WO2017054110A1 - 用户身份认证的方法及设备 - Google Patents

用户身份认证的方法及设备 Download PDF

Info

Publication number
WO2017054110A1
WO2017054110A1 PCT/CN2015/090943 CN2015090943W WO2017054110A1 WO 2017054110 A1 WO2017054110 A1 WO 2017054110A1 CN 2015090943 W CN2015090943 W CN 2015090943W WO 2017054110 A1 WO2017054110 A1 WO 2017054110A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
terminal
identity
priority
credential
Prior art date
Application number
PCT/CN2015/090943
Other languages
English (en)
French (fr)
Inventor
曾元清
唐海
Original Assignee
广东欧珀移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广东欧珀移动通信有限公司 filed Critical 广东欧珀移动通信有限公司
Priority to EP15905022.8A priority Critical patent/EP3316512B1/en
Priority to CN201580081100.4A priority patent/CN107710673B/zh
Priority to US15/745,347 priority patent/US10412585B2/en
Priority to PCT/CN2015/090943 priority patent/WO2017054110A1/zh
Publication of WO2017054110A1 publication Critical patent/WO2017054110A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/183—Processing at user equipment or user record carrier
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Definitions

  • Embodiments of the present invention relate to the field of communications, and, more particularly, to a method and device for user identity authentication.
  • the operator provides a SIM card for the user, and the cellular system uses the SIM card provided by the operator for identity authentication. Users need to apply for a SIM card to different operators to use the services provided by multiple operators. Moreover, when the SIM card is lost or damaged, the user cannot access the carrier network and the service cannot be used.
  • the SIM card since one number can only use one terminal device at the same time, when the user wants to replace the terminal device, the SIM card must be transferred at the same time. However, different terminal devices currently have different specifications for the SIM card. Therefore, when the terminal device is replaced, the operator may need to change the SIM card or use the adapter. This is inconvenient for the user, causing a large user cost or even a damage to the SIM card or the terminal device due to the failure of the adapter.
  • the embodiment of the invention provides a method for user identity authentication, which can implement a unified and secure identity authentication mode, improve ease of use, and achieve better utilization of resources.
  • a method for user identity authentication including:
  • the service provider SP device receives a user request sent by the terminal, where the user request includes the identity credential of the user;
  • the SP device starts a corresponding service for the terminal according to the priority.
  • a method for user identity authentication including:
  • the identity authentication server obtains a user request from a service provider SP device, the user request including the identity credentials of the user;
  • the identity authentication server sends the ID of the user and the priority of the identity credential to the SP device, so that the SP device starts a corresponding service for the user.
  • a method for user identity authentication including:
  • the terminal receives the identity credentials entered by the user;
  • the terminal acquires subscription information of the user according to the ID of the user;
  • the terminal determines, according to the subscription information, a service corresponding to a priority of the identity credential.
  • a terminal including:
  • a receiving unit configured to receive an identity credential input by the user
  • a determining unit configured to determine, according to the identity credential, an identifier ID of the user and a priority of the identity credential
  • An obtaining unit configured to use the ID of the user, to obtain subscription information of the user
  • a determining unit configured to determine, according to the subscription information, a service corresponding to a priority of the identity credential.
  • a service provider device comprising:
  • a receiving unit configured to receive a user request sent by the terminal, where the user request includes the identity credential of the user
  • a determining unit configured to determine, according to the user request, an identifier of the user and a priority of the identity credential
  • a processing unit configured to enable a corresponding service for the terminal according to the priority.
  • a device for user identity authentication including:
  • a receiving unit configured to acquire a user request from a service provider SP device, where the user request includes an identity credential of the user;
  • a determining unit configured to determine, according to the user request, an identifier of the user and a priority of the identity credential
  • a sending unit configured to send the ID of the user and the priority of the identity credential to the SP device, so that the SP device starts a corresponding service for the user.
  • the SP device provides a corresponding service according to the identity credential of the user. This enables a unified and secure identity authentication method, improves ease of use, and enables better utilization of resources.
  • FIG. 1 is a flow chart of a method of user identity authentication according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a selection interface presented by a terminal according to an embodiment of the present invention.
  • FIG. 3 is a flow chart of a method of user identity authentication according to another embodiment of the present invention.
  • FIG. 4 is a flow chart of a method of user identity authentication according to another embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for user identity authentication according to another embodiment of the present invention.
  • FIG. 6 is a flow chart of a method of user identity authentication according to another embodiment of the present invention.
  • FIG. 7 is a flow chart of a method of user identity authentication according to another embodiment of the present invention.
  • FIG. 8 is a structural block diagram of a terminal according to an embodiment of the present invention.
  • FIG. 9 is a structural block diagram of a terminal according to another embodiment of the present invention.
  • Figure 10 is a block diagram showing the structure of an SP device according to an embodiment of the present invention.
  • FIG. 11 is a block diagram showing the structure of an SP device according to another embodiment of the present invention.
  • FIG. 12 is a structural block diagram of an apparatus for user identity authentication according to an embodiment of the present invention.
  • FIG. 13 is a structural block diagram of an apparatus for user identity authentication according to another embodiment of the present invention.
  • the terminal may also be referred to as a user equipment (User Equipment, UE), including but not limited to a device having a wireless communication function.
  • the terminal may be a device capable of using a communication service such as a handheld terminal, an in-vehicle device, a wearable device, a home smart device, a sensor, or the like.
  • a communication service such as a handheld terminal, an in-vehicle device, a wearable device, a home smart device, a sensor, or the like.
  • it can be a cellular phone, such as a smart phone.
  • an operator may provide a service to a user through a Service Provider (SP) device.
  • SP Service Provider
  • the services provided include, but are not limited to, traditional communication services such as voice, video, and data, services such as car networking, Internet of Things, intelligent transportation, smart home, medical monitoring, and sensor networks.
  • FIG. 1 is a flow chart of a method of user identity authentication according to an embodiment of the present invention.
  • the terminal 11, the SP device 12, and the identity authentication server 13 are shown in FIG.
  • the terminal 11 is not in the use state in the initial state, that is, no user uses the terminal 11 to access the mobile network.
  • the terminal 11 may be in a factory-set state, or the first user may use the terminal 11 for the first time.
  • the terminal 11 presents a selection interface for the first user to select an operator.
  • the interface of the terminal 11 may display a first list (as shown in FIG. 2), and the first list lists multiple operators (as shown in FIG. 2, operator A, carrier B, and carrier). C).
  • the terminal 11 receives the selection information input by the first user, where the selection information indicates the operator selected by the first user.
  • the first user may select at least one operator in the selection interface presented by S101.
  • the selection information may be that the first user selects the operator A shown in FIG. 2 and clicks the "OK" button.
  • the selection information may also be that the first user selects the operator A and the operator C shown in FIG. 2 and clicks the "OK" button.
  • the terminal 11 presents a list of supported identity credentials.
  • the identity credential is a representation of the identity of the user.
  • the identity credentials can include primary credentials and secondary credentials.
  • the primary credentials may include at least one of the following: DNA, fingerprint, iris, voiceprint, and the like.
  • the secondary credentials may include at least one of the following: a digital certificate, a digital signature, a user card, a password, and the like.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • the certificate issued by an authority can be an ID number or a passport number.
  • the other proof may be used as an identifier (ID) of the first user.
  • different identity credentials may have different priorities.
  • Primary credentials The priority can be higher than the priority of the secondary credentials.
  • the DNA can be taken as the highest priority
  • the fingerprint is taken as the second priority
  • the iris is taken as the third priority
  • the voiceprint is taken as the fourth priority
  • ... the password is taken as the lowest priority.
  • DNA can be determined by collecting blood or saliva or the like.
  • the fingerprint may be fingerprint information of a plurality of fingers, or fingerprint information of one finger, or may be partial fingerprint information of one finger; and, the fingerprint of the plurality of fingers may have a higher priority than the fingerprint of one finger.
  • the iris can be a binocular or monocular iris.
  • the user card can be a SIM card.
  • the password can be a long string or a short string, or it can be an order of motion on the graph.
  • the user credentials that can support input will vary depending on the hardware differences of the different terminals.
  • some terminals can collect the user's iris information through the camera; some terminals can collect the user's fingerprint information through a specific area; and the like.
  • some terminals can collect blood or saliva in a specific way for DNA identification.
  • the list of user credentials presented by the terminal 11 in S103 is related to the hardware attributes of the terminal 11, and the like.
  • the step S103 is optional, and is not required.
  • the terminal 11 is owned by the first user, and other users can only be used after the consent or authorization of the first user, and the first user is already familiar with the attributes (and corresponding services) of the terminal 11, then the first The user can set the terminal 11 to no longer present a list of supported identity credentials.
  • the terminal 11 receives the identity credential input by the first user.
  • the first user can enter a password through the keyboard or touch screen of the terminal 11.
  • the first user can input a fingerprint through the fingerprint collection module of the terminal 11.
  • the first user can input the iris through the camera of the terminal 11.
  • the first user can input voiceprints through the mic. and many more.
  • the terminal 11 is not limited to being used by only one user, that is, multiple users can access the mobile network through the terminal 11. Then, the terminal 11 can allocate separate storage areas for different users.
  • the terminal 11 may internally have a plurality of physically or logically independent storage areas for storing information of different users.
  • the terminal 11 may allocate a first storage area to the first user for storing the identity credential of the first user. And after passing the authentication, it is used to store user data (including user interface) and service information of the first user.
  • the terminal 11 sends the identity credential of the first user to the SP device 12.
  • the SP device 12 is the SP device of the operator selected by the first user in S102.
  • the SP device 12 is the SP device of the operator A.
  • the SP device 12 includes the SP device of the operator A and the SP device of the operator B.
  • the terminal 11 may first process the identity credential of the first user by using a generating method, and then process the processed credential credential. Sent to the SP device 12. That is to say, the terminal 11 does not directly transmit the original data of the user identity credentials such as DNA, fingerprint, iris, voiceprint, etc., but transmits the data processed by a certain generation method (for example, an algorithm using some kind of one-way mapping). In this way, users can protect their privacy from being illegally obtained by operators or other third parties (such as hackers) who intercept data transmission.
  • a certain generation method for example, an algorithm using some kind of one-way mapping
  • the production method here can be understood as an encryption method.
  • the form generated after the generation method can be of a lower priority form.
  • a string of length 30 can be processed by the generation method.
  • the string processed by the generation method can be a string of length 25.
  • the SP device 12 sends the identity credential of the first user to the identity authentication server 13.
  • the identity authentication server 13 may be built and maintained by a service provider (such as an operator). In other words, different operators build and maintain their own identity authentication servers.
  • the identity authentication server 13 may be a third party other than the user or the operator; for example, the third party may be another agreed third party institution.
  • a third party may be a government authority, that is, the identity authentication server 13 may be built and maintained for a government authority. In this way, the security of the user's identity credentials can be guaranteed.
  • the identity authentication server 13 can be accessed by at least one operator.
  • the authority of the operator to access the identity authentication server 13 may be set.
  • the SP device 12 may re-process the identity credential of the first user and send it to the identity authentication server 13, for example, may increase its own digital signature or encryption. In this way, not only the source of the message can be indicated to the identity authentication server 13, but also the SP device can be guaranteed. 12 Secure communication with the authentication server 13. It can be understood that the digital signature or encryption method and the like used by the SP device 12 are pre-agreed by the SP device 12 and the identity authentication server 13.
  • the SP device 12 receives the identity credential processed by the generating method from the terminal 11 in S105, then in S106, the SP device 12 also sends the identity credential processed by the generating method to the identity authentication. Server 13.
  • the SP device may re-process the identity credential processed by the generating method (add its own digital signature or encryption) and then send it to the identity authentication server 13. Since the SP device 12 does not know the generation method employed by the terminal 11, or even if the SP device 12 knows the generation method but does not know the key for encryption, the SP device 12 cannot perform the decryption operation, so that the SP device 12 cannot acquire the first. The user's higher priority identity credentials, which increases the security of the identity credentials.
  • the identity credential of the first user input terminal 11 is DNA feature information
  • the processed identity credential obtained by the SP device 12 from the terminal 11 is a string of length 30. Accordingly, the SP device 12 transmits a character string of length 30 to the identity authentication server 13, or the SP device 12 processes the character string of length 30 again and transmits it to the identity authentication server 13.
  • the identity authentication server 13 determines an identifier (Identifier, ID) of the first user corresponding to the identity credential and a priority of the identity credential according to the identity credential of the first user.
  • the ID of the first user may be a certificate issued by an authority, for example, an ID card number or a passport number of the first user.
  • the identity authentication server 13 stores a correspondence between the ID of the user and the priority of the user identity credential and the identity credential. That is to say, the information of the identity binding authentication between the identity credential and the other proof is stored in the identity authentication server 13.
  • the user authentication server 13 can determine that the corresponding identifier is ID1, and the corresponding priority is P1.
  • the identity authentication server 13 may first recover the identity credential by using the verification method, and then determine the corresponding Priority and user ID.
  • the verification method is a decryption method. Also, the SP device 12 cannot acquire the verification method.
  • the generating method and the verification method are that the terminal 11 and the identity authentication server 13 agree in advance.
  • the generation method may be included in the factory settings of the terminal 11.
  • the identity authentication server 13 may determine the priority of the user's ID already having the identity credential according to the sequence of features processed by the generating method.
  • the generation method can also be stored in the identity authentication server 13.
  • the identity authentication server 13 can generate a feature sequence by using a generation method such as DNA, fingerprint, voiceprint, iris, and the like. In this way, the identity authentication server 13 can compare the feature sequence with the received sequence, thereby being able to determine the priority of the received identity credentials and the ID of the corresponding user.
  • the identity authentication server 13 may obtain the identity credentials of the user from a specific part, or may actively upload the identity credentials by the user. Assuming that the identity authentication server 13 is built and maintained by the competent government department, the competent government department can obtain the correspondence between the user's fingerprint and the ID card number/passport number from the public security department, and can obtain the user from a specific hospital. The correspondence between the DNA and iris characteristic information and the ID card number/passport number can be uploaded by the user himself or herself.
  • the identity authentication server 13 transmits the priority of the identity credential and the ID of the first user to the SP device 12.
  • the SP device 12 can acquire the registration information of the user according to the ID of the first user.
  • the registration information is also called contract information.
  • the first user needs to register with the operator before using the service provided by the operator.
  • the first user has already performed a contract service at the operator.
  • the first user may select at least one service provided by the operator when signing the contract, and may set the user credentials required for the at least one service separately.
  • the first user may or may not select an international roaming service.
  • the first user can agree with the operator that the user credentials required for the international roaming service are fingerprints.
  • the SP device 12 turns on the corresponding service for the terminal 11.
  • the SP device 12 stores a correspondence between the priority of the identity credential and the available service.
  • the corresponding relationship can also be understood as contract information.
  • the correspondence may include: the service corresponding to the password includes a partial call; the user card pair
  • the services should include SMS and all calls; ..., the service corresponding to the fingerprint includes SMS, all calls and network traffic under a certain threshold; ..., the service corresponding to DNA includes all available services; and so on. It is not listed here one by one.
  • the user can only use the corresponding service if he or she enters the corresponding or higher priority identity credentials. If the priority of the identity credential input by the user is lower than the priority of the identity credential corresponding to the service, the terminal 11 may deny the user the use of the service.
  • the SP device 12 may acquire the subscription information of the first user according to the ID of the first user, and further, may determine the service corresponding to the priority of the identity credential according to the subscription information. Thereby, the corresponding service can be turned on for the terminal 11 used by the first user in S109.
  • the services supported by the operator may be divided into different levels.
  • the level of the service may be classified according to the importance of the service or the tariff of the service.
  • Operators can set the identity credentials required for different levels of service. For example, the operator can set the following rules: 1. The user needs the highest priority identity credentials (eg, DNA) to modify the service selected at the time of registration; 2. The user needs the second priority identity credentials (eg, fingerprint ) You can use the international roaming service.
  • the highest priority identity credentials eg, DNA
  • the second priority identity credentials eg, fingerprint
  • the rule can be represented by the correspondence between the priority of the identity credentials and the available services. Moreover, the operator can pre-store the correspondence in the SP device 12, and thus, in S109, the SP device 12 can determine the corresponding service according to the correspondence, and enable the corresponding service for the terminal 11.
  • the SP device 12 may also send the priority of the identity credential and the ID of the first user to the terminal 11 (not shown in FIG. 1), such that the terminal 11 may use the identity credential, the identity credential.
  • the correspondence between the priority and the ID of the first user is stored, and specifically, may be stored in the first storage area.
  • the first user can access the operator's network through the terminal 11, and can use the service corresponding to the identity credentials entered by the first user.
  • the first user can use the service opened in S109. If the first user wants to use other services than the opened service, the terminal 11 may display a rejection alert or prompt the first user to enter a high priority identity credential.
  • the terminal 11 may present an alarm interface rejecting the service request of the first user's international roaming call; or The terminal 11 can present an indication information interface indicating that the first user needs a high priority identity credential "fingerprint" to use the service.
  • the information of the priority of a part of the user credentials may be pre-stored in the SP device 12, for example, the user ID and the user identity credential (the lower priority part of the user credential) and the identity credential may be pre-stored. Partial correspondence between priorities.
  • the SP device 12 can first determine whether there is a pre-stored partial correspondence on the SP device 12. If the SP device 12 does not store the partial correspondence, or if the SP device 12 cannot determine the priority of the identity credential and the ID of the user according to the partial correspondence, then after S105, the execution proceeds to S106.
  • the SP device 12 can determine the priority of the identity credential and the ID of the user according to the partial correspondence, then after S105, the SP device 12 can perform authentication according to the partial correspondence, and directly execute S109 after the authentication (ie, no need Executions S106 to S108). In this way, the efficiency of the user's authentication can be improved.
  • the operator where the SP device 12 is located is the operator A.
  • the first user accesses the network of the operator A through the terminal 11, and the service provided by the operator A can be used through the terminal 11.
  • the method further includes: the SP device 12 performs charging according to the service usage of the first user.
  • different service types may adopt different charging methods, for example, session based charging, time-based charging, and charging according to network resources (such as traffic) used, and may be used.
  • the type of the resource is charged, and the like is not limited by the present invention.
  • the charging according to the type of the used resource may include: the priority resource (such as an emergency call) has a higher cost; the broadcast type resource charging mode is different from the unicast type resource charging mode, and the like.
  • the SP device 12 can perform charging by using a charging control device, a Policy and Charging Enforcement Function (PCEF), a Policy and Charging Rules Function (PCRF), and the like.
  • PCEF Policy and Charging Enforcement Function
  • PCF Policy and Charging Rules Function
  • the user can set a billing account corresponding to the ID of the user in the unified billing server.
  • the ID of the user is in one-to-one correspondence with the billing account.
  • different operators can use the billing account, thereby saving user expenses, reducing the pressure on the user to pay, and avoiding the trouble caused by the user being stopped due to forgetting the payment.
  • the SP device 12 can send a charging request to the unified charging server, where the charging is requested.
  • the request includes the ID, and the unified billing server performs billing from the user's billing account.
  • the terminal 11 receives a specific instruction of the first user, where the specific instruction indicates that the operator needs to be reselected.
  • the first user can reselect the operator through a specific button of the terminal 11, for example, the first user can cause the terminal 11 to display the interface as shown in FIG. 2 through the specific menu of the terminal 11. That is, after S110, S101 and S102 can be performed. It is assumed that in this S102, the operator selected by the first user is the operator B.
  • the first user may set an operator to which certain services are connected in the “Service Setting” menu of the terminal 11 during the service use. And, the information can be stored in the first storage area of the terminal 11, so that the first user can use certain services in the subsequent use of the setting.
  • the order in which the first user can set the carrier used by the service S1 is: operator B, operator A, and operator C.
  • the service S1 preferentially uses the carrier B, and only the carrier A is used when the carrier B fails to connect (if there is no signal), and the carrier C is used when both the operator B and the carrier A fail to connect.
  • the order in which the first user can set the carrier used by the service S2 is: operator A, operator C.
  • the terminal 11 sends the identity credential of the first user to the SP device of the operator B.
  • the identity credential of the first user is acquired by the terminal 11 in S104 and stored in the first storage area of the terminal 11.
  • the identity credential of the first user may be re-entered by the first user after S110.
  • the identity credentials required for the service S1 provided only by the operator B are DNA, then the first user can enter the DNA before S111.
  • the SP device of the operator B can perform a process similar to that of the SP device 12, and details are not described herein again.
  • the terminal 11 may further include: Receive the temporary exit instruction of the first user.
  • the temporary exit instruction indicates that the first user temporarily no longer uses the terminal 11, and needs to temporarily suspend related information of the first user.
  • the terminal 11 may freeze the user data of the first user according to the temporary exit instruction. That is, the user data of the first user is in an inactive state.
  • the user data may include a user's profile, a user's application (Application, APP), and a user's user interface.
  • the first user can input an activation command. That is, the terminal 11 can receive the activation instruction of the first user and activate the frozen user data of the first user. Specifically, the terminal 11 may load the profile of the first user according to the activated user data, and present the user interface of the first user. The user interface can present the APP information of the first user.
  • the terminal 11 receives an activation instruction input by the first user.
  • the activation command may be the identity credential of the first user, for example, the identity credential P1.
  • the terminal 11 acquires the ID of the first user and the priority of the identity credential P1.
  • the terminal 11 may determine the ID of the first user and the priority of the input identity credential P1 according to the stored information.
  • the terminal 11 can determine the priority of the first user and the priority of the input identity credential P1.
  • the terminal 11 may perform the step of S105 and obtain from the SP device after S201.
  • the terminal 11 acquires user information in the first storage area according to the ID of the first user.
  • the first storage area is an independent storage area allocated by the terminal 11 for the first user as described above.
  • the terminal 11 presents a user interface (UI) of the first user stored in the first storage area, and the UI can display the APP of the first user and the like.
  • UI user interface
  • the first user sets the service through the "Service Settings" menu after the aforementioned S109
  • the provider (or the order of the operators) used by the service then, in S204, the first user can directly use the service according to the previous settings.
  • the terminal 11 may reject the first user using the service S2. Alternatively, the terminal 11 may present a notification message for the first user to enter the identity credential P2. Alternatively, the terminal 11 may present a selection interface for the user to decide whether to transmit the identity credential P2 stored in the first storage area (if stored) to the SP device of the operator providing the service S2.
  • the invention is not limited thereto.
  • the terminal 11 may further include: receiving, by the terminal 11, a permanent deactivation instruction of the first user. Subsequently, the terminal 11 can delete the user data of the first user according to the permanent deactivation instruction. That is to say, the terminal 11 can delete all the information in the first storage area according to the permanent deactivation instruction.
  • the permanent deactivation instruction can be input after use to clear the personal data in time, thereby ensuring the security of the user data.
  • the first user temporarily withdraws or permanently deactivates the terminal 11
  • another user for example, the second user
  • the process of using the terminal 11 by the second user is similar to the process of the first user, and details are not described herein again.
  • the second user can also use the terminal 11 in a similar manner.
  • the user data of the first user is stored in the first storage area
  • the user data of the second user is stored in the second storage area. That is to say, the terminal 11 can be used by a plurality of users at the same time.
  • the terminal 11 may divide the display screen (such as a touch screen) into two parts, respectively presenting the UI of the first user and the UI of the second user.
  • the first user and the second user respectively use the terminal through their respective UIs.
  • the terminal 11 can present the display screen to the UI of the first user, and the UI of the second user runs in the background.
  • the first user can use the terminal through its UI, and the second user can use the terminal to make a call or the like through Bluetooth.
  • the terminal 11 can be used by multiple users, and multiple The user data of the user are stored in separate storage areas in the terminal 11, respectively. That is to say, user data of different users are separately stored. Generally, a user cannot access user data of other users. However, authorized user data can be accessed by other users.
  • the first user may authorize the permissions of a portion of his user data (eg, user data block DATA1) to be public, such that other authorized users may access the authorized user data block DATA1.
  • a portion of his user data eg, user data block DATA1
  • other authorized users may access the authorized user data block DATA1.
  • the first user can set a conditional authorization, for example, setting a part of the user data (such as the user data block DATA2) to a semi-public, and allowing only a part of the user during the setting process (eg, by limiting the user) The way of the ID) accesses the user data block DATA2.
  • a conditional authorization for example, setting a part of the user data (such as the user data block DATA2) to a semi-public, and allowing only a part of the user during the setting process (eg, by limiting the user) The way of the ID) accesses the user data block DATA2.
  • a conditional authorization for example, setting a part of the user data (such as the user data block DATA2) to a semi-public, and allowing only a part of the user during the setting process (eg, by limiting the user) The way of the ID) accesses the user data block DATA2.
  • the operator divides the services provided by the operator into different levels, and requires the user to use the corresponding identity credentials to use the corresponding service. In this way, the user can use the identity credentials to access the operator's network through any available terminal, which can increase the flexibility of the user to use the corresponding service.
  • FIG. 4 is a flow chart of a method of user identity authentication in accordance with an embodiment of the present invention. The method shown in Figure 4 is performed by an SP device, including:
  • the SP device receives a user request sent by the terminal, where the user request includes the identity credential of the user.
  • the SP device determines, according to the user request, a priority of the ID of the user and the identity credential.
  • the SP device starts a corresponding service for the terminal according to the priority.
  • the SP device provides a corresponding service according to the identity credential of the user. This enables a unified and secure identity authentication method, improves ease of use, and enables better utilization of resources.
  • the user's identity credentials may include primary credentials and secondary credentials.
  • the primary credentials have a higher priority than the secondary credentials.
  • the primary credentials include at least one of the following: DNA, fingerprint, iris, voiceprint.
  • the secondary credential includes at least one of the following: a digital certificate, a digital signature, a user card, and a password.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • a certificate issued by an authority can be an identity. Certificate number or passport number, etc.
  • the other proof may be used as the ID of the first user.
  • the priority order may be set for each of the different identity credentials.
  • the priority order may be set for each of the different identity credentials.
  • the SP device may determine, according to the pre-stored correspondence, the ID and the priority corresponding to the identity credential.
  • the SP device may send the user request to the identity authentication server, and receive the ID and the priority sent by the identity authentication server.
  • the identity credential in the user request may be the identity credential after the terminal processes the generating method.
  • the SP device may determine a service corresponding to the priority, where different priorities correspond to different services, and the high priority corresponding service includes a low priority Corresponding service; and opening a service corresponding to the priority for the terminal.
  • S303 can be referred to the description of S109 in the embodiment of FIG. 1. To avoid repetition, details are not described herein again.
  • the SP device can perform charging according to the service usage of the user.
  • the SP device may send a charging request to the unified charging server, so that the unified charging server performs charging from the charging account of the user.
  • the charging request includes the ID, and the charging account has a one-to-one correspondence with the ID.
  • the billing account may be preset by the user in the unified billing server, and the billing account may be accessed by the SP device of at least one operator.
  • FIG. 5 is a flowchart of a method for user identity authentication according to another embodiment of the present invention. The method shown in Figure 5 is performed by an identity authentication server, including:
  • the identity authentication server acquires a user request from the SP device, where the user request includes the identity credential of the user.
  • the identity authentication server determines, according to the user request, a priority of the user ID and the identity credential.
  • the identity authentication server sends the ID of the user and the priority of the identity credential. To the SP device, so that the SP device enables a corresponding service for the user.
  • the identity authentication server acquires the identity credential of the user from the SP device, and sends the ID of the user corresponding to the identity credential and the priority of the identity credential to the SP device. This enables a unified and secure identity authentication method, improves ease of use, and enables better utilization of resources.
  • the user's identity credentials may include primary credentials and secondary credentials.
  • the primary credentials have a higher priority than the secondary credentials.
  • the primary credentials include at least one of the following: DNA, fingerprint, iris, voiceprint.
  • the secondary credential includes at least one of the following: a digital certificate, a digital signature, a user card, and a password.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • the certificate issued by an authority can be an ID number or a passport number.
  • the other proof may be used as the ID of the first user.
  • the priority order may be set for each of the different identity credentials.
  • the priority order may be set for each of the different identity credentials.
  • the identity authentication server may be built and maintained by the operator, or may be set up and maintained by other agreed third-party organizations, which is not limited by the present invention.
  • the third party is for example the government department.
  • the identity credential in the user request may be the identity credential after the terminal adopts the generating method.
  • the S402 may include: processing the identity credential by using a verification method; and acquiring, according to the pre-stored correspondence, the ID and the priority corresponding to the processed identity credential.
  • the pre-stored correspondence may be obtained by the identity authentication server from a specific department, or the pre-stored correspondence may be uploaded by the user, which is not limited by the present invention.
  • S401 can refer to the description of S106 in the foregoing embodiment of FIG. 1.
  • S402 can refer to the description of S107 in the foregoing embodiment of FIG. 1
  • S403 can refer to the description of S108 in the foregoing embodiment of FIG. 1. To avoid repetition, here. No longer.
  • FIG. 6 is a flow chart of a method of user identity authentication according to another embodiment of the present invention. The method shown in Figure 6 is performed by the terminal, including:
  • the terminal receives the identity credential input by the user.
  • the terminal determines, according to the identity credential, an ID of the user and a priority of the identity credential.
  • the terminal acquires subscription information of the user according to the ID of the user.
  • the terminal determines, according to the subscription information, a service corresponding to a priority of the identity credential.
  • the terminal determines the ID of the user according to the identity credential input by the user, further enabling the user to use the service corresponding to the identity credential, so that the user experience can be improved.
  • the identity credentials may include primary credentials and secondary credentials.
  • the primary credentials have a higher priority than the secondary credentials.
  • the primary credentials include at least one of the following: DNA, fingerprint, iris, voiceprint.
  • the secondary credential includes at least one of the following: a digital certificate, a digital signature, a user card, and a password.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • the certificate issued by an authority can be an ID number or a passport number.
  • the other proof may be used as the ID of the first user.
  • the priority order may be set for each of the different identity credentials.
  • the priority order may be set for each of the different identity credentials.
  • S501 may refer to S201 in the embodiment of FIG. 3, that is, the identity credential in S501 may be understood as an activation instruction in S201.
  • S502 may refer to S202 in the embodiment of FIG. 3, that is, the terminal may perform S202 according to the correspondence between the stored identity credential, the ID of the user, and the priority of the identity credential.
  • S503 can refer to S203 in the embodiment of FIG. 3, that is, the subscription information that the terminal can obtain in advance from the SP device.
  • S504 can refer to S204 in the embodiment of FIG. 3, that is, the user can use the service corresponding to the identity credential (assumed to be P1) through the terminal.
  • the method may include: the terminal receiving the service request of the user; if the service indicated by the service request (assumed to be the first service) does not belong to the priority of the identity credential The level corresponds to the service, then the terminal can reject the user's service request for the first service. For example, the terminal may present prompt information for instructing the user to input another identity credential corresponding to the first service.
  • the user can only use the corresponding service if he or she has entered the corresponding identity credentials.
  • the service corresponding to the high priority identity credential includes the service corresponding to the lower priority identity credential.
  • the terminal can be used by at least two users at the same time.
  • the terminal may receive the identity credential input by another user (assumed to be P2), and further, the terminal may determine another service (assumed to be the second service) corresponding to the identity credential (P2) input by another user. In this way, another user can use the other service (second service) through the terminal.
  • the terminal can divide the display screen (such as the touch screen) into two parts for respectively presenting the UIs of the two users.
  • the two users use the terminal through their respective UIs.
  • the terminal can present the display to one user's UI and the other user's UI to run in the background.
  • One user can use the terminal through its UI, and another user can use the terminal to make a call via Bluetooth.
  • the method further includes: acquiring, by the terminal, a first correspondence between the identity credential, the ID of the user, and the priority of the identity credential.
  • the terminal acquires a second correspondence between the ID of the user and the subscription information of the user.
  • the terminal acquires a third correspondence between the priority of the identity credential and the service.
  • the terminal receives first selection information input by the user, where the first selection information indicates a first operator selected by the user.
  • the terminal receives a user request input by the user, where the user request includes the identity credential of the user.
  • the terminal sends the user request to the first SP device of the first operator.
  • the terminal performs identity authentication via the SP device through the user's identity credentials, and the SP device can provide the corresponding service to the user.
  • This enables a unified and secure identity authentication method, improves ease of use, and enables better utilization of resources.
  • the terminal may allocate a separate storage area for the user, where the independent storage area is used to store the identity credential of the user. Wait.
  • the terminal can include multiple physical or logically independent storage areas, respectively Used to store information for different users.
  • the method may include: accessing, by the first SP device, the network of the first operator after the first SP device indicates that the terminal passes the authentication. That is to say, the user can use the service provided by the first operator through the terminal.
  • the terminal may receive the first correspondence sent by the first SP device, where the first correspondence includes an ID of the user, a priority of the identity credential and the identity credential Correspondence between them.
  • the first correspondence may be stored in a separate storage area allocated for the user.
  • the terminal may acquire the subscription information of the user by using the first SP device.
  • the subscription information may be stored in a separate storage area allocated for the user.
  • the stored relationship between the ID of the user and the subscription information is stored.
  • the terminal may receive the second correspondence sent by the first SP device, where the second correspondence includes a correspondence between a priority of the identity credential and the service.
  • the second correspondence may be stored in a separate storage area allocated for the user.
  • S513 may include: processing the identity credential by using a predefined generating method; and sending the processed identity credential to the first SP device.
  • processing the identity credential by using a predefined generating method may include: processing the identity credential by using a predefined generating method; and sending the processed identity credential to the first SP device.
  • S511 can refer to the description of S102 in the foregoing embodiment of FIG. 1.
  • S512 can refer to the description of S104 in the foregoing embodiment of FIG. 1.
  • S513 can refer to the description of S105 in the foregoing embodiment of FIG. 1. To avoid repetition, here. No longer.
  • the method further includes: receiving, by the terminal, an instruction of the user, where the instruction indicates that the user needs to reselect an operator; and receiving, by the terminal, second selection information of the user, where the The second selection information indicates the second operator selected by the user; the terminal sends the user request to the second SP device of the second operator; after the second SP device indicates that the terminal passes the authentication, The terminal accesses the network of the second operator by using the second SP device.
  • the process refer to the foregoing descriptions of S110 and S111, and details are not described herein again.
  • the user in the process of using the terminal, the user can switch the operator at any time according to requirements, or the user can use multiple operators to access the network at the same time, which can improve the user experience.
  • the method may further include: the terminal receiving the temporary exit instruction of the user; and the terminal freezing the user data of the user according to the temporary exit instruction.
  • the user can temporarily freeze a terminal, so that the user's user data can be secured on the one hand, and the terminal can be used by other users on the other hand, thereby improving the utilization rate of the terminal and realizing better utilization of resources. .
  • the terminal may activate the frozen user data. Specifically, the terminal may load the profile of the user and present the user interface of the user according to the activated user data.
  • the activation command herein can be understood as the identity credential in S501 in FIG. 6.
  • the user can unfreeze the terminal at any time to resume use immediately.
  • the method further includes: receiving, by the terminal, the permanent deactivation instruction of the user; and deleting, by the terminal, the user data of the user according to the permanent deactivation instruction.
  • the terminal deletes the user data, thereby ensuring the security of the user data.
  • FIG. 8 is a structural block diagram of a terminal according to an embodiment of the present invention.
  • the terminal 700 shown in FIG. 8 includes a receiving unit 701, a determining unit 702, and an obtaining unit 703.
  • the receiving unit 701 is configured to receive the identity credential input by the user.
  • the determining unit 702 is configured to determine, according to the identity credential, an identifier ID of the user and a priority of the identity credential.
  • the obtaining unit 703 is configured to obtain the subscription information of the user for the ID of the user.
  • the determining unit 702 is further configured to determine, according to the subscription information, a service corresponding to a priority of the identity credential.
  • the terminal determines the ID of the user according to the identity credential input by the user, further enabling the user to use the service corresponding to the identity credential, so that the user experience can be improved.
  • the identity credentials may include primary credentials and secondary credentials.
  • the primary credentials have a higher priority than the secondary credentials.
  • the primary credentials include at least one of the following: DNA, fingerprint, iris, voiceprint.
  • the secondary credential includes at least one of the following: a digital certificate, a digital signature, a user card, and a password.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • the certificate issued by an authority can be an ID number or a passport number.
  • the other proof may be used as the ID of the first user.
  • the priority order may be set for each of the different identity credentials.
  • the priority order may be set for each of the different identity credentials.
  • the terminal 700 may further include a sending unit and a processing unit.
  • the receiving unit 701 is further configured to receive first selection information input by the user, where the first selection information indicates a first operator selected by the user, and the receiving The unit 701 is further configured to receive a user request input by the user, where the user request includes the identity credential.
  • the sending unit is configured to send the user request to a first service provider SP device of the first operator.
  • the processing unit is configured to: after the first SP device indicates that the identity credential is authenticated, access the network of the first operator by using the first SP device.
  • the receiving unit 701 is further configured to: acquire the subscription information of the user by using the first SP device.
  • the receiving unit 701 is further configured to: receive a first correspondence sent by the first SP device, where the first correspondence includes an ID of the user, the identity The correspondence between the credentials and the priority of the identity credentials.
  • the receiving unit 701 is further configured to: receive a second correspondence sent by the first SP device, where the second correspondence includes a priority and a location of the identity credential The correspondence between the services.
  • the sending unit is specifically configured to: process the identity credential by using a predefined generating method; and send the processed identity credential to the first SP device.
  • the receiving unit 701 is further configured to receive an instruction of the user, where the instruction indicates that the user needs to reselect an operator; and may also be used to receive the second selection of the user.
  • Information, the second selection information indicating a second operator selected by the user.
  • the sending unit may be further configured to send the user request to the second SP device of the second operator.
  • the processing unit may be further configured to: in the second SP device, instruct the terminal to pass the recognition After the certificate, the second operator's network is accessed by the second SP device.
  • the processing unit is further configured to allocate, to the user, a separate storage area, where the independent storage area is used to store the user's identity credentials.
  • the receiving unit 701 is further configured to receive a temporary exit instruction of the user.
  • the processing unit may be further configured to freeze the user data of the user according to the temporary exit instruction.
  • the processing unit is further configured to: load the profile of the user according to the identity credential and present a user interface of the user.
  • the receiving unit 701 is further configured to receive a service request of the user.
  • the processing unit may be configured to reject the service request if the service indicated by the service request does not belong to a service corresponding to a priority of the identity credential.
  • the processing unit is specifically configured to: present prompt information, where the prompt information is used to instruct the user to input another identity credential corresponding to the service indicated by the service request.
  • the receiving unit 701 is further configured to receive user credentials input by another user.
  • the determining unit 702 is further configured to determine another service corresponding to the identity credential input by the another user, so that the another user uses the another service by using the terminal.
  • the receiving unit 701 is further configured to receive a permanent deactivation instruction of the user.
  • the processing unit may be further configured to delete user data of the user according to the permanent deactivation instruction.
  • the receiving unit 701 may be implemented by a receiver
  • the sending unit may be implemented by a transmitter
  • the determining unit 702, the obtaining unit 703, and the processing unit may be implemented by a processor.
  • the terminal 800 may include a processor 801, a receiver 802, a transmitter 803, and a memory 804.
  • the memory 804 can be used to store user information, and can also be used to store code and the like executed by the processor 801.
  • a logical storage area in the memory 804 may be used to store the user information, including the user's identity credentials, subscription information, user interface, and the like.
  • bus system 805 which in addition to the data bus includes a power bus, a control bus, and a status signal bus.
  • the terminal 700 shown in FIG. 8 or the terminal 800 shown in FIG. 9 can implement the foregoing FIGS. 1 and 3 to The various processes implemented by the terminal in the embodiment of FIG. 7 are not repeated here to avoid repetition.
  • the processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the foregoing method embodiment may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programming logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.
  • the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (Erasable PROM, EPROM), or an electric Erase programmable read only memory (EEPROM) or flash memory.
  • the volatile memory can be a Random Access Memory (RAM) that acts as an external cache.
  • RAM Random Access Memory
  • many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (Synchronous DRAM).
  • SDRAM Double Data Rate SDRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Connection Dynamic Random Access Memory
  • DR RAM direct memory bus random access memory
  • FIG 10 is a block diagram showing the structure of an SP device according to an embodiment of the present invention.
  • the SP device shown in Figure 10 The 900 includes a receiving unit 901, a determining unit 902, and a processing unit 903.
  • the receiving unit 901 is configured to receive a user request sent by the terminal, where the user request includes the identity credential of the user.
  • the determining unit 902 is configured to determine, according to the user request, an ID of the user and a priority of the identity credential.
  • the processing unit 903 is configured to enable a corresponding service for the terminal according to the priority.
  • the SP device provides a corresponding service according to the identity credential of the user. This enables a unified and secure identity authentication method, improves ease of use, and enables better utilization of resources.
  • the user's identity credentials may include primary credentials and secondary credentials.
  • the primary credentials have a higher priority than the secondary credentials.
  • the primary credentials include at least one of the following: DNA, fingerprint, iris, voiceprint.
  • the secondary credential includes at least one of the following: a digital certificate, a digital signature, a user card, and a password.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • the certificate issued by an authority can be an ID number or a passport number.
  • the other proof may be used as the ID of the first user.
  • the priority order may be set for each of the different identity credentials.
  • the priority order may be set for each of the different identity credentials.
  • the SP device 900 may further include a sending unit.
  • the determining unit 902 is specifically configured to: determine, according to the pre-stored correspondence, the ID and the priority corresponding to the identity credential.
  • the determining unit 902 is specifically configured to: send the user request to an identity authentication server; and receive the ID and the priority sent by the identity authentication server.
  • the processing unit 903 may be specifically configured to: determine a service corresponding to the priority, where services corresponding to different priorities are different, and services corresponding to the high priority include low a service corresponding to the priority; and the service corresponding to the priority is enabled for the terminal.
  • processing unit 903 is further configured to: according to the user Billing for service usage.
  • the sending unit may be configured to: send a charging request to the unified charging server, so that the unified charging server performs charging from the charging account of the user.
  • the charging request includes the ID, and the charging account has a one-to-one correspondence with the ID.
  • the receiving unit 901 may be implemented by a receiver
  • the sending unit may be implemented by a transmitter
  • the determining unit 902 and the processing unit 903 may be implemented by a processor.
  • the SP device 1000 may include a processor 1001, a receiver 1002, a transmitter 1003, and a memory 1004.
  • the memory 1004 can be used to store subscription information of the user, and can also be used to store codes and the like executed by the processor 1001.
  • the various components in the SP device 1000 are coupled together by a bus system 1005, which in addition to the data bus includes a power bus, a control bus, and a status signal bus.
  • a bus system 1005 which in addition to the data bus includes a power bus, a control bus, and a status signal bus.
  • the SP device 900 shown in FIG. 10 or the SP device 1000 shown in FIG. 11 can implement the various processes implemented by the SP device in the foregoing embodiments of FIG. 1 and FIG. 3 to FIG. 7. To avoid repetition, details are not described herein again.
  • FIG. 12 is a structural block diagram of an apparatus for user identity authentication according to an embodiment of the present invention.
  • the device 1100 shown in FIG. 12 includes a receiving unit 1101, a determining unit 1102, and a transmitting unit 1103.
  • the receiving unit 1101 is configured to acquire a user request from a service provider SP device, where the user request includes the identity credential of the user.
  • the determining unit 1102 is configured to determine, according to the user request, an identifier of the user and a priority of the identity credential.
  • the sending unit 1103 is configured to send the ID of the user and the priority of the identity credential to the SP device, so that the SP device starts a corresponding service for the user.
  • the identity authentication server acquires the identity credential of the user from the SP device, and sends the ID of the user corresponding to the identity credential and the priority of the identity credential to the SP device. This enables a unified and secure identity authentication method, improves ease of use, and enables better utilization of resources.
  • the user's identity credentials may include primary credentials and secondary credentials.
  • the primary credentials have a higher priority than the secondary credentials.
  • the primary credentials include at least one of the following: DNA, fingerprint, iris, voiceprint.
  • the secondary credential includes at least one of the following: a digital certificate, a digital signature, a user card, Password.
  • the identity credentials can be authenticated with other certificates.
  • other certificates can be, for example, certificates issued by an authority.
  • the certificate issued by an authority can be an ID number or a passport number.
  • the other proof may be used as the ID of the first user.
  • the priority order may be set for each of the different identity credentials.
  • the priority order may be set for each of the different identity credentials.
  • the device 1100 in the embodiment of the present invention may be an identity authentication server.
  • the identity credential is generated by the terminal by using a generating method.
  • the determining unit 1102 is specifically configured to: process the identity credential by using a verification method; and obtain the ID and the priority corresponding to the processed identity credential according to the pre-stored correspondence.
  • the pre-stored correspondence is uploaded by the user.
  • the device is built and maintained by a government authority, or the device is built and maintained by an operator.
  • the receiving unit 1101 may be implemented by a receiver
  • the sending unit 1103 may be implemented by a transmitter
  • the determining unit 1102 may be implemented by a processor.
  • device 1200 can include a processor 1201, a receiver 1202, a transmitter 1203, and a memory 1204.
  • the memory 1204 can be used to store the correspondence between the user's identity credential, the ID of the user and the priority of the identity credential, and can also be used to store the code executed by the processor 1201 and the like.
  • bus system 1205 which in addition to the data bus includes a power bus, a control bus, and a status signal bus.
  • the device 1100 shown in FIG. 12 or the device 1000 shown in FIG. 13 can implement the processes implemented by the identity authentication server in the foregoing embodiments of FIG. 1 and FIG. 3 to FIG. 7. To avoid repetition, details are not described herein again.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Abstract

本发明提供了一种用户身份认证的方法，包括：服务提供商（SP）设备接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据；所述SP设备根据所述用户请求，确定所述用户的身份标识（ID）和所述身份凭据的优先级；所述SP设备根据所述优先级为所述终端开启相应的服务。本发明实施例中，SP设备根据用户的身份凭据，提供相应的服务。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。

Description

用户身份认证的方法及设备 技术领域
本发明实施例涉及通信领域，并且更具体地，涉及一种用户身份认证的方法及设备。
背景技术
在现有的移动通信系统中，运营商为用户提供SIM卡，蜂窝系统使用运营商提供的SIM卡进行身份认证。用户需要向不同的运营商分别申请SIM卡才能使用多个运营商提供的服务。并且，当SIM卡丢失或损坏时，用户无法接入运营商网络而导致无法使用服务。
另外，由于一个号码在同一时间只能使用一个终端设备，因此当用户想要更换终端设备时，必须同时转移SIM卡。然而目前不同的终端设备对于SIM卡的规格要求是不同的，因此，用户在更换终端设备时，可能需要到运营商更换SIM卡或者使用转接器。这样容易给用户带来不便，造成用户开销大甚至可能会由于转接器的故障导致SIM卡或者终端设备损坏。
可见，现有的方式对用户使用运营商的服务造成了很多限制，给用户带来诸多不便，甚至还可能造成用户开销大。
发明内容
本发明实施例提供一种用户身份认证的方法，能够实现统一安全的身份认证方式，提高易用性，并且能够实现资源的更优利用。
第一方面，提供了一种用户身份认证的方法，包括：
服务提供商SP设备接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据；
所述SP设备根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
所述SP设备根据所述优先级为所述终端开启相应的服务。
第二方面，提供了一种用户身份认证的方法，包括：
身份认证服务器从服务提供商SP设备获取用户请求，所述用户请求包括所述用户的身份凭据；
所述身份认证服务器根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
所述身份认证服务器将所述用户的ID和所述身份凭据的优先级发送至所述SP设备，以便所述SP设备为所述用户开启相应的服务。
第三方面，提供了一种用户身份认证的方法，包括：
终端接收用户输入的身份凭据；
所述终端根据所述身份凭据确定所述用户的标识ID和所述身份凭据的优先级；
所述终端根据所述用户的ID，获取所述用户的签约信息；
所述终端根据所述签约信息，确定与所述身份凭据的优先级对应的服务。
第四方面，提供了一种终端，包括：
接收单元，用于接收用户输入的身份凭据；
确定单元，用于根据所述身份凭据确定所述用户的标识ID和所述身份凭据的优先级；
获取单元，用于所述用户的ID，获取所述用户的签约信息；
确定单元，还用于根据所述签约信息，确定与所述身份凭据的优先级对应的服务。
第五方面，提供了一种服务提供商设备，包括：
接收单元，用于接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据；
确定单元，用于根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
处理单元，用于根据所述优先级为所述终端开启相应的服务。
第六方面，提供了一种用于用户身份认证的设备，包括：
接收单元，用于从服务提供商SP设备获取用户请求，所述用户请求包括所述用户的身份凭据；
确定单元，用于根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
发送单元，用于将所述用户的ID和所述身份凭据的优先级发送至所述SP设备，以便所述SP设备为所述用户开启相应的服务。
本发明实施例中，SP设备根据用户的身份凭据，提供相应的服务。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本发明一个实施例的用户身份认证的方法的流程图。
图2是本发明一个实施例的终端呈现的选择界面的示意图。
图3是本发明另一个实施例的用户身份认证的方法的流程图。
图4是本发明另一个实施例的用户身份认证的方法的流程图。
图5是本发明另一个实施例的用户身份认证的方法的流程图。
图6是本发明另一个实施例的用户身份认证的方法的流程图。
图7是本发明另一个实施例的用户身份认证的方法的流程图。
图8是本发明一个实施例的终端的结构框图。
图9是本发明另一个实施例的终端的结构框图。
图10是本发明一个实施例的SP设备的结构框图。
图11是本发明另一个实施例的SP设备的结构框图。
图12是本发明一个实施例的用于用户身份认证的设备的结构框图。
图13是本发明另一个实施例的用于用户身份认证的设备的结构框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
应注意，本发明实施例中，终端也可以称为用户设备(User Equipment，UE)，包括但不限于具有无线通信功能的设备。例如，终端可以为手持终端、车载设备、可穿戴设备、家用智能设备、传感器等能够使用通信服务的设备。 举例来说，可以为蜂窝电话，如智能手机等。
本发明实施例中，运营商可以通过服务提供商(Service Provider，SP)设备向用户提供服务。其中，所提供的服务包括但不限于：话音、视频、数据等传统通信服务，车联网、物联网、智能交通、智能家居、医疗监控、传感器网络等未来可能出现的服务。
图1是本发明一个实施例的用户身份认证的方法的流程图。图1中示出了终端11、SP设备12和身份认证服务器13。
本发明实施例中，假设终端11在初始状态未处于使用状态，即没有任一用户使用终端11接入移动网络。或者，可以是该终端11处于出厂设置的状态，或者可以是第一用户初次使用该终端11。
S101，在第一用户准备使用终端11时，终端11呈现选择界面，用于第一用户选择运营商。
例如，终端11的界面可以显示第一列表(如图2所示为其中一例)，第一列表列出了多个运营商(如图2中示出了运营商A、运营商B和运营商C)。
S102，终端11接收第一用户输入的选择信息，该选择信息指示第一用户所选择的运营商。
具体地，第一用户可以在S101所呈现的选择界面中选择至少一个运营商。
举例来说，该选择信息可以是第一用户选择图2所示的运营商A，并点击“确定”按钮。
举例来说，该选择信息也可以是第一用户选择图2所示的运营商A和运营商C，并点击“确定”按钮。
S103，终端11呈现可支持的身份凭据列表。
本发明实施例中，身份凭据是一种用户的身份的表征。身份凭据可以包括首要(primary)凭据和次级(secondary)凭据。其中，首要凭据可以包括如下的至少一种：DNA、指纹、虹膜、声纹等。次级凭据可以包括如下的至少一种：数字证书、数字签名、用户卡、口令等。并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的标识(Identifier，ID)。
本发明实施例中，不同的身份凭据可以具有不同的优先级。首要凭据的 优先级可以高于次级凭据的优先级。并且，具体地可以将DNA作为最高优先级，将指纹作为第二优先级，将虹膜作为第三优先级，将声纹作为第四优先级，…将口令作为最低优先级。
这里，DNA可以通过采集血液或者唾液等确定。指纹可以是多个手指的指纹信息，或者一个手指的指纹信息，或者可以是一个手指的部分指纹信息；并且，多个手指的指纹的优先级可以高于一个手指的指纹的优先级。虹膜可以是双眼或单眼的虹膜。
举例来说，用户卡可以是SIM卡。口令可以是长字符串或短字符串，或者也可以是在图形上运动的顺序。
可理解，由于不同的终端的硬件差异，所能够支持输入的用户凭据也会有所不同。例如，有的终端可以通过摄像头采集用户的虹膜信息；有的终端可以通过特定区域采集用户的指纹信息；等等。未来有的终端也可以通过特定的方式收集血液或唾液等进行DNA识别。
因此，S103中终端11呈现的用户凭据列表与该终端11的硬件属性等有关。
应注意，本发明实施例中，该步骤S103是可选的，非必须的。例如，终端11为该第一用户所有，其他用户只能在第一用户的同意或授权之后才能使用，并且第一用户对该终端11的属性(和对应的服务)已经很熟悉，那么第一用户可以设置该终端11不再呈现支持的身份凭据列表。
S104，终端11接收第一用户输入的身份凭据。
举例来说，第一用户可以通过终端11的键盘或者触摸屏输入口令。或者，第一用户可以通过终端11的指纹采集模块输入指纹。或者，第一用户可以通过终端11的摄像头输入虹膜。或者，第一用户可以通过麦克输入声纹。等等。
本发明实施例中，终端11不限定只由一个用户使用，即可以有多个用户通过该终端11接入移动网络。那么，终端11可以为不同的用户分配各自独立的存储区域。例如，终端11内部可以具有多个物理上或者逻辑上独立的存储区域，分别用于存储不同用户的信息。
具体地，终端11可以为第一用户分配第一存储区域，用于存储该第一用户的身份凭据。并在通过认证之后，用于存储第一用户的用户数据(包括用户界面)和服务信息等。
S105，终端11将第一用户的身份凭据发送至SP设备12。
可理解，SP设备12为S102中第一用户所选择的运营商的SP设备。
举例来说，如果第一用户在S102选择的运营商为运营商A，那么SP设备12即为运营商A的SP设备。举例来说，如果第一用户在S102选择的运营商为运营商A和运营商B，那么SP设备12包括运营商A的SP设备和运营商B的SP设备。
可选地，如果第一用户的身份凭据的优先级比较高，例如为DNA或虹膜等，那么终端11可以先采用生成方法对第一用户的身份凭据进行处理，然后再将处理后的身份凭据发送至SP设备12。也就是说，终端11不直接传输DNA、指纹、虹膜、声纹等用户身份凭据的原始数据，而是传输经过某种产生方法(例如使用某种单向映射的算法)进行处理后的数据。这样，用户可以保护自己的隐私不被运营商或者其他截获传输数据的第三方(如黑客)非法获取。
这里的产生方法可以理解为一种加密的方法。并且，采用产生方法之后生成的可以为较低优先级的形式。例如，针对DNA，采用生成方法处理后的可以为长度为30的字符串。针对指纹，采用生成方法处理后的可以为长度为25的字符串。
S106，SP设备12将第一用户的身份凭据发送至身份认证服务器13。
可选地，作为一例，身份认证服务器13可以是由服务提供者(如运营商)搭建并维护的。也就是说，不同的运营商分别搭建并维护各自的身份认证服务器。
可选地，作为另一例，身份认证服务器13可以是用户、运营商之外的第三方搭建的；例如，第三方可以为其他商定的第三方机构。例如，第三方可以为政府主管部门，也就是说，身份认证服务器13可以为政府主管部门进行搭建并维护的。这样，能够保证用户的身份凭据的安全性。
若身份认证服务器13是由第三方搭建的，那么，该身份认证服务器13可以由至少一个运营商进行访问。这里，为了保证用户的身份凭据的安全性，可以设置运营商访问身份认证服务器13的权限。
可选地，在S106中，SP设备12可以将第一用户的身份凭据进行再次处理后发送至身份认证服务器13，例如，可以增加自身的数字签名或加密。这样，不仅可以向身份认证服务器13表明消息的来源，还可以保证SP设备 12与身份认证服务器13之间的安全通信。可理解，SP设备12所使用的数字签名或加密的方法等是SP设备12与身份认证服务器13预先约定的。
可理解，若在S105中，SP设备12从终端11接收到的是采用产生方法处理后的身份凭据，那么，在S106中，SP设备12也将采用产生方法处理后的身份凭据发送至身份认证服务器13。或者，在S106中，SP设备可以将采用产生方法处理后的身份凭据进行再次处理(增加自身的数字签名或加密)后再发送至身份认证服务器13。由于SP设备12不知道终端11所采用的产生方法，或者，即使SP设备12知道产生方法却不知道用于加密的密钥，因此SP设备12无法进行解密操作，从而SP设备12无法获取第一用户的优先级较高的身份凭据，这样能够提高身份凭据的安全性。
例如，第一用户输入终端11的身份凭据为DNA特征信息，SP设备12从终端11获取的处理后的身份凭据为长度为30的字符串。相应地，SP设备12将长度为30的字符串发送至身份认证服务器13，或者SP设备12将长度为30的字符串再次处理后发送至身份认证服务器13。
S107，身份认证服务器13根据第一用户的身份凭据，确定与该身份凭据对应的第一用户的标识(Identifier，ID)以及该身份凭据的优先级。
其中，第一用户的ID可以为权威机构颁发的证明，例如可以为第一用户的身份证号码或者护照号码等。
本发明实施例中，身份认证服务器13中存储有用户的ID与用户身份凭据以及身份凭据的优先级之间的对应关系。也就是说，身份凭据与其他证明之间的身份捆绑认证的信息存储在身份认证服务器13中。
举例来说，如表一所示，假设身份认证服务器13在S106中收到的身份凭据为DNA1，那么，用户认证服务器13可以确定对应的标识为ID1，对应的优先级为P1。
表一
优先级 P1 P2 P3 P4 …… P9
ID1 DNA1 指纹1 虹膜1 声纹1 …… 口令
如果身份认证服务器13接收到的处理后的身份凭据(终端11采用产生方法处理后的身份凭据)，那么，在S107中，身份认证服务器13可以先采用验证方法恢复出身份凭据，然后再确定对应的优先级和用户的ID。可理 解，验证方法为一种解密的方法。并且，SP设备12无法获取该验证方法。
可理解，本发明实施例中，产生方法和验证方法是终端11与身份认证服务器13事先约定的。例如，产生方法可以是终端11出厂设置所包括的。
可选地，在另一实施例中，如果身份认证服务器13接收到的不是DNA、指纹、声纹、虹膜等身份凭据的原始数据，而是终端11经产生方法处理后的序列，那么身份认证服务器13可以根据经产生方法处理后的特征序列确定用户的ID已经身份凭据的优先级。例如，身份认证服务器13中也可以存储产生方法。身份认证服务器13可以将DNA、指纹、声纹、虹膜等原始数据采用产生方法生成特征序列。这样，身份认证服务器13可以将该特征序列与接收到的序列进行比对，从而能够确定接收到的身份凭据的优先级以及对应的用户的ID。
另外，本发明实施例中，身份认证服务器13可以从特定部分获取用户的身份凭据，或者，也可以由用户主动上传身份凭据。假设身份认证服务器13是由政府主管部门进行搭建并维护的，那么，政府主管部门可以从公安部门获取用户的指纹与身份证号码/护照号码之间的对应关系等，可以从特定的医院获取用户的DNA和虹膜特征信息与身份证号码/护照号码之间的对应关系等，可以由用户自己上传用户卡和口令等。
S108，身份认证服务器13将身份凭据的优先级和第一用户的ID发送至SP设备12。
这样，SP设备12可以根据第一用户的ID获取用户的注册信息。其中，注册信息也称为签约信息。
可理解，第一用户需要在运营商进行注册之后才可以使用运营商提供的服务。在本发明实施例之前，第一用户已经在运营商进行了签约服务。例如，第一用户可以在签约的时候，选择运营商提供的至少一种服务，并可以设置至少一种服务分别所需的用户凭据。例如，第一用户可以选择或不选择国际漫游服务。第一用户可以与运营商约定国际漫游服务所需的用户凭据为指纹。
S109，SP设备12为终端11开启相应的服务。
SP设备12中存储有身份凭据的优先级与可用服务之间的对应关系。其中，该对应关系也可以理解为签约信息。
例如，该对应关系可以包括：口令对应的服务包括部分通话；用户卡对 应的服务包括短信和全部通话；……，指纹对应的服务包括短信、全部通话和一定阈值下的网络流量；……，DNA对应的服务包括所有可用的服务；等等。这里不再一一罗列。
也就是说，用户只有输入了相应的或者更高优先级的身份凭据才能使用对应的服务。如果用户输入的身份凭据的优先级低于服务对应的身份凭据的优先级，那么，终端11可以拒绝用户使用服务。
具体地，S108之后，SP设备12可以根据第一用户的ID获取第一用户的签约信息，进一步地，可以根据签约信息确定与身份凭据的优先级对应的服务。从而可以在S109中为第一用户所使用的终端11开启对应的服务。
具体地，运营商所支持的服务可以分为不同的等级，例如，服务的等级可以根据服务的重要性或者服务的资费等进行划分。
运营商可以设置不同等级的服务所需的身份凭据。举例来说，运营商可以设置如下规则：1.用户需要最高优先级的身份凭据(例如，DNA)才可以修改注册时选择的服务；2.用户需要第二优先级的身份凭据(例如，指纹)才可以使用国际漫游通话服务。
该规则可以通过身份凭据的优先级与可用服务之间的对应关系来表示。并且，运营商可以将该对应关系预先存储在SP设备12中，这样，在S109中，SP设备12可以根据该对应关系确定相应的服务，并为终端11开启该相应的服务。
可选地，在S108之后，SP设备12也可以将身份凭据的优先级与第一用户的ID发送至终端11(图1中未示出)，这样，终端11可以将身份凭据，身份凭据的优先级与第一用户的ID之间的对应关系进行存储，具体地，可以存储在第一存储区域。
在S109之后，第一用户便可以通过终端11接入运营商的网络，并且能够使用与第一用户输入的身份凭据对应的服务。
可理解，在此过程中，第一用户可以使用S109中所开启的服务。如果第一用户想要使用该所开启的服务之外的其他服务，那么，终端11可以显示拒绝告警或者提示第一用户需要输入高优先级的身份凭据。
举例来说，假设第一用户在S104中输入的身份凭据为口令，且在S109中所开启的服务包括本地通话。如果第一用户想要使用国际漫游通话，那么终端11可以呈现告警界面，拒绝第一用户的国际漫游通话的服务请求；或 者，终端11可以呈现指示信息界面，指示第一用户需要高优先级的身份凭据“指纹”才可以使用该服务。
可选地，作为一个实施例，SP设备12中可以预存储一部分用户凭据的优先级的信息，例如，可以预存储用户ID与用户身份凭据(优先级较低的部分用户凭据)以及身份凭据的优先级之间的部分对应关系。
这样，在S105之后，SP设备12可以首先判断该SP设备12上是否有预存储的部分对应关系。如果SP设备12没有存储部分对应关系，或者，如果SP设备12无法根据该部分对应关系确定身份凭据的优先级以及用户的ID，那么，在S105之后，继续执行S106。
如果SP设备12可以根据该部分对应关系确定身份凭据的优先级以及用户的ID，那么，在S105之后，SP设备12可以根据该部分对应关系进行认证，且在认证之后直接执行S109(即，无需执行S106至S108)。这样，能够提高用户进行认证的效率。
本发明实施例中，假设SP设备12所在的运营商为运营商A。在S109之后，第一用户通过终端11接入到运营商A的网络，并且可以通过终端11使用运营商A提供的服务。
在该过程中，还可以进一步包括：SP设备12根据第一用户的服务使用情况，进行计费。具体地，不同的服务类型可以采用不同的计费方式，例如，可以按次(session based)计费，可以按时长计费，可以按所使用的网络资源(如流量)计费，可以按使用资源的类型计费等，本发明对此不作限定。
其中，按照使用资源的类型计费可以包括：优先级资源(如紧急通话)费用较高；广播类型的资源计费方式不同于单播(unicast)类型的资源计费方式，等等。
可选地，SP设备12可以通过计费控制装置、策略与计费执行功能(Policy and Charging Enforcement Function，PCEF)、策略与计费规则功能(Policy and Charging Rules Function，PCRF)等进行计费。
可选地，用户可以在统一计费服务器设置与该用户的ID对应的计费账户。其中，用户的ID与计费账户一一对应。这样，不同的运营商均可以使用该计费账户，从而能够节省用户开销，减轻了用户缴费的压力，避免了用户由于忘记缴费导致停机带来的麻烦。
具体地，SP设备12可以向该统一计费服务器发送计费请求，该计费请 求包括所述ID，并由所述统一计费服务器从用户的计费账户进行计费。
进一步地，在该过程中，如果第一用户想要使用其他运营商的服务(例如运营商B)，此时，在图1所示的方法之后还可以包括(图1中未示出)：
S110，终端11接收第一用户的特定指令，该特定指令指示需要重新选择运营商。
具体地，第一用户可以通过终端11的特定按钮重新选择运营商，例如，第一用户可以通过终端11的特定菜单使得终端11显示如图2所示的界面。即在S110之后，可以执行S101和S102。假设在该S102中，第一用户再次选择的运营商为运营商B。
举例来说，假设某种服务S1只由运营商B提供，或者第一用户只在与运营商B进行签约时包括服务S1。则在S109之后，若第一用户想要使用服务S1，终端11会提示拒绝的告警信息。此时，可以执行S110，即第一用户可以通过终端11重新选择运营商。
本发明实施例中，在S109之后，第一用户在服务使用过程中，可以在终端11的“服务设置”菜单中设置某些服务所连接的运营商。并且，该信息可以存储在终端11的第一存储区域中，这样，第一用户可以在后续利用该设置使用某些服务。例如，第一用户可以设置服务S1使用的运营商的顺序为：运营商B、运营商A、运营商C。这样，服务S1优先使用运营商B，只有在运营商B连接失败(如无信号)时才使用运营商A，在运营商B和运营商A都连接失败时才使用运营商C。例如，第一用户可以设置服务S2使用的运营商的顺序为：运营商A、运营商C。
可见，第一用户在使用终端11的过程中，不同的服务可以是不同的运营商所提供的。也就是说，第一用户可以同时使用多个运营商提供的服务。
S111，终端11将第一用户的身份凭据发送至运营商B的SP设备。
可理解，第一用户的身份凭据是终端11在S104中所获取的，且存储在终端11的第一存储区域中的。或者，该第一用户的身份凭据可以是第一用户在S110之后重新输入的。例如，如果只由运营商B提供的服务S1所需的身份凭据为DNA，那么，在S111之前，第一用户可以输入DNA。
在此之后，运营商B的SP设备可以执行与SP设备12类似的过程，这里不再赘述。
可选地，作为一例，在上述所示的方法之后，还可以包括：终端11接 收第一用户的临时退出指令。该临时退出指令指示第一用户暂时不再使用该终端11，并需临时冻结(suspend)该第一用户的相关信息。随后，终端11可以根据该临时退出指令，将第一用户的用户数据进行冻结。也就是说，该第一用户的用户数据处于不活动状态。其中，用户数据可以包括用户的profile、用户的应用程序(Application，APP)以及用户的用户界面等。
当后续第一用户需要继续使用终端11时，第一用户可以输入激活指令。也就是说，终端11可以接收第一用户的激活指令，并将冻结的该第一用户的用户数据激活。具体地，终端11可以根据激活的用户数据，加载该第一用户的profile，并呈现第一用户的用户界面。其中，该用户界面可以呈现第一用户的APP信息。
对于第一用户通过临时退出指令冻结的终端11，第一用户再次使用时，如图3所示，可以包括如下步骤：
S201，终端11接收第一用户输入的激活指令。
其中，该激活指令可以是第一用户的身份凭据，例如为身份凭据P1。
S202，终端11获取第一用户的ID以及身份凭据P1的优先级。
可选地，如果终端11中存储有第一用户的身份凭据P1的信息，那么，S202中，终端11可以根据存储的信息确定该第一用户的ID以及输入的身份凭据P1的优先级。
举例来说，若终端11的第一存储区域存储有相关的信息，那么，终端11可以自行确定第一用户的ID以及输入的身份凭据P1的优先级。
可选地，如果终端11中没有存储第一用户的身份凭据P1的信息(例如终端11只存储有身份凭据P2的信息)，那么，终端11在S201之后可执行S105的步骤并从SP设备获取该第一用户的ID以及身份凭据P1的优先级。具体的描述如前所述，这里不再赘述。
S203，终端11根据第一用户的ID，获取第一存储区域中的用户信息。
这里，第一存储区域如前所述，为终端11为第一用户分配的独立的存储区域。
具体的，S203中，终端11呈现第一存储区域所存储的第一用户的用户界面(User Interface，UI)，并且UI可显示第一用户的APP等。
S204，第一用户通过终端11再次进行数据通信。
另外，如果第一用户在前述的S109之后通过“服务设置”菜单设置了服 务所使用的供应商(或运营商的顺序)，那么，在S204中第一用户可以直接根据先前的设置使用服务。
可选地，假设第一用户想要使用服务S2，而服务S2所需的身份凭据为P2。如果第一用户在S201输入的身份凭据S1的优先级低于身份凭据P2的优先级，那么，终端11可以拒绝第一用户使用服务S2。或者，终端11可以呈现通知消息以便第一用户输入身份凭据P2。或者，终端11可以呈现选择界面以便用户决定是否将第一存储区域中所存储的身份凭据P2(如果存储的话)发送至提供服务S2的运营商的SP设备。本发明对此不作限定。
可选地，作为另一例，在上述所示的方法之后(S109之后或者S204之后)，还可以包括：终端11接收第一用户的永久停用指令。随后，终端11可以根据该永久停用指令，删除第一用户的用户数据。也就是说，终端11可以根据永久停用指令，将第一存储区域中的信息全部删除。
可理解，在此之后，如果第一用户再次使用该终端11，其过程与第一用户首次使用该终端11的流程相同，这里不再赘述。
举例来说，如果第一用户在某公共场所(如图书馆、网吧等地)使用公共设备，那么可以在使用之后输入永久停用指令以及时清除个人数据，这样能够保证用户数据的安全性。
可理解，在第一用户临时退出或者永久停用该终端11之后，另一用户(例如第二用户)可以使用该终端11接入数据通信网络。其中，第二用户使用该终端11的过程与第一用户的过程类似，这里不再赘述。
可选地，在第一用户使用终端11的过程中，第二用户也可以通过类似的方式使用该终端11。并且第一用户的用户数据存储在第一存储区域，第二用户的用户数据存储在第二存储区域。也就是说，终端11可以同时由多个用户使用。
举例来说，终端11可以将显示屏(如触摸屏)划分为两部分，分别呈现第一用户的UI和第二用户的UI。第一用户和第二用户分别通过各自的UI使用该终端。
举例来说，终端11可以将显示屏呈现第一用户的UI，第二用户的UI在后台运行。第一用户可以通过其UI使用该终端，第二用户可以通过蓝牙使用该终端进行通话等。
应注意，本发明实施例中，终端11可以由多个用户使用，并且，多个 用户的用户数据分别存储在终端11中的各自独立的存储区域中。也就是说，不同用户的用户数据是分别进行存储的，一般地，某个用户无法访问其他用户的用户数据。但是，经过授权的用户数据可以由其他的用户进行访问。
举例来说，第一用户可以授权将其用户数据中的一部分(如用户数据块DATA1)的权限设置为公开，这样，其他的用户可以访问该授权的用户数据块DATA1。
举例来说，第一用户可以设置附条件的授权，例如，将用户数据中的一部分(如用户数据块DATA2)的权限设置为半公开，在设置过程中只允许部分用户(如可以通过限定用户的ID的方式)访问该用户数据块DATA2。这样，只有第一用户所限定的用户可以访问该用户数据块DATA2。
本发明实施例中，运营商将其提供的服务分成不同的等级，并且需要用户使用相应的身份凭据才能使用对应的服务。这样，用户可以使用身份凭据通过任何可用的终端接入运营商的网络，能够提高用户使用相应的服务的灵活性。
图4是本发明一个实施例的用户身份认证的方法的流程图。图4所示的方法由SP设备执行，包括：
S301，SP设备接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据。
S302，SP设备根据所述用户请求，确定所述用户的ID和所述身份凭据的优先级。
S303，SP设备根据所述优先级为所述终端开启相应的服务。
本发明实施例中，SP设备根据用户的身份凭据，提供相应的服务。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。
本发明实施例中，用户的身份凭据可以包括首要凭据和次级凭据。所述首要凭据的优先级高于所述次级凭据的优先级。
其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹。其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份 证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的ID。
本发明实施例中，各个不同的身份凭据可以设定优先级顺序，具体地可以参见前述图1的实施例中关于优先级的描述，这里不再赘述。
可选地，S302中，SP设备可以根据预存储的对应关系，确定与所述身份凭据对应的所述ID和所述优先级。
可选地，作为另一个实施例，在S302中，SP设备可以将所述用户请求发送至身份认证服务器，并接收所述身份认证服务器发送的所述ID和所述优先级。
其中，用户请求中的身份凭据可以是终端采用产生方法处理之后的身份凭据。
可选地，作为一个实施例，在S303中，SP设备可以确定与所述优先级对应的服务，其中，不同的优先级对应的服务不同，且高优先级所对应的服务包括低优先级所对应的服务；并为所述终端开启与所述优先级对应的服务。
可理解，SP设备中可以存储优先级与服务之间的对应关系。具体地，S303可以参见图1的实施例中S109的描述，为避免重复，这里不再赘述。
进一步地，在S303之后，SP设备可以根据用户的服务使用情况，进行计费。
具体地，SP设备可以向统一计费服务器发送计费请求，以便于所述统一计费服务器从所述用户的计费账户进行计费。其中，所述计费请求包括所述ID，且所述计费账户与所述ID一一对应。
这里，计费账户可以是用户预先设置在统一计费服务器中的，并且该计费账户可以由至少一个运营商的SP设备进行访问。
图5是本发明另一个实施例的用户身份认证的方法的流程图。图5所示的方法由身份认证服务器执行，包括：
S401，身份认证服务器从SP设备获取用户请求，所述用户请求包括所述用户的身份凭据。
S402，身份认证服务器根据所述用户请求，确定所述用户的ID和所述身份凭据的优先级。
S403，身份认证服务器将所述用户的ID和所述身份凭据的优先级发送 至所述SP设备，以便所述SP设备为所述用户开启相应的服务。
本发明实施例中，身份认证服务器从SP设备获取用户的身份凭据，并将与身份凭据对应的用户的ID以及身份凭据的优先级发给SP设备。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。
本发明实施例中，用户的身份凭据可以包括首要凭据和次级凭据。所述首要凭据的优先级高于所述次级凭据的优先级。
其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹。其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的ID。
本发明实施例中，各个不同的身份凭据可以设定优先级顺序，具体地可以参见前述图1的实施例中关于优先级的描述，这里不再赘述。
身份认证服务器可以是由运营商搭建并维护的，也可以是由其他商定的第三方机构进行搭建并维护的，本发明对此不作限定。其中，第三方例如为政府主管部门。
本发明实施例中，在S401中，用户请求中的身份凭据可以是终端采用产生方法处理之后的身份凭据。相应地，S402可以包括：采用验证方法，对所述身份凭据进行处理；根据预存储的对应关系，获取与处理后的身份凭据对应的所述ID和所述优先级。
其中，预存储的对应关系可以是由身份认证服务器从特定的部门获取的，或者，预存储的对应关系可以是由用户上传的，本发明对此不作限定。
可理解，S401可以参见前述图1的实施例中S106的描述，S402可以参见前述图1的实施例中S107的描述，S403可以参见前述图1的实施例中S108的描述，为避免重复，这里不再赘述。
图6是本发明另一个实施例的用户身份认证的方法的流程图。图6所示的方法由终端执行，包括：
S501，终端接收用户输入的身份凭据。
S502，所述终端根据所述身份凭据确定所述用户的ID和所述身份凭据的优先级。
S503，所述终端根据所述用户的ID，获取所述用户的签约信息。
S504，所述终端根据所述签约信息，确定与所述身份凭据的优先级对应的服务。
本发明实施例中，终端根据用户输入的身份凭据确定该用户的ID，进一步使得该用户能够使用与该身份凭据对应的服务，这样，能够提高用户体验。
本发明实施例中，身份凭据可以包括首要凭据和次级凭据。所述首要凭据的优先级高于所述次级凭据的优先级。
其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹。其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的ID。
本发明实施例中，各个不同的身份凭据可以设定优先级顺序，具体地可以参见前述图1的实施例中关于优先级的描述，这里不再赘述。
应注意，本发明实施例中，S501可以参见图3的实施例中的S201，即可以将S501中的身份凭据理解为是S201中的激活指令。S502可以参见图3的实施例中的S202，即终端可以根据存储的身份凭据、用户的ID与身份凭据的优先级之间的对应关系执行S202。S503可以参见图3的实施例中的S203，即终端可以预先从SP设备获取的签约信息。S504可以参见图3的实施例中的S204，即用户可以通过该终端使用与身份凭据(假设为P1)对应的服务。
进一步地，如果用户想要使用其他的服务，那么，可包括：终端接收所述用户的服务请求；如果所述服务请求指示的服务(假设为第一服务)不属于与所述身份凭据的优先级对应的服务，那么终端可以拒绝所述用户对第一服务的服务请求。例如，终端可以呈现提示信息，所述提示信息用于指示所述用户输入与第一服务对应的另一身份凭据。
也就是说，用户只有输入了对应的身份凭据，才能使用相应的服务。一般地，优先级高的身份凭据对应的服务包括优先级低的身份凭据对应的服务。
可选地，该终端可以同时由至少两个用户使用。终端可以接收另一用户输入的身份凭据(假设为P2)，进一步地，终端可以确定与另一用户输入的身份凭据(P2)对应的另一服务(假设为第二服务)。这样，另一用户可以通过该终端使用该另一服务(第二服务)。
其中，另一用户使用该终端的过程与前述的用户使用该终端的过程类似，这里不再赘述。
举例来说，终端可以将显示屏(如触摸屏)划分为两部分，用于分别呈现两个用户的UI。这两个用户分别通过各自的UI使用该终端。
举例来说，终端可以将显示屏呈现一个用户的UI，另一用户的UI在后台运行。一个用户可以通过其UI使用该终端，另一用户可以通过蓝牙使用该终端进行通话等。
可理解，在图6所示的方法之前，还可以包括：终端获取身份凭据、用户的ID和身份凭据的优先级之间的第一对应关系。终端获取用户的ID与用户的签约信息之间的第二对应关系。终端获取身份凭据的优先级与服务之间的第三对应关系。
可选地，在图6所示的方法之前，还可以包括如下步骤，如图8所示：
S511，终端接收所述用户输入的第一选择信息，所述第一选择信息指示所述用户所选择的第一运营商。
S512，终端接收所述用户输入的用户请求，所述用户请求包括所述用户的身份凭据。
S513，终端将所述用户请求发送至所述第一运营商的第一SP设备。
这样，终端通过用户的身份凭据，经由SP设备进行身份认证，能够由SP设备为用户提供相应的服务。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。
本发明实施例中，用户在初次使用终端时(即终端中未存储有该用户的用户信息)，终端可以为用户分配独立的存储区域，该独立的存储区域用于存储所述用户的身份凭据等。
也就是说，终端上可以包括多个物理上或逻辑上独立的存储区域，分别 用于存储不同用户的信息。
可选地，在S513之后，可以包括：在所述第一SP设备指示所述终端通过认证之后，通过所述第一SP设备访问所述第一运营商的网络。也就是说，用户可以通过该终端使用由第一运营商提供的服务。
可选地，在通过认证之后，终端可以接收所述第一SP设备发送的第一对应关系，所述第一对应关系包括所述用户的ID、所述身份凭据与所述身份凭据的优先级之间的对应关系。其中，该第一对应关系可以存储在为用户分配的独立的存储区域中。
可选地，在通过认证之后，终端可以通过所述第一SP设备获取所述用户的所述签约信息。其中，该签约信息可以存储在为用户分配的独立的存储区域中。这里，可以理解为所存储的为用户的ID与签约信息之间的对应关系。
可选地，在通过认证之后，终端可以接收所述第一SP设备发送的第二对应关系，所述第二对应关系包括所述身份凭据的优先级与所述服务之间的对应关系。其中，该第二对应关系可以存储在为用户分配的独立的存储区域中。
可选地，作为一个实施例，S513可以包括：采用预定义的产生方法对所述身份凭据进行处理；将所述处理后的身份凭据发送至所述第一SP设备。其中，关于产生方法的描述可以参见前述图1的实施例中的相关描述，这里不再赘述。
可理解，S511可以参见前述图1的实施例中S102的描述，S512可以参见前述图1的实施例中S104的描述，S513可以参见前述图1的实施例中S105的描述，为避免重复，这里不再赘述。
可选地，作为一例，在S513之后，还可包括：终端接收所述用户的指令，所述指令指示所述用户需要重新选择运营商；终端接收所述用户的第二选择信息，所述第二选择信息指示所述用户所选择的第二运营商；终端将所述用户请求发送至所述第二运营商的第二SP设备；在所述第二SP设备指示所述终端通过认证之后，所述终端通过所述第二SP设备访问所述第二运营商的网络。该过程可以参见前述的S110和S111所述，这里不再赘述。
也就是说，用户在使用终端的过程中，可以根据需求随时切换运营商，或者，用户可以同时使用多个运营商接入网络，这样能够提高用户体验。
可选地，作为另一例，在S513之后，还可包括：终端接收所述用户的临时退出指令；终端根据所述临时退出指令，将所述用户的用户数据进行冻结。
也就是说，用户可以临时冻结某终端，这样一方面可以保证用户的用户数据的安全性，另一方面可以由其他的用户使用该终端，提高了终端的利用率，实现了资源的更优利用。
如果后续终端接收到所述用户的激活指令；终端可以将所述冻结的用户数据进行激活。具体地，终端可以根据所述激活的用户数据，加载所述用户的profile并呈现所述用户的用户界面。具体的，这里的激活指令可以理解为是图6中S501中的身份凭据。
也就是说，用户可以随时再对终端解除冻结使其立即恢复使用。
可选地，作为另一例，在S503之后，还可包括：终端接收所述用户的永久停用指令；并且终端根据所述永久停用指令，删除所述用户的用户数据。
这样，如果用户只是临时使用某终端，可以在临时使用后永久停用，使得终端将用户数据进行删除，这样能够保证用户数据的安全性。
图8是本发明一个实施例的终端的结构框图。图8所示的终端700包括接收单元701、确定单元702和获取单元703。
接收单元701，用于接收用户输入的身份凭据。
确定单元702，用于根据所述身份凭据确定所述用户的标识ID和所述身份凭据的优先级。
获取单元703，用于所述用户的ID，获取所述用户的签约信息。
确定单元702，还用于根据所述签约信息，确定与所述身份凭据的优先级对应的服务。
本发明实施例中，终端根据用户输入的身份凭据确定该用户的ID，进一步使得该用户能够使用与该身份凭据对应的服务，这样，能够提高用户体验。
本发明实施例中，身份凭据可以包括首要凭据和次级凭据。所述首要凭据的优先级高于所述次级凭据的优先级。
其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹。其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的ID。
本发明实施例中，各个不同的身份凭据可以设定优先级顺序，具体地可以参见前述图1的实施例中关于优先级的描述，这里不再赘述。
本发明实施例中，终端700还可以包括发送单元和处理单元。
可选地，作为一个实施例，所述接收单元701，还可用于接收所述用户输入的第一选择信息，所述第一选择信息指示所述用户所选择的第一运营商、所述接收单元701，还可用于接收所述用户输入的用户请求，所述用户请求包括所述身份凭据。所述发送单元，可用于将所述用户请求发送至所述第一运营商的第一服务提供商SP设备。
可选地，作为另一个实施例，处理单元，可用于：在所述第一SP设备指示所述身份凭据通过认证之后，通过所述第一SP设备访问所述第一运营商的网络。
可选地，作为另一个实施例，所述接收单元701，还可用于：通过所述第一SP设备获取所述用户的所述签约信息。
可选地，作为另一个实施例，所述接收单元701，还可用于：接收所述第一SP设备发送的第一对应关系，所述第一对应关系包括所述用户的ID、所述身份凭据与所述身份凭据的优先级之间的对应关系。
可选地，作为另一个实施例，所述接收单元701，还可用于：接收所述第一SP设备发送的第二对应关系，所述第二对应关系包括所述身份凭据的优先级与所述服务之间的对应关系。
可选地，作为另一个实施例，所述发送单元，具体可用于：采用预定义的产生方法对所述身份凭据进行处理；将所述处理后的身份凭据发送至所述第一SP设备。
可选地，作为另一个实施例，所述接收单元701，还可用于接收所述用户的指令，所述指令指示所述用户需要重新选择运营商；还可用于接收所述用户的第二选择信息，所述第二选择信息指示所述用户所选择的第二运营商。所述发送单元，还可用于将所述用户请求发送至所述第二运营商的第二SP设备。所述处理单元，还可用于在所述第二SP设备指示所述终端通过认 证之后，通过所述第二SP设备访问所述第二运营商的网络。
可选地，作为另一个实施例，处理单元，还可用于为所述用户分配独立的存储区域，所述独立的存储区域用于存储所述用户的身份凭据。
可选地，作为另一个实施例，所述接收单元701，还可用于接收所述用户的临时退出指令。所述处理单元，还可用于根据所述临时退出指令，将所述用户的用户数据进行冻结。
可选地，作为另一个实施例，所述处理单元，还可用于：根据所述身份凭据，加载所述用户的profile并呈现所述用户的用户界面。
可选地，作为另一个实施例，所述接收单元701，还可用于接收所述用户的服务请求。所述处理单元，可用于如果所述服务请求指示的服务不属于与所述身份凭据的优先级对应的服务，拒绝所述服务请求。
可选地，作为另一个实施例，所述处理单元，具体用于：呈现提示信息，所述提示信息用于指示所述用户输入与所述服务请求指示的服务对应的另一身份凭据。
可选地，作为另一个实施例，所述接收单元701，还可用于接收另一用户输入的用户凭据。所述确定单元702，还可用于确定与所述另一用户输入的身份凭据对应的另一服务，以使得所述另一用户通过所述终端使用所述另一服务。
可选地，作为另一个实施例，所述接收单元701，还可用于接收所述用户的永久停用指令。所述处理单元，还可用于根据所述永久停用指令，删除所述用户的用户数据。
应注意，本发明实施例中，接收单元701可以由接收器实现，发送单元可以由发送器实现，确定单元702、获取单元703和处理单元可以由处理器实现。如图9所示，终端800可以包括处理器801、接收器802、发送器803和存储器804。其中，存储器804可以用于存储用户信息，还可以用于存储处理器801执行的代码等。
具体的，可以是存储器804中的一个逻辑存储区域用于存储所述用户信息，包括用户的身份凭据、签约信息、用户界面等。
终端800中的各个组件通过总线系统805耦合在一起，其中总线系统805除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。
图8所示的终端700或图9所示的终端800能够实现前述图1、图3至 图7的实施例中由终端所实现的各个过程，为避免重复，这里不再赘述。
应注意，本发明上述方法实施例可以应用于处理器中，或者由处理器实现。处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本发明实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
图10是本发明一个实施例的SP设备的结构框图。图10所示的SP设备 900包括接收单元901、确定单元902和处理单元903。
接收单元901，用于接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据。
确定单元902，用于根据所述用户请求，确定所述用户的ID和所述身份凭据的优先级。
处理单元903，用于根据所述优先级为所述终端开启相应的服务。
本发明实施例中，SP设备根据用户的身份凭据，提供相应的服务。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。
本发明实施例中，用户的身份凭据可以包括首要凭据和次级凭据。所述首要凭据的优先级高于所述次级凭据的优先级。
其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹。其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的ID。
本发明实施例中，各个不同的身份凭据可以设定优先级顺序，具体地可以参见前述图1的实施例中关于优先级的描述，这里不再赘述。
本发明实施例中，SP设备900还可包括发送单元。
可选地，作为一个实施例，确定单元902，可具体用于：根据预存储的对应关系，确定与所述身份凭据对应的所述ID和所述优先级。
可选地，作为另一个实施例，确定单元902，可具体用于：将所述用户请求发送至身份认证服务器；接收所述身份认证服务器发送的所述ID和所述优先级。
可选地，作为另一个实施例，处理单元903，可具体用于：确定与所述优先级对应的服务，其中，不同的优先级对应的服务不同，且高优先级所对应的服务包括低优先级所对应的服务；为所述终端开启与所述优先级对应的服务。
可选地，作为另一个实施例，处理单元903，还可用于：根据所述用户 的服务使用情况，进行计费。
可选地，作为另一个实施例，发送单元，可用于：向统一计费服务器发送计费请求，以便于所述统一计费服务器从所述用户的计费账户进行计费。其中，所述计费请求包括所述ID，且所述计费账户与所述ID一一对应。
应注意，本发明实施例中，接收单元901可以由接收器实现，发送单元可以由发送器实现，确定单元902和处理单元903可以由处理器实现。如图11所示，SP设备1000可以包括处理器1001、接收器1002、发送器1003和存储器1004。其中，存储器1004可以用于存储用户的签约信息，还可以用于存储处理器1001执行的代码等。
SP设备1000中的各个组件通过总线系统1005耦合在一起，其中总线系统1005除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。
图10所示的SP设备900或图11所示的SP设备1000能够实现前述图1、图3至图7的实施例中由SP设备所实现的各个过程，为避免重复，这里不再赘述。
图12是本发明一个实施例的用于用户身份认证的设备的结构框图。图12所示的设备1100包括：接收单元1101、确定单元1102和发送单元1103。
接收单元1101，用于从服务提供商SP设备获取用户请求，所述用户请求包括所述用户的身份凭据.
确定单元1102，用于根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级。
发送单元1103，用于将所述用户的ID和所述身份凭据的优先级发送至所述SP设备，以便所述SP设备为所述用户开启相应的服务。
本发明实施例中，身份认证服务器从SP设备获取用户的身份凭据，并将与身份凭据对应的用户的ID以及身份凭据的优先级发给SP设备。这样能够实现统一安全的身份认证方式，提高了易用性，并且能够实现资源的更优利用。
本发明实施例中，用户的身份凭据可以包括首要凭据和次级凭据。所述首要凭据的优先级高于所述次级凭据的优先级。
其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹。其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、 口令。
并且，身份凭据可以与其他证明进行身份捆绑认证。其中，其他证明例如可以为权威机构颁发的证明。举例来说，权威机构颁发的证明可以是身份证号码或者护照号码等。本发明实施例中，该其他证明可以作为第一用户的ID。
本发明实施例中，各个不同的身份凭据可以设定优先级顺序，具体地可以参见前述图1的实施例中关于优先级的描述，这里不再赘述。
本发明实施例中的设备1100可以为身份认证服务器。
可选地，作为一个实施例，所述身份凭据是终端采用产生方法进行处理后生成的。确定单元1102，可具体用于：采用验证方法，对所述身份凭据进行处理；根据预存储的对应关系，获取与处理后的身份凭据对应的所述ID和所述优先级。
可选地，作为另一个实施例，所述预存储的对应关系是由所述用户上传的。
可选地，作为另一个实施例，所述设备是由政府主管部门进行搭建并维护的，或者，所述设备是由运营商进行搭建并维护的。
应注意，本发明实施例中，接收单元1101可以由接收器实现，发送单元1103可以由发送器实现，确定单元1102可以由处理器实现。如图13所示，设备1200可以包括处理器1201、接收器1202、发送器1203和存储器1204。其中，存储器1204可以用于存储用户的身份凭据、用户的ID与身份凭据的优先级之间的对应关系，还可以用于存储处理器1201执行的代码等。
设备1200中的各个组件通过总线系统1205耦合在一起，其中总线系统1205除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。
图12所示的设备1100或图13所示的设备1000能够实现前述图1、图3至图7的实施例中由身份认证服务器所实现的各个过程，为避免重复，这里不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。

Claims (65)

  1. 一种用户身份认证的方法，其特征在于，包括：
    服务提供商SP设备接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据；
    所述SP设备根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
    所述SP设备根据所述优先级为所述终端开启相应的服务。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述用户请求，确定所述用户的ID和所述身份凭据的优先级，包括：
    根据预存储的对应关系，确定与所述身份凭据对应的所述ID和所述优先级。
  3. 根据权利要求1所述的方法，其特征在于，所述根据所述用户请求，确定所述用户的ID和所述身份凭据的优先级，包括：
    将所述用户请求发送至身份认证服务器；
    接收所述身份认证服务器发送的所述ID和所述优先级。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述根据所述优先级为所述终端开启相应的服务，包括：
    确定与所述优先级对应的服务，其中，不同的优先级对应的服务不同，且高优先级所对应的服务包括低优先级所对应的服务；
    为所述终端开启与所述优先级对应的服务。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    根据所述用户的服务使用情况，进行计费。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    向统一计费服务器发送计费请求，以便于所述统一计费服务器从所述用户的计费账户进行计费；
    其中，所述计费请求包括所述ID，且所述计费账户与所述ID一一对应。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述用户的身份凭据包括首要凭据和次级凭据；
    其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹；
    其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户 卡、口令。
  8. 根据权利要求7所述的方法，其特征在于，所述首要凭据的优先级高于所述次级凭据的优先级。
  9. 一种用户身份认证的方法，其特征在于，包括：
    身份认证服务器从服务提供商SP设备获取用户请求，所述用户请求包括所述用户的身份凭据；
    所述身份认证服务器根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
    所述身份认证服务器将所述用户的ID和所述身份凭据的优先级发送至所述SP设备，以便所述SP设备为所述用户开启相应的服务。
  10. 根据权利要求9所述的方法，其特征在于，所述身份凭据是终端采用产生方法进行处理后生成的，
    所述根据所述用户请求，确定所述用户的ID和所述身份凭据的优先级，包括：
    采用验证方法，对所述身份凭据进行处理；
    根据预存储的对应关系，获取与处理后的身份凭据对应的所述ID和所述优先级。
  11. 根据权利要求10所述的方法，其特征在于，所述预存储的对应关系是由所述用户上传的。
  12. 根据权利要求9至11任一项所述的方法，其特征在于，所述身份认证服务器是由政府主管部门进行搭建并维护的。
  13. 根据权利要求9至11任一项所述的方法，其特征在于，所述身份认证服务器是由运营商进行搭建并维护的。
  14. 根据权利要求9至13任一项所述的方法，其特征在于，所述身份凭据包括首要凭据和次级凭据；
    其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹；
    其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
  15. 根据权利要求14所述的方法，其特征在于，所述首要凭据的优先级高于所述次级凭据的优先级。
  16. 一种用户身份认证的方法，其特征在于，包括：
    终端接收用户输入的身份凭据；
    所述终端根据所述身份凭据确定所述用户的标识ID和所述身份凭据的优先级；
    所述终端根据所述用户的ID，获取所述用户的签约信息；
    所述终端根据所述签约信息，确定与所述身份凭据的优先级对应的服务。
  17. 根据权利要求16所述的方法，其特征在于，在所述终端接收用户输入的身份凭据之前，还包括：
    所述终端接收所述用户输入的第一选择信息，所述第一选择信息指示所述用户所选择的第一运营商；
    所述终端接收所述用户输入的用户请求，所述用户请求包括所述身份凭据；
    所述终端将所述用户请求发送至所述第一运营商的第一服务提供商SP设备。
  18. 根据权利要求17所述的方法，其特征在于，还包括：
    在所述第一SP设备指示所述终端的所述身份凭据通过认证之后，所述终端通过所述第一SP设备访问所述第一运营商的网络。
  19. 根据权利要求17或18所述的方法，其特征在于，还包括：
    所述终端通过所述第一SP设备获取所述用户的所述签约信息。
  20. 根据权利要求17至19任一项所述的方法，其特征在于，还包括：
    所述终端接收所述第一SP设备发送的第一对应关系，所述第一对应关系包括所述用户的ID、所述身份凭据与所述身份凭据的优先级之间的对应关系。
  21. 根据权利要求17至20任一项所述的方法，其特征在于，还包括：
    所述终端接收所述第一SP设备发送的第二对应关系，所述第二对应关系包括所述身份凭据的优先级与所述服务之间的对应关系。
  22. 根据权利要求17至21任一项所述的方法，其特征在于，所述将所述用户请求发送至所述第一SP设备，包括：
    采用预定义的产生方法对所述身份凭据进行处理；
    将所述处理后的身份凭据发送至所述第一SP设备。
  23. 根据权利要求17至22任一项所述的方法，其特征在于，还包括：
    所述终端接收所述用户的指令，所述指令指示所述用户需要重新选择运营商；
    所述终端接收所述用户的第二选择信息，所述第二选择信息指示所述用户所选择的第二运营商；
    所述终端将所述用户请求发送至所述第二运营商的第二SP设备；
    在所述第二SP设备指示所述终端通过认证之后，所述终端通过所述第二SP设备访问所述第二运营商的网络。
  24. 根据权利要求17至23任一项所述的方法，其特征在于，所述终端为所述用户分配独立的存储区域，所述独立的存储区域用于存储所述用户的身份凭据。
  25. 根据权利要求17至24任一项所述的方法，其特征在于，还包括：
    所述终端接收所述用户的临时退出指令；
    所述终端根据所述临时退出指令，将所述用户的用户数据进行冻结。
  26. 根据权利要求16所述的方法，其特征在于，还包括：
    所述终端根据所述身份凭据，加载所述用户的profile并呈现所述用户的用户界面。
  27. 根据权利要求16至26任一项所述的方法，其特征在于，还包括：
    所述终端接收所述用户的服务请求；
    如果所述服务请求指示的服务不属于与所述身份凭据的优先级对应的服务，所述终端拒绝所述服务请求。
  28. 根据权利要求27所述的方法，其特征在于，所述终端拒绝所述服务请求包括：
    所述终端呈现提示信息，所述提示信息用于指示所述用户输入与所述服务请求指示的服务对应的另一身份凭据。
  29. 根据权利要求16至28任一项所述的方法，其特征在于，还包括：
    所述终端接收另一用户输入的用户凭据；
    所述终端确定与所述另一用户输入的身份凭据对应的另一服务，以使得所述另一用户通过所述终端使用所述另一服务。
  30. 根据权利要求16至29任一项所述的方法，其特征在于，还包括：
    所述终端接收所述用户的永久停用指令；
    所述终端根据所述永久停用指令，删除所述用户的用户数据。
  31. 根据权利要求16至30任一项所述的方法，其特征在于，所述身份凭据包括首要凭据和次级凭据；
    其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹；
    其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
  32. 根据权利要求31所述的方法，其特征在于，所述首要凭据的优先级高于所述次级凭据的优先级。
  33. 一种终端，其特征在于，包括：
    接收单元，用于接收用户输入的身份凭据；
    确定单元，用于根据所述身份凭据确定所述用户的标识ID和所述身份凭据的优先级；
    获取单元，用于所述用户的ID，获取所述用户的签约信息；
    确定单元，还用于根据所述签约信息，确定与所述身份凭据的优先级对应的服务。
  34. 根据权利要求33所述的终端，其特征在于，还包括发送单元：
    所述接收单元，还用于接收所述用户输入的第一选择信息，所述第一选择信息指示所述用户所选择的第一运营商；
    所述接收单元，还用于接收所述用户输入的用户请求，所述用户请求包括所述身份凭据；
    所述发送单元，用于将所述用户请求发送至所述第一运营商的第一服务提供商SP设备。
  35. 根据权利要求34所述的终端，其特征在于，还包括处理单元，用于：
    在所述第一SP设备指示所述身份凭据通过认证之后，通过所述第一SP设备访问所述第一运营商的网络。
  36. 根据权利要求34或35所述的终端，其特征在于，所述接收单元，还用于：
    通过所述第一SP设备获取所述用户的所述签约信息。
  37. 根据权利要求34至36任一项所述的终端，其特征在于，所述接收单元，还用于：
    接收所述第一SP设备发送的第一对应关系，所述第一对应关系包括所 述用户的ID、所述身份凭据与所述身份凭据的优先级之间的对应关系。
  38. 根据权利要求34至37任一项所述的终端，其特征在于，所述接收单元，还用于：
    接收所述第一SP设备发送的第二对应关系，所述第二对应关系包括所述身份凭据的优先级与所述服务之间的对应关系。
  39. 根据权利要求34至38任一项所述的终端，其特征在于，所述发送单元，具体用于：
    采用预定义的产生方法对所述身份凭据进行处理；
    将所述处理后的身份凭据发送至所述第一SP设备。
  40. 根据权利要求34至39任一项所述的终端，其特征在于，还包括处理单元：
    所述接收单元，还用于接收所述用户的指令，所述指令指示所述用户需要重新选择运营商；
    所述接收单元，还用于接收所述用户的第二选择信息，所述第二选择信息指示所述用户所选择的第二运营商；
    所述发送单元，还用于将所述用户请求发送至所述第二运营商的第二SP设备；
    所述处理单元，用于在所述第二SP设备指示所述终端通过认证之后，通过所述第二SP设备访问所述第二运营商的网络。
  41. 根据权利要求34至40任一项所述的终端，其特征在于，还包括处理单元，用于为所述用户分配独立的存储区域，所述独立的存储区域用于存储所述用户的身份凭据。
  42. 根据权利要求34至41任一项所述的终端，其特征在于，还包括处理单元：
    所述接收单元，还用于接收所述用户的临时退出指令；
    所述处理单元，用于根据所述临时退出指令，将所述用户的用户数据进行冻结。
  43. 根据权利要求33所述的终端，其特征在于，还包括处理单元，用于：
    根据所述身份凭据，加载所述用户的profile并呈现所述用户的用户界面。
  44. 根据权利要求33至43任一项所述的终端，其特征在于，还包括处理单元：
    所述接收单元，还用于接收所述用户的服务请求；
    所述处理单元，用于如果所述服务请求指示的服务不属于与所述身份凭据的优先级对应的服务，拒绝所述服务请求。
  45. 根据权利要求44所述的终端，其特征在于，所述处理单元，具体用于：
    呈现提示信息，所述提示信息用于指示所述用户输入与所述服务请求指示的服务对应的另一身份凭据。
  46. 根据权利要求33至45任一项所述的终端，其特征在于：
    所述接收单元，还用于接收另一用户输入的用户凭据；
    所述确定单元，还用于确定与所述另一用户输入的身份凭据对应的另一服务，以使得所述另一用户通过所述终端使用所述另一服务。
  47. 根据权利要求33至46任一项所述的终端，其特征在于，还包括处理单元：
    所述接收单元，还用于接收所述用户的永久停用指令；
    所述处理单元，用于根据所述永久停用指令，删除所述用户的用户数据。
  48. 根据权利要求33至44任一项所述的终端，其特征在于，所述身份凭据包括首要凭据和次级凭据；
    其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹；
    其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
  49. 根据权利要求47所述的终端，其特征在于，所述首要凭据的优先级高于所述次级凭据的优先级。
  50. 一种服务提供商设备，其特征在于，包括：
    接收单元，用于接收终端发送的用户请求，所述用户请求包括所述用户的身份凭据；
    确定单元，用于根据所述用户请求，确定所述用户的标识ID和所述身份凭据的优先级；
    处理单元，用于根据所述优先级为所述终端开启相应的服务。
  51. 根据权利要求49所述的服务提供商设备，其特征在于，所述确定 单元，具体用于：
    根据预存储的对应关系，确定与所述身份凭据对应的所述ID和所述优先级。
  52. 根据权利要求49所述的服务提供商设备，其特征在于，所述确定单元，具体用于：
    将所述用户请求发送至身份认证服务器；
    接收所述身份认证服务器发送的所述ID和所述优先级。
  53. 根据权利要求49至51任一项所述的服务提供商设备，其特征在于，所述处理单元，具体用于：
    确定与所述优先级对应的服务，其中，不同的优先级对应的服务不同，且高优先级所对应的服务包括低优先级所对应的服务；
    为所述终端开启与所述优先级对应的服务。
  54. 根据权利要求49至52任一项所述的服务提供商设备，其特征在于，所述处理单元，还用于：
    根据所述用户的服务使用情况，进行计费。
  55. 根据权利要求53述的服务提供商设备，其特征在于，还包括发送单元，用于：
    向统一计费服务器发送计费请求，以便于所述统一计费服务器从所述用户的计费账户进行计费；
    其中，所述计费请求包括所述ID，且所述计费账户与所述ID一一对应。
  56. 根据权利要求49至54任一项所述的服务提供商设备，其特征在于，所述用户的身份凭据包括首要凭据和次级凭据；
    其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹；
    其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
  57. 根据权利要求55所述的服务提供商设备，其特征在于，所述首要凭据的优先级高于所述次级凭据的优先级。
  58. 一种用于用户身份认证的设备，其特征在于，包括：
    接收单元，用于从服务提供商SP设备获取用户请求，所述用户请求包括所述用户的身份凭据；
    确定单元，用于根据所述用户请求，确定所述用户的标识ID和所述身 份凭据的优先级；
    发送单元，用于将所述用户的ID和所述身份凭据的优先级发送至所述SP设备，以便所述SP设备为所述用户开启相应的服务。
  59. 根据权利要求57所述的设备，其特征在于，所述身份凭据是终端采用产生方法进行处理后生成的，
    所述确定单元，具体用于：
    采用验证方法，对所述身份凭据进行处理；
    根据预存储的对应关系，获取与处理后的身份凭据对应的所述ID和所述优先级。
  60. 根据权利要求58所述的设备，其特征在于，所述预存储的对应关系是由所述用户上传的。
  61. 根据权利要求57至59任一项所述的设备，其特征在于，所述设备是由政府主管部门进行搭建并维护的。
  62. 根据权利要求57至59任一项所述的设备，其特征在于，所述设备是由运营商进行搭建并维护的。
  63. 根据权利要求57至61任一项所述的设备，其特征在于，所述身份凭据包括首要凭据和次级凭据；
    其中，所述首要凭据包括如下的至少一种：DNA、指纹、虹膜、声纹；
    其中，所述次级凭据包括如下的至少一种：数字证书、数字签名、用户卡、口令。
  64. 根据权利要求62所述的设备，其特征在于，所述首要凭据的优先级高于所述次级凭据的优先级。
  65. 根据权利要求57至61任一项所述的设备，其特征在于，所述设备为身份认证服务器。
PCT/CN2015/090943 2015-09-28 2015-09-28 用户身份认证的方法及设备 WO2017054110A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP15905022.8A EP3316512B1 (en) 2015-09-28 2015-09-28 User identity authentication method and device
CN201580081100.4A CN107710673B (zh) 2015-09-28 2015-09-28 用户身份认证的方法及设备
US15/745,347 US10412585B2 (en) 2015-09-28 2015-09-28 User identity authentication method and device
PCT/CN2015/090943 WO2017054110A1 (zh) 2015-09-28 2015-09-28 用户身份认证的方法及设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/090943 WO2017054110A1 (zh) 2015-09-28 2015-09-28 用户身份认证的方法及设备

Publications (1)

Publication Number Publication Date
WO2017054110A1 true WO2017054110A1 (zh) 2017-04-06

Family

ID=58422501

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/090943 WO2017054110A1 (zh) 2015-09-28 2015-09-28 用户身份认证的方法及设备

Country Status (4)

Country Link
US (1) US10412585B2 (zh)
EP (1) EP3316512B1 (zh)
CN (1) CN107710673B (zh)
WO (1) WO2017054110A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10798645B2 (en) * 2018-06-15 2020-10-06 Juniper Networks, Inc. Extending subscriber services to roaming wireless user equipment
CN110472485A (zh) * 2019-07-03 2019-11-19 华为技术有限公司 识别身份的方法和装置
CN111552942B (zh) * 2020-04-27 2023-02-10 北京三快在线科技有限公司 身份认证方法、系统、装置及计算机存储介质
CN115460022B (zh) * 2022-11-11 2023-03-07 广州中长康达信息技术有限公司 一种对智能辅助平台的资源管理方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040030887A1 (en) * 2002-08-07 2004-02-12 Harrisville-Wolff Carol L. System and method for providing secure communications between clients and service providers
CN101567878A (zh) * 2008-04-26 2009-10-28 华为技术有限公司 提高网络身份认证安全性的方法和装置
CN101317362B (zh) * 2006-04-07 2012-01-04 华为技术有限公司 一种信息安全认证方法和系统

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060053296A1 (en) * 2002-05-24 2006-03-09 Axel Busboom Method for authenticating a user to a service of a service provider
ITRM20030100A1 (it) * 2003-03-06 2004-09-07 Telecom Italia Mobile Spa Tecnica di accesso multiplo alla rete, da parte di terminale di utente interconnesso ad una lan e relativa architettura di riferimento.
US8225385B2 (en) * 2006-03-23 2012-07-17 Microsoft Corporation Multiple security token transactions
KR100911983B1 (ko) 2006-04-07 2009-08-13 후아웨이 테크놀러지 컴퍼니 리미티드 정보 보안에 관한 인증을 구현하는 방법 및 시스템
CN101409880B (zh) 2007-10-09 2010-08-25 中国电信股份有限公司 跨通信网的帐户认证及密码管理系统和方法
CN101453328A (zh) * 2007-12-06 2009-06-10 中国移动通信集团公司 身份管理系统及身份认证系统
CN101442733A (zh) 2008-12-19 2009-05-27 华为技术有限公司 通信网络计费处理方法、装置和系统
CN102307097A (zh) 2011-09-02 2012-01-04 深圳中兴网信科技有限公司 一种用户身份认证方法及系统
CN103188076B (zh) 2011-12-27 2016-06-29 中国移动通信集团江苏有限公司 一种实现多终端统一认证的方法及系统
CN103209160B (zh) 2012-01-13 2018-05-08 中兴通讯股份有限公司 一种面向异构网络的认证方法及系统
TW201417598A (zh) * 2012-07-13 2014-05-01 Interdigital Patent Holdings 安全性關聯特性
US9043865B2 (en) * 2012-08-31 2015-05-26 Motorola Solutions, Inc. Prioritized token based arbiter and method
CN104717648B (zh) 2013-12-12 2018-08-17 中国移动通信集团公司 一种基于sim卡的统一认证方法和设备
US9305149B2 (en) 2014-02-07 2016-04-05 Bank Of America Corporation Sorting mobile banking functions into authentication buckets
US11297059B2 (en) * 2014-04-25 2022-04-05 Adobe Inc. Facilitating user-centric identity management
CN104469765B (zh) * 2014-07-28 2020-10-23 北京佰才邦技术有限公司 用于移动通信系统中的终端认证方法和装置
US9055062B1 (en) * 2014-08-08 2015-06-09 Google Inc. Per-user wireless traffic handling

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040030887A1 (en) * 2002-08-07 2004-02-12 Harrisville-Wolff Carol L. System and method for providing secure communications between clients and service providers
CN101317362B (zh) * 2006-04-07 2012-01-04 华为技术有限公司 一种信息安全认证方法和系统
CN101567878A (zh) * 2008-04-26 2009-10-28 华为技术有限公司 提高网络身份认证安全性的方法和装置

Also Published As

Publication number Publication date
US10412585B2 (en) 2019-09-10
CN107710673A8 (zh) 2018-08-03
EP3316512A4 (en) 2018-12-26
CN107710673B (zh) 2020-04-10
CN107710673A (zh) 2018-02-16
US20180270658A1 (en) 2018-09-20
EP3316512B1 (en) 2020-12-02
EP3316512A1 (en) 2018-05-02

Similar Documents

Publication Publication Date Title
US11729594B2 (en) Network access method, device, and system
US10341860B2 (en) Learned dual band WIFI network association
US9426132B1 (en) Methods and apparatus for rules-based multi-factor verification
US9215005B2 (en) Social cloud application-mediated mobile data hotspot sharing
KR20180110202A (ko) 모바일 디바이스에서의 사용자 인증 및 인간 의도 검증을 위한 방법 및 장치
JP6411629B2 (ja) 移動通信システムに用いられる端末認証方法及び装置
WO2017049598A1 (zh) 终端认证的方法及设备
US10305901B2 (en) System and method for multi-factor authentication
WO2017054110A1 (zh) 用户身份认证的方法及设备
EP3930361A1 (en) System and method for operating a user device with personalized identity module profiles
KR20160143333A (ko) 이중 채널을 이용한 이중 인증 방법
WO2016015510A1 (zh) 用于移动通信系统中的终端认证方法和装置
US11895251B2 (en) Mutual authentication with pseudo random numbers
US20140189789A1 (en) Method and apparatus for ensuring collaboration between a narrowband device and a broadband device
US11146402B2 (en) Non-repudiation method and system
US20240080317A1 (en) Use of QR codes in Online Encoding
CN117597958A (zh) 认证与授权方法、装置、通信设备及存储介质
CN117597959A (zh) 认证与授权方法、装置、通信设备及存储介质
CN117795905A (zh) Api调用者认证方法以及装置、通信设备及存储介质
CN117859127A (zh) Ue加入pin的方法及装置、通信设备及存储介质
CN117501728A (zh) 个人物联网pin基元凭证配置方法、装置、通信设备及存储介质
CN110545225A (zh) 一种本地和互联网的设备认证授权机制

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15905022

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15745347

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2015905022

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE