WO2018137239A1 - 一种鉴权方法、鉴权服务器和核心网设备 - Google Patents

一种鉴权方法、鉴权服务器和核心网设备 Download PDF

Info

Publication number
WO2018137239A1
WO2018137239A1 PCT/CN2017/072741 CN2017072741W WO2018137239A1 WO 2018137239 A1 WO2018137239 A1 WO 2018137239A1 CN 2017072741 W CN2017072741 W CN 2017072741W WO 2018137239 A1 WO2018137239 A1 WO 2018137239A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
core network
request
network device
device identifier
Prior art date
Application number
PCT/CN2017/072741
Other languages
English (en)
French (fr)
Inventor
陈璟
潘凯
李�赫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2017/072741 priority Critical patent/WO2018137239A1/zh
Publication of WO2018137239A1 publication Critical patent/WO2018137239A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present invention relates to the field of mobile communications, and in particular, to an authentication method, an authentication server, and a core network device.
  • IMEI International Mobile Equipment Identity
  • certificate-bound user equipment identity authentication method As shown in Figure 1, the user equipment needs to be pre-configured with the device certificate and the device certificate-related private key.
  • the network side needs to pre-configure the binding relationship between the IMEI and the device certificate. 102.
  • Authentication In the user equipment and authentication, authorization, and accounting (Authentication) , Authorization and Accounting (AAA)/Home Subscriber Server (HSS) for user identity authentication; 103-105, Security Anchor Function (SEAF) entity sends device identity authentication request to user equipment
  • the user equipment uses a private key pair (IMEI, fresh, challenge), then sends it to the SEAF along with the IMEI; 106-108, requests the device certificate; 109, checks the signature using the device certificate to complete the device Identification and authentication.
  • IMEI public key pair
  • SEAF Security Anchor Function
  • User equipment identity authentication method based on user equipment's IMEI and public key binding. As shown in Figure 2, the user equipment needs to be pre-configured with a public-private key pair. The network side needs to pre-configure the binding relationship between the IMEI and the device public key. 202. Perform user identity authentication between the user equipment and the AAA/HSS. 205. The SEAF sends a device identity authentication request to the user equipment, where the user equipment uses a private key pair (IMEI, fresh value, challenge), and then sends the message to the SEAF along with the IMEI; 206-208, requests the device public key; 209, uses the device The public key checks the signature to complete the device identification authentication.
  • IMEI private key pair
  • the authentication mode of the user equipment identity authentication method is fixed, the number and types of devices supported are limited, and device access with different trust types in the next generation network is not considered.
  • the embodiment of the present invention provides an authentication method, an authentication server, and a core network device, which adopts an EAP device identifier authentication method, can adapt to multiple authentication modes, and can support multiple types of trust type user equipments. Meet the user equipment identity authentication requirements in the next generation network.
  • an embodiment of the present invention provides an authentication method, where the method includes: an authentication server is configured from a core network. Receiving a first request, the first request includes a device identifier of the user equipment UE, and the authentication server selects, according to the device identifier, an extensible authentication protocol EAP device identifier authentication manner, and is based on the selected The method performs EAP device identity authentication on the UE.
  • the authentication method provided by the embodiment of the present invention can select an EAP device identifier authentication method according to the device identifier of the UE, and perform EAP device identifier authentication on the UE according to the selected manner, and can adapt to multiple authentication modes. Supporting various types of credential type user equipment, thereby overcoming the drawbacks of the prior art device identification authentication method being fixed.
  • the method before the authentication server receives the first request from the core network device, the method further includes: the authentication server sending a first response to the core network device The first response is used to trigger a determination of whether to perform device identity authentication on the UE.
  • the authentication server performs EAP device identifier authentication on the UE according to the selected manner, including: the authentication server sends the selected device identifier to the UE The way of power.
  • the authentication server generates a first key; the authentication server sends a second response message to the core network device, where the second response message includes the first key
  • the first key is used for updating an key in the core network device.
  • the key in the core network device can be updated, and when the key generated by the subscription information authentication is leaked, secure communication can still be guaranteed.
  • the authentication server includes an authentication server function AUSF entity and/or an authentication credential storage and processing function ARPF entity.
  • the core network device includes at least one of a security anchor function SEAF entity, an access and mobility management function AMF entity, and a session management function SMF entity.
  • the embodiment of the present invention further provides another authentication method, where the method includes: the core network device acquires the device identifier of the UE from the user equipment UE; and the core network device sends the first identifier to the authentication server.
  • the request, the first request includes a device identifier of the UE, and the device identifier is used for selection of an extensible authentication protocol EAP device identifier authentication mode of the UE.
  • the method further includes: receiving, by the core network device, a second request from the UE, or receiving a first response, the second request, or the The first response is used to trigger whether to perform device identity authentication on the UE. After receiving the first response or the second request, the core network device determines whether to perform device identity authentication on the UE. .
  • the method further includes: the core network device sending a third request to the UE to request the device identifier.
  • the core network device sends a third request to the UE, where the core network device sends the first message to the UE by using a non-access stratum security mode command NAS SMC message.
  • the core network device sends a third request to the UE, where the core network device sends an EAP request to the UE, where the EAP request includes the third request.
  • the second request includes the device identifier
  • the core network device acquiring the device identifier includes: the core network device acquiring the device identifier from the second request.
  • the acquiring, by the core network device, the device identifier includes: receiving, by the core network device, a non-access stratum security mode from the UE to complete a NAS SMP message, where the NAS SMP message includes The device identifier.
  • the method further includes: the core network device receiving a second response message from the authentication server, where the second response message includes a first key; The first key updates a second key stored by the core network device.
  • the core network device includes at least one of a security anchor function SEAF entity, an access and mobility management function AMF entity, and a session management function SMF entity.
  • the authentication server includes an authentication server function AUSF entity and/or an authentication credential storage and processing function ARPF entity.
  • an embodiment of the present invention provides an authentication server, where the server includes: a processing module and a communication module; the communication module receives a first request from a core network device, where the first request includes a user equipment UE And the processing module performs the EAP device identifier authentication on the UE according to the selected manner.
  • an embodiment of the present invention provides a core network device, where the core network device includes: a processing module and a communication module; the communication module acquires a device identifier of the UE from a user equipment UE; The authentication server sends a first request, where the first request includes a device identifier of the UE, and the device identifier is used for selecting an extensible authentication protocol EAP device identifier authentication mode of the UE.
  • an embodiment of the present invention further provides an authentication server, where the server includes: a processor and a communication interface; and the processor and the communication interface are used to perform an authentication method provided by the first aspect.
  • the embodiment of the present invention further provides a core network device, where the core network device includes: a processor and a communication interface; the processor and the communication interface are used to perform the authentication method provided by the second aspect .
  • an embodiment of the present invention further provides a computer readable storage medium, wherein the computer readable storage medium stores instructions that, when run on a computer, cause the computer to perform the methods described in the above aspects.
  • an embodiment of the present invention further provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method described in the above aspects.
  • the authentication method, the authentication server, and the core network device provided by the embodiments of the present invention adopt the EAP device identifier authentication method, can adapt to multiple authentication modes, and can support multiple types of trust type user equipments, thereby overcoming the present In the technology, the shortcomings of the device identification authentication method are fixed, which can meet the user equipment identification authentication requirements in the next generation network.
  • FIG. 1 is a schematic flow diagram of a device identification authentication method in the prior art
  • FIG. 2 is a schematic flow diagram of another device identification authentication method in the prior art
  • FIG. 3 is a flowchart of an authentication method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of another authentication method according to an embodiment of the present invention.
  • FIG. 5 is a schematic process interaction diagram of an authentication method according to Embodiment 1 of the present invention.
  • FIG. 6 is a schematic process interaction diagram of an authentication method according to Embodiment 2 of the present invention.
  • FIG. 7 is a schematic process interaction diagram of an authentication method according to Embodiment 3 of the present invention.
  • FIG. 8 is a schematic process interaction diagram of an authentication method according to Embodiment 4 of the present invention.
  • FIG. 9 is a schematic process interaction diagram of an authentication method according to Embodiment 5 of the present invention.
  • FIG. 10 is a schematic process interaction diagram of an authentication method according to Embodiment 6 of the present invention.
  • FIG. 11 is a schematic process interaction diagram of an authentication method according to Embodiment 7 of the present invention.
  • FIG. 12 is a schematic process interaction diagram of an authentication method according to Embodiment 8 of the present invention.
  • FIG. 13 is a schematic process interaction diagram of an authentication method according to Embodiment 9 of the present invention.
  • FIG. 14 is a schematic structural diagram of an authentication server according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of a core network device according to an embodiment of the present disclosure.
  • FIG. 16 is a schematic structural diagram of another authentication server according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic structural diagram of another core network device according to an embodiment of the present invention.
  • the UE in the embodiment of the present application may be a mobile phone, a tablet, a computer with a wireless transceiver function, a virtual reality (VR) terminal device, and an augmented reality (AR) terminal device.
  • wireless terminal in industrial control wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, transportation security Wireless terminal in safety), wireless terminal in smart city, wireless terminal in smart home, and the like.
  • the embodiment of the present application does not limit the application scenario.
  • the UE may have two types of identifiers, the user identifier of the user using the UE, for example, an international mobile subscriber identity (ID) for identifying the subscriber subscription information (International Mobile Subscriber Identification Number, IMSI), and, the device identifier of the UE, for example, IMEI.
  • ID international mobile subscriber identity
  • IMSI International Mobile Subscriber Identification Number
  • IMEI the device identifier of the UE
  • AKA Authentication and Key Agreement
  • the device identifier such as IMEI
  • IMEI is not only a key basis for blocking the stolen UE, preventing the UE from being illegally resold, and recovering the normal operation of the UE, but also for emergency call when the IMSI does not exist or the user identity authentication fails.
  • the IMEI has the possibility of being modified or cloned. Therefore, the UE needs to be authenticated when accessing the network to ensure that the IMEI of the UE is trusted.
  • the number of devices supported by the next generation network is greatly increased, in order to ensure a secure network environment, it is necessary to prevent some devices with low security performance from accessing the network, which necessitates authentication of the device. To determine if the device is in the range that needs to be blocked, it is also necessary to ensure that the device identification is trustworthy to the network.
  • Device identification authentication is a way to authenticate a device by authenticating device identification.
  • Extensible Authentication Protocol is an extensible authentication mechanism that is often used in wireless networks or point-to-point connections. EAP can be used not only for wireless LANs, but also for wired LANs, but it is used more frequently in wireless LANs. EAP is a certification framework, not A special authentication mechanism. EAP provides some common functionality and allows negotiation of the desired authentication mechanism. The EAP protocol is only a certification framework, and does not specify the specific authentication method. Therefore, this authentication mechanism combines the EAP protocol and the EAP authentication method selected by the operator (such as EAP-TLS, EAP-SIM, EAP-AKA, PEAP).
  • the user equipment identity authentication method provided by the embodiment of the present invention utilizes the EAP feature to extend the device identity authentication mode, can adapt to multiple authentication modes, and can support various types of trust type user equipments, and can satisfy the next generation network.
  • User equipment identification authentication requirements in the middle Specifically, in the method provided by the embodiment of the present invention, the SEAF or the MME that receives the device identifier of the UE may send an EAP device identity authentication request to the authentication server or the HSS to enable the authentication server or the HSS to the UE. Perform EAP device identification authentication.
  • the core network device of the next generation network may include a Security Anchor Function (SEAF) entity, which is a network element that interacts with the AUSF and the UE in the core network of the next generation network, in the authentication process. After receiving the intermediate key.
  • SEAF Security Anchor Function
  • AMF Access and Mobility Management Function
  • the core network device of the next generation network may further include a Session Management Function (SMF) entity whose main function is to establish a session for the UE, assign an Identity (ID), manage or terminate the session. Wait.
  • SMF Session Management Function
  • the authentication server of the next generation network is used for the device identification authentication request sent by the SEAF, the authentication of the UE, and the storage of the trust certificate and the like.
  • the authentication server may include an Authentication Server Function (AUSF) entity and/or an Authentication Credential Repository and Processing Function (ARPF) entity.
  • AUSF Authentication Server Function
  • ARPF Authentication Credential Repository and Processing Function
  • LTE Long Term Evolution
  • the core network device may be a Mobile Management Entity (MME);
  • the authentication server may be a Home Subscriber Server (HSS), or may be a third party used for device identification authentication. server.
  • MME Mobile Management Entity
  • HSS Home Subscriber Server
  • the authentication method provided by the embodiment of the present invention is specifically described with reference to FIG.
  • the execution body of the method may be an authentication server.
  • the method includes the following steps.
  • Step 301 The authentication server receives a first request from a core network device, where the first request includes a device identifier of the user equipment UE.
  • the device identity of the UE may be the IMEI of the UE.
  • the authentication server can include AUSF and/or ARPF.
  • the core network device can include a SEAF, and the authentication server can receive the first request from the SEAF.
  • the core network device can include an AMF, and the authentication server can receive the first request from the AMF.
  • the core network device can include an SMF, and the authentication server can receive the first request from the SMF.
  • the authentication server can include an HSS.
  • the core network device can include an MME, and the authentication server can receive the first request from the MME.
  • Step 302 The authentication server selects an EAP device identifier authentication method for the UE according to the device identifier, and performs EAP device identifier authentication on the UE according to the selected manner.
  • the authentication server performing EAP device identity authentication on the UE according to the selected manner may include: the manner in which the authentication server sends the selected device identity authentication to the UE.
  • the authentication method provided by the embodiment of the present invention may further include: the authentication server generates a first key; the authentication server sends a second response message to the core network device, where the second response message is The first key is included, and the first key is used for updating an key in the core network device.
  • An authentication method provided by the embodiment of the present invention adopts an extensible authentication protocol (EAP), which can adapt to multiple authentication modes, can support multiple types of trust type user equipment, and can satisfy user equipment identifiers in next generation networks. Authentication requirements.
  • EAP extensible authentication protocol
  • the execution body of the method may be a core network device. The method includes the following steps.
  • Step 401 The core network device acquires the device identifier of the UE from the user equipment UE.
  • Step 402 The core network device sends a first request to the authentication server, where the first request includes a device identifier of the UE, and the device identifier is used to select an authentication method of an extensible authentication protocol EAP device identifier of the UE. .
  • the core network device includes at least one of a security anchor functional entity SEAF entity, an access and mobility management function AMF entity, and a session management function SMF entity.
  • the method further includes: the core network device receiving the second request from the UE, or receiving a first response from the authentication server, the second request or the first response being used to trigger whether Determining, by the UE, the device identity authentication, and determining, by the core network device, device ID authentication to the UE after receiving the first response or the second request.
  • the method further includes the core network device transmitting a third request to the UE to request the device identification.
  • the core network device sends a third request to the UE, where the core network device sends a message through a Non-Access Stratum Security Mode Command (NAS SMC) message.
  • NAS SMC Non-Access Stratum Security Mode Command
  • the UE sends the third request.
  • the core network device sends a third request to the UE, including: the core network device sends an EAP request to the UE, and the EAP request includes the third request.
  • the second request includes the device identifier
  • the core network device acquiring the device identifier includes: the core network device acquiring the device identifier from the second request.
  • the core network device obtains the device identifier, and the core network device receives a Non-Access Stratum Security Mode Complete (NAS SMP) message from the UE.
  • the NAS SMP message includes the device identifier.
  • the method further includes: the core network device receiving a second response message from the authentication server, the second response message including a first key; the core network device according to the first The key updates the second key stored by the core network device.
  • the authentication server includes an authentication server function AUSF entity and/or an authentication credential storage and an authentication credential storage and processing function ARPF entity.
  • the authentication method provided by the embodiment of the present invention adopts the extensible authentication protocol EAP, can adapt to multiple authentication modes, can support multiple types of trust type user equipment, and can satisfy the authentication of user equipment identifiers in the next generation network. demand.
  • the specific embodiment 1 of the present invention specifically introduces the method provided by the embodiment of the present invention.
  • the core network device in this example may include AMF.
  • Step 501 The UE sends an attach request to the AMF, where the attach request may include a device identifier authentication request, where In an example, the device identification authentication request may be implemented by an equipment identifier authentication indicator.
  • Step 502 The UE and the authentication server may perform subscription information authentication.
  • the authentication server for signing information authentication may be the same server as the authentication server for device identification authentication in this example, or may be a different server.
  • the authentication server that authenticates the subscription information and the authentication server that authenticates the device identifier are exemplified by the same server, and are not limited.
  • Step 503 If the subscription information is successfully authenticated, the authentication server may send a subscription information authentication response to the AMF.
  • Step 504 The AMF may determine whether to perform device identity authentication on the UE. For example, the AMF may determine whether to perform device identity authentication on the UE according to the operator's requirement or the subscription information of the UE. If device identification authentication is not required, the AMF directly forwards the subscription information authentication response to complete the network access of the UE. If device ID authentication is required, the next steps are taken.
  • the operator For device identification authentication, for example, the operator requires device ID authentication for the UE. Specifically, because the operator can require the USIM card to be bound to the UE, the operator can pre-configure the information required to bind the USIM card to the UE.
  • SEAF SEAF may also obtain information that requires the binding of the USIM card and the UE through an authentication server or the like. For example, a user who is often in Shanghai suddenly appears in Beijing, and the network will authenticate the UE to check whether the USIM of the user is stolen.
  • Step 505 The AMF sends a device identification request to the UE to request the device identifier of the UE, and the message for transmitting the device identifier request may be a NAS SMC message.
  • Step 506 The UE sends a device identifier to the AMF, where the device identifier may be an IMEI, and the message for transmitting the device identifier may be a NAS SMP message.
  • the device identifier may be an IMEI
  • the message for transmitting the device identifier may be a NAS SMP message.
  • Step 507 After receiving the device identifier, the AMF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the authentication server may select an EAP device identifier authentication method according to the received EAP device identifier authentication request. Specifically, the EAP device identifier authentication manner may be selected for the UE according to the device identifier. It can be assumed that the correspondence between the credential, the credential and the device identifier of the UE is pre-stored in the authentication server, and the authentication server can select the matching EAP device identifier authentication mode according to the credential corresponding to the device identifier, wherein the credential can be Including, but not limited to, a certificate, a key, or other credentials, the manner in which the EAP device identifies the authentication may include, but is not limited to, EAP-AKA, EAP-TLS, EAP-TTLS, and the like.
  • the authentication server may be owned by the operator or owned by a third party.
  • Step 509 The authentication server may perform device identification authentication on the UE according to the EAP device identifier authentication method selected in step 508. For example, the number of message interactions between the UE and the authentication server depends on the manner in which the authentication server selects the EAP device identity authentication.
  • Step 510 The authentication server sends a device identity authentication success message (for example, an EAP success message) to the AMF, where, in an example, the device identity authentication success message may include that the authentication server generates after the device identity authentication succeeds.
  • a device identity authentication success message for example, an EAP success message
  • the device identity authentication success message may include that the authentication server generates after the device identity authentication succeeds. The first key.
  • Step 511 If the device identifier authentication success message received by the AMF includes the first key, the AMF may update the key generated in the subscription information authentication in the AMF according to the first key. It should be noted that step 511 is optional. For example, if the network needs to use a device identity authentication credential (Credential) binding security context to update the security context, the AMF may generate the authentication information in the AMF. The key is updated. Alternatively, if the first key leaks, the update operation can also be performed to ensure secure communication.
  • Step 512 The AMF sends a NAS SMC message to the UE, where the device identifier authentication success message may be included (eg, EAP Success Message) And, if the key in the AMF is updated, the parameters used to update the key can also be attached to the NAS SMC message.
  • the device identifier authentication success message may be included (eg, EAP Success Message)
  • Step 513 The UE sends a NAS SMP message to the AMF.
  • Step 514 The AMF sends an attach accept message to the UE.
  • the specific embodiment 2 of the present invention is specifically introduced in conjunction with FIG. 6 to provide a method according to an embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 601 The UE sends an attach request to the AMF.
  • Step 602 The UE and the authentication server may perform subscription information authentication.
  • the authentication server for signing information authentication may be the same server as the authentication server for device identification authentication in this example, or may be a different server.
  • the authentication server that authenticates the subscription information and the authentication server that authenticates the device identifier are exemplified by the same server, and are not limited.
  • Step 603 If the subscription information is successfully authenticated, the authentication server may send the subscription information authentication response to the SEAF.
  • Step 604 The SEAF may determine whether to perform device identity authentication on the UE. For example, the AMF may determine whether to perform device identity authentication on the UE according to the operator's requirement or the subscription information of the UE. If device identification authentication is not required, the SEAF directly forwards the subscription information authentication response to complete the network access of the UE. If device ID authentication is required, the next steps are taken.
  • the operator For device identification authentication, for example, the operator requires device ID authentication for the UE. Specifically, because the operator can require the USIM card to be bound to the UE, the operator can pre-configure the information required to bind the USIM card to the UE.
  • SEAF SEAF may also obtain information that requires the binding of the USIM card and the UE through an authentication server or the like. For example, a user who is often in Shanghai suddenly appears in Beijing, and the network will authenticate the UE to check whether the USIM of the user is stolen.
  • Step 605 The SEAF sends an EAP request to the AMF, where the EAP request may include a device identification request to request the device identifier of the UE.
  • Step 606 The AMF sends the EAP request to the UE, where the EAP request may include a device identification request to request the device identifier of the UE.
  • Step 607 The UE sends a device identifier to the AMF, where the device identifier may be an IMEI.
  • Step 608 After receiving the device identifier, the AMF sends the device identifier to the SEAF.
  • Step 609 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • Step 610 The authentication server may select an EAP device identifier authentication method according to the received EAP device identifier authentication request.
  • the specific selection manner refer to the content described in the foregoing Embodiment 1, and details are not described herein again.
  • Step 611 to step 613 the authentication server may send the EAP device identifier selected in step 610 to the UE.
  • the specific embodiment 3 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 701 The UE sends an attach request to the AMF.
  • Step 702 The UE and the authentication server may perform subscription information authentication.
  • the authentication server for signing information authentication may be the same server as the authentication server for device identification authentication in this example, or may be a different server.
  • the authentication server authenticated by the subscription information and the authentication server authenticated by the device identification The illustration of the same server is not limited.
  • Step 703 If the subscription information is successfully authenticated, the authentication server may send the subscription information authentication response to the SEAF.
  • Step 704 The SEAF may determine whether to perform device identity authentication on the UE. For example, the AMF may determine whether to perform device identity authentication on the UE according to the operator's requirement or the subscription information of the UE. If device identification authentication is not required, the SEAF directly forwards the subscription information authentication response to complete the network access of the UE. If device ID authentication is required, the next steps are taken.
  • the operator For device identification authentication, for example, the operator requires device ID authentication for the UE. Specifically, because the operator can require the USIM card to be bound to the UE, the operator can pre-configure the information required to bind the USIM card to the UE.
  • SEAF SEAF may also obtain information that requires the binding of the USIM card and the UE through an authentication server or the like. For example, a user who is often in Shanghai suddenly appears in Beijing, and the network will authenticate the UE to check whether the USIM of the user is stolen.
  • Step 705 The SEAF sends a device identification request to the AMF to request the device identifier of the UE.
  • Step 706 The AMF sends the device identification request to the UE to request the device identifier of the UE.
  • Step 707 The UE sends a device identifier to the AMF, where the device identifier may be an IMEI.
  • Step 708 After receiving the device identifier, the AMF sends the device identifier to the SEAF, where the device identifier can be delivered through a Diameter message.
  • Step 709 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the specific embodiment 4 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 801 The UE sends an attach request to the AMF, where the attach request may include a device identifier authentication request.
  • the device identifier authentication request may be implemented by using an equipment identifier authentication indicator.
  • Step 802 The AMF sends the device identifier authentication request to the SEAF.
  • Step 803 The SEAF may determine whether to perform device identity authentication on the UE. For example, the AMF may determine whether to perform device identity authentication on the UE according to the operator's requirement or the subscription information of the UE. If device identification authentication is not required, the SEAF directly forwards the subscription information authentication response to complete the network access of the UE. If device ID authentication is required, the next steps are taken.
  • the operator For device identification authentication, for example, the operator requires device ID authentication for the UE. Specifically, because the operator can require the USIM card to be bound to the UE, the operator can pre-configure the information required to bind the USIM card to the UE.
  • SEAF SEAF may also obtain information that requires the binding of the USIM card and the UE through an authentication server or the like. For example, a user who is often in Shanghai suddenly appears in Beijing, and the network will authenticate the UE to check whether the USIM of the user is stolen.
  • Step 804 The SEAF sends a device identification request to the AMF to request the device identifier of the UE.
  • Step 805 The AMF sends the device identification request to the UE to request the device identifier of the UE, and the message for transmitting the device identifier request may be a NAS SMC message.
  • Step 806 The UE sends a device identifier to the AMF, where the device identifier may be an IMEI, and the message for transmitting the device identifier may be a NAS SMP message.
  • the device identifier may be an IMEI
  • the message for transmitting the device identifier may be a NAS SMP message.
  • Step 807 After receiving the device identifier, the AMF sends the device identifier to the SEAF, where the device identifier can be delivered through a Diameter message.
  • Step 808 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the specific embodiment 5 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 901 The UE sends an attach request to the AMF, where the attach request may include a device identifier authentication request.
  • the device identifier authentication request may be implemented by using an equipment identifier authentication indicator.
  • Step 902 The AMF sends the device identifier authentication request to the SEAF.
  • Step 903 The SEAF may determine whether to perform device identity authentication on the UE.
  • Step 904 The SEAF sends an EAP request to the AMF, where the EAP request may include a device identification request to request the device identifier of the UE.
  • Step 905 The AMF sends the EAP request to the UE, where the EAP request may include a device identification request to request the device identifier of the UE, and the message for transmitting the EAP request may be a NAS SMC message.
  • Step 906 The UE sends a device identifier to the AMF, where the device identifier may be an IMEI, and the message for transmitting the device identifier may be a NAS SMP message.
  • the device identifier may be an IMEI
  • the message for transmitting the device identifier may be a NAS SMP message.
  • Step 907 After receiving the device identifier, the AMF sends the device identifier to the SEAF, where the device identifier can be delivered through a Diameter message.
  • Step 908 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the specific embodiment 6 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 1001 The UE sends an attach request to the AMF.
  • Step 1002 The AMF sends a NAS SMC message to the UE.
  • Step 1003 The UE sends a device identity authentication request to the AMF, where the message for transmitting the device identity authentication request may be a NAS SMP message.
  • Step 1004 The AMF sends a device identity authentication request to the SEAF.
  • the specific embodiment 7 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 1101 The UE sends an attach request to the AMF.
  • Step 1102 The AMF sends a NAS SMC message to the UE.
  • Step 1103 The UE sends a device identity authentication request to the AMF, where the device identity authentication request includes a device identifier, such as an IMEI.
  • the message conveying the device identification authentication request may be a NAS SMP message.
  • Step 1104 The AMF sends a device identifier authentication request to the SEAF, where the device identifier authentication request includes a device identifier.
  • Step 1105 The SEAF may determine whether to perform device identity authentication on the UE. For example, the AMF may determine whether to perform device identity authentication on the UE according to the operator's requirement or the subscription information of the UE. If device identification authentication is not required, then The SEAF directly forwards the subscription information authentication response to complete the network access of the UE. If device ID authentication is required, the next steps are taken.
  • the operator For device identification authentication, for example, the operator requires device ID authentication for the UE. Specifically, because the operator can require the USIM card to be bound to the UE, the operator can pre-configure the information required to bind the USIM card to the UE.
  • SEAF SEAF may also obtain information that requires the binding of the USIM card and the UE through an authentication server or the like. For example, a user who is often in Shanghai suddenly appears in Beijing, and the network will authenticate the UE to check whether the USIM of the user is stolen.
  • Step 1106 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the specific embodiment 8 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include AMF, SEAF.
  • Step 1201 The UE sends an attach request to the AMF, where the device identifier authentication request is included.
  • the device identifier authentication request may be implemented by using an equipment identifier authentication indicator.
  • Step 1202 The AMF may determine, according to the device identity authentication request, whether to perform device authentication on the UE.
  • Step 1203 The AMF may send a device identification request to the UE to request the device identifier, where the message conveying the device identifier request may be a NAS SMC message.
  • Step 1204 The UE may send a device identifier to the AMF, where the message conveying the device identifier may be a NAS SMP message.
  • Step 1205 The AMF sends the device identifier to the SEAF.
  • Step 1206 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the specific embodiment 9 of the present invention is specifically introduced in conjunction with the method provided by the embodiment of the present invention.
  • the core network devices in this example may include SMF, AMF, SEAF.
  • Step 1301 The UE sends a session establishment request to the SMF, where the device identifier authentication request is included.
  • the device identifier authentication request may be implemented by using an equipment identifier authentication indicator.
  • Step 1302 The SMF may determine, according to the device identifier authentication request, whether to perform device authentication on the UE.
  • the SMF may determine, according to the device identifier authentication request, whether to perform device authentication on the UE.
  • Step 1303 The SMF may send a device identification request to the UE to request the device identifier.
  • Step 1304 The UE may send a device identifier, for example, an IMEI, to the SMF.
  • a device identifier for example, an IMEI
  • step 1305 the SMF sends the device identifier to the AMF.
  • Step 1306 The AMF may send the device identifier to the SEAF.
  • Step 1307 The SEAF may send an EAP device identity authentication request to the authentication server, where the EAP device identity authentication request includes the device identifier.
  • the embodiment of the present invention provides an authentication server 1400.
  • the authentication server 1400 includes a processing module 1401 and a communication module 1402.
  • the processing module 1401 is configured to control the communication module 1402; the communication module 1402 Receiving a first request from the core network device, where the first request includes a device identifier of the user equipment UE, and the processing module 1401 selects, according to the device identifier, an extensible authentication protocol EAP device identifier authentication manner, and is based on the selection
  • the method performs EAP device identity authentication on the UE.
  • processing module 1401 and the communication module 1402 For other functions of the processing module 1401 and the communication module 1402, reference may be made to the content of the method in the above, and details are not described herein.
  • the embodiment of the present invention provides a core network device 1500.
  • the core network device 1500 includes a processing module 1501 and a communication module 1502.
  • the processing module 1501 is configured to control the communication module 1502.
  • the communication module 1502 acquires the device identifier of the UE from the user equipment UE.
  • the communication module 1502 sends a first request to the authentication server, where the first request includes the device of the UE. And identifying, by the device, a selection of an extensible authentication protocol EAP device identity authentication mode used by the UE.
  • processing module 1501 and the communication module 1502 For other functions of the processing module 1501 and the communication module 1502, reference may be made to the content of the method in the above, and details are not described herein.
  • the beneficial effects of the core network device 1500 can be referred to the content of the method in the above, and are not described here.
  • the embodiment of the present invention provides an authentication server 1600.
  • the authentication server 1600 includes a processor 1601 and a communication interface 1602, and is configured to perform an authentication method provided by an embodiment of the present invention.
  • the authentication server 1600 includes a processor 1601 and a communication interface 1602, and is configured to perform an authentication method provided by an embodiment of the present invention.
  • the content of the above methods please refer to the content of the above methods, which are not described here.
  • the beneficial effects of the authentication server 1600 can be referred to the content of the method in the above, and are not described here.
  • the embodiment of the present invention provides a core network device 1700.
  • the core network device 1700 includes a processor 1701 and a communication interface 1702 for performing an authentication method provided by an embodiment of the present invention.
  • a processor 1701 for performing an authentication method provided by an embodiment of the present invention.
  • a communication interface 1702 for performing an authentication method provided by an embodiment of the present invention.
  • the beneficial effects of the core network device 1700 can be referred to the content of the method in the above, and are not described here.
  • processors in the embodiment of the present application may be a central processing unit (CPU), and may be other general-purpose processors, digital signal processors (DSPs), and application specific integrated circuits. (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof.
  • a general purpose processor can be a microprocessor or any conventional processor.
  • the method steps in the embodiments of the present application may be implemented by means of hardware, or may be implemented by a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (Programmable ROM). , PROM), Erasable PROM (EPROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Register, Hard Disk, Mobile Hard Disk, CD-ROM, or well known in the art Any other form of storage medium.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the calculation The machine program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in or transmitted by a computer readable storage medium.
  • the computer instructions can be from a website site, computer, server or data center to another website site by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) Transfer from a computer, server, or data center.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及一种鉴权方法，所述方法包括：鉴权服务器从核心网设备接收第一请求，所述第一请求包括用户设备UE的设备标识；所述鉴权服务器根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。本发明实施例提供的鉴权方法，可以适应多种鉴权模式，能够支持各种信任状类型的用户设备，从而克服了现有技术中设备标识鉴权方式固定的弊端。

Description

一种鉴权方法、鉴权服务器和核心网设备 技术领域
本发明涉及移动通信领域，特别涉及一种鉴权方法、鉴权服务器和核心网设备。
背景技术
随着通信技术的不断发展，网络能够支持的用户设备(User Equipment，UE)数量和种类越来越多。为了能够保障网络环境的安全，需要对用户设备进行鉴权，以阻止安全性能过低、来源不明、报废翻新等用户设备接入网络。现有技术中，用户设备标识鉴权有以下方式。
基于用户设备的国际移动设备身份码(International Mobile Equipment Identity，IMEI)和证书绑定的用户设备标识鉴权方法。如图1所示；101、用户设备需要预先配置设备证书和设备证书相关私钥，网络侧需要预先配置IMEI与设备证书的绑定关系；102、在用户设备与认证、授权和计费(Authentication,Authorization and Accounting,AAA)/归属用户服务器(Home Subscriber Server，HSS)间进行用户身份鉴权；103-105、安全锚点功能(Security Anchor Function，SEAF)实体向用户设备发送设备标识鉴权请求，用户设备使用私钥对(IMEI，新鲜值(fresh)，挑战(challenge))进行签名，然后连同IMEI发送给SEAF；106-108，请求设备证书；109、使用设备证书检查签名，以完成设备标识鉴权。
基于用户设备的IMEI和公钥绑定的用户设备标识鉴权方法。如图2所示，201、用户设备需要预先配置公私钥对，网络侧需要预先配置IMEI与设备公钥的绑定关系；202、在用户设备与AAA/HSS间进行用户身份鉴权；203-205、SEAF向用户设备发送设备标识鉴权请求，用户设备使用私钥对(IMEI，新鲜值，挑战)进行签名，然后连同IMEI发送给SEAF；206-208，请求设备公钥；209、使用设备公钥检查签名，以完成设备标识鉴权。
上述用户设备标识鉴权方法的鉴权模式固定、支持的设备数量和种类有限，没有考虑到下一代网络中的具有不同信任状类型的设备接入。
发明内容
本发明实施例提供了一种鉴权方法、鉴权服务器和核心网设备，采用了EAP设备标识鉴权的方式，可以适应多种鉴权模式，能够支持多种信任状类型的用户设备，能够满足下一代网络中的用户设备标识鉴权需求。
第一方面，本发明实施例提供了一种鉴权方法，该方法包括：鉴权服务器从核心网设 备接收第一请求，所述第一请求包括用户设备UE的设备标识；所述鉴权服务器根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。
本发明实施例提供的鉴权方法，可以根据UE的设备标识选择EAP设备标识鉴权的方法，并基于选择的方式对所述UE进行EAP设备标识鉴权，可以适应多种鉴权模式，能够支持各种信任状类型的用户设备，从而克服了现有技术中设备标识鉴权方式固定的弊端。
在一种可能的实现方式中，在所述鉴权服务器从所述核心网设备接收所述第一请求之前，所述方法还包括：所述鉴权服务器向所述核心网设备发送第一响应，所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断。
在一种可能的实现方式中，所述鉴权服务器基于所述选择的方式对所述UE进行EAP设备标识鉴权，包括：所述鉴权服务器向所述UE发送所述选择的设备标识鉴权的方式。
在一种可能的实现方式中，所述鉴权服务器生成第一密钥；所述鉴权服务器向所述核心网设备发送第二响应消息，所述第二响应消息包括所述第一密钥，所述第一密钥用于所述核心网设备内密钥的更新。
在本发明实施例中，可以更新核心网设备中的密钥，在签约信息鉴权所产生的密钥泄露时，仍可以保证安全通信。
在一种可能的实现方式中，所述鉴权服务器包括鉴权服务器功能AUSF实体和/或鉴权信任状存储和处理功能ARPF实体。
在一种可能的实现方式中，所述核心网设备包括安全锚点功能SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
第二方面，本发明实施例还提供了另一种鉴权方法，所述方法包括：核心网设备从用户设备UE获取所述UE的设备标识；所述核心网设备向鉴权服务器发送第一请求，所述第一请求包括所述UE的设备标识，所述设备标识用于所述UE的可扩展认证协议EAP设备标识鉴权方式的选择。
在一种可能的实现方式中，所述方法还包括：所述核心网设备从所述UE接收第二请求，或，从所述鉴权服务器接收第一响应，所述第二请求或所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断；所述核心网设备收到所述第一响应或所述第二请求后，决定是否对所述UE进行设备标识鉴权。
在一种可能的实现方式中，所述方法还包括：所述核心网设备向所述UE发送第三请求，以请求所述设备标识。
在一种可能的实现方式中，所述核心网设备向所述UE发送设第三请求，包括：所述核心网设备通过非接入层安全模式命令NAS SMC消息向所述UE发送所述第三请求。
在一种可能的实现方式中，所述核心网设备向所述UE发送第三请求，包括：所述核心网设备向所述UE发送EAP请求，所述EAP请求包括所述第三请求。
在一种可能的实现方式中，所述第二请求包括所述设备标识；所述核心网设备获取所述设备标识包括：所述核心网设备从所述第二请求中获取所述设备标识。
在一种可能的实现方式中，所述核心网设备获取所述设备标识，包括：所述核心网设备从所述UE接收非接入层安全模式完成NAS SMP消息，所述NAS SMP消息包括所述设备标识。
在一种可能的实现方式中，所述方法还包括：所述核心网设备从所述鉴权服务器接收第二响应消息，所述第二响应消息包括第一密钥；所述核心网设备根据所述第一密钥更新所述核心网设备存储的第二密钥。
在一种可能的实现方式中，所述核心网设备包括安全锚点功能SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
在一种可能的实现方式中，所述鉴权服务器包括鉴权服务器功能AUSF实体和/或鉴权信任状存储和处理功能ARPF实体。
第三方面，本发明实施例提供了一种鉴权服务器，所述服务器包括：处理模块和通信模块；所述通信模块从核心网设备接收第一请求，所述第一请求包括用户设备UE的设备标识；所述处理模块根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。
第四方面，本发明实施例提供了一种核心网设备，所述核心网设备包括：处理模块和通信模块；所述通信模块从用户设备UE获取所述UE的设备标识；所述通信模块向鉴权服务器发送第一请求，所述第一请求包括所述UE的设备标识，所述设备标识用于所述UE的可扩展认证协议EAP设备标识鉴权方式的选择。
第五方面，本发明实施例还提供了一种鉴权服务器，所述服务器包括：处理器和通信接口；所述处理器和所述通信接口用于执行第一方面提供的鉴权方法。
第六方面，本发明实施例还提供了一种核心网设备，所述核心网设备包括：处理器和通信接口；所述处理器和所述通信接口用于执行第二方面提供的鉴权方法。
第七方面，本发明实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第八方面，本发明实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本发明实施例提供的鉴权方法、鉴权服务器和核心网设备，采用了EAP设备标识鉴权的方式，可以适应多种鉴权模式，能够支持多种信任状类型的用户设备，克服了现有技术中设备标识鉴权方式固定的弊端，能够满足下一代网络中的用户设备标识鉴权需求。
附图说明
图1为现有技术中一种设备标识鉴权方法示意性流程交互图；
图2为现有技术中另一种设备标识鉴权方法示意性流程交互图；
图3为本发明实施例提供一种鉴权方法的流程图；
图4为本发明实施例提供的另一种鉴权方法的流程图；
图5为本发明具体实施例1提供的鉴权方法示意性流程交互图；
图6为本发明具体实施例2提供的鉴权方法示意性流程交互图；
图7为本发明具体实施例3提供的鉴权方法示意性流程交互图；
图8为本发明具体实施例4提供的鉴权方法示意性流程交互图；
图9为本发明具体实施例5提供的鉴权方法示意性流程交互图；
图10为本发明具体实施例6提供的鉴权方法示意性流程交互图；
图11为本发明具体实施例7提供的鉴权方法示意性流程交互图；
图12为本发明具体实施例8提供的鉴权方法示意性流程交互图；
图13为本发明具体实施例9提供的鉴权方法示意性流程交互图；
图14为本发明实施例提供的一种鉴权服务器结构示意图；
图15为本发明实施例提供的一种核心网设备结构示意图；
图16为本发明实施例提供的另一种鉴权服务器结构示意图；
图17为本发明实施例提供的另一种核心网设备结构示意图。
具体实施方式
下面将结合附图，对本发明实施例中的技术方案进行描述。显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。
本申请的实施例中的UE可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(Virtual Reality，VR)终端设备、增强现实(Augmented Reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请的实施例对应用场景不做限定。
在第三代伙伴关系项目(3rd Generation Partnership Project，3GPP)系统中，UE可以存在两种标识，UE的使用用户的用户标识，例如，用于识别用户签约信息的国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)，和，该UE的设备标识，例如，IMEI。IMSI可以在用户身份鉴权过程中网络使用鉴权和密钥协商(Authentication and Key Agreement，AKA)进行鉴权，因此，IMSI对于网络是可信的。
设备标识，例如IMEI，不仅是封堵失窃的UE、阻止UE被非法转售及恢复找回UE正常运行的关键依据，还可以在IMSI不存在或用户身份鉴权失败时用于紧急呼叫，并且IMEI存在被修改或克隆的可能，因此，需要UE接入网络时对设备进行鉴权，以确保该UE的IMEI是可信的。此外，由于下一代网络所支持的设备在数量和种类上大大增加，为保证提供一个安全的网络环境，需阻止一些安全性能过低的设备接入网络，这就有必要对设备进行鉴权，以判断该设备是否在需要被阻止的范围内，因此也需要确保设备标识对网络是可信的。
设备标识鉴权是一种通过鉴权设备标识来对某一设备进行鉴权的方式。
可扩展认证协议(Extensible Authentication Protocol，EAP)，是一种可以扩展的认证机制，它常被用于无线网络或点到点的连接中。EAP不仅可以用于无线局域网，而且可以用于有线局域网，但它在无线局域网中使用的更频繁。EAP是一个认证框架，不是 一个特殊的认证机制。EAP提供一些公共的功能，并且允许协商所希望的认证机制。EAP协议只是一个认证框架，没有明确指出具体的认证方法，因此这种认证机制结合了EAP协议和操作者选用的EAP认证方法(比如EAP-TLS,EAP-SIM,EAP-AKA,PEAP)。本发明实施例提供的用户设备标识鉴权方法利用EAP这一特性，扩展了设备标识鉴权方式，可以适应多种鉴权模式，能够支持各种信任状类型的用户设备，能够满足下一代网络中的用户设备标识鉴权需求。具体地，在本发明实施例提供的方法中，可以由收到UE的设备标识后的SEAF或者MME，向鉴权服务器或HSS发送EAP设备标识鉴权请求，以使鉴权服务器或HSS对UE进行EAP设备标识鉴权。
本申请实施例提供的方法可以应用于下一代网络。在本申请实施例中，下一代网络的核心网设备可以包括安全锚点功能(Security Anchor Function，SEAF)实体，是下一代网络的核心网中与AUSF和UE交互的网元，在鉴权流程后，接收中间密钥。在一个示例中，还可以包括接入和移动管理功能(Access and Mobility management Function，AMF)实体，其主要功能是负责移动管理、接入管理等。在一个示例中，下一代网络的核心网设备还可以包括，会话管理功能(Session Management Function，SMF)实体，其主要功能是为UE建立会话、分配会话身份(Identification，ID)、管理或终止会话等。下一代网络的鉴权服务器，用于根据SEAF发来的设备标识鉴权请求、对UE进行鉴权以及负责存安全储信任状等信息等。鉴权服务器可以包括鉴权服务器功能(Authentication Server Function，AUSF)实体和/或鉴权信任状存储和处理功能(Authentication Credential Repository and Processing Function，ARPF)实体。
下一代网络应当说明的是，本发明实施例提供的方法也可以应用于长期演进(Long Term Evolution，LTE)网络以及之前各代网络。其中，在LTE中，核心网设备可以是移动管理实体(Mobile Management Entity，MME)；鉴权服务器可以是归属用户服务器(Home Subscriber Server，HSS)，也可以是第三方用于设备标识鉴权的服务器。
结合图3对本发明实施例提供的鉴权方法进行具体说明。该方法的执行主体可以为鉴权服务器。该方法包括以下步骤。
步骤301、鉴权服务器从核心网设备接收第一请求，所述第一请求包括用户设备UE的设备标识。
在一个示例中，UE的设备标识可以为UE的IMEI。
在一个示例中，鉴权服务器可以包括AUSF和/或ARPF。
在一个示例中，核心网设备可以包括SEAF，鉴权服务器可以从SEAF接收第一请求。
在一个示例中，核心网设备可以包括AMF，鉴权服务器可以从AMF接收第一请求。
在一个示例中，核心网设备可以包括SMF，鉴权服务器可以从SMF接收第一请求。
在一个示例中，鉴权服务器可以包括HSS。
在一个示例中，核心网设备可以包括MME，鉴权服务器可以从MME接收第一请求。
步骤302、所述鉴权服务器根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。
在一个示例中，鉴权服务器基于选择的方式对UE进行EAP设备标识鉴权可以包括：鉴权服务器向UE发送所述选择的设备标识鉴权的方式。
在一个示例中，本发明实施例提供的鉴权方法还可以包括：鉴权服务器生成第一密钥；所述鉴权服务器向所述核心网设备发送第二响应消息，所述第二响应消息包括所述第一密钥，所述第一密钥用于所述核心网设备内密钥的更新。
本发明实施例提供的一种鉴权方法，采用了可扩展认证协议EAP，可以适应多种鉴权模式，能够支持多种信任状类型的用户设备，能够满足下一代网络中的用户设备标识的鉴权需求。
本发明实施例还提供了另一种鉴权方法，结合图4对本发明实施例提供的另一种鉴权方法进行具体说明。该方法的执行主体可以为核心网设备。该方法包括以下步骤。
步骤401、核心网设备从用户设备UE获取所述UE的设备标识。
步骤402、核心网设备向鉴权服务器发送第一请求，所述第一请求包括所述UE的设备标识，所述设备标识用于所述UE的可扩展认证协议EAP设备标识鉴权方式的选择。
在一个示例中，核心网设备包括安全锚点功能实体SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
在一个示例中，该方法还包括：核心网设备从所述UE接收第二请求，或，从所述鉴权服务器接收第一响应，所述第二请求或所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断；所述核心网设备收到所述第一响应或所述第二请求后，决定是否对所述UE进行设备标识鉴权。
在一个示例中，该方法还包括：所述核心网设备向所述UE发送第三请求，以请求所述设备标识。
在一个示例中，所述核心网设备向所述UE发送设第三请求，包括：所述核心网设备通过非接入层安全模式命令(Non-Access Stratum Security Mode Command，NAS SMC)消息向所述UE发送所述第三请求。
在一个示例中，所述核心网设备向所述UE发送第三请求，包括：所述核心网设备向所述UE发送EAP请求，所述EAP请求包括所述第三请求。
在一个示例中，所述第二请求包括所述设备标识；所述核心网设备获取所述设备标识包括：所述核心网设备从所述第二请求中获取所述设备标识。
在一个示例中，所述核心网设备获取所述设备标识，包括：所述核心网设备从所述UE接收非接入层安全模式完成(Non-Access Stratum Security Mode Complete，NAS SMP)消息，所述NAS SMP消息包括所述设备标识。
在一个示例中，所述方法还包括：所述核心网设备从所述鉴权服务器接收第二响应消息，所述第二响应消息包括第一密钥；所述核心网设备根据所述第一密钥更新所述核心网设备存储的第二密钥。
在一个示例中，所述鉴权服务器包括鉴权服务器功能AUSF实体和/或鉴权信任状存储和鉴权信任状存储和处理功能ARPF实体。
本发明实施例提供的鉴权方法，采用了可扩展认证协议EAP，可以适应多种鉴权模式，能够支持多种信任状类型的用户设备，能够满足下一代网络中的用户设备标识的鉴权需求。
本发明具体实施例1，结合图5对本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF。
步骤501、UE向AMF发送附着请求，附着请求中可以包括设备标识鉴权请求，在一个 例子中，设备标识鉴权请求可以通过设备标识鉴权指示符(equipment identifier authentication indicator)实现。
步骤502、UE与鉴权服务器可以进行签约信息鉴权。应当说明的是，签约信息鉴权的鉴权服务器可以与本示例中的设备标识鉴权的鉴权服务器可以是同一个服务器，也可以是不同的服务器。在本示例中，以签约信息鉴权的鉴权服务器和设备标识鉴权的鉴权服务器为同一个服务器进行举例说明，并不限定。
步骤503、如果签约信息鉴权成功，鉴权服务器可以向AMF发送签约信息鉴权响应。
步骤504、AMF可以决定是否对UE进行设备标识鉴权。例如，AMF可以根据运营商需求或UE的签约信息判断是否对UE进行设备标识鉴权。如果无需进行设备标识鉴权，则AMF直接转发签约信息鉴权响应，以完成UE的网络接入。如果需要进行设备标识鉴权，则进行后续步骤。关于设备标识鉴权，比如，运营商要求对UE进行设备标识鉴权；具体地，因为运营商可以要求USIM卡和UE绑定，运营商可以将要求USIM卡和UE绑定的信息预先配置在SEAF中，也可以是SEAF通过鉴权服务器等获得要求USIM卡和UE绑定的信息。例如，一个经常在上海的用户突然之间出现在了北京，此时网络会对该UE进行鉴权，以检查该用户的USIM是不是被盗。
步骤505、AMF向UE发送设备标识请求，以请求UE的设备标识，传递设备标识请求的消息可以是NAS SMC消息。
步骤506、UE向AMF发送设备标识，该设备标识可以为IMEI，传递设备标识的消息可以是NAS SMP消息。
步骤507、AMF接收到设备标识后，可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
步骤508、鉴权服务器可以根据接收的EAP设备标识鉴权请求选择EAP设备标识鉴权的方式，具体地，可以根据设备标识为UE选择EAP设备标识鉴权的方式。可以假设UE的信任状、信任状与设备标识的对应关系预先存储在鉴权服务器中，鉴权服务器可以根据设备标识所对应的信任状选择匹配的EAP设备标识鉴权方式，其中，信任状可以包括但不限于证书、密钥或其他信任状，EAP设备标识鉴权的方式可以包括但不限于EAP-AKA、EAP-TLS、EAP-TTLS等。其中，鉴权服务器可以为运营商拥有，也可以为第三方拥有。
步骤509、鉴权服务器可以根据步骤508选择的EAP设备标识鉴权的方式对UE进行设备标识鉴权。例如，UE和鉴权服务器间消息交互的次数取决于鉴权服务器选择的EAP设备标识鉴权的方式。
步骤510、鉴权服务器向AMF发送设备标识鉴权成功消息(比如，EAP成功消息)，其中，在一个例子中，设备标识鉴权成功消息可以包括鉴权服务器在设备标识鉴权成功后生成的第一密钥。
步骤511、如果AMF接收到的设备标识鉴权成功消息中包括第一密钥，AMF可以根据第一密钥对AMF中的签约信息鉴权中生成的密钥进行更新。应当说明的是，步骤511是可选的，比如，如果网络需要使用设备标识鉴权信任状(Credential)绑定安全上下文以更新安全上下文，则AMF可以对AMF中的签约信息鉴权中生成的密钥进行更新。或者，若第一密钥发生泄漏，也可执行该更新操作，从而保证安全通信。
步骤512、AMF向UE发送NAS SMC消息，其中，可以包括设备标识鉴权成功消息(如， EAP成功消息)并且，如果AMF中的密钥有更新，则更新密钥所使用的参数也可以附带在NAS SMC消息中。
步骤513、UE向AMF发送NAS SMP消息。
步骤514、AMF向UE发送附着接受消息。
本发明具体实施例2结合图6对本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤601、UE向AMF发送附着请求。
步骤602、UE与鉴权服务器可以进行签约信息鉴权。应当说明的是，签约信息鉴权的鉴权服务器可以与本示例中的设备标识鉴权的鉴权服务器可以是同一个服务器，也可以是不同的服务器。在本示例中，以签约信息鉴权的鉴权服务器和设备标识鉴权的鉴权服务器为同一个服务器进行举例说明，并不限定。
步骤603、如果签约信息鉴权成功，鉴权服务器可以向SEAF发送签约信息鉴权响应
步骤604、SEAF可以决定是否对UE进行设备标识鉴权。例如，AMF可以根据运营商需求或UE的签约信息判断是否对UE进行设备标识鉴权。如果无需进行设备标识鉴权，则SEAF直接转发签约信息鉴权响应，以完成UE的网络接入。如果需要进行设备标识鉴权，则进行后续步骤。关于设备标识鉴权，比如，运营商要求对UE进行设备标识鉴权；具体地，因为运营商可以要求USIM卡和UE绑定，运营商可以将要求USIM卡和UE绑定的信息预先配置在SEAF中，也可以是SEAF通过鉴权服务器等获得要求USIM卡和UE绑定的信息。例如，一个经常在上海的用户突然之间出现在了北京，此时网络会对该UE进行鉴权，以检查该用户的USIM是不是被盗。
步骤605、SEAF向AMF发送EAP请求，EAP请求中可以包括设备标识请求，以请求UE的设备标识。
步骤606、AMF向UE发送该EAP请求，该EAP请求中可以包括设备标识请求，以请求UE的设备标识。
步骤607、UE向AMF发送设备标识，该设备标识可以为IMEI。
步骤608、AMF接收到设备标识后，将该设备标识发送给SEAF。
步骤609、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
步骤610、鉴权服务器可以根据接收的EAP设备标识鉴权请求选择EAP设备标识鉴权的方式，具体的择方式可以参照上述具体实施例1记载的内容，此处不再赘述。
步骤611至步骤613、鉴权服务器可以将步骤610中选择的EAP设备标识鉴权的方式发送给UE。
后续步骤，可以参照上述具体实施例1记载的内容，此处不再赘述。
本发明具体实施例3结合图7本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤701、UE向AMF发送附着请求。
步骤702、UE与鉴权服务器可以进行签约信息鉴权。应当说明的是，签约信息鉴权的鉴权服务器可以与本示例中的设备标识鉴权的鉴权服务器可以是同一个服务器，也可以是不同的服务器。在本示例中，以签约信息鉴权的鉴权服务器和设备标识鉴权的鉴权服务器 为同一个服务器进行举例说明，并不限定。
步骤703、如果签约信息鉴权成功，鉴权服务器可以向SEAF发送签约信息鉴权响应。
步骤704、SEAF可以决定是否对UE进行设备标识鉴权。例如，AMF可以根据运营商需求或UE的签约信息判断是否对UE进行设备标识鉴权。如果无需进行设备标识鉴权，则SEAF直接转发签约信息鉴权响应，以完成UE的网络接入。如果需要进行设备标识鉴权，则进行后续步骤。关于设备标识鉴权，比如，运营商要求对UE进行设备标识鉴权；具体地，因为运营商可以要求USIM卡和UE绑定，运营商可以将要求USIM卡和UE绑定的信息预先配置在SEAF中，也可以是SEAF通过鉴权服务器等获得要求USIM卡和UE绑定的信息。例如，一个经常在上海的用户突然之间出现在了北京，此时网络会对该UE进行鉴权，以检查该用户的USIM是不是被盗。
步骤705、SEAF向AMF发送设备标识请求，以请求UE的设备标识。
步骤706、AMF向UE发送该设备标识请求，以请求UE的设备标识。
步骤707、UE向AMF发送设备标识，该设备标识可以为IMEI。
步骤708、AMF接收到设备标识后，将该设备标识发送给SEAF，其中，该设备标识可以通过Diameter消息传递。
步骤709、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
后续步骤，可以参照上述具体实施例2记载的内容，此处不再赘述。
本发明具体实施例4结合图8本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤801、UE向AMF发送附着请求，附着请求中可以包括设备标识鉴权请求，在一个例子中，设备标识鉴权请求可以通过设备标识鉴权指示符(equipment identifier authentication indicator)实现。
步骤802、AMF将上述设备标识鉴权请求发送给SEAF。
步骤803、SEAF可以决定是否对UE进行设备标识鉴权。例如，AMF可以根据运营商需求或UE的签约信息判断是否对UE进行设备标识鉴权。如果无需进行设备标识鉴权，则SEAF直接转发签约信息鉴权响应，以完成UE的网络接入。如果需要进行设备标识鉴权，则进行后续步骤。关于设备标识鉴权，比如，运营商要求对UE进行设备标识鉴权；具体地，因为运营商可以要求USIM卡和UE绑定，运营商可以将要求USIM卡和UE绑定的信息预先配置在SEAF中，也可以是SEAF通过鉴权服务器等获得要求USIM卡和UE绑定的信息。例如，一个经常在上海的用户突然之间出现在了北京，此时网络会对该UE进行鉴权，以检查该用户的USIM是不是被盗。
步骤804、SEAF向AMF发送设备标识请求，以请求UE的设备标识。
步骤805、AMF向UE发送该设备标识请求，以请求UE的设备标识，传递设备标识请求的消息可以是NAS SMC消息。
步骤806、UE向AMF发送设备标识，该设备标识可以为IMEI，传递设备标识的消息可以是NAS SMP消息。
步骤807、AMF接收到设备标识后，将该设备标识发送给SEAF，其中，该设备标识可以通过Diameter消息传递。
步骤808、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
后续步骤，可以参照上述具体实施例2记载的内容，此处不再赘述。
本发明具体实施例5结合图9本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤901、UE向AMF发送附着请求，附着请求中可以包括设备标识鉴权请求，在一个例子中，设备标识鉴权请求可通过设备标识鉴权指示符(equipment identifier authentication indicator)实现。
步骤902、AMF将上述设备标识鉴权请求发送给SEAF。
步骤903、SEAF可以决定是否对UE进行设备标识鉴权。
步骤904、SEAF向AMF发送EAP请求，EAP请求中可以包括设备标识请求，以请求UE的设备标识。
步骤905、AMF向UE发送该EAP请求，该EAP请求中可以包括设备标识请求，以请求UE的设备标识，传递EAP请求的消息可以是NAS SMC消息。
步骤906、UE向AMF发送设备标识，该设备标识可以为IMEI，传递设备标识的消息可以是NAS SMP消息。
步骤907、AMF接收到设备标识后，将该设备标识发送给SEAF，其中，该设备标识可以通过Diameter消息传递。
步骤908、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
后续步骤，可以参照上述具体实施例2记载的内容，此处不再赘述。
本发明具体实施例6结合图10本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤1001、UE向AMF发送附着请求。
步骤1002、AMF向UE发送NAS SMC消息。
步骤1003、UE向AMF发送设备标识鉴权请求，其中，传递设备标识鉴权请求的消息可以是NAS SMP消息。
步骤1004、AMF将设备标识鉴权请求发送给SEAF。
后续步骤可以参考具体实施例3记载的内容，此处不再赘述。
本发明具体实施例7结合图11本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤1101、UE向AMF发送附着请求。
步骤1102、AMF向UE发送NAS SMC消息。
步骤1103、UE向AMF发送设备标识鉴权请求，其中，设备标识鉴权请求中包括设备标识，例如IMEI。传递设备标识鉴权请求的消息可以是NAS SMP消息。
步骤1104、AMF将设备标识鉴权请求发送给SEAF，其中，设备标识鉴权请求中包括设备标识。
步骤1105、SEAF可以决定是否对UE进行设备标识鉴权。例如，AMF可以根据运营商需求或UE的签约信息判断是否对UE进行设备标识鉴权。如果无需进行设备标识鉴权，则 SEAF直接转发签约信息鉴权响应，以完成UE的网络接入。如果需要进行设备标识鉴权，则进行后续步骤。关于设备标识鉴权，比如，运营商要求对UE进行设备标识鉴权；具体地，因为运营商可以要求USIM卡和UE绑定，运营商可以将要求USIM卡和UE绑定的信息预先配置在SEAF中，也可以是SEAF通过鉴权服务器等获得要求USIM卡和UE绑定的信息。例如，一个经常在上海的用户突然之间出现在了北京，此时网络会对该UE进行鉴权，以检查该用户的USIM是不是被盗。
步骤1106、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
后续步骤可以参考具体实施例2记载的内容，此处不再赘述。
本发明具体实施例8结合图12本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括AMF、SEAF。
步骤1201、UE向AMF发送附着请求，其中，包括设备标识鉴权请求，在一个例子中，设备标识鉴权请求可通过设备标识鉴权指示符(equipment identifier authentication indicator)实现。
步骤1202、AMF可以根据设备标识鉴权请求决定是否对UE进行设备鉴权。
步骤1203、AMF可以向UE发送设备标识请求，以请求设备标识，其中，传递设备标识请求的消息可以是NAS SMC消息。
步骤1204、UE可以向AMF发送设备标识，其中，传递设备标识的消息可以是NAS SMP消息。
步骤1205、AMF将设备标识发送给SEAF。
步骤1206、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
后续步骤可以参考具体实施例2记载的内容，此处不再赘述。
本发明具体实施例9结合图13本发明实施例提供的方法进行具体介绍。该示例中核心网设备可以包括SMF、AMF、SEAF。
步骤1301、UE向SMF发送会话建立请求，其中，包括设备标识鉴权请求，在一个例子中，设备标识鉴权请求可以通过设备标识鉴权指示符(equipment identifier authentication indicator)实现。
步骤1302、SMF可以根据设备标识鉴权请求决定是否对UE进行设备鉴权，具体过程可参考上述具体实施例，此处不再赘述。
步骤1303、SMF可以向UE发送设备标识请求，以请求设备标识。
步骤1304、UE可以向SMF发送设备标识，例如，IMEI。
步骤1305、SMF将可以设备标识发送给AMF。
步骤1306、AMF可以将设备标识发送给SEAF。
步骤1307、SEAF可以向鉴权服务器发送EAP设备标识鉴权请求，EAP设备标识鉴权请求包括设备标识。
后续步骤可以参考具体实施例2记载的内容，此处不再赘述。
本发明实施例提供了一种鉴权服务器1400，如图14所示，鉴权服务器1400包括处理模块1401和通信模块1402。其中，处理模块1401用于控制通信模块1402；通信模块1402 从核心网设备接收第一请求，所述第一请求包括用户设备UE的设备标识；处理模块1401根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。
处理模块1401和通信模块1402的其他功能可参照上文中有关方法的内容介绍，此处不在赘述。
鉴权服务器1400的有益效果可参照上文中有关方法的内容介绍，此处不在赘述。
本发明实施例提供了一种核心网设备1500，如图15所示，核心网设备1500包括处理模块1501和通信模块1502。其中，处理模块1501用于控制通信模块1502；通信模块1502从用户设备UE获取所述UE的设备标识；通信模块1502向鉴权服务器发送第一请求，所述第一请求包括所述UE的设备标识，所述设备标识用于所述UE的可扩展认证协议EAP设备标识鉴权方式的选择。
处理模块1501和通信模块1502的其他功能可参照上文中有关方法的内容介绍，此处不在赘述。
核心网设备1500的有益效果可参照上文中有关方法的内容介绍，此处不在赘述。
本发明实施例提供了一种鉴权服务器1600，如图16所示，鉴权服务器1600包括处理器1601和通信接口1602，用于执行本发明实施例提供的鉴权方法。具体内容可参照上文中有关方法的内容介绍，此处不在赘述。
鉴权服务器1600的有益效果可参照上文中有关方法的内容介绍，此处不在赘述。
本发明实施例提供了一种核心网设备1700，如图17所示，核心网设备1700包括处理器1701和通信接口1702，用于执行本发明实施例提供的鉴权方法。具体内容可参照上文中有关方法的内容介绍，此处不在赘述。
核心网设备1700的有益效果可参照上文中有关方法的内容介绍，此处不在赘述。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算 机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等”
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。
可以理解的是，在本申请的实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请的实施例的实施过程构成任何限定。
以上所述，仅为本申请的实施例的具体实施方式，任何熟悉本技术领域的技术人员在本申请公开揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本申请的实施例的保护范围之内。

Claims (34)

  1. 一种鉴权方法，其特征在于，所述方法包括：
    鉴权服务器从核心网设备接收第一请求，所述第一请求包括用户设备UE的设备标识；
    所述鉴权服务器根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。
  2. 根据权利要求1所述的方法，其特征在于，在所述鉴权服务器从所述核心网设备接收所述第一请求之前，所述方法还包括：
    所述鉴权服务器向所述核心网设备发送第一响应，所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断。
  3. 根据权利要求1或2所述的方法，其特征在于，所述鉴权服务器基于所述选择的方式对所述UE进行EAP设备标识鉴权，包括：
    所述鉴权服务器向所述UE发送所述选择的设备标识鉴权的方式。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述方法还包括：
    所述鉴权服务器生成第一密钥；
    所述鉴权服务器向所述核心网设备发送第二响应消息，所述第二响应消息包括所述第一密钥，所述第一密钥用于所述核心网设备内密钥的更新。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述鉴权服务器包括鉴权服务器功能AUSF实体和/或鉴权信任状存储和处理功能ARPF实体。
  6. 根据权利要求1至5任一所述的方法，其特征在于，所述核心网设备包括安全锚点功能SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
  7. 一种鉴权方法，其特征在于，所述方法包括：
    核心网设备从用户设备UE获取所述UE的设备标识；
    所述核心网设备向鉴权服务器发送第一请求，所述第一请求包括所述UE的设备标识，所述设备标识用于所述UE的可扩展认证协议EAP设备标识鉴权方式的选择。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    所述核心网设备从所述UE接收第二请求，或，从所述鉴权服务器接收第一响应，所述第二请求或所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断；
    所述核心网设备收到所述第一响应或所述第二请求后，决定是否对所述UE进行设备标识鉴权。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    所述核心网设备向所述UE发送第三请求，以请求所述设备标识。
  10. 根据权利要求9所述的方法，其特征在于，所述核心网设备向所述UE发送设第三请求，包括：
    所述核心网设备通过非接入层安全模式命令NAS SMC消息向所述UE发送所述第三请求。
  11. 根据权利要求9或10所述的方法，其特征在于，所述核心网设备向所述UE发送第三请求，包括：
    所述核心网设备向所述UE发送EAP请求，所述EAP请求包括所述第三请求。
  12. 根据权利要求8至11任一所述的方法，其特征在于，所述第二请求包括所述设备标识；
    所述核心网设备获取所述设备标识包括：
    所述核心网设备从所述第二请求中获取所述设备标识。
  13. 根据权利要求7至11任一所述的方法，其特征在于，所述核心网设备获取所述设备标识，包括：
    所述核心网设备从所述UE接收非接入层安全模式完成NAS SMP消息，所述NAS SMP消息包括所述设备标识。
  14. 根据权利要求7至13任一所述的方法，其特征在于，所述方法还包括：
    所述核心网设备从所述鉴权服务器接收第二响应消息，所述第二响应消息包括第一密钥；
    所述核心网设备根据所述第一密钥更新所述核心网设备存储的第二密钥。
  15. 根据权利要求7至14任一所述的方法，其特征在于，所述核心网设备包括安全锚点功能实体SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
  16. 根据权利要求7至15任一所述的方法，其特征在于，所述鉴权服务器包括鉴权服务器功能AUSF设备和/或鉴权信任状存储和处理功能ARPF设备。
  17. 一种鉴权服务器，其特征在于，所述服务器包括：处理模块和通信模块；
    所述通信模块从核心网设备接收第一请求，所述第一请求包括用户设备UE的设备标识；
    所述处理模块根据所述设备标识为所述UE选择可扩展认证协议EAP设备标识鉴权的方式，并基于选择的方式对所述UE进行EAP设备标识鉴权。
  18. 根据权利要求17所述的服务器，其特征在于，所述通信模块向所述核心网设备发送第一响应，所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断。
  19. 根据权利要求17或18所述的服务器，其特征在于，所述处理模块控制所述通信模块向所述UE发送所述选择的设备标识鉴权的方式。
  20. 根据权利要求17至19任一项所述的服务器，其特征在于，所述处理模块生成第一密钥；
    所述通信模块向所述核心网设备发送第二响应消息，所述第二响应消息包括所述第一密钥，所述第一密钥用于所述核心网设备内密钥的更新。
  21. 根据权利要求17至20任一项所述的服务器，其特征在于，所述鉴权服务器包括鉴权服务器功能AUSF实体和/或鉴权信任状存储和处理功能ARPF实体。
  22. 根据权利要求17至21任一项所述的服务器，其特征在于，所述核心网设备包括安全锚点功能SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
  23. 一种核心网设备，其特征在于，所述核心网设备包括：处理模块和通信模块；
    所述通信模块从用户设备UE获取所述UE的设备标识；
    所述通信模块向鉴权服务器发送第一请求，所述第一请求包括所述UE的设备标识，所述设备标识用于所述UE的可扩展认证协议EAP设备标识鉴权方式的选择。
  24. 根据权利要求23所述的核心网设备，其特征在于，所述通信模块从所述UE接收第二请求，或，从所述鉴权服务器接收第一响应，所述第二请求或所述第一响应用于触发是否对所述UE进行设备标识鉴权的判断；
    所述通信模块收到所述第一响应或所述第二请求后，所述处理模块决定是否对所述UE进行设备标识鉴权。
  25. 根据权利要求23或24所述的核心网设备，其特征在于，所述通信模块向所述UE发送第三请求，以请求所述设备标识。
  26. 根据权利要求25所述的核心网设备，其特征在于，所述通信模块通过非接入层安全模式命令NAS SMC消息向所述UE发送所述第三请求。
  27. 根据权利要求25或26所述的核心网设备，其特征在于，所述通信模块向所述UE发送EAP请求，所述EAP请求包括所述第三请求。
  28. 根据权利要求24至27任一项所述的核心网设备，其特征在于，所述第二请求包括所述设备标识；
    所述通信模块从所述第二请求中获取所述设备标识。
  29. 根据权利要求23至27任一项所述的核心网设备，其特征在于，所述通信模块从所述UE接收非接入层安全模式完成NAS SMP消息，所述NAS SMP消息包括所述设备标识。
  30. 根据权利要求23至29任一项所述的核心网设备，其特征在于，所述通信模块从所述鉴权服务器接收第二响应消息，所述第二响应消息包括第一密钥；
    所述处理模块根据所述第一密钥更新所述核心网设备存储的第二密钥。
  31. 根据权利要求23至30任一项所述的核心网设备，其特征在于，所述核心网设备包括安全锚点功能实体SEAF实体、接入和移动管理功能AMF实体、会话管理功能SMF实体中的至少一个。
  32. 根据权利要求23至31任一项所述的核心网设备，其特征在于，所述鉴权服务器包括鉴权服务器功能AUSF实体和/或鉴权信任状存储和处理功能ARPF实体。
  33. 一种鉴权服务器，其特征在于，所述服务器包括：处理器和通信接口；
    所述处理器和所述通信接口用于执行权利要求1至6任一项所述的方法。
  34. 一种核心网设备，其特征在于，所述核心网设备包括：处理器和通信接口；
    所述处理器和所述通信接口用于执行权利要求7至16任一项所述的方法。
PCT/CN2017/072741 2017-01-26 2017-01-26 一种鉴权方法、鉴权服务器和核心网设备 WO2018137239A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/072741 WO2018137239A1 (zh) 2017-01-26 2017-01-26 一种鉴权方法、鉴权服务器和核心网设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/072741 WO2018137239A1 (zh) 2017-01-26 2017-01-26 一种鉴权方法、鉴权服务器和核心网设备

Publications (1)

Publication Number Publication Date
WO2018137239A1 true WO2018137239A1 (zh) 2018-08-02

Family

ID=62977899

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/072741 WO2018137239A1 (zh) 2017-01-26 2017-01-26 一种鉴权方法、鉴权服务器和核心网设备

Country Status (1)

Country Link
WO (1) WO2018137239A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220007182A1 (en) * 2018-11-02 2022-01-06 Apple Inc. Protection of Initial Non-Access Stratum Protocol Message in 5G Systems

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1848994A (zh) * 2005-04-11 2006-10-18 华为技术有限公司 一种实现微波接入全球互操作系统鉴权的方法
WO2008016800A2 (en) * 2006-08-01 2008-02-07 Cisco Technology, Inc. Method and apparatus for selecting an appropriate authentication method on a client
CN101772020A (zh) * 2009-01-05 2010-07-07 华为技术有限公司 鉴权处理方法和系统、3gpp认证授权计费服务器及用户设备
CN103957103A (zh) * 2014-04-17 2014-07-30 小米科技有限责任公司 安全验证的方法、装置及移动终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1848994A (zh) * 2005-04-11 2006-10-18 华为技术有限公司 一种实现微波接入全球互操作系统鉴权的方法
WO2008016800A2 (en) * 2006-08-01 2008-02-07 Cisco Technology, Inc. Method and apparatus for selecting an appropriate authentication method on a client
CN101772020A (zh) * 2009-01-05 2010-07-07 华为技术有限公司 鉴权处理方法和系统、3gpp认证授权计费服务器及用户设备
CN103957103A (zh) * 2014-04-17 2014-07-30 小米科技有限责任公司 安全验证的方法、装置及移动终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
3GPP: "Study on the security aspects of the next generation system (Release 14)", 3GPP TR 33.899 V0.6.0, 25 November 2016 (2016-11-25), XP051200378 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220007182A1 (en) * 2018-11-02 2022-01-06 Apple Inc. Protection of Initial Non-Access Stratum Protocol Message in 5G Systems
US11863975B2 (en) * 2018-11-02 2024-01-02 Apple Inc. Protection of initial non-access stratum protocol message in 5G systems

Similar Documents

Publication Publication Date Title
US11825303B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
KR101959492B1 (ko) 모바일 디바이스에서의 사용자 인증 및 인간 의도 검증을 위한 방법 및 장치
US11496320B2 (en) Registration method and apparatus based on service-based architecture
RU2414086C2 (ru) Аутентификация приложения
CN111465011B (zh) 跨网络接入方法、装置、存储介质及通信系统
US10917790B2 (en) Server trust evaluation based authentication
US10856135B2 (en) Method and apparatus for network access
US20200007335A1 (en) Network Function Service Invocation Method, Apparatus, and System
TWI645724B (zh) 用於使用特定於應用的網路存取身份碼來進行到無線網路的受贊助連接的設備和方法（二）
WO2017049461A1 (zh) 用户设备ue的接入方法、设备及系统
WO2011017924A1 (zh) 无线局域网的认证方法、系统、服务器和终端
DK2924944T3 (en) Presence authentication
US20110035592A1 (en) Authentication method selection using a home enhanced node b profile
US9807088B2 (en) Method and network node for obtaining a permanent identity of an authenticating wireless device
WO2021109753A1 (zh) 一种应用于极简网络的机卡验证方法和相关设备
WO2017076216A1 (zh) 服务器、移动终端、网络实名认证系统及方法
WO2019056971A1 (zh) 一种鉴权方法及设备
BR112021003460A2 (pt) dispositivo sem identidade de assinante, dispositivo de identidade do assinante, método para uso em um dispositivo sem identidade de assinante, método para uso em um dispositivo com identidade de assinante e produto de programa de computador
WO2018099407A1 (zh) 账户认证登录方法及装置
KR101502999B1 (ko) 일회성 비밀번호를 이용한 본인 인증 시스템 및 방법
WO2018137239A1 (zh) 一种鉴权方法、鉴权服务器和核心网设备
Latze et al. Strong mutual authentication in a user-friendly way in eap-tls
WO2024049335A1 (en) Two factor authentication
WO2024078692A1 (en) Secure provisioning of fido credential

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17894254

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17894254

Country of ref document: EP

Kind code of ref document: A1