WO2017088634A1

WO2017088634A1 - Third-party application authentication method, authentication server, terminal and management server

Info

Publication number: WO2017088634A1
Application number: PCT/CN2016/104863
Authority: WO
Inventors: 高扬
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-11-27
Filing date: 2016-11-07
Publication date: 2017-06-01
Also published as: CN106817347A

Abstract

Disclosed are a third-party application authentication method, an authentication server, a terminal, and a management server. The method comprises: when a third-party login operation is performed, acquiring, by a third-party application in a terminal, and from a user identity information module of the terminal, identity verification information set for a user by an operator, and generating and transmitting an authentication request containing the identity verification information to a third-party authentication server for authentication; and transmitting, by the third-party authentication server, the authentication request to an operator-side user data management server to undergo the authentication. In the invention, when a third-party login is performed, authentication is performed by directly calling identity verification information assigned to a user by an operator from a terminal in cooperation with an operator-side user data management server. The identity verification information assigned to the user by the operator is information which can be used to authentically verify the user, such as a number for use in real-name authentication, thereby improving authentication security, and providing more secure and reliable real-name authentication for a third party while satisfying an open capability requirement of the operator.

Description

Third-party application authentication method, authentication server, terminal, and management server

Technical field

The present invention relates to the field of communications, and in particular, to a third-party application authentication method, an authentication server, a terminal, and a management server.

Background technique

The so-called third-party login is to use the existing account of the user on the third-party application platform to quickly complete the login or registration function of the application. The third-party application platform here is generally an application platform that already has a large number of users, such as Sina Weibo, QQ Space, WeChat, Facebook, Twitter, etc. in China.

To implement third-party login, you first need to choose a third-party application platform. For example, Sina Weibo and QQ space are good choices. These platforms have a large number of users, and open APIs for us to call. For example, the Weibo open platform encapsulates the Weibo login button, attention button, share button and other components that can be directly deployed on any website, which enables developers to lower the registration threshold of new users and realize the zero cost introduction and high quality content of social relationships. Rapid spread. Therefore, third-party login is very convenient. However, there is a serious problem with third-party application logins based on the Internet, such as Sina Weibo, QQ space, WeChat, and other foreign Facebook, Twitter, etc., that is, the security of third-party login will not be higher than the original. The security of the authentication platform is because the authentication information used by the above-mentioned third-party applications is rarely the information that can truly identify the user, and the real-name system cannot be implemented in the future. As a result, the security of using the third-party application login is reduced, and there is a security risk.

Summary of the invention

The main technical problem to be solved by the present invention is to provide a third-party application authentication method, an authentication server, a terminal, and a management server, which solves the problem that the existing third-party login security is low and there are security risks.

To solve the above technical problem, the present invention provides a third-party application authentication method, including:

The third-party application module of the terminal obtains the identity identification information set by the operator for the user from the user identity information module of the terminal;

The third-party application module generates an authentication request including the identity identification information and sends the authentication request to the third-party authentication server for authentication.

In an embodiment of the present invention, the method further includes:

The third-party application module receives authentication challenge information fed back by the third-party authentication server according to the authentication request;

Transmitting, by the third-party application module, the authentication challenge information to a user identity information module of the terminal;

The third-party application module receives the authentication challenge response information fed back by the user identity information module, and sends the authentication challenge response information to the third-party authentication server for re-authentication.

In an embodiment of the present invention, the acquiring, by the third-party application module, the identity information set by the operator for the user includes:

When the third-party application module is a third-party application module set by the operator, the identity identification information is directly obtained from the user identity information module of the terminal;

When the third-party application module is a third-party application module that is not set by the operator, the method sends an identity information acquisition request to the authentication proxy module of the terminal, and receives the identity identification information that is obtained by the authentication agent module and is obtained from the user identity information module. .

To solve the above technical problem, the present invention also provides a third-party application authentication method, including:

The third-party authentication server receives an authentication request sent by a third-party application from the terminal, where the authentication request includes the identity identification information set by the operator for the user;

The third-party authentication server sends the authentication request to the user data management server on the operator side for authentication.

In an embodiment of the present invention, the method further includes:

Receiving, by the third-party authentication server, the user data management server according to the authentication request Feedback authentication challenge information;

The third-party authentication server sends the authentication challenge information to the third-party application module of the terminal;

The third-party authentication server receives the authentication challenge response information fed back by the third-party application of the terminal, and sends the authentication challenge response information to the user data management server for authentication.

The user data management server receives an authentication request sent by a third-party authentication server, where the authentication request includes identity identification information set by the operator for the user;

The user data management server performs authentication according to the authentication request.

In an embodiment of the present invention, the user data management server performs authentication according to the authentication request, including:

Generating authentication challenge information according to the identity identification information in the authentication request;

Sending the authentication challenge information to the third-party authentication server;

The authentication challenge response information from the third-party authentication server is received for authentication.

To solve the above technical problem, the present invention further provides a terminal, including: a third-party application module, where the third-party application module includes an identity information acquiring sub-module and a first processing sub-module;

The information obtaining submodule is configured to obtain, from the user identity information module of the terminal, the identity identification information set by the operator for the user;

The first processing submodule is configured to generate an authentication request including the identity identification information according to the identity identification information, and send the authentication request to the third party authentication server for authentication.

In an embodiment of the present invention, the third-party application module further includes:

a challenge information obtaining submodule, configured to receive authentication challenge information fed back by the third party authentication server according to the authentication request;

An information forwarding submodule, configured to send the authentication challenge information to a user identity letter of the terminal Information module

The second processing sub-module is configured to receive the authentication challenge response information fed back by the user identity information module and send the authentication challenge information to the third-party authentication server for re-authentication.

To solve the above technical problem, the present invention also provides a third-party authentication server, including:

a request receiving module, configured to receive an authentication request sent by a third-party application from the terminal, where the authentication request includes the identity identification information set by the operator for the user;

The request sending module is configured to send the authentication request to the user data management server on the operator side for authentication.

In an embodiment of the present invention, the method further includes:

a challenge information receiving module, configured to receive authentication challenge information fed back by the user data management server according to the authentication request;

a challenge information sending module, configured to send the authentication challenge information to a third-party application of the terminal;

The response information receiving module is configured to receive the authentication challenge response information fed back by the third-party application of the terminal;

The response message sending module is configured to send the authentication challenge response information to the user data management server on the operator side for authentication.

To solve the above technical problem, the present invention also provides a user data management server, including:

The request obtaining module is configured to receive an authentication request sent by a third-party authentication server, where the authentication request includes the identity identification information set by the operator for the user;

The authentication processing module is configured to perform authentication according to the authentication request.

In an embodiment of the invention, the authentication processing module includes:

a challenge information generating submodule, configured to generate authentication challenge information according to the identity identification information in the authentication request;

a challenge information feedback sub-module, configured to send the authentication challenge information to the third-party authentication server;

The authentication submodule is configured to receive authentication challenge response information from the third party authentication server for authentication.

To solve the above technical problem, the present invention also provides a communication system, including a terminal, a third-party authentication server, and a user data management server;

The third-party application module of the terminal obtains the identity identification information set by the operator for the user from the user identity information module of the terminal, and generates an authentication request including the identity identification information and sends the authentication request to the third-party authentication server.

The third-party authentication server is configured to receive the authentication request and send it to a user data management server on the operator side;

The user data management server is configured to perform authentication according to the authentication request.

In an embodiment of the present invention, the authentication proxy server is further configured to process the authentication request format sent by the third-party authentication server into an internal message format of the operator network, and then send the format to the user data management server.

In an embodiment of the present invention, the user data management server is a home subscription user server; and/or the user identity information module is a user identification card module or an IP multimedia service identity module.

Another embodiment of the present invention provides a computer storage medium storing execution instructions for performing the method in the above embodiments.

The beneficial effects of the invention are:

The third-party application authentication method, the authentication server, the terminal, and the management server provided by the present invention, when using a third-party login, the third-party application in the terminal can obtain the identity identification information set by the operator for the user from the user identity information module of the terminal. Then, the authentication request including the identification information is sent to the third-party authentication server for authentication; the third-party authentication server sends the authentication request to the user data management server on the operator side for authentication. The invention is logged in at a third party The identity identification information assigned by the operator to the user is directly authenticated from the terminal, and the user data management server on the operator side is used for authentication; the identity identification information assigned by the operator to the user is information that can truly identify each user, for example, real-name authentication. The number and other user identity information can not only improve the security of the authentication, but also provide the third party with a safer, more reliable and real-name authentication, and also meet the needs of the operator's open capabilities.

DRAWINGS

1 is a flowchart of a terminal-side third-party authentication process according to Embodiment 1 of the present invention;

2 is a flowchart of a third-party server-side third-party authentication process according to Embodiment 1 of the present invention;

3 is a flowchart of a third-party authentication process on a user data management server side according to Embodiment 1 of the present invention;

4 is a schematic structural diagram of a communication system according to Embodiment 2 of the present invention;

FIG. 5 is a schematic structural diagram of a terminal according to Embodiment 2 of the present invention;

6 is a schematic structural diagram of a third-party application module in FIG. 5;

FIG. 7 is a schematic structural diagram of a third-party authentication server according to Embodiment 2 of the present invention;

8 is a schematic structural diagram of a user data management server according to Embodiment 2 of the present invention;

9 is a schematic structural diagram of a communication system based on an IMS architecture according to Embodiment 2 of the present invention;

10 is a flowchart of a third-party authentication process when an authentication proxy module is provided according to Embodiment 3 of the present invention;

FIG. 11 is a flowchart of a third-party authentication process when directly acquiring a user identity according to Embodiment 3 of the present invention;

FIG. 12 is a flowchart of a third-party authentication process when an authentication proxy module is provided based on an IMS architecture according to Embodiment 3 of the present invention;

FIG. 13 is a flowchart of a third-party authentication process when a user identity is directly obtained based on an IMS architecture according to Embodiment 3 of the present invention.

detailed description

When the third party logs in, the invention directly uses the identity identification information assigned by the operator for the user and the user data management server on the operator side to perform authentication, which can improve the security of the authentication, provide a safer, more reliable and real-name system for the third party. At the same time of certification, it also meets the needs of operators' openness. The present invention will be further described in detail below with reference to the accompanying drawings.

Embodiment 1:

In this embodiment, the identity information that the operator assigns to the user is generally built in the user identity information module of the terminal, so the third-party application module of the terminal (that is, various third-party application APPs) can directly The user identification information allocated by the operator to the user is obtained in the terminal; the user identification information in this embodiment refers to the identity information in the user that can truly identify the user. For example, the user identification information module may be a user identification card module (SIM module). The user identification information at this time may be each identity information in the user identification card module, such as a phone number, and the user identification card module also stores each Key information; for example, in an IMS (IP Multimedia Subsystem), the user identity information module may also be various identity information included in an IP multimedia service identity module (ISIM module), which is also Includes various key information.

The third-party application module in this embodiment may be various applications set by the operator in the terminal, or may be various applications set by the terminal manufacturer or other application providers or terminal users themselves in the terminal. For a third-party application module built in the operator, such an application can directly interact with the user identity information module in the terminal to obtain corresponding user identification information and corresponding key information; for a third party built by a non-operator The application module, the security level of the user identification information assigned by the operator to the user is extremely high, and the user is not directly able to obtain the user identity information module. Therefore, the terminal in this embodiment is also provided with an authentication agent module. The proxy module is configured to interact with the user identity information module to obtain user identification information, obtain a key, etc., and then forward it to a third-party application module.

After obtaining the identity information assigned by the operator to the user in the foregoing manner, the third-party application module may generate an authentication request including the identity identification information and send the authentication request to the third-party authentication server for authentication.

In this embodiment, the third-party authentication server generally does not have user data such as identification information allocated by the operator for the user, and has the capability of authenticating and authenticating the identity of the terminal user. Therefore, after receiving the authentication request, the third-party authentication server needs to authenticate with the user data management server (that is, the operator user data center) for managing user data on the carrier side.

For operators, they already have a user identity authentication mechanism. Therefore, if they can be opened to third parties, they can be platform-based for user authentication, which is more in line with the current needs of operators' openness and enhance the core competition of operators. force. After receiving the authentication request, the user data management server on the operator side can use the existing authentication mechanisms to perform authentication according to the identity identification information in the authentication request. Of course, the authentication mechanism used by the user data management server to perform authentication in this embodiment may be flexibly selected according to specific scenarios such as different operators or different protocols. For example, in the IMS network, the user data management server may be an HSS (Home Subscriber Server).

In addition, since the third-party application server is generally based on a protocol such as HTTP, and cannot directly communicate with the user data management server on the carrier side, an authentication proxy server may be added in this embodiment to implement the third-party application server and the user. The format conversion and forwarding of the interaction information between the data management servers, that is, the protocol conversion on both sides of the third-party application server and the user data management server, for example, converting the information of the HTTP-type protocol used by the third-party application server into an operation The information of the Diameter-like protocol inside the vendor is sent to the user data management server.

The following describes the execution process of the terminal, the third-party authentication server, and the user data management server in the authentication process.

Referring to FIG. 1 , the process of the terminal in the third-party application authentication process includes:

Step 101: The third-party application module of the terminal acquires the identity identification information set by the operator for the user from the user identity information module of the terminal.

When the third-party application module is a third-party application module set by a non-operator, authentication to the terminal is performed. The agent module sends an identity information obtaining request, and receives the identity identification information obtained by the authentication agent module and obtained from the user identity information module;

Step 102: The third-party application module generates an authentication request that includes the identity identification information and sends the authentication request to the third-party authentication server for authentication.

Step 103: The third-party application module receives the authentication challenge information fed back by the third-party authentication server according to the authentication request.

Step 104: The third-party application module sends the received authentication challenge information to the user identity information module of the terminal, so that the user identity information module generates the authentication challenge response information.

Step 105: The third-party application module receives the authentication challenge response information fed back by the user identity information module, and sends the authentication challenge response information to the third-party authentication server for re-authentication. Specifically, an authentication request including the authentication challenge response information may be reconstructed and sent to the third-party authentication server.

Step 106: The third-party application module receives the registration success message sent by the third-party authentication server.

Referring to FIG. 2, the execution process of the third-party authentication server in the third-party application authentication process includes:

Step 201: The third-party authentication server receives an authentication request sent by a third-party application from the terminal, where the authentication request includes the identity identification information set by the operator for the user.

Step 202: The third-party authentication server sends the authentication request to the user data management server on the operator side for authentication;

Step 203: The third-party authentication server receives the authentication challenge information fed back by the user data management server according to the authentication request.

Step 204: The third-party authentication server sends the authentication challenge information to the third-party application module of the terminal.

Step 205: The third-party authentication server receives the authentication challenge response information fed back by the third-party application of the terminal, and sends the authentication challenge response information to the user data management server for authentication.

Step 206: The third-party authentication server receives the authentication of the feedback from the user data management server. Gong news.

Referring to FIG. 3, the execution process of the user data management server in the third-party application authentication process includes:

Step 301: The user data management server receives an authentication request sent by a third-party authentication server, where the authentication request includes the identity identification information set by the operator for the user.

Step 302: The user data management server generates authentication challenge information according to the identity identification information in the authentication request.

Step 303: The user data management server sends the authentication challenge information to the third-party authentication server.

Step 304: The user data management server receives the authentication challenge response information from the third-party authentication server for authentication.

Step 305: The user data management server sends an authentication success message to the third-party authentication server when the authentication is successful.

In the above FIG. 2 and FIG. 3, the interaction of each message between the third-party application server and the user data management server is completed by the above-mentioned authentication proxy server. However, it should be understood that when the communication protocols used by the third-party application server and the user data management server are the same, the two can also directly interact, and there is no need to additionally set the authentication proxy server for format conversion and forwarding.

Embodiment 2:

Referring to FIG. 4, this embodiment provides a communication system, including a terminal 1, a third-party authentication server 2, and a user data management server 4;

The third-party application module of the terminal 1 obtains the identity identification information set by the operator for the user from the user identity information module of the terminal, and generates an authentication request including the identity identification information and sends the authentication request to the third-party authentication server.

The third-party authentication server 2 is configured to receive the authentication request and send it to the user data management server 4 on the operator side;

The user data management server 4 is configured to perform authentication according to the authentication request.

Since the communication protocol used by the third-party application server 2 and the user data management server 4 on the carrier side is different, the third-party application server 2 is generally based on a protocol such as HTTP, and cannot directly communicate with the user data management server on the carrier side. Therefore, in this embodiment, an authentication proxy server 3 may be added, which is configured to implement format conversion and forwarding of interaction information between the third-party application server 2 and the user data management server 4, that is, to perform a third-party application server and a user data management server. The protocol conversion on the side, for example, converts the information of the HTTP-type protocol used by the third-party application server into the information of the Diameter-like protocol of the operator, and sends the information to the user data management server.

The identification information that the operator assigns to the user is generally built in the user identity information module of the terminal 1. Therefore, the third-party application module of the terminal can directly obtain the user identification information allocated by the operator for the user from the terminal when logging in. The third-party application module in this embodiment may be various applications set by the operator in the terminal, or may be various applications set by the terminal manufacturer or other application providers or terminal users themselves in the terminal. For a third-party application module built in the operator, such an application can directly interact with the user identity information module in the terminal to obtain corresponding user identification information and corresponding key information; for a third party built by a non-operator The application module, the security level of the user identification information assigned by the operator to the user is extremely high, and the user is not directly able to obtain the user identity information module. Therefore, the terminal in this embodiment is also provided with an authentication agent module. The proxy module is configured to interact with the user identity information module to obtain user identification information, obtain a key, etc., and then forward it to a third-party application module. Therefore, as shown in FIG. 5, the terminal 1 in this embodiment includes a third-party application module 11, an authentication proxy module 12, and a user identity information module 13.

Referring to FIG. 6, the third-party application module 11 in this embodiment includes an identity information obtaining sub-module 111 and a first processing sub-module 112;

The information acquisition sub-module 111 is configured to obtain the identity identification information set by the operator for the user from the user identity information module 13 of the terminal; according to the analysis, it can be obtained directly from the user identity information module 13 or acquired by the authentication agent module 12;

The first processing sub-module 112 is configured to generate the identity identifier according to the identity identification information The authentication request of the other information is sent to the third-party authentication server 2 for authentication;

The challenge information obtaining sub-module 113 is configured to receive the authentication challenge information fed back by the third-party authentication server 2 according to the authentication request;

The information forwarding sub-module 114 is configured to send the authentication challenge information to the user identity information module of the terminal;

The second processing sub-module 115 is configured to receive the authentication challenge response information fed back by the user identity information module 13 and send it to the third-party authentication server 2 for re-authentication. Specifically, an authentication request including the authentication challenge response information may be reconstructed and sent to the third-party authentication server 2.

Referring to FIG. 7, the third-party authentication server 2 in this embodiment includes:

The request receiving module 21 is configured to receive an authentication request sent by the third-party application from the terminal 1, where the authentication request includes the identity identification information set by the operator for the user;

The request sending module 22 is configured to send an authentication request to the user data management server 4 on the operator side for authentication.

The challenge information receiving module 23 is configured to receive the authentication challenge information fed back by the user data management server 4 according to the authentication request;

The challenge information sending module 24 is configured to send the authentication challenge information to the third-party application of the terminal 1;

The response information receiving module 25 is configured to receive the authentication challenge response information fed back by the third party application of the terminal 1;

The response message sending module 26 is configured to send the authentication challenge response information to the user data management server 4 on the operator side for authentication.

Referring to FIG. 8, the user data management server 4 includes:

The request obtaining module 41 is configured to receive an authentication request sent by the third-party authentication server 2, where the authentication request includes the identity identification information set by the operator for the user;

The authentication processing module 42 is configured to perform authentication according to the authentication request. Optionally, the method includes:

The challenge information generation sub-module 421 is configured to generate information according to the identification information in the authentication request. Certified as challenge information;

The challenge information feedback sub-module 422 is configured to send the authentication challenge information to the third-party authentication server;

The authentication submodule 423 is configured to receive authentication challenge response information from a third party authentication server for authentication.

The interaction of each message between the third-party application server 2 and the user data management server 4 is completed by the above-described authentication proxy server 3. However, it should be understood that when the communication protocols adopted by the third-party application server 2 and the user data management server 4 are the same, the two can also directly interact, and there is no need to additionally set the authentication proxy server 3 for format conversion and forwarding.

As shown in FIG. 9, in the IMS network, the user identity information module 13 may be an IP multimedia service identity module 131 (ISIM module), and the user data management server 4 may be a home subscriber server 401 (Home Subscriber Server, Referred to as HSS).

Embodiment 3:

In order to better understand the present invention, the present invention will be further described below in conjunction with several specific application scenarios.

Referring to FIG. 10, the basic process for providing identity authentication to a third-party application of the telecommunication network proposed by the present invention includes:

Step 1001: A third-party application module (App) sends a telecommunications identity query request to the authentication proxy module.

Step 1002: The authentication proxy module interactively acquires the user identity from the user identity information module.

Step 1003: The authentication proxy module returns a telecommunications identity query response to the third-party application module (App).

Step 1004: The third-party application module (App) initiates a registration request to the third-party application server, and constructs an authentication request using the user identity obtained from the authentication proxy module.

Step 1005: The third-party application server forwards the authentication request to the authentication proxy server of the operator.

Step 1006: The authentication proxy server transforms the authentication request into an authentication request that can be identified by the user data management server inside the operator, and sends the authentication request to the user data management server inside the operator.

Step 1007: The user data management server inside the operator fails to perform authentication and carries the authentication challenge information of the user.

Step 1008: The third-party application server fails to register the user, including the challenge information obtained from the telecommunication network;

Step 1009: The third-party application module (App) receives the registration failure message, and sends the authentication challenge information to the authentication proxy module.

Step 1010: The authentication proxy module interacts with the user identity information module to generate an authentication challenge response message.

Step 1011: The authentication proxy module sends the challenge response to the third-party application module (App);

Step 1012: The third-party application module (App) reconstructs the registration request by using the challenge response message, and sends the registration request to the third-party application server.

Step 1013: The third-party application server sends an authentication request to the authentication proxy server according to the newly received registration request.

Step 1014: The authentication proxy server forwards the authentication request to the user data management server inside the operator.

Step 1015: The user data management server internal to the operator passes the authentication, and the authentication succeeds to the authentication proxy server.

Step 1016: The authentication proxy server forwards the authentication to the third-party application server.

Step 1017: The third-party application server successfully registers the user back.

Referring to FIG. 11, the interaction process of obtaining the identity of the user directly from the user identity information module is as follows:

Step 1101: A third-party application module (generally a native mode application or another application set by another operator) interacts with the user identity information module to obtain a user identity.

Step 1102: The third-party application module initiates a registration request to the third-party application server, and constructs the authentication information by using the user identity obtained from the authentication proxy module.

Step 1103: The third-party application server forwards the authentication request to the authentication proxy server of the operator.

Step 1104: The authentication proxy server transforms the authentication request into an authentication request that can be identified by the user data management server inside the operator, and sends the authentication request to the user data management server inside the operator.

Step 1105: The user data management server inside the operator fails to perform authentication and carries the authentication challenge information of the user.

Step 1106: The third-party application server fails to register the user, including the authentication challenge information obtained from the telecommunication network;

Step 1107: The third-party application module receives the registration failure message, and uses the challenge information to interact with the user identity information module to generate an authentication challenge response message.

Step 1108: The third-party application module reconstructs the registration request by using the authentication challenge response, and sends the registration request to the third-party application server.

Step 1109: The third-party application server sends an authentication request to the authentication proxy server according to the newly received registration request.

Step 1110: The authentication proxy server forwards the authentication request to the user data management server inside the operator.

Step 1111: The user data management server inside the operator passes the authentication, and the authentication is successful to the authentication proxy server.

Step 1112: The authentication proxy server forwards the authentication to the third-party application server.

Step 1113: The third-party application server successfully registers the user back.

Referring to FIG. 12, the process for providing identity authentication to a third-party application based on IMS is as follows:

Step 1201: The third-party application module (App) sends a telecommunication identity to the authentication agent module. Request for inquiry;

Step 1202: The authentication proxy module interacts with the IP multimedia service identity module (ISIM module) to obtain the user identity. Because it is the ISIM module of the IMS system, the user identity in a non-phone number format, such as the user identity in the format john@abc.com, can be obtained. ;

Step 1203: The authentication proxy module returns a telecommunications identity query response to the third-party application module (App).

Step 1204: The third-party application module (App) initiates a registration request to the third-party application server, and constructs the authentication information by using the user identity obtained from the authentication proxy module.

Step 1205: The third-party application server forwards the authentication request to the authentication proxy server of the operator.

Step 1206: The authentication proxy server transforms the authentication request into an authentication request that can be identified by the home subscriber network server of the operator, and sends the authentication request to the home subscription subscriber server inside the operator.

Step 1207: The home subscription user server inside the operator fails to authenticate, and carries the authentication challenge information of the user.

Step 1208: The third-party application server fails to register the user, including the authentication challenge information obtained from the telecommunication network;

Step 1209: The third-party application module (App) receives the registration failure message, and sends the challenge information to the authentication agent module.

Step 1210: The authentication proxy module interacts with the ISIM module to generate a challenge response.

Step 1211: The authentication proxy module sends an authentication challenge response message to a third-party application module (App);

Step 1212: The third-party application module (App) reconstructs the registration request by using the authentication challenge response message, and sends the registration request to the third-party application server.

Step 1213: The third-party application server sends an authentication request to the authentication proxy server according to the newly received registration request.

Step 1214: The authentication proxy server forwards the authentication request to the home subscription subscriber server inside the operator.

Step 1215: The home subscriber network of the operator passes the authentication, and the authentication succeeds to the authentication proxy server.

Step 1216: The authentication proxy server forwards the authentication to the third-party application server.

Step 1217: The third-party application server registers the user successfully.

Referring to FIG. 13, the interaction process for acquiring the user identity directly from the user identity information module based on the IMS is as follows:

Step S1301: A third-party application module (generally a native mode application) interacts with an IP multimedia service identity module (ISIM module) to acquire a user identity;

Step S1302: The third-party application module initiates a registration request to the third-party application server, and constructs the authentication information by using the user identity obtained from the authentication proxy module.

Step S1303: The third-party application server forwards the authentication request to the authentication proxy server of the operator.

Step S1304: The authentication proxy server transforms the authentication request into an authentication request that can be identified by the home subscription subscriber server of the operator, and sends the authentication request to the home subscription subscriber server inside the operator.

Step S1305: The home subscription user server inside the operator fails to authenticate, and carries the authentication challenge information of the user.

Step S1306: The third-party application server fails to register the user, including the authentication challenge information acquired from the telecommunication network;

Step S1307: The third-party application module receives the registration failure message, and uses the challenge information to interact with the ISIM module to generate an authentication challenge response message.

Step S1308: The third-party application module reconstructs the registration request by using the authentication challenge response information, and sends the registration request to the third-party application server.

Step S1309: The third-party application server constructs the authentication according to the newly received registration request. Request to send to the authentication proxy server;

Step S1310: The authentication proxy server forwards the authentication request to the home subscription subscriber server inside the operator;

Step S1311: the home subscriber network server internal authentication of the operator passes, and the authentication is successful to the authentication proxy server;

Step S1312: the authentication proxy server forwards the authentication to the third-party application server successfully;

Step S1313: The third-party application server returns the registration to the user successfully.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in a storage medium (ROM/RAM, diskette, optical disk) by a computing device, and in some cases The steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of the modules or steps may be implemented as a single integrated circuit module. Therefore, the invention is not limited to any particular combination of hardware and software.

The above is a further detailed description of the present invention in connection with the specific embodiments, and the specific embodiments of the present invention are not limited to the description. It will be apparent to those skilled in the art that the present invention may be made without departing from the spirit and scope of the invention.

Industrial applicability

As described above, a third-party application authentication method, an authentication server, a terminal, and a management server provided by the embodiments of the present invention have the following beneficial effects: when a third party logs in, the identity identification information assigned by the operator to the user is directly called from the terminal. The user data management server on the carrier side is used for authentication; the identity information assigned by the operator to the user is information that can truly identify each user, such as the number of the real-name authentication, and the like, thereby improving the security of the authentication. Sex, while providing third parties with safer, more reliable and real-name authentication, It also meets the needs of operators' openness.

Claims

A third-party application authentication method, including:

The third-party application module of the terminal obtains the identity identification information set by the operator for the user from the user identity information module of the terminal;

The third-party application module generates an authentication request including the identity identification information and sends the authentication request to the third-party authentication server for authentication.
The third-party application authentication method according to claim 1, further comprising:

The third-party application module receives authentication challenge information fed back by the third-party authentication server according to the authentication request;

Transmitting, by the third-party application module, the authentication challenge information to a user identity information module of the terminal;

The third-party application module receives the authentication challenge response information fed back by the user identity information module, and sends the authentication challenge response information to the third-party authentication server for re-authentication.
The third-party application authentication method according to claim 1 or 2, wherein the third-party application module acquires the identity identification information set by the operator for the user, including:

When the third-party application module is a third-party application module set by the operator, the identity identification information is directly obtained from the user identity information module of the terminal;

When the third-party application module is a third-party application module that is not set by the operator, the method sends an identity information acquisition request to the authentication proxy module of the terminal, and receives the identity identification information that is obtained by the authentication agent module and is obtained from the user identity information module. .
A third-party application authentication method, including:

The third-party authentication server receives an authentication request sent by a third-party application from the terminal, where the authentication request includes the identity identification information set by the operator for the user;

The third-party authentication server sends the authentication request to the user data management server on the operator side for authentication.
The third-party application authentication method of claim 4, further comprising:

Receiving, by the third-party authentication server, authentication challenge information fed back by the user data management server according to the authentication request;

The third-party authentication server sends the authentication challenge information to the third-party application module of the terminal;

The third-party authentication server receives the authentication challenge response information fed back by the third-party application of the terminal, and sends the authentication challenge response information to the user data management server for authentication.
A third-party application authentication method, including:

The user data management server receives an authentication request sent by a third-party authentication server, where the authentication request includes identity identification information set by the operator for the user;

The user data management server performs authentication according to the authentication request.
The third-party application authentication method according to claim 6, wherein the user data management server performs authentication according to the authentication request, including:

Generating authentication challenge information according to the identity identification information in the authentication request;

Sending the authentication challenge information to the third-party authentication server;

The authentication challenge response information from the third-party authentication server is received for authentication.
A terminal includes: a third-party application module, where the third-party application module includes an identity information obtaining sub-module and a first processing sub-module;

The information obtaining submodule is configured to obtain, from the user identity information module of the terminal, the identity identification information set by the operator for the user;

The first processing submodule is configured to generate an authentication request including the identity identification information according to the identity identification information, and send the authentication request to the third party authentication server for authentication.
The terminal of claim 8, wherein the third-party application module further comprises:

a challenge information obtaining submodule, configured to receive authentication challenge information fed back by the third party authentication server according to the authentication request;

An information forwarding submodule, configured to send the authentication challenge information to a user of the terminal Information module;

The second processing sub-module is configured to receive the authentication challenge response information fed back by the user identity information module and send the authentication challenge information to the third-party authentication server for re-authentication.
A third-party authentication server that includes:

a request receiving module, configured to receive an authentication request sent by a third-party application from the terminal, where the authentication request includes the identity identification information set by the operator for the user;

The request sending module is configured to send the authentication request to the user data management server on the operator side for authentication.
The third-party authentication server according to claim 10, further comprising:

a challenge information receiving module, configured to receive authentication challenge information fed back by the user data management server according to the authentication request;

a challenge information sending module, configured to send the authentication challenge information to a third-party application of the terminal;

The response information receiving module is configured to receive the authentication challenge response information fed back by the third-party application of the terminal;

The response message sending module is configured to send the authentication challenge response information to the user data management server on the operator side for authentication.
A user data management server comprising:

The request obtaining module is configured to receive an authentication request sent by a third-party authentication server, where the authentication request includes the identity identification information set by the operator for the user;

The authentication processing module is configured to perform authentication according to the authentication request.
The user data management server of claim 12, wherein the authentication processing module comprises:

a challenge information generating submodule, configured to generate authentication challenge information according to the identity identification information in the authentication request;

a challenge information feedback sub-module, configured to send the authentication challenge information to the third-party authentication server;

The authentication submodule is configured to receive authentication challenge response information from the third party authentication server for authentication.
A communication system includes a terminal, a third-party authentication server, and a user data management server;

The third-party application module of the terminal obtains the identity identification information set by the operator for the user from the user identity information module of the terminal, and generates an authentication request including the identity identification information and sends the authentication request to the third-party authentication server.

The third-party authentication server is configured to receive the authentication request and send it to a user data management server on the operator side;

The user data management server is configured to perform authentication according to the authentication request.
The communication system according to claim 14, further comprising an authentication proxy server configured to process the authentication request format sent by the third-party authentication server into an operator network internal message format and send the data to the user data management server.
The communication system according to claim 14 or 15, wherein said user data management server is a home subscription user server; and/or said user identity information module is a user identification card module or an IP multimedia service identity module.