WO2019196794A1 - 认证方法、设备和计算机可读存储介质 - Google Patents

认证方法、设备和计算机可读存储介质 Download PDF

Info

Publication number
WO2019196794A1
WO2019196794A1 PCT/CN2019/081746 CN2019081746W WO2019196794A1 WO 2019196794 A1 WO2019196794 A1 WO 2019196794A1 CN 2019081746 W CN2019081746 W CN 2019081746W WO 2019196794 A1 WO2019196794 A1 WO 2019196794A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
group
gateway
group gateway
mtc device
Prior art date
Application number
PCT/CN2019/081746
Other languages
English (en)
French (fr)
Inventor
毛玉欣
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2019196794A1 publication Critical patent/WO2019196794A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/16—Gateway arrangements

Definitions

  • the present disclosure relates to, but is not limited to, the field of mobile communication technology.
  • MTC Machine Type Communication
  • 3GPP 3rd Generation Partnership Project
  • MTC Machine Type Communication
  • an important feature of the MTC technology is that it can allow a large number of MTC devices to access the network, and usually a massive MTC device simultaneously requests access to the mobile cellular communication system network. Due to the limited network resources of the mobile cellular communication system network, a large number of MTC devices consume a large amount of network resources when requesting access to the network device instantaneously, and when two-way authentication is performed between each MTC device and the network device during the MTC device access process There are multiple signaling interactions. In this way, a huge signaling processing burden is caused to the network device, and thus network congestion and the like occur.
  • an embodiment of the present disclosure provides an authentication method, including: if a group gateway requests access to a network and passes authentication, receiving an authentication vector group sent by an authentication device, and storing the authentication vector group; An authentication vector of each machine-type communication MTC device managed by the group gateway; acquiring a first authentication vector of the first MTC device from the stored authentication vector group; wherein the first MTC device is configured by the group Gateway management; and authenticating with the first MTC device based on the first authentication vector.
  • an embodiment of the present disclosure provides an authentication method, including: receiving a third access request that is sent by a group gateway and carrying an identity identifier of the group gateway; and responding to the third access request, based on Obtaining, by the identifier of the group gateway, a third authentication vector of the group gateway, acquiring a first parameter in the third authentication vector, and sending the first parameter to the group gateway, where the first parameter is used for
  • the group gateway authenticates the authentication device; receives a second parameter sent by the group gateway, and performs authentication on the group gateway based on the second parameter and the third authentication vector;
  • the group gateway obtains an authentication vector group and sends the authentication vector group to the group gateway.
  • the authentication vector group includes an authentication vector of each MTC device managed by the group gateway, and the authentication vector group is used by the group.
  • the group gateway performs mutual authentication with each MTC device managed by the group gateway.
  • an embodiment of the present disclosure provides a group gateway, including: a first processor, a first memory, and a first communication bus; the first communication bus is configured to implement the first processor and the a connection communication between the first memories; the first processor is configured to execute an authentication program stored in the first memory to implement the following steps: if the group gateway requests access to the network and passes the authentication, the receiving authentication device sends And authenticating the authentication vector group; wherein the authentication vector group includes an authentication vector of each machine type communication MTC device managed by the group gateway; and acquiring the first MTC device from the stored authentication vector group An authentication vector; wherein the first MTC device is managed by the group gateway; and the first MTC device performs authentication based on the first authentication vector.
  • an embodiment of the present disclosure provides an authentication device, where the authentication device includes: a second processor, a second memory, and a second communication bus; and the second communication bus is configured to implement the second processor And communicating with the second memory; the second processor is configured to execute an authentication program stored in the second memory, to implement the following steps: receiving, by the group gateway, carrying the group gateway The third access request of the identity is obtained, and the third authentication vector of the group gateway is obtained based on the identity of the group gateway, and the first one of the third authentication vectors is obtained.
  • the authentication vector group includes Authentication vector for each group of said MTC gateway management apparatus, said authentication vector set for the gateway and each group by the group MTC gateway apparatus performs mutual authentication management.
  • an embodiment of the present disclosure provides a computer readable storage medium having an authentication program stored thereon, the authentication program being executed by a processor to implement the steps of the authentication method described herein.
  • FIG. 1 is a schematic flowchart of an authentication method according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart diagram of another authentication method according to an embodiment of the present disclosure.
  • FIG. 3 is a schematic flowchart of still another authentication method according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic flowchart diagram of still another authentication method according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a system according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic flowchart of an authentication method according to another embodiment of the present disclosure.
  • FIG. 8 is a schematic flowchart of still another authentication method according to another embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a group gateway according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an authentication device according to an embodiment of the present disclosure.
  • MTC Machine Type Communication
  • 3GPP 3rd Generation Partnership Project
  • MTC Machine Type Communication
  • an important feature of the MTC technology is that it can allow a large number of MTC devices to access the network, and usually a massive MTC device simultaneously requests access to the mobile cellular communication system network. Due to the limited network resources of the mobile cellular communication system network, a large number of MTC devices consume a large amount of network resources when requesting access to the network device instantaneously, and when two-way authentication is performed between each MTC device and the network device during the MTC device access process There are multiple signaling interactions. In this way, a huge signaling processing burden is caused to the network device, and thus network congestion and the like occur.
  • the prior art proposes to introduce a group gateway to manage the MTC device group, that is, when the group gateway accesses the mobile cellular communication system network, the group gateway performs mutual authentication with the network device on the network side of the mobile cellular communication system.
  • the local two-way authentication is performed between the group gateway and the MTC device based on a Pre-shared Key (PSK) or a Public Key Infrastructure (PKI), so that the network device can be greatly reduced.
  • PSK Pre-shared Key
  • PKI Public Key Infrastructure
  • the MTC device and the group gateway only perform local authentication according to the PSK or the PKI, and the MTC device does not perform authentication with the network device. That is, as long as the two-way authentication between the network device and the group gateway is passed, the MTC device trusts the network device by default, and the network device also trusts the MTC device by default, so that a weak trust relationship exists between the MTC device and the network device, resulting in MTC.
  • the communication between the device and the network device is less secure.
  • the present disclosure particularly provides authentication methods, apparatus, and computer readable storage media that substantially obviate one or more of the problems due to limitations and disadvantages of the related art.
  • FIG. 1 is a schematic flowchart diagram of an authentication method according to an embodiment of the present disclosure. Referring to FIG. 1, the method may include the following steps 101 to 103.
  • the group gateway requests access to the network and passes authentication, the authentication vector group sent by the authentication device is received and stored.
  • the authentication vector group includes an authentication vector of each machine type communication MTC device managed by the group gateway.
  • step 101 "If the group gateway requests access to the network and passes authentication, receiving the authentication vector group sent by the authentication device and storing" may be implemented by the group gateway.
  • the group gateway may authenticate the authentication device on the network side when requesting access to the network, or may be the group gateway when requesting access to the network.
  • the group gateway and the authentication device pass the two-way authentication.
  • the two-way authentication between the group gateway and the authentication device may be based on an Authentication and Key Agreement (AKA) or an Extensible Authentication Protocol (EAP)-Secure Transport Layer Protocol (Transport Layer).
  • Security Protocol TLS
  • the mutual authentication between the group gateway and the authentication device includes not only the authentication device in the mobile cellular communication system network, but also the authentication of the group gateway. Legitimacy is also subject to certification.
  • the authentication vector of each MTC device includes a random number (Random, RAND), an expected response (XRES), an encryption key (Cipher Key, CK), and an integrity check key. (Integrity Key, IK) and an authentication token (AUTN) and other parameters.
  • the AUTN includes a Message Authentication Code (MAC) and a Sequence Number (SQN).
  • the authentication vector group includes an authentication vector of at least one MTC device managed by the group gateway.
  • the authentication device is a device for authenticating the legitimacy of the group gateway in the network device of the mobile cellular communication system network, and may include an authentication node, an authentication server, and a subscription register.
  • the authentication vector of each MTC device is carried in the digital certificate of the MTC device.
  • the authentication device includes a certificate authority (CA) center and an authentication server.
  • CA certificate authority
  • a first authentication vector of the first MTC device is obtained from the stored set of authentication vectors.
  • the first MTC device is managed by a group gateway.
  • step 102 "Get the first authentication vector of the first MTC device from the stored set of authentication vectors" may be implemented by the group gateway.
  • the first MTC device may be the first MTC device in the MTC device managed by the group gateway to send an access request to the group gateway after the group gateway and the authentication device pass the mutual authentication, or in the group gateway and the authentication. After the device passes the two-way authentication, any one of the MTC devices managed by the group gateway sends the MTC device of the access request like the group gateway.
  • the group gateway acquires the first authentication vector of the first MTC device from the stored authentication vector group based on the identifier of the first MTC device.
  • the group gateway After acquiring the first authentication vector, the group gateway sends parameters such as RAND and AUTN in the first authentication vector to the first MTC device, so that the first MTC device generates the expected authentication value (Expected MAC, XMAC) and the AUTN based on the RAND.
  • the MAC is compared, and the SQN carried in the AUTN is compared with the SQN local to the group network to implement authentication of the group gateway.
  • authentication is performed with the first MTC device based on the first authentication vector.
  • step 103 "Authentication with the first MTC device based on the first authentication vector" may be implemented by a group gateway.
  • the authentication method provided by the embodiment of the present disclosure, if the group gateway requests access to the network and passes the authentication, receives the authentication vector group sent by the authentication device, and stores the first authentication vector of the first MTC device from the authentication vector group, and The authentication is performed with the first MTC device based on the first authentication vector. In this way, after the group gateway requests access to the network and passes the authentication, the group gateway receives the authentication vector group that is sent by the authentication device, including all the MTC device authentication vectors managed by the group gateway, and requests the first MTC device managed by the group gateway.
  • the first authentication vector of the first MTC device in the authentication vector group sent by the authentication device performs mutual authentication with the first MTC device, which solves the problem that the MTC device is caused by the introduction of the group gateway in the prior art.
  • the problem that the trust relationship between the network devices is weak is that the trust relationship between the MTC device and the network device is directly established through the group gateway, and the communication security between the MTC device and the network device is improved.
  • FIG. 2 is a schematic flowchart diagram of another authentication method according to an embodiment of the present disclosure. Referring to FIG. 2, the method may include the following steps 201 to 205.
  • a third access request that is sent by the group gateway and carries the identity of the group gateway is received.
  • the third authentication vector of the group gateway is obtained based on the identity of the group gateway.
  • a first parameter in the third authentication vector is obtained and sent to the group gateway.
  • the first parameter is used by the group gateway to authenticate the authentication device.
  • step 203 "Acquiring the first parameter in the third authentication vector and transmitting to the group gateway" may be implemented by the authentication device.
  • the first parameter is a parameter such as RAND and AUTN in the third authentication vector of the group gateway.
  • a second parameter sent by the group gateway is received, and the group gateway is authenticated based on the second parameter and the third authentication vector.
  • step 204 "Receive a second parameter sent by the group gateway, and authenticate the group gateway based on the second parameter and the third authentication vector" may be implemented by the authentication device.
  • the second parameter is generated by the group gateway based on the RAND and the AUTN in the first parameter after authenticating the authentication device based on the received first parameter, and may be, for example, the RES of the group gateway.
  • the authentication vector group is obtained and sent to the group gateway.
  • the authentication vector group includes an authentication vector of each MTC device managed by the group gateway, and the authentication vector group is used for the mutual authentication of the group gateway and each MTC device managed by the group gateway.
  • step 205 "If the group gateway passes the authentication, the authentication vector group is obtained and sent to the group gateway" may be implemented by the authentication device. If the authentication device matches the MAC in the AUTN in the third parameter XMAC and the third authentication vector, and the SQN in the AUTN matches the SQN in the local device of the authentication device, the authentication device according to the root of the MTC device subscription information managed by the group gateway The key generates an authentication vector of each MTC device, obtains an authentication vector group, and sends the obtained authentication vector group of the MTC device to the group gateway, so that when the MTC device managed by the group gateway requests access, the MTC device is based on the MTC device.
  • the authentication vector group performs bidirectional authentication with the MTC device that requests the access, and the authentication process between the MTC device and the authentication device is implemented through the group gateway, and the signaling interaction between the MTC device and the authentication device is reduced.
  • the authentication method after receiving the third access request that is sent by the group gateway and carrying the identity of the group gateway, obtains the group gateway based on the identity of the group gateway in response to the third access request. a third authentication vector, and acquiring the first parameter in the third authentication vector and sending to the group gateway, and then receiving the second parameter sent by the group gateway, and authenticating the group gateway based on the second parameter and the third authentication vector If the group gateway is authenticated, the authentication vector group is obtained and sent to the group gateway. In this way, the authentication device authenticates the group gateway, and after the authentication of the group gateway passes, sends the set of authentication vectors for authenticating the MTC device and including all the MTC devices managed by the group gateway to the group.
  • the group gateway authenticates the first MTC device that is requested to be accessed based on the authentication vector group sent by the authentication device, and solves the trust relationship between the MTC device and the network device due to the introduction of the group gateway in the prior art.
  • the weaker problem is to realize the direct establishment of a trust relationship between the MTC device and the network device through the group gateway, thereby improving the communication security between the MTC device and the network device.
  • FIG. 3 is a schematic flowchart diagram of still another authentication method according to an embodiment of the present disclosure. Referring to FIG. 3, the method may include the following steps 301 to 312.
  • the group gateway sends a third access request carrying the identity of the group gateway to the authentication device.
  • the third access request is used to instruct the authentication device to acquire the first parameter of the group gateway based on the identity of the group gateway.
  • the two-way authentication based on the AKA protocol between the group gateway and the authentication device, the MTC device, and the group gateway is used as an example.
  • the MTC devices in the authentication server are classified and stored according to the group gateway to which they belong, for example, by using an MTC device group, for example, (GID j , UE j , (MTC 1 , MTC 2 , ..., MTC n j ), where GID is the group identifier corresponding to the jth group gateway, and UE j represents the identity of the jth group gateway, (MTC 1 , MTC 2 , ..., MTC n ) j represents the jth group The identity of the n MTC devices managed by the group gateway.
  • the group gateway sends a third access request carrying the identity UE j of the group gateway to the authentication device.
  • the first parameter is a vector parameter in an Authentication Vector (AV), for example, RAND and AUTN in the authentication vector.
  • AV Authentication Vector
  • the authentication device receives a third access request that is sent by the group gateway and carries the identity of the group gateway.
  • the authentication device acquires a third authentication vector of the group gateway based on the identity of the group gateway in response to the third access request.
  • the authentication device in response to the third access request, the gateway based on the identity of the group identifier UE j to obtain a shared root key information K j between the gateway and the authentication device group corresponding to the UE j, based on the shared root secret
  • the key information K j uses the authentication vector algorithm to generate a third authentication vector of the group gateway, that is, the authentication vector AV j [RAND j , AUTN j , XRES j , CK j , IK j ] of the group gateway.
  • the authentication device acquires the first parameter in the third authentication vector and sends it to the group gateway.
  • the first parameter is used by the group gateway to authenticate the authentication device.
  • the authentication device acquires the first parameters RAND j and AUTN j of the third authentication vector AV j [RAND j , AUTN j , XRES j , CK j , IK j ] and sends them to the group gateway.
  • the group gateway receives the first parameter sent by the authentication device, and authenticates the authentication device based on the first parameter.
  • the group gateway receives the first parameters RAND j and AUTN j sent by the authentication device, calculates the XMAC based on the RAND j using the AKA protocol, and obtains the XMAC j of the group gateway, and parses the AUTN j .
  • the SQN and the MAC sent by the authentication device are obtained, and the two values of the MAC and the XMAC are compared. If the two values of the MAC and the XMAC are different, the authentication process is aborted; if the two values of the MAC and the XMAC are the same, the group gateway is based on the local storage.
  • the SQN of the SQN authentication device authenticates the authentication process if the SQN sent by the authentication device is inconsistent with the locally stored SQN. Otherwise, if the SQN sent by the authentication device is the same as the locally stored SQN, the authentication device passes the authentication of the group gateway. Based on the RAND j algorithm using the response (Response, RES) for calculating the random number in the AKA protocol, the response RES j of the group gateway is obtained, and the second parameter is obtained.
  • the group gateway sends the second parameter to the authentication device.
  • the second parameter is used by the authentication device to authenticate the group gateway. If the group gateway does not receive the response message sent by the authentication device to indicate that the group gateway authentication fails, the default group gateway passes the authentication.
  • the authentication device receives the second parameter sent by the group gateway, and authenticates the group gateway based on the second parameter and the third authentication vector.
  • the authentication device receives the second parameter RES j sent by the group gateway, and determines whether the second parameter RES j is related to the third authentication vector AV j [RAND j , AUTN j , XRES j , CK j , IK j ]
  • the XRES j is the same.
  • the authentication device obtains the authentication vector group and sends it to the group gateway.
  • the authentication vector group includes an authentication vector of each MTC device managed by the group gateway, and the authentication vector group is used for the mutual authentication between the group gateway and the first MTC device managed by the group gateway.
  • RES j is not the same as XRES j
  • the operation is stopped and a message that the authentication failed is sent to the group gateway.
  • the RES j is the same as the XRES j
  • the authentication device acquires the authentication vector group (AV 1 , AV) corresponding to the MTC devices (MTC 1 , MTC 2 , . . . , MTC n ) j corresponding to the group gateway UE j . 2 ,...,AV n ) j and sent to the group gateway.
  • step 308 can be implemented by the following steps 308a1 through 308a5.
  • the authentication device determines the group identifier corresponding to the group gateway based on the identity of the group gateway carried in the third access request.
  • the authentication device determines each MTC device managed by the group gateway based on the group identification.
  • the MTC device group in which the group gateway UE j is located may be determined according to the identity identifier of the group gateway, so that it may be determined.
  • Each MTC device managed by the group gateway UE j may be determined according to the identity identifier of the group gateway, so that it may be determined.
  • the authentication device acquires the identity of each MTC device and obtains a first key for each MTC device based on the identity of each MTC device.
  • the authentication device acquires an identity (MTC 1 , MTC 2 , . . . , MTC n ) j of each MTC device, and acquires a first key of each MTC device based on the identity of each MTC device, for example,
  • the first key of MTC 1 is K 1
  • the first key of MTC 2 is K 2
  • ... the first key of MTC n is K n .
  • the authentication device generates an authentication vector for each MTC device based on each first key using a preset algorithm to obtain an authentication vector group.
  • the preset algorithm is an algorithm that generates an authentication vector group in the AKA protocol.
  • the authentication device generates an authentication vector of each MTC device by using a preset algorithm based on each first key.
  • the authentication vector of the MTC 1 is AV 1 (RAND1, AUTN1, XRES1, CK1, IK1)
  • the authentication vector of the MTC 2 is AV. 2 (RAND2, AUTN2, XRES2, CK2, IK2)
  • the authentication vector of MTC n is AV n (RANDn, AUTNn, XRESn, CKn, IKn)
  • the authentication vector group of the MTC device corresponding to the group gateway UE j is obtained.
  • steps 308a1 to 308a4 and the steps 303 to 307 can be performed simultaneously, and the steps 308a1 to 308a4 can be performed simultaneously with the step 303.
  • the specific execution sequence can be determined according to the actual application scenario.
  • the authentication vector group is sent to the group gateway.
  • the group gateway receives the authentication vector group sent by the authentication device and stores it.
  • the authentication vector group includes an authentication vector of each machine type communication MTC device managed by the group gateway.
  • the group gateway obtains a first authentication vector of the first MTC device from the stored set of authentication vectors.
  • the first MTC device is managed by a group gateway.
  • step 310 may be specifically implemented by the following steps 301a1 and 310a2.
  • the group gateway receives a first access request that is sent by the first MTC device and carries the identity of the first MTC device.
  • the group gateway obtains an authentication vector corresponding to the identity of the first MTC device from the authentication vector group in response to the first access request, to obtain a first authentication vector.
  • the first MTC device is any one of the MTC devices managed by the group gateway. Assuming the identity of the first device is a MTC MTC 2, based on MTC 2 (AV 1, AV 2 , ..., AV n) j acquired from the authentication vector AV MTC group 2 corresponding to the first authentication vector AV 2.
  • the group gateway acquires a third parameter in the first authentication vector and sends the third parameter to the first MTC device.
  • the third parameter is used by the first MTC device to authenticate the group gateway.
  • the third parameter is a first authentication vector AV authentication token and a random number RAND2 AUTN2 2.
  • the group gateway receives the fourth parameter sent by the first MTC device, and authenticates the first MTC device based on the fourth parameter and the first authentication vector.
  • the fourth parameter is generated by the first MTC device after the authentication of the group gateway is passed based on the third parameter.
  • the fourth parameter RES is the same as the XRES in the first authentication vector, it indicates that the first MTC device passes the authentication.
  • the first MTC device implements mutual authentication between the group gateway and the authentication device.
  • the communication data may be protected between the first MTC device and the group gateway by using the CK key and the IK key in the first authentication vector, and the third authentication may be adopted between the group gateway and the authentication device.
  • the CK key and the IK key in the vector protect the communication data.
  • the first authentication vector, the second authentication vector, the third authentication vector, the first parameter, the second parameter, and the first are digital certificates of the corresponding gateway or device.
  • the authentication method provided by the embodiment of the present disclosure receives a third access request that is sent by the group gateway and carries the identity of the group gateway, and obtains the group gateway based on the identity of the group gateway in response to the third access request. a third authentication vector, then acquiring the first parameter in the third authentication vector and sending it to the group gateway, receiving the second parameter sent by the group gateway, and authenticating the group gateway based on the second parameter and the third authentication vector If the group gateway is authenticated, the authentication vector group is obtained and sent to the group gateway. If the group gateway requests to access the network and passes the authentication, the authentication vector group sent by the authentication device is received and stored, and the obtained authentication vector group is obtained.
  • the authentication device first authenticates the group gateway, and sends all the group gateway management after the group gateway authentication passes
  • the authentication vector group of the MTC device is sent to the group gateway, so that the group gateway authenticates the first MTC device that is requested to access based on the authentication vector, and solves the problem.
  • the trust relationship between the MTC device and the network device is weak due to the introduction of the group gateway, and the trust relationship between the MTC device and the network device is directly established through the group gateway, thereby improving the MTC device and Communication between network devices is secure.
  • an embodiment of the present disclosure provides an authentication method, where the authentication device obtains the MTC only when the authentication device and the group gateway pass the two-way authentication, and the authentication device receives the identity of the first MTC device sent by the group gateway.
  • the authentication vector group of the device sends the obtained MTC parameter set to the group gateway, so that the group gateway authenticates the first MTC device that requests access.
  • FIG. 4 is a schematic flowchart diagram of still another authentication method according to an embodiment of the present disclosure. Referring to FIG. 4, the method may include the following steps 401 to 419.
  • the group gateway sends a third access request carrying the identity of the group gateway to the authentication device.
  • the third access request is used to instruct the authentication device to acquire the first parameter of the group gateway based on the identity of the group gateway.
  • the authentication device receives a third access request that is sent by the group gateway and carries the identity of the group gateway.
  • the authentication device acquires a third authentication vector of the group gateway based on the identity of the group gateway in response to the third access request.
  • the authentication device acquires the first parameter in the third authentication vector and sends it to the group gateway.
  • the first parameter is used by the group gateway to authenticate the authentication device.
  • the group gateway receives the first parameter sent by the authentication device and authenticates the authentication device based on the first parameter.
  • the group gateway sends the second parameter to the authentication device.
  • the second parameter is used by the authentication device to authenticate the group gateway. If the group gateway does not receive the response message sent by the authentication device to indicate that the group gateway authentication fails, the default group gateway passes the authentication.
  • the authentication device receives the second parameter sent by the group gateway, and authenticates the group gateway based on the second parameter and the third authentication vector.
  • the group gateway default group gateway passes the authentication.
  • the group gateway since the group gateway does not receive the response message sent by the authentication device for the group gateway authentication failure, the group gateway and the authentication device pass the mutual authentication.
  • the group gateway receives a first access request that is sent by the first MTC device and carries the identity of the first MTC device.
  • the first MTC device may be the first one of all the MTC devices managed by the group gateway to send the first access request to the group gateway.
  • the group gateway sends the identity of the first MTC device to the authentication device in response to the first access request.
  • the authentication device receives the identity of the first MTC device sent by the group gateway.
  • the first MTC device is the first MTC device in each MTC device managed by the group gateway to request access to the group gateway.
  • the authentication device determines a group identity corresponding to the identity of the first MTC device based on the identity of the first MTC device.
  • the authentication device determines each MTC device managed by the group gateway based on the group identification.
  • the authentication device acquires the identity of each MTC device and acquires a second key for each MTC device based on the identity of each MTC device.
  • the authentication device generates an authentication vector for each MTC device based on each second key using a preset algorithm to obtain an authentication vector group and send it to the group gateway.
  • the group gateway receives the authentication vector group sent by the authentication device and stores it.
  • the authentication vector group is obtained by the authentication device based on the identity of the first MTC device.
  • the group gateway obtains the first authentication vector of the first MTC device from the stored set of authentication vectors.
  • the first MTC device is managed by a group gateway.
  • the group gateway acquires a third parameter in the first authentication vector and transmits the third parameter to the first MTC device.
  • the third parameter is used by the first MTC device to authenticate the group gateway.
  • the group gateway receives the fourth parameter sent by the first MTC device, and authenticates the first MTC device based on the fourth parameter and the first authentication vector.
  • the fourth parameter is generated by the first MTC device after the authentication of the group gateway is passed based on the third parameter.
  • the following steps 420 to 422 are further included after the step 419.
  • the group gateway receives a second access request that is sent by the second MTC device and carries the identity of the second MTC device.
  • the second MTC device is an MTC device other than the first MTC device among all MTC devices managed by the group gateway.
  • the group gateway obtains the second authentication vector of the second MTC device from the authentication vector group based on the identity of the second MTC device in response to the second access request.
  • the group gateway authenticates with the second MTC device based on the second authentication vector.
  • step 422 can be implemented by the following steps 422a and 422b.
  • the group gateway acquires a fifth parameter in the second authentication vector and sends it to the second MTC device.
  • the second MTC device authenticates the group gateway based on receiving the fifth parameter, and if the group gateway passes the authentication of the second MTC device, generates a sixth parameter based on the fifth parameter and sends the sixth parameter to the group. Gateway.
  • the group gateway receives the sixth parameter sent by the second MTC device, and authenticates the second MTC device based on the sixth parameter and the second authentication vector.
  • the sixth parameter is generated by the second MTC device after the authentication of the group gateway is passed based on the fifth parameter.
  • the first authentication vector, the second authentication vector, the third authentication vector, the first parameter, the second parameter, and the third The parameter, the fourth parameter, the fifth parameter, and the sixth parameter are all digital certificates of the corresponding gateway or device.
  • the authentication method provided by the embodiment of the present disclosure receives a third access request that is sent by the group gateway and carries the identity of the group gateway, and obtains the group gateway based on the identity of the group gateway in response to the third access request. a third feature parameter authentication vector, and then acquiring a first parameter in the third feature parameter authentication vector and transmitting to the group gateway, receiving the second parameter sent by the group gateway, and based on the second parameter and the third feature parameter authentication vector
  • the group gateway is authenticated. If the group gateway is authenticated, the feature parameter set authentication vector group is obtained and sent to the group gateway. If the group gateway requests to access the network and passes the authentication, the feature parameter set authentication vector sent by the authentication device is received.
  • the authentication device first authenticates the group gateway.
  • the group gateway enables the group gateway to authenticate the first MTC device that is requested to access based on the feature parameter authentication vector, which solves the problem that the trust relationship between the MTC device and the network device is weak due to the introduction of the group gateway in the prior art.
  • the problem is that the group gateway is used to directly establish a trust relationship between the MTC device and the network device, thereby improving communication security between the MTC device and the network device.
  • FIG. 5 is a schematic structural diagram of a system according to an embodiment of the present disclosure. Based on the foregoing embodiments, embodiments of the present disclosure are implemented based on the system structure as shown in FIG. 5, including at least one MTC device (A1, A2, ..., An), a group gateway B, and an authentication device C.
  • the group gateway B can manage multiple MTC devices (A1, A2, ..., An), and the MTC devices (A1, A2, ..., and/or An) communicate with the authentication device C through the group gateway B.
  • the authentication device C may include an authentication node C1, an authentication server C2, and a subscription register C3.
  • the authentication node C1 is configured to perform a communication link with the group gateway B, and the information content obtained from the group gateway B is sent to the authentication server C2 or received by the authentication server C2 and forwarded to the group gateway B.
  • the authentication server C2 is configured. To obtain the authentication data from the contract register C3, store and send it to the authentication node C1; the subscription register C3 is configured to store the root key for sharing corresponding to the group gateway and the MTC device, and send it to the authentication server C2.
  • the algorithm After obtaining the request for the authentication data, the algorithm responds to the request for obtaining the authentication data by using an algorithm to generate a plurality of random numbers (RAND) according to the root key, and generates a plurality of sets of authentication vectors by using one of the RANDs to obtain the authentication data, and generates the authentication data.
  • the plurality of sets of authentication vectors are sent to the authentication server C3, such that the authentication server C3 sends the plurality of sets of authentication vectors to the group gateway B through the authentication node C1 to perform identity authentication on the group gateway B or identity authentication of the MTC device.
  • FIG. 6 is a schematic flowchart of an authentication method according to another embodiment of the present disclosure.
  • the authentication device includes an authentication node, an authentication server, and a subscription register.
  • the authentication method may include the following steps 501 to 518.
  • the group gateway sends a first access request to the authentication node, and the authentication node receives the access request of the group gateway.
  • the first access request carries the gateway identity identifier UE GW of the group gateway.
  • the authentication node acquires the gateway identity UE GW of the group gateway from the first access request and sends a first authentication request to the authentication server.
  • the first authentication request carries the gateway identity identifier UE GW of the group gateway.
  • the authentication server acquires the gateway identity UE GW from the received first authentication request and sends a request message for obtaining authentication data to the subscription register.
  • the MTC user group information is also configured in the subscription register, for example, it can be recorded as (GID, UE GW , UE 1 , UE 2 , ..., UE n ), where the GID is the group of the MTC device managed by the group gateway.
  • the group identifier, the UE GW indicates the gateway identity of the group gateway, and the UE 1 , the UE 2 , ..., the UE n are the identity identifiers of all the MTC devices managed by the group gateway, and the subscription register is also configured with the group The root key K GW shared by the group gateway and the root key K1, K2, ..., Kn shared with the corresponding MTC device.
  • the request message carries the gateway identity UE GW .
  • the register request message is received subscription, subscription register root key K GW obtains identification UE GW group identity corresponding to the gateway according to the gateway group gateway, and a root key generation algorithm using the authentication vector K GW Generate the authentication vector AV GW of the group gateway.
  • the group identity-based UE identity GW determines the identity identifiers UE 1 , UE 2 , . . . , UE n of all the MTC devices managed by the group gateway, and acquires the root keys K1, K2, ... corresponding to all the MTC devices.
  • the subscription register sends a response message to the authentication server.
  • the authentication server sends the authentication vector AV GW of the group gateway to the authentication node.
  • the authentication node obtains the authentication parameters RAND GW and AUTN GW of the group gateway from the authentication vector AV GW of the group gateway.
  • the authentication node sends a second authentication request to the group gateway, and the group gateway receives the second authentication request sent by the authentication node.
  • the authentication parameters RAND GW and AUTN GW of the group gateway are carried in the second authentication request.
  • the group gateway calculates the expected authentication value XMAC GW using the authentication value calculation algorithm based on the RAND GW carried in the second authentication request sent by the authentication node; if the XMAC GW and the group gateway local MAC GW value Similarly, the group gateway parses the AUTN GW carried in the second authentication request sent by the authentication node to obtain an SQN GW . If the SQN GW is the same as the SQN maintained locally by the group gateway, the group gateway generates the QoS GW and the AUTN GW . The RES GW of the group gateway sends the RES GW to the authentication node, indicating that the network side authenticates through the group gateway.
  • the group gateway sends a reject authentication message to the authentication server, and terminates the authentication process.
  • the group gateway If the SQN GW is different from the SQN maintained by the group gateway, the group gateway sends a synchronization failure message to the authentication server, and terminates the authentication process.
  • the authentication node compares the RES GW sent by the group gateway with the XRES GW in the authentication vector AV GW of the group gateway in the authentication node. If the RES GW is the same as the XRES GW , the group gateway passes the network side authentication. , indicating that the authentication node and the group gateway have passed the two-way authentication.
  • the authentication node sends an authentication failure message to the group gateway.
  • the group gateway and the network side may use the group gateway to protect the communication data according to the key and the key pair CK and IK generated by the RAND GW .
  • the group gateway receives a second access request sent by the first MTC device managed by the group gateway.
  • the first MTC device is any one of the MTC devices managed by the group gateway, and the second access request sent by the first MTC device carries the identity identifier UE j of the first MTC device.
  • the group gateway acquires the authentication parameters RAND j and AUTN j of the first MTC device from the authentication vector AV j of the first MTC device, and transmits a third authentication request to the first MTC device.
  • the third authentication request sent by the group gateway to the first MTC device carries the authentication parameters RAND j and AUTN j of the first MTC device.
  • the first MTC device calculates the expected authentication value XMAC j using the authentication value calculation algorithm based on the RAND j carried in the third authentication request sent by the group gateway; if the XMAC j is local to the first MTC device MAC j same value, the first MTC third authentication request sent by the gateway device to the group carried AUTN j obtained SQN j analyzing process, if the SQN j with the same first MTC device the SQN locally maintained, and based on RAND j AUTN j generates RES j of the first MTC device and sends RES j to the group gateway.
  • the first device transmitting MTC group reject message to the authentication gateway and terminates the authentication process.
  • the first MTC device If the SQN j is different from the SQN maintained by the first MTC device, the first MTC device sends a synchronization failure message to the group gateway, and terminates the authentication process.
  • the group gateway compares the RES j sent by the first MTC device with the XRES j in the authentication vector AV j of the first MTC device in the group gateway. If RES j is the same as XRES j , the group gateway and the first An MTC device completes the mutual authentication, and the group gateway returns an acknowledgement message to the authentication node, indicating that the first MTC device is successfully authenticated.
  • the group gateway may determine that the first MTC device re-initiates the authentication.
  • the group communication between the group gateway and the first MTC device may use the key pair CK and IK generated by the first MTC device according to the key and RAND j . Protect.
  • FIG. 7 is a schematic flowchart diagram of another authentication method according to another embodiment of the present disclosure.
  • the authentication device includes an authentication node, an authentication server, and a subscription register. Referring to Figure 7, the method can include the following steps 601 through 619.
  • the group gateway sends a first access request to the authentication node.
  • the first access request carries the gateway identity identifier UE GW of the group gateway, and is used to indicate that the group gateway requests to establish a communication link with the network side.
  • the authentication node After receiving the first access request of the group gateway, the authentication node acquires the gateway identity identifier UE GW of the group gateway from the first access request in response to the first access request, and sends the first authentication request. To the authentication server.
  • the first authentication request carries the gateway identity identifier UE GW of the group gateway.
  • the authentication server sends a request message for obtaining authentication data to the subscription register based on the gateway identity identifier UE GW carried in the received authentication request.
  • the register request message is received subscription, subscription register root key K GW obtains identification UE GW group identity corresponding to the gateway according to the gateway group gateway, and a root key generation algorithm using the authentication vector K GW Generate the authentication vector AV GW of the group gateway.
  • the subscription register sends a response message to the authentication server.
  • the response message carries the authentication vector AV GW of the group gateway.
  • the authentication server saves the authentication vector AV GW of the group gateway carried in the response message.
  • the authentication server sends the authentication vector AV GW of the group gateway to the authentication node.
  • the authentication node obtains the authentication parameters RAND GW and AUTN GW of the group gateway from the authentication vector of the group gateway.
  • the authentication node sends a second authentication request to the group gateway, and the group gateway receives the second authentication request sent by the authentication node.
  • the authentication parameters RAND GW and AUTN GW of the group gateway are carried in the second authentication request.
  • the group gateway calculates the expected authentication value XMAC GW using the authentication value calculation algorithm based on the RAND GW carried in the second authentication request sent by the authentication node; if the XMAC GW and the group gateway local MAC GW value Similarly, the group gateway parses the AUTN GW carried in the second authentication request sent by the authentication node to obtain an SQN GW . If the SQN GW is the same as the SQN maintained locally by the group gateway, the group gateway generates the QoS GW and the AUTN GW . The RES GW of the group gateway sends the RES GW to the authentication node, indicating that the network side authenticates through the group gateway.
  • the group gateway sends a reject authentication message to the authentication server, and terminates the authentication process.
  • the group gateway If the SQN GW is different from the SQN maintained by the group gateway, the group gateway sends a synchronization failure message to the authentication server, and terminates the authentication process.
  • the authentication node compares the RES GW sent by the group gateway with the XRES GW in the authentication vector AV GW of the group gateway in the authentication node. If the RES GW is the same as the XRES GW , the group gateway passes the network side authentication. , indicating that the authentication node and the group gateway have passed the two-way authentication.
  • the authentication node sends an authentication failure message to the group gateway.
  • the group gateway and the network side may use the group gateway to protect the communication data according to the key and the key pair CK and IK generated by the RAND GW .
  • the group gateway receives an attach request sent by the first MTC device managed by the group gateway.
  • the first MTC device is the first one of the MTC devices managed by the group gateway to send an attach request to request access to the group gateway, and the identity request UE 1 of the first MTC device is carried in the attach request.
  • the group gateway acquires the identity identifier UE 1 of the first MTC device carried in the attach request, and sends a second access request for the first MTC device to the authentication node.
  • the second access request carries the identity identifier UE 1 of the first MTC device, and the second access request is used to instruct the first MTC device to request to establish a communication link with the network side.
  • the authentication node After receiving the second access request sent by the group gateway, the authentication node acquires the identity identifier UE 1 of the first MTC device carried in the second access request, and sends a third authentication request to the authentication server.
  • the third authentication request carries the identity identifier UE 1 of the first MTC device.
  • the authentication server sends a request message for obtaining authentication data to the subscription register based on the identity identifier UE 1 of the first MTC device carried in the received third authentication request.
  • the subscription register determines the MTC device user group information in which the first MTC device is located based on the identity identifier UE 1 of the first MTC device carried in the request message, for example, (GID, UE GW , UE 1 , UE 2) , ..., UE n ), and based on the identity identifiers UE 1 , UE 2 , . . .
  • the device performs two-way authentication.
  • the group gateway may Two-way authentication is performed directly with other MTC devices based on the set of authentication vectors stored in the group gateway.
  • an embodiment of the present disclosure provides an authentication method, which is mainly used for authentication between an MTC device, a group gateway, and an authentication device by using an EAP-TLS protocol, where the authentication device is an authentication server and a certificate authority (Certificate Authority). , CA) Center.
  • FIG. 8 is a schematic flowchart of still another authentication method according to another embodiment of the present disclosure. Referring to FIG. 8, the method may include the following steps 701 to 728.
  • the group gateway sends a network access request to the authentication server.
  • the network access request carries the identity of the group gateway.
  • the CA center pre-stores digital certificates of the MTC devices managed by the group gateway and the group gateway, and the respective digital certificates are pre-stored in the MTC device and the group gateway.
  • Each of the corresponding digital certificates carries a corresponding authentication vector.
  • the authentication server receives the network access request, and determines to use the EAP-TLS protocol for mutual authentication in response to the network access request and the group gateway capability.
  • the authentication server sends a notification command carrying the digital certificate of the authentication server to the group gateway.
  • the notification instruction is used to indicate that the group gateway uses the EAP-TLS authentication mode for authentication.
  • the group gateway receives the notification instruction and enables the EAP-TLS authentication mode in response to the notification instruction.
  • the group gateway obtains the digital certificate of the authentication server from the CA center, and verifies whether the digital certificate of the authentication server obtained from the CA center matches the digital certificate sent by the authentication server, and obtains the verification result.
  • the verification result is that the authentication server passes the verification, and the authentication server is supported as an EAP-TLS authentication server; if the group gateway is from the CA center The obtained digital certificate of the authentication server does not match the digital certificate sent by the authentication server. The authentication result is that the authentication server fails the authentication, and the authentication server is not supported as the EAP-TLS authentication server.
  • the support authentication server is an EAP-TLS authentication server
  • the group gateway sends the verification result and the digital certificate of the group gateway to the authentication server.
  • the authentication server If the authentication result is that the authentication server fails to pass the authentication, the authentication server is not supported as the EAP-TLS authentication server, and the authentication result is sent to the authentication server. After receiving the verification result, the authentication server does not perform subsequent operations.
  • the authentication server receives the verification result and the digital certificate of the group gateway.
  • the authentication server sends a request command for requesting the digital certificate of the group gateway to the CA center.
  • the CA Center receives the request command and responds by acquiring the digital certificate of the group gateway and transmitting it to the authentication server.
  • the authentication server receives the digital certificate of the group gateway sent by the CA center, and verifies whether the digital certificate of the group gateway sent by the CA center matches the digital certificate of the group gateway sent by the group gateway.
  • the authentication server sends a successful authentication to the group gateway to indicate that the group gateway is acting as the proxy authentication server. Response message.
  • the authentication success response message is also used to indicate that the group gateway passes the authentication.
  • the group gateway receives an authentication success response message.
  • the group gateway receives the authentication success response message indicating that the group gateway and the authentication device pass the two-way authentication.
  • the group gateway receives the first access request that is sent by the first MTC device and carries the identity of the first MTC device.
  • the group gateway determines to use the EAP-TLS protocol for mutual authentication in response to the first access request, in conjunction with the first MTC device capability and the like.
  • the group gateway sends a notification command carrying the digital certificate of the group gateway to the first MTC device.
  • the notification instruction is used to indicate that the first MTC device uses the EAP-TLS authentication mode for authentication.
  • the first MTC device receives the notification command carrying the digital certificate of the group gateway and enables the EAP-TLS authentication mode in response to the notification instruction.
  • the first MTC device obtains the digital certificate of the group gateway from the CA center, and verifies whether the digital certificate of the group gateway acquired from the CA center matches the digital certificate sent by the group gateway, and the verification result is obtained.
  • the verification result is that the group gateway passes the verification, and the group gateway is supported as the proxy EAP-TLS authentication server; If the digital certificate of the group gateway acquired by the first MTC device from the CA center does not match the digital certificate sent by the group gateway, the verification result is that the group gateway fails the verification, and the group gateway is not supported as the proxy EAP-TLS authentication server.
  • the supporting group gateway is the proxy EAP-TLS authentication server, and the first MTC device sends the verification result and the digital certificate of the first MTC device to the group gateway.
  • the group gateway If the verification result is that the group gateway fails to pass the verification, the group gateway is not supported as the proxy EAP-TLS authentication server, and the verification result is sent to the group gateway. After receiving the verification result, the group gateway does not perform subsequent operations.
  • the group gateway receives the verification result and the digital certificate of the first MTC device.
  • the group gateway sends the identity of the first MTC device to the CA center.
  • the CA center receives the identity of the first MTC device sent by the group gateway.
  • the CA center determines a group identifier corresponding to the identity of the first MTC device based on the identity of the first MTC device.
  • the CA Center determines each MTC device managed by the group gateway based on the group identity.
  • the CA center obtains the identity of each MTC device, and obtains a digital certificate for each MTC device based on the identity of each MTC device to obtain a digital certificate set.
  • the digital certificate set of each MTC device carries the authentication vector of each MTC device, so the obtained digital certificate set obtains the authentication vector group of the MTC device managed by the group gateway.
  • the CA Center sends the set of digital certificates to the group gateway.
  • the group gateway receives the digital certificate set and stores it.
  • the group gateway obtains the digital certificate of the first MTC device from the stored set of digital certificates.
  • the group gateway verifies whether the digital certificate of the first MTC device is obtained from the digital certificate set and the digital certificate of the first MTC device sent by the first MTC device matches, and the verification result is obtained.
  • the first MTC device If the digital certificate of the first MTC device is matched with the digital certificate of the first MTC device sent by the first MTC device, the first MTC device passes the group gateway and the authentication device (ie, the authentication server and the CA). Through the two-way authentication between the centers, the subsequent communication process is credible.
  • the group gateway and the authentication device ie, the authentication server and the CA.
  • the CA center when the CA center performs the step 709, the CA center obtains the digital certificate of the group gateway, and also obtains the digital certificate of all the MTC devices managed by the group gateway, and obtains the digital certificate set and the sending group.
  • the digital certificate of the group gateway is sent to the authentication server to send the digital certificate set to the authentication server.
  • the authentication server sends the digital certificate set to the group gateway, so that the group gateway stores the digital certificate.
  • the group gateway may not perform step 720.
  • step 726 the CA center may not perform steps 723 to 725.
  • the authentication server requests the CA center to obtain the digital certificate of all the MTC devices managed by the group gateway, and obtains the digital certificate.
  • the aggregation server sends the digital certificate set to the group gateway to enable the group gateway to store the digital certificate.
  • the group gateway may not perform step 720 and step 726, and the CA center may not perform step 723. To 725.
  • the authentication method provided by the embodiment of the present disclosure receives a third access request that is sent by the group gateway and carries the identity of the group gateway, and obtains the group gateway based on the identity of the group gateway in response to the third access request. a third authentication vector, then acquiring the first parameter in the third authentication vector and sending it to the group gateway, receiving the second parameter sent by the group gateway, and authenticating the group gateway based on the second parameter and the third authentication vector If the group gateway is authenticated, the authentication vector group is obtained and sent to the group gateway. If the group gateway requests to access the network and passes the authentication, the authentication vector group sent by the authentication device is received and stored, and the obtained authentication vector group is obtained.
  • the authentication device first authenticates the group gateway, and sends all the group gateway management after the group gateway authentication passes
  • the authentication vector group of the MTC device is sent to the group gateway, so that the group gateway authenticates the first MTC device that requests access based on the authentication vector, and solves the problem.
  • the trust relationship between the MTC device and the network device is weak due to the introduction of the group gateway, and the trust relationship between the MTC device and the network device is directly established through the group gateway, thereby improving the MTC device and Communication between network devices is secure.
  • FIG. 9 is a schematic structural diagram of a group gateway according to an embodiment of the present disclosure.
  • the group gateway 8 includes a first processor 81, a first memory 82, and a first communication bus 83.
  • the first communication bus 83 is configured to implement connection communication between the first processor 81 and the first memory 82.
  • the first processor 81 is configured to execute an authentication program stored in the first memory 82 to implement the step of: the first communication bus is for implementing connection communication between the first processor and the first memory.
  • the first processor 81 is further configured to execute an authentication program stored in the first memory 82 to implement the following steps: if the group gateway requests access to the network and passes the authentication, the authentication vector group sent by the authentication device is received and stored; wherein, the authentication The vector group includes an authentication vector of each machine type communication MTC device managed by the group gateway; and the first authentication vector of the first MTC device is obtained from the stored authentication vector group; wherein the first MTC device is managed by the group gateway; The authentication is performed with the first MTC device based on the first authentication vector.
  • the first processor 81 is further configured to perform an authentication procedure to implement the following steps: if the group gateway requests access to the network and passes the authentication, receiving the first MTC device sent by the first MTC device Receiving the first access request of the identity; sending the identity of the first MTC device to the authentication device in response to the first access request; receiving the authentication vector group sent by the authentication device and storing; wherein the authentication vector group is based on the authentication device The identity of an MTC device is obtained.
  • the first processor 81 after receiving the first parameter sent by the first MTC device, and authenticating the first MTC device based on the first parameter and the first authentication vector, the first processor 81 is further configured to perform an authentication procedure, The method of the following steps: receiving a second access request that is sent by the second MTC device and carrying the identity of the second MTC device; and responding to the second access request, obtaining the first from the authentication vector group based on the identity of the second MTC device a second authentication vector of the second MTC device; performing authentication according to the second authentication vector and the second MTC device.
  • the first processor 81 is further configured to perform an authentication procedure to: receive a first access request that is sent by the first MTC device and that carries the identity of the first MTC device; An access request is obtained, and an authentication vector corresponding to the identity of the first MTC device is obtained from the authentication vector group to obtain a first authentication vector.
  • the first processor 81 is further configured to perform an authentication procedure to implement the following steps: a third access request carrying the identity of the group gateway to the authentication device; wherein the third access request is used to indicate that the authentication device acquires the first parameter of the group gateway based on the identity of the group gateway; and the receiving authentication device sends The first parameter is used to authenticate the authentication device based on the first parameter; if the authentication device passes the authentication, the second parameter is sent to the authentication device; wherein the second parameter is used by the authentication device to authenticate the group gateway, if not received The response message sent by the authentication device to indicate that the group gateway authentication fails, and the default group gateway passes the authentication.
  • the first processor 81 is further configured to perform an authentication procedure to implement the steps of: acquiring a third parameter in the first authentication vector, and transmitting the third parameter to the first MTC device;
  • the third parameter is used by the first MTC device to authenticate the group gateway;
  • the fourth parameter sent by the first MTC device is received, and the first MTC device is authenticated based on the fourth parameter and the first authentication vector; wherein the fourth parameter is After the first MTC device authenticates the group gateway, it is generated based on the third parameter.
  • the group gateway provided by the embodiment of the present disclosure, if the group gateway requests access to the network and passes the authentication, receives the authentication vector group sent by the authentication device, and stores the first authentication vector of the first MTC device from the authentication vector group. And authenticating with the first MTC device based on the first authentication vector. In this way, after the group gateway requests access to the network and passes the authentication, the group gateway receives the authentication vector group that is sent by the authentication device, including all the MTC device authentication vectors managed by the group gateway, and requests the first MTC device managed by the group gateway.
  • the first authentication vector of the first MTC device in the authentication vector group sent by the authentication device performs mutual authentication with the first MTC device, which solves the problem that the MTC device is caused by the introduction of the group gateway in the prior art.
  • the problem that the trust relationship between the network devices is weak is that the trust relationship between the MTC device and the network device is directly established through the group gateway, and the communication security between the MTC device and the network device is improved.
  • FIG. 10 is a schematic structural diagram of an authentication device according to an embodiment of the present disclosure.
  • the authentication device 9 includes a second processor 91, a second memory 92, and a second communication bus 93.
  • the second communication bus 93 is configured to implement connection communication between the second processor 91 and the second memory 92.
  • the second processor 91 is configured to execute an authentication procedure stored in the second memory 92 to implement the following steps: receiving a third access request sent by the group gateway carrying the identity of the group gateway; responding to the third access request Obtaining a third authentication vector of the group gateway based on the identity of the group gateway; acquiring the first parameter in the third authentication vector and sending the first parameter to the group gateway; wherein the first parameter is used by the group gateway to authenticate the authentication device Receiving a second parameter sent by the group gateway, and authenticating the group gateway based on the second parameter and the third authentication vector; if the group gateway is authenticated, acquiring the authentication vector group and sending the group to the group gateway; wherein, the authentication vector group The authentication vector of each MTC device managed by the group gateway is used for the group gateway to perform mutual authentication with each MTC device managed by the group gateway.
  • the second processor 91 is further configured to perform an authentication procedure to implement the following steps: if the group gateway passes the authentication, receiving the identity of the first MTC device sent by the group gateway; wherein, the first The MTC device is the first one of the MTC devices that the group gateway manages to access the group gateway; the group identifier corresponding to the identity of the first MTC device is determined based on the identity of the first MTC device; Determining each MTC device managed by the group gateway; obtaining an identity of each MTC device and a key of each MTC device; generating an authentication vector of each MTC device by using a preset algorithm based on a key of each MTC device The authentication vector group is sent to the group gateway.
  • the second processor 91 is further configured to perform an authentication procedure to: determine, according to the identity of the group gateway carried in the third access request, the group identifier corresponding to the group gateway; The group identifier determines each MTC device managed by the group gateway; acquires an identity of each MTC device and a key of each MTC device; and generates an authentication vector of each MTC device by using a preset algorithm based on a key of each MTC device The authentication vector group is obtained; if the group gateway is authenticated, the authentication vector group is sent to the group gateway.
  • the authentication device after receiving the third access request that is sent by the group gateway and carrying the identity identifier of the group gateway, obtains the group gateway based on the identity of the group gateway in response to the third access request. a third authentication vector, and acquiring the first parameter in the third authentication vector and sending to the group gateway, and then receiving the second parameter sent by the group gateway, and authenticating the group gateway based on the second parameter and the third authentication vector If the group gateway is authenticated, the authentication vector group is obtained and sent to the group gateway. In this way, the authentication device authenticates the group gateway, and after the authentication of the group gateway passes, sends the set of authentication vectors for authenticating the MTC device and including all the MTC devices managed by the group gateway to the group.
  • the group gateway authenticates the first MTC device that is requested to be accessed based on the authentication vector group sent by the authentication device, and solves the trust relationship between the MTC device and the network device due to the introduction of the group gateway in the prior art.
  • the weaker problem is to realize the direct establishment of a trust relationship between the MTC device and the network device through the group gateway, thereby improving the communication security between the MTC device and the network device.
  • the present disclosure provides a computer readable storage medium having an authentication program stored thereon, the authentication program being executable by one or more processors to implement the following steps:
  • the gateway requests access to the network and passes the authentication, and receives the authentication vector group sent by the authentication device and stores the authentication vector group, where the authentication vector group includes the authentication vector of each machine type communication MTC device managed by the group gateway; and the stored authentication vector group Obtaining a first authentication vector of the first MTC device; wherein the first MTC device is managed by the group gateway; and authenticating with the first MTC device based on the first authentication vector.
  • the authentication vector group sent by the authentication device is received and stored, and the method includes the following steps: if the group gateway requests to access the network and passes the authentication, the first is received. Sending, by the MTC device, a first access request that carries the identity of the first MTC device; in response to the first access request, sending the identity of the first MTC device to the authentication device; receiving the authentication vector group sent by the authentication device and storing; The authentication vector group is obtained by the authentication device based on the identity of the first MTC device.
  • the method after receiving the first parameter sent by the first MTC device, and after authenticating the first MTC device based on the first parameter and the first authentication vector, includes the following steps: receiving the carried by the second MTC device a second access request having an identity of the second MTC device; obtaining, in response to the second access request, the second authentication vector of the second MTC device from the authentication vector group based on the identity of the second MTC device; The vector is authenticated with the second MTC device.
  • acquiring the first authentication vector of the first MTC device from the stored authentication vector group includes the following steps: receiving a first connection that is sent by the first MTC device and carrying the identity of the first MTC device In response to the first access request, the authentication vector corresponding to the identity of the first MTC device is obtained from the authentication vector group to obtain a first authentication vector.
  • the method includes the following steps: sending the third access carrying the identity of the group gateway. Requesting to the authentication device, wherein the third access request is used to instruct the authentication device to acquire the first parameter of the group gateway based on the identity of the group gateway; receive the first parameter sent by the authentication device, and authenticate the device based on the first parameter If the authentication device passes the authentication, the second parameter is sent to the authentication device; wherein the second parameter is used by the authentication device to authenticate the group gateway, and if the authentication device fails to receive the group gateway authentication failure, In response to the message, the default group gateway is authenticated.
  • performing authentication according to the first authentication vector with the first MTC device including the steps of: acquiring a third parameter in the first authentication vector, and transmitting the third parameter to the first MTC device;
  • the third parameter is used by the first MTC device to authenticate the group gateway;
  • the fourth parameter sent by the first MTC device is received, and the first MTC device is authenticated based on the fourth parameter and the first authentication vector; wherein the fourth parameter is After the first MTC device authenticates the group gateway, it is generated based on the third parameter.
  • the present disclosure provides a computer readable storage medium having an authentication program stored thereon, the authentication program being executable by one or more processors to implement the following steps: receiving a group a third access request that is sent by the gateway and carries the identity of the group gateway; in response to the third access request, the third authentication vector of the group gateway is obtained based on the identity of the group gateway; and the third authentication vector is obtained.
  • a parameter is sent to the group gateway; wherein the first parameter is used by the group gateway to authenticate the authentication device; the second parameter sent by the group gateway is received, and the group gateway is authenticated based on the second parameter and the third authentication vector.
  • the authentication vector group is obtained and sent to the group gateway; wherein the authentication vector group includes an authentication vector of each MTC device managed by the group gateway, and the authentication vector group is used for the group gateway and the group The first MTC device managed by the gateway performs mutual authentication.
  • the method further includes the following steps: if the group gateway passes the authentication, receiving the identity of the first MTC device sent by the group gateway.
  • the first MTC device is the first one of the MTC devices managed by the group gateway to request access to the group gateway; and the identity of the first MTC device is determined according to the identity of the first MTC device.
  • a group identifier determining, according to the group identifier, each MTC device managed by the group gateway; acquiring an identity of each MTC device and a key of each MTC device; generating each MTC by using a preset algorithm based on a key of each MTC device
  • the authentication vector of the device is obtained from the authentication vector group and sent to the group gateway.
  • the authentication vector group is obtained and sent to the group gateway, and the method includes the following steps: determining the group gateway corresponding to the identity of the group gateway carried in the third access request. a group identifier; determining, according to the group identifier, each MTC device managed by the group gateway; acquiring an identity of each MTC device and a key of each MTC device; generating each using a preset algorithm based on a key of each MTC device.
  • the authentication vector of the MTC device obtains the authentication vector group; if the group gateway passes the authentication, the authentication vector group is sent to the group gateway.
  • embodiments of the present disclosure can be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware aspects. Moreover, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program messages can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that a message stored in the computer readable memory includes an article of manufacture of the message device, the message
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种认证方法，包括：若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，所述认证向量组中包括所述群组网关管理的每一机器类通信MTC设备的认证向量；从存储的所述认证向量组中获取第一MTC设备的第一认证向量；其中，所述第一MTC设备由所述群组网关管理；基于所述第一认证向量与所述第一MTC设备进行认证。本申请还提供了一种设备和计算机可读存储介质。

Description

认证方法、设备和计算机可读存储介质 技术领域
本公开涉及但不限于移动通信技术领域。
背景技术
在第三代合作伙伴计划(The 3rd Generation Partnership Project，3GPP)移动通信技术中，引入了机器类通信(Machine Type Communication，MTC)技术。其中，MTC技术的一个重要特点是可以允许海量MTC设备接入网络，并且通常是海量MTC设备同时请求接入移动蜂窝通信系统网络。由于移动蜂窝通信系统网络的网络资源有限，海量的MTC设备瞬间请求接入网络设备时消耗了大量的网络资源，并且在MTC设备接入过程中每一MTC设备与网络设备之间进行双向认证时有多次信令交互。这样，会给网络设备造成巨大的信令处理负担，进而出现网络拥塞等问题。
发明内容
第一方面，本公开实施例提供了一种认证方法，包括：若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，所述认证向量组中包括所述群组网关管理的每一机器类通信MTC设备的认证向量；从存储的所述认证向量组中获取第一MTC设备的第一认证向量；其中，所述第一MTC设备由所述群组网关管理；以及基于所述第一认证向量与所述第一MTC设备进行认证。
第二方面，本公开实施例提供了一种认证方法，包括：接收群组网关发送的携带有所述群组网关的身份标识的第三接入请求；响应所述第三接入请求，基于所述群组网关的身份标识获取所述群组网关的第三认证向量；获取所述第三认证向量中的第一参数并发送至所述群组网关；其中，所述第一参数用于所述群组网关对所述认证设备进行认证；接收所述群组网关发送的第二参数，基于所述第二参数和所述第三认证向量对所述群组网关进行认证；若所述群组网关通过认证， 获取认证向量组并发送至所述群组网关；其中，所述认证向量组包括所述群组网关管理的每一MTC设备的认证向量，所述认证向量组用于所述群组网关与由所述群组网关管理的每一MTC设备进行双向认证。
第三方面，本公开实施例提供了一种群组网关，包括：第一处理器、第一存储器及第一通信总线；所述第一通信总线用于实现所述第一处理器和所述第一存储器之间的连接通信；所述第一处理器用于执行所述第一存储器中存储的认证程序，以实现以下步骤：若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，所述认证向量组中包括所述群组网关管理的每一机器类通信MTC设备的认证向量；从存储的所述认证向量组中获取第一MTC设备的第一认证向量；其中，所述第一MTC设备由所述群组网关管理；基于所述第一认证向量与所述第一MTC设备进行认证。
第四方面，本公开实施例提供了一种认证设备，所述认证设备包括：第二处理器、第二存储器及第二通信总线；所述第二通信总线用于实现所述第二处理器和所述第二存储器之间的连接通信；所述第二处理器用于执行所述第二存储器中存储的认证程序，以实现以下步骤：接收群组网关发送的携带有所述群组网关的身份标识的第三接入请求；响应所述第三接入请求，基于所述群组网关的身份标识获取所述群组网关的第三认证向量；获取所述第三认证向量中的第一参数并发送至所述群组网关；其中，所述第一参数用于所述群组网关对所述认证设备进行认证；接收所述群组网关发送的第二参数，基于所述第二参数和所述第三认证向量对所述群组网关进行认证；若所述群组网关通过认证，获取认证向量组并发送至所述群组网关；其中，所述认证向量组包括所述群组网关管理的每一MTC设备的认证向量，所述认证向量组用于所述群组网关与由所述群组网关管理的每一MTC设备进行双向认证。
第五方面，本公开实施例提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有认证程序，所述认证程序被处理器执行时实现本文所述的认证方法的步骤。
附图说明
图1为本公开实施例提供的一种认证方法的流程示意图；
图2为本公开实施例提供的另一种认证方法的流程示意图；
图3为本公开实施例提供的又一种认证方法的流程示意图；
图4为本公开实施例提供的再一种认证方法的流程示意图；
图5为本公开实施例提供的一种系统结构示意图；
图6为本公开另一实施例提供的一种认证方法的流程示意图；
图7为本公开另一实施例提供的另一种认证方法的流程示意图；
图8为本公开另一实施例提供的又一种认证方法的流程示意图；
图9为本公开实施例提供的一种群组网关的结构示意图；
图10为本公开实施例提供的一种认证设备的结构示意图。
具体实施方式
下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述。
在第三代合作伙伴计划(The 3rd Generation Partnership Project，3GPP)移动通信技术中，引入了机器类通信(Machine Type Communication，MTC)技术。其中，MTC技术的一个重要特点是可以允许海量MTC设备接入网络，并且通常是海量MTC设备同时请求接入移动蜂窝通信系统网络。由于移动蜂窝通信系统网络的网络资源有限，海量的MTC设备瞬间请求接入网络设备时消耗了大量的网络资源，并且在MTC设备接入过程中每一MTC设备与网络设备之间进行双向认证时有多次信令交互。这样，会给网络设备造成巨大的信令处理负担，进而出现网络拥塞等问题。为了解决上述技术问题，现有技术中提出了引入群组网关管理MTC设备群，即群组网关接入移动蜂窝通信系统网络时，群组网关与移动蜂窝通信系统网络侧的网络设备进行双向认证；而群组网关和MTC设备之间基于预共享密钥(Pre-shared Key，PSK)或者公共密钥架构(Public Key Infrastructure，PKI)完成本地双向认证，这样，可大幅度地减小网络设备的信令处理负担，并降低网络拥塞问题。
但是，现有技术中仅仅只是实现了网络设备与群组网关之间的双向认证，而MTC设备与群组网关之间只是根据PSK或PKI进行本地认证，MTC设备并没有与网络设备进行认证，也就是说只要网络设备与群组网关之间的双向认证通过后，MTC设备默认信任网络设备，网络设备也默认信任MTC设备，这样MTC设备与网络设备之间呈现一种弱信任关系，导致MTC设备与网络设备之间的通信安全性较低。
因此，本公开特别提供了认证方法、设备和计算机可读存储介质，其基本上避免了由于现有技术的局限和缺点所导致的问题中的一个或多个。
本公开实施例提供一种认证方法。图1为本公开实施例提供的一种认证方法的流程示意图。参照图1所示，该方法可以包括以下步骤101至103。
在步骤101处，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储。
其中，认证向量组中包括群组网关管理的每一机器类通信MTC设备的认证向量。
在一个示例中，步骤101“若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储”可以由群组网关来实现。群组网关请求接入网络并通过认证可以是群组网关在请求接入网络时，群组网关通过网络侧的认证设备的认证即可，还可以是群组网关在请求接入网络时，群组网关与认证设备之间通过双向认证。其中，群组网关与认证设备之间的双向认证可以是基于身份验证和密钥协议(Authentication and Key Agreement，AKA)或者扩展认证协议(Extensible Authentication Protocol，EAP)-安全传输层协议((Transport Layer Security Protocol，TLS)来实现的。群组网关与认证设备之间的双向认证不仅包括移动蜂窝通信系统网络中的认证设备对群组网关的合法性进行认证，也包括群组网关对认证设备的合法性也要进行认证。
采用AKA协议时，每一MTC设备的认证向量包括一个随机数(Random，RAND)、一个期望响应(Expected Response，XRES)、一 个加密密钥(Cipher Key，CK)、一个完整性校验密钥(Integrity Key，IK)和一个认证令牌(Authentication Token，AUTN)等参数。其中，AUTN包括消息鉴权码(Message Authentication Code，MAC)和序列号(Sequence Number，SQN)。认证向量组中包括群组网关管理的至少一个MTC设备的认证向量。此时，认证设备为移动蜂窝通信系统网络的网络设备中用于对群组网关的合法性进行认证的设备，可以包括认证节点、认证服务器和签约寄存器。
采用EAP-TLS协议时，每一MTC设备的认证向量在MTC设备的数字证书中携带。此时，认证设备包括证书授权(Certificate Authority，CA)中心和认证服务器。
在步骤102处，从存储的认证向量组中获取第一MTC设备的第一认证向量。
其中，第一MTC设备由群组网关管理。
在一个示例中，步骤102“从存储的认证向量组中获取第一MTC设备的第一认证向量”可以由群组网关来实现。第一MTC设备可以是在群组网关与认证设备通过双向认证后，群组网关管理的MTC设备中的第一个向群组网关发送接入请求的MTC设备，或者是在群组网关与认证设备通过双向认证后，群组网关管理的MTC设备中的任意一个像群组网关发送接入请求的MTC设备。群组网关基于第一MTC设备的标识从存储的认证向量组中获取第一MTC设备的第一认证向量。
群组网关获取第一认证向量后，将第一认证向量中的RAND和AUTN等参数发送至第一MTC设备，使第一MTC设备基于RAND生成期望鉴权值(Expected MAC，XMAC)与AUTN中的MAC进行比较，以及对AUTN中携带的SQN与群组网本地的SQN进行比较，以实现对群组网关的认证。
在步骤103处，基于第一认证向量与第一MTC设备进行认证。
在一个示例中，步骤103“基于第一认证向量与第一MTC设备进行认证”可以由群组网关来实现。
本公开实施例所提供的认证方法，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储，从认证向量组中 获取第一MTC设备的第一认证向量，并基于第一认证向量与第一MTC设备进行认证。这样，在群组网关请求接入网络并通过认证后，群组网关接收认证设备发送的包括群组网关管理的所有MTC设备认证向量的认证向量组，在群组网关管理的第一MTC设备请求接入群组网关时，基于认证设备发送的认证向量组中第一MTC设备的第一认证向量与第一MTC设备进行双向认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
基于前述实施例，本公开实施例提供一种认证方法。图2为本公开实施例提供的另一种认证方法的流程示意图。参照图2所示，该方法可以包括以下步骤201至205。
在步骤201处，接收群组网关发送的携带有群组网关的身份标识的第三接入请求。
在一个示例中，步骤201“接收群组网关发送的携带有群组网关的身份标识的第三接入请求”可以由认证设备来实现。第三接入请求用于群组网关请求接入移动蜂窝通信系统网络，在允许群组网关接入移动蜂窝通信系统网络时，首先需对群组网关与认证设备之间进行双向认证。
在步骤202处，响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量。
在一个示例中，步骤202“响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量”可以由认证设备来实现。在群组网关上预先配置有群组网关的签约信息，包括群组网关的身份标识，以及与认证设备和MTC设备之间的共享根密钥，其中，认证设备和MTC设备之间的根密钥可以相同，也可以不同。在认证设备上配置有认证设备的签约信息以及群组网关管理的所有MTC设备的签约信息，包括身份标识和共享根密钥。
第三认证向量是认证设备获取与群组网关的身份标识对应的群组网关的共享密钥，然后基于群组网关的共享密钥采用预设算法进行 计算得到的，包括群组网关的RAND、XRES、CK、IK和AUTN等参数。
在步骤203处，获取第三认证向量中的第一参数并发送至群组网关。
其中，第一参数用于群组网关对认证设备进行认证。
在一个示例中，步骤203“获取第三认证向量中的第一参数并发送至群组网关”可以由认证设备来实现。第一参数是群组网关的第三认证向量中的RAND和AUTN等参数。
在步骤204处，接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证。
在一个示例中，步骤204“接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证”可以由认证设备来实现。第二参数是群组网关基于接收到的第一参数对认证设备进行认证后基于第一参数中的RAND和AUTN生成得到的，例如可以是群组网关的RES。
在步骤205处，若群组网关通过认证，获取认证向量组并发送至群组网关。
这里，认证向量组包括群组网关管理的每一MTC设备的认证向量，认证向量组用于群组网关与由群组网关管理的每一MTC设备进行双向认证。
在一个示例中，步骤205“若群组网关通过认证，获取认证向量组并发送至群组网关”可以由认证设备来实现。若认证设备基于第二参数XMAC和第三认证向量中的AUTN中的MAC匹配，且AUTN中的SQN与认证设备本地的SQN匹配，则认证设备根据群组网关管理的MTC设备签约信息中的根密钥生成每一MTC设备的认证向量，得到认证向量组并将得到的MTC设备的认证向量组发送至群组网关，这样，在群组网关管理的MTC设备请求接入时，基于MTC设备的认证向量组与请求接入的MTC设备进行双向认证，通过群组网关实现MTC设备与认证设备之间的认证过程，并减少了MTC设备与认证设备之间的信令交互。
本公开实施例所提供的认证方法，接收群组网关发送的携带有群组网关的身份标识的第三接入请求后，响应第三接入请求，基于群 组网关的身份标识获取群组网关的第三认证向量，并获取第三认证向量中的第一参数并发送至群组网关，然后接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证，若群组网关通过认证，获取认证向量组并发送至群组网关。这样，认证设备对群组网关进行认证，并在群组网关的认证通过后将用于对MTC设备进行认证的、且包括群组网关所管理的所有MTC设备的认证向量的集合发送至群组网关，以便于群组网关基于认证设备发送的认证向量组对请求接入的第一MTC设备进行认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
基于前述实施例，本公开实施例提供一种认证方法。图3为本公开实施例提供的又一种认证方法的流程示意图。参照图3所示，该方法可以包括以下步骤301至312。
在步骤301处，群组网关发送携带有群组网关的身份标识的第三接入请求至认证设备。
其中，第三接入请求用于指示认证设备基于群组网关的身份标识获取群组网关的第一参数。
以群组网关和认证设备、MTC设备与群组网关之间基于AKA协议进行双向认证为例进行说明，MTC设备上预先配置有MTC设备的签约信息，包括(MTC i，K i，…)，i＝1，2……，其中，MTC i为MTC设备身份标识、Ki为MTC设备和认证设备之间共享根密钥信息；群组网关上也预先配置有群组网关的签约信息(UE j，K j，…)，j＝1，2……，其中UE j为群组网关身份标识、K j为群组网关与认证设备之间的共享根密钥信息；认证设备上配置有上述MTC设备的签约信息和上述群组网关的签约信息。其中，认证服务器中的MTC设备按照所属的群组网关进行分类存储，例如采用MTC设备群组的方式进行存储，例如可以是(GID j，UE j，(MTC 1，MTC 2，…，MTC n) j)，其中，GID为第j个群组网关对应的组标识、UE j表示第j个群组网关的身份标识，(MTC 1，MTC 2，…，MTC n) j表示第j个群组网关管理的n个MTC设备的身份标识。群组 网关发送携带有群组网关的身份标识UE j的第三接入请求至认证设备。
以AKA协议进行双向认证时，第一参数为认证向量(Authentication Vector，AV)中的向量参数，例如可以是认证向量中的RAND和AUTN。
在步骤302处，认证设备接收群组网关发送的携带有群组网关的身份标识的第三接入请求。
在步骤303处，认证设备响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量。
在一个示例中，认证设备响应第三接入请求，基于群组网关的身份标识UE j获取与UE j对应的群组网关与认证设备之间的共享根密钥信息K j，基于共享根密钥信息K j采用认证向量算法生成群组网关的第三认证向量，即群组网关的认证向量AV j[RAND j，AUTN j，XRES j，CK j，IK j]。
在步骤304处，认证设备获取第三认证向量中的第一参数并发送至群组网关。
其中，第一参数用于群组网关对认证设备进行认证。
在一个示例中，认证设备获取第三认证向量AV j[RAND j，AUTN j，XRES j，CK j，IK j]中的第一参数RAND j和AUTN j并发送至群组网关。
在步骤305处，群组网关接收认证设备发送的第一参数，并基于第一参数对认证设备进行认证。
在一个示例中，群组网关接收认证设备发送的第一参数RAND j和AUTN j，基于RAND j采用AKA协议中计算XMAC的算法进行计算，得到群组网关的XMAC j，对AUTN j进行解析处理，得到认证设备发送的SQN以及MAC，比较MAC和XMAC两个值是否相同；如果MAC和XMAC两个值不相同，则中止认证流程；如果MAC和XMAC两个值相同，群组网关基于本地存储的SQN验证认证设备发送的SQN，如果认证设备发送的SQN和本地存储的SQN不一致，则中止认证流程。否则如果认证设备发送的SQN和本地存储的SQN一致，表明认证设备通过群组网关的认证。基于RAND j采用AKA协议中计算随机数的响应(Response，RES)的算法进行计算得到群组网关的响应RES j，得到第二参数。
在步骤306处，若认证设备通过认证，群组网关发送第二参数至认证设备。
其中，第二参数用于认证设备对群组网关进行认证，若群组网关未接收到认证设备发送的用于指示群组网关认证失败的响应消息，默认群组网关通过认证。
在步骤307处，认证设备接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证。
在一个示例中，认证设备接收群组网关发送的第二参数RES j，并判断第二参数RES j是否与第三认证向量AV j[RAND j，AUTN j，XRES j，CK j，IK j]中的XRES j相同。
在步骤308处，若群组网关通过认证，认证设备获取认证向量组并发送至群组网关。
其中，认证向量组包括群组网关管理的每一MTC设备的认证向量，认证向量组用于群组网关与由群组网关管理的第一MTC设备进行双向认证。
在一个示例中，若RES j与XRES j不相同，则停止操作，向群组网关发送认证失败的消息。若RES j与XRES j相同，表明群组网关通过认证，认证设备获取群组网关UE j对应的MTC设备(MTC 1，MTC 2，…，MTC n) j对应的认证向量组(AV 1，AV 2，…，AV n) j并发送至群组网关。
在本公开其他实施例中，步骤308可以由以下步骤308a1至308a5来实现。
在步骤308a1处，认证设备基于第三接入请求中携带的群组网关的身份标识确定群组网关对应的组标识。
在步骤308a2处，认证设备基于组标识确定群组网关管理的每一MTC设备。
在一个示例中，由于认证设备中的MTC设备签约信息是采用MTC设备群组的方式进行存储的，所以可以根据群组网关的身份标识确定群组网关UE j所在MTC设备群组，从而可以确定群组网关UE j管理的每一MTC设备。
在步骤308a3处，认证设备获取每一MTC设备的身份标识，并 基于每一MTC设备的身份标识获取每一MTC设备的第一密钥。
在一个示例中，认证设备获取每一MTC设备的身份标识(MTC 1，MTC 2，…，MTC n) j，并基于每一MTC设备的身份标识获取每一MTC设备的第一密钥，例如MTC 1的第一密钥为K 1，MTC 2的第一密钥为K 2，…，MTC n的第一密钥为K n。
在步骤308a4处，认证设备基于每一第一密钥采用预设算法生成每一MTC设备的认证向量，得到认证向量组。
在一个示例中，预设算法为AKA协议中生成认证向量组的算法。认证设备基于每一第一密钥采用预设算法生成每一MTC设备的认证向量，例如MTC 1的认证向量为AV 1(RAND1，AUTN1，XRES1，CK1，IK1)，MTC 2的认证向量为AV 2(RAND2，AUTN2，XRES2，CK2，IK2)，…，MTC n的认证向量为AV n(RANDn，AUTNn，XRESn，CKn，IKn)，因此得到群组网关UE j对应的MTC设备的认证向量组AV(AV 1，AV 2，…，AV n) j。
其中，需说明的是，步骤308a1至308a4与步骤303至307可以同时执行，步骤308a1至308a4还可以与步骤303同时执行，具体执行顺序可以根据实际应用场景来确定。
在步骤308a5处，若群组网关通过认证，发送认证向量组至群组网关。
在步骤309处，群组网关接收认证设备发送的认证向量组并存储。
其中，认证向量组中包括群组网关管理的每一机器类通信MTC设备的认证向量。
在步骤310处，群组网关从存储的认证向量组中获取第一MTC设备的第一认证向量。
其中，第一MTC设备由群组网关管理。
在本公开其他实施例中，步骤310具体可以由以下步骤301a1和310a2来实现。
在步骤310a1处，群组网关接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求。
在步骤310a2处，群组网关响应第一接入请求，从认证向量组 中获取与第一MTC设备的身份标识对应的认证向量，得到第一认证向量。
在本公开实施例中，第一MTC设备为群组网关管理的任意一个MTC设备。假设第一MTC设备的身份标识为MTC 2，则基于MTC 2从认证向量组AV(AV 1，AV 2，…，AV n) j中获取与MTC 2对应的第一认证向量AV 2。
在步骤311处，群组网关获取第一认证向量中的第三参数，并发送第三参数至第一MTC设备。
其中，第三参数用于第一MTC设备对群组网关进行认证。
在一个示例中，第三参数为第一认证向量AV 2中的随机数RAND2和认证令牌AUTN2。
在步骤312处，群组网关接收第一MTC设备发送的第四参数，并基于第四参数和第一认证向量对第一MTC设备进行认证。
其中，第四参数是第一MTC设备对群组网关的认证通过后基于第三参数生成的。
在一个示例中，若第四参数RES与第一认证向量中的XRES相同，表明第一MTC设备通过认证，此时，第一MTC设备通过群组网关与认证设备之间实现双向认证。在后续通信过程中，第一MTC设备和群组网关之间可以采用第一认证向量中的CK密钥和IK密钥对通信数据进行保护，群组网关和认证设备之间可以采用第三认证向量中的CK密钥和IK密钥对通信数据进行保护。
进一步需说明的是，MTC设备、群组网关和认证设备之间采用EAP-TLS协议进行认证时，第一认证向量、第二认证向量、第三认证向量、第一参数、第二参数、第三参数和第四参数均为对应的网关或设备的数字证书。
需要说明的是，本实施例中与其它实施例中相同步骤或者概念的解释，可以参照其它实施例中的描述，此处不再赘述。
本公开实施例所提供的认证方法，接收群组网关发送的携带有群组网关的身份标识的第三接入请求，并响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量，然后获取第三认证 向量中的第一参数并发送至群组网关，接收群组网关发送的第二参数，并基于第二参数和第三认证向量对群组网关进行认证，若群组网关通过认证，获取认证向量组并发送至群组网关，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储，从存储的认证向量组中获取第一MTC设备的第一认证向量，并基于第一认证向量与第一MTC设备进行认证；这样，认证设备首先对群组网关进行认证，在群组网关认证通过后发送群组网关管理的所有MTC设备的认证向量组至群组网关，使群组网关基于认证向量对请求接入的第一MTC设备进行认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
基于前述实施例，本公开实施例提供一种认证方法，主要用于认证设备与群组网关双向认证通过后，认证设备在接收到群组网关发送的第一MTC设备的身份标识时才获取MTC设备的认证向量组，并将获取的MTC参数集合发送给群组网关，以便于群组网关对请求接入的第一MTC设备进行认证。图4为本公开实施例提供的再一种认证方法的流程示意图。参照图4所示，该方法可以包括以下步骤401至419。
在步骤401处，群组网关发送携带有群组网关的身份标识的第三接入请求至认证设备。
其中，第三接入请求用于指示认证设备基于群组网关的身份标识获取群组网关的第一参数。
在步骤402处，认证设备接收群组网关发送的携带有群组网关的身份标识的第三接入请求。
在步骤403处，认证设备响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量。
在步骤404处，认证设备获取第三认证向量中的第一参数并发送至群组网关。
其中，第一参数用于群组网关对认证设备进行认证。
在步骤405处，群组网关接收认证设备发送的第一参数，并基 于第一参数对认证设备进行认证。
在步骤406处，若认证设备通过认证，群组网关发送第二参数至认证设备。
其中，第二参数用于认证设备对群组网关进行认证，若群组网关未接收到认证设备发送的用于指示群组网关认证失败的响应消息，默认群组网关通过认证。
在步骤407处，认证设备接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证。
在步骤408处，若未接收到认证设备发送的用于指示群组网关认证失败的响应消息，群组网关默认群组网关通过认证。
在一个示例中，由于群组网关未接收到认证设备发送的用于直至群组网关认证失败的响应消息，因此，群组网关与认证设备通过双向认证。
在步骤409处，群组网关接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求。
在本公开实施例中，第一MTC设备可以是群组网关管理的所有MTC设备中第一个向群组网关发送第一接入请求的MTC设备。
在步骤410处，群组网关响应第一接入请求，发送第一MTC设备的身份标识至认证设备。
在步骤411处，认证设备接收群组网关发送的第一MTC设备的身份标识。
其中，第一MTC设备是群组网关管理的每一MTC设备中第一个请求接入群组网关的MTC设备。
在步骤412处，认证设备基于第一MTC设备的身份标识确定第一MTC设备的身份标识对应的组标识。
在步骤413处，认证设备基于组标识确定群组网关管理的每一MTC设备。
在步骤414处，认证设备获取每一MTC设备的身份标识，并基于每一MTC设备的身份标识获取每一MTC设备的第二密钥。
在步骤415处，认证设备基于每一第二密钥采用预设算法生成 每一MTC设备的认证向量，得到认证向量组并发送至群组网关。
在步骤416处，群组网关接收认证设备发送的认证向量组并存储。
其中，认证向量组是认证设备基于第一MTC设备的身份标识得到的。
在步骤417处，群组网关从存储的认证向量组中获取第一MTC设备的第一认证向量。
其中，第一MTC设备由群组网关管理。
在步骤418处，群组网关获取第一认证向量中的第三参数，并发送第三参数至第一MTC设备。
其中，第三参数用于第一MTC设备对群组网关进行认证。
在步骤419处，群组网关接收第一MTC设备发送的第四参数，并基于第四参数和第一认证向量对第一MTC设备进行认证。
其中，第四参数是第一MTC设备对群组网关的认证通过后基于第三参数生成的。
基于前述实施例，在本公开其他实施例中，步骤419之后还包括以下步骤420至422。
在步骤420处，群组网关接收第二MTC设备发送的携带有第二MTC设备的身份标识的第二接入请求。
在一个示例中，第二MTC设备是群组网关管理的所有MTC设备中除第一MTC设备外的MTC设备。
在步骤421处，群组网关响应第二接入请求，基于第二MTC设备的身份标识从认证向量组中获取第二MTC设备的第二认证向量。
在步骤422处，群组网关基于第二认证向量与第二MTC设备进行认证。
其中，步骤422可以由以下步骤422a和422b来实现。
在步骤422a处，群组网关获取第二认证向量中的第五参数并发送至第二MTC设备。
在一个示例中，第二MTC设备基于接收到第五参数对群组网关进行认证，若群组网关通过第二MTC设备的认证，基于第五参数生成 第六参数并发送第六参数至群组网关。
在步骤422b处，群组网关接收第二MTC设备发送的第六参数，并基于第六参数和第二认证向量对第二MTC设备进行认证。
其中，第六参数是第二MTC设备对群组网关的认证通过后基于第五参数生成的。
需说明的是，MTC设备、群组网关和认证设备之间采用EAP-TLS协议进行认证时，第一认证向量、第二认证向量、第三认证向量、第一参数、第二参数、第三参数、第四参数、第五参数、第六参数均为对应的网关或设备的数字证书。
需要说明的是，本实施例中与其它实施例中相同步骤或者概念的解释，可以参照其它实施例中的描述，此处不再赘述。
本公开实施例所提供的认证方法，接收群组网关发送的携带有群组网关的身份标识的第三接入请求，并响应第三接入请求，基于群组网关的身份标识获取群组网关的第三特征参数认证向量，然后获取第三特征参数认证向量中的第一参数并发送至群组网关，接收群组网关发送的第二参数，并基于第二参数和第三特征参数认证向量对群组网关进行认证，若群组网关通过认证，获取特征参数集合认证向量组并发送至群组网关，若群组网关请求接入网络并通过认证，接收认证设备发送的特征参数集合认证向量组并存储，从存储的特征参数集合认证向量组中获取第一MTC设备的第一认证向量，并基于第一认证向量与第一MTC设备进行认证；这样，认证设备首先对群组网关进行认证，在群组网关认证通过后发送群组网关管理的所有MTC设备的特征参数集合认证向量组至群组网关，使群组网关基于特征参数认证向量对请求接入的第一MTC设备进行认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
图5为本公开实施例提供的一种系统结构示意图。基于前述实施例，本公开实施例实施基于如图5所示的系统结构，包括至少一个MTC设备(A1、A2、……、An)、群组网关B和认证设备C。其中， 群组网关B可以管理多个MTC设备(A1、A2、……、An)，MTC设备(A1、A2、……和/或An)通过群组网关B与认证设备C之间实现通信链接，群组网关可以有多个；认证设备是移动蜂窝通信系统网络中用于对群组网关、MTC设备等进行身份认证的设备。认证设备C可以包括认证节点C1、认证服务器C2和签约寄存器C3。其中，认证节点C1配置为与群组网关B进行通信链接，从群组网关B处获取信息内容发送至认证服务器C2或接收认证服务器C2发送的内容并转发至群组网关B；认证服务器C2配置为从签约寄存器C3处获取认证数据，进行存储并发送至认证节点C1；签约寄存器C3配置为存储与群组网关和MTC设备对应的用于共享的根密钥，并在接收到认证服务器C2发送的获取认证数据的请求后，响应获取认证数据的请求采用算法根据根密钥生成多个随机数(RAND)，并利用其中一个RAND采用预设算法生成多组认证向量得到认证数据，并将生成的多组认证向量发送至认证服务器C3，这样，认证服务器C3将多组认证向量通过认证节点C1发送给群组网关B以对群组网关B进行身份认证或对MTC设备进行身份认证。
基于前述实施例，本公开实施例提供一种认证方法。图6为本公开另一实施例提供的一种认证方法的流程示意图。认证设备包括认证节点、认证服务器和签约寄存器。参照图6所示，该认证方法可以包括以下步骤501至518。
在步骤501处，群组网关发送第一接入请求至认证节点，认证节点接收到群组网关的接入请求。
其中，第一接入请求中携带有群组网关的网关身份标识UE GW。
在步骤502处，认证节点从第一接入请求中获取群组网关的网关身份标识UE GW，并发送第一认证请求至认证服务器。
其中，第一认证请求中携带有群组网关的网关身份标识UE GW。
在步骤503处，认证服务器从接收到的第一认证请求中获取网关身份标识UE GW，并发送用于获取认证数据的请求消息至签约寄存器。
其中，签约寄存器中还配置有MTC用户群组信息，例如可以记为(GID，UE GW，UE 1，UE 2，…，UE n)，其中，GID为群组网关所管理 的MTC设备所在组的组标识、UE GW表示该群组网关的网关身份标识，UE 1，UE 2，…，UE n为该群组网关所管理的所有MTC设备的身份标识，签约寄存器中还配置有与该群组网关共享的根密钥K GW，以及与对应的MTC设备共享的根密钥K1，K2，…，Kn。请求消息中携带有网关身份标识UE GW。
在步骤504处，签约寄存器接收到请求消息后，签约寄存器根据群组网关的网关身份标识UE GW获得与群组网关对应的根密钥K GW，并基于根密钥K GW采用认证向量生成算法生成群组网关的认证向量AV GW。基于群组网关的网关身份标识UE GW确定群组网关所管理的所有MTC设备的身份标识UE 1，UE 2，…，UE n，并获取与所有MTC设备对应的根密钥K1，K2，…，Kn，基于根密钥K1，K2，…，Kn生成该群组网关所管理的所有MTC设备的认证向量，得到认证向量组AV i[RAND，AUTN，XRES，CK，IK]，i＝1，2，…，n。
在步骤505处，签约寄存器发送响应消息至认证服务器。
其中，响应消息中携带有群组网关的认证向量AV GW和群组网关所管理的所有MTC设备对应的认证向量组AV i，i＝1，2，…，n。
在步骤506处，认证服务器保存响应消息中携带的群组网关的认证向量AV GW和群组网关所管理的所有MTC设备对应的认证向量组AV i，i＝1，2，…，n。
在步骤507处，认证服务器发送群组网关的认证向量AV GW至认证节点。
在步骤508处，认证节点从群组网关的认证向量AV GW中获取群组网关的认证参数RAND GW和AUTN GW。
在步骤509处，认证节点发送第二认证请求至群组网关，群组网关接收认证节点发送的第二认证请求。
其中，第二认证请求中的携带有群组网关的认证参数RAND GW和AUTN GW。
在步骤510处，群组网关基于认证节点发送的第二认证请求中携带的RAND GW，采用鉴权值计算算法计算出期待鉴权值XMAC GW；若XMAC GW与群组网关本地的MAC GW值相同，群组网关对认证节点发送的 第二认证请求中携带的AUTN GW进行解析处理得到SQN GW，若SQN GW与群组网关本地维护的SQN相同，则群组网关基于RAND GW和AUTN GW生成群组网关的RES GW，并发送RES GW至认证节点，表明网络侧通过群组网关的认证。
其中，若XMAC GW与群组网关本地的MAC GW值不相同，群组网关向认证服务器发送拒绝认证消息，并终止认证流程。
若SQN GW与群组网关本地维护的SQN不相同，群组网关向认证服务器发送同步失败消息，并终止认证流程。
在步骤511处，认证节点比较群组网关发送的RES GW与认证节点中群组网关的认证向量AV GW中的XRES GW，若RES GW与XRES GW相同，群组网关通过网络侧的认证，这样，表明认证节点与群组网关之间通过了双向认证。
其中，若RES GW与XRES GW不相同，认证节点发送认证失败消息至群组网关。当认证节点与群组网关实现双向认证后，在随后通信中，群组网关与网络侧可以采用群组网关根据密钥和RAND GW生成的密钥对CK和IK对通信数据进行保护。
在本公开其他实施例中，步骤505中签约寄存器发送至认证服务器的响应消息中可以只携带有群组网关的认证向量AV GW，在认证节点与群组网关之间实现双向认证后，签约寄存器再将群组网关所管理的所有MTC设备对应的认证向量组AV i，i＝1，2，…，n发送至群组网关。
在步骤512处，认证节点与群组网关实现双向认证后，认证服务器将群组网关所管理的所有MTC设备对应的认证向量组AV i，i＝1，2，…，n发送至群组网关。
在步骤513处，群组网关保存认证向量组AV i，i＝1，2，…，n。
在步骤514处，群组网关接收群组网关所管理的第一MTC设备发送的第二接入请求。
其中，第一MTC设备是群组网关所管理的MTC设备中的任意一个MTC设备，第一MTC设备发送的第二接入请求中携带有第一MTC设备的身份标识UE j。
在步骤515处，群组网关基于第二接入请求中携带的第一MTC设备的身份标识UE j从存储的认证向量组AV i，i＝1，2，…，n中获取对应的认证向量，得到第一MTC设备的认证向量AV j。
在步骤516处，群组网关从第一MTC设备的认证向量AV j中获取第一MTC设备的认证参数RAND j和AUTN j，并发送第三认证请求至第一MTC设备。
其中，群组网关发送至第一MTC设备的第三认证请求中携带有第一MTC设备的认证参数RAND j和AUTN j。
在步骤517处，第一MTC设备基于群组网关发送的第三认证请求中携带的RAND j，采用鉴权值计算算法计算出期待鉴权值XMAC j；若XMAC j与第一MTC设备本地的MAC j值相同，第一MTC设备对群组网关发送的第三认证请求中携带的AUTN j进行解析处理得到SQN j，若SQN j与第一MTC设备本地维护的SQN相同，则基于RAND j和AUTN j生成第一MTC设备的RES j，并发送RES j至群组网关。
其中，若XMAC j与第一MTC设备本地的MAC j值不相同，第一MTC设备向群组网关送拒绝认证消息，并终止认证流程。
若SQN j与第一MTC设备本地维护的SQN不相同，第一MTC设备向群组网关发送同步失败消息，并终止认证流程。
在步骤518处，群组网关比较第一MTC设备发送的RES j与群组网关中第一MTC设备的认证向量AV j中的XRES j，若RES j与XRES j相同，则群组网关与第一MTC设备完成双向认证，群组网关向认证节点返回确认消息，表示第一MTC设备认证成功。
其中，若RES GW与XRES GW不相同，表明认证失败，群组网关可以决定第一MTC设备重发起认证。
当认证节点与群组网关实现双向认证后，在随后通信中，群组网关与第一MTC设备之间可以采用第一MTC设备根据密钥和RAND j生成的密钥对CK和IK对通信数据进行保护。
基于前述实施例，本公开实施例还提供一种认证方法。图7为本公开另一实施例提供的另一种认证方法的流程示意图。认证设备包括认证节点、认证服务器和签约寄存器。参照图7所示，该方法可以 包括以下步骤601至619。
在步骤601处，群组网关发送第一接入请求至认证节点。
其中，第一接入请求中携带有群组网关的网关身份标识UE GW，用于指示群组网关请求建立与网络侧的通信链接。
在步骤602处，认证节点接收到群组网关的第一接入请求后，响应第一接入请求从第一接入请求中获取群组网关的网关身份标识UE GW，并发送第一认证请求至认证服务器。
其中，第一认证请求中携带有群组网关的网关身份标识UE GW。
在步骤603处，认证服务器基于接收到的认证请求中携带的网关身份标识UE GW，发送用于获取认证数据的请求消息至签约寄存器。
在步骤604处，签约寄存器接收到请求消息后，签约寄存器根据群组网关的网关身份标识UE GW获得与群组网关对应的根密钥K GW，并基于根密钥K GW采用认证向量生成算法生成群组网关的认证向量AV GW。
在步骤605处，签约寄存器发送响应消息至认证服务器。
其中，响应消息中携带有群组网关的认证向量AV GW。
在步骤606处，认证服务器保存响应消息中携带的群组网关的认证向量AV GW。
在步骤607处，认证服务器发送群组网关的认证向量AV GW至认证节点。
在步骤608处，认证节点从群组网关的认证向量中获取群组网关的认证参数RAND GW和AUTN GW。
在步骤609处，认证节点发送第二认证请求至群组网关，群组网关接收认证节点发送的第二认证请求。
其中，第二认证请求中的携带有群组网关的认证参数RAND GW和AUTN GW。
在步骤610处，群组网关基于认证节点发送的第二认证请求中携带的RAND GW，采用鉴权值计算算法计算出期待鉴权值XMAC GW；若XMAC GW与群组网关本地的MAC GW值相同，群组网关对认证节点发送的第二认证请求中携带的AUTN GW进行解析处理得到SQN GW，若SQN GW与群 组网关本地维护的SQN相同，则群组网关基于RAND GW和AUTN GW生成群组网关的RES GW，并发送RES GW至认证节点，表明网络侧通过群组网关的认证。
其中，若XMAC GW与群组网关本地的MAC GW值不相同，群组网关向认证服务器发送拒绝认证消息，并终止认证流程。
若SQN GW与群组网关本地维护的SQN不相同，群组网关向认证服务器发送同步失败消息，并终止认证流程。
在步骤611处，认证节点比较群组网关发送的RES GW与认证节点中群组网关的认证向量AV GW中的XRES GW，若RES GW与XRES GW相同，群组网关通过网络侧的认证，这样，表明认证节点与群组网关之间通过了双向认证。
其中，若RES GW与XRES GW不相同，认证节点发送认证失败消息至群组网关。当认证节点与群组网关实现双向认证后，在随后通信中，群组网关与网络侧可以采用群组网关根据密钥和RAND GW生成的密钥对CK和IK对通信数据进行保护。
在步骤612处，群组网关接收群组网关所管理的第一MTC设备发送的附着请求。
其中，第一MTC设备是群组网关所管理的MTC设备中第一个发送附着请求以请求接入群组网关的MTC设备，在附着请求中携带有第一MTC设备的身份标识UE 1。
在步骤613处，群组网关获取附着请求中携带的第一MTC设备的身份标识UE 1，并发送针对该第一MTC设备的第二接入请求至认证节点。
其中，第二接入请求中携带有第一MTC设备的身份标识UE 1，第二接入请求用于指示第一MTC设备请求建立与网络侧的通信链接。
在步骤614处，认证节点接收到群组网关发送的第二接入请求后，获取第二接入请求中携带的第一MTC设备的身份标识UE 1，并发送第三认证请求至认证服务器。
其中，第三认证请求中携带有第一MTC设备的身份标识UE 1。
在步骤615处，认证服务器基于接收到的第三认证请求中携带 的第一MTC设备的身份标识UE 1，发送用于获取认证数据的请求消息至签约寄存器。
在步骤616处，签约寄存器基于请求消息中携带的第一MTC设备的身份标识UE 1，确定第一MTC设备所在的MTC设备用户群组信息，例如为(GID，UE GW，UE 1，UE 2，…，UE n)，并基于MTC设备用户群组信息中的所有MTC设备的身份标识UE 1，UE 2，…，UE n，获取与所有MTC设备对应的根密钥K 1，K 2，…，K n，基于根密钥K1，K2，…，Kn生成该MTC设备用户群组信息中所有MTC设备的认证向量，得到认证向量组AV i[RAND，AUTN，XRES，CK，IK]，i＝1，2，…，n。
在步骤617处，签约寄存器将得到的认证向量组AV i，i＝1，2，…，n发送至认证服务器，然后认证服务器发送认证向量组AV i，i＝1，2，…，n群组网关。
在步骤618处，群组网关接收认证向量组AV i，i＝1，2，…，n并保存。
在步骤619处，群组网关从认证向量组AV i，i＝1，2，…，n中查找与第一MTC设备UE 1对应的认证向量AV 1，并基于认证向量AV 1与第一MTC设备进行双向认证。
其中，群组网关基于认证向量AV 1与第一MTC设备进行双向认证的过程具体参照上述实施例中的步骤516至518的过程，此处不再详细赘述。
需说明的是，第一MTC设备与群组网关进行双向认证后，群组网关所管理的MTC设备中除第一MTC设备外的其他MTC设备接入网络需进行双向认证时，群组网关可以直接基于群组网关中存储的认证向量集合与其他MTC设备进行双向认证。
基于前述实施例，本公开实施例提供一种认证方法，主要用于MTC设备、群组网关和认证设备之间采用EAP-TLS协议进行认证，其中，认证设备为认证服务器和证书授权(Certificate Authority，CA)中心。图8为本公开另一实施例提供的又一种认证方法的流程示意图，参照图8，该方法可以包括以下步骤701至728。
在步骤701处，群组网关发送网络接入请求至认证服务器。
其中，网络接入请求中携带有群组网关的身份标识。
在一个示例中，CA中心预先存储有群组网关和群组网关所管理的MTC设备的数字证书，MTC设备和群组网关中预先存储有各自的数字证书。其中，各自对应的数字证书中携带有各自对应的认证向量。
在步骤702处，认证服务器接收网络接入请求，响应网络接入请求结合群组网关能力等策略确定采用EAP-TLS协议进行双向认证。
在步骤703处，认证服务器发送携带有认证服务器的数字证书的通知指令至群组网关。
其中，通知指令用于指示群组网关采用EAP-TLS认证方式进行认证。
在步骤704处，群组网关接收通知指令，并响应通知指令启用EAP-TLS认证方式。
在步骤705处，群组网关从CA中心获取认证服务器的数字证书，并验证从CA中心获取的认证服务器的数字证书与认证服务器发送的数字证书是否匹配，得到验证结果。
其中，若群组网关从CA中心获取的认证服务器的数字证书与认证服务器发送的数字证书匹配，验证结果为认证服务器通过验证，支持认证服务器为EAP-TLS认证服务器；若群组网关从CA中心获取的认证服务器的数字证书与认证服务器发送的数字证书不匹配，验证结果为认证服务器未通过验证，不支持认证服务器为EAP-TLS认证服务器。
在步骤706处，若验证结果为认证服务器通过验证，支持认证服务器为EAP-TLS认证服务器，群组网关发送验证结果和群组网关的数字证书至认证服务器。
若验证结果为认证服务器未通过验证，不支持认证服务器为EAP-TLS认证服务器，发送验证结果至认证服务器，认证服务器接收到验证结果后，不执行后续操作。
在步骤707处，认证服务器接收验证结果以及群组网关的数字证书。
在步骤708处，认证服务器发送用于请求群组网关的数字证书 的请求指令至CA中心。
在步骤709处，CA中心接收请求指令并响应，获取群组网关的数字证书并发送至认证服务器。
在步骤710处，认证服务器接收CA中心发送的群组网关的数字证书，并验证CA中心发送的群组网关的数字证书与群组网关发送的群组网关的数字证书是否匹配。
在步骤711处，若CA中心发送的群组网关的数字证书与群组网关发送的群组网关的数字证书匹配，认证服务器向群组网关发送用于指示群组网关作为代理认证服务器的认证成功响应消息。
其中，认证成功响应消息还用于表明群组网关通过认证。
在步骤712处，群组网关接收认证成功响应消息。
在一个示例中，群组网关接收到认证成功响应消息表明群组网关与认证设备通过双向认证。
在步骤713处，群组网关接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求。
在步骤714处，群组网关响应第一接入请求，结合第一MTC设备能力等策略确定采用EAP-TLS协议进行双向认证。
在步骤715处，群组网关发送携带有群组网关的数字证书的通知指令至第一MTC设备。
其中，通知指令用于指示第一MTC设备采用EAP-TLS认证方式进行认证。
在步骤716处，第一MTC设备接收携带有群组网关的数字证书的通知指令，并响应通知指令启用EAP-TLS认证方式。
在步骤717处，第一MTC设备从CA中心获取群组网关的数字证书，并验证从CA中心获取的群组网关的数字证书与群组网关发送的数字证书是否匹配，得到验证结果。
其中，若第一MTC设备从CA中心获取的群组网关的数字证书与群组网关器发送的数字证书匹配，验证结果为群组网关通过验证，支持群组网关为代理EAP-TLS认证服务器；若第一MTC设备从CA中心获取的群组网关的数字证书与群组网关发送的数字证书不匹配，验证 结果为群组网关未通过验证，不支持群组网关为代理EAP-TLS认证服务器。
在步骤718处，若验证结果为群组网关通过验证，支持群组网关为代理EAP-TLS认证服务器，第一MTC设备发送验证结果和第一MTC设备的数字证书至群组网关。
若验证结果为群组网关未通过验证，不支持认群组网关为代理EAP-TLS认证服务器，发送验证结果至群组网关，群组网关接收到验证结果后，不执行后续操作。
在步骤719处，群组网关接收验证结果以及第一MTC设备的数字证书。
在步骤720处，群组网关发送第一MTC设备的身份标识至CA中心。
在步骤721处，CA中心接收群组网关发送的第一MTC设备的身份标识。
在步骤722处，CA中心基于第一MTC设备的身份标识确定第一MTC设备的身份标识对应的组标识。
在步骤723处，CA中心基于组标识确定群组网关管理的每一MTC设备。
在步骤724处，CA中心获取每一MTC设备的身份标识，并基于每一MTC设备的身份标识获取每一MTC设备的数字证书，得到数字证书集合。
其中，由于每一MTC设备的数字证书中携带有每一MTC设备的认证向量，所以得到的数字证书集合即得到了群组网关所管理的MTC设备的认证向量组。
在步骤725处，CA中心将数字证书集合发送至群组网关。
在步骤726处，群组网关接收数字证书集合并存储。
在步骤727处，群组网关从存储的数字证书集合中获取第一MTC设备的数字证书。
在步骤728处，群组网关验证从数字证书集合中获取第一MTC设备的数字证书与第一MTC设备发送的第一MTC设备的数字证书是否 匹配，得到验证结果。
其中，若从数字证书集合中获取第一MTC设备的数字证书与第一MTC设备发送的第一MTC设备的数字证书匹配，表明第一MTC设备通过群组网关与认证设备(即认证服务器和CA中心)之间通过双向认证，后续通信过程是可信的。
在本公开其他实施例中，CA中心执行步骤709时，CA中心获取群组网关的数字证书的同时，还可以获取群组网关所管理的所有MTC设备的数字证书，得到数字证书集合，发送群组网关的数字证书至认证服务器的同时也发送数字证书集合至认证服务器，认证服务器将数字证书集合发送至群组网关，使群组网关存储数字证书；对应的，群组网关可以不执行步骤720和步骤726，CA中心可以不执行步骤723至725。或者，若CA中心发送的群组网关的数字证书与群组网关发送的群组网关的数字证书匹配，认证服务器向CA中心请求获取群组网关所管理的所有MTC设备的数字证书，得到数字证书集合，认证服务器执行步骤711的同时，将数字证书集合发送至群组网关，使群组网关存储数字证书；对应的，群组网关可以不执行步骤720和步骤726，CA中心可以不执行步骤723至725。
需要说明的是，本实施例中与其它实施例中相同步骤或者概念的解释，可以参照其它实施例中的描述，此处不再赘述。
本公开实施例所提供的认证方法，接收群组网关发送的携带有群组网关的身份标识的第三接入请求，并响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量，然后获取第三认证向量中的第一参数并发送至群组网关，接收群组网关发送的第二参数，并基于第二参数和第三认证向量对群组网关进行认证，若群组网关通过认证，获取认证向量组并发送至群组网关，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储，从存储的认证向量组中获取第一MTC设备的第一认证向量，并基于第一认证向量与第一MTC设备进行认证；这样，认证设备首先对群组网关进行认证，在群组网关认证通过后发送群组网关管理的所有MTC设备的认证向量组至群组网关，使群组网关基于认证向量对请求接入的第一MTC 设备进行认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
本公开实施例提供一种群组网关，可应用于图1、图3至图4、以及图6对应的实施例提供的认证方法中。图9为本公开实施例提供的一种群组网关的结构示意图。参照图9所示，该群组网关8包括：第一处理器81、第一存储器82及第一通信总线83。
第一通信总线83配置为实现第一处理器81和第一存储器82之间的连接通信。
第一处理器81配置为执行第一存储器82中存储的认证程序，以实现以下步骤：第一通信总线用于实现第一处理器和第一存储器之间的连接通信。
第一处理器81还配置为执行第一存储器82中存储的认证程序，以实现以下步骤：若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，认证向量组中包括群组网关管理的每一机器类通信MTC设备的认证向量；从存储的认证向量组中获取第一MTC设备的第一认证向量；其中，第一MTC设备由群组网关管理；基于第一认证向量与第一MTC设备进行认证。
在本公开其他实施例中，第一处理器81还配置为执行认证程序，以实现以下步骤：若群组网关请求接入网络并通过认证，接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求；响应第一接入请求，发送第一MTC设备的身份标识至认证设备；接收认证设备发送的认证向量组并存储；其中，认证向量组是认证设备基于第一MTC设备的身份标识得到的。
在本公开其他实施例中，接收第一MTC设备发送的第一参数，并基于第一参数和第一认证向量对第一MTC设备进行认证之后，第一处理器81还配置为执行认证程序，以实现以下步骤：接收第二MTC设备发送的携带有第二MTC设备的身份标识的第二接入请求；响应第二接入请求，基于第二MTC设备的身份标识从认证向量组中获取第二 MTC设备的第二认证向量；基于第二认证向量与第二MTC设备进行认证。
在本公开其他实施例中，第一处理器81还配置为执行认证程序，以实现以下步骤：接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求；响应第一接入请求，从认证向量组中获取与第一MTC设备的身份标识对应的认证向量，得到第一认证向量。
在本公开其他实施例中，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储之前，第一处理器81还配置为执行认证程序，以实现以下步骤：发送携带有群组网关的身份标识的第三接入请求至认证设备；其中，第三接入请求用于指示认证设备基于群组网关的身份标识获取群组网关的第一参数；接收认证设备发送的第一参数，并基于第一参数对认证设备进行认证；若认证设备通过认证，发送第二参数至认证设备；其中，第二参数用于认证设备对群组网关进行认证，若未接收到认证设备发送的用于指示群组网关认证失败的响应消息，默认群组网关通过认证。
在本公开其他实施例中，第一处理器81还配置为执行认证程序，以实现以下步骤：获取第一认证向量中的第三参数，并发送第三参数至第一MTC设备；其中，第三参数用于第一MTC设备对群组网关进行认证；接收第一MTC设备发送的第四参数，并基于第四参数和第一认证向量对第一MTC设备进行认证；其中，第四参数是第一MTC设备对群组网关的认证通过后基于第三参数生成的。
需要说明的是，本实施例中处理器所实现的步骤之间的交互过程，可以参照图1、图3至图4、以及图6对应的实施例及上述实施例提供的认证方法中的交互过程，此处不再赘述。
本公开实施例所提供的群组网关，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储，从认证向量组中获取第一MTC设备的第一认证向量，并基于第一认证向量与第一MTC设备进行认证。这样，在群组网关请求接入网络并通过认证后，群组网关接收认证设备发送的包括群组网关管理的所有MTC设备认证向量的认证向量组，在群组网关管理的第一MTC设备请求接入群组网关 时，基于认证设备发送的认证向量组中第一MTC设备的第一认证向量与第一MTC设备进行双向认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
本公开实施例提供一种认证设备，可应用于图2至图4、以及图6对应的实施例提供的认证方法中。图10为本公开实施例提供的一种认证设备的结构示意图。参照图10所示，该认证设备9包括：第二处理器91、第二存储器92及第二通信总线93。
第二通信总线93配置为实现第二处理器91和第二存储器92之间的连接通信。
第二处理器91配置为执行第二存储器92中存储的认证程序，以实现以下步骤：接收群组网关发送的携带有群组网关的身份标识的第三接入请求；响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量；获取第三认证向量中的第一参数并发送至群组网关；其中，第一参数用于群组网关对认证设备进行认证；接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证；若群组网关通过认证，获取认证向量组并发送至群组网关；其中，认证向量组包括群组网关管理的每一MTC设备的认证向量，认证向量组用于群组网关与由群组网关管理的每一MTC设备进行双向认证。
在本公开其他实施例中，第二处理器91还配置为执行认证程序，以实现以下步骤：若群组网关通过认证，接收群组网关发送的第一MTC设备的身份标识；其中，第一MTC设备是群组网关管理的每一MTC设备中第一个请求接入群组网关的MTC设备；基于第一MTC设备的身份标识确定第一MTC设备的身份标识对应的组标识；基于组标识确定群组网关管理的每一MTC设备；获取每一MTC设备的身份标识和每一MTC设备的密钥；基于每一MTC设备的密钥采用预设算法生成每一MTC设备的认证向量，得到认证向量组并发送至群组网关。
在本公开其他实施例中，第二处理器91还配置为执行认证程序， 以实现以下步骤：基于第三接入请求中携带的群组网关的身份标识确定群组网关对应的组标识；基于组标识确定群组网关管理的每一MTC设备；获取每一MTC设备的身份标识和每一MTC设备的密钥；基于每一MTC设备的密钥采用预设算法生成每一MTC设备的认证向量，得到认证向量组；若群组网关通过认证，发送认证向量组至群组网关。
需说明的是，本实施例中处理器所实现的步骤之间的交互过程，可以参照图2至图4、以及图6对应的实施例及上述实施例提供的认证方法中的交互过程，此处不再赘述。
本公开实施例所提供的认证设备，接收群组网关发送的携带有群组网关的身份标识的第三接入请求后，响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量，并获取第三认证向量中的第一参数并发送至群组网关，然后接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证，若群组网关通过认证，获取认证向量组并发送至群组网关。这样，认证设备对群组网关进行认证，并在群组网关的认证通过后将用于对MTC设备进行认证的、且包括群组网关所管理的所有MTC设备的认证向量的集合发送至群组网关，以便于群组网关基于认证设备发送的认证向量组对请求接入的第一MTC设备进行认证，解决了现有技术中由于群组网关的引入导致MTC设备与网络设备之间的信任关系较弱的问题，实现了通过群组网关使MTC设备与网络设备之间直接建立信任关系，提高了MTC设备与网络设备之间的通信安全。
基于前述实施例，本公开提供一种计算机可读存储介质，该计算机可读存储介质上存储有认证程序，所述认证程序可被一个或者多个处理器执行，以实现以下步骤：若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，认证向量组中包括群组网关管理的每一机器类通信MTC设备的认证向量；从存储的认证向量组中获取第一MTC设备的第一认证向量；其中，第一MTC设备由群组网关管理；基于第一认证向量与第一MTC设备进行认证。
在本公开其他实施例中，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储，包括以下步骤：若群组网关 请求接入网络并通过认证，接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求；响应第一接入请求，发送第一MTC设备的身份标识至认证设备；接收认证设备发送的认证向量组并存储；其中，认证向量组是认证设备基于第一MTC设备的身份标识得到的。
在本公开其他实施例中，接收第一MTC设备发送的第一参数，并基于第一参数和第一认证向量对第一MTC设备进行认证之后，包括以下步骤：接收第二MTC设备发送的携带有第二MTC设备的身份标识的第二接入请求；响应第二接入请求，基于第二MTC设备的身份标识从认证向量组中获取第二MTC设备的第二认证向量；基于第二认证向量与第二MTC设备进行认证。
在本公开其他实施例中，从存储的认证向量组中获取第一MTC设备的第一认证向量，包括以下步骤：接收第一MTC设备发送的携带有第一MTC设备的身份标识的第一接入请求；响应第一接入请求，从认证向量组中获取与第一MTC设备的身份标识对应的认证向量，得到第一认证向量。
在本公开其他实施例中，若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储之前，包括以下步骤：发送携带有群组网关的身份标识的第三接入请求至认证设备；其中，第三接入请求用于指示认证设备基于群组网关的身份标识获取群组网关的第一参数；接收认证设备发送的第一参数，并基于第一参数对认证设备进行认证；若认证设备通过认证，发送第二参数至认证设备；其中，第二参数用于认证设备对群组网关进行认证，若未接收到认证设备发送的用于指示群组网关认证失败的响应消息，默认群组网关通过认证。
在本公开其他实施例中，基于第一认证向量与第一MTC设备进行认证，包括以下步骤：获取第一认证向量中的第三参数，并发送第三参数至第一MTC设备；其中，第三参数用于第一MTC设备对群组网关进行认证；接收第一MTC设备发送的第四参数，并基于第四参数和第一认证向量对第一MTC设备进行认证；其中，第四参数是第一MTC设备对群组网关的认证通过后基于第三参数生成的。
需要说明的是，本实施例中处理器所实现的步骤之间的交互过 程，可以参照图1、图3至图4、以及图6对应的实施例及上述实施例提供的认证方法中的交互过程，此处不再赘述。
基于前述实施例，本公开提供一种计算机可读存储介质，该计算机可读存储介质上存储有认证程序，所述认证程序可被一个或者多个处理器执行，以实现以下步骤：接收群组网关发送的携带有群组网关的身份标识的第三接入请求；响应第三接入请求，基于群组网关的身份标识获取群组网关的第三认证向量；获取第三认证向量中的第一参数并发送至群组网关；其中，第一参数用于群组网关对认证设备进行认证；接收群组网关发送的第二参数，基于第二参数和第三认证向量对群组网关进行认证；若群组网关通过认证，获取认证向量组并发送至群组网关；其中，认证向量组包括群组网关管理的每一MTC设备的认证向量，认证向量组用于群组网关与由群组网关管理的第一MTC设备进行双向认证。
在本公开其他实施例中，若群组网关通过认证，获取认证向量组并发送至群组网关，还包括以下步骤：若群组网关通过认证，接收群组网关发送的第一MTC设备的身份标识；其中，第一MTC设备是群组网关管理的每一MTC设备中第一个请求接入群组网关的MTC设备；基于第一MTC设备的身份标识确定第一MTC设备的身份标识对应的组标识；基于组标识确定群组网关管理的每一MTC设备；获取每一MTC设备的身份标识和每一MTC设备的密钥；基于每一MTC设备的密钥采用预设算法生成每一MTC设备的认证向量，得到认证向量组并发送至群组网关。
在本公开其他实施例中，若群组网关通过认证，获取认证向量组并发送至群组网关，包括以下步骤：基于第三接入请求中携带的群组网关的身份标识确定群组网关对应的组标识；基于组标识确定群组网关管理的每一MTC设备；获取每一MTC设备的身份标识和每一MTC设备的密钥；基于每一MTC设备的密钥采用预设算法生成每一MTC设备的认证向量，得到认证向量组；若群组网关通过认证，发送认证向量组至群组网关。
需要说明的是，本实施例中处理器所实现的步骤之间的交互过程，可以参照图2至图4、以及图6对应的实施例及上述实施例提供的认证方法中的交互过程，此处不再赘述。
本领域内的技术人员应明白，本公开的实施例可提供为方法、系统、或计算机程序产品。因此，本公开可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本公开是参照根据本公开实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序消息实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序消息到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的消息产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序消息也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的消息产生包括消息装置的制造品，该消息装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序消息也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的消息提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述，仅为本公开的示例性实施例而已，并非用于限定本公开的保护范围。

Claims (19)

  1. 一种认证方法，包括：
    若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，所述认证向量组中包括所述群组网关管理的每一机器类通信(MTC)设备的认证向量；
    从存储的所述认证向量组中获取第一MTC设备的第一认证向量；其中，所述第一MTC设备由所述群组网关管理；
    基于所述第一认证向量与所述第一MTC设备进行认证。
  2. 根据权利要求1所述的方法，其中，所述若群组网关请求接入网络并通过认证，接收所述认证设备发送的所述认证向量组并存储，包括：
    若所述群组网关请求接入网络并通过认证，接收所述第一MTC设备发送的携带有所述第一MTC设备的身份标识的第一接入请求；其中，所述第一MTC设备是所述群组网关管理的MTC设备中第一个请求接入所述群组网关的MTC设备；
    响应所述第一接入请求，发送所述第一MTC设备的身份标识至所述认证设备；
    接收所述认证设备发送的所述认证向量组并存储；其中，所述认证向量组是所述认证设备基于所述第一MTC设备的身份标识得到的。
  3. 基于权利要求2所述的方法，其中，基于所述第一认证向量对所述第一MTC设备进行认证之后，包括：
    接收第二MTC设备发送的携带有所述第二MTC设备的身份标识的第二接入请求；
    响应所述第二接入请求，基于所述第二MTC设备的身份标识从所述认证向量组中获取所述第二MTC设备的第二认证向量；
    基于所述第二认证向量与所述第二MTC设备进行认证。
  4. 根据权利要求1所述的方法，其中，所述从存储的所述认证向量组中获取第一MTC设备的第一认证向量，包括：
    接收所述第一MTC设备发送的携带有所述第一MTC设备的身份标识的第一接入请求；其中，所述第一MTC设备是所述群组网关管理的MTC设备中的任意一个MTC设备；
    响应所述第一接入请求，从所述认证向量组中获取与所述第一MTC设备的身份标识对应的认证向量，得到所述第一认证向量。
  5. 根据权利要求1至4中任一所述的方法，其中，所述若群组网关请求接入网络并通过认证，接收所述认证设备发送的认证向量组并存储之前，包括：
    发送携带有所述群组网关的身份标识的第三接入请求至所述认证设备；其中，所述第三接入请求用于指示所述认证设备基于所述群组网关的身份标识获取所述群组网关的第一参数；
    接收所述认证设备发送的所述第一参数，并基于所述第一参数对所述认证设备进行认证；
    若所述认证设备通过认证，获取第二参数并发送至所述认证设备；其中，所述第二参数用于所述认证设备对所述群组网关进行认证；
    若未接收到所述认证设备发送的用于指示所述群组网关认证失败的响应消息，默认所述群组网关通过认证。
  6. 根据权利要求1所述的方法，其中，所述基于所述第一认证向量与所述第一MTC设备进行认证，包括：
    获取所述第一认证向量中的第三参数，并发送所述第三参数至所述第一MTC设备；其中，所述第三参数用于所述第一MTC设备对所述群组网关进行认证；
    接收所述第一MTC设备发送的第四参数，并基于所述第四参数和所述第一认证向量对所述第一MTC设备进行认证；其中，所述第四参数是所述第一MTC设备对所述群组网关的认证通过后基于所述第三参数生成的。
  7. 一种认证方法，包括：
    接收群组网关发送的携带有所述群组网关的身份标识的第三接入请求；
    响应所述第三接入请求，基于所述群组网关的身份标识获取所述群组网关的第三认证向量；
    获取所述第三认证向量中的第一参数并发送至所述群组网关；其中，所述第一参数用于所述群组网关对所述认证设备进行认证；
    接收所述群组网关发送的第二参数，基于所述第二参数和所述第三认证向量对所述群组网关进行认证；
    若所述群组网关通过认证，获取认证向量组并发送至所述群组网关；其中，所述认证向量组包括所述群组网关管理的每一机器类通信(MTC)设备的认证向量，所述认证向量组用于所述群组网关与由所述群组网关管理的每一MTC设备进行双向认证。
  8. 根据权利要求7所述的方法，其中，所述若所述群组网关通过认证，获取认证向量组并发送至所述群组网关，包括：
    若所述群组网关通过认证，接收所述群组网关发送的第一MTC设备的身份标识；其中，所述第一MTC设备是所述群组网关管理的每一MTC设备中第一个请求接入所述群组网关的MTC设备；
    基于所述第一MTC设备的身份标识确定所述第一MTC设备的身份标识对应的组标识；
    基于所述组标识确定所述群组网关管理的每一MTC设备；
    获取每一所述MTC设备的身份标识和每一所述MTC设备的密钥；
    基于每一所述MTC设备的密钥采用预设算法生成每一所述MTC设备的认证向量，得到所述认证向量组并发送至所述群组网关。
  9. 根据权利要求7所述的方法，其中，所述若所述群组网关通过认证，获取认证向量组并发送至所述群组网关，还包括：
    基于所述第三接入请求中携带的所述群组网关的身份标识确定所述群组网关对应的组标识；
    基于所述组标识确定所述群组网关管理的每一MTC设备；
    获取每一所述MTC设备的身份标识和每一所述MTC设备的密钥；
    基于每一所述MTC设备的密钥采用预设算法生成每一所述MTC设备的认证向量，得到所述认证向量组；
    若所述群组网关通过认证，发送所述认证向量组至所述群组网关。
  10. 一种群组网关，包括：第一处理器、第一存储器及第一通信总线；
    所述第一通信总线配置为实现所述第一处理器和所述第一存储器之间的连接通信；
    所述第一处理器配置为执行所述第一存储器中存储的认证程序，以实现以下步骤：
    若群组网关请求接入网络并通过认证，接收认证设备发送的认证向量组并存储；其中，所述认证向量组中包括所述群组网关管理的每一机器类通信(MTC)设备的认证向量；
    从存储的所述认证向量组中获取第一MTC设备的第一认证向量；其中，所述第一MTC设备由所述群组网关管理；
    基于所述第一认证向量与所述第一MTC设备进行认证。
  11. 根据权利要求10所述的群组网关，其中，所述第一处理器还配置为执行所述认证程序，以实现以下步骤：
    若所述群组网关请求接入网络并通过认证，接收所述第一MTC设备发送的携带有所述第一MTC设备的身份标识的第一接入请求；其中，所述第一MTC设备是所述群组网关管理的MTC设备中第一个请求接入所述群组网关的MTC设备；
    响应所述第一接入请求，发送所述第一MTC设备的身份标识至所述认证设备；
    接收所述认证设备发送的所述认证向量组并存储；其中，所述认证向量组是所述认证设备基于所述第一MTC设备的身份标识得到 的。
  12. 根据权利要求11所述的群组网关，其中，所述接收所述第一MTC设备发送的第一参数，并基于所述第一参数和所述第一认证向量对所述第一MTC设备进行认证之后，所述第一处理器还配置为执行所述认证程序，以实现以下步骤：
    接收第二MTC设备发送的携带有所述第二MTC设备的身份标识的第二接入请求；
    响应所述第二接入请求，基于所述第二MTC设备的身份标识从所述认证向量组中获取所述第二MTC设备的第二认证向量；
    基于所述第二认证向量与所述第二MTC设备进行认证。
  13. 根据权利要求10所述的群组网关，其中，所述第一处理器还配置为执行所述认证程序，以实现以下步骤：
    接收所述第一MTC设备发送的携带有所述第一MTC设备的身份标识的第一接入请求；其中，所述第一MTC设备是所述群组网关管理的MTC设备中的任意一个MTC设备；
    响应所述第一接入请求，从所述认证向量组中获取与所述第一MTC设备的身份标识对应的认证向量，得到所述第一认证向量。
  14. 根据权利要求10至13中任一所述的群组网关，其中，所述若群组网关请求接入网络并通过认证，接收所述认证设备发送的认证向量组并存储之前，所述第一处理器还配置为执行所述认证程序，以实现以下步骤：
    发送携带有所述群组网关的身份标识的第三接入请求至所述认证设备；其中，所述第三接入请求用于指示所述认证设备基于所述群组网关的身份标识获取所述群组网关的第一参数；
    接收所述认证设备发送的所述第一参数，并基于所述第一参数对所述认证设备进行认证；
    若所述认证设备通过认证，发送第二参数至所述认证设备；其 中，所述第二参数用于所述认证设备对所述群组网关进行认证；
    若未接收到所述认证设备发送的用于指示所述群组网关认证失败的响应消息，默认所述群组网关通过认证。
  15. 根据权利要求10所述的群组网关，其中，所述第一处理器还配置为执行所述认证程序，以实现以下步骤：
    获取所述第一认证向量中的第三参数，并发送所述第三参数至所述第一MTC设备；其中，所述第三参数用于所述第一MTC设备对所述群组网关进行认证；
    接收所述第一MTC设备发送的第四参数，并基于所述第四参数和所述第一认证向量对所述第一MTC设备进行认证；其中，所述第四参数所述群组网关通过所述第一MTC设备的认证后基于所述第三参数生成得到的。
  16. 一种认证设备，包括：第二处理器、第二存储器及第二通信总线；
    所述第二通信总线配置为实现所述第二处理器和所述第二存储器之间的连接通信；
    所述第二处理器配置为执行所述第二存储器中存储的认证程序，以实现以下步骤：
    接收群组网关发送的携带有所述群组网关的身份标识的第三接入请求；
    响应所述第三接入请求，基于所述群组网关的身份标识获取所述群组网关的第三认证向量；
    获取所述第三认证向量中的第一参数并发送至所述群组网关；其中，所述第一参数用于所述群组网关对所述认证设备进行认证；
    接收所述群组网关发送的第二参数，基于所述第二参数和所述第三认证向量对所述群组网关进行认证；
    若所述群组网关通过认证，获取认证向量组并发送至所述群组网关；其中，所述认证向量组包括所述群组网关管理的每一机器类通 信(MTC)设备的认证向量，所述认证向量组用于所述群组网关与由所述群组网关管理的每一MTC设备进行双向认证。
  17. 根据权利要求16所述的认证设备，其中，所述第二处理器还配置为执行认证程序，以实现以下步骤：
    若所述群组网关通过认证，接收所述群组网关发送的第一MTC设备的身份标识；其中，所述第一MTC设备是所述群组网关管理的每一MTC设备中第一个请求接入所述群组网关的MTC设备；
    基于所述第一MTC设备的身份标识确定所述第一MTC设备的身份标识对应的组标识；
    基于所述组标识确定所述群组网关管理的每一MTC设备；
    获取每一所述MTC设备的身份标识和每一所述MTC设备的密钥；
    基于每一所述MTC设备的密钥采用预设算法生成每一所述MTC设备的认证向量，得到所述认证向量组并发送至所述群组网关。
  18. 根据权利要求16所述的认证设备，其中，所述第二处理器还配置为执行认证程序，以实现以下步骤：
    基于所述第三接入请求中携带的所述群组网关的身份标识确定所述群组网关对应的组标识；
    基于所述组标识确定所述群组网关管理的每一MTC设备；
    获取每一MTC设备的身份标识和每一所述MTC设备的密钥；
    基于每一所述MTC设备的密钥采用预设算法生成每一所述MTC设备的认证向量，得到所述认证向量组；
    若所述群组网关通过认证，发送所述认证向量组至所述群组网关。
  19. 一种计算机可读存储介质，所述计算机可读存储介质上存储有认证程序，所述认证程序被处理器执行时实现如权利要求1至9中任一项所述的认证方法的步骤。
PCT/CN2019/081746 2018-04-09 2019-04-08 认证方法、设备和计算机可读存储介质 WO2019196794A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810312169.9A CN110366179A (zh) 2018-04-09 2018-04-09 一种认证方法、设备和计算机可读存储介质
CN201810312169.9 2018-04-09

Publications (1)

Publication Number Publication Date
WO2019196794A1 true WO2019196794A1 (zh) 2019-10-17

Family

ID=68162795

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/081746 WO2019196794A1 (zh) 2018-04-09 2019-04-08 认证方法、设备和计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN110366179A (zh)
WO (1) WO2019196794A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114079566A (zh) * 2020-08-05 2022-02-22 阿里巴巴集团控股有限公司 物联网设备认证方法、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102204306A (zh) * 2011-04-28 2011-09-28 华为技术有限公司 Mtc终端通过网关与网络通信的方法、设备及系统
US20110307694A1 (en) * 2010-06-10 2011-12-15 Ioannis Broustis Secure Registration of Group of Clients Using Single Registration Procedure
CN102480727A (zh) * 2010-11-30 2012-05-30 中兴通讯股份有限公司 机器与机器通信中的组认证方法及系统
US20120297193A1 (en) * 2010-01-29 2012-11-22 Huawei Technologies Co., Ltd. Mtc device authentication method, mtc gateway, and related device
CN102843233A (zh) * 2011-06-21 2012-12-26 中兴通讯股份有限公司 一种机器到机器通信中组认证的方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120297193A1 (en) * 2010-01-29 2012-11-22 Huawei Technologies Co., Ltd. Mtc device authentication method, mtc gateway, and related device
US20110307694A1 (en) * 2010-06-10 2011-12-15 Ioannis Broustis Secure Registration of Group of Clients Using Single Registration Procedure
CN102480727A (zh) * 2010-11-30 2012-05-30 中兴通讯股份有限公司 机器与机器通信中的组认证方法及系统
CN102204306A (zh) * 2011-04-28 2011-09-28 华为技术有限公司 Mtc终端通过网关与网络通信的方法、设备及系统
CN102843233A (zh) * 2011-06-21 2012-12-26 中兴通讯股份有限公司 一种机器到机器通信中组认证的方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, ET AL.: "Key issue-MTC group based communication via MTC GW", 3GPP TSG-SA3 (SECURITY) S3-110075, 28 January 2011 (2011-01-28), XP050526360 *

Also Published As

Publication number Publication date
CN110366179A (zh) 2019-10-22

Similar Documents

Publication Publication Date Title
JP6732095B2 (ja) 異種ネットワークのための統一認証
US11026084B2 (en) Mobile network authentication method, terminal device, server, and network authentication entity
US11228442B2 (en) Authentication method, authentication apparatus, and authentication system
US11496320B2 (en) Registration method and apparatus based on service-based architecture
US20230007475A1 (en) Method for Performing Verification by Using Shared Key, Method for Performing Verification by Using Public Key and Private Key, and Apparatus
JP7324765B2 (ja) 認証された装置から装置への通信のための動的ドメイン鍵交換
KR101038064B1 (ko) 애플리케이션 인증
US7707412B2 (en) Linked authentication protocols
JP6189953B2 (ja) 無線ユニットのユーザを認証するための方法およびシステム
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
WO2019041802A1 (zh) 基于服务化架构的发现方法及装置
WO2020093864A1 (zh) 一种密钥协商的方法、相关装置及系统
WO2010012203A1 (zh) 鉴权方法、重认证方法和通信装置
US20110035592A1 (en) Authentication method selection using a home enhanced node b profile
CN112105021B (zh) 一种认证方法、装置及系统
WO2019095990A1 (zh) 一种通信方法及装置
US20150381611A1 (en) Method and network node for obtaining a permanent identity of an authenticating wireless device
BR112021003460A2 (pt) dispositivo sem identidade de assinante, dispositivo de identidade do assinante, método para uso em um dispositivo sem identidade de assinante, método para uso em um dispositivo com identidade de assinante e produto de programa de computador
BR112021003448A2 (pt) dispositivo sem identidade de assinante, dispositivo de identidade do assinante, método para uso em um dispositivo sem identidade de assinante, método para uso em um dispositivo com identidade de assinante e produto de programa de computador transferível por download
US20230396602A1 (en) Service authorization method and system, and communication apparatus
WO2019196794A1 (zh) 认证方法、设备和计算机可读存储介质
JP6609212B2 (ja) 暗号化通信チャネル確立システム、方法、プログラム及びコンピュータ読取り可能なプログラム記録媒体
TW202245442A (zh) 一種通訊方法及裝置
CN117749389A (zh) 用于获取证书的方法、装置、设备及存储介质
CN116438822A (zh) 应用于WiFi的安全认证的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19785062

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 04/02/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19785062

Country of ref document: EP

Kind code of ref document: A1