WO2020037957A1 - 客户端注册方法、装置及系统 - Google Patents

客户端注册方法、装置及系统 Download PDF

Info

Publication number
WO2020037957A1
WO2020037957A1 PCT/CN2019/074724 CN2019074724W WO2020037957A1 WO 2020037957 A1 WO2020037957 A1 WO 2020037957A1 CN 2019074724 W CN2019074724 W CN 2019074724W WO 2020037957 A1 WO2020037957 A1 WO 2020037957A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
authentication
user
registration server
user terminal
Prior art date
Application number
PCT/CN2019/074724
Other languages
English (en)
French (fr)
Inventor
刘高峰
Original Assignee
刘高峰
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201810969927.4A external-priority patent/CN109041205A/zh
Application filed by 刘高峰 filed Critical 刘高峰
Priority to CN201910775079.8A priority Critical patent/CN110858968A/zh
Priority to CN201910774037.2A priority patent/CN111050314B/zh
Priority to CN201910777127.7A priority patent/CN110858969A/zh
Publication of WO2020037957A1 publication Critical patent/WO2020037957A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Definitions

  • the present invention relates to the field of communication technology and Internet technology, and in particular, to a client registration method, device, and system.
  • USB Universal Subscriber Identity Module
  • ISIM IP Multimedia Services Identity Module
  • eSIM essentially transfers user data and encrypted information on the SIM card from the original SIM card stored on the physical SIM card to another hardware carrier of the user terminal device itself; soft SIM is replaced by pure software
  • the physical SIM card implements the functions of the SIM and also stores user data and key information securely.
  • the SIM card stores the user identification and key information of the contracted user.
  • the above modules that store the identity and key information of the mobile communication network contracted user are collectively referred to as " Subscriber Identity Module SIM ".
  • the home subscriber server HSS home subscriber server, home user server
  • unified data management unified data management (UDM) is a user data system of the mobile communication network, which stores the mobile user identification and key information corresponding to the user identification module SIM.
  • the main object of the present invention is to provide a method, device and system for client registration, which aims to provide a method, device and system for third-party application clients running in user terminals to securely and automatically obtain registration information. It can automatically obtain registration information including user ID, user key, user token, etc. for third-party application clients, thereby solving existing third-party application clients in registering accounts, negotiating shared keys, and obtaining user tokens. , User identity authentication and other processes that are cumbersome to use and affect the user ’s experience.
  • the present invention provides the following technical solutions:
  • a client registration method is provided, which is applied to a user terminal running a third-party application client.
  • the method includes:
  • the mobile user identification is an identification of the user identification module SIM;
  • the performing authentication and key negotiation with the registration server based on the user identification module SIM includes:
  • the registration server Receiving an authentication and key agreement challenge message sent by the registration server, where the authentication and key agreement challenge message includes a random number RAND and an authentication token AUTN;
  • the authentication and key agreement challenge response message including a first expected response value, the first expected response value being generated based on the expected response value RES;
  • the authentication and key negotiation success response message includes the security token, and the security token is obtained from the authentication and key negotiation success response message; or / and,
  • the authentication and key negotiation with the registration server based on the user identification module SIM is based on 3G / 4G AKA mechanism, then:
  • the user identification module SIM is a global user identification module USIM, and the mobile user identification is an international mobile user identification code IMSI; or the user identification module SIM is an IP multimedia service identification module ISIM, and the mobile user identification is IP multimedia Private identification IMPI;
  • the first expected response value is the expected response value RES; or the first expected response value is a hash value generated by hashing the expected response value RES.
  • the authentication and key negotiation with the registration server based on the user identification module SIM is based on 5G AKA mechanism, then:
  • the subscriber identification module SIM is a global subscriber identification module USIM, and the mobile subscriber identity is a subscriber permanent identity SUPI;
  • the generating the first root key based on the first encryption key CK or / and the first integrity key IK includes: based on the first encryption key CK or / and the first integrity key
  • the sexual key IK generates a first key KAUSF, and generates the first root key based on the first key KAUSF;
  • the first expected response value is an expected response value RES *, and the expected response value RES * is generated based on the expected response value RES; or the first expected response value is a response to the expected response value RES *
  • the sending an authentication and key agreement request to the registration server includes:
  • the user hidden identifier SUCI is used as the mobile user identifier.
  • the performing security authentication with the registration server based on the first security parameter includes:
  • the registration server verifies that the security token is valid, it is determined that the security authentication is successful.
  • the performing security authentication with the registration server based on the first security parameter includes:
  • the registration server verifies that the first encrypted value is valid, it is determined that the security authentication is successful.
  • the receiving registration information and services provided by the registration server includes:
  • the transmitting the third-party application identifier to the registration server includes:
  • the security authentication request sent to the registration server further includes the third-party application identifier; or
  • the information that generates the first verification information further includes the first The three-party application identifier, so that the registration server obtains the third-party application identifier from the plaintext after decrypting the first encrypted value.
  • the first security parameter includes the first root key
  • a third-party user identifier sent by the registration server is received, after receiving the registration information and services provided by the registration server, ,Also includes:
  • a first user key is generated based on the first root key.
  • the first user key is generated in a manner consistent with the second server key generation method generated by the registration server. And serving as a key identified by the third-party user in the third-party application client.
  • the method further includes:
  • a client registration method which is applied to a registration server, the method includes:
  • the second security parameter includes a security token (1) or / and a second root key (1)
  • the mobile user identifier (1) is sent by the user terminal (1);
  • the user terminal (2) After the security authentication is successful, the user terminal (2) is provided with registration information and services.
  • the performing authentication and key negotiation based on a user data system includes:
  • the authentication response message includes a random number RAND, an authentication token AUTN, an initial key, and a second expected response value
  • the authentication and key agreement challenge message includes the random number RAND and the authentication token AUTN;
  • the second security parameter includes a security token (1) or / and a second root key (1), and specifically includes:
  • the second root key (1) is generated based on the initial key, and a generation manner of the second root key (1) is consistent with a generation manner in which the user terminal generates the first root key.
  • the verifying the first expected response value based on the second expected response value includes:
  • the first expected response value is plain text, comparing whether the second expected response value is consistent with the first expected response value, and if they are consistent, determining that the first expected response value is valid; or,
  • the first expected response value is a hash value after hash calculation
  • the second expected response value is calculated using the same hash calculation method to generate a hash value, and whether the two hash values are consistent, and if they are consistent, It is determined that the first expected response value is valid.
  • the generating the security token (1) includes:
  • the information including the mobile user identification (1) is encrypted based on a preset key using a symmetric encryption algorithm, and the encrypted cipher text is used as the security token (1).
  • the authentication and key negotiation between the user data system and the user terminal are based on the 3G / 4G AKA mechanism, then:
  • the mobile user identifier (1) is an international mobile user identifier IMSI or an IP multimedia private identifier IMPI;
  • the user data system is a home user server HSS:
  • the authentication response message includes the random number RAND, the authentication token AUTN, a second encryption key CK or / and a second integrity key IK, and an expected response value XRES;
  • the initial key is the second encryption key CK or / and the second integrity key IK;
  • the second expected response value is the expected response value XRES;
  • the first expected response value included in the authentication and key agreement challenge response message is the expected response value RES; or, the first expected response value included in the authentication and key agreement challenge response message is to the expected response
  • the authentication and key negotiation between the user data system and the user terminal are based on the 5G AKA mechanism, then:
  • the mobile user identity (1) is a user permanent identity SUPI or a user hidden identity SUCI;
  • the user data system is a unified data management UDM
  • the authentication response message includes the random number RAND, the authentication token AUTN, a second key KAUSF, and an expected response value XRES;
  • the authentication response message further includes a user permanent identification SUPI obtained by decrypting the user hidden identification SUCI, and the decrypted user permanent identification SUPI is used as the mobile user identity (1);
  • the initial key is the second key KAUSF;
  • the second expected response value is the expected response value XRES *;
  • the first expected response value included in the authentication and key agreement challenge response message is the expected response value RES *; or the first expected response value included in the authentication and key agreement challenge response message is the expected value.
  • Response value RES * hash value generated after hash calculation.
  • the performing the security authentication based on the corresponding relationship includes:
  • the security token (2) is verified to be valid and a mobile user identity (2) corresponding to the user terminal (2) is obtained, it is determined that the security authentication is successful.
  • the performing security authentication with the registration server based on the second security parameter includes:
  • the providing registration information and services to the user terminal (2) includes:
  • the user service is included in the sum service, so that the user token is used for authentication and access to the corresponding third-party application server in the third-party application client corresponding to the third-party application identifier.
  • the obtaining a third-party user identifier corresponding to the third-party application identifier includes:
  • a unique third-party user identifier is created, and the mobile user identifier (2) and the third-party application identifier and the created third-party user identifier are created and stored.
  • the correspondence relationship is such that the created third-party user identifier can be found according to the mobile user identifier and the third-party application identifier, and it is determined that the third-party user identifier is the created third-party user identifier.
  • the method further includes:
  • Generating a second user key based on the second root key (2), and the generation method of the second user key is consistent with the generation method of generating the first user key by the user terminal;
  • the method further includes:
  • the application authorization request message includes a third-party application name or / and a mobile user name
  • the third-party application name is obtained according to the third-party application identifier
  • the mobile user The name is obtained according to the mobile user identity
  • the application authorization response message is an application authorization confirmation message, performing the step of providing registration information and services to the user terminal (2).
  • a client registration device which is characterized in that the client registration device is applied to a user terminal running a third-party application client and includes: a memory and a processor, where the processor is configured to run all The program stored in the memory is executed when the program is executed, and the method includes any one of the methods described above and applied to a user terminal running a third-party application client.
  • a client registration device is provided, characterized in that the client registration device is applied to a registration server and includes: a memory and a processor, the processor is configured to run a program stored in the memory, and the program is executed when the program is run. Including the method described in any one of the above applied to the registration server.
  • a client registration system which is characterized in that the client registration system includes: a user terminal and a registration server; the user terminal includes the above-mentioned client registration device applied to a user terminal running a third-party application client;
  • the registration server includes the above-mentioned client registration device applied to the registration server.
  • a storage medium is provided, characterized in that a program is stored in the storage medium, and the program is configured to implement any one of the methods described above in a user terminal running on a third-party application client.
  • a storage medium is provided, characterized in that a program is stored in the storage medium, and the program is configured to implement the method including any one of the foregoing applied to a registration server.
  • the invention realizes the provision of a secure registration environment for a third-party application client running in a user terminal, and can further automatically obtain registration information including a user ID, a user key, or a user token for the third-party application client. , Thereby solving the technical problems of existing third-party application clients in the process of registering accounts, negotiating shared keys, obtaining user tokens, user identity authentication, etc., which are cumbersome and affect the user experience. The entire process does not require user input or only A small amount of input information improves the user experience.
  • FIG. 1 is a schematic structural diagram of an implementation environment provided by an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an embodiment of a client registration method according to the present invention.
  • FIG. 3 is a schematic flowchart of a first embodiment of a client security authentication process according to the present invention.
  • Embodiment 4 is a schematic flowchart of Embodiment 2 of a client security authentication process provided by the present invention
  • Embodiment 1 of a client registration information providing process provided by the present invention
  • Embodiment 6 is a schematic flowchart of Embodiment 2 of a client registration information providing process provided by the present invention.
  • FIG. 7 is a schematic flowchart of Embodiment 3 of a client registration information providing process provided by the present invention.
  • Embodiment 8 is a schematic flowchart of Embodiment 1 of an authentication and key negotiation process provided by the present invention.
  • FIG. 9 is a schematic flowchart of a second embodiment of an authentication and key negotiation process provided by the present invention.
  • Mobile subscriber identity The identity used to uniquely identify the subscriber identity module SIM.
  • the mobile subscriber identity includes: international mobile subscriber identity (international mobile subscriber identification number (IMSI), or IP multimedia private identification (IP multimedia private identity (IMPI), or permanent user identity (5G subscription permanent identifier (SUPI), or the user's hidden identifier (SUbscription) after the user's permanent identifier SUPI is encrypted concealed identifier (SUCI).
  • IMSI international mobile subscriber identification number
  • IMPI IP multimedia private identification
  • SUPI permanent user identity
  • SUbscription the user's hidden identifier
  • SUPI encrypted concealed identifier
  • Third-party application identifier is used to uniquely identify a third-party application client and to identify a third-party application server corresponding to the third-party application client.
  • Signature encryption algorithm refers to the encryption algorithm used to verify the authenticity of the information. Only a sender of the information can generate a string of numbers that cannot be forged by others. This digital string is also one of the authenticity of the information sent by the sender of the information.
  • Valid proofs such as message authentication codes (such as hash-based message authentication code HMAC, cipher block chain message authentication code CBC-MAC, Galois message authentication code GMAC, etc.), hash functions with key encryption, RSA-based Digital schemes (such as RSA-PSS), digital signature algorithms (DSA), and elliptic curve digital signature algorithms.
  • Symmetric encryption algorithm refers to an encryption algorithm that uses the same key for encryption and decryption, such as the Triple Data Encryption Standard (Triple Data Encryption Standard (DES), Advanced Encryption Standard (AES), etc.
  • Triple Data Encryption Standard Triple Data Encryption Standard (DES), Advanced Encryption Standard (AES), etc.
  • DES Triple Data Encryption Standard
  • AES Advanced Encryption Standard
  • Authentication and key agreement mechanism English abbreviation AKA (authentication and key agreement (AKA), based on the challenge response mechanism, completes the identity authentication between the end user and the mobile communication network, and negotiates the communication encryption key based on the identity authentication.
  • AKA authentication and key agreement
  • 5G AKA 5G AKA
  • the authentication and key agreement mechanism used for the 3G / 4G mobile communication network is referred to as 3G / 4G AKA
  • the authentication and key agreement mechanism used for the 5G mobile communication network is referred to as 5G AKA
  • authentication and key agreement mechanisms include 3G / 4G AKA and 5G AKA.
  • User data system a system for storing mobile user identification, mobile user key (K), AKA-related algorithms, and authenticating end users in mobile communication networks, including home subscriber server (HSS) And unified data management management (UDM).
  • K mobile user key
  • AKA-related algorithms a system for storing mobile user identification, mobile user key (K), AKA-related algorithms, and authenticating end users in mobile communication networks, including home subscriber server (HSS) And unified data management management (UDM).
  • HSS home subscriber server
  • UDM unified data management management
  • User identification module SIM It is used to store applications including mobile user identification, mobile user key (K), home network, AKA related algorithms, etc. for end users.
  • the end user implements identity authentication to the mobile communication network based on the user identification module SIM.
  • SIM includes a global subscriber identity module (universal subscriber identity module, USIM) and IP Multimedia Services Identification Module (IP multimedia services identity module (ISIM).
  • USIM universal subscriber identity module
  • ISIM IP Multimedia Services Identification Module
  • Token The credentials used to secure authentication or access to a protected resource, usually a string. Based on the difference that tokens can be used for security authentication or access to protected resources, in the embodiments of the present invention, tokens are divided into security tokens, user tokens, and the like.
  • FIG. 1 is a schematic structural diagram of an implementation environment involved in a client registration method according to an embodiment of the present invention.
  • the implementation environment includes a registration server, a user terminal, and a third-party application client.
  • Registration server Connected to the user terminal through the network, used to receive and execute the user terminal's authentication and key agreement requests, and receive and execute the client registration request of the user terminal; connected to the user data system through the network, used to send user data
  • the system sends a mobile user authentication request and a request result.
  • the user data system includes a home user server (home subscriber server (HSS) or / and unified data management (unified data management (UDM).
  • HSS home subscriber server
  • UDM unified data management
  • the registration server is usually provided by a communication operator.
  • the user terminal accesses the network through wired or wireless methods such as WLAN (including wifi), mobile data, LAN, and fixed broadband, and performs data connection with the registration server.
  • the user terminal is a smart terminal device that can be inserted, embedded or externally connected with a user identification module SIM and supports reading the user identification module SIM. It is usually a smart phone, but also a smart TV, set-top box, tablet computer, portable computer, desktop Computer, smart watch, etc.
  • Third-party application client An application running in the operating system of a user terminal, provided by a third-party application service provider.
  • each user terminal may run multiple third-party application clients provided by different third-party application service providers, and each third-party The application client can connect to and access the corresponding third-party application server to obtain the required business application data and services.
  • the third-party application server is provided by a third-party application service provider, and is used to connect with the corresponding third-party application client through the network to provide users with the required application services, such as information, shopping, social networking, etc .; used to register with the server through the network Connect to and obtain or verify the registration information of the third-party application client from the registration server, such as third-party user ID, user key, user token, and other information.
  • FIG. 1 does not constitute a limitation on the implementation environment, and may include more or fewer components than shown, or some components may be combined, or different components may be arranged.
  • FIG. 2 shows a flowchart of an embodiment of a client registration method provided by the present invention.
  • the method can be used in the implementation environment shown in FIG. 1.
  • the method may include the following steps:
  • Step 201 The user terminal performs authentication and key negotiation with the registration server.
  • the user identification module SIM connected to the user terminal stores a mobile user identity, a mobile user key (K), and an AKA-related algorithm.
  • the mobile user identity and the mobile user identity are stored in a user data system connected to the registration server.
  • the user terminal based on the user identification module SIM and the registration server based on the user data system can perform authentication and key negotiation through the authentication and key negotiation mechanism. If the authentication and key negotiation succeeds, the corresponding security parameters can be negotiated, and Establish the corresponding relationship between the security parameter and the mobile user identity for security authentication between the user terminal and the registration server in the subsequent process.
  • the security parameter on the user terminal is called the first security parameter here, and the registration will be The security parameter on the server is called the second security parameter.
  • the security parameters may include a security token.
  • the security token is generated by the registration server and sent to the user terminal.
  • an embodiment of establishing a correspondence relationship between the security token and the mobile user identity can be established on the registration server.
  • the correspondence between the security token and the mobile user identity can also be encrypted to generate a security token, so that the corresponding mobile user identity can be obtained according to the security token.
  • the security parameter may include a root key.
  • the root key is generated by the user terminal and the registration server using the same key generation method.
  • the root key generated on the user terminal is referred to as One key, the root key generated on the registration server is called the second root key.
  • the correspondence between the mobile user identity and the second root key is established on the registration server, so that the corresponding second root key can be obtained according to the mobile user identity.
  • the authentication and key negotiation between the user terminal and the registration server may include multiple implementation manners.
  • the first embodiment of the authentication and key negotiation process and the second embodiment of the authentication and key negotiation process a variety of methods are provided to implement An embodiment in which a user terminal performs authentication and key negotiation with a registration server.
  • Step 202 The user terminal performs security authentication with the registration server.
  • the user terminal After the user terminal and the registration server successfully perform authentication and key negotiation, based on the security parameters obtained through the negotiation, the user terminal can perform security authentication with the registration server.
  • the user terminal uses the security token to perform security authentication with the registration server.
  • the security parameter includes a root key
  • the second root key with the same value is stored on the registration server, and the mobile user identity and the second root secret are established.
  • the user terminal and the registration server can perform security authentication based on the root key with the same value.
  • the user terminal and the registration server for security authentication may include multiple implementation manners.
  • a variety of methods are provided for implementing the user terminal and the registration server for authentication. Implementation of safety certification.
  • Step 203 After the security authentication is successful, the registration server provides registration information and services to the user terminal.
  • the registration server can provide the required data and services to the user terminal and the third-party application client running in the user terminal, for example, it can send a registration success response message to the user terminal, or provide it to the user terminal. Registration information and services related to third-party application clients.
  • the user terminal may receive data and services provided by the registration server as needed, for example, may receive a registration success response message sent by the registration server, or a third-party application client-related information provided by the registration server. Registration information and services, etc.
  • the registration server providing the registration information to the third-party application client running in the user terminal may include various implementation manners.
  • the first embodiment of the client registration information providing process to the third embodiment of the client registration information providing process Various implementations for providing registration information for a third-party application client running in a user terminal.
  • the method provided by this embodiment provides a secure registration environment for the registration of the user terminal and a third-party application client running in the user terminal after authentication and key negotiation and security authentication between the user terminal and the registration server.
  • the registration server After the security authentication is successful, the registration server provides the corresponding registration information and services to the user terminal and the third-party application client running in the user terminal. The entire process does not require the user to enter the registration information, which improves the user experience.
  • FIG. 3 shows a flowchart of a first embodiment of a client security authentication process provided by the present invention.
  • This embodiment can be used in the implementation environment shown in FIG. 1.
  • This embodiment includes:
  • Step 301 The user terminal sends a security authentication request to the registration server, where the security authentication request includes a security token.
  • the registration server During the authentication and key negotiation process, the registration server generates a security token for the user terminal, and sends the security token to the user terminal, and the user terminal obtains the security token.
  • the user terminal sends a security authentication request to the registration server, and includes the security token in the security authentication request, so that the registration server can verify the security token.
  • the registration server receives the security authentication request sent by the user terminal, and acquires the security token in the security authentication request.
  • Step 302 The registration server verifies whether the security token is valid, and obtains a mobile user identity corresponding to the user terminal.
  • the registration server needs to use corresponding implementation modes to verify the security token, including:
  • the first implementation manner corresponds to the implementation manner in which the registration server uses a randomly generated globally unique character string as the security token, and the registration server searches for the correspondence between all the stored security tokens and the mobile user identifier to see if the security exists. Token, and find whether the security token has a corresponding mobile user ID; if so, determine that the security token is valid, and obtain the mobile user ID corresponding to the security token, and the obtained corresponding mobile user ID is The mobile user identity corresponding to the user terminal; if not, it is determined that the security token is invalid.
  • the second implementation manner corresponds to the implementation manner in which the registration server uses a symmetric encryption algorithm to encrypt the ciphertext including the information of the mobile user identity as a security token based on a preset key, and the registration server uses the same symmetric encryption algorithm Decrypt the security token with the same preset key, and obtain the mobile user identity in the decrypted plain text. If the mobile user ID can be successfully decrypted and obtained, the security token is determined to be valid, and the mobile user ID in the plain text is obtained, and the mobile user ID in the plain text is the mobile user ID corresponding to the user terminal; if not, It is determined that the security token is invalid.
  • the key is the preset key used when generating the security token
  • AES_DENCRYPT is the decryption algorithm
  • s is the ciphertext, which is the security token.
  • Step 303 The registration server determines whether the security authentication is successful according to the verification result of the security token.
  • the registration server determines whether the security authentication is successful based on the verification result of the security token, and performs corresponding operations, including:
  • the registration server may provide the required data and services to the user terminal, for example, may send a registration success response message to the user terminal, or provide registration information and services to the user terminal.
  • the user terminal may obtain data and services provided by the registration server as needed, for example, receiving a registration success response message sent by the registration server, or receiving registration information and services provided by the registration server.
  • the registration server does not provide the required data and services to the user terminal, and sends a registration failure response message to the user terminal.
  • the user terminal After determining that the security authentication fails, the user terminal receives a registration failure response message and the like sent by the registration server.
  • the method provided in this embodiment mainly performs security authentication based on the security token negotiated by the user terminal and the registration server. After the security authentication is successful, the method can be used for the user terminal and a third-party application client running on the user terminal. Provide corresponding registration information and services securely, and return a registration success response message to the user terminal.
  • FIG. 4 shows a flowchart of a second embodiment of a client security authentication process provided by the present invention.
  • This embodiment can be used in the implementation environment shown in FIG. 1.
  • This embodiment includes:
  • the user terminal starts the client security authentication process after obtaining an operation instruction for starting the client security authentication process.
  • the security authentication process may include the following three sub-processes and corresponding steps:
  • the user terminal and the registration server generate an authentication key with the same value based on the same mobile user identity and the same root key as the value. This can include:
  • Step 401 The user terminal obtains a mobile user identity and a first root key.
  • the user terminal obtains the mobile user identity and the first root key.
  • the mobile server identity and the corresponding mobile user identity should be stored on the registration server.
  • the second key is the mobile server identity and the corresponding mobile user identity.
  • Step 402 The user terminal generates a first authentication key based on the first root key.
  • the first root key may be used as the first authentication key.
  • the information based on the information including the first root key and the first fixed character string (1) or / and the first random character string or / and the first time stamp or / and the mobile user identifier or / and the third party application identifier
  • the information generates a first authentication key; wherein the first fixed character string (1) is a character string that is pre-configured and has the same value as the first fixed character string (2) that is pre-configured on the registration server, and the first random
  • the character string is a locally randomly generated character string
  • the first time stamp is generated by acquiring the current system time of the user terminal.
  • DK PBKDF2 (passphrase, Salt, c, dkLen), where: DK is the first authentication key generated, PBKDF2 is the key derivation algorithm, passphrase is the first root key and is the first fixed string (1) or / And the first random string or / and the first timestamp or / and the mobile user identification or / and the third-party application identification combination; Salt is a salt value, in this case a fixed string; c is The number of iterations; dlLen is the length of the key output, which can be generated according to the encryption algorithm used.
  • the third-party application identifier is the identifier of the third-party application client running in the user terminal.
  • the third-party application client software has built-in storage in the third-party application client software installation package and is stored in a configuration file after installation.
  • the user terminal obtains the configuration file from the configuration file.
  • the third-party application identifier; or, the third-party application client obtains the request after sending the request to the corresponding third-party application server, and then the user terminal obtains the request from the third-party application client.
  • Step 403 The user terminal sends the mobile user identity and the information for generating the first authentication key to the registration server.
  • the user terminal sends the mobile user identity to the registration server, so that the registration server can obtain a corresponding second root key according to the mobile user identity.
  • the registration server In order for the registration server to generate a second authentication key with the same value as the first authentication key, if the information for generating the first authentication key further includes a first random string or / and a first time stamp or / and a third party
  • the application identifier sends the first random string or / and the first time stamp or / and the third-party application identifier to the registration server.
  • the registration server receives the mobile user identifier and the first random character string or / and the third-party application identifier sent by the user terminal.
  • the above-mentioned information for generating the first authentication key further includes the first fixed character string (1), since the fixed character string can be pre-configured with a fixed character string of the same value on the registration server, the first fixed key can be omitted.
  • the string (1) is sent to the registration server.
  • Step 404 The registration server obtains a second root key according to the mobile user identity.
  • the correspondence between the mobile user identity and the second root key is stored on the registration server.
  • the registration server searches and obtains the corresponding second root key in the corresponding relationship according to the mobile user identifier.
  • Step 405. The registration server generates a second authentication key based on the second root key.
  • the registration server uses the same authentication key generation method as the user terminal, and generates a second authentication key based on the second root key.
  • the registration server uses the second root key as the second authentication key. key.
  • the registration server is based on including the second root key and the first fixed character string (2) or / and A random character string or / and a first time stamp or / and information of the mobile user identifier or / and a third-party application identifier to generate a first authentication key
  • the second authentication key is generated in a manner similar to that in which the user terminal generates the first authentication key
  • the authentication key is generated in the same manner; wherein the first fixed character string (2) is a character string that is pre-configured and has the same value as the first fixed character string (1) that is pre-configured by the user terminal, and the first random character The string or / and the first time stamp or /
  • the values of the first authentication key and the second authentication key are also the same.
  • the second sub-process the user terminal and the registration server generate the same authentication information. This can include:
  • Step 406. The user terminal generates first verification information.
  • the user terminal generates the first authentication information, so that the first authentication information is used for encryption, and the first authentication information and the second authentication information generated by the registration server have the same value.
  • the user terminal may use one of the second fixed character string (1) or the second random character string or the second time stamp or the mobile user identifier or the third-party application identifier as the first verification information; or
  • the first fixed information is generated by the second fixed character string (1) or / and the second random character string or / and the second time stamp or / and the information of the mobile user identifier or / and the third-party application identifier, for example, a user terminal Combine the second fixed character string (1) or / and the second random character string or / and the second time stamp or / and the mobile user identifier or / and the third-party application identifier to generate the first verification information.
  • the second fixed character string (1) is a pre-configured character string with the same value as the second fixed character string (2) pre-configured on the registration server, and the second random character string is a locally randomly generated character string.
  • the second time stamp is generated by acquiring the current system time of the user terminal.
  • the user terminal sends the information for generating the first authentication information to the registration server.
  • the registration server After the user terminal generates the first authentication information, in order to make the registration server generate the second authentication information with the same value as the first authentication information, if the generated first authentication information further includes a second random string or / and a second time stamp Or / and the mobile user identity or / and the third-party application identity, and a first encryption value is signed and encrypted using a signature encryption algorithm to generate a first encrypted value, then the second random string or / and the second time The stamp or / and the mobile user identification or / and the third-party application identification is sent to the registration server.
  • the registration server receives the second random character string or / and the second time stamp or / and the mobile user identity or / and the third-party application identity sent by the user terminal.
  • the above-mentioned information for generating the first verification information further includes a second fixed character string (1), since the fixed character string can be pre-configured with a fixed character string of the same value on the registration server, the second fixed character can be omitted String (1) is sent to the registration server.
  • the generated first verification information further includes the second random string or / and the second timestamp or / and the mobile user ID or / and the third party application ID
  • the A verification information is symmetrically encrypted to generate a first encrypted value. Since the first verification information can be obtained after decrypting the first encrypted value, the second random string or / and the second time stamp or / And the mobile user identity or / and the third-party application identity are sent to the registration server.
  • this step can also be combined with the above step 403 into one step for implementation, that is, the user terminal can send the mobile user identity, the information for generating the first authentication key, and the information for generating the first authentication information at the same time in one transmission request.
  • the registration server correspondingly, the corresponding steps of the above-mentioned registration server generating the second authentication key and generating the second authentication information are also implemented after the combined step.
  • Step 408. The registration server generates second authentication information.
  • the registration server generates second authentication information, and makes the value of the generated second authentication information the same as the value of the first authentication information generated by the user terminal.
  • step 406 Taking the method of generating the same authentication information as in step 406 as an example, if the user terminal sends the second fixed character string (1) or the second random character string or the second time stamp or the mobile user identifier or the third party application identifier One type is the first verification information, and the registration server uses one of the second fixed character string (2) or the second random character string or the second time stamp or the mobile user identity or the third-party application identity as the second verification. information.
  • the registration server includes a second fixed character string (2) or / and a second random character string or / and a second time stamp or / and the mobile user identification Or / and the second identification information is generated by the information of the third-party application identification.
  • the registration server sends the second fixed character string (2) or / and the second random character string or / and the second time stamp or / and the mobile user ID or / and The third-party application identification combination is spliced to generate second verification information.
  • the second fixed character string (2) is a character string that is pre-configured and has the same value as the second fixed character string (1) that is pre-configured on the user terminal, the second random character string or / and the second The time stamp or / and the third-party application identifier is sent by the user terminal.
  • the values of the first verification information and the second verification information are also the same.
  • the registration server compares the second timestamp with the current system time of the registration server to determine both Whether the time difference is within the preset valid range: If it is within the valid range, perform the following steps; if it is not within the valid range, do not perform the following steps to end the client security authentication process.
  • the third sub-process The user terminal and the registration server implement security authentication based on an authentication key having the same value and authentication information having the same value. This can include:
  • Step 409 The user terminal encrypts and generates a first encrypted value based on the first authentication key and the first authentication information.
  • the user terminal encrypts and generates a first encrypted value based on the first authentication key and the first authentication information.
  • a first encrypted value based on the first authentication key and the first authentication information.
  • multiple implementations can be included, including at least:
  • the user terminal uses a signature encryption algorithm to sign-encrypt the first verification information based on the first authentication key to generate a first encrypted value.
  • the user terminal uses a signature encryption algorithm based on the first authentication key to sign and encrypt the first verification information.
  • the first encryption value is a signature value.
  • the signature value can uniquely identify the first verification information. Only the same signature is used. Only the encryption algorithm, the signature key with the same value, and the information to be signed with the same value can generate the same signature value.
  • the signature encryption algorithm uses a hash message authentication code as an example.
  • Signature SHA256 (k
  • the user terminal uses a symmetric encryption algorithm to symmetrically encrypt the information including the first authentication information based on the first authentication key to generate a first encrypted value.
  • the user terminal uses a symmetric encryption algorithm to symmetrically encrypt the information including the first authentication information based on the first authentication key to generate a first encrypted value.
  • the first encrypted value is a cipher text of the information including the first authentication information. Only the same symmetric encryption algorithm and the same value of the key can be used to decrypt the ciphertext to obtain the original plaintext.
  • the above-mentioned information including the first verification information means that the generated information also includes the first verification information and other information, for example, information generated after combining the first verification information and other information, and for the other information, Information, unless otherwise specified, is not limited in this embodiment.
  • Step 410 The user terminal sends a security authentication request to the registration server, where the security authentication request includes the first encrypted value.
  • the user terminal sends a security authentication request to the registration server, where the security authentication request includes the first encrypted value, so that the registration server implements security authentication of the user terminal by verifying the first encrypted value.
  • the registration server receives the security authentication request sent by the user terminal, and acquires the first encrypted value included in the security authentication request.
  • this step can also be combined with the above step 403 or / and step 407 into one step for implementation, that is, the user terminal can send the security authentication request with the information of the mobile user identity and the first authentication key generation, or the first A step of verifying the information of the information is simultaneously sent to the registration server in one transmission request. Accordingly, the corresponding steps of the registration server generating the second authentication key and generating the second verification information are also implemented after the combined step.
  • Step 411 The registration server verifies the first encrypted value based on the second authentication key and the second verification information.
  • the registration server needs to use corresponding implementations to verify the first encrypted value based on the second authentication key and the second verification information, including :
  • the first implementation manner corresponds to the implementation manner in which the user terminal uses the signature encryption algorithm to generate the first encrypted value, and the registration server uses the same signature encryption algorithm as the user terminal, based on the second authentication key and the second verification information Verify the first encrypted value.
  • This can include:
  • Step 411a The registration server uses the same signature encryption algorithm as the user terminal to encrypt the second authentication information based on the second authentication key to generate a second encrypted value.
  • the registration server uses the same signature encryption algorithm as the user terminal to sign and encrypt the second verification information based on the second authentication key to generate a signature value, and the signature value is also expressed herein as the second encryption value.
  • the registration server uses the same signature algorithm as the user terminal, the second authentication information and the first authentication information are the information to be signed with the same value, and the second authentication key and the first authentication key are the same signature encryption value. Key, the second encrypted value and the first encrypted value generated should be the same.
  • Step 411b The registration server compares whether the second encrypted value is consistent with the first encrypted value; if they are consistent, it determines that the security verification is successful.
  • the registration server compares whether the second encrypted value is consistent with the first encrypted value, and performs a corresponding operation according to the comparison result, including:
  • the registration server uses the same symmetric encryption algorithm as the user terminal, and verifies the first authentication value based on the second authentication key and the second verification information.
  • Two encrypted values can include:
  • Step 411i The registration server uses the same symmetric encryption algorithm as the user terminal, decrypts the first encrypted value based on the second authentication key to obtain a plaintext, and obtains the first verification information from the plaintext.
  • the registration server uses the same symmetric encryption algorithm as the user terminal to decrypt the first encrypted value based on the second authentication key, thereby obtaining the decrypted plaintext.
  • the first verification information can be obtained from the plain text.
  • Step 411ii The registration server compares whether the second authentication information is consistent with the first authentication information; if they are consistent, it determines that the security verification is successful.
  • the registration server compares whether the second verification information is consistent with the plaintext obtained after decryption, and performs corresponding operations according to the comparison result, including:
  • Step 412 The registration server determines whether the security authentication is successful according to the verification result of the first encrypted value.
  • the registration server determines whether the security authentication is successful according to the verification result of the first encrypted value, and performs corresponding operations, including:
  • the registration server may provide the required data and services to the user terminal, such as sending a registration success response message to the user terminal, or providing registration information and services to the user terminal.
  • the user terminal may receive data and services provided by the registration server, such as receiving a registration success response message sent by the registration server, or receiving registration information and services provided by the registration server.
  • the registration server may not provide the required data and services to the user terminal, including sending a registration failure response message to the user terminal.
  • the user terminal After determining that the security authentication fails, the user terminal receives a registration failure response message and the like sent by the registration server.
  • the method provided in this embodiment is mainly based on the mobile user identity and the first root key in the user terminal, and based on the same mobile user identity and the corresponding second root key stored in the registration server.
  • the registration server performs security authentication on the user terminal by using the same encryption algorithm as the user terminal. After the security authentication is successful, it can securely provide corresponding registration information and services for the user terminal and third-party application clients running on the user terminal. A registration success response message is returned to the user terminal.
  • FIG. 5 shows a flowchart of Embodiment 1 of a client registration information providing process provided by the present invention.
  • This method can be used in the implementation environment shown in FIG. 1.
  • This embodiment further provides registration information for a third-party application client running in the user terminal, where the registration information includes a third-party user identifier and a user key.
  • the user terminal In order for the registration server to provide corresponding registration information and services for the third-party application client running in the user terminal, the user terminal needs to pass the third-party application identifier corresponding to the third-party application client to the registration server.
  • the user terminal passing the third-party application identifier to the registration server may include various implementation manners, for example, it may include:
  • the user terminal sends the third-party application identifier to a registration server, and the registration server receives the third-party application identifier.
  • the user terminal sends the third-party application identifier to the registration server.
  • the third-party application identifier may be sent to the registration server in a separate sending request, or the third-party application identifier may be combined in a security authentication request or other sending request.
  • Sent to the registration server for example, incorporated in the above-mentioned step 301 or step 410 security authentication request, or incorporated in the above-mentioned step 403 or / and step 407 the user terminal sends an authentication key or authentication information related steps.
  • the registration server receives the third-party application identifier sent by the user terminal.
  • the user terminal encrypts the third-party application identifier, and sends the encrypted ciphertext to the registration server, and the registration server decrypts the ciphertext to obtain the third-party application identifier.
  • the user terminal uses the same key generation method to generate an encryption key with the same value based on the first root key and the registration server based on the second root key.
  • the user terminal uses a symmetric encryption algorithm and the encryption key for the third-party application.
  • Identity encryption the encrypted ciphertext is sent to the registration server, and the registration server decrypts the encryption key with the same value to obtain the third-party application identity.
  • the user terminal uses a symmetric encryption algorithm to symmetrically encrypt the information including the first authentication information based on the first authentication key to generate a first encrypted value.
  • the information of the first verification information includes the third-party application identifier. Therefore, in the second implementation manner of step 411, the registration server obtains the third-party application identifier from the decrypted plaintext.
  • the registration server can provide the third-party application client running in the user terminal with registration information including the third-party user identifier and user key. That is, the following steps of this embodiment are applied in After the first embodiment of the client security authentication process and the second embodiment of the client security authentication process. This can include:
  • Step 501 The registration server obtains a corresponding third-party user identifier according to the mobile user identifier corresponding to the user terminal and the third-party application identifier.
  • the mobile user identity corresponding to the user terminal is the corresponding mobile user identity obtained according to the security token; corresponding to the second embodiment of the client security authentication process above, the user The mobile user identifier corresponding to the terminal is the mobile user identifier included in the authentication key information or security verification information or security authentication request sent by the user terminal to the registration server.
  • the corresponding relationship between the mobile user identifier and the third-party application identifier and the third-party user identifier is stored on the registration server, and the corresponding third-party user identifier can be obtained in the corresponding relationship according to the mobile user identifier and the third-party application identifier. It can include the following steps:
  • Step 501a The registration server searches for a corresponding third-party user identifier according to the mobile user identifier and the third-party application identifier.
  • the registration server stores the correspondence relationship between the mobile user identification and the third-party application identification and the third-party user identification, that is, the corresponding third-party user identification can be found in the account correspondence according to the third-party application identification and the mobile user identification.
  • the registration server searches for the corresponding third-party user identifier in the account correspondence relationship according to the mobile user identifier and the third-party application identifier.
  • the registration server If a corresponding third-party user ID is found, the registration server has created a third-party user ID for the third-party application ID for the mobile user ID, the registration server obtains the corresponding third-party user ID, and then executes the following Step 502.
  • the registration server has not created a third-party user identifier for the third-party application identifier for the mobile user identifier, and the following step 501b is performed.
  • Step 501b The registration server creates a unique third-party user ID.
  • the registration server creates a new user ID.
  • the new user ID is the only one of all third-party user IDs on the registration server, or all third parties corresponding to the third-party application ID in the account correspondence relationship described in step 501a.
  • the unique ID in the user ID, and then the new user ID is used as the third-party user ID.
  • Step 501c The registration server establishes and stores a correspondence between the mobile user identifier and the third-party application identifier and the third-party user identifier.
  • the registration server adds a corresponding relationship between the mobile user identifier and the third-party application identifier to the third-party user identifier in the account correspondence relationship described in step 501a, that is, corresponding to the mobile user identifier and the third-party application identifier in the account.
  • the relationship will be able to find and obtain the third-party user ID.
  • Steps 501a, 501b, and 501c may also be that the registration server pre-establishes an application user relationship table for the third-party application identifier, and the application user relationship table stores one by one of the mobile user identifier and the third-party user identifier. Correspondence.
  • the registration server looks up the third-party user ID in the application user relationship table according to the mobile user ID. If no third-party user ID is found, a unique third-party user ID is created, and the new addition is added to the application user relationship table. The one-to-one correspondence between the mobile user identity and the third-party user identity. If the third-party user identity is found, the third-party user identity is obtained.
  • Steps 501a, 501b, and 501c may also be that the registration server pre-establishes a mobile user relationship table for the mobile user identity, and the mobile user relationship table stores a third-party application identifier and a third-party user identifier. Correspondence.
  • the registration server looks up the third-party user ID in the mobile user relationship table according to the third-party application ID. If no third-party user ID is found, it creates a unique third-party user ID and adds a new one to the mobile user relationship table. The one-to-one correspondence between the third-party application identifier and the third-party user identifier. If the third-party user identifier is found, the third-party user identifier is obtained.
  • Step 502. the registration server generates a second user key corresponding to the third-party user identifier based on the second root key.
  • the registration server generates a second user key based on the second root key, and establishes a correspondence between the third-party user identifier and the second user key. It can include the following steps:
  • Step 502a The registration server generates a second user key based on the second root key.
  • the registration server generates a second user key based on the second root key.
  • the registration server is based on including the second root key and a third fixed character string (2) or / and a third random character string or / and a third time stamp or / and the mobile user identity or / and the third party Generating a second user key by using the application identification or / and the information of the third-party user identification; wherein the third fixed character string (2) is a third fixed character string (1) that is pre-configured and pre-configured on the user terminal; A string with the same value, the third random string is a locally randomly generated string, and the third timestamp is generated by obtaining the current system time of the registration server.
  • DK PBKDF2 (passphrase, Salt, c, dkLen), where: DK is the generated second user key, PBKDF2 is the key derivation algorithm, passphrase is the second root key and the third fixed string or / and the third random A string or / and a third timestamp or / and the mobile user identification or / and the third party application identification or / and the third party user identification combined spliced string; Salt is a salt value, in this case a fixed character String; c is the number of iterations; dlLen is the length of the key output, which can be generated as required.
  • Step 502b The registration server establishes a correspondence between the third-party user ID and the second user key.
  • the registration server establishes a correspondence between the third user identifier and the second user key, so that the corresponding second user key can be obtained in the correspondence according to the third user identifier.
  • the third-party user ID is the only one of all third-party user IDs on the registration server, a correspondence between the third-party user ID and the second user key is established.
  • the third-party user identifier is a unique identifier among all third-party user identifiers corresponding to the third-party application identifier, a correspondence between the third-party user identifier and the third-party application identifier and the second user key is established.
  • the registration server has established the correspondence between the third-party user ID and the second user key.
  • the registration server can store the correspondence locally, or send the correspondence to the third-party authentication server, or synchronize the correspondence. Sent to a third-party application server corresponding to the third-party application identity. Then, based on the corresponding relationship, if the third-party application client running on the user terminal has the same third-party user ID and the same user key as the value of the second user key, the third-party application client can be implemented Identity authentication, data encryption and other operations.
  • the registration server establishes an account key relationship table for the third-party application identifier in advance, and the account key relationship table stores a third-party user identifier and the second user key.
  • One-to-one correspondence The registration server looks up the second user key in the account key relationship table according to the third-party user ID. If the second user key is not found, the third-party user ID and the third-party user ID are added to the account key relationship table. The one-to-one correspondence of the second user key. If the user key is found, the second user key newly generated in this step is used in the account key relationship table to replace the existing user of the third-party user identifier. Key.
  • step 501 if an application user relationship table for the third-party application identifier is established in advance on the registration server, or if a mobile user relationship table for the mobile user identifier is established in advance on the registration server, A one-to-one correspondence between the third-party user identifier and the second user key is established and updated in the application user relationship table or the mobile user relationship table, and details are not described herein again.
  • step 502 may also be performed after the following step 503, which is not limited in the present invention.
  • Step 503 The registration server sends a registration response message to the user terminal, where the registration response message is a registration success response message and includes the third-party user identifier.
  • the registration success response message sent to the user terminal further includes the third random string Or / and the third timestamp.
  • Step 504. The user terminal receives the registration response message sent by the registration server and performs a corresponding operation.
  • the user terminal receives a registration response message sent by the registration server, where the registration response message is a registration success response message or a registration failure response message.
  • the user terminal performs corresponding operations according to the client registration response message, including:
  • the registration response message is a registration success response message
  • the third-party user identifier in the registration success response message is obtained, and the third-party user identifier is sent to a third-party application client corresponding to the third-party application identifier.
  • a corresponding step 505 is performed to generate a first user key, and the generated first user key is sent to the corresponding third-party application client at the same time.
  • the process is ended, or the user terminal ends the process after sending the registration failure response message to a third-party application client.
  • Step 505. the user terminal uses the same user key generation method as the registration server, and generates a first user key based on the first root key.
  • the user terminal uses the same user key generation method as the registration server, and generates a first user key based on the first root key.
  • the registration server is based on including the second root key and the third fixed character string (2) or / and the third random character string or / and the third time stamp or / and the mobile user identity or /
  • the third-party application identification or / and the third-party user identification information to generate a second user key
  • the user terminal is based on including the first root key and a third fixed character string (1) or / and a third random character String or / and a third time stamp or / and the mobile user identification or / and the third party application identification or / and the third party user identification information to generate a first user key;
  • the third fixed character string (1) It is a character string that is pre-configured and has the same value as the third fixed character string (2) pre-configured on the registration server, and the third random character string or / and the third time stamp is included in the registration success response message.
  • the user terminal sends the third-party user identifier and the first user key to a third-party application client corresponding to the third-party application identifier, and the third-party application client will be able to use the third-party user identifier and the first user key Perform identity authentication and data encryption to third-party application servers.
  • the third-party application client running in the user terminal obtains a third-party user identifier and generates a corresponding user key.
  • the third-party application client is automatically obtained with a third-party user ID and the corresponding user key, which reduces the input operation of the end user and improves the user experience.
  • the second aspect as long as It is the same user identification module SIM. Even if it is replaced to another user terminal, as long as it is the same third-party application client, it can automatically obtain the same third-party user identity for it.
  • the third-party application client corresponds Third-party application server will only be able to obtain the third-party user identity related to it, but not the mobile user identity, which can effectively protect the user ’s privacy from being leaked; fourth, third-party application customers running in user terminals The client can implement fast and secure identity authentication, data encryption and other operations based on the obtained third-party user ID and the generated user key.
  • FIG. 6 shows a flowchart of Embodiment 2 of a client registration information providing process provided by the present invention.
  • This method can be used in the implementation environment shown in FIG. 1.
  • This embodiment further provides registration information for a third-party application client running in the user terminal, and the registration information includes generating a user token for the third-party application client running in the user terminal.
  • the user terminal In order for the registration server to provide corresponding registration information and services for the third-party application client running in the user terminal, the user terminal needs to pass the third-party application identifier corresponding to the third-party application client to the registration server.
  • the user terminal passing the third-party application identifier to the registration server may include various implementation manners. For specific implementation manners, reference may be made to Embodiment 1 of the above-mentioned client registration information providing process, and details are not described herein again.
  • the registration server can provide the third-party application client running in the user terminal with registration information including the user token, that is, the following steps of this embodiment are applied to the client security authentication process After the first embodiment and the first embodiment of the client security authentication process.
  • This can include:
  • Step 601. The registration server generates a user token for the third-party application identifier.
  • the registration server generates a user token for the third-party application identifier.
  • the user token is unique and has sufficient length and sufficient randomness, making it difficult to guess and crack.
  • Step 602 The registration server establishes an association relationship between the user token and the third-party application identifier or / and the mobile user identifier.
  • the registration server establishes the association between the user token and the third-party application identifier.
  • the registration server can store the association locally, or send the association to the third-party authentication server, or send the association to the third-party.
  • the third-party application server corresponding to the application identifier. Then, based on the association, if the third-party application client running on the user terminal has the same user token, the third-party application server can implement authentication to the third-party application client according to the association, for example, to the user For example, the token is sent to the third-party application server corresponding to the third-party application identifier.
  • the third-party application server receives an authentication request including a user token, and searches for the corresponding user token in the association relationship. The authentication is successful, so that it can be determined that the sender of the authentication request is a third-party application client corresponding to the third-party application server.
  • an association relationship between the user token and the third-party application identifier and a mobile user identifier corresponding to the user terminal should be established so that the The token can find the third-party application identity and mobile user identity corresponding to the same user terminal, thereby providing continuous services for the same user.
  • the synchronization relationship is sent to a third-party application server corresponding to the third-party application identifier as an example.
  • the third-party application server receives an authentication request including a user token, and searches for the corresponding relationship in the association according to the user token. If it is found, it can provide continuous application services to users associated with the mobile user identity.
  • a unique user ID corresponding to the mobile user ID may also be created, and then the user token and the third-party application ID and the unique user ID may be created. Correspondence relationship, thereby preventing the user's mobile user identity from being leaked to a third-party application server.
  • a cleaning mechanism should also be provided, and the corresponding association relationship should be cleared in time for the user token that has expired, such as deleting the corresponding association relationship of the user token after the user token is verified once, or setting the user token Set a valid period, and delete the corresponding association relationship of the user token that has expired in time according to the valid period.
  • the specific cleaning mechanism will not be repeated here.
  • Step 603. The registration server sends a registration response message to the user terminal, where the registration response message is a registration success response message and includes the user token.
  • Step 604 The user terminal receives the registration response message sent by the registration server and performs a corresponding operation.
  • the user terminal receives a registration response message sent by the registration server, where the registration response message is a registration success response message or a registration failure response message.
  • the user terminal performs corresponding operations according to the registration response message, including:
  • the registration response message is a registration success response message
  • obtaining a user token in the registration success response message and passing the user token to a third-party application client corresponding to the third-party application identifier for authentication and authentication, Then end this process.
  • the process is ended, or the user terminal ends the process after sending the registration failure response message to a third-party application client.
  • the process of the above embodiment generates a user token for a third-party application client running in the user terminal.
  • the effects include: in the first aspect, automatically obtaining user tokens for third-party application clients, reducing end-user input operations and improving the user experience; in the second aspect, the user token can be used for The third-party application client authenticates to the corresponding third-party application server, thereby improving the user experience.
  • the user token when used for authentication, the user token does not need to perform operations such as cryptographic calculations. Suitable for some lightweight application clients (such as browser-based web applications).
  • FIG. 7 shows a flowchart of Embodiment 3 of a client registration information providing process provided by the present invention.
  • This method can be used in the implementation environment shown in FIG. 1.
  • this embodiment further implements the authorization confirmation process of the end user.
  • the following steps of the method are based on the first embodiment of the client registration information providing process.
  • the user terminal passes the third-party application identifier and security authentication to the registration server, and the application runs on the registration server as the user terminal,
  • the process includes the following steps:
  • Step a The registration server sends an application authorization request message to the user terminal.
  • the application authorization request message may include:
  • third-party application name which is a name used to identify a third-party application client and a third-party application server.
  • the correspondence between the third-party application identifier and the third-party application name is stored in advance on the registration server.
  • the third-party application identifier searches and obtains the corresponding third-party application name in the corresponding relationship.
  • the name is used to identify the mobile user.
  • the correspondence between the mobile user ID and the mobile user name is stored in advance on the registration server.
  • the registration server searches and obtains the corresponding relationship according to the mobile user ID. Corresponding mobile user name.
  • the user terminal receives an application authorization request message sent by the registration server.
  • Step b The user terminal displays an application authorization verification interface.
  • the user terminal After receiving the application authorization request message sent by the registration server, the user terminal invokes and displays the application authorization verification interface to ask the end user whether to agree to authorize the third-party application.
  • the third-party application name or / and mobile user name included in the application authorization request message can be displayed, specifically:
  • Third-party application name which is the name of the third-party application client and third-party application server to be authorized
  • Mobile user name the name of the mobile user to be authorized.
  • the end user can enter authorization information indicating confirmation of authorization or cancellation of authorization.
  • a security verification code input box may also be included to ask the end user to enter a security verification code.
  • the security verification code is used to further verify the authorization of the end user.
  • the correspondence between the mobile user identification and the security verification code is stored in advance on the registration server.
  • Step c The user terminal receives authorization information entered by the end user in the application authorization verification interface.
  • Step d The user terminal sends an application authorization response message to the registration server, where the application authorization response message is an application authorization confirmation message or an application authorization cancellation message.
  • the user terminal performs corresponding operations according to the authorization information input by the terminal user, including:
  • the application authorization response message sent by the user terminal to the registration server is an application authorization confirmation message.
  • a security verification code input box is further included on the displayed application authorization verification interface, and the authorization message input by the end user received by the user terminal includes the security verification code, the application authorization confirmation message sent by the user terminal to the registration server It also includes the security verification code.
  • the application authorization response message sent by the user terminal to the registration server is an application authorization cancellation message.
  • Step e The registration server receives the application authorization response message sent by the user terminal and performs a corresponding operation.
  • the registration server receives an application authorization response message sent by the user terminal.
  • the application authorization response message is an application authorization response message indicating confirmation of authorization or cancellation of authorization.
  • the registration server performs corresponding operations according to the application authorization response message, including:
  • the correspondence between the mobile user ID and the security verification code is stored in advance on the registration server. If the application authorization confirmation message received by the registration server includes the security verification code, the registration server is in the correspondence according to the mobile user ID. Find and obtain the corresponding security verification code, and compare whether the two security verification codes are the same: if they are the same, continue to the subsequent steps; if they are not the same, end the process and do not execute the registration server as a third-party application client running in the user terminal Procedure for providing registration information including third-party user ID and user key
  • the process ends and the registration server does not perform a process of providing registration information including a third-party user ID and a user key to a third-party application client running in the user terminal.
  • the method provided in this embodiment is based on the first embodiment of the client registration information providing process, and adds a process for the end user to verify and authorize. By adding this process, it can be more confirmed that the client registration information is provided to the end user. Authorization to avoid unnecessary third-party application clients being authorized due to misuse and other reasons.
  • This embodiment can also be combined with the second embodiment of the client registration information providing process to form a new embodiment, that is, the method steps of this embodiment are applied after the user terminal passes the third-party application identifier and the security authentication to the registration server, and the application is Before the registration server provides a process including a user token to a third-party application client running in the user terminal, the specific process is not described in detail.
  • FIG. 8 shows a flowchart of Embodiment 1 of an authentication and key negotiation process provided by the present invention.
  • the process is based on the authentication and key negotiation mechanism being 3G / 4G.
  • This process is implemented by the AKA mechanism.
  • This process can be used in the implementation environment shown in Figure 1, where the user data system is the home user server HSS.
  • the process includes:
  • Step 801. The user terminal starts an authentication and key negotiation process.
  • the user terminal After obtaining the operation instruction for authentication and key negotiation, the user terminal starts the authentication and key negotiation process.
  • Step 802. The user terminal obtains a mobile user identity.
  • the mobile subscriber identity is an identity for uniquely identifying the subscriber identification module SIM, and the mobile subscriber identity is IMSI or IMPI.
  • the mobile user ID and the mobile user ID obtained in the process of the client security authentication process embodiment are the same ID.
  • the used user identification module SIM is USIM
  • the mobile user identity obtained on USIM is IMSI
  • the user terminal obtains IMSI through the API on the operating system (for example, using the getSubscriberId method on the Android system), or the user terminal uses APDU
  • the command reads the EFimsi value of the USIM.
  • the mobile user identity obtained on the ISIM is IMPI, and the user terminal reads the EFimpi value of the ISIM through an APDU command.
  • Step 803 The user terminal sends an authentication and key agreement request to the registration server, where the authentication and key agreement request includes the mobile user identity.
  • the registration server receives the authentication and key agreement request sent by the user terminal.
  • Step 804 The registration server sends an authentication request to the home user server HSS, where the authentication request includes the mobile user identity.
  • a Multimedia-Auth-Request authentication request message may be sent to the SWx interface of the home user server HSS, and the Multimedia-Auth-Request authentication request message includes the mobile subscriber identity.
  • a Multimedia-Auth-Request authentication request message may be sent to the Cx or SWx interface of the home user server HSS, and the Multimedia-Auth-Request authentication request message includes the mobile user identity.
  • Step 805 The registration server receives an authentication response message returned by the home user server HSS, where the authentication response message includes a random number RAND, an authentication token AUTN, an expected response value XRES, a second encryption key CK, and a second integrity key IK .
  • the home user server HSS After the home user server HSS receives the authentication request from the registration server, the home user server HSS returns an authentication vector AV to the registration server.
  • the authentication vector AV includes a random number RAND, an authentication token AUTN, an expected response value XRES, and a second encryption key. CK and second integrity key IK.
  • the home user server HSS After the registration server sends a Multimedia-Auth-Request authentication request message to the home user server HSS, the home user server HSS returns a Multimedia-Auth-Answer authentication response message to the registration server.
  • the registration server parses the Multimedia-Auth-Answer authentication response message and obtains the SIP-Auth-Data-Item attribute value pair (AVP: Attribute Value) Pair), the SIP-Auth-Data-Item attribute value pair includes SIP-Authenticate, SIP-Authorization, Confidentiality-Key, Integrity-Key attribute value pairs, and the registration server obtains a random number RAND and Authentication token AUTN, obtain the expected response value XRES from the SIP-Authorization attribute value pair, obtain the second encryption key CK from the Confidentiality-Key attribute value pair, and / or obtain the second integrity from the Integrity-Key attribute value pair Key IK.
  • AVP Attribute Value
  • Step 806 The registration server sends an authentication and key agreement challenge message to the user terminal, where the authentication and key agreement challenge message includes the random number RAND and the authentication token AUTN.
  • the registration server retains the expected response value XRES, the second encryption key CK or / and the second integrity key IK, and sends an authentication and key agreement challenge message to the user terminal, where the authentication and key agreement challenge message includes the random number RAND and the authentication token AUTN.
  • the user terminal receives the authentication and key agreement challenge message sent by the registration server, and obtains the random number RAND and the authentication token AUTN from it.
  • Step 807 The user terminal sends an authentication request to the user identification module SIM, where the authentication request includes the random number RAND and the authentication token AUTN.
  • the user terminal sends an authentication request to the user identification module SIM (for example, by sending an APDU command AUTHENTICATE), and the parameters are the random number RAND and the authentication token AUTN.
  • Step 808 The user terminal receives a return value of the user identification module SIM, where the return value includes an expected response value RES, a first encryption key CK, and a first integrity key IK.
  • the user identification module SIM After the user identification module SIM receives the authentication request sent by the user terminal, the user identification module SIM sends a return value to the user terminal after the authentication calculation.
  • the return value includes the expected response value RES, the first encryption key CK, and the first The integrity key IK, the user terminal receives the return value.
  • Step 809 The user terminal sends an authentication and key agreement challenge response message to the registration server, where the authentication and key challenge response message includes the expected response value RES.
  • a hash algorithm (such as SHA256) can also be used to hash the expected response value RES, and only the expected response value RES is hashed. After generating the hash value without sending the plaintext of the expected response value RES.
  • the registration server receives the expected response value RES or the hash value of the expected response value RES sent by the user terminal.
  • Step 810 The registration server verifies the expected response value RES based on the expected response value XRES; if the verification is valid, step 811 is performed.
  • the registration server obtains the expected response value RES or the hash value of the expected response value RES from the received authentication and key challenge response message, and the registration server verifies the expected response value XRES retained locally. If the verification is valid, the following step 811 is performed; if the verification is invalid, an authentication and key agreement response message is sent to the user terminal.
  • the authentication and key agreement response message is an authentication and key agreement failure response message, and the following is performed. Step 813.
  • the plain text of the expected response value RES is sent to the registration server, it is compared whether the expected response value XRES and the expected response value RES are consistent; if they are consistent, the verification is valid; if they are not consistent, the verification is invalid.
  • the expected response value XRES is calculated using the same hash calculation method to generate a hash value, and whether the two hash values are consistent; if they are consistent , It is determined that the verification is valid; if it is not consistent, it is determined that the verification is invalid.
  • Step 811 The registration server generates a second security parameter, where the second security parameter includes a security token or / and a second root key, and establishes a correspondence between the second security parameter and the mobile user identity.
  • the registration server generates a second security parameter, the second security parameter includes a security token or / and a second root key, and establishes a correspondence between the second security parameter and the mobile user identity.
  • the implementation includes:
  • the registration server generates a security token, and establishes a correspondence between the security token and a mobile user identity.
  • the registration server generates a security token, and establishes a correspondence between the security token and the mobile user identity, so that the mobile user identity can be obtained according to the security token.
  • the registration server generates a security token, which is a globally unique security token and has sufficient length and sufficient randomness, making it difficult to guess and crack.
  • a corresponding relationship between the security token and the mobile user identity is established, so that the corresponding mobile user identity can be obtained in the corresponding relationship according to the security token.
  • the registration server uses a symmetric encryption algorithm to encrypt the information including the mobile user identity based on a preset key, and uses the encrypted ciphertext as a security token, so that the registration server obtains the mobile after decrypting the security token.
  • the registration server In a second implementation manner, the registration server generates a second root key based on the second encryption key CK or / and the second integrity key IK, and establishes a correspondence between the mobile user identity and the second root key. .
  • the second encryption key CK or the second integrity key IK is used as the second root key.
  • the second encryption key CK or / and the second integrity key IK or / and the fourth fixed character string (2) are combined to generate a second root key.
  • the fourth fixed character string (2) is a character that is pre-configured and has the same value as the fourth fixed character string (1) that is pre-configured on the user terminal String
  • the fourth random string is a locally randomly generated string
  • the fourth timestamp is generated by obtaining the current system time of the registration server.
  • DK PBKDF2 (passphrase, Salt, c, dkLen), where: DK is the second generated key, PBKDF2 is the key derivation algorithm, passphrase is the second encryption key CK or / and the second integrity key IK and the fourth fixed string (2) or / and the fourth random string or / and the fourth timestamp or / and the string stitched by the combination of the mobile user identity; Salt is a salt value, which is a fixed value in this example String; c is the number of iterations; dlLen is the length of the key output, and a key length that meets the requirements can be generated as required.
  • the correspondence between the mobile user identity and the second root key is established on the registration server, so that the registration server will be able to find and obtain the second root key in the correspondence relationship according to the mobile user identity.
  • the second root key generated this time is used to replace the corresponding second root key that the mobile user identity has stored.
  • first embodiment and the second embodiment may be applied separately or simultaneously.
  • step 812 the registration server sends an authentication and key agreement success response message to the user terminal, which is not limited in this embodiment of the present invention.
  • Step 812 The registration server sends an authentication and key agreement response message to the user terminal, where the authentication and key agreement response message is an authentication and key agreement success response message.
  • the authentication and key negotiation success response message also includes the security token.
  • the authentication and key agreement success response message also includes the fourth random character string or / and the Fourth timestamp.
  • Step 813 The user terminal receives the authentication and key agreement response message sent by the registration server and performs a corresponding operation.
  • the user terminal receives an authentication and key agreement response message sent by the registration server, and the authentication and key agreement response message includes an authentication and key agreement success response message or an authentication and key agreement failure response message.
  • the user terminal performs corresponding operations according to the authentication and key agreement response message, including:
  • the user terminal performs the following step 814.
  • authentication and key agreement response message is an authentication and key agreement failure response message, the following steps are not performed, and the current authentication and key agreement process ends.
  • Step 814 The user terminal obtains a first security parameter, where the first security parameter includes the security token or / and a first root key.
  • the user terminal obtains the first security parameter, where the first security parameter includes the security token or / and the first root key, and specific implementation manners include:
  • the authentication and key negotiation success response message further includes the security token, and the user terminal obtains the security token.
  • the user terminal uses the same root key generation method as the registration server, and generates a first root key based on the first encryption key CK or / and the first integrity key IK.
  • the registration server uses the second encryption key CK or the second integrity key IK as the second root key in step 811
  • the user terminal uses the first encryption key CK or the first integrity key
  • the key IK is used as the first key.
  • the registration server combines the second encryption key CK or / and the second integrity key IK or / and the fourth fixed character string (2) to generate a second key in step 811
  • the user The terminal combines the first encryption key CK or / and the first integrity key IK or / and the fourth fixed character string (1) to generate a first root key.
  • the registration server is based on including the second encryption key CK or / and the second integrity key IK and including the fourth fixed character string (2) or / and the fourth random character string or / Generate a second root key with the fourth time stamp or / and the information of the mobile user identity
  • the user terminal is based on including the first encryption key CK or / and the first integrity key IK and including a fourth fixed character String (1) or / and a fourth random string or / and a fourth timestamp or / and information of the mobile user identifier to generate a first root key;
  • the fourth fixed character string (1) is on the user terminal A pre-configured string that is the same as the value of the fourth fixed string (2) used when generating the second key on the registration server; the fourth random string or / and the fourth timestamp are from the registration server Obtained from the authentication and key negotiation success response message sent.
  • the values of the first encryption key CK and the first integrity key IK obtained from the user terminal are the same as the values of the second encryption key CK and the second integrity key IK obtained from the registration server, and because the values of the root key The generation methods are the same. Therefore, the value of the first root key generated on the user terminal and the second key generated on the registration server are the same.
  • the user terminal is based on the mobile user identity, mobile user key (K), and related AKA algorithms stored in the user identification module SIM, and the registration server is based on the mobile user identity
  • the user key (K) and related AKA algorithm are obtained through the authentication and key negotiation process between the user terminal and the registration server, and the first security parameter and the second security parameter are obtained respectively, which can be used in the subsequent process by the user terminal and the registration server Security certification.
  • FIG. 9 shows a flowchart of Embodiment 2 of the authentication and key negotiation process provided by the present invention.
  • the process is based on the authentication and key negotiation mechanism being 5G.
  • This process is implemented by the AKA mechanism.
  • This process can be used in the implementation environment shown in Figure 1, where the user data system is a unified data management UDM. This process can include the following steps:
  • Step 901 The user terminal starts an authentication and key negotiation process.
  • the user terminal After obtaining the operation instruction for authentication and key negotiation, the user terminal starts the authentication and key negotiation process.
  • Step 902 The user terminal obtains a mobile user identity.
  • the subscriber identity module SIM used is a USIM card, and the mobile subscriber identity obtained on the USIM is SUPI.
  • the mobile user ID and the mobile user ID obtained in the process of the client security authentication process embodiment are the same ID.
  • Step 903 The user terminal sends an authentication and key agreement request to the registration server, and the authentication and key agreement request includes the mobile user identity.
  • the user terminal sends an authentication and key agreement request to the registration server, and the authentication and key agreement request includes the SUPI.
  • the SUPI is encrypted to generate a SUCI
  • the SUCI is used as a mobile user identifier in the authentication and key agreement request, that is, the user terminal sends an authentication and key agreement request to the registration server, and the authentication and key agreement is performed during the authentication and key agreement.
  • the SUCI was included in the request.
  • the registration server receives the authentication and key agreement request sent by the user terminal.
  • Step 904. The registration server sends an authentication request to the unified data management UDM, where the authentication request includes the mobile user identity.
  • the registration server obtains a mobile user identity from the authentication and key agreement request sent by the user terminal, and the mobile user identity is a user permanent identity SUPI or a user hidden identity SUCI.
  • the registration server sends a Nudm_Authentication_Get authentication request message to the unified data management UDM.
  • the authentication request message includes the user's permanent identifier SUPI or the user's hidden identifier SUCI and the service network name (SN name).
  • the service network name is the service network name of the registration server.
  • the registration server may send an authentication request message to the corresponding home user server HSS or unified
  • the data management UDM determines whether the authentication request message is to be sent to the home user server HSS or the unified data management UDM according to the type or scope of the mobile user identity in the authentication and key agreement request.
  • Step 905. The registration server receives an authentication response message fed back by the unified data management UDM.
  • the authentication response message includes a random number RAND, an authentication token AUTN, an expected response value XRES *, and a second key KAUSF.
  • the unified data management UDM After the unified data management UDM receives the authentication request from the registration server, the unified data management UDM returns an authentication vector AV * to the registration server, which includes the random number RAND, the authentication token AUTN, the expected response value XRES *, and the second secret Key KAUSF.
  • the unified data management UDM After the unified data management UDM receives the authentication request message of the registration server, the unified data management UDM returns a Nudm_Authenticate_Get response message to the registration server.
  • the Nudm_Authenticate_Get response message includes a 5G HE AV, which includes a random number RAND, an authentication token AUTN, an expected response value XRES *, and a second key KAUSF.
  • the returned Nud_Authenticate_Get response message also includes the user's permanent identity SUPI obtained by decrypting the user's hidden identity SUCI, and decrypting the The user permanent identity SUPI is used as the mobile user identity in the subsequent steps.
  • the registration server obtains a random number RAND, an authentication token AUTN, an expected response value XRES *, and a second key KAUSF from the authentication response message.
  • Step 906 The registration server sends an authentication and key agreement challenge message to the user terminal, where the authentication and key agreement challenge message includes the random number RAND and the authentication token AUTN.
  • the registration server retains the expected response value XRES * and the key KAUSF, and sends an authentication and key agreement challenge message to the user terminal.
  • the authentication and key agreement challenge message includes the random number RAND and the authentication token AUTN.
  • the user terminal receives the authentication and key agreement challenge message sent by the registration server, and obtains the random number RAND and the authentication token AUTN from it.
  • Step 907 The user terminal sends an authentication request to the user identification module SIM, where the authentication request includes the random number RAND and the authentication token AUTN.
  • the user terminal sends an authentication request to the user identification module SIM (for example, by sending an APDU command AUTHENTICATE), and the parameters are the random number RAND and the authentication token AUTN.
  • Step 908 The user terminal receives a return value of the user identification module SIM, where the return value includes an expected response value RES, a first encryption key CK, and a first integrity key IK.
  • the user identification module SIM After the user identification module SIM receives the authentication request sent by the user terminal, the user identification module SIM sends a return value to the user terminal after the authentication calculation.
  • the return value includes the expected response value RES, the first encryption key CK, and the first The integrity key IK, the user terminal receives the return value.
  • Step 909 The user terminal sends an authentication and key agreement challenge response message to the registration server.
  • the authentication and key agreement challenge response message includes an expected response value RES *, and the expected response value RES * is generated based on the expected response value RES. .
  • the user terminal follows the method used in the "RES * and XRES * derived functions" in TS33.501 Annex A.4, that is, the expected response value RES * is generated in the same way as the unified data management UDM generates the expected response value XRES *.
  • a hash algorithm (such as SHA256) can also be used to hash the expected response value RES * and only send the expected response value RES * via The hash value generated after the hash calculation, without sending the plaintext of the expected response value RES *.
  • the registration server receives the expected response value RES * or the hash value of the expected response value RES * sent by the user terminal.
  • Step 910 The registration server verifies the expected response value RES * based on the expected response value XRES *; if the verification is valid, step 911 is performed.
  • the registration server obtains the expected response value RES * or the hash value of the expected response value RES * from the received authentication and key challenge response message, and the registration server verifies the expected response value XRES * locally. If the verification is valid, the following step 911 is performed; if the verification is not valid, an authentication and key agreement response message is sent to the user terminal, and the authentication and key agreement response message is an authentication and key agreement failure response message, and the following is performed Step 913.
  • the plain text of the expected response value RES * is sent to the registration server, it is compared whether the expected response value XRES * and the expected response value RES * are consistent; if they are consistent, it is determined that the verification is valid; if they are not consistent, it is determined that the verification is invalid.
  • the expected response value XRES * is calculated using the same hash calculation method to generate a hash value, and whether the two hash values are consistent is compared; If they are consistent, the verification is valid; if they are not consistent, the verification is invalid.
  • Step 911 The registration server generates a second security parameter, where the second security parameter includes a security token or / and a second root key, and establishes a correspondence between the second security parameter and the mobile user identity.
  • the registration server generates a second security parameter, the second security parameter includes a security token or / and a second root key, and establishes a correspondence between the second security parameter and the mobile user identity.
  • the implementation includes:
  • the registration server generates a security token, and establishes a correspondence between the security token and a mobile user identity.
  • the registration server generates a security token, and establishes a correspondence between the security token and the mobile user identity, so that the mobile user identity can be obtained according to the security token.
  • the registration server generates a security token, which is a globally unique security token and has sufficient length and sufficient randomness, making it difficult to guess and crack.
  • a corresponding relationship between the security token and the mobile user identity is established, so that the corresponding mobile user identity can be obtained in the corresponding relationship according to the security token.
  • the registration server uses a symmetric encryption algorithm to encrypt the information including the mobile user identity based on a preset key, and uses the encrypted ciphertext as a security token, so that the registration server obtains the mobile after decrypting the security token.
  • the registration server In a second implementation manner, the registration server generates a second root key based on the second key KAUSF, and establishes a correspondence between the mobile user identity and the second root key.
  • the second key KAUSF is used as the second root key.
  • a second root key is generated based on information including the second key KAUSF and a fourth fixed character string (2) or / and a fourth random character string or / and a fourth time stamp or / and the mobile user identity.
  • the fourth fixed character string (2) is a character string that is pre-configured and has the same value as the fourth fixed character string (1) that is pre-configured on the user terminal, and the fourth random character string is randomly generated locally
  • the fourth timestamp is generated by obtaining the current system time of the registration server.
  • DK PBKDF2 (passphrase, Salt, c, dkLen), where: DK is the second key generated, PBKDF2 is the key derivation algorithm, passphrase is the second key KAUSF and the fourth fixed string (2) or / and The fourth random string or / and the fourth timestamp or / and the combination of the mobile user identifier; Salt is the salt value, in this case a fixed string; c is the number of iterations; dlLen is the key output Length, which can be generated as required.
  • the correspondence between the mobile user identity and the second root key is established on the registration server, so that the registration server will be able to find and obtain the second root key in the correspondence relationship according to the mobile user identity.
  • the second root key generated this time is used to replace the corresponding second root key that the mobile user identity has stored.
  • first embodiment and the second embodiment may be applied separately or simultaneously.
  • step 912 the registration server sends an authentication and key negotiation success response message to the user terminal, which is not limited in this embodiment of the present invention.
  • Step 912 The registration server sends an authentication and key agreement response message to the user terminal, where the authentication and key agreement response message is an authentication and key agreement success response message.
  • the authentication and key negotiation success response message also includes the security token.
  • the authentication and key agreement success response message also includes the fourth random character string or / and the Fourth timestamp.
  • Step 913 The user terminal receives the authentication and key agreement response message sent by the registration server and performs a corresponding operation.
  • the user terminal receives an authentication and key agreement response message sent by the registration server, and the authentication and key agreement response message includes an authentication and key agreement success response message or an authentication and key agreement failure response message.
  • the user terminal performs corresponding operations according to the authentication and key agreement response message, including:
  • the user terminal executes the following step 914.
  • authentication and key agreement response message is an authentication and key agreement failure response message, the following steps are not performed, and the current authentication and key agreement process ends.
  • Step 914 The user terminal obtains a first security parameter, where the first security parameter includes the security token or / and a first root key.
  • the user terminal obtains the first security parameter, where the first security parameter includes the security token or / and the first root key, and specifically includes:
  • the authentication and key negotiation success response message further includes the security token, and the user terminal obtains the security token.
  • the user terminal uses the same root key generation method as the registration server to generate a first root key based on the first key KAUSF, and the first key KAUSF is based on the first encryption key CK or / And the first integrity key IK generates a first key KAUSF.
  • the user terminal follows the method used in the "KAUSF derived function" in TS33.501 Annex A.2, that is, the first key KAUSF is generated in the same way as the second key KAUSF generated by the unified data management UDM, and then based on the first secret The key KAUSF generates the first key.
  • the registration server uses the second key KAUSF as the second root key in step 911
  • the user terminal uses the first key KAUSF as the first root key.
  • the registration server is based on the second key KAUSF and the fourth fixed character string (2) or / and the fourth random character string or / and the fourth timestamp or / and the mobile user identity Information to generate a second root key
  • the user terminal is based on including the first key KAUSF and a fourth fixed character string (1) or / and a fourth random character string or / and a fourth time stamp or / and the mobile user identity
  • the first fixed key is generated by the information; wherein the fourth fixed character string (1) is pre-configured on the user terminal and is the fourth fixed character string (2) used when generating the second key on the registration server.
  • the fourth random string or / and the fourth timestamp are obtained from the authentication and key agreement success response message sent by the registration server.
  • the value of the first key KAUSF generated on the user terminal is the same as the value of the second key KAUSF obtained from the registration server, and because the root key is generated in the same way, the first root key generated on the user terminal and The value of the second root key generated on the registration server is the same.
  • the present invention also provides a client registration device, which is applied to a user terminal running a third-party application client, and includes: a memory, a processor, and a memory stored on the memory.
  • a client registration program running on the processor may be implemented. When the client registration program is executed by the processor, the steps of the client registration method described above are implemented.
  • the present invention also provides a client registration device.
  • the client registration device is applied to a registration server and includes a memory, a processor, and a memory that can be stored on the processor.
  • a running client registration program that implements the steps of the client registration method described above when the client registration program is executed by the processor.
  • the present invention also provides a client registration system
  • the client registration system includes: a user terminal and a registration server;
  • the user terminal includes the client registration device applied to a user terminal running a third-party application client;
  • the registration server includes the above-mentioned client registration device applied to the registration server.
  • the present invention also provides a storage medium for client registration, which is characterized in that a program is stored in the storage medium, and the program is used for implementing the above-mentioned application running a third-party application.
  • Client registration method in the user terminal of the client.
  • the present invention also provides a storage medium for client registration, which is characterized in that a program is stored in the storage medium, and the program is used to implement the client including the application to the registration server. Registration method.
  • the methods, devices, and systems of the present invention can be implemented in many ways.
  • the methods and systems of the present invention can be implemented by software, hardware, firmware or any combination of software, hardware, firmware.
  • the above-mentioned order of the steps of the method is merely for the purpose of illustration, and the steps of the method of the present invention are not limited to the order specifically described above, unless specifically stated otherwise.
  • the present invention can also be implemented as programs recorded in a recording medium, which programs include machine-readable instructions for implementing the method according to the present invention.
  • the present invention also covers a recording medium storing a program for executing the method according to the present invention.
  • the invention realizes the provision of a secure registration environment for a third-party application client running in a user terminal, and can further automatically obtain registration information including a user ID, a user key, or a user token for the third-party application client. , Thereby solving the technical problems of existing third-party application clients in the process of registering accounts, negotiating shared keys, obtaining user tokens, user identity authentication, etc., which are cumbersome and affect the user experience. The entire process does not require user input or only A small amount of input information improves the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种客户端注册方法、装置及系统。所述方法包括：用户终端基于用户识别模块SIM中的移动用户标识和密钥，以及注册服务器基于用户数据系统中相同的移动用户标识和密钥，经过用户终端和注册服务器间的认证与密钥协商，为用户终端及在用户终端中运行的第三方应用客户端的注册提供了安全认证，同时还为第三方应用客户端提供了第三方用户标识、用户密钥或用户令牌，从而可以为第三方应用客户端实现快捷、安全的身份认证、数据加密等操作，由于无需用户输入账号、口令或密钥等，极大提升了用户的使用体验。

Description

客户端注册方法、装置及系统 技术领域
本发明涉及通信技术领域和互联网技术领域，尤其涉及客户端注册方法、装置及系统。
 背景技术
用于3G以上网络的全球用户识别模块（USIM，Universal Subscriber Identity Module）和用于IMS网络的IP多媒体服务识别模块（IP multimedia services identity module, ISIM），是通信运营商用于鉴别签约用户的身份、符合3GPP标准规范的IC集成电路设备。
eSIM作为一种嵌入式SIM卡，实质上是将SIM卡上的用户数据和加密信息由原来存储在物理SIM卡转移到用户终端设备本身的另一个硬件载体上；软SIM是通过纯软件方式代替物理SIM卡实现SIM的功能，同样安全地存储有用户数据和密钥信息。
无论是哪一种SIM卡类型，SIM卡里都存储有签约用户的用户标识和密钥信息，为了表述方便，对于上述存储有移动通信网络签约用户的身份标识和密钥信息的模块统称为“用户识别模块SIM”。相应地，归属用户服务器HSS（home subscriber server，归属用户服务器）和统一数据管理（unified data management，UDM）是移动通信网络的用户数据系统，里面存储了与用户识别模块SIM中对应的移动用户标识和密钥信息。
 技术问题
随着智能终端（如移动智能手机）的广泛使用，用户在智能终端上会安装有大量的第三方应用客户端，而第三方应用客户端在使用时，往往需要获取终端用户的必要信息之后才能正常使用，而这些必要的信息通常是需要终端用户手工输入或预先配置的，例如输入账号及相应的口令、预先配置密钥等，但这些操作都较为烦琐和影响用户的使用体验。
 技术解决方案
本发明的主要目的在于提供一种客户端注册的方法、装置及系统，旨在提供一种为用户终端中运行的第三方应用客户端能安全、自动地获取注册信息的方法、装置及系统，从而能为第三方应用客户端自动获取包括用户标识、用户密钥、用户令牌等在内的注册信息，进而解决现有第三方应用客户端在注册账号、协商共享密钥、获取用户令牌、用户身份认证等过程中使用较为烦琐从而影响用户使用体验的技术问题。
为达到上述目的，本发明提供了以下技术方案：
第一方面，提供了一种客户端注册方法，应用于运行有第三方应用客户端的用户终端中，所述方法包括：
基于用户识别模块SIM与注册服务器进行认证与密钥协商，其中包括向所述注册服务器发送移动用户标识和获得第一安全参数，所述第一安全参数包括安全令牌或/和第一根密钥，所述移动用户标识为所述用户识别模块SIM的标识；
基于所述第一安全参数与所述注册服务器进行安全认证；
在所述安全认证成功之后，接收所述注册服务器提供的注册信息和服务。
优选的，所述基于用户识别模块SIM与注册服务器进行认证与密钥协商包括：
从所述用户识别模块SIM获取所述移动用户标识；
向所述注册服务器发送认证与密钥协商请求，所述认证与密钥协商请求包括所述移动用户标识；
接收所述注册服务器发送的认证与密钥协商挑战消息，所述认证与密钥协商挑战消息包括随机数RAND和鉴权令牌AUTN；
向所述用户识别模块SIM发送鉴权请求，所述鉴权请求包括所述随机数RAND和所述鉴权令牌AUTN；
接收所述用户识别模块SIM的返回值，所述返回值包括期望响应值RES、第一加密密钥CK和第一完整性密钥IK；
向所述注册服务器发送认证与密钥协商挑战应答消息，所述认证与密钥协商挑战应答消息包括第一期望响应值，所述第一期望响应值是基于所述期望响应值RES生成的；
接收所述注册服务器发送的认证与密钥协商成功应答消息，所述认证与密钥协商成功应答消息是在所述注册服务器验证所述第一期望响应值有效之后发送的；
获得第一安全参数，所述第一安全参数包括安全令牌或/和第一根密钥，具体包括：
所述认证与密钥协商成功应答消息中包括所述安全令牌，从所述认证与密钥协商成功应答消息中获取所述安全令牌；或/和，
基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成所述第一根密钥，并且所述第一根密钥的生成方式与所述注册服务器生成第二根密钥的生成方式一致。
优选的，所述基于用户识别模块SIM与注册服务器进行认证与密钥协商是基于3G/4G AKA机制的，则：
所述用户识别模块SIM为全球用户识别模块USIM，所述移动用户标识为国际移动用户识别码IMSI；或者，所述用户识别模块SIM为IP多媒体服务识别模块ISIM，所述移动用户标识为IP多媒体私有标识IMPI；
所述第一期望响应值为所述期望响应值RES；或者，所述第一期望响应值为对所述期望响应值RES哈希计算后所生成的哈希值。
优选的，所述基于用户识别模块SIM与注册服务器进行认证与密钥协商是基于5G AKA机制的，则：
所述用户识别模块SIM为全球用户识别模块USIM，所述移动用户标识为用户永久标识SUPI；
所述基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成所述第一根密钥包括：基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成第一密钥KAUSF，并且基于所述第一密钥KAUSF生成所述第一根密钥；
所述第一期望响应值为期望响应值RES*，所述期望响应值RES*是基于所述期望响应值RES生成的；或者，所述第一期望响应值为对所述期望响应值RES*哈希计算后所生成的哈希值。
优选的，所述向所述注册服务器发送认证与密钥协商请求包括：
将所述用户永久标识SUPI加密生成用户隐藏标识SUCI；
在所述向所述注册服务器发送的认证与密钥协商请求中，将所述用户隐藏标识SUCI作为所述移动用户标识。
优选的，若所述第一安全参数包括安全令牌，则所述基于所述第一安全参数与所述注册服务器进行安全认证包括：
向所述注册服务器发送安全认证请求，所述安全认证请求包括所述安全令牌；
若所述注册服务器验证所述安全令牌有效，则确定安全认证成功。
优选的，若所述第一安全参数包括第一根密钥，则所述基于所述第一安全参数与所述注册服务器进行安全认证包括：
基于所述第一根密钥生成第一认证密钥；
生成第一验证信息，并且使得所述第一验证信息与所述注册服务器生成的第二验证信息的值相同；
基于所述第一认证密钥和所述第一验证信息加密生成第一加密值；
将所述移动用户标识和所述第一加密值发送给所述注册服务器；
若所述注册服务器验证所述第一加密值有效，则确定安全认证成功。
优选的，若向所述注册服务器传递了第三方应用标识以及若所述安全认证成功，则所述接收所述注册服务器提供的注册信息和服务包括：
接收所述注册服务器发送的第三方用户标识，所述第三方用户标识用于在所述第三方应用客户端中标识用户身份；或者，
接收所述注册服务器发送的用户令牌，所述用户令牌用于所述第三方应用客户端访问对应第三方应用服务器的认证鉴权。
优选的，所述向所述注册服务器传递第三方应用标识包括：
在向所述注册服务器发送的安全认证请求中还包括所述第三方应用标识；或者，
若使用对称加密算法基于所述第一认证密钥对包括所述第一验证信息的信息对称加密生成所述第一加密值，则在生成所述第一验证信息的信息中还包括所述第三方应用标识，以使得所述注册服务器从对所述第一加密值解密后的明文中获取所述第三方应用标识。
优选的，若所述第一安全参数包括所述第一根密钥，并且若接收到所述注册服务器发送的第三方用户标识，则在所述接收所述注册服务器提供的注册信息和服务之后，还包括：
基于所述第一根密钥生成第一用户密钥，所述第一用户密钥的生成方式与所述注册服务器生成第二用户密钥的生成方式一致，所述第一用户密钥用于在所述第三方应用客户端中作为所述第三方用户标识的密钥。
优选的，在若向所述注册服务器传递了第三方应用标识以及若所述安全认证成功之后，以及在所述接收所述注册服务器提供的注册信息和服务之前，还包括：
接收所述注册服务器发送的应用授权请求消息；
显示应用授权验证界面；
接收终端用户在所述应用授权验证界面中输入的授权信息；
若所述授权信息表示确认授权，则向所述注册服务器发送应用授权应答消息，所述应用授权应答消息为应用授权确认消息。
 
第二方面，提供了一种客户端注册方法，应用于注册服务器中，所述方法包括：
接收用户终端（1）发起的认证与密钥协商，基于用户数据系统进行所述认证与密钥协商，其中包括生成第二安全参数并且建立所述第二安全参数与移动用户标识（1）的对应关系，所述第二安全参数包括安全令牌（1）或/和第二根密钥（1），所述移动用户标识（1）为所述用户终端（1）发送的；
接收用户终端（2）发起的安全认证，基于所述对应关系进行所述安全认证，其中包括获取所述用户终端（2）对应的移动用户标识（2）；
在所述安全认证成功之后，向所述用户终端（2）提供注册信息和服务。
优选的，所述基于用户数据系统进行所述认证与密钥协商包括：
接收所述用户终端（1）发送的认证与密钥协商请求，所述认证与密钥协商请求包括所述移动用户标识（1）；
向用户数据系统发送认证请求，所述认证请求包括所述移动用户标识（1）；
接收所述用户数据系统反馈的认证应答消息，所述认证应答消息包括随机数RAND、鉴权令牌AUTN、初始密钥及第二期望响应值；
向所述用户终端发送认证与密钥协商挑战消息，所述认证与密钥协商挑战消息包括所述随机数RAND和所述鉴权令牌AUTN；
接收所述用户终端发送的认证与密钥协商挑战应答消息，所述认证与密钥协商挑战应答消息包括第一期望响应值；
基于所述第二期望响应值验证所述第一期望响应值；
若验证所述第一期望响应值有效，则生成第二安全参数，并且建立所述第二安全参数与所述移动用户标识（1）的对应关系；
向所述用户终端（1）发送认证与密钥协商成功应答消息；
其中，所述第二安全参数包括安全令牌（1）或/和第二根密钥（1），具体包括：
生成所述安全令牌（1），在所述认证与密钥协商成功应答消息中包括所述安全令牌（1）；或/和，
基于所述初始密钥生成所述第二根密钥（1），并且所述第二根密钥（1）的生成方式与所述用户终端生成所述第一根密钥的生成方式一致。
优选的，所述基于所述第二期望响应值验证所述第一期望响应值包括：
所述第一期望响应值为明文，比较所述第二期望响应值与所述第一期望响应值是否一致，若一致则确定所述第一期望响应值有效；或者，
所述第一期望响应值为哈希计算后的哈希值，将所述第二期望响应值使用相同的哈希计算方式计算生成哈希值，并且比较两个哈希值是否一致，若一致则确定所述第一期望响应值有效。
优选的，所述生成所述安全令牌（1）包括：
使用随机生成的全局唯一字符串作为所述安全令牌（1），并且建立所述安全令牌（1）与所述移动用户标识（1）的对应关系；或者，
使用对称加密算法基于预置密钥将包括所述移动用户标识（1）的信息加密，将加密后得到的密文作为所述安全令牌（1）。
优选的，所述基于用户数据系统与用户终端进行认证与密钥协商是基于3G/4G AKA机制的，则：
所述移动用户标识（1）为国际移动用户识别码IMSI或者是IP多媒体私有标识IMPI；
所述用户数据系统为归属用户服务器HSS：
所述认证应答消息包括所述随机数RAND、所述鉴权令牌AUTN、第二加密密钥CK或/和第二完整性密钥IK以及期望响应值XRES；
所述初始密钥为所述第二加密密钥CK或/和所述第二完整性密钥IK；
所述第二期望响应值为所述期望响应值XRES；
所述认证与密钥协商挑战应答消息中包括的第一期望响应值为期望响应值RES；或者，所述认证与密钥协商挑战应答消息中包括的第一期望响应值为对所述期望响应值RES哈希计算后所生成的哈希值。
优选的，所述基于用户数据系统与用户终端进行认证与密钥协商是基于5G AKA机制的，则：
所述移动用户标识（1）为用户永久标识SUPI或用户隐藏标识SUCI；
所述用户数据系统为统一数据管理UDM；
所述认证应答消息包括所述随机数RAND、所述鉴权令牌AUTN、第二密钥KAUSF以及期望响应值XRES；
若所述移动用户标识（1）为用户隐藏标识SUCI，则所述认证应答消息中还包括对所述用户隐藏标识SUCI解密后得到的用户永久标识SUPI，并将所述解密后的用户永久标识SUPI作为所述移动用户标识（1）；
所述初始密钥为所述第二密钥KAUSF；
所述第二期望响应值为所述期望响应值XRES*；
所述认证与密钥协商挑战应答消息中包括的第一期望响应值为期望响应值RES*；或者，所述认证与密钥协商挑战应答消息中包括的第一期望响应值为对所述期望响应值RES*哈希计算后所生成的哈希值。
优选的，若所述第二安全参数包括安全令牌（1），则所述基于所述对应关系进行所述安全认证包括：
接收所述用户终端（2）发送的安全认证请求，所述安全认证请求包括安全令牌（2）；
若验证所述安全令牌（2）有效并获取到所述用户终端（2）对应的移动用户标识（2），则确定安全认证成功。
优选的，若所述第二安全参数包括第二根密钥（1），则所述基于所述第二安全参数与所述注册服务器进行安全认证包括：
接收所述用户终端（2）发送的移动用户标识（2）和第一加密值；
根据所述移动用户标识（2）获取对应的第二根密钥（2）；
基于所述第二根密钥（2）生成第二认证密钥；
生成第二验证信息，并且使得所述第二验证信息与所述用户终端生成的第一验证信息的值相同；
基于所述第二认证密钥和所述第二验证信息验证所述第一加密值；
若所述第一加密值验证成功，则确定安全认证成功。
优选的，若接收到所述用户终端（2）传递的第三方应用标识以及所述安全认证成功之后，则所述向所述用户终端（2）提供注册信息和服务包括：
获取所述第三方应用标识对应的第三方用户标识，向所述用户终端（2）提供注册信息和服务中包括所述第三方用户标识，以使得所述第三方用户标识用于在所述第三方应用标识对应的第三方应用客户端中标识用户身份；或者，
生成所述第三方应用标识对应的用户令牌，所述用户令牌为用于所述第三方应用客户端访问对应第三方应用服务器的认证鉴权，向所述用户终端（2）提供注册信息和服务中包括所述用户令牌，以使得所述用户令牌用于在所述第三方应用标识对应的第三方应用客户端中访问对应第三方应用服务器的认证鉴权。
优选的，所述获取所述第三方应用标识对应的第三方用户标识包括：
根据所述移动用户标识（2）和所述第三方应用标识查找对应的第三方用户标识；
若查找到对应的第三方用户标识，则确定所述第三方用户标识为所述查找到的对应的第三方用户标识；
若没有查找到对应的第三方用户标识，则创建一个唯一的第三方用户标识，并且建立和存储所述移动用户标识（2）和所述第三方应用标识与所述创建的第三方用户标识的对应关系，以使得根据所述移动用户标识和所述第三方应用标识能查找到所述创建的第三方用户标识，并确定所述第三方用户标识为所述创建的第三方用户标识。
优选的，若所述移动用户标识（2）有对应的第二根密钥（2），则所述获取所述第三方应用标识对应的第三方用户标识之后还包括：
基于所述第二根密钥（2）生成第二用户密钥，所述第二用户密钥的生成方式与所述用户终端生成第一用户密钥的生成方式一致；
建立所述第三方用户标识与所述第二用户密钥的对应关系。
优选的，在若接收到所述用户终端（2）传递的第三方应用标识以及所述安全认证成功之后，以及向所述用户终端（2）提供注册信息和服务之前，还包括：
向所述用户终端发送应用授权请求消息，所述应用授权请求消息包括第三方应用名称或/和移动用户名称，所述第三方应用名称是根据所述第三方应用标识获取的，所述移动用户名称是根据所述移动用户标识获取的；
接收所述用户终端发送的应用授权应答消息；
若所述应用授权应答消息为应用授权确认消息，则执行向所述用户终端（2）提供注册信息和服务的步骤。
 
第三方面，提供了一种客户端注册装置，其特征在于，所述客户端注册装置应用于运行有第三方应用客户端的用户终端中，包括：存储器、处理器，所述处理器用于运行所述存储器所存储的程序，所述程序运行时执行包括上述中应用于运行有第三方应用客户端的用户终端中任一项所述的方法。
提供一种客户端注册装置，其特征在于，所述客户端注册装置应用于注册服务器，包括：存储器、处理器，所述处理器用于运行所述存储器所存储的程序，所述程序运行时执行包括上述应用于注册服务器中任一项所述的方法。
提供一种客户端注册系统，其特征在于，所述客户端注册系统包括：用户终端以及注册服务器；所述用户终端包括上述应用于运行有第三方应用客户端的用户终端的客户端注册装置；所述注册服务器包括上述应用于注册服务器的客户端注册装置。
提供一种存储介质，其特征在于，所述存储介质中存储有程序，所述程序用于实现包括上述应用于运行有第三方应用客户端的用户终端中的任一项所述方法。
提供一种存储介质，其特征在于，所述存储介质中存储有程序，所述程序用于实现包括上述应用于注册服务器中的任一项所述方法。
 有益效果
本发明实现了为在用户终端中运行的第三方应用客户端提供了安全的注册环境，进而能为第三方应用客户端自动获取包括用户标识、用户密钥或用户令牌等在内的注册信息，进而解决现有第三方应用客户端在注册账号、协商共享密钥、获取用户令牌、用户身份认证等过程中使用较为烦琐从而影响用户使用体验的技术问题，整个过程不需要用户输入或仅少量输入信息，提升了用户的使用体验。
 附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1是本发明实施例提供的一种实施环境结构示意图；
图2是本发明提供的客户端注册方法实施例的流程示意图；
图3是本发明提供的客户端安全认证过程实施例一的流程示意图；
图4是本发明提供的客户端安全认证过程实施例二的流程示意图；
图5是本发明提供的客户端注册信息提供过程实施例一的流程示意图；
图6是本发明提供的客户端注册信息提供过程实施例二的流程示意图；
图7是本发明提供的客户端注册信息提供过程实施例三的流程示意图；
图8是本发明提供的认证与密钥协商过程实施例一的流程示意图；
图9是本发明提供的认证与密钥协商过程实施例二的流程示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
 本发明的最佳实施方式
在此处键入本发明的最佳实施方式描述段落。
 本发明的实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
一、相关名词术语
为了便于理解，对本文中涉及的一些名词作介绍和说明。
移动用户标识：用于唯一识别用户识别模块SIM的标识，移动用户标识包括：国际移动用户识别码（international mobile subscriber identification number，IMSI），或者IP多媒体私有标识（IP multimedia private identity, IMPI），或者用户永久标识（5G subscription permanent identifier，SUPI），或者对用户永久标识SUPI加密后的结果即用户隐藏标识（SUbscription concealed identifier, SUCI）。
第三方应用标识：第三方应用标识用于唯一地标识第三方应用客户端，以及用于标识该第三方应用客户端对应的第三方应用服务器。
签名加密算法：指用于加密地核实信息真实性的加密算法，只有信息的发送者才能产生的别人无法伪造的一段数字串，这段数字串同时也是对信息的发送者发送信息真实性的一个有效证明，例如消息认证码（诸如基于哈希的消息认证码HMAC、密码分组链接消息认证码CBC-MAC、伽罗瓦消息认证码GMAC等）、含密钥加密的哈希函数、基于RSA的数字方案（诸如RSA-PSS）、数字签名算法（DSA）和椭圆曲线数字签名算法等。
对称加密算法：指加密和解密使用相同密钥的加密算法，例如三重数据加密标准（Triple Data Encryption Standard，DES）、高级加密标准（Advanced Encryption Standard，AES）等。
认证与密钥协商机制：英文简称为AKA（authentication and key agreement，AKA），基于挑战应答机制，完成终端用户和移动通信网络间的身份认证，同时基于身份认证对通信加密密钥进行协商。当前，通常将用于3G/4G移动通信网络的认证与密钥协商机制称为AKA，而将用于5G移动通信网络的认证与密钥协商机制称为5G AKA，为了加以区分和避免混淆，在本发明实施例中，将用于3G/4G移动通信网络的认证与密钥协商机制称为3G/4G AKA，将用于5G移动通信网络的认证与密钥协商机制称为5G AKA，如无特别说明，认证与密钥协商机制包括3G/4G AKA和5G AKA。
用户数据系统：在移动通信网络中用于存储移动用户标识、移动用户密钥（K）、AKA相关算法并对终端用户进行身份认证等的系统，具体包括归属用户服务器（home subscriber server，HSS）和统一数据管理（unified data management，UDM）。
用户识别模块SIM：用于为终端用户存储包括移动用户标识、移动用户密钥（K）、归属网络、AKA相关算法等的应用，终端用户基于用户识别模块SIM实现向移动通信网络的身份认证，具体包括全球用户识别模块（universal subscriber identity module, USIM）和IP多媒体服务识别模块（IP multimedia services identity module, ISIM）。
令牌：用于安全认证或访问受保护资源的凭据，通常是一个字符串。基于令牌可用于安全认证或访问受保护资源的不同，在本发明各实施例中，将令牌区分为安全令牌、用户令牌等。
二、实施环境结构示意图
请参考图1，其示出了本发明实施例提供的客户端注册方法所涉及的一种实施环境的结构示意图。该实施环境包括注册服务器、用户终端、第三方应用客户端。
注册服务器：与用户终端通过网络相连，用于接收并执行用户终端的认证与密钥协商请求、以及接收并执行用户终端的客户端注册请求；与用户数据系统通过网络相连，用于向用户数据系统发送移动用户认证请求和获取请求结果，该用户数据系统包括归属用户服务器（home subscriber server，HSS）或/和统一数据管理（unified data management，UDM）。注册服务器通常由通信运营服务商提供。
用户终端：用户终端通过WLAN（包括wifi）、移动数据、LAN、固定宽带等有线或无线方式接入网络并与注册服务器进行数据连接。用户终端是可插入、内嵌或者外部连接有用户识别模块SIM并且支持对用户识别模块SIM读取的智能终端设备，通常是智能手机，也可以是智能电视、机顶盒、平板电脑、便携计算机、台式计算机、智能手表等。
第三方应用客户端：运行在用户终端的操作系统中的应用程序，由第三方应用服务商提供。
可以理解的是，在实际实施环境中，可以包括有多个或大量的用户终端，每个用户终端中可以运行多个由不同第三方应用服务商提供的第三方应用客户端，每个第三方应用客户端可以连接访问对应的第三方应用服务器，从而获取所需业务应用数据和服务。
需要说明的是，在实际实施环境中，还应当有第三方应用服务器。第三方应用服务器由第三方应用服务商提供，用于和对应的第三方应用客户端通过网络相连，向用户提供所需的应用服务，例如资讯、购物、社交等；用于和注册服务器通过网络相连，向注册服务器获取或验证第三方应用客户端的注册信息，例如第三方用户标识、用户密钥、用户令牌等信息。
本领域技术人员可以理解，图1中示出的实施环境结构并不构成对实施环境的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
三、客户端注册方法实施例
请参考图2，其示出了本发明提供的客户端注册方法实施例的流程图，该方法可用于图1所示的实施环境中。该方法可以包括如下几个步骤：
步骤201.用户终端与注册服务器进行认证与密钥协商。
用户终端连接的用户识别模块SIM中存储有移动用户标识、移动用户密钥（K）和AKA相关算法，相应的，在注册服务器连接的用户数据系统中存储有该移动用户标识、该移动用户标识对应的移动用户密钥（K）和AKA相关算法。
因此，用户终端基于用户识别模块SIM、注册服务器基于用户数据系统可以通过认证与密钥协商机制进行认证与密钥协商，其中，若认证与密钥协商成功，则可以协商相应的安全参数，并且建立该安全参数与该移动用户标识的对应关系，以用于后续过程中用户终端与注册服务器间的安全认证，为了区分，在这里将用户终端上的安全参数称为第一安全参数，将注册服务器上的安全参数称为第二安全参数。
安全参数可以包括安全令牌，安全令牌由注册服务器生成并发送给用户终端，根据生成安全令牌的实施方式，建立安全令牌与移动用户标识对应关系的实施方式，可以在注册服务器上建立安全令牌与移动用户标识的对应关系，也可以将移动用户标识加密生成安全令牌，从而都可以使得根据安全令牌能获取到对应的移动用户标识。
安全参数可以包括根密钥，根密钥由用户终端和注册服务器分别使用相同的密钥生成方式生成值相同的根密钥，为了区分，在这里将用户终端上生成的根密钥称为第一根密钥，将注册服务器上生成的根密钥称为第二根密钥。同时在注册服务器上建立移动用户标识与第二根密钥的对应关系，以使得根据移动用户标识能获取到对应的第二根密钥。
具体的，用户终端与注册服务器进行认证与密钥协商可以包括多种实施方式，在认证与密钥协商过程实施例一和认证与密钥协商过程实施例二中，提供了多种用以实现用户终端与注册服务器进行认证与密钥协商的实施方式。
步骤202.用户终端与注册服务器进行安全认证。
在用户终端与注册服务器成功进行了认证与密钥协商之后，基于协商得到的安全参数，用户终端可以向注册服务器进行安全认证。
例如，如果安全参数包括安全令牌，则用户终端以此安全令牌向注册服务器进行安全认证。
又例如，如果安全参数包括根密钥，则由于用户终端上生成了第一根密钥，在注册服务器上存储有值相同的第二根密钥，并且建立了移动用户标识与第二根密钥的对应关系，则用户终端与注册服务器可以基于值相同的根密钥进行安全认证。
具体的，用户终端与注册服务器进行安全认证可以包括多种实施方式，在客户端安全认证过程实施例一至客户端安全认证过程实施例三中，提供了多种用以实现用户终端与注册服务器进行安全认证的实施方式。
步骤203.在安全认证成功之后，注册服务器向用户终端提供注册信息和服务。
在安全认证成功之后，注册服务器可以根据需要向用户终端及运行在用户终端中的第三方应用客户端提供所需的数据和服务，例如可以向用户终端发送注册成功应答消息，或者向用户终端提供第三方应用客户端相关的注册信息和服务等。
相应地，在确定安全认证成功之后，用户终端可以根据需要接收注册服务器所提供的数据和服务，例如可以接收注册服务器发送的注册成功应答消息，或者接收注册服务器提供的第三方应用客户端相关的注册信息和服务等。
具体的，注册服务器向运行在用户终端中的第三方应用客户端提供注册信息可以包括多种实施方式，在客户端注册信息提供过程实施例一至客户端注册信息提供过程实施例三中，提供了多种用以实现为运行在用户终端中的第三方应用客户端提供注册信息的实施方式。
由上可知，本实施例提供的方法，经过用户终端与注册服务器之间的认证与密钥协商和安全认证，为用户终端及在用户终端中运行的第三方应用客户端的注册提供了安全注册环境，在安全认证成功之后，注册服务器向用户终端及运行在用户终端中的第三方应用客户端提供相应的注册信息和服务，整个过程不需要用户输入注册信息，提升了用户的使用体验。
四、客户端安全认证过程实施例一
请参考图3，其示出了本发明提供的客户端安全认证过程实施例一的流程图，该实施例可用于图1所示的实施环境中。该实施例包括：
步骤301.用户终端向注册服务器发送安全认证请求，该安全认证请求包括安全令牌。
在认证与密钥协商过程中，注册服务器为用户终端生成了安全令牌，并且将该安全令牌发送给了用户终端，用户终端获取了该安全令牌。
用户终端向注册服务器发送安全认证请求，并在该安全认证请求中包括该安全令牌，以使得注册服务器能对该安全令牌进行验证。
相应地，注册服务器接收用户终端发送的安全认证请求，以及获取该安全认证请求中的安全令牌。
步骤302.注册服务器验证该安全令牌是否有效，并且获取该用户终端对应的移动用户标识。
与注册服务器在认证与密钥协商过程中生成安全令牌可以包括的多种实施方式相对应的，注册服务器验证该安全令牌需使用相对应的实施方式，具体包括：
第一种实施方式，与注册服务器使用随机生成的全局唯一字符串作为安全令牌的实施方式相对应的，注册服务器在存储的所有安全令牌与移动用户标识的对应关系中查找是否存在该安全令牌，并且查找该安全令牌是否有对应的移动用户标识；若有，则确定该安全令牌有效，并获取该安全令牌对应的移动用户标识，该获取的对应的移动用户标识即为该用户终端对应的移动用户标识；若否，则确定该安全令牌无效。
第二种实施方式，与注册服务器使用对称加密算法基于预置密钥将包括该移动用户标识的信息加密得到的密文作为安全令牌的实施方式相对应的，注册服务器使用相同的对称加密算法和相同的预置密钥对该安全令牌解密，并获取该解密后的明文中的移动用户标识。若能成功解密并获取到移动用户标识，则确定该安全令牌有效，并获取该明文中的移动用户标识，该明文中的移动用户标识即为该用户终端对应的移动用户标识；若否，则确定该安全令牌无效。
例如，以生成安全令牌的对称加密算法为AES为例，解密方式可以表示为：m=AES_DENCRYPT(s,k)，其中m是解密后的结果值，即解密后的明文，k是解密密钥即在生成安全令牌时所使用的预置密钥，AES_DENCRYPT是解密算法，s是密文即该安全令牌。
步骤303.注册服务器根据对该安全令牌的验证结果确定安全认证是否成功。
注册服务器根据对安全令牌的验证结果确定安全认证是否成功，并执行相应的操作，包括：
若确定该安全令牌有效，则确定安全认证成功。在确定安全认证成功之后，注册服务器可以根据需要向用户终端提供所需的数据和服务，例如可以向用户终端发送注册成功应答消息，或者向用户终端提供注册信息和服务等。
相应地，在确定安全认证成功之后，用户终端可以根据需要获取注册服务器提供的数据和服务，例如接收注册服务器发送的注册成功应答消息，或者接收注册服务器提供的注册信息和服务等。
若确定该安全令牌无效，则确定安全认证失败。在确定安全认证失败之后，注册服务器则不向用户终端提供所需的数据和服务，以及向用户终端发送注册失败应答消息等。
相应地，在确定安全认证失败之后，用户终端接收注册服务器发送的注册失败应答消息等。
综上所述，本实施例提供的方法，主要是基于用户终端与注册服务器协商的安全令牌进行安全认证，在安全认证成功之后，可以为用户终端及用户终端上运行的第三方应用客户端安全地提供相应的注册信息和服务，并向用户终端返回注册成功应答消息。
五、客户端安全认证过程实施例二
请参考图4，其示出了本发明提供的客户端安全认证过程实施例二的流程图，该实施例可用于图1所示的实施环境中。该实施例包括：
用户终端在获取到用于启动客户端安全认证过程的操作指示之后启动客户端安全认证过程，该安全认证过程可以包括如下三个子过程和相应的步骤：
第一子过程：用户终端与注册服务器基于相同的移动用户标识和值相同的根密钥生成值相同的认证密钥。具体可以包括：
步骤401.用户终端获取移动用户标识和第一根密钥。
用户终端获取移动用户标识和第一根密钥，相对应的，在用户终端与注册服务器认证与密钥协商成功之后，在注册服务器上应当存储有该移动用户标识以及与该移动用户标识对应的第二根密钥。
步骤402.用户终端基于该第一根密钥生成第一认证密钥。
例如，可将该第一根密钥作为第一认证密钥。
又例如，基于包括该第一根密钥以及第一固定字符串（1）或/和第一随机字符串或/和第一时间戳或/和该移动用户标识或/和第三方应用标识的信息生成第一认证密钥；其中，该第一固定字符串（1）为预先配置的并且与注册服务器上预先配置的第一固定字符串（2）的值相同的字符串，该第一随机字符串为本地随机生成的字符串，该第一时间戳为通过获取用户终端的当前系统时间生成。具体地，以密钥派生算法公式为例，可以表示为：DK= PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第一认证密钥，PBKDF2是密钥派生算法，passphrase是该第一根密钥并且和第一固定字符串（1）或/和第一随机字符串或/和第一时间戳或/和该移动用户标识或/和第三方应用标识组合拼接的字符串；Salt是盐值，在本例中是一个固定字符串；c是迭代次数；dlLen是密钥输出长度，可以根据使用的加密算法生成符合要求的密钥长度。
第三方应用标识是用户终端中运行的第三方应用客户端的标识，例如，在第三方应用客户端软件安装包内已经内置存储并且在安装后存储在配置文件中，用户终端从该配置文件中获取该第三方应用标识；或者，由第三方应用客户端向对应的第三方应用服务器发送请求后获得，再由用户终端从该第三方应用客户端获取。
步骤403.用户终端将该移动用户标识以及生成第一认证密钥的信息发送给注册服务器。
用户终端将该移动用户标识发送给注册服务器，以使得注册服务器根据该移动用户标识能获取到对应的第二根密钥。
为了使得注册服务器生成与第一认证密钥的值相同的第二认证密钥，则如果生成第一认证密钥的信息还包括第一随机字符串或/和第一时间戳或/和第三方应用标识，则将该第一随机字符串或/和该第一时间戳或/和该第三方应用标识发送给注册服务器。
相应地，注册服务器接收用户终端发送的该移动用户标识以及该第一随机字符串或/和该第三方应用标识。
可以理解，如果上述生成第一认证密钥的信息还包括第一固定字符串（1），由于固定字符串在注册服务器上可以预先配置相同值的固定字符串，则可以不用将该第一固定字符串（1）发送给注册服务器。
步骤404.注册服务器根据该移动用户标识获取第二根密钥。
在注册服务器上存储有移动用户标识和第二根密钥的对应关系。
注册服务器根据该移动用户标识在该对应关系中查找和获取对应的第二根密钥。
步骤405.注册服务器基于该第二根密钥生成第二认证密钥。
注册服务器使用和用户终端相同的认证密钥生成方式，基于该第二根密钥生成第二认证密钥。
例如，以使用和步骤402用户终端相同的认证密钥生成方式为例，如果用户终端使用第一根密钥作为第一认证密钥，则注册服务器使用该第二根密钥作为第二认证密钥。
又例如，以使用和步骤402用户终端相同的认证密钥生成方式为例，如果用户终端基于包括该第一根密钥以及第一固定字符串（1）或/和第一随机字符串或/和第一时间戳或/和该移动用户标识或/和第三方应用标识生成第一认证密钥，则注册服务器基于包括该第二根密钥以及第一固定字符串（2）或/和第一随机字符串或/和第一时间戳或/和该移动用户标识或/和第三方应用标识的信息生成第一认证密钥，并且该第二认证密钥的生成方式与用户终端生成第一认证密钥的生成方式一致；其中，该第一固定字符串（2）为预先配置的并且与用户终端预先配置的第一固定字符串（1）的值相同的字符串，该第一随机字符串或/和第一时间戳或/和第三方应用标识为用户终端所发送的。
具体地，以步骤402相对应的示例为例，密钥派生算法公式为：DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第二认证密钥，PBKDF2是与用户终端相同的密钥派生算法，passphrase是该第二根密钥并且和第一固定字符串（2）或/和第一随机字符串或/和第一时间戳或/和该移动用户标识或/和第三方应用标识组合拼接的字符串；Salt是盐值，是一个与用户终端相同的固定字符串；c是与用户终端中相同的迭代次数；dlLen是与用户终端中相同的密钥输出长度。
至此，由于同一移动用户标识在用户终端上对应的第一根密钥和在注册服务器上对应的第二根密钥的值是相同的，而由于第一认证密钥和第二认证密钥是使用相同的密钥生成方式、基于值相同的根密钥生成的，因此，第一认证密钥和第二认证密钥的值也是相同的。
第二子过程：用户终端与注册服务器生成值相同的验证信息。具体可以包括：
步骤406.用户终端生成第一验证信息。
用户终端生成第一验证信息，以使得该第一验证信息用于加密，并且要使得该第一验证信息与注册服务器生成的第二验证信息的值相同。
用户终端可以将第二固定字符串（1）或第二随机字符串或第二时间戳或该移动用户标识或该第三方应用标识中的一种作为第一验证信息；或者，用户终端根据包括第二固定字符串（1）或/和第二随机字符串或/和第二时间戳或/和该移动用户标识或/和该第三方应用标识的信息生成第一验证信息，例如，用户终端将第二固定字符串（1）或/和第二随机字符串或/和第二时间戳或/和该移动用户标识或/和该第三方应用标识组合拼接后生成第一验证信息。
其中，该第二固定字符串（1）为预先配置的与注册服务器上预先配置的第二固定字符串（2）的值相同的字符串，该第二随机字符串为本地随机生成的字符串，该第二时间戳为通过获取用户终端的当前系统时间生成。
步骤407.可选的，用户终端将生成第一验证信息的信息发送给注册服务器。
在用户终端生成第一验证信息之后，为了使得注册服务器生成与第一认证信息的值相同的第二认证信息，如果生成的第一验证信息还包括第二随机字符串或/和第二时间戳或/和该移动用户标识或/和该第三方应用标识，并且是使用签名加密算法对第一验证信息签名加密生成第一加密值，则将该第二随机字符串或/和该第二时间戳或/和该移动用户标识或/和该第三方应用标识发送给注册服务器。
相应地，注册服务器接收用户终端发送的该第二随机字符串或/和该第二时间戳或/和该移动用户标识或/和该第三方应用标识。
可以理解，如果上述生成第一验证信息的信息还包括第二固定字符串（1），由于固定字符串在注册服务器上可以预先配置相同值的固定字符串，则可以不用将该第二固定字符串（1）发送给注册服务器。
可以理解，如果生成的第一验证信息还包括该第二随机字符串或/和该第二时间戳或/和该移动用户标识或/和该第三方应用标识，并且是使用对称加密算法对第一验证信息对称加密生成第一加密值，由于对该第一加密值解密后可以获取到第一验证信息，因此，则可以不用将该第二随机字符串或/和该第二时间戳或/和该移动用户标识或/和该第三方应用标识发送给注册服务器。
可以理解，本步骤还可以与上述步骤403合并成一个步骤实施，即用户终端可以将该移动用户标识以及生成第一认证密钥的信息和生成第一验证信息的信息在一个发送请求中同时发送给注册服务器，相应地，则上述注册服务器生成第二认证密钥、生成第二验证信息的相应步骤也在该合并的步骤后实施。
可以理解，如果合并成一个步骤实施，则两个步骤中如果生成第一认证密钥的信息与生成第一验证信息的信息有相同的信息，则可以不用重复发送该相同的信息。
步骤408.注册服务器生成第二验证信息。
注册服务器生成第二验证信息，并且要使得该生成的第二验证信息的值与用户终端生成的第一验证信息的值相同。
以使用和步骤406相同的验证信息生成方式为例，如果用户终端将第二固定字符串（1）或第二随机字符串或第二时间戳或该移动用户标识或该第三方应用标识中的一种作为第一验证信息，将注册服务器将第二固定字符串（2）或第二随机字符串或第二时间戳或该移动用户标识或该第三方应用标识中的一种作为第二验证信息。
以使用和步骤406相同的验证信息生成方式为例，如果用户终端根据包括第二固定字符串（1）或/和第二随机字符串或/和第二时间戳或/和该移动用户标识或/和该第三方应用标识的信息生成第一验证信息，则注册服务器根据包括第二固定字符串（2）或/和第二随机字符串或/和第二时间戳或/和该移动用户标识或/和该第三方应用标识的信息生成第二验证信息。例如，与步骤406用户终端相对应的示例为例，注册服务器将第二固定字符串（2）或/和第二随机字符串或/和第二时间戳或/和该移动用户标识或/和该第三方应用标识组合拼接后生成第二验证信息。
其中，该第二固定字符串（2）为预先配置的并且与用户终端上预先配置的第二固定字符串（1）的值相同的字符串，该第二随机字符串或/和该第二时间戳或/和第三方应用标识为用户终端所发送的。
至此，由于第一验证信息和第二验证信息是使用相同的验证信息生成方式、基于相同值的信息生成的，因此，第一验证信息和第二验证信息的值也是相同的。
进一步地，如果生成第一验证信息的信息还包括第二时间戳，则注册服务器在接收到该第二时间戳之后，将该第二时间戳与注册服务器的当前系统时间进行比较，确定两者的时间差是否在预先设定的有效范围内：如果是在有效的范围内，则执行下述步骤；如果不是在有效的范围内，则不执行下述步骤，结束本次客户端安全认证过程。
第三子过程：用户终端与注册服务器基于值相同的认证密钥和值相同的验证信息实现安全认证。具体可以包括：
步骤409.用户终端基于该第一认证密钥和该第一验证信息加密生成第一加密值。
根据上述步骤中生成的第一认证密钥和第一验证信息，用户终端基于该第一认证密钥和该第一验证信息加密生成第一加密值。根据所使用的加密算法，可以包括多种实施方式，至少可以包括：
第一种实施方式，用户终端使用签名加密算法基于该第一认证密钥对该第一验证信息签名加密生成第一加密值。
用户终端使用签名加密算法基于该第一认证密钥对该第一验证信息签名加密计算生成的第一加密值，即为签名值，签名值可以唯一地识别第一验证信息，只有使用相同的签名加密算法、相同值的签名密钥、相同值的待签名信息才可以生成相同的签名值。
例如，以签名加密算法使用哈希消息认证码为例，签名方式可以表示为：Signature=HMAC_SHA256(k,m)，其中m是待签名信息即该第一验证信息，k是签名密钥即该第一认证密钥，HMAC_SHA256是签名加密算法，Signature是签名值即第一加密值。
又例如，以签名加密算法使用含密钥加密的哈希函数为例，签名方式可以表示为：Signature= SHA256(k||m)，其中m是待签名信息即该第一验证信息，k是签名密钥即该第一认证密钥，“k||m”表示将k和m组合拼接，SHA256是哈希函数，Signature是签名值即第一加密值。
第二种实施方式，用户终端使用对称加密算法基于该第一认证密钥对包括该第一验证信息的信息对称加密生成第一加密值。
用户终端使用对称加密算法基于该第一认证密钥对包括该第一验证信息的信息对称加密生成第一加密值，该第一加密值即为包括该第一验证信息的信息的密文，只有使用相同的对称加密算法、相同值的密钥才可以将该密文解密后得到原来的明文。
例如，以对称加密算法使用AES为例，加密方式可以表示为：s=AES_ENCRYPT(m,k)，其中m是明文，该明文为包括该第一验证信息的信息，k是加密密钥即该第一认证密钥，AES_ENCRYPT是加密算法，s是加密结果即第一加密值。
上述的包括该第一验证信息的信息，是指在生成的信息中还包括该第一验证信息和其他信息，例如将该第一验证信息和其他信息组合拼接后所生成的信息，对于该其他信息，如非特别说明，在本实施例中并不进行限定。
步骤410.用户终端向注册服务器发送安全认证请求，该安全认证请求包括该第一加密值。
用户终端向注册服务器发送安全认证请求，该安全认证请求包括该第一加密值，以使得注册服务器通过验证该第一加密值而实现对用户终端的安全认证。
相应地，注册服务器接收用户终端发送的安全认证请求，并且获取该安全认证请求中包括的该第一加密值。
可以理解，本步骤还可以与上述步骤403或/和步骤407合并成一个步骤实施，即用户终端可以将该安全认证请求与发送移动用户标识以及生成第一认证密钥的信息、或发送生成第一验证信息的信息的步骤在一个发送请求中同时发送给注册服务器，相应地，则上述注册服务器生成第二认证密钥、生成第二验证信息的相应步骤也在该合并的步骤后实施。
步骤411.注册服务器基于该第二认证密钥和该第二验证信息验证该第一加密值。
与用户终端中生成第一加密值可以包括的多种实施方式相对应的，注册服务器基于该第二认证密钥和该第二验证信息验证该第一加密值需使用相对应的实施方式，包括：
第一种实施方式，与用户终端使用签名加密算法生成第一加密值的实施方式相对应的，注册服务器使用和用户终端相同的签名加密算法，基于该第二认证密钥和该第二验证信息验证该第一加密值。具体可以包括：
步骤411a.注册服务器使用和用户终端相同的签名加密算法，基于该第二认证密钥对该第二验证信息签名加密生成第二加密值。
注册服务器使用和用户终端相同的签名加密算法基于该第二认证密钥对该第二验证信息签名加密生成签名值，该签名值也这里表述为是第二加密值。
例如，以签名加密算法使用和步骤409用户终端中相同的哈希消息认证码为例，签名方式可以表示为：Signature=HMAC_SHA256(k,m)，其中m是待签名信息即第二验证信息，k是签名密钥即第二认证密钥，HMAC_SHA256是与用户终端相同的哈希消息认证码，Signature是签名值即第二加密值。
又例如，以签名算法使用和步骤409用户终端中相同的含密钥加密的哈希函数为例，签名方式可以表示为：Signature= SHA256(k||m)，其中m是待签名信息即第二验证信息，k是签名密钥即第二认证密钥，SHA256是与用户终端相同的哈希函数，Signature是签名值即第二加密值。
至此，由于注册服务器使用的是和用户终端相同的签名算法，第二验证信息和第一验证信息是值相同的待签名信息，第二认证密钥和第一认证密钥是值相同的签名密钥，则生成的第二加密值和第一加密值应当相同。
步骤411b.注册服务器比较该第二加密值与该第一加密值是否一致；若一致，则确定安全验证成功。
注册服务器比较该第二加密值和该第一加密值是否一致，并根据比较结果执行相应的操作，包括：
如果比较结果是一致的，则确定该第一加密值验证成功。
如果比较结果是不一致的，则确定该第一加密值验证失败。
第二种实施方式，与用户终端使用对称加密算法生成第一加密值相对应的，注册服务器使用和用户终端相同的对称加密算法，基于该第二认证密钥和该第二验证信息验证该第二加密值。具体可以包括：
步骤411i.注册服务器使用和用户终端相同的对称加密算法，基于该第二认证密钥对该第一加密值解密获得明文，并从该明文中获取第一验证信息。
注册服务器使用和用户终端相同的对称加密算法基于该第二认证密钥对该第一加密值解密，从而获得解密后的明文。
例如，以对称加密算法使用和步骤409用户终端中相同的AES为例，解密方式可以表示为：m=AES_DENCRYPT(s,k)，其中m是解密后的结果值，即解密后的明文，k是解密密钥即该第二认证密钥，AES_DENCRYPT是解密算法，s是密文即第一加密值。
由于该明文是第一验证信息或者是包括该第一验证信息的信息，因此，可以从该明文中获取到第一验证信息。
步骤411ii.注册服务器比较该第二验证信息与该第一验证信息是否一致；若一致，则确定安全验证成功。
注册服务器比较该第二验证信息和该解密后获得的明文是否一致，并根据比较结果执行相应的操作，包括：
如果比较结果是一致的，则确定该第一加密值验证成功。
如果比较结果是不一致的，则确定该第一加密值验证失败。
步骤412.注册服务器根据对第一加密值的验证结果确定安全认证是否成功。
注册服务器根据对该第一加密值的验证结果确定安全认证是否成功，并执行相应的操作，包括：
若确定该第一加密值验证成功，则确定安全认证成功。在确定安全认证成功之后，注册服务器可以根据需要向用户终端提供所需的数据和服务，例如向用户终端发送注册成功应答消息，或者向用户终端提供注册信息和服务等。
相应地，在确定安全认证成功之后，用户终端可以根据需要接收注册服务器提供的数据和服务，例如接收注册服务器发送的注册成功应答消息，或者接收注册服务器提供的注册信息和服务等。
若确定该第一加密值验证失败，则确定安全认证失败。在确定安全认证失败之后，注册服务器可以根据不向用户终端提供所需的数据和服务，包括可以向用户终端发送注册失败应答消息等。
相应地，在确定安全认证失败之后，用户终端接收注册服务器发送的注册失败应答消息等。
综上所述，本实施例提供的方法，主要是基于用户终端中的移动用户标识和第一根密钥，以及基于注册服务器中存储的相同的移动用户标识和对应的第二根密钥，注册服务器通过使用和用户终端相同的加密算法对用户终端进行安全认证，在安全认证成功之后，可以为用户终端及用户终端上运行的第三方应用客户端安全地提供相应的注册信息和服务，并向用户终端返回注册成功应答消息。
六、客户端注册信息提供过程实施例一
请参考图5，其示出了本发明提供的客户端注册信息提供过程实施例一的流程图，该方法可用于图1所示的实施环境中。本实施例进一步为用户终端中运行的第三方应用客户端提供了注册信息，该注册信息包括第三方用户标识和用户密钥。
为了让注册服务器为用户终端中运行的第三方应用客户端提供相应的注册信息和服务，则用户终端需将第三方应用客户端对应的第三方应用标识传递给注册服务器。
具体的，用户终端将第三方应用标识传递给注册服务器可以包括多种实施方式，例如可以包括：
第一种实施方式，用户终端将该第三方应用标识发送给注册服务器，注册服务器接收该第三方应用标识。
用户终端将该第三方应用标识发送给注册服务器，可以以一个单独的发送请求将该第三方应用标识发送给注册服务器，也可以合并在安全认证请求或其他的发送请求中将该第三方应用标识发送给注册服务器，例如合并在上述步骤301或步骤410的安全认证请求中，或者合并在上述步骤403或/和步骤407用户终端发送认证密钥或认证信息的相关步骤中。
相应地，注册服务器接收用户终端发送的第三方应用标识。
第二种实施方式，用户终端将该第三方应用标识加密，并将加密后的密文发送给注册服务器，注册服务器将该密文解密后获得该第三方应用标识。
例如，用户终端基于第一根密钥以及注册服务器基于第二根密钥使用相同的密钥生成方式生成值相同的加密密钥，用户终端使用对称加密算法和该加密密钥对该第三方应用标识加密，将加密后的密文发送给注册服务器，注册服务器使用值相同的加密密钥解密后获得该第三方应用标识。
又例如，与上述步骤409的第二种实施方式相对应的，用户终端使用对称加密算法基于该第一认证密钥对包括该第一验证信息的信息对称加密生成第一加密值，则在包括该第一验证信息的信息中包括该第三方应用标识。从而在步骤411的第二种实施方式中，注册服务器从解密获得的明文中获取该第三方应用标识。
在传递第三方应用标识以及安全认证成功以后，注册服务器可以为用户终端中运行的第三方应用客户端提供包括第三方用户标识和用户密钥的注册信息，即本实施例的下述步骤应用在客户端安全认证过程实施例一和客户端安全认证过程实施例二之后。具体可以包括：
步骤501.注册服务器根据用户终端对应的移动用户标识和该第三方应用标识获取对应的第三方用户标识。
与上述客户端安全认证过程实施例一相对应的，用户终端对应的移动用户标识为根据安全令牌所获取的对应的移动用户标识；与上述客户端安全认证过程实施例二相对应的，用户终端对应的移动用户标识为用户终端发送给注册服务器的认证密钥信息或安全验证信息或安全认证请求中所包括的移动用户标识。
在注册服务器上存储有移动用户标识和第三方应用标识与第三方用户标识的对应关系，根据移动用户标识和第三方应用标识在该对应关系中可获取对应的第三方用户标识。具体可以包括如下步骤：
步骤501a.注册服务器根据该移动用户标识和该第三方应用标识查找对应的第三方用户标识。
在注册服务器上存储有移动用户标识和第三方应用标识与第三方用户标识的账户对应关系，即根据第三方应用标识和移动用户标识在该账户对应关系中能够查找到对应的第三方用户标识。
注册服务器根据该移动用户标识和该第三方应用标识在该账户对应关系中查找对应的第三方用户标识。
如果查找到对应的第三方用户标识，则说明注册服务器已经为该移动用户标识创建了用于该第三方应用标识的第三方用户标识，则注册服务器获取对应的第三方用户标识，然后执行下述步骤502。
如果没有查找到对应的第三方用户标识，则说明注册服务器没有为该移动用户标识创建过用于该第三方应用标识的第三方用户标识，则执行下述步骤501b。
步骤501b.注册服务器创建一个唯一的第三方用户标识。
注册服务器创建一个新用户标识，该新用户标识是注册服务器上所有的第三方用户标识中唯一的标识，也可以是在步骤501a所述的账户对应关系中该第三方应用标识对应的所有第三方用户标识中唯一的标识，然后将该新用户标识作为第三方用户标识。
步骤501c.注册服务器建立和存储该移动用户标识和该第三方应用标识与该第三方用户标识的对应关系。
注册服务器在步骤501a所述的账户对应关系中新增该移动用户标识和该第三方应用标识与该第三方用户标识的对应关系，即根据该移动用户标识和该第三方应用标识在该账户对应关系中将能查找和获取到该第三方用户标识。
步骤501a、步骤501b和步骤501c，还可以是，注册服务器预先建立有用于该第三方应用标识的应用用户关系表，在该应用用户关系表中存储有移动用户标识和第三方用户标识的一一对应关系。注册服务器根据该移动用户标识在该应用用户关系表中查找第三方用户标识，如果没有查找到第三方用户标识，则创建一个唯一的第三方用户标识，并且在该应用用户关系表中新增该移动用户标识和该第三方用户标识的一一对应关系，如果查找到第三方用户标识，则获取该第三方用户标识。
步骤501a、步骤501b和步骤501c，还可以是，注册服务器预先建立有用于该移动用户标识的移动用户关系表，在该移动用户关系表中存储有第三方应用标识和第三方用户标识的一一对应关系。注册服务器根据该第三方应用标识在该移动用户关系表中查找第三方用户标识，如果没有查找到第三方用户标识，则创建一个唯一的第三方用户标识，并且在该移动用户关系表中新增该第三方应用标识和该第三方用户标识的一一对应关系，如果查找到第三方用户标识，则获取该第三方用户标识。
步骤502.可选的，注册服务器基于该第二根密钥生成该第三方用户标识对应的第二用户密钥。
注册服务器基于该第二根密钥生成第二用户密钥，并且建立该第三方用户标识与该第二用户密钥的对应关系。具体可以包括如下步骤：
步骤502a.注册服务器基于该第二根密钥生成第二用户密钥。
注册服务器基于该第二根密钥生成第二用户密钥。
进一步的，注册服务器基于包括该第二根密钥以及第三固定字符串（2）或/和第三随机字符串或/和第三时间戳或/和该移动用户标识或/和该第三方应用标识或/和该第三方用户标识的信息生成第二用户密钥；其中，该第三固定字符串（2）为预先配置的并且与用户终端上预先配置的第三固定字符串（1）的值相同的字符串，该第三随机字符串为本地随机生成的字符串，该第三时间戳为通过获取注册服务器的当前系统时间生成。具体地，以密钥派生算法公式为例，可以表示为：DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第二用户密钥，PBKDF2是密钥派生算法，passphrase是该第二根密钥以及第三固定字符串或/和第三随机字符串或/和第三时间戳或/和该移动用户标识或/和第三方应用标识或/和该第三方用户标识组合拼接的字符串；Salt是盐值，在本例中是一个固定字符串；c是迭代次数；dlLen是密钥输出长度，可以根据需要生成符合要求的密钥长度。
步骤502b.注册服务器建立该第三方用户标识与该第二用户密钥的对应关系。
注册服务器建立该第三方用户标识与该第二用户密钥的对应关系，以使得根据该第三方用户标识在该对应关系中能获取到对应的第二用户密钥。
如果该第三方用户标识是注册服务器上所有的第三方用户标识中唯一的标识，则建立该第三方用户标识与该第二用户密钥的对应关系。
如果该第三方用户标识是该第三方应用标识对应的所有第三方用户标识中唯一的标识，则建立该第三方用户标识和该第三方应用标识与该第二用户密钥的对应关系。
至此，注册服务器建立了该第三方用户标识与该第二用户密钥的对应关系，注册服务器可以本地存储该对应关系，或者将该对应关系同步发送给第三方认证服务器，或者将该对应关系同步发送给对应该第三方应用标识的第三方应用服务器。然后，基于该对应关系，如果运行在用户终端的第三方应用客户端有相同的第三方用户标识和与该第二用户密钥的值相同的用户密钥，则将可以实现对第三方应用客户端的身份认证、数据加密等操作。
以注册服务器本地存储该对应关系为例，注册服务器预先建立有用于该第三方应用标识的账户密钥关系表，在该账户密钥关系表中存储有第三方用户标识与该第二用户密钥的一一对应关系。注册服务器根据该第三方用户标识在该账户密钥关系表中查找第二用户密钥，如果没有查找到第二用户密钥，则在该账户密钥关系表中新增该第三方用户标识与该第二用户密钥的一一对应关系，如果查找到用户密钥，则在该账户密钥关系表中使用本步骤新生成的该第二用户密钥替换该第三方用户标识已有的用户密钥。
以结合步骤501为例，如果在注册服务器上预先建立用于该第三方应用标识的应用用户关系表，或者如果在注册服务器上预先建立用于该移动用户标识的移动用户关系表，则也可以在该应用用户关系表或移动用户关系表中建立及更新该第三方用户标识和该第二用户密钥的一一对应关系，在此不再赘述。
需要说明的是，上述步骤502还可以在下述步骤503之后执行，本发明并不对此进行限定。
步骤503.注册服务器向用户终端发送注册应答消息，该注册应答消息是注册成功应答消息，并且包括该第三方用户标识。
与步骤502a相对应的，如果生成的第二用户密钥还包括第三随机字符串或/和第三时间戳，则向用户终端发送的该注册成功应答消息，还包括该第三随机字符串或/和该第三时间戳。
步骤504.用户终端接收注册服务器发送的注册应答消息并执行相应的操作。
用户终端接收注册服务器发送的注册应答消息，该注册应答消息是注册成功应答消息或者是注册失败应答消息。
用户终端根据该客户端注册应答消息执行相应的操作，包括：
如果该注册应答消息是注册成功应答消息，则获取该注册成功应答消息中的第三方用户标识，并且将该第三方用户标识发送给第三方应用标识对应的第三方应用客户端。如果实施了上述步骤502，则相对应的执行下述步骤505生成第一用户密钥，并将该生成的第一用户密钥同时发送给对应的第三方应用客户端。
如果该注册应答消息是注册失败应答消息，则结束本流程，或者用户终端将该注册失败应答消息发送给第三方应用客户端之后结束本流程。
步骤505.可选的，用户终端使用和注册服务器相同的用户密钥生成方式，基于该第一根密钥生成第一用户密钥。
用户终端使用和注册服务器相同的用户密钥生成方式，基于该第一根密钥生成第一用户密钥。
相应的，如果在步骤502中注册服务器基于包括该第二根密钥以及第三固定字符串（2）或/和第三随机字符串或/和第三时间戳或/和该移动用户标识或/和第三方应用标识或/和该第三方用户标识的信息生成第二用户密钥，则用户终端基于包括该第一根密钥以及第三固定字符串（1）或/和第三随机字符串或/和第三时间戳或/和该移动用户标识或/和第三方应用标识或/和该第三方用户标识的信息生成第一用户密钥；其中，该第三固定字符串（1）为预先配置的并且与注册服务器上预先配置的第三固定字符串（2）的值相同的字符串，该第三随机字符串或/和第三时间戳为注册成功应答消息中所包括的。具体地，以使用和步骤502注册服务器相同的密钥派生算法为例，密钥派生算法公式可以表示为DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第一用户密钥；PBKDF2是与注册服务器相同的密钥派生算法；passphrase是该第一根密钥以及第三固定字符串（1）或/和第三随机字符串或/和第三时间戳或/和该移动用户标识或/和第三方应用标识或/和该第三方用户标识组合拼接的字符串，并且组合拼接方式与注册服务器一致；Salt是盐值，是一个与注册服务器相同的固定字符串；c是与注册服务器相同的迭代次数；dlLen是与注册服务器相同的密钥输出长度。
至此，由于用户终端上生成的第一根密钥和在注册服务器上生成的第二根密钥的值相同，并且由于第一用户密钥和第二用户密钥是使用相同的用户密钥生成方式、基于相同值的根密钥生成的，因此，第一用户密钥和第二用户密钥的值也是相同的。
用户终端将该第三方用户标识和该第一用户密钥发送给该第三方应用标识对应的第三方应用客户端，第三方应用客户端将可以根据该第三方用户标识和该第一用户密钥向第三方应用服务器进行身份认证、数据加密等操作。
如上实施例过程，为用户终端中运行的第三方应用客户端获取了第三方用户标识和生成了对应的用户密钥。带来的效果至少包括：第一方面，自动为第三方应用客户端获取第三方用户标识和对应的用户密钥，减少了终端用户的输入操作，提升了用户的使用体验；第二方面，只要是同一用户识别模块SIM，即使是更换到其他的用户终端上，只要是相同的第三方应用客户端，也能为其自动获取相同的第三方用户标识；第三方面，第三方应用客户端对应的第三方应用服务器，将只能获取与其有关的第三方用户标识，而不能获取移动用户标识，从而能够有效地保护用户的隐私不被泄露；第四方面，用户终端中运行的第三方应用客户端将可以根据获取的第三方用户标识以及生成的用户密钥实现快捷、安全的身份认证、数据加密等操作。
七、客户端注册信息提供过程实施例二
请参考图6，其示出了本发明提供的客户端注册信息提供过程实施例二的流程图，该方法可用于图1所示的实施环境中。本实施例进一步为用户终端中运行的第三方应用客户端提供了注册信息，该注册信息包括为用户终端中运行的第三方应用客户端生成用户令牌。
为了让注册服务器为用户终端中运行的第三方应用客户端提供相应的注册信息和服务，则用户终端需将第三方应用客户端对应的第三方应用标识传递给注册服务器。用户终端将第三方应用标识传递给注册服务器可以包括多种实施方式，具体实施方式可以参照上述客户端注册信息提供过程实施例一，在此不再赘述。
在传递第三方应用标识以及安全认证成功以后，注册服务器可以为用户终端中运行的第三方应用客户端提供包括用户令牌的注册信息，即本实施例的下述步骤应用在客户端安全认证过程实施例一和客户端安全认证过程实施例一之后。具体可以包括：
步骤601.注册服务器为该第三方应用标识生成用户令牌。
注册服务器为该第三方应用标识生成用户令牌，该用户令牌是唯一的，并且具有足够的长度和足够的随机性，使得难以被猜测破解。
步骤602.注册服务器建立该用户令牌与该第三方应用标识或/和该移动用户标识的关联关系。
注册服务器建立该用户令牌与该第三方应用标识的关联关系，注册服务器可以本地存储该关联关系，或者将该关联关系同步发送给第三方认证服务器，或者将该关联关系同步发送给该第三方应用标识对应的第三方应用服务器。然后，基于该关联关系，如果运行在用户终端的第三方应用客户端有相同的用户令牌，第三方应用服务器将可以根据该关联关系实现对第三方应用客户端的认证，例如，以将该用户令牌同步发送给该第三方应用标识对应的第三方应用服务器为例，该第三方应用服务器接收包括用户令牌的认证请求，在该关联关系中查找是否有对应的用户令牌，若有，则认证成功，从而可确定发送该认证请求的发送方是该第三方应用服务器对应的第三方应用客户端。
进一步的，为了使得第三方应用服务器给同一用户提供持续的应用服务，还应当建立该用户令牌与该第三方应用标识和该用户终端对应的移动用户标识的关联关系，以使得能根据该用户令牌能查找到同一用户终端对应的第三方应用标识和移动用户标识，从而为同一用户提供持续的服务。例如，以将该关联关系同步发送给该第三方应用标识对应的第三方应用服务器为例，该第三方应用服务器接收包括用户令牌的认证请求，根据该用户令牌在该关联关系中查找对应的移动用户标识，若查找到，则可以向该移动用户标识关联的用户提供持续的应用服务。
进一步的，为了不致于在第三方应用服务器上泄露移动用户标识，还可以创建一个与该移动用户标识对应的唯一用户标识，再建立该用户令牌与该第三方应用标识和该唯一用户标识的对应关系，从而避免用户的移动用户标识泄露给第三方应用服务器。
需要说明的是，还应当提供清理机制，对于已经失效的用户令牌应当及时清理相应的关联关系，例如在用户令牌验证一次后删除该用户令牌相应的关联关系，或者给用户令牌设定一个有效期，依据有效期及时删除已过有效期的用户令牌相应的关联关系。具体清理机制在此不赘述。
步骤603.注册服务器向用户终端发送注册应答消息，该注册应答消息是注册成功应答消息，并且包括该用户令牌。
步骤604.用户终端接收注册服务器发送的注册应答消息并执行相应的操作。
用户终端接收注册服务器发送的注册应答消息，该注册应答消息是注册成功应答消息或者是注册失败应答消息。
用户终端根据该注册应答消息执行相应的操作，包括：
如果该注册应答消息是注册成功应答消息，则获取该注册成功应答消息中的用户令牌，并且将该用户令牌传递给第三方应用标识对应的第三方应用客户端以用于认证鉴权，然后结束本流程。
如果该注册应答消息是注册失败应答消息，则结束本流程，或者用户终端将该注册失败应答消息发送给第三方应用客户端之后结束本流程。
如上实施例过程，为用户终端中运行的第三方应用客户端生成了用户令牌。带来的效果包括：第一方面，自动为第三方应用客户端获取用户令牌，减少了终端用户的输入操作，提升了用户的使用体验；第二方面，该用户令牌将可以用于第三方应用客户端向对应的第三方应用服务器的认证鉴权，从而提升用户的使用体验；第三方面，在用于认证鉴权时，该用户令牌由于不需要进行加密计算等操作，因此，更适用于一些轻量级的应用客户端（如基于浏览器的网页应用）。
八、客户端注册信息提供过程实施例三
请参考图7，其示出了本发明提供的客户端注册信息提供过程实施例三的流程图，该方法可用于图1所示的实施环境中。作为基于客户端注册信息提供过程实施例一提供的更为优选地实施例，本实施例还进一步实现了终端用户的授权确认过程。
该方法的下述步骤在客户端注册信息提供过程实施例一的基础上，应用在用户终端向注册服务器传递第三方应用标识以及安全认证成功以后，以及应用在注册服务器为用户终端中运行的第三方应用客户端提供包括第三方用户标识和用户密钥的注册信息的过程之前，具体包括如下几个步骤：
步骤a.注册服务器向用户终端发送应用授权请求消息。
该应用授权请求消息中可以包括：
或/和第三方应用名称，该名称是用于识别第三方应用客户端和第三方应用服务器的名称，在注册服务器上预先存储有第三方应用标识和第三方应用名称的对应关系，注册服务器根据第三方应用标识在该对应关系中查找和获取对应的第三方应用名称。
或/和移动用户名称，该名称是用于识别移动用户的名称，在注册服务器上预先存储有移动用户标识和移动用户名称的对应关系，注册服务器根据移动用户标识在该对应关系中查找和获取对应的移动用户名称。
相应地，用户终端接收注册服务器发送的应用授权请求消息。
步骤b.用户终端显示应用授权验证界面。
用户终端接收到注册服务器发送的应用授权请求消息之后，调用并显示应用授权验证界面，以询问终端用户是否同意向该第三方应用授权。
在显示的应用授权验证界面上，可以显示应用授权请求消息中所包括的第三方应用名称或/和移动用户名称，具体为：
第三方应用名称，即将要授权的第三方应用客户端和第三方应用服务器的名称；
移动用户名称，即将要授权的移动用户名称。
在显示应用授权验证界面之后，终端用户可以输入表示确认授权或者表示取消授权的授权信息。
可选地，在显示的应用授权验证界面上，还可以包括安全验证码输入框，以询问终端用户输入安全验证码。该安全验证码用于进一步地验证终端用户的授权，相应地，在注册服务器上预先存储有移动用户标识和安全验证码的对应关系。
步骤c.用户终端接收终端用户在应用授权验证界面中输入的授权信息。
步骤d.用户终端向注册服务器发送应用授权应答消息，该应用授权应答消息是应用授权确认消息或者是应用授权取消消息。
用户终端根据终端用户输入的授权信息执行相应的操作，包括：
如果授权信息是表示确认授权的授权信息，则用户终端向注册服务器发送的应用授权应答消息是应用授权确认消息。
可选地，如果在显示的应用授权验证界面上还包括安全验证码输入框，并且用户终端接收的终端用户输入的授权消息中包括安全验证码，则用户终端向注册服务器发送的应用授权确认消息中还包括该安全验证码。
如果授权信息是表示取消授权的授权信息，则用户终端向注册服务器发送的应用授权应答消息是应用授权取消消息。
步骤e.注册服务器接收用户终端发送的应用授权应答消息并执行相应的操作。
注册服务器接收用户终端发送的应用授权应答消息，该应用授权应答消息是表示确认授权或者是表示取消授权的应用授权应答消息。
注册服务器根据该应用授权应答消息执行相应的操作，包括：
如果该应用授权应答消息是应用授权确认消息，则继续执行后续步骤。
可选地，在注册服务器上预先存储有移动用户标识和安全验证码的对应关系，如果在注册服务器接收的应用授权确认消息中包括安全验证码，则注册服务器根据移动用户标识在该对应关系中查找和获取对应的安全验证码，并且比较两个安全验证码是否一致：如果一致，则继续执行后续步骤；如果不一致，则结束流程，不执行注册服务器为用户终端中运行的第三方应用客户端提供包括第三方用户标识和用户密钥的注册信息的过程
如果该应用授权应答消息是应用授权取消消息，则结束流程，不执行注册服务器为用户终端中运行的第三方应用客户端提供包括第三方用户标识和用户密钥的注册信息的过程。
本实施例提供的方法，在客户端注册信息提供过程实施例一的基础上，增加了让终端用户验证授权的过程，通过增加这一过程，可以更加确认客户端注册信息的提供得到了终端用户的授权许可，避免由于误操作等原因给非必要的第三方应用客户端进行了授权。
本实施例还可以与客户端注册信息提供过程实施例二组成一个新的实施例，即将本实施例的方法步骤应用在用户终端向注册服务器传递第三方应用标识以及安全认证成功以后，以及应用在注册服务器为用户终端中运行的第三方应用客户端提供包括用户令牌的过程之前，具体过程不赘述。
九、认证与密钥协商过程实施例一
请参考图8，其示出了本发明提供的认证与密钥协商过程实施例一的流程图，该过程是基于认证与密钥协商机制为3G/4G AKA机制而实现的，该过程可用于图1所示的实施环境中，其中用户数据系统为归属用户服务器HSS。该过程包括：
步骤801.用户终端启动认证与密钥协商过程。
在获取到用于认证与密钥协商的操作指示之后，用户终端启动认证与密钥协商过程。
步骤802.用户终端获取移动用户标识。
该移动用户标识是用于唯一识别用户识别模块SIM的标识，该移动用户标识是IMSI或者IMPI。该移动用户标识和客户端安全认证过程实施例的流程中获取的移动用户标识是同一标识。
例如，以使用的用户识别模块SIM是USIM为例，在USIM上获取的移动用户标识是IMSI，用户终端通过操作系统上的API获取IMSI（例如Android系统上使用getSubscriberId方法），或者用户终端通过APDU命令读取USIM的EFimsi值。
又例如，以使用的用户识别模块SIM是ISIM为例，在ISIM上获取的移动用户标识是IMPI，用户终端通过APDU命令读取ISIM的EFimpi值。
步骤803.用户终端向注册服务器发送认证与密钥协商请求，该认证与密钥协商请求包括该移动用户标识。
相应地，注册服务器接收用户终端发送的认证与密钥协商请求。
步骤804.注册服务器向归属用户服务器HSS发送认证请求，该认证请求包括该移动用户标识。
以移动用户标识是IMSI为例，可以通过向归属用户服务器HSS的SWx接口发送Multimedia-Auth-Request认证请求消息，该Multimedia-Auth-Request认证请求消息中包括该移动用户标识。
以移动用户标识是IMPI为例，可以通过向归属用户服务器HSS的Cx或SWx接口发送Multimedia-Auth-Request认证请求消息，该Multimedia-Auth-Request认证请求消息中包括该移动用户标识。
步骤805.注册服务器接收归属用户服务器HSS反馈的认证应答消息，该认证应答消息包括随机数RAND、鉴权令牌AUTN、期望响应值XRES、第二加密密钥CK和第二完整性密钥IK。
在归属用户服务器HSS接收注册服务器的认证请求之后，归属用户服务器HSS向注册服务器返回认证向量AV，该认证向量AV包括随机数RAND、鉴权令牌AUTN、期望响应值XRES、第二加密密钥CK和第二完整性密钥IK。
具体的，在注册服务器向归属用户服务器HSS发送Multimedia-Auth-Request认证请求消息之后，归属用户服务器HSS向注册服务器返回Multimedia-Auth-Answer认证应答消息。注册服务器对Multimedia-Auth-Answer认证应答消息进行解析，从中获取SIP-Auth-Data-Item属性值对（AVP：Attribute Value Pair），该SIP-Auth-Data-Item属性值对包括SIP-Authenticate、SIP-Authorization、Confidentiality-Key、Integrity-Key属性值对，注册服务器从该SIP-Authenticate属性值对中获取随机数RAND和鉴权令牌AUTN，从该SIP-Authorization属性值对中获取期望响应值XRES，从Confidentiality-Key属性值对获取第二加密密钥CK或/和从Integrity-Key属性值对获取第二完整性密钥IK。
步骤806.注册服务器向用户终端发送认证与密钥协商挑战消息，该认证与密钥协商挑战消息包括该随机数RAND和该鉴权令牌AUTN。
注册服务器保留期望响应值XRES、第二加密密钥CK或/和第二完整性密钥IK，并向用户终端发送认证与密钥协商挑战消息，该认证与密钥协商挑战消息包括该随机数RAND和该鉴权令牌AUTN。
相应地，用户终端接收注册服务器发送的认证与密钥协商挑战消息，并从中获取该随机数RAND和该鉴权令牌AUTN。
步骤807.用户终端向用户识别模块SIM发送鉴权请求，该鉴权请求包括该随机数RAND和该鉴权令牌AUTN。
用户终端向用户识别模块SIM发送鉴权请求（例如通过发送APDU命令AUTHENTICATE），传递参数为该随机数RAND和该鉴权令牌AUTN。
步骤808.用户终端接收用户识别模块SIM的返回值，该返回值包括期望响应值RES、第一加密密钥CK和第一完整性密钥IK。
在用户识别模块SIM接收到用户终端发送的鉴权请求之后，用户识别模块SIM经过鉴权计算后向用户终端发送返回值，该返回值包括期望响应值RES、第一加密密钥CK和第一完整性密钥IK，用户终端接收该返回值。
步骤809.用户终端向注册服务器发送认证与密钥协商挑战应答消息，该认证与密钥挑战应答消息包括该期望响应值RES。
进一步地，为了保护期望响应值RES的安全，避免在传输过程中被泄露，还可以使用哈希算法（例如SHA256）对期望响应值RES进行哈希计算，只发送期望响应值RES经哈希计算后所生成的哈希值，而不发送期望响应值RES的明文。
相应地，注册服务器接收用户终端发送的该期望响应值RES或该期望响应值RES的哈希值。
步骤810.注册服务器基于该期望响应值XRES验证该期望响应值RES；若验证有效，则执行步骤811。
注册服务器从接收的认证与密钥挑战应答消息中获取该期望响应值RES或期望响应值RES的哈希值，注册服务器将本地保留的期望响应值XRES对其进行验证。若验证有效，则执行下述步骤811；若验证无效，则向用户终端发送认证与密钥协商应答消息，该认证与密钥协商应答消息是认证与密钥协商失败应答消息，并执行下述步骤813。
相应的，若是将期望响应值RES的明文发送给注册服务器，则比较该期望响应值XRES和该期望响应值RES是否一致；若一致，则确定验证有效；若不一致则确定验证无效。
相应的，若是将期望响应值RES的哈希值发送给注册服务器，则将该期望响应值XRES使用相同的哈希计算方式计算生成哈希值，并且比较两个哈希值是否一致；若一致，则确定验证有效；若不一致则确定验证无效。
步骤811.注册服务器生成第二安全参数，该第二安全参数包括安全令牌或/和第二根密钥，并且建立该第二安全参数与该移动用户标识的对应关系。
注册服务器生成第二安全参数，该第二安全参数包括安全令牌或/和第二根密钥，并且建立该第二安全参数与该移动用户标识的对应关系。具体的，实施方式包括：
第一种实施方式，注册服务器生成安全令牌，并且建立该安全令牌与移动用户标识的对应关系。
注册服务器生成安全令牌，并且建立该安全令牌与该移动用户标识的对应关系，以使得根据该安全令牌可以获取到该移动用户标识。
例如，注册服务器生成安全令牌，该安全令牌是全局唯一的安全令牌，并且具有足够的长度和足够的随机性，使得难以被猜测破解。同时，建立该安全令牌与该移动用户标识的对应关系，以使得根据该安全令牌在该对应关系中能获取到该对应的移动用户标识。
又例如，注册服务器使用对称加密算法基于预置密钥将包括移动用户标识的信息加密，将加密后得到的密文作为安全令牌，以使得注册服务器在对该安全令牌解密后获得该移动用户标识。以生成安全令牌的对称加密算法为AES为例，加密方式可以表示为：s=AES_ENCRYPT(m,k)，其中m是明文，该明文为包括该移动用户标识的信息，k是加密密钥即预置密钥，AES_ENCRYPT是加密算法，s是加密结果即安全令牌。
第二种实施方式，注册服务器基于该第二加密密钥CK或/和该第二完整性密钥IK生成第二根密钥，并且建立该移动用户标识与该第二根密钥的对应关系。
例如，以该第二加密密钥CK或该第二完整性密钥IK作为第二根密钥。
又例如，将该第二加密密钥CK或/和该第二完整性密钥IK或/和第四固定字符串（2）组合拼接生成第二根密钥。
又例如，基于包括该第二加密密钥CK或/和所述第二完整性密钥IK以及包括第四固定字符串（2）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识的信息生成第二根密钥；其中，该第四固定字符串（2）为预先配置的并且与用户终端上预先配置第四固定字符串（1）的值相同的字符串，该第四随机字符串为本地随机生成的字符串，该第四时间戳为通过获取注册服务器的当前系统时间生成。具体地，以密钥派生算法公式为例，可以表示为：DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第二根密钥，PBKDF2是密钥派生算法，passphrase是该第二加密密钥CK或/和所述第二完整性密钥IK以及第四固定字符串（2）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识组合拼接的字符串；Salt是盐值，在本例中是一个固定字符串；c是迭代次数；dlLen是密钥输出长度，可以根据需要生成符合要求的密钥长度。
在注册服务器上建立该移动用户标识与该第二根密钥的对应关系，以使得注册服务器将能够根据该移动用户标识在该对应关系中查找和获取到该第二根密钥。
如果注册服务器上已经存储有该移动用户标识和第二根密钥的对应关系，则使用本次生成的该第二根密钥替换该移动用户标识已经存储的对应的第二根密钥。
上述第一种实施方式和第二种实施方式可以分别应用，也可以同时应用。
需要说明的是，本步骤还可以在步骤812即注册服务器向用户终端发送认证与密钥协商成功应答消息之后执行，本发明实施例并不对此进行限定。
步骤812.注册服务器向用户终端发送认证与密钥协商应答消息，该认证与密钥协商应答消息是认证与密钥协商成功应答消息。
如果生成的第二安全参数中包括安全令牌，则在该认证与密钥协商成功应答消息中还包括该安全令牌。
如果在生成第二根密钥的信息中还包括第四随机字符串或/和第四时间戳，则在该认证与密钥协商成功应答消息中还包括该第四随机字符串或/和该第四时间戳。
步骤813.用户终端接收注册服务器发送的认证与密钥协商应答消息并执行相应的操作。
用户终端接收注册服务器发送的认证与密钥协商应答消息，该认证与密钥协商应答消息包括认证与密钥协商成功应答消息或认证与密钥协商失败应答消息。
用户终端根据该认证与密钥协商应答消息执行相应的操作，包括：
如果该认证与密钥协商应答消息是认证与密钥协商成功应答消息，则用户终端执行下述步骤814。
如果该认证与密钥协商应答消息是认证与密钥协商失败应答消息，则不执行下述步骤，结束本次认证与密钥协商流程。
步骤814.用户终端获得第一安全参数，该第一安全参数包括该安全令牌或/和第一根密钥。
与注册服务器生成第二安全参数的实施方式相对应的，用户终端获得第一安全参数，该第一安全参数包括该安全令牌或/和第一根密钥，具体实施方式包括：
第一种实施方式，在认证与密钥协商成功应答消息中还包括该安全令牌，用户终端获取该安全令牌。
第二种实施方式，用户终端使用和注册服务器相同的根密钥生成方式，基于该第一加密密钥CK或/和该第一完整性密钥IK生成第一根密钥。
例如，如果在步骤811注册服务器以该第二加密密钥CK或该第二完整性密钥IK作为第二根密钥，则用户终端以该第一加密密钥CK或该第一完整性密钥IK作为第一根密钥。
又例如，如果在步骤811注册服务器将该第二加密密钥CK或/和该第二完整性密钥IK或/和第四固定字符串（2）组合拼接生成第二根密钥，则用户终端将该第一加密密钥CK或/和该第一完整性密钥IK或/和第四固定字符串（1）组合拼接生成第一根密钥。
又例如，如果在步骤811中注册服务器基于包括该第二加密密钥CK或/和该第二完整性密钥IK以及包括第四固定字符串（2）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识的信息生成第二根密钥，则用户终端基于包括该第一加密密钥CK或/和该第一完整性密钥IK以及包括第四固定字符串（1）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识的信息生成第一根密钥；其中，该第四固定字符串（1）是在用户终端上预先配置的并且与注册服务器上生成第二根密钥时所使用的第四固定字符串（2）的值相同的字符串；第四随机字符串或/和第四时间戳是从注册服务器发送的认证与密钥协商成功应答消息中所获取的。具体地，以使用和步骤811注册服务器相同的密钥派生算法为例，密钥派生算法公式可以表示为DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第一根密钥；PBKDF2是与注册服务器相同的密钥派生算法；passphrase是该第一加密密钥CK或/和该第一完整性密钥IK以及第四固定字符串（1）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识组合拼接的字符串，并且组合拼接方式与注册服务器一致；Salt是盐值，是一个与注册服务器相同的固定字符串；c是与注册服务器相同的迭代次数；dlLen是与注册服务器相同的密钥输出长度。
由于用户终端上获取的第一加密密钥CK、第一完整性密钥IK与注册服务器上获取的第二加密密钥CK、第二完整性密钥IK的值相同，又由于根密钥的生成方式一致，因此，在用户终端上生成的第一根密钥与注册服务器上生成的第二根密钥的值相同。
通过本实施例提供的方法，用户终端基于用户识别模块SIM中存储的移动用户标识、移动用户密钥（K）和相关AKA算法，以及注册服务器基于归属用户服务器HSS中存储的移动用户标识、移动用户密钥（K）和相关AKA算法，经过用户终端和注册服务器间的认证与密钥协商过程，分别得到了第一安全参数和第二安全参数，从而可用于后续过程中用户终端与注册服务器间的安全认证。
十、认证与密钥协商过程实施例二
请参考图9，其示出了本发明提供的认证与密钥协商过程实施例二的流程图，该过程是基于认证与密钥协商机制为5G AKA机制而实现的，该过程可用于图1所示的实施环境中，其中用户数据系统为统一数据管理UDM。该过程可以包括如下几个步骤：
步骤901.用户终端启动认证与密钥协商过程。
在获取到用于认证与密钥协商的操作指示之后，用户终端启动认证与密钥协商过程。
步骤902.用户终端获取移动用户标识。
使用的用户识别模块SIM是USIM卡，在USIM上获取的移动用户标识是SUPI。该移动用户标识和客户端安全认证过程实施例的流程中获取的移动用户标识是同一标识。
步骤903.用户终端向注册服务器发送认证与密钥协商请求，该认证与密钥协商请求中包括该移动用户标识。
用户终端向注册服务器发送认证与密钥协商请求，在该认证与密钥协商请求中包括该SUPI。
进一步地，将该SUPI加密生成SUCI，并将该SUCI作为该认证与密钥协商请求中的移动用户标识，即，用户终端向注册服务器发送认证与密钥协商请求，在该认证与密钥协商请求中包括该SUCI。
相应地，注册服务器接收用户终端发送的认证与密钥协商请求。
步骤904.注册服务器向统一数据管理UDM发送认证请求，该认证请求包括该移动用户标识。
注册服务器从用户终端发送的认证与密钥协商请求中获取移动用户标识，该移动用户标识是用户永久标识SUPI或用户隐藏标识SUCI。
注册服务器向统一数据管理UDM发送Nudm_Authentication_Get认证请求消息，该认证请求消息中包括该用户永久标识SUPI或用户隐藏标识SUCI以及服务网络名（SN name），该服务网络名是注册服务器的服务网络名。
需要说明的是，结合认证与密钥协商过程实施例一，如果注册服务器同时连接有归属用户服务器HSS和统一数据管理UDM，则注册服务器可以将认证请求消息发送给对应的归属用户服务器HSS或统一数据管理UDM，例如根据认证与密钥协商请求中移动用户标识的类型或范围确定认证请求消息是要发送给归属用户服务器HSS还是统一数据管理UDM。
步骤905.注册服务器接收统一数据管理UDM反馈的认证应答消息，该认证应答消息包括随机数RAND、鉴权令牌AUTN、期望响应值XRES*和第二密钥KAUSF。
在统一数据管理UDM接收注册服务器的认证请求之后，统一数据管理UDM向注册服务器返回认证向量AV*，该认证向量AV包括随机数RAND、鉴权令牌AUTN、期望响应值XRES*和第二密钥KAUSF。
具体的，在统一数据管理UDM接收注册服务器的认证请求消息之后，统一数据管理UDM向注册服务器返回Nudm_Authenticate_Get应答消息。在Nudm_Authenticate_Get应答消息中包括5G HE AV，该5G HE AV包括随机数RAND、鉴权令牌AUTN、期望响应值XRES*和第二密钥KAUSF。如果注册服务器向统一数据管理UDM发送的Nudm_Authentication_Get认证请求消息中包括用户隐藏标识SUCI，则返回的Nudm_Authenticate_Get应答消息中还包括经过对用户隐藏标识SUCI解密后得到的用户永久标识SUPI，并将该解密后的用户永久标识SUPI作为后续步骤中的移动用户标识。
相应地，注册服务器从该认证应答消息中获取随机数RAND、鉴权令牌AUTN、期望响应值XRES*和第二密钥KAUSF。
步骤906.注册服务器向用户终端发送认证与密钥协商挑战消息，该认证与密钥协商挑战消息包括该随机数RAND和该鉴权令牌AUTN。
注册服务器保留期望响应值XRES*和该密钥KAUSF，并向用户终端发送认证与密钥协商挑战消息，该认证与密钥协商挑战消息包括该随机数RAND和该鉴权令牌AUTN。
相应地，用户终端接收注册服务器发送的认证与密钥协商挑战消息，并从中获取该随机数RAND和该鉴权令牌AUTN。
步骤907.用户终端向用户识别模块SIM发送鉴权请求，该鉴权请求包括该随机数RAND和该鉴权令牌AUTN。
用户终端向用户识别模块SIM发送鉴权请求（例如通过发送APDU命令AUTHENTICATE），传递参数为该随机数RAND和该鉴权令牌AUTN。
步骤908.用户终端接收用户识别模块SIM的返回值，该返回值包括期望响应值RES、第一加密密钥CK和第一完整性密钥IK。
在用户识别模块SIM接收到用户终端发送的鉴权请求之后，用户识别模块SIM经过鉴权计算后向用户终端发送返回值，该返回值包括期望响应值RES、第一加密密钥CK和第一完整性密钥IK，用户终端接收该返回值。
步骤909.用户终端向注册服务器发送认证与密钥协商挑战应答消息，该认证与密钥协商挑战应答消息包括期望响应值RES*，该期望响应值RES*是基于所述期望响应值RES生成的。
用户终端遵照TS33.501 Annex A.4中“RES*和XRES*派生函数”中使用的方式，即使用和统一数据管理UDM生成期望响应值XRES*相同的方式生成期望响应值RES*。
进一步地，为了保护期望响应值RES*的安全，避免在传输过程中被泄露，还可以使用哈希算法（例如SHA256）对期望响应值RES*进行哈希计算，只发送期望响应值RES*经哈希计算后所生成的哈希值，而不发送期望响应值RES*的明文。
相应地，注册服务器接收用户终端发送的该期望响应值RES*或该期望响应值RES*的哈希值。
步骤910.注册服务器基于该期望响应值XRES*验证该期望响应值RES*；若验证有效，则执行步骤911。
注册服务器从接收的认证与密钥挑战应答消息中获取该期望响应值RES*或期望响应值RES*的哈希值，注册服务器将本地保留的该期望响应值XRES*对其进行验证。若验证有效，则执行下述步骤911；若验证无效，则向用户终端发送认证与密钥协商应答消息，该认证与密钥协商应答消息是认证与密钥协商失败应答消息，并执行下述步骤913。
相应的，若是将期望响应值RES*的明文发送给注册服务器，则比较该期望响应值XRES*和该期望响应值RES*是否一致；若一致，则确定验证有效；若不一致则确定验证无效。
相应的，若是将期望响应值RES*的哈希值发送给注册服务器，则将该期望响应值XRES*使用相同的哈希计算方式计算生成哈希值，并且比较两个哈希值是否一致；若一致，则确定验证有效；若不一致则确定验证无效。
步骤911.注册服务器生成第二安全参数，该第二安全参数包括安全令牌或/和第二根密钥，并且建立该第二安全参数与该移动用户标识的对应关系。
注册服务器生成第二安全参数，该第二安全参数包括安全令牌或/和第二根密钥，并且建立该第二安全参数与该移动用户标识的对应关系。具体的，实施方式包括：
第一种实施方式，注册服务器生成安全令牌，并且建立该安全令牌与移动用户标识的对应关系。
注册服务器生成安全令牌，并且建立该安全令牌与该移动用户标识的对应关系，以使得根据该安全令牌可以获取到该移动用户标识。
例如，注册服务器生成安全令牌，该安全令牌是全局唯一的安全令牌，并且具有足够的长度和足够的随机性，使得难以被猜测破解。同时，建立该安全令牌与该移动用户标识的对应关系，以使得根据该安全令牌在该对应关系中能获取到该对应的移动用户标识。
又例如，注册服务器使用对称加密算法基于预置密钥将包括移动用户标识的信息加密，将加密后得到的密文作为安全令牌，以使得注册服务器在对该安全令牌解密后获得该移动用户标识。以生成安全令牌的对称加密算法为AES为例，加密方式可以表示为：s=AES_ENCRYPT(m,k)，其中m是明文，该明文为包括该移动用户标识的信息，k是加密密钥即预置密钥，AES_ENCRYPT是加密算法，s是加密结果即安全令牌。
第二种实施方式，注册服务器基于该第二密钥KAUSF生成第二根密钥，并且建立该移动用户标识与该第二根密钥的对应关系。
例如，以该第二密钥KAUSF作为第二根密钥。
又例如，基于包括该第二密钥KAUSF以及第四固定字符串（2）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识的信息生成第二根密钥；其中，该第四固定字符串（2）为预先配置的并且与用户终端上预先配置的第四固定字符串（1）的值相同的字符串，该第四随机字符串为本地随机生成的字符串，该第四时间戳为通过获取注册服务器的当前系统时间生成。具体地，以密钥派生算法公式为例，可以表示为：DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第二根密钥，PBKDF2是密钥派生算法，passphrase是该第二密钥KAUSF以及第四固定字符串（2）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识组合拼接的字符串；Salt是盐值，在本例中是一个固定字符串；c是迭代次数；dlLen是密钥输出长度，可以根据需要生成符合要求的密钥长度。
在注册服务器上建立该移动用户标识与该第二根密钥的对应关系，以使得注册服务器将能够根据该移动用户标识在该对应关系中查找和获取到该第二根密钥。
如果注册服务器上已经存储有该移动用户标识和第二根密钥的对应关系，则使用本次生成的该第二根密钥替换该移动用户标识已经存储的对应的第二根密钥。
上述第一种实施方式和第二种实施方式可以分别应用，也可以同时应用。
需要说明的是，本步骤还可以在步骤912即注册服务器向用户终端发送认证与密钥协商成功应答消息之后执行，本发明实施例并不对此进行限定。
步骤912.注册服务器向用户终端发送认证与密钥协商应答消息，该认证与密钥协商应答消息是认证与密钥协商成功应答消息。
如果生成的第二安全参数中包括安全令牌，则在该认证与密钥协商成功应答消息中还包括该安全令牌。
如果在生成第二根密钥的信息中还包括第四随机字符串或/和第四时间戳，则在该认证与密钥协商成功应答消息中还包括该第四随机字符串或/和该第四时间戳。
步骤913.用户终端接收注册服务器发送的认证与密钥协商应答消息并执行相应的操作。
用户终端接收注册服务器发送的认证与密钥协商应答消息，该认证与密钥协商应答消息包括认证与密钥协商成功应答消息或认证与密钥协商失败应答消息。
用户终端根据该认证与密钥协商应答消息执行相应的操作，包括：
如果该认证与密钥协商应答消息是认证与密钥协商成功应答消息，则用户终端执行下述步骤914。
如果该认证与密钥协商应答消息是认证与密钥协商失败应答消息，则不执行下述步骤，结束本次认证与密钥协商流程。
步骤914.用户终端获得第一安全参数，该第一安全参数包括该安全令牌或/和第一根密钥。
与注册服务器生成第二安全参数相对应的，用户终端获得第一安全参数，该第一安全参数包括该安全令牌或/和第一根密钥，具体包括：
第一种实施方式，在认证与密钥协商成功应答消息中还包括该安全令牌，用户终端获取该安全令牌。
第二种实施方式，用户终端使用和注册服务器相同的根密钥生成方式，基于第一密钥KAUSF生成第一根密钥，该第一密钥KAUSF是基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成第一密钥KAUSF的。
用户终端遵照TS33.501 Annex A.2中“KAUSF派生函数”中使用的方式，即使用和统一数据管理UDM生成第二密钥KAUSF相同的方式生成第一密钥KAUSF，再基于该第一密钥KAUSF生成第一根密钥。
相应地，如果在步骤911注册服务器以该第二密钥KAUSF作为第二根密钥，则用户终端以该第一密钥KAUSF作为第一根密钥。
相应地，如果在步骤911中注册服务器基于包括该第二密钥KAUSF以及第四固定字符串（2）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识的信息生成第二根密钥，则用户终端基于包括该第一密钥KAUSF以及第四固定字符串（1）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识的信息生成第一根密钥；其中，该第四固定字符串（1）是在用户终端上预先配置的并且与注册服务器上生成第二根密钥时所使用的第四固定字符串（2）的值相同的字符串；第四随机字符串或/和第四时间戳是从注册服务器发送的认证与密钥协商成功应答消息中所获取的。具体地，以使用和步骤911注册服务器相同的密钥派生算法为例，密钥派生算法公式可以表示为DK = PBKDF2(passphrase，Salt，c，dkLen)，其中：DK是生成的第一根密钥；PBKDF2是与注册服务器相同的密钥派生算法；passphrase是该第一密钥KAUSF以及第四固定字符串（1）或/和第四随机字符串或/和第四时间戳或/和该移动用户标识组合拼接的字符串，并且组合拼接方式与注册服务器一致；Salt是盐值，是一个与注册服务器相同的固定字符串；c是与注册服务器相同的迭代次数；dlLen是与注册服务器相同的密钥输出长度。
由于用户终端上生成的第一密钥KAUSF与注册服务器上获取的第二密钥KAUSF的值相同，又由于根密钥的生成方式一致，因此，在用户终端上生成的第一根密钥与注册服务器上生成的第二根密钥的值相同。
通过本实施例提供的方法，用户终端基于用户识别模块SIM中存储的移动用户标识、移动用户密钥（K）和相关AKA算法，以及注册服务器基于统一数据管理UDM中存储的移动用户标识、移动用户密钥（K）和相关AKA算法，经过用户终端和注册服务器间的认证与密钥协商过程，分别得到了第一安全参数和第二安全参数，从而可用于后续过程中用户终端与注册服务器间的安全认证。
 
此外，为实现上述目的，本发明还提供一种客户端注册装置，所述客户端注册装置应用于运行有第三方应用客户端的用户终端中，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的客户端注册程序，所述客户端注册程序被所述处理器执行时实现上述的客户端注册方法的步骤。
此外，为实现上述目的，本发明还提供一种客户端注册装置，所述客户端注册装置应用于注册服务器，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的客户端注册程序，所述客户端注册程序被所述处理器执行时实现上述的客户端注册方法的步骤。
此外，为实现上述目的，本发明还提供一种客户端注册系统，所述客户端注册系统包括：用户终端以及注册服务器；
所述用户终端包括上述应用于运行有第三方应用客户端的用户终端中的客户端注册装置；
所述注册服务器包括上述应用于注册服务器的客户端注册装置。
此外，为实现上述目的，本发明还提供一种用于客户端注册的存储介质，其特征在于，所述存储介质中存储有程序，所述程序用于实现包括上述应用于运行有第三方应用客户端的用户终端中的客户端注册方法。
此外，为实现上述目的，本发明还提供一种用于客户端注册的存储介质，其特征在于，所述存储介质中存储有程序，所述程序用于实现包括上述应用于注册服务器的客户端注册方法。
 
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者系统不仅包括那些要素，而且还可以包括没有明确列出的其他要素，或者是还可以包括为这种过程、方法、物品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者系统中还存在另外的相同要素。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
可以以许多方式来实现本发明的方法、装置和系统。例如，可通过软件、硬件、固件或者软件、硬件、固件的任何组合来实现本发明的方法和系统。用于方法的步骤的上述顺序仅是为了进行说明，本发明的方法的步骤不限于以上具体描述的顺序，除非以其它方式特别说明。此外，在一些实施例中，还可将本发明实施为记录在记录介质中的程序，这些程序包括用于实现根据本发明的方法的机器可读指令。因而，本发明还覆盖存储用于执行根据本发明的方法的程序的记录介质。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
 工业实用性
本发明实现了为在用户终端中运行的第三方应用客户端提供了安全的注册环境，进而能为第三方应用客户端自动获取包括用户标识、用户密钥或用户令牌等在内的注册信息，进而解决现有第三方应用客户端在注册账号、协商共享密钥、获取用户令牌、用户身份认证等过程中使用较为烦琐从而影响用户使用体验的技术问题，整个过程不需要用户输入或仅少量输入信息，提升了用户的使用体验。
 序列表自由内容
在此处键入序列表自由内容描述段落。

Claims (42)

1.一种客户端注册方法，其特征在于，应用于运行有第三方应用客户端的用户终端中，所述方法包括：
基于用户识别模块SIM与注册服务器进行认证与密钥协商，其中包括向所述注册服务器发送移动用户标识和获得第一安全参数，所述第一安全参数包括安全令牌或/和第一根密钥，所述移动用户标识为所述用户识别模块SIM的标识；
基于所述第一安全参数与所述注册服务器进行安全认证；
在所述安全认证成功之后，接收所述注册服务器提供的注册信息和服务。
2.根据权利要求1所述的方法，其特征在于，所述基于用户识别模块SIM与注册服务器进行认证与密钥协商包括：
从所述用户识别模块SIM获取所述移动用户标识；
向所述注册服务器发送认证与密钥协商请求，所述认证与密钥协商请求包括所述移动用户标识；
接收所述注册服务器发送的认证与密钥协商挑战消息，所述认证与密钥协商挑战消息包括随机数RAND和鉴权令牌AUTN；
向所述用户识别模块SIM发送鉴权请求，所述鉴权请求包括所述随机数RAND和所述鉴权令牌AUTN；
接收所述用户识别模块SIM的返回值，所述返回值包括期望响应值RES、第一加密密钥CK和第一完整性密钥IK；
向所述注册服务器发送认证与密钥协商挑战应答消息，所述认证与密钥协商挑战应答消息包括第一期望响应值，所述第一期望响应值是基于所述期望响应值RES生成的；
接收所述注册服务器发送的认证与密钥协商成功应答消息，所述认证与密钥协商成功应答消息是在所述注册服务器验证所述第一期望响应值有效之后发送的；
获得第一安全参数，所述第一安全参数包括安全令牌或/和第一根密钥，具体包括：
所述认证与密钥协商成功应答消息中包括所述安全令牌，从所述认证与密钥协商成功应答消息中获取所述安全令牌；或/和，
基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成所述第一根密钥，并且所述第一根密钥的生成方式与所述注册服务器生成第二根密钥的生成方式一致。
3.根据权利要求2所述的方法，其特征在于，所述基于用户识别模块SIM与注册服务器进行认证与密钥协商是基于3G/4G AKA机制的，则：
所述用户识别模块SIM为全球用户识别模块USIM，所述移动用户标识为国际移动用户识别码IMSI；或者，所述用户识别模块SIM为IP多媒体服务识别模块ISIM，所述移动用户标识为IP多媒体私有标识IMPI；
所述第一期望响应值为所述期望响应值RES；或者，所述第一期望响应值为对所述期望响应值RES哈希计算后所生成的哈希值。
4.根据权利要求2所述的方法，其特征在于，所述基于用户识别模块SIM与注册服务器进行认证与密钥协商是基于5G AKA机制的，则：
所述用户识别模块SIM为全球用户识别模块USIM，所述移动用户标识为用户永久标识SUPI；
所述基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成所述第一根密钥包括：基于所述第一加密密钥CK或/和所述第一完整性密钥IK生成第一密钥KAUSF，并且基于所述第一密钥KAUSF生成所述第一根密钥；
所述第一期望响应值为期望响应值RES*，所述期望响应值RES*是基于所述期望响应值RES生成的；或者，所述第一期望响应值为对所述期望响应值RES*哈希计算后所生成的哈希值。
5.根据权利要求4所述的方法，其特征在于，所述向所述注册服务器发送认证与密钥协商请求包括：
将所述用户永久标识SUPI加密生成用户隐藏标识SUCI；
在所述向所述注册服务器发送的认证与密钥协商请求中，将所述用户隐藏标识SUCI作为所述移动用户标识。
6.根据权利要求1所述的方法，其特征在于，若所述第一安全参数包括安全令牌，则所述基于所述第一安全参数与所述注册服务器进行安全认证包括：
向所述注册服务器发送安全认证请求，所述安全认证请求包括所述安全令牌；
若所述注册服务器验证所述安全令牌有效，则确定安全认证成功。
7.根据权利要求1所述的方法，其特征在于，若所述第一安全参数包括第一根密钥，则所述基于所述第一安全参数与所述注册服务器进行安全认证包括：
基于所述第一根密钥生成第一认证密钥；
生成第一验证信息，并且使得所述第一验证信息与所述注册服务器生成的第二验证信息的值相同；
基于所述第一认证密钥和所述第一验证信息加密生成第一加密值；
将所述移动用户标识和所述第一加密值发送给所述注册服务器；
若所述注册服务器验证所述第一加密值有效，则确定安全认证成功。
8.根据权利要求7所述的方法，其特征在于，所述基于所述第一根密钥生成第一认证密钥包括：
将所述第一根密钥作为所述第一认证密钥；或者，
基于包括所述第一根密钥以及第一固定字符串或/和第一随机字符串或/和第一时间戳或/和所述移动用户标识或/和第三方应用标识的信息生成第一认证密钥，并且所述第一认证密钥的生成方式与所述注册服务器生成第二认证密钥的生成方式一致，所述第一固定字符串为预先配置的并且与所述注册服务器预先配置的第一固定字符串的值相同的字符串，所述第一随机字符串为随机生成的字符串，所述第一时间戳为通过获取所述用户终端的当前系统时间生成，所述第三方应用标识是所述第三方应用客户端的标识；
若生成所述第一认证密钥的信息包括所述第一随机字符串或/和第一时间戳或/和所述第三方应用标识，则将所述第一随机字符串或/和所述第一时间戳或/和所述第三方应用标识发送给所述注册服务器。
9.根据权利要求7所述的方法，其特征在于，所述生成第一验证信息包括：
基于第二固定字符串或/和第二随机字符串或/和第二时间戳或/和所述移动用户标识或/和所述第三方应用标识生成所述第一验证信息，并且所述第一验证信息的生成方式与所述注册服务器生成第二验证信息的生成方式一致，所述第二固定字符串为预先配置的并且与所述注册服务器预先配置的第二固定字符串的值相同的字符串，所述第二随机字符串为随机生成的字符串，所述第二时间戳为通过获取所述用户终端的当前系统时间生成；
若生成所述第一验证信息包括基于所述第二随机字符串或/和第二时间戳或/和所述第三方应用标识，并且使用签名加密算法基于所述第一认证密钥对所述第一验证信息签名加密生成所述第一加密值，则将所述第二随机字符串或/和所述第二时间戳或/和所述第三方应用标识发送给所述注册服务器。
10.根据权利要求9所述的方法，其特征在于，所述基于第二固定字符串或/和第二随机字符串或/和第二时间戳或/和所述移动用户标识或/和所述第三方应用标识生成所述第一验证信息包括：
将所述第二固定字符串或所述第二随机字符串或所述第二时间戳或所述移动用户标识或所述第三方应用标识中的一种作为所述第一验证信息；或者，
根据包括所述第二固定字符串或/和所述第二随机字符串或/和所述第二时间戳或/和所述移动用户标识或/和所述第三方应用标识的信息生成所述第一验证信息。
11.根据权利要求7所述的方法，其特征在于，所述基于所述第一认证密钥和所述第一验证信息加密生成第一加密值包括：
使用签名加密算法基于所述第一认证密钥对所述第一验证信息签名加密生成所述第一加密值；或者，
使用对称加密算法基于所述第一认证密钥对包括所述第一验证信息的信息对称加密生成所述第一加密值。
12.根据权利要求1所述的方法，其特征在于，若向所述注册服务器传递了第三方应用标识以及若所述安全认证成功，则所述接收所述注册服务器提供的注册信息和服务包括：
接收所述注册服务器发送的第三方用户标识，所述第三方用户标识用于在所述第三方应用客户端中标识用户身份；或者，
接收所述注册服务器发送的用户令牌，所述用户令牌用于所述第三方应用客户端访问对应第三方应用服务器的认证鉴权。
13.根据权利要求12所述的方法，其特征在于，所述向所述注册服务器传递第三方应用标识包括：
在向所述注册服务器发送的安全认证请求中还包括所述第三方应用标识；或者，
若使用对称加密算法基于所述第一认证密钥对包括所述第一验证信息的信息对称加密生成所述第一加密值，则在生成所述第一验证信息的信息中还包括所述第三方应用标识，以使得所述注册服务器从对所述第一加密值解密后的明文中获取所述第三方应用标识。
14.根据权利要求12所述的方法，其特征在于，若所述第一安全参数包括所述第一根密钥，并且若接收到所述注册服务器发送的第三方用户标识，则在所述接收所述注册服务器提供的注册信息和服务之后，还包括：
基于所述第一根密钥生成第一用户密钥，所述第一用户密钥的生成方式与所述注册服务器生成第二用户密钥的生成方式一致，所述第一用户密钥用于在所述第三方应用客户端中作为所述第三方用户标识的密钥。
15.根据权利要求14所述的方法，其特征在于，所述基于所述第一根密钥生成第一用户密钥包括：
基于包括所述第一根密钥以及第三固定字符串或/和第三随机字符串或/和第三时间戳或/和所述移动用户标识或/和第三方应用标识的信息生成第一用户密钥，所述第三固定字符串为预先配置的并且与所述注册服务器预先配置的第三固定字符串的值相同的字符串，所述第三随机字符串或/和所述第三时间戳为所述注册成功应答消息中所包括的。
16.根据权利要求12至15任一项所述的方法，其特征在于，在若向所述注册服务器传递了第三方应用标识以及若所述安全认证成功之后，以及在所述接收所述注册服务器提供的注册信息和服务之前，还包括：
接收所述注册服务器发送的应用授权请求消息；
显示应用授权验证界面；
接收终端用户在所述应用授权验证界面中输入的授权信息；
若所述授权信息表示确认授权，则向所述注册服务器发送应用授权应答消息，所述应用授权应答消息为应用授权确认消息。
17.一种客户端注册方法，其特征在于，应用于注册服务器中，所述方法包括：
接收用户终端（1）发起的认证与密钥协商，基于用户数据系统进行所述认证与密钥协商，其中包括生成第二安全参数并且建立所述第二安全参数与移动用户标识（1）的对应关系，所述第二安全参数包括安全令牌（1）或/和第二根密钥（1），所述移动用户标识（1）为所述用户终端（1）发送的；
接收用户终端（2）发起的安全认证，基于所述对应关系进行所述安全认证，其中包括获取所述用户终端（2）对应的移动用户标识（2）；
在所述安全认证成功之后，向所述用户终端（2）提供注册信息和服务。
18.根据权利要求17所述的方法，其特征在于，所述基于用户数据系统进行所述认证与密钥协商包括：
接收所述用户终端（1）发送的认证与密钥协商请求，所述认证与密钥协商请求包括所述移动用户标识（1）；
向用户数据系统发送认证请求，所述认证请求包括所述移动用户标识（1）；
接收所述用户数据系统反馈的认证应答消息，所述认证应答消息包括随机数RAND、鉴权令牌AUTN、初始密钥及第二期望响应值；
向所述用户终端发送认证与密钥协商挑战消息，所述认证与密钥协商挑战消息包括所述随机数RAND和所述鉴权令牌AUTN；
接收所述用户终端发送的认证与密钥协商挑战应答消息，所述认证与密钥协商挑战应答消息包括第一期望响应值；
基于所述第二期望响应值验证所述第一期望响应值；
若验证所述第一期望响应值有效，则生成第二安全参数，并且建立所述第二安全参数与所述移动用户标识（1）的对应关系；
向所述用户终端（1）发送认证与密钥协商成功应答消息；
其中，所述第二安全参数包括安全令牌（1）或/和第二根密钥（1），具体包括：
生成所述安全令牌（1），在所述认证与密钥协商成功应答消息中包括所述安全令牌（1）；或/和，
基于所述初始密钥生成所述第二根密钥（1），并且所述第二根密钥（1）的生成方式与所述用户终端生成所述第一根密钥的生成方式一致。
19.根据权利要求18所述的方法，其特征在于，所述基于所述第二期望响应值验证所述第一期望响应值包括：
所述第一期望响应值为明文，比较所述第二期望响应值与所述第一期望响应值是否一致，若一致则确定所述第一期望响应值有效；或者，
所述第一期望响应值为哈希计算后的哈希值，将所述第二期望响应值使用相同的哈希计算方式计算生成哈希值，并且比较两个哈希值是否一致，若一致则确定所述第一期望响应值有效。
20.根据权利要求18所述的方法，其特征在于，所述生成所述安全令牌（1）包括：
使用随机生成的全局唯一字符串作为所述安全令牌（1），并且建立所述安全令牌（1）与所述移动用户标识（1）的对应关系；或者，
使用对称加密算法基于预置密钥将包括所述移动用户标识（1）的信息加密，将加密后得到的密文作为所述安全令牌（1）。
21.根据权利要求18所述的方法，其特征在于，所述基于用户数据系统与用户终端进行认证与密钥协商是基于3G/4G AKA机制的，则：
所述移动用户标识（1）为国际移动用户识别码IMSI或者是IP多媒体私有标识IMPI；
所述用户数据系统为归属用户服务器HSS：
所述认证应答消息包括所述随机数RAND、所述鉴权令牌AUTN、第二加密密钥CK或/和第二完整性密钥IK以及期望响应值XRES；
所述初始密钥为所述第二加密密钥CK或/和所述第二完整性密钥IK；
所述第二期望响应值为所述期望响应值XRES；
所述认证与密钥协商挑战应答消息中包括的第一期望响应值为期望响应值RES；或者，
所述认证与密钥协商挑战应答消息中包括的第一期望响应值为对所述期望响应值RES哈希计算后所生成的哈希值。
22.根据权利要求18所述的方法，其特征在于，所述基于用户数据系统与用户终端进行认证与密钥协商是基于5G AKA机制的，则：
所述移动用户标识（1）为用户永久标识SUPI或用户隐藏标识SUCI；
所述用户数据系统为统一数据管理UDM；
所述认证应答消息包括所述随机数RAND、所述鉴权令牌AUTN、第二密钥KAUSF以及期望响应值XRES；
若所述移动用户标识（1）为用户隐藏标识SUCI，则所述认证应答消息中还包括对所述用户隐藏标识SUCI解密后得到的用户永久标识SUPI，并将所述解密后的用户永久标识SUPI作为所述移动用户标识（1）；
所述初始密钥为所述第二密钥KAUSF；
所述第二期望响应值为所述期望响应值XRES*；所述认证与密钥协商挑战应答消息中包括的第一期望响应值为期望响应值RES*；或者，所述认证与密钥协商挑战应答消息中包括的第一期望响应值为对所述期望响应值RES*哈希计算后所生成的哈希值。
23.根据权利要求17所述的方法，其特征在于，若所述第二安全参数包括安全令牌（1），则所述基于所述对应关系进行所述安全认证包括：
接收所述用户终端（2）发送的安全认证请求，所述安全认证请求包括安全令牌（2）；
若验证所述安全令牌（2）有效并获取到所述用户终端（2）对应的移动用户标识（2），则确定安全认证成功。
24.根据权利要求23所述的方法，其特征在于，所述若验证所述安全令牌（2）有效并获取到所述用户终端（2）对应的移动用户标识（2）包括：
与使用随机生成的全局唯一字符串作为所述安全令牌（1）相对应的，在存储的所有安全令牌与移动用户标识的对应关系中查找所述安全令牌（2）及所述安全令牌（2）对应的移动用户标识；若查找到，则确定所述安全令牌（2）有效，并确定该对应的移动用户标识为所述移动用户标识（2）；若没查找到，则确定所述安全令牌（2）无效；或者，
与使用对称加密算法基于预置密钥将包括所述移动用户标识（1）的信息加密后得到的密文作为所述安全令牌（1）相对应的，使用相同的对称加密算法基于所述预置密钥将所述安全令牌（2）解密，并获取所述解密后的明文中的移动用户标识；若能成功解密并获取到移动用户标识，则确定所述安全令牌（2）有效，并确定该获取到的移动用户标识为所述移动用户标识（2）；若否，则确定所述安全令牌（2）无效。
25.根据权利要求17所述的方法，其特征在于，若所述第二安全参数包括第二根密钥（1），则所述基于所述第二安全参数与所述注册服务器进行安全认证包括：
接收所述用户终端（2）发送的移动用户标识（2）和第一加密值；
根据所述移动用户标识（2）获取对应的第二根密钥（2）；
基于所述第二根密钥（2）生成第二认证密钥；
生成第二验证信息，并且使得所述第二验证信息与所述用户终端生成的第一验证信息的值相同；
基于所述第二认证密钥和所述第二验证信息验证所述第一加密值；
若所述第一加密值验证成功，则确定安全认证成功。
26.根据权利要求25所述的方法，其特征在于，所述基于所述第二根密钥（2）生成第二认证密钥包括：
将所述第二根密钥（2）作为所述第一认证密钥；或者，
基于包括所述第二根密钥以及第一固定字符串或/和第一随机字符串或/和第一时间戳或/和所述移动用户标识（2）或/和第三方应用标识的信息生成第一认证密钥，并且所述第二认证密钥的生成方式与所述用户终端生成第一认证密钥的生成方式一致，所述第一固定字符串为预先配置的并且与所述用户终端预先配置的第一固定字符串的值相同的字符串，所述第一随机字符串或/和所述第一时间戳或/和所述第三方应用标识为所述用户终端所发送的。
27.根据权利要求25所述的方法，其特征在于，所述生成第二验证信息包括：
基于第二固定字符串或/和第二随机字符串或/和第二时间戳或/和所述移动用户标识（2）或/和所述第三方应用标识生成所述第二验证信息，并且所述第二验证信息的生成方式与所述用户终端生成第一验证信息的生成方式一致，所述第二固定字符串为预先配置的并且与所述用户终端预先配置的第二固定字符串的值相同的字符串，所述第二随机字符串或/和所述第二时间戳或/和所述第三方应用标识为所述用户终端所发送的。
28.根据权利要求27所述的方法，其特征在于，所述基于第二固定字符串或/和第二随机字符串或/和所述移动用户标识或/和所述第三方应用标识生成所述第二验证信息包括：
将所述第二固定字符串或所述第二随机字符串或所述第二时间戳或所述移动用户标识（2）或所述第三方应用标识中的一种作为所述第二验证信息；或者，
根据包括所述第二固定字符串或/和所述第二随机字符串或/和第二时间戳或/和所述移动用户标识（2）或/和所述第三方应用标识的信息生成所述第二验证信息。
29.根据权利要求25所述的方法，其特征在于，所述基于所述第二认证密钥和所述第二验证信息验证所述第一加密值包括：
若所述用户终端（2）使用签名加密算法生成所述第一加密值，则使用相同的签名加密算法基于所述第二认证密钥和所述第二验证信息验证所述第一加密值；或者，
若所述用户终端（2）使用对称加密算法生成所述第一加密值，则使用相同的对称加密算法基于所述第二认证密钥和所述第二验证信息验证所述第一加密值。
30.根据权利要求29所述的方法，其特征在于，所述使用相同的签名加密算法基于所述第二认证密钥和所述第二验证信息验证所述第一加密值包括：
使用和所述用户终端（2）相同的签名加密算法，基于所述第二认证密钥对所述第二验证信息签名加密生成第二加密值；
比较所述第二加密值与所述第一加密值是否一致；
若一致，则确定所述第一加密值验证成功。
31.根据权利要求29所述的方法，其特征在于，所述使用相同的对称加密算法基于所述第二认证密钥和所述第二验证信息验证所述第一加密值包括：
使用和所述用户终端（2）相同的对称加密算法，基于所述第二认证密钥对所述第一加密值解密获得明文，并从所述解密获得的明文中获取第一验证信息；
比较所述第二验证信息与所述第一验证信息是否一致；
若一致，则确定所述第一加密值验证成功。
32.根据权利要求17所述的方法，其特征在于，若接收到所述用户终端（2）传递的第三方应用标识以及所述安全认证成功之后，则所述向所述用户终端（2）提供注册信息和服务包括：
获取所述第三方应用标识对应的第三方用户标识，向所述用户终端（2）提供注册信息和服务中包括所述第三方用户标识，以使得所述第三方用户标识用于在所述第三方应用标识对应的第三方应用客户端中标识用户身份；或者，
生成所述第三方应用标识对应的用户令牌，所述用户令牌为用于所述第三方应用客户端访问对应第三方应用服务器的认证鉴权，向所述用户终端（2）提供注册信息和服务中包括所述用户令牌，以使得所述用户令牌用于在所述第三方应用标识对应的第三方应用客户端中访问对应第三方应用服务器的认证鉴权。
33.根据权利要求32所述的方法，其特征在于，所述获取所述第三方应用标识对应的第三方用户标识包括：
根据所述移动用户标识（2）和所述第三方应用标识查找对应的第三方用户标识；
若查找到对应的第三方用户标识，则确定所述第三方用户标识为所述查找到的对应的第三方用户标识；
若没有查找到对应的第三方用户标识，则创建一个唯一的第三方用户标识，并且建立和存储所述移动用户标识（2）和所述第三方应用标识与所述创建的第三方用户标识的对应关系，以使得根据所述移动用户标识和所述第三方应用标识能查找到所述创建的第三方用户标识，并确定所述第三方用户标识为所述创建的第三方用户标识。
34.根据权利要求32所述的方法，其特征在于，若所述移动用户标识（2）有对应的第二根密钥（2），则所述获取所述第三方应用标识对应的第三方用户标识之后还包括：
基于所述第二根密钥（2）生成第二用户密钥，所述第二用户密钥的生成方式与所述用户终端生成第一用户密钥的生成方式一致；
建立所述第三方用户标识与所述第二用户密钥的对应关系。
35.根据权利要求34所述的方法，其特征在于，所述基于所述第二根密钥（2）生成第二用户密钥包括：
基于包括所述第二根密钥以及第三固定字符串或/和第三随机字符串或/和第三时间戳或/和所述移动用户标识（2）或/和所述第三方应用标识的信息生成第二用户密钥，所述第三固定字符串为预先配置的并且与所述用户终端预先配置的第三固定字符串的值相同的字符串，所述第三随机字符串为随机生成的字符串，所述第三时间戳为通过获取所述注册服务器的当前系统时间生成。
36.根据权利要求32所述的方法，其特征在于，所述生成所述第三方应用标识对应的用户令牌包括：
使用随机生成的全局唯一字符串作为所述用户令牌；
建立所述用户令牌与所述第三方应用标识或/和所述移动用户标识（2）的关联关系。
37.根据权利要求32至36中任一项所述的方法，其特征在于，在若接收到所述用户终端（2）传递的第三方应用标识以及所述安全认证成功之后，以及向所述用户终端（2）提供注册信息和服务之前，还包括：
向所述用户终端发送应用授权请求消息，所述应用授权请求消息包括第三方应用名称或/和移动用户名称，所述第三方应用名称是根据所述第三方应用标识获取的，所述移动用户名称是根据所述移动用户标识获取的；
接收所述用户终端发送的应用授权应答消息；
若所述应用授权应答消息为应用授权确认消息，则执行向所述用户终端（2）提供注册信息和服务的步骤。
38.一种客户端注册装置，其特征在于，所述客户端注册装置应用于运行有第三方应用客户端的用户终端中，包括：存储器、处理器，所述处理器用于运行所述存储器所存储的程序，所述程序运行时执行包括权利要求1至16中任一项所述的方法。
39.一种客户端注册装置，其特征在于，所述客户端注册装置应用于注册服务器，包括：存储器、处理器，所述处理器用于运行所述存储器所存储的程序，所述程序运行时执行包括权利要求17至37中任一项所述的方法。
40.一种客户端注册系统，其特征在于，所述客户端注册系统包括：
用户终端以及注册服务器；
所述用户终端包括如权利要求38所述的客户端注册装置；
所述注册服务器包括如权利要求39所述的客户端注册装置。
41.一种存储介质，其特征在于，所述存储介质中存储有程序，所述程序用于实现包括权利要求1至16中任一项所述的方法。
42.一种存储介质，其特征在于，所述存储介质中存储有程序，所述程序用于实现包括权利要求17至37中任一项所述的方法。
PCT/CN2019/074724 2018-08-23 2019-02-04 客户端注册方法、装置及系统 WO2020037957A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN201910775079.8A CN110858968A (zh) 2018-08-23 2019-08-22 客户端注册方法、装置及系统
CN201910774037.2A CN111050314B (zh) 2018-08-23 2019-08-22 客户端注册方法、装置及系统
CN201910777127.7A CN110858969A (zh) 2018-08-23 2019-08-22 客户端注册方法、装置及系统

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201810969927.4 2018-08-23
CN201810969927.4A CN109041205A (zh) 2018-08-23 2018-08-23 客户端注册方法、装置及系统
CN2019072129 2019-01-17
CNPCT/CN2019/072129 2019-01-17

Publications (1)

Publication Number Publication Date
WO2020037957A1 true WO2020037957A1 (zh) 2020-02-27

Family

ID=69592289

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/074724 WO2020037957A1 (zh) 2018-08-23 2019-02-04 客户端注册方法、装置及系统

Country Status (1)

Country Link
WO (1) WO2020037957A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103259795A (zh) * 2013-05-14 2013-08-21 百度在线网络技术（北京）有限公司 执行自动注册登录的方法、移动终端以及服务器
GB2518734A (en) * 2013-07-29 2015-04-01 Canon Kk Information processing apparatus, method of controlling the same, and storage medium
CN104660595A (zh) * 2015-02-10 2015-05-27 重庆善生缘科技有限公司 一种app快速注册及执行方法
CN109041205A (zh) * 2018-08-23 2018-12-18 刘高峰 客户端注册方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103259795A (zh) * 2013-05-14 2013-08-21 百度在线网络技术（北京）有限公司 执行自动注册登录的方法、移动终端以及服务器
GB2518734A (en) * 2013-07-29 2015-04-01 Canon Kk Information processing apparatus, method of controlling the same, and storage medium
CN104660595A (zh) * 2015-02-10 2015-05-27 重庆善生缘科技有限公司 一种app快速注册及执行方法
CN109041205A (zh) * 2018-08-23 2018-12-18 刘高峰 客户端注册方法、装置及系统

Similar Documents

Publication Publication Date Title
CN111050314B (zh) 客户端注册方法、装置及系统
US10638321B2 (en) Wireless network connection method and apparatus, and storage medium
US11228442B2 (en) Authentication method, authentication apparatus, and authentication system
CN108599925B (zh) 一种基于量子通信网络的改进型aka身份认证系统和方法
KR101485230B1 (ko) 안전한 멀티 ｕｉｍ 인증 및 키 교환
CN111050322B (zh) 基于gba的客户端注册和密钥共享方法、装置及系统
US8122250B2 (en) Authentication in data communication
KR101038064B1 (ko) 애플리케이션 인증
EP2296392A1 (en) Authentication method, re-certification method and communication device
WO2022111187A1 (zh) 终端认证方法、装置、计算机设备及存储介质
CN108880813B (zh) 一种附着流程的实现方法及装置
CN105553981B (zh) 一种wlan网络快速认证和密钥协商方法
TW201014314A (en) Techniques for secure channelization between UICC and a terminal
CN109075973B (zh) 一种使用基于id的密码术进行网络和服务统一认证的方法
US8397281B2 (en) Service assisted secret provisioning
WO2019051776A1 (zh) 密钥的传输方法及设备
CN108599926B (zh) 一种基于对称密钥池的HTTP-Digest改进型AKA身份认证系统和方法
CN111277583B (zh) 一种移动云计算的监控系统身份认证方法
Rao et al. Authenticating Mobile Users to Public Internet Commodity Services Using SIM Technology
WO2020037957A1 (zh) 客户端注册方法、装置及系统
JP2006191429A (ja) 集合型宅内ネットワークにおける認証方法及びシステム
Jain et al. SAP: a low-latency protocol for mitigating evil twin attacks and high computation overhead in WI-FI networks
WO2020037958A1 (zh) 基于gba的客户端注册和密钥共享方法、装置及系统
WO2022048125A1 (zh) 信息处理方法、装置、设备及存储介质
CN118802307A (zh) 通信鉴权方法及相关装置、存储介质、计算机程序产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19851490

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15.04.2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19851490

Country of ref document: EP

Kind code of ref document: A1