. It should be noted that, in the second mode, the mobile communication network may send a message to the two terminals to prompt that other terminals use the same credential information for authentication. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

As a preferred embodiment, in the embodiment of the present invention, the terminal may determine the first authentication information according to the first credential information in multiple manners.

Example 3

The first determining unit 20 may include: a determining module and a generating module. The determining module may be configured to cause the terminal to determine the identification data according to the first credential information; and the generating module may be configured to cause the terminal to generate the first authentication information according to the identification data. Specifically, the terminal side may include an identification data generating means for generating corresponding identification data based on the first voucher information input by the user, the identification data being used to generate the authentication information by the terminal authentication information generating means. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

Example 4

As a preferred embodiment, in the embodiment of the present invention, the terminal authentication apparatus may further include: a third receiving unit. The third receiving unit may be configured to: before the terminal acquires the first credential information input by the user, the terminal receives the authentication request that is sent by the authentication end, and the first determining unit is further configured to enable the terminal to use the first credential information and the random The number determines the first authentication information.

As a preferred embodiment, in the embodiment of the present invention, in addition to authenticating the user terminal by using one of the foregoing credential information (ie, the first credential information), another credential information (such as the second credential may be passed). The information is combined with the first credential information to authenticate the user terminal. For example, prior to performing authentication according to the first credential information, preliminary authentication may be performed through the second credential information. Specifically, the authentication apparatus may further include: a fifth obtaining unit, a sixth obtaining unit, a third determining unit, and a third sending unit.

The fifth obtaining unit may be configured to: before the terminal acquires the first credential information input by the terminal, the terminal acquires the second credential information by using the user identification module SIM connected to the terminal; and/or the sixth obtaining unit may be configured to enable the terminal to pass The self-embedded storage module acquires the second credential information; the third determining unit may be configured to enable the terminal to determine the second credential information according to the second credential information; and the third sending unit may be configured to enable the terminal to send the second credential information to the authentication The authentication end is configured to authenticate the terminal according to the second authentication information, where the access unit is further configured to enable the terminal to access the mobile communication network to obtain the third after the authentication end successfully authenticates the terminal according to the second authentication information. The class mobile communication service; and after the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service.

As a preferred embodiment, in the embodiment of the present invention, the access unit may be further configured to enable the terminal to access the mobile communication network through the LIPA protocol to obtain the third type of mobile communication service; and the terminal accesses the mobile communication network by using the SIPTO protocol. Obtain the fourth type of mobile communication service. The details of the content of the LIPA protocol and the SIPTO protocol are the same as those of the foregoing method, and are not described here.

As a preferred embodiment, in the embodiment of the present invention, the terminal authentication apparatus may further include: a first generating unit and a second generating unit. The first generating unit may be configured to: after the terminal accesses the mobile communication network to obtain the third type of mobile communication service, the terminal generates first reminder information, and the second generating unit may be configured to enable the terminal to access the mobile communication network to obtain the first After the four types of mobile communication services, the terminal generates second reminder information.

The second credential information may be SIM card information. When the terminal passes the authentication according to the SIM card information, the terminal sends the first reminder information. When the first credential information is authenticated, the terminal sends the second reminder information. The user is informed of the currently available types of mobile communication services. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

According to an embodiment of the present invention, another terminal authentication apparatus for use in a mobile communication system is provided.

As shown in FIG. 11, the apparatus includes a seventh obtaining unit 50, a third authentication unit 60, and an authorization unit 70.

The seventh obtaining unit may be configured to enable the authentication end to obtain the first authentication information sent by the terminal, where the terminal may be configured to obtain the first credential information input by the user, and determine the first credential information according to the first credential information, where the first credential information The information verified by the target software; the third authentication unit may be configured to enable the authentication end to authenticate the terminal according to the first authentication information; and the authorization unit may be configured to: after the authentication end successfully authenticates the terminal according to the first authentication information, move The communication network authorizes the terminal to access the mobile communication network.

The authentication end receives the first authentication information sent by the terminal according to the first credential information input by the user, and authenticates the terminal according to the first authentication information. If the authentication passes, the mobile communication network provides the mobile communication service for the terminal. Wherein, the first credential information can be used to authenticate the user in software (target software) developed by a third party other than the user and the mobile communication service provider. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

As a preferred embodiment, in the embodiment of the present invention, the authentication end may be an authentication center in the mobile communication network, or it may be a mobile communication server (such as an AAA server) in the mobile communication network, or it may be a mobile communication A cloud platform with authentication side functionality in the network. Or the authentication end can also be a software server corresponding to the target software developed by the third party. The authentication center, the mobile communication server, and the software server can respectively authenticate the terminal in the following manner: the authentication end can include an authentication center in the mobile communication network, and the third authentication unit 60 can include: a first acquiring module, and a first The receiving module and the first authentication module.

The authentication center may be configured to enable the authentication center to obtain the user data used by the target software to verify the first credential information; the first receiving module may be configured to enable the authentication center to be used by the receiving terminal to send the first The first authentication module is configured to enable the authentication center to authenticate the terminal according to the user data and the first authentication information, wherein the authorization unit is further configured to: use the first authentication information and the user data to authenticate the terminal at the authentication center. After the authentication succeeds, the authentication end authorizes the terminal to access the mobile communication network. The details of the method are the same as those in the foregoing, and are not described here.

Mobile communication server: The authentication mode of the mobile communication server is similar to that of the authentication center, and is not described here. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

Alternatively, the authentication end may include a software server corresponding to the target software, and the third authentication unit may include: a second obtaining module and a second authentication module. The second obtaining module can be used to enable the software server to acquire the terminal Sending the first authentication information; the second authentication module may be configured to enable the software server to authenticate the terminal according to the first authentication information; and wherein the authorization unit is further configured to enable the software server to successfully authenticate the terminal according to the first authentication information The mobile communication network authorizes the terminal to access the mobile communication network.

When the authentication of the terminal is completed on the third-party software server, the third-party software server transmits the authentication result to the mobile communication network, and the mobile communication network provides the mobile communication service to the terminal according to the authentication result. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

In the first manner, the seventh obtaining unit may be further configured to: the authentication end acquires the first authentication information that is sent by the first terminal, where the terminal authentication device may further include: a fourth authentication unit, a fourth determining unit, and a second interrupting unit. .

The fourth authentication unit may be configured to: after the authentication end acquires the first authentication information sent by the first terminal, the authentication end authenticates the first terminal according to the first authentication information sent by the first terminal; the fourth determining unit may be configured to enable The authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal, and the second interrupting unit is further configured to: if the authentication end determines that the first authentication information that has been sent according to the first terminal is used to be the second If the terminal authentication succeeds, the second terminal interrupts the connection with the mobile communication network, wherein the authorization unit may be further configured to enable the authentication end to authorize the authentication of the first terminal after the authentication end succeeds according to the first credential information sent by the first terminal. A terminal accesses the mobile communication network.

As a preferred embodiment, the authentication apparatus may further include: a fifth determining unit. The fifth determining unit may be configured to: before the second terminal interrupts the connection with the mobile communication network, the authentication end determines whether the network access priority of the first terminal is higher than the network access priority of the second terminal, where the second interrupting unit is further The second terminal interrupts the connection with the mobile communication network if the authentication end determines that the network access priority of the first terminal is higher than the network access priority of the second terminal; and the third authentication unit is further configured to enable the authentication end If the first terminal's network access priority is not higher than the second terminal's network access priority, the authentication end fails to authenticate the first terminal according to the first credential information sent by the first terminal.

In the second manner, the authorization unit may include: a second receiving module, a second authentication module, a determining module, a holding module, and a third authorization module.

The second receiving module may be configured to: the authentication end receives the first authentication information sent by the first terminal; the second authentication module may be configured to enable the authentication end to authenticate the first terminal according to the first authentication information sent by the first terminal; The breaking module may be configured to enable the authentication end to determine whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal; the maintaining module may be configured to: if the authentication end determines that the first authentication information that has been sent according to the first terminal is After the authentication of the second terminal is successful, the second terminal maintains a connection with the mobile communication network; the third authorization module may be configured to enable the mobile terminal to perform authentication after the first terminal successfully authenticates according to the first credential information sent by the first terminal. The first terminal of the network is authorized to access the mobile communication network, wherein the first terminal can be used to obtain the first type of mobile communication service provided by the mobile communication network; and the second terminal can be used to obtain the second type of mobile communication provided by the mobile communication network service.

As a preferred embodiment, in the embodiment of the present invention, the terminal authentication apparatus may further include: a fourth sending unit. The fourth sending unit may be configured to: before the authentication end acquires the first authentication information sent by the terminal, the authentication end sends an authentication request including a random number to the terminal, where the terminal may be configured to acquire the first credential information input by the user, and The first authentication information is determined according to the first credential information and the random number. The detailed description of the detailed authentication process of the first terminal and the second terminal is the same as the foregoing method part, and details are not described herein again.

As a preferred embodiment, in the embodiment of the present invention, the authentication end can authenticate the user terminal by using one of the foregoing credential information (ie, the first credential information), and can also pass another credential information (such as The second voucher information is combined with the first credential information to authenticate the user terminal. For example, prior to performing authentication according to the first credential information, preliminary authentication may be performed through the second credential information. Specifically, the terminal may be configured to obtain the second credential information, and determine the second credential information according to the second credential information, and send the second authentication information to the authentication end, where the authentication apparatus may further include: an eighth obtaining unit and a fourth Certification unit.

The eighth obtaining unit may be configured to: before the authentication end acquires the first authentication information sent by the terminal, the authentication end acquires the second authentication information sent by the terminal, where the terminal is configured to acquire the second information by using the user identification module SIM connected to the terminal. The voucher information and/or the second credential information is obtained by the embedded storage module; the fourth authentication unit may be configured to enable the authentication end to authenticate the terminal according to the second authentication information, wherein the authorization unit may further be configured to enable the authentication end After the terminal authentication succeeds according to the second authentication information, the mobile communication network authorizes the terminal to access the mobile communication network to obtain the third type of mobile communication service; and after the authentication end successfully authenticates the terminal according to the first authentication information, the mobile communication network authorizes the terminal. Access to a mobile communication network to obtain a fourth type of mobile communication service. The authorization unit may also be used in the mobile communication network to authorize the terminal to access the mobile communication network through the LIPA protocol to obtain the third type of mobile communication service; and the mobile communication network to authorize the terminal to access the mobile communication network through the SIPTO protocol to obtain the fourth type of mobile communication service. .

The above authentication method is a two-level authentication method: the terminal pre-stores the second credential information of the user, and acquires first credential information input by the user, where the first credential information can be used in addition to the user and the mobile communication service provider. The user authenticated by the software developed by the three parties; when the terminal enters the coverage area of the mobile communication network, it first automatically communicates with the mobile communication network according to the second credential information and authenticates the terminal, and then moves according to the first credential information and The mobile communication network communicates and authenticates the terminal; if the authentication according to the second credential information of the user passes, the third type of mobile communication service is obtained through the mobile communication network; if the authentication according to the first credential information is passed, the mobile communication network is further obtained through the mobile communication network. The fourth type of mobile communication services. The detailed description of the content is the same as the method part mentioned above, and will not be described here.

As a preferred embodiment, in the embodiment of the present invention, the mobile communication network may authorize the terminal to access the mobile communication network through the LIPA protocol to obtain the third type of mobile communication service. The mobile communication network can authorize the terminal to access the mobile communication network through the SIPTO protocol to obtain the fourth type of mobile communication service. The detailed description is the same as the foregoing, and will not be repeated here.

Through the above description, the embodiment of the present invention can achieve the following technical effects:

The user does not need to purchase the SIM card from the mobile communication service provider, but directly inputs the credential information in the terminal; when the terminal enters the coverage area of the mobile communication network, it automatically communicates with the mobile communication network according to the credential information and authenticates the terminal, and the authentication passes. You can enjoy mobile communication services. Therefore, there is no need to set a SIM card slot in the terminal, which reduces the design complexity of the terminal, and is also beneficial to the development of the terminal. Moreover, when used, it is only necessary to input the credential information once on the terminal, so that when the terminal enters different coverage areas of the mobile communication network, it can automatically authenticate.

The credential information input by the user can be used not only for the authentication operation in the process of accessing the mobile communication network, but also for authenticating the user in the software developed by the third party, thus eliminating the trouble that a user needs to have multiple network identities, for example. The WeChat user can input the WeChat ID and password in the terminal, and when the terminal enters the coverage area of the mobile communication network, automatically communicates with the mobile communication network according to the entered credential information and authenticates the terminal, so that the user only needs to have one WeChat. ID's network identity, users can obtain more convenient information services through third-party social resources. For example, after users input WeChat ID and password, they can connect to the Internet and communicate with friends directly through the mobile communication network.

Increase the value of software developed by third parties. For example, when users can enjoy mobile communication services by inputting WeChat ID and password, WeChat will attract more users and enhance the value of WeChat; mobile communication service providers can also expand their business scope by cooperation with third parties, for example Can be profitable by increasing value for third parties.

It should be noted that the steps illustrated in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and, although shown in the flowchart, The steps shown or described may be performed in an order different than that herein.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in a storage device by a computing device, or they may be fabricated into individual integrated circuit modules, or Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

A terminal authentication method for use in a mobile communication system, comprising:

The terminal acquires first credential information input by the user, where the first credential information is information verified by the target software;

Determining, by the terminal, first authentication information according to the first credential information;

The terminal sends the first authentication information to the authentication end, where the authentication end is configured to authenticate the terminal according to the first authentication information;

After the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network.
The terminal authentication method according to claim 1, wherein the terminal comprises a first terminal and a second terminal,

The obtaining, by the terminal, the first credential information input by the user includes: the first terminal acquiring the first credential information input by the user,

Determining the first authentication information by the terminal according to the first credential information includes: determining, by the first terminal, the first authentication information according to the first credential information,

The sending, by the terminal, the first authentication information to the authentication end includes: sending, by the first terminal, the first authentication information to the authentication end,

After the first terminal sends the first authentication information to the authentication end, the terminal authentication method further includes: the authentication end receiving the first authentication information sent by the first terminal; The first terminal is authenticated according to the first authentication information sent by the first terminal; the authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal; If the authentication end determines that the second terminal has successfully authenticated according to the first authentication information sent by the first terminal, the mobile communication network interrupts the connection between the second terminal and the mobile communication network,

The first terminal accesses the mobile communication network after the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal.
The terminal authentication method according to claim 2, before the second terminal interrupts the connection with the mobile communication network, the terminal authentication method includes:

The authentication end determines whether the network access priority of the first terminal is higher than the network access priority of the second terminal,

If the authentication end determines that the network access priority of the first terminal is higher than the network access priority of the second terminal, the second terminal interrupts the connection with the mobile communication network; The authentication end determines that the network access priority of the first terminal is not higher than the network access priority of the second terminal, and the authentication end fails to authenticate the first terminal according to the interruption indication sent by the second terminal.
The terminal authentication method according to claim 1, wherein the terminal comprises a first terminal and a second terminal, and the second terminal accesses the mobile communication network by:

The first terminal acquires first credential information input by a user;

Determining, by the first terminal, first authentication information according to the first credential information;

The first terminal sends the first authentication information to the authentication end;

The authentication end receives the first authentication information sent by the first terminal;

The authentication end authenticates the first terminal according to the first authentication information sent by the first terminal;

The authentication end determines whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal;

If the authentication end determines that the second terminal has successfully authenticated according to the first authentication information sent by the first terminal, the second terminal maintains a connection with the mobile communication network;

After the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal, the first terminal accesses the mobile communication network;

The first terminal acquires a first type of mobile communication service provided by the mobile communication network;

The second terminal acquires a second type of mobile communication service provided by the mobile communication network.
The terminal authentication method according to claim 1, wherein the determining, by the terminal, the first authentication information according to the first credential information comprises:

Determining, by the terminal, identification data according to the first credential information;

The terminal generates the first authentication information according to the identification data.
The terminal authentication method according to claim 1,

Before the terminal obtains the first credential information input by the user, the terminal authentication method further includes: the terminal receiving an authentication request that is sent by the authentication end, including a random number,

The determining, by the terminal, the first authentication information according to the first credential information comprises: determining, by the terminal, the first authentication information according to the first credential information and the random number.
The terminal authentication method according to claim 1, wherein before the terminal acquires the first credential information input by the user, the authentication method further includes:

The terminal acquires second credential information through a subscriber identity module SIM connected to the terminal; and/or

The terminal acquires the second credential information by using a storage module embedded therein;

Determining, by the terminal, second authentication information according to the second credential information;

The terminal sends the second authentication information to the authentication end, where the authentication end is used to authenticate the terminal according to the second authentication information.

After the authentication end successfully authenticates the terminal according to the second authentication information, the terminal accesses the mobile communication network to obtain a third type of mobile communication service; and the first end is authenticated according to the first After the authentication information is successfully authenticated by the terminal, the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service.
The terminal authentication method according to claim 7,

The terminal accesses a mobile communication network through a LIPA protocol to obtain a third type of mobile communication service;

The terminal accesses the mobile communication network through the SIPTO protocol to obtain the fourth type of mobile communication service.
The terminal authentication method according to claim 7,

After the terminal accesses the mobile communication network to obtain the third type of mobile communication service, the terminal authentication method further includes: the terminal generating the first reminder information,

After the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service, the terminal authentication method further includes: the terminal generating second reminder information.
A terminal authentication apparatus for use in a mobile communication system, comprising:

a first obtaining unit, configured to enable the terminal to obtain first credential information input by the user, where the first credential information is information verified by the target software;

a first determining unit, configured to enable the terminal to determine first authentication information according to the first credential information;

a first sending unit, configured to enable the terminal to send the first authentication information to an authentication end, where the authentication end is configured to authenticate the terminal according to the first authentication information;

The access unit is configured to enable the terminal to access the mobile communication network after the authentication end successfully authenticates the terminal according to the first authentication information.
The terminal authentication apparatus according to claim 10, wherein the terminal comprises a first terminal and a second terminal,

The first obtaining unit is further configured to enable the first terminal to obtain first credential information input by a user,

The first determining unit is further configured to: determine, by the terminal, the first authentication information according to the first credential information, that: the first terminal determines, according to the first credential information, first authentication information, where

The first sending unit is further configured to: send, by the terminal, the first authentication information to the authentication end, where the first terminal sends the first authentication information to the authentication end,

The terminal authentication apparatus further includes: a first receiving unit, configured to: after the first terminal sends the first authentication information to the authentication end, the authentication end receives the first a first authentication unit, configured to enable the authentication end to authenticate the first terminal according to the first authentication information sent by the first terminal, where the first determining unit is configured to enable the authentication end to determine Whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal; the first interruption unit is configured to: if the authentication end determines that the first authentication has been sent according to the first terminal If the information is successfully authenticated by the second terminal, the mobile communication network interrupts the connection between the second terminal and the mobile communication network,

The access unit is further configured to enable the first terminal to access the mobile communication network after the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal. .
The terminal authentication device according to claim 11, wherein the terminal authentication device further comprises:

a second determining unit, configured to: before the second terminal interrupts the connection with the mobile communication network, the authentication end determines whether the network access priority of the first terminal is higher than the access priority of the second terminal level,

The first interrupting unit is further configured to: if the authentication end determines that the network access priority of the first terminal is higher than the network access priority of the second terminal, the second terminal is interrupted and a connection of the mobile communication network; and the first authentication unit is further configured to cause if the authentication terminal determines If the priority of the first terminal is not higher than the network access priority of the second terminal, the authentication end fails to authenticate the first terminal according to the interruption indication sent by the second terminal.
The terminal authentication device according to claim 11, wherein the terminal comprises a first terminal and a second terminal, and the terminal authentication device further comprises:

a second acquiring unit, configured to enable the first terminal to acquire first credential information input by a user;

a second determining unit, configured to enable the first terminal to determine first authentication information according to the first credential information;

a second sending unit, configured to enable the first terminal to send the first authentication information to the authentication end;

a second receiving unit, configured to enable the authentication end to receive the first authentication information sent by the first terminal;

a second authentication unit, configured to enable the authentication end to authenticate the first terminal according to the first authentication information sent by the first terminal;

a third determining unit, configured to enable the authentication end to determine whether the second terminal is successfully authenticated according to the first authentication information sent by the first terminal;

a holding unit, configured to enable the second terminal to maintain a connection with the mobile communication network if the authentication terminal determines that the second terminal has successfully authenticated according to the first authentication information sent by the first terminal ;

The access unit is configured to enable the first terminal to access the mobile communication network after the authentication end successfully authenticates the first terminal according to the first credential information sent by the first terminal;

a third acquiring unit, configured to enable the first terminal to acquire a first type of mobile communication service provided by the mobile communication network;

And a fourth acquiring unit, configured to enable the second terminal to acquire a second type of mobile communication service provided by the mobile communication network.
The terminal authentication device according to claim 10, wherein the first determining unit comprises:

Determining a module, configured to cause the terminal to determine identification data according to the first credential information;

And a generating module, configured to enable the terminal to generate the first authentication information according to the identification data.
The terminal authentication device according to claim 10,

The terminal authentication device further includes: a third receiving unit, configured to: before the terminal acquires the first credential information input by the user, the terminal receives the authentication request that is sent by the authenticating end, including the random number,

The first determining unit is further configured to enable the terminal to determine the first authentication information according to the first credential information and the random number.
The terminal authentication device according to claim 10, wherein the authentication device further comprises:

a fifth obtaining unit, configured to: before the terminal acquires the first credential information input by the terminal, the terminal acquires the second credential information by using a user identification module SIM connected to the terminal; and/or

a sixth obtaining unit, configured to enable the terminal to acquire the second credential information by using a storage module embedded therein;

a third determining unit, configured to enable the terminal to determine second authentication information according to the second credential information;

a third sending unit, configured to enable the terminal to send the second authentication information to the authentication end, where the authentication end is configured to authenticate the terminal according to the second authentication information,

The access unit is further configured to: after the authentication end successfully authenticates the terminal according to the second authentication information, the terminal accesses a mobile communication network to obtain a third type of mobile communication service; After the authentication end successfully authenticates the terminal according to the first authentication information, the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service.
The terminal authentication apparatus according to claim 16, wherein the access unit is further configured to enable the terminal to access a mobile communication network through a LIPA protocol to acquire a third type of mobile communication service; and the terminal accesses the mobile through a SIPTO protocol. Communication network to obtain the fourth type of mobile communication service.
The terminal authentication device according to claim 16, wherein the terminal authentication device further comprises:

a first generating unit, configured to: after the terminal accesses the mobile communication network to obtain the third type of mobile communication service, the terminal generates first reminder information;

And a second generating unit, configured to: after the terminal accesses the mobile communication network to obtain the fourth type of mobile communication service, the terminal generates second reminder information.