WO2017107745A1

WO2017107745A1 - Terminal authentication method, device and system

Info

Publication number: WO2017107745A1
Application number: PCT/CN2016/107731
Authority: WO
Inventors: 范红伟
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-12-22
Filing date: 2016-11-29
Publication date: 2017-06-29
Also published as: CN106912047B; CN106912047A

Abstract

Disclosed are a terminal authentication method, device and system, belonging to the technical field of communications and being applicable to a terminal which does not have a USIM/SIM card or a terminal which cannot obtain USIM/SIM card information. The terminal authentication method comprises: a terminal initiating an initial attachment request to an access gateway; the access gateway transmitting a DER message to a 3GPP AAA server according to the initial attachment request; the 3GPP AAA server receiving the DER message and determining that the terminal is in EAP-TLS access when an EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a pre-set character; and the 3GPP AAA server performing authentication certification on the terminal by means of EAP-TLS interaction. It can be seen therefrom that the terminal authentication method in this embodiment can enable the terminal which does not have a USIM/SIM card or the terminal which cannot obtain USIM/SIM card information to access an LTE network and use a VoWiFi service, thereby improving the user experience.

Description

Terminal authentication method, device and system

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a terminal authentication method, apparatus, and system.

Background technique

With the rapid development of network technologies, the communication needs of users continue to migrate from fixed voice services to mobile communication services. The current mobile communication is developed to the fourth generation Long Term Evolution (4G LTE) network, and the user terminal can access through a Wireless Local Area Networks (WLAN) to implement WiFi voice over Internet (VoWiFi). Business, such as VoWiFi phones.

In the related art, the terminal accesses the LTE network in a WLAN manner, and performs an extensible authentication protocol-authentication and key agreement protocol through a Universal Subscriber Identity Module/Subscriber Identity Module (USIM/SIM). (Extensible Authentication Protocol-Authentication and Key Agreement, EAP-AKA) or EAP-AKA' authentication authentication access to the network. Among them, EAP-AKA is an authentication authentication access method for the third mobile communication based on the EAP protocol, and EAP-AKA' is a new authentication method after the EAP-AKA authentication is corrected.

However, both authentication authentication methods require the terminal to have a USIM/SIM card. For a terminal without a USIM/SIM card (such as a PAD, PC, etc.), the USIM/SIM card cannot be obtained due to permissions or system restrictions. For the terminal of the information, the LTE network cannot be accessed, and the VoWiFi service cannot be used, which brings inconvenience to the user.

Summary of the invention

The main purpose of the embodiments of the present invention is to provide a terminal authentication method, device, and system, which are related to the problem that the cardless terminal in the related art or the terminal that cannot obtain the USIM/SIM card information type cannot access the LTE network.

To achieve the above object, a terminal authentication method is provided by the embodiment of the present invention, the method includes: the terminal initiates an initial attach request to the access gateway; and according to the initial attach request, the access gateway to the third generation collaborative group The authentication, authorization, and accounting 3GPP AAA server sends a DER message; when the 3GPP AAA server receives the DER message and determines that the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, then The terminal is an extensible authentication protocol-secure transport layer protocol EAP-TLS access; and the 3GPP AAA server performs authentication authentication on the terminal through EAP-TLS interaction.

Optionally, the 3GPP AAA server performs authentication and authentication on the terminal by using an EAP-TLS interaction, including: after receiving the handshake message sent by the access gateway, the 3GPP AAA server returns a service certificate to the server. The access gateway receives the server certificate sent by the access gateway, and verifies the server certificate. When the server certificate is verified, the terminal sends the terminal certificate. And the 3GPP AAA server receives and verifies the terminal certificate sent by the access gateway, and sends a handshake completion message to the access gateway when the verification passes, to complete the The authentication of the terminal.

Optionally, the method further includes: after receiving the DER message sent by the access gateway to acknowledge the receipt of the handshake completion message, the 3GPP AAA server sends the MAR message to the evolved packet core network-home subscriber server EPC-HSS server. And the SAR message, to obtain the authentication data and the user data, and perform an authorization check. When the authorization check succeeds, the DEA message indicating that the authorization check succeeds is sent to the access gateway, and the terminal and the 3GPP AAA server are completed. Authorization.

Optionally, the EAP-IDENTITY prefix in the DER message is extended to use English characters. When the prefix is a preset character, the authentication mode is EAP-TLS, where the preset character is an English character.

Optionally, the terminal is installed with a terminal certificate, where the terminal certificate includes at least IMSI information of the terminal for performing a communication service, and the 3GPP AAA server is installed with a server certificate.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a terminal authentication method, which should For a terminal without a global subscriber identity card/customer identification card USIM/SIM terminal or unable to acquire USIM/SIM card information, the method includes: sending an initial attach request to an access gateway to send through the access gateway The DER message is sent to the 3GPP AAA server; when the 3GPP AAA server performs authentication authentication on the terminal through EAP-TLS interaction, the server certificate forwarded by the access gateway is received; and the server certificate is verified; And when the server certificate is verified, the terminal certificate is sent to the access gateway, so that the terminal certificate is sent by the access gateway to the 3GPP AAA server for verification.

Optionally, the terminal certificate includes at least the IMSI information that the terminal performs a communication service.

In addition, to achieve the above object, the embodiment of the present invention further provides a terminal authentication method, which is applied to a 3GPP AAA server, where the method includes: receiving a DER message from an access gateway; and determining EAP-PAYLOAD in the DER message. When the EAP-IDENTITY prefix in the attribute is a preset character, the terminal is EAP-TLS access, and the terminal is authenticated and authenticated through EAP-TLS interaction.

Optionally, the authenticating the terminal by using the EAP-TLS interaction includes: receiving a handshake message from the access gateway, and sending a server certificate to the access gateway, so that the terminal is configured to The server certificate is verified; when the terminal verifies the server certificate, the terminal certificate is received from the access gateway; the terminal certificate is verified; when the verification is passed, the handshake is completed. The message is sent to the access gateway to complete authentication of the terminal.

Optionally, the method further includes: receiving a DER message from the access gateway confirming receipt of the handshake completion message; sending the MAR message and the SAR message to the EPC-HSS server to obtain the authentication data and the user data, and performing Authorization check; when the authorization check of the authentication data and the user data is successful, sending a DEA message indicating that the authorization check succeeds to the access gateway.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a terminal authentication system, where the system includes a terminal, an access gateway, and a 3GPP AAA server, where the terminal is configured to initiate initial attachment to the access gateway. Requesting, the access gateway, configured to send a DER message to the 3GPP AAA server according to the initial attach request; the 3GPP AAA server, configured to receive the DER message, and determine an EAP in the DER message When the EAP-IDENTITY prefix in the PAYLOAD attribute is a preset character, the terminal is EAP-TLS access, and the terminal is authenticated and authenticated through EAP-TLS interaction.

Optionally, the 3GPP AAA server is further configured to: after receiving the handshake message sent by the access gateway, return a service certificate to the access gateway; and the terminal is further configured to receive the access And the server certificate is sent by the gateway, and the server certificate is verified. After the server certificate is verified, the terminal certificate is sent to the access gateway; the 3GPP AAA server is further configured to Receiving and verifying the terminal certificate sent by the access gateway, and when the verification is successful, sending a handshake completion message to the access gateway to complete authentication of the terminal.

Optionally, the system further includes an EPC-HSS server, where: the EPC-HSS server is configured to receive the MAR message and the SAR message sent by the 3GPP AAA server, and send the authentication data to the 3GPP AAA server. And the user data; the 3GPP AAA server is further configured to perform an authorization check on the terminal according to the authentication data and the user data, and when the authorization check succeeds, send a DEA message indicating that the authorization check succeeds to the access gateway, and complete the Authorization between the terminal and the 3GPP AAA server.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a terminal authentication apparatus, which should In the terminal for the USIM/SIM card terminal or the USIM/SIM card information, the device includes: a first sending module, configured to send an initial attach request to the access gateway, to send the DER through the access gateway Sending a message to the 3GPP AAA server; the first receiving module is configured to: when the 3GPP AAA server performs authentication authentication on the terminal by using EAP-TLS interaction, receive the server certificate forwarded by the access gateway; the server certificate a verification module, configured to verify the server certificate; the second sending module is further configured to send a terminal certificate to the access gateway to send through the access gateway when the server certificate is verified The terminal certificate is verified by the 3GPP AAA server.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a terminal authentication apparatus, which is applied to a 3GPP AAA server, where the apparatus includes: a third receiving module, configured to receive a DER message from an access gateway; and an authentication pass module When the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is determined to be a preset character, the terminal is EAP-TLS access, and the terminal is performed through EAP-TLS interaction. Authentication certification.

Optionally, the authentication pass module further includes: a fourth receiving module, configured to receive a handshake message from the access gateway; and a third sending module, configured to send a server certificate to the access gateway, so that The terminal is configured to verify the server certificate; the fifth receiving module is configured to: when the terminal verifies the server certificate, pass the terminal certificate from the access gateway; the verification module sets To verify the terminal certificate, the fourth sending module is configured to send a handshake completion message to the access gateway when the verification passes, to complete the authentication of the terminal.

Optionally, the device further includes: a sixth receiving module, configured to receive a DER message from the access gateway for confirming receipt of a handshake completion message; and a fifth sending module, configured to send a MAR message and a SAR message to the EPC - an HSS server to obtain authentication data and user data and perform an authorization check; a sixth sending module, configured to when the authentication data and the number of users are When the authorization check is successful, a DEA message indicating that the authorization check succeeds is sent to the access gateway.

In the embodiment of the present invention, a computer storage medium is further provided, and the computer storage medium may store an execution instruction, where the execution instruction is used to execute the terminal authentication method in the foregoing embodiment.

The terminal authentication method, device and system according to the embodiment of the present invention initiates an initial attach request to the access gateway by the terminal, and according to the initial attach request, the access gateway sends a DER message to the 3GPP AAA server, and the 3GPP AAA server receives the Declaring that the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message contains a preset character, determining that the terminal is EAP-TLS access, and the 3GPP AAA server interacts through EAP-TLS The terminal performs authentication and authentication. Therefore, the USIM/SIM card terminal or the terminal that cannot obtain the USIM/SIM card information can access the LTE network and use the VoWiFi service to improve the user experience.

DRAWINGS

1 is a schematic flowchart of a terminal authentication method according to a first embodiment of the present invention;

2 is a schematic flowchart of a terminal authentication method according to a second embodiment of the present invention;

3 is a schematic flowchart of a method for authenticating a terminal according to a third embodiment of the present invention;

4 is a schematic flowchart of a method for authenticating a terminal according to a fourth embodiment of the present invention;

FIG. 5 is a schematic flowchart of a method for authenticating a terminal according to a fifth embodiment of the present invention;

FIG. 6 is a schematic flowchart of a sub-process of a terminal authentication method according to a fifth embodiment of the present invention;

FIG. 7 is a schematic flowchart of a method for authenticating a terminal according to a sixth embodiment of the present invention;

8 is a schematic block diagram of a terminal authentication system according to a seventh embodiment of the present invention;

9 is a schematic block diagram of a terminal authentication system according to a ninth embodiment of the present invention;

FIG. 10 is a schematic block diagram of a terminal authentication apparatus according to a tenth embodiment of the present invention;

FIG. 11 is a schematic block diagram of a terminal authentication apparatus according to an eleventh embodiment of the present invention;

FIG. 12 is a schematic block diagram of a terminal authentication apparatus according to a twelfth embodiment of the present invention.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

detailed description

It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

A mobile terminal embodying various embodiments of the present invention will now be described with reference to the accompanying drawings. In the following description, the use of suffixes such as "module", "component" or "unit" for indicating an element is merely an explanation for facilitating the present invention, and does not have a specific meaning per se. Therefore, "module" and "component" can be used in combination.

The first embodiment of the present invention provides a terminal authentication method, which is applicable to a Universal Subscriber Identity Module/Subscriber Identity Module (USIM/SIM) terminal or a terminal that cannot obtain USIM/SIM card information.

In the present embodiment, the terminal may be implemented in various forms, for example, the terminal described in the present invention may include, for example, a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Plate) Mobile terminals of computers, PMPs (portable multimedia players), navigation devices, and the like, and fixed terminals such as digital TVs, desktop computers, and the like. In the following, it is assumed that the terminal is a mobile terminal. However, those skilled in the art will appreciate that configurations in accordance with embodiments of the present invention can be applied to fixed type terminals in addition to components that are specifically for mobile purposes.

The terminal is installed with a terminal certificate, and the terminal certificate includes at least the IMSI (International Mobile Subscriber Identification Number) information of the terminal for performing communication services, and the third generation collaborative group project authentication-authorization and accounting (3rd Generation Partnership Project Authentication-Authorization and Accounting, 3GPP AAA) server installed service Service certificate. The certificate is applied by the network operator to the certificate authority. This embodiment is not described here.

Optionally, the common name field in the terminal certificate is an IMSI of the service performed by the terminal, and the terminal supports an Extensible Authentication Protocol and Transport Layer Security (EAP-TLS) authentication.

FIG. 1 is a schematic flowchart of a terminal authentication method according to a first embodiment of the present invention, where the method includes:

Step 101: The terminal initiates an attach request to the access gateway.

Specifically, the EAP-IDENTITY prefix of the EAP-PAYLOAD attribute in the attach request is set to a certain character in AZ and az, and it is assumed that the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the attach request in this embodiment is determined by the network operator. The preset is A.

Step 102: The access gateway receives an attach request sent by the terminal, and sends a DER message to the 3GPP AAA server.

Specifically, after receiving the terminal attach request, the access gateway sends a DER (Diameter-EAP-Request) message to the 3GPP AAA server according to the attach request. It can be understood that the EAP-PAYLOAD attribute in the DER message is EAP- The IDENTITY prefix is A.

Optionally, those skilled in the art can understand that if the terminal accesses from the untrusted WiFi network, the access gateway may be an Evolved Packet Data Gateway (ePDG); if the terminal is connected from the trusted WLAN network Ingress, the access gateway may be an HRPD Gateway (HSGW).

Step 103: The 3GPP AAA server receives the DER message sent by the access gateway.

Step 104: The 3GPP AAA server checks whether the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, and if yes, proceeds to step 105; if not, ends;

Step 105: Determine that the terminal is an EAP-TLS access.

Step 106: The 3GPP AAA server authenticates the terminal by using EAP-TLS interaction Certification.

Specifically, the EAP-IDENTITY prefix in the DER message is extended in advance. The 3GPP protocol stipulates that the prefix corresponding to the EAP-AKA authentication mode is 0, 2, and 4, and the EAP-AKA' authentication mode is the corresponding prefix of 6, 7, 8. Therefore, in this embodiment, the English character AZ can be used for the extension. The prefix corresponding to the az, that is, the EAP-TLS authentication mode is an English character. Further, the network operator can set the prefix to be A, that is, the prefix corresponding to the EAP-TLS authentication mode is the English character A.

Therefore, when the 3GPP AAA server receives the DER message sent by the access gateway and the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the message is the preset character A, the 3GPP AAA server determines that the access request is EAP. - TLS access, the authentication authentication of the terminal will be followed by the EAP-TLS authentication mode. If the authentication succeeds, the terminal can access the LTE network to use various services such as VoWiFi services.

In the terminal authentication method provided by the embodiment, the terminal initiates an initial attach request to the access gateway, and according to the initial attach request, the access gateway sends a DER message to the 3GPP AAA server, and the 3GPP AAA server receives the DER message, when checking When the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message includes a preset character, it is determined that the terminal is EAP-TLS access, and the 3GPP AAA server authenticates the terminal through EAP-TLS interaction. Certification. It can be seen that the terminal authentication method in this embodiment can enable the USIM/SIM card terminal or the terminal that cannot obtain the USIM/SIM card information to access the LTE network and use the VoWiFi service to improve the user experience.

A terminal authentication method provided by the second embodiment of the present invention. In the second embodiment, the terminal authentication method is different from the first embodiment in that the step 106 specifically includes:

After receiving the handshake message sent by the access gateway, the 3GPP AAA server returns a service certificate to the access gateway;

The terminal receives the server certificate sent by the access gateway, and verifies the server certificate, and when the server certificate is verified, the terminal sends the terminal certificate. Sent to the access gateway;

The 3GPP AAA server receives and verifies the terminal certificate sent by the access gateway, and sends a handshake completion message to the access gateway when the verification passes, to complete the authentication of the terminal.

Specifically, in actual application, after the step 105, when the 3GPP AAA server performs EAP-TLS authentication on the terminal through EAP-TLS, the interaction between the access gateway, the 3GPP AAA server, and the terminal may refer to FIG. 2, and the interaction process is as follows: :

Step 201: The 3GPP AAA server returns a DEA (Diameter-EAP-Answer) message (TLS-Start), and starts EAP-TLS interaction with the access gateway.

Step 202: The terminal sends an EAP message to the access gateway.

Step 203: The access gateway receives the EAP message sent by the terminal, and sends a DER handshake message (TLS-Client Hello) to the 3GPP AAA server.

Step 204: The 3GPP AAA server receives the DER handshake message sent by the access gateway, and returns a DEA message (TLS-Server Hello) to the access gateway to return the certificate information saved by the server.

Step 205: The access gateway receives the server certificate sent by the 3GPP AAA server, and forwards the certificate to the terminal.

Step 206: The terminal receives the server certificate sent by the access gateway, and verifies the server certificate.

Step 207: When the server certificate is verified, the terminal sends the terminal certificate to the access gateway.

When the server certificate verification fails, the process proceeds to step 111.

Step 208: The access gateway receives the terminal certificate sent by the terminal, and sends a DER message to the 3GPP AAA server, where the DER message carries the terminal certificate information.

Step 209: The 3GPP AAA server receives the DER message sent by the access gateway, and performs verification on the terminal certificate.

Specifically, the 3GPP AAA server verifies the CA signature, validity period, and IMSI binding in the terminal information.

Step 210: When the terminal certificate is verified, the 3GPP AAA server sends a handshake complete DEA message to the access gateway to complete the authentication of the terminal.

When the terminal certificate verification fails, the process proceeds to step 211.

In step 211, the authentication fails, and the return message rejects the access request of the current terminal.

The terminal authentication method provided in this embodiment adopts two-way authentication, and the 3GPP AAA server checks the terminal certificate to confirm that the terminal is a legitimate terminal, and the terminal checks the server certificate to confirm that the accessed network is a legitimate network, thereby improving user access. safety.

A third embodiment of the present invention provides another terminal authentication method. In the third embodiment, the terminal authentication method is different from the second embodiment in that the method further includes:

After receiving the DER message sent by the access gateway and confirming receipt of the handshake completion message, the 3GPP AAA server sends a MAR (Multimedia-Authentication-Request) message and a SAR (Server-Assignment) to the EPC Home Subscriber (HSS) server. a -Request message to obtain the authentication data and the user data and perform an authorization check. When the authorization check succeeds, the DEA message indicating that the authorization check succeeds is sent to the access gateway, and the terminal and the 3GPP AAA server are completed. Authorization.

Specifically, reference may be made to FIG. 2 and FIG. 3 simultaneously. In an actual application, after step 210, the 3GPP AAA server performs EAP-TLS authentication on the terminal, and further includes the following steps:

Step 301: The access gateway sends a DER message to the 3GPP AAA server to confirm that the handshake completion DEA message sent by the 3GPP AAA server is received.

Step 302: The 3GPP AAA server receives the DER message sent by the access gateway, and sends a MAR message to the EPC Home Subscriber (HSS) server.

Step 303: The EPC-HSS server receives the MAR message sent by the 3GPP AAA server, and returns the authentication data to the 3GPP AAA server.

Step 304: The 3GPP AAA server acquires the authentication data sent by the EPC-HSS server, and performs an authorization check on the authentication data.

Step 305: The 3GPP AAA server sends a SAR message to the EPC-HSS server.

Step 306, the EPC-HSS server receives the SAR message sent by the 3GPP AAA server, and replies the user data to the 3GPP AAA server;

Step 307: The 3GPP AAA server acquires user data sent by the EPC-HSS server, and performs authorization check on the user data.

Step 308: The 3GPP AAA server sends a DEA message indicating that the authorization is successful to the access gateway, and then completes the authorization between the terminal and the 3GPP AAA server, and waits for the subsequent access procedure of the terminal.

The terminal authentication method provided in this embodiment sends a MAR message and a SAR message to the EPC-HSS server through the 3GPP AAA server to obtain the authentication data and the user data, and performs authorization check. When the authentication data and the user data are successfully checked. Sending a DEA message indicating that the authorization check succeeds to the access gateway, and completing authorization between the terminal and the 3GPP AAA server.

Referring to FIG. 4, a fourth embodiment of the present invention further provides a terminal authentication method, which is applied to a terminal that does not have a USIM/SIM card terminal or cannot obtain USIM/SIM card information, and the method includes:

Step 401: Send an initial attach request to the access gateway, to send a DER message to the 3GPP AAA server by using the access gateway;

Step 402: When the 3GPP AAA server performs authentication authentication on the terminal through EAP-TLS interaction, receiving a server certificate forwarded by the access gateway;

Specifically, the terminal certificate includes at least the IMSI information that the terminal performs a communication service.

Step 403, verifying the server certificate; and

Step 404: When the server certificate is verified, sending a terminal certificate to the access And the gateway sends the terminal certificate to the 3GPP AAA server for verification by using the access gateway.

The terminal authentication method in this embodiment sends an initial attach request to the access gateway. When the 3GPP AAA server performs authentication authentication on the terminal through EAP-TLS interaction, the server certificate is received and verified, and the USIM/SIM card terminal can be enabled. Or the terminal that cannot obtain the USIM/SIM card information accesses the LTE network and uses the VoWiFi service to improve the user experience.

Referring to FIG. 5, a fifth embodiment of the present invention further provides a terminal authentication method, which is applied to a 3GPP AAA server, where the method includes:

Step 501: Receive a DER message from an access gateway.

Step 502: Check whether the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character; if yes, go to step 503; if no, the process ends;

Step 503: Determine that the terminal is EAP-TLS access, and perform authentication authentication on the terminal by using EAP-TLS interaction.

As a further improvement of the embodiment, the authentication of the terminal by the EAP-TLS interaction in step 503 is further combined with FIG.

Step 601: Receive a handshake message from the access gateway.

Step 602: Send a server certificate to the access gateway, so that the terminal verifies the server certificate.

Step 603: When the terminal verifies the server certificate, the terminal certificate is received from the access gateway.

Step 604, verifying the terminal certificate;

Step 605: When the verification passes, sending a handshake completion message to the access gateway to complete authentication of the terminal.

The terminal authentication method in this embodiment adopts two-way authentication, and the 3GPP AAA server checks the end. The end certificate confirms that the terminal is a legitimate terminal, and the terminal checks the server certificate to confirm that the accessed network is a legitimate network, thereby improving the security of user access.

Referring to FIG. 7, a sixth embodiment of the present invention further provides a terminal authentication method. In the sixth embodiment, the terminal authentication method is different from the fifth embodiment in that the method further includes:

Step 701: Receive a DER message from the access gateway confirming receipt of a handshake completion message.

Step 702: Send a MAR message and a SAR message to the EPC-HSS server to obtain authentication data and user data and perform an authorization check;

Step 703: When the authorization check of the authentication data and the user data is successful, send a DEA message indicating that the authorization check succeeds to the access gateway.

The terminal authentication method in this embodiment receives the DER message from the access gateway and acknowledges receipt of the handshake completion message, and sends the MAR message and the SAR message to the EPC-HSS server to obtain the authentication data and the user data, and perform authorization check. When the authorization data and the user data are successfully checked, the DEA message indicating that the authorization check succeeds is sent to the access gateway, and the authorization between the terminal and the 3GPP AAA server is completed.

Referring to FIG. 8, a seventh embodiment of the present invention further provides a terminal authentication system, where the system includes the terminal 810, an access gateway 820, and a 3GPP AAA server 830.

The terminal 810 is a terminal without a USIM/SIM card terminal or unable to acquire USIM/SIM card information. In the present embodiment, the terminal 810 can be implemented in various forms, for example, the terminal described in the present invention can include, for example, a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD ( Mobile terminals of tablet computers, PMPs (portable multimedia players), navigation devices, and the like, and fixed terminals such as digital TVs, desktop computers, and the like. In the following, it is assumed that the terminal is a mobile terminal. However, those skilled in the art will appreciate that configurations in accordance with embodiments of the present invention can be applied in addition to components that are specifically for mobile purposes. Fixed type of terminal.

The terminal 810 is installed with a terminal certificate, and the terminal certificate includes at least the IMSI information of the communication service performed by the terminal 810, and the 3GPP AAA is installed with a server certificate. The certificate is applied by the network operator to the certificate authority. This embodiment is not described here.

Optionally, the common name field in the terminal certificate is an IMSI of the service performed by the terminal, and the terminal supports EAP-TLS authentication.

The terminal 810 is configured to initiate an attach request to the access gateway 820.

Specifically, the EAP-IDENTITY prefix of the EAP-PAYLOAD attribute is carried in the attach request, and the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the attach request in this embodiment is preset to be A by the network operator.

The access gateway 820 is configured to receive an attach request sent by the terminal 810 and send a DER message to the 3GPP AAA server 830.

Specifically, after receiving the terminal attach request, the access gateway 820 sends a network access request (Diameter-EAP-Request, DER) message to the 3GPP AAA server 830 according to the attach request. It can be understood that the EAP in the DER message is The EAP-IDENTITY prefix in the -PAYLOAD attribute is A.

The 3GPP AAA server 830 is configured to receive the DER message sent by the access gateway 820, and check whether the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, and if yes, determine that the terminal is EAP-TLS accesses and authenticates the terminal 810 through EAP-TLS interaction.

Specifically, the EAP-IDENTITY prefix in the DER message is extended in advance. The 3GPP protocol stipulates that the prefix corresponding to the EAP-AKA authentication mode is 0, 2, and 4, and the EAP-AKA' authentication mode is the corresponding prefix of 6, 7, 8. Therefore, in this embodiment, the English character AZ can be used for the extension. The prefix corresponding to the A-z, that is, the EAP-TLS authentication mode is an English character. Further, the network operator can set the prefix to be A, that is, the prefix corresponding to the EAP-TLS authentication mode is the English character A.

Therefore, when the 3GPP AAA server 830 receives the DER message sent by the access gateway and the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the message is the preset character A, the 3GPP AAA server 830 determines the current access. The request is EAP-TLS access, and the authentication authentication for the terminal 810 will be followed by the EAP-TLS authentication mode. If the authentication succeeds, the terminal 810 can access the LTE network to use various services such as VoWiFi services.

In the terminal authentication system provided by this embodiment, the terminal 810 initiates an initial attach request to the access gateway 820. According to the initial attach request, the access gateway 820 sends a DER message to the 3GPP AAA server 830, and the 3GPP AAA server 830 receives the DER message. When it is checked that the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message contains a preset character, it is determined that the terminal 810 is EAP-TLS access, and the 3GPP AAA server 830 interacts with the EAP-TLS. The terminal 810 performs authentication authentication. It can be seen that the terminal authentication system in this embodiment can enable the USIM/SIM card terminal or the terminal that cannot obtain the USIM/SIM card information to access the LTE network and use the VoWiFi service to improve the user experience.

The eighth embodiment of the present invention further provides a terminal authentication system. In the eighth embodiment, the terminal authentication system is different from the seventh embodiment only in that, in the embodiment, when the terminal 810 is authenticated by EAP-TLS interaction through the 3GPP AAA server, :

The 3GPP AAA server 830 is further configured to: after receiving the handshake message sent by the access gateway 820, return a service certificate to the access gateway 820;

The terminal 810 is further configured to receive the server certificate sent by the access gateway 820, and verify the server certificate. After verifying the server certificate, send the terminal certificate to the terminal. Into the gateway 820;

The 3GPP AAA server 830 is further configured to receive and verify the terminal certificate sent by the access gateway 820, and send a handshake completion message to the access network when the verification is successful. Off 820 to complete authentication of the terminal 810.

Specifically, in an actual application, when the 3GPP AAA server 830 performs EAP-TLS authentication on the terminal 810, the interaction between the access gateway 820, the 3GPP AAA server 830, and the terminal 810 can be referred to FIG.

The 3GPP AAA server 830 returns a DEA message (TLS-Start) and begins EAP-TLS interaction with the access gateway 820.

The terminal 810 is further configured to send an EAP message to the access gateway 820.

The access gateway 820 is further configured to receive the EAP message sent by the terminal 810 and send a DER handshake message (TLS-Client Hello) to the 3GPP AAA server 830.

The 3GPP AAA server 830 is further configured to receive the DER handshake message sent by the access gateway 820, and reply to the access gateway 820 with a DEA message (TLS-Server Hello) to return the certificate information saved by the server.

The access gateway 820 is further configured to receive the server certificate sent by the 3GPP AAA server 830 and forward it to the terminal 810.

The terminal 810 is further configured to receive the server certificate sent by the access gateway 820, and verify the server certificate.

When the server certificate is verified, the terminal 810 sends the terminal certificate to the access gateway 820;

When the server certificate verification fails, the authentication fails.

The access gateway 820 is further configured to receive the terminal certificate sent by the terminal 810, and send a DER message to the 3GPP AAA server 830, where the DER message carries the terminal certificate information.

The 3GPP AAA server 830 is further configured to receive the DER message sent by the access gateway 820 and verify the terminal certificate.

Specifically, the 3GPP AAA server 830 checks the CA signature, validity period, and IMSI binding in the terminal information.

When the terminal certificate is verified, the 3GPP AAA server 830 will handshake to complete the DEA. The message is sent to the access gateway 820 to complete the authentication of the terminal 810;

When the terminal certificate verification fails, the authentication fails, and the return message rejects the access request of the current terminal 810.

The terminal authentication system provided in this embodiment adopts two-way authentication, the 3GPP AAA server 830 checks the terminal certificate, confirms that the terminal 810 is a legitimate terminal, and the terminal 820 checks the server certificate to confirm that the accessed network is a legitimate network, thereby improving the user. Access security.

Please refer to FIG. 9, which is a terminal authentication system according to a ninth embodiment of the present invention. In the ninth embodiment, the terminal authentication system is different from the eighth embodiment only in that the system further includes an EPC Home Subscriber (HSS) service 910, where:

The EPC-HSS server 910 is configured to receive the MAR message and the SAR message sent by the 3GPP AAA server 830, and send the authentication data and the user data to the 3GPP AAA server;

The 3GPP AAA server 830 is further configured to perform an authorization check on the terminal according to the authentication data and the user data, and when the authorization check succeeds, send a DEA message indicating that the authorization check succeeds to the access gateway, and complete the terminal and Authorization between the 3GPP AAA servers 830.

Specifically, the interaction between the access gateway 820, the 3GPP AAA server 830, and the terminal 810 is as follows: When the 3GPP AAA server 830 performs EAP-TLS authentication on the terminal 810, the interaction between the access gateway 820, the 3GPP AAA server 830, and the terminal 810 is:

The access gateway 820 is further configured to send a DER message to the 3GPP AAA server 830 to acknowledge receipt of the DEA message sent by the 3GPP AAA server 830.

The 3GPP AAA server 830 is further configured to receive the DER message sent by the access gateway 820 and send the MAR message to the EPC-HSS server 910.

The EPC-HSS server 910 is configured to receive the MAR message sent by the 3GPP AAA server 830 and reply the authentication data to the 3GPP AAA server 830.

The 3GPP AAA server 830 is further configured to acquire authentication data sent by the EPC-HSS server 910.

The 3GPP AAA server 830 is further configured to perform authorization check on the authentication data and send the SAR message to the EPC-HSS server 910.

The EPC-HSS server 910 is further configured to receive the SAR message sent by the 3GPP AAA server 830 and reply the user data to the 3GPP AAA server 830.

The 3GPP AAA server 830 is further configured to acquire user data sent by the EPC-HSS server 910 to perform authorization check on the user data, and send a DEA message for successfully checking the access to the access gateway 820, thereby completing the terminal 810 and the 3GPP AAA server 830. Authorization between and waits for the subsequent access procedure of the terminal 810.

The terminal authentication system provided in this embodiment provides a 3GPP AAA server 830 to send a MAR message and a SAR message to the EPC-HSS server 910 to obtain authentication data and user data and perform authorization check. When authenticating the authentication data and user data, Upon successful, a DEA message indicating that the authorization check is successful is sent to the access gateway 820, and the authorization between the terminal 810 and the 3GPP AAA server 830 is completed.

Referring to FIG. 10, a tenth embodiment of the present invention further provides a terminal authentication apparatus, which is applied to a terminal 810 that does not have a USIM/SIM card terminal or cannot obtain USIM/SIM card information, and the device includes a first sending module 1010. The first receiving module 1020, the server certificate verification module 1030, and the second sending module 1040. among them:

The first sending module 1010 is configured to send an initial attach request to the access gateway 820, to send a DER message to the 3GPP AAA server 830 through the access gateway 820;

The first receiving module 1020 is configured to receive the server certificate forwarded by the access gateway 820 when the 3GPP AAA server 830 performs authentication authentication on the terminal 810 through EAP-TLS interaction;

The server certificate verification module 1030 is configured to verify the server certificate.

The second sending module 1040 is further configured to: when the server certificate is verified, send a terminal certificate to the access gateway 820, to send the terminal certificate to the 3GPP AAA server 830 through the access gateway 820. Test.

The terminal authentication device in this embodiment can authenticate the terminal 810 through the 3GPP AAA server 830, and can enable the USIM/SIM card terminal or the terminal that cannot obtain the USIM/SIM card information to access the LTE network, and use the VoWiFi service to improve the user experience. .

Referring to FIG. 11, an eleventh embodiment of the present invention further provides a terminal authentication apparatus, which is applied to a 3GPP AAA server, where the apparatus includes a third receiving module 1110, a determining module 1120, and an authentication passing module 1130. among them:

The third receiving module 1110 is configured to receive a DER message from the access gateway 820.

The determining module 1120 is configured to check whether the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character;

The authentication pass module 1130 is configured to determine, when the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, the determining module 1120 determines that the terminal 810 is an EAP-TLS access. The terminal 810 is authenticated and authenticated through EAP-TLS interaction.

Optionally, the authentication pass module 1130 further includes a fourth receiving module 1140, a third sending module 1150, a fifth receiving module 1160, a checking module 1170, and a fourth sending module 1180. among them:

The fourth receiving module 1140 is configured to receive a handshake message from the access gateway 820.

The third sending module 1150 is configured to send a server certificate to the access gateway 820, so that the terminal 810 verifies the server certificate.

The fifth receiving module 1160 is configured to: when the terminal 810 authenticates the server certificate Obsolete, receiving a terminal certificate from the access gateway 820;

a verification module 1170, configured to verify the terminal certificate;

The fourth sending module 1180 is configured to send a handshake complete message to the access gateway 820 to complete the authentication of the terminal 810 when the check is passed.

The terminal authentication device of the embodiment adopts two-way authentication, and the 3GPP AAA server checks the terminal certificate to confirm that the terminal is a legitimate terminal, and the terminal checks the server certificate to confirm that the accessed network is a legitimate network, thereby improving the security of user access. Sex.

Referring to FIG. 12, a twelfth embodiment of the present invention further provides a terminal authentication apparatus. In the twelfth embodiment, the terminal authentication apparatus is different from the eleventh embodiment only in that the apparatus further includes The six receiving module 1210, the fifth sending module 1210, and the sixth sending module 1230. among them:

The sixth receiving module 1210 is configured to receive a DER message from the access gateway 820 confirming receipt of the handshake completion message;

The fifth sending module is configured to send the MAR message and the SAR message to the EPC-HSS server 910 to obtain the authentication data and the user data and perform an authorization check;

The sixth sending module 1230 is configured to send a DEA message indicating that the authorization check succeeds to the access gateway 820 when the authorization check of the authentication data and the user data is successful.

The terminal authentication device of the embodiment receives the DER message from the access gateway 820 confirming the receipt of the handshake completion message by the sixth receiving module 1210, and the fifth sending module sends the MAR message and the SAR message to the EPC-HSS server 910 to obtain The authentication data and the user data are checked for authorization. When the authorization data and the user data are successfully checked, the sixth sending module 1230 sends a DEA message indicating that the authorization check succeeds to the access gateway 820, completing the terminal 810 and the Authorization between 3GPP AAA servers 830.

Embodiments of the present invention also provide a storage medium. Optionally, in this embodiment, on The storage medium can be configured to store program code for performing the following steps:

S1. The terminal initiates an initial attach request to the access gateway.

S2. According to the initial attach request, the access gateway sends a DER message to the third generation collaborative group to verify, authorize, and bill the 3GPP AAA server.

S3. When the 3GPP AAA server receives the DER message and checks whether the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, the terminal is an extensible authentication protocol-secure transport layer protocol EAP-TLS access. ;

S4, the 3GPP AAA server authenticates the terminal through EAP-TLS interaction.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

After receiving the handshake message sent by the access gateway, the 3GPP AAA server returns a service certificate to the access gateway.

S2: The terminal receives the server certificate sent by the access gateway, and verifies the server certificate. When the server certificate is verified, the terminal sends the terminal certificate to the access gateway.

S3. The 3GPP AAA server receives and verifies the terminal certificate sent by the access gateway. When the check is passed, the handshake completion message is sent to the access gateway to complete the authentication of the terminal.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is better. Implementation. Based on such understanding, the technical solution of the present invention in essence or the contribution to the related art can be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM). The instructions include a number of instructions for causing a terminal device (which may be a cell phone, computer, server, air conditioner, or network device, etc.) to perform the methods described in various embodiments of the present invention.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the drawings are directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Industrial applicability

In the embodiment of the present invention, the terminal initiates an initial attach request to the access gateway, and according to the initial attach request, the access gateway sends a DER message to the 3GPP AAA server, and the 3GPP AAA server receives the DER message, and the checkpoint When the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message includes a preset character, it is determined that the terminal is an EAP-TLS access, and the 3GPP AAA server performs authentication and authentication on the terminal through EAP-TLS interaction. . Therefore, the USIM/SIM card terminal or the terminal that cannot obtain the USIM/SIM card information can access the LTE network and use the VoWiFi service to improve the user experience.

Claims

A terminal authentication method, the method comprising:

The terminal initiates an initial attach request to the access gateway;

According to the initial attach request, the access gateway sends a DER message to the third generation collaborative group authentication, authorization, and accounting 3GPP AAA server;

When the 3GPP AAA server receives the DER message and checks whether the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, the terminal is an extensible authentication protocol-secure transport layer. Protocol EAP-TLS access;

The 3GPP AAA server performs authentication authentication on the terminal through EAP-TLS interaction.
The terminal authentication method according to claim 1, wherein the 3GPP AAA server performs authentication authentication on the terminal by using an EAP-TLS interaction, including:

After receiving the handshake message sent by the access gateway, the 3GPP AAA server returns a service certificate to the access gateway;

Receiving, by the terminal, the server certificate sent by the access gateway, and verifying the server certificate, when the server certificate is verified, the terminal sends the terminal certificate to the access Gateway;

The 3GPP AAA server receives and verifies the terminal certificate sent by the access gateway, and sends a handshake completion message to the access gateway when the verification passes, to complete the authentication of the terminal.
The terminal authentication method according to claim 2, wherein the method further comprises:

After receiving the DER message sent by the access gateway and confirming receipt of the handshake completion message, the 3GPP AAA server sends a MAR message and a SAR message to the Evolved Packet Core Network-Home Subscriber Server EPC-HSS server to obtain authentication data and User data and authorization check If the authorization check is successful, the DEA message indicating that the authorization check succeeds is sent to the access gateway, and the authorization between the terminal and the 3GPP AAA server is completed.
The terminal authentication method according to claim 1, wherein the EAP-IDENTITY prefix in the DER message is extended to use an English character, and when the prefix is a preset character, the authentication mode is EAP-TLS, wherein The preset character is an English character.
The terminal authentication method according to claim 1, wherein the terminal is installed with a terminal certificate, the terminal certificate includes at least IMSI information of the terminal for performing a communication service, and the 3GPP AAA server is installed with a server certificate.
A terminal authentication method is applied to a terminal without a global subscriber identity card/customer identification card USIM/SIM or a terminal that cannot obtain USIM/SIM card information, and the method includes:

Sending an initial attach request to the access gateway to send a DER message to the 3GPP AAA server through the access gateway;

Receiving, by the 3GPP AAA server, the server certificate forwarded by the access gateway when the terminal authenticates the terminal through EAP-TLS interaction;

Verifying the server certificate; and

And when the server certificate is verified, the terminal certificate is sent to the access gateway, so that the terminal certificate is sent by the access gateway to the 3GPP AAA server for verification.
The terminal authentication method according to claim 6, wherein the terminal certificate includes at least IMSI information for the terminal to perform a communication service.
A terminal authentication method is applied to a 3GPP AAA server, and the method includes:

Receiving a DER message from the access gateway;

When the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is determined to be a preset character, the terminal is EAP-TLS access, and the terminal is authenticated and authenticated through EAP-TLS interaction.
The terminal authentication method according to claim 8, wherein the authenticating the terminal by the EAP-TLS interaction comprises:

Receiving a handshake message from the access gateway;

Sending a server certificate to the access gateway, so that the terminal verifies the server certificate;

Receiving a terminal certificate from the access gateway when the terminal verifies the server certificate;

Verifying the terminal certificate;

When the verification is passed, a handshake completion message is sent to the access gateway to complete authentication of the terminal.
The terminal authentication method according to claim 8 or 9, wherein the method further comprises:

Receiving a DER message from the access gateway confirming receipt of a handshake completion message;

Sending a MAR message and a SAR message to the EPC-HSS server to obtain authentication data and user data and perform an authorization check;

When the authorization check of the authentication data and the user data is successful, a DEA message indicating that the authorization check succeeds is sent to the access gateway.
A terminal authentication system, the system comprising: a terminal, an access gateway, and a 3GPP AAA server, wherein

The terminal is configured to initiate an initial attach request to the access gateway;

The access gateway is configured to send a DER message to the 3GPP AAA server according to the initial attach request;

The 3GPP AAA server is configured to receive the DER message, and determine that the EAP-IDENTITY prefix in the EAP-PAYLOAD attribute in the DER message is a preset character, and the terminal is an EAP-TLS access. The terminal is authenticated and authenticated through EAP-TLS interaction.
The terminal authentication system according to claim 11, wherein

The 3GPP AAA server is further configured to: after receiving the handshake message sent by the access gateway, return a service certificate to the access gateway;

The terminal is further configured to receive the server certificate sent by the access gateway, and verify the server certificate, and after verifying the server certificate, send the terminal certificate to the terminal Into the gateway;

The 3GPP AAA server is further configured to receive and verify the terminal certificate sent by the access gateway, and when the verification is successful, send a handshake completion message to the access gateway to complete the Certification.
The terminal authentication system according to claim 12, wherein said system further comprises an EPC-HSS server, wherein:

The EPC-HSS server is configured to receive the MAR message and the SAR message sent by the 3GPP AAA server, and send the authentication data and the user data to the 3GPP AAA server;

The 3GPP AAA server is further configured to perform an authorization check on the terminal according to the authentication data and the user data, and send an authorization check to the access gateway successfully when the authorization check succeeds. The DEA message completes the authorization between the terminal and the 3GPP AAA server.
The terminal authentication system according to claim 11, wherein the EAP-IDENTITY prefix in the DER message is extended to use an English character, and when the prefix is a preset character, the authentication mode is EAP-TLS, wherein The preset character is an English character.
The terminal authentication system according to claim 11, wherein the terminal is installed with a terminal certificate, and the terminal certificate includes at least IMSI information of the terminal for performing a communication service, and the 3GPP AAA server is installed with a server certificate.
A terminal authentication device is applied to a terminal that does not have a USIM/SIM card terminal or cannot obtain USIM/SIM card information, and the device includes:

The first sending module is configured to send an initial attach request to the access gateway, to send a DER message to the 3GPP AAA server by using the access gateway;

a first receiving module, configured to: when the 3GPP AAA server performs authentication authentication on the terminal by using EAP-TLS interaction, receive a server certificate forwarded by the access gateway;

a server certificate verification module, configured to verify the server certificate;

The second sending module is further configured to send a terminal certificate to the access gateway when the server certificate is verified, to send the terminal certificate to the 3GPP AAA server for verification by using the access gateway.
The terminal authentication apparatus according to claim 16, wherein the terminal certificate includes at least IMSI information for the terminal to perform a communication service.
A terminal authentication apparatus is applied to a 3GPP AAA server, where the apparatus includes:

a third receiving module, configured to receive a DER message from the access gateway;

The authentication pass module is configured to determine the EAP-PAYLOAD genus in the DER message When the EAP-IDENTITY prefix is a preset character, the terminal is EAP-TLS access, and the terminal is authenticated and authenticated through EAP-TLS interaction.
The terminal authentication device according to claim 18, wherein the authentication pass module further comprises:

a fourth receiving module, configured to receive a handshake message from the access gateway;

a third sending module, configured to send a server certificate to the access gateway, so that the terminal verifies the server certificate;

a fifth receiving module, configured to receive a terminal certificate from the access gateway when the terminal verifies the server certificate;

a verification module, configured to verify the terminal certificate;

The fourth sending module is configured to send a handshake completion message to the access gateway when the verification passes, to complete authentication of the terminal.
The terminal authentication device according to claim 18 or 19, wherein the device further comprises:

a sixth receiving module, configured to receive a DER message from the access gateway confirming receipt of a handshake completion message;

The fifth sending module is configured to send the MAR message and the SAR message to the EPC-HSS server to obtain the authentication data and the user data and perform an authorization check;

The sixth sending module is configured to send a DEA message indicating that the authorization check succeeds to the access gateway when the authorization check of the authentication data and the user data is successful.