WO2022033186A1

WO2022033186A1 - General bootstrapping architecture-based authentication method and corresponding device

Info

Publication number: WO2022033186A1
Application number: PCT/CN2021/101804
Authority: WO
Inventors: 刘小军; 缪永生; 张宝健; 李如俊
Original assignee: 中兴通讯股份有限公司
Priority date: 2020-08-14
Filing date: 2021-06-23
Publication date: 2022-02-17
Also published as: CN114143016A

Abstract

The present disclosure provides a GBA-based authentication method, comprising: negotiating a transport layer security protocol with a user terminal to confirm a secret key algorithm suite used by the user terminal; and applying the secret key algorithm suite to a wireless access node, such that the wireless access node performs authentication by using the secret key algorithm suite. The present disclosure also provides a terminal, a gateway, the wireless access node, and a computer readable storage medium.

Description

Authentication method and corresponding device based on general bootstrap architecture

technical field

The embodiments of the present disclosure relate to, but are not limited to, the field of communication technologies, and in particular, relate to an authentication method and a corresponding device based on a universal bootstrap architecture.

Background technique

With the development of communication technology, in many communication services, many applications require interaction between the user terminal (User Equipment, UE) and the access layer (Access Stratum, AS), such as service activation, service setting, service access, etc. . In order to ensure the security of service applications, two-way authentication is required between the UE and the AS. If the UE and the AS interact directly, there are two serious problems: 1) Independent authentication must be performed between the UE and each AS, including Negotiation of authentication mechanism and management of secret key; 2) UE needs to input secret key every time it logs in to a different AS, resulting in poor user experience. Therefore, the Third Generation Partnership Project (3GPP) standard organization proposed the concept of a general authentication architecture, of which the General Bootstrapping Architecture (GBA) is a general authentication architecture based on a shared secret key. GBA uses Authentication and Key Agreement (AKA, the authentication and key agreement protocol of the third generation mobile communication network) to provide a mechanism for key sharing, mutual authentication and service protection between the UE and the network. It has high security and versatility. In GBA, a wireless access node (Access Point, AP) is added between the UE and the AS. The AP acts as an authentication proxy function to authenticate the UE, and the proxy AS completes the authentication of the UE. .

Because GBA provides public network service addresses, considering security and other factors, the actual networking introduces an Application Layer Gateway (ALG), which implements access control by ALG, such as firewall, antivirus, intrusion detection, and user access. Active authentication and other functions provide GBA with a comprehensive access security management solution. After ALG is introduced, UE and AP establish Transport Layer Security (TLS) tunnels with ALG respectively, which affects the authentication of AP to UE. .

SUMMARY OF THE INVENTION

An embodiment of the present disclosure provides a GBA-based authentication method applied to a terminal side, including: negotiating a security transport layer protocol with an application layer gateway to confirm the key algorithm suite used; The secret key algorithm suite is applied to the wireless access node so that the wireless access node uses the secret key algorithm suite for authentication.

Embodiments of the present disclosure also provide a GBA-based authentication method applied to a gateway side, including: negotiating a security transport layer protocol with a user terminal, confirming a key algorithm suite used by the user terminal; The algorithm suite is applied to the wireless access node such that the wireless access node uses the secret key algorithm suite for authentication.

Embodiments of the present disclosure also provide a GBA-based authentication method applied to a wireless access node, including: performing authentication by using a key algorithm suite applied to the wireless access node by an application layer gateway, wherein the key algorithm The suite is the secret key algorithm suite used by the user terminal for negotiation and confirmation of the security transport layer protocol between the application layer gateway and the user terminal.

An embodiment of the present disclosure further provides a terminal, where the terminal includes a first processor and a first memory, where the first processor is configured to execute one or more computer programs stored in the first memory, so as to implement the computer program according to the present disclosure. GBA-based authentication method applied to terminal testing.

An embodiment of the present disclosure further provides a gateway, the gateway includes a second processor and a second memory, where the second processor is configured to execute one or more computer programs stored in the second memory, so as to implement the method according to the present disclosure. GBA-based authentication method applied to the gateway side.

An embodiment of the present disclosure further provides a wireless access node, where the wireless access node includes a third processor and a third memory, where the third processor is configured to execute one or more computer programs stored in the third memory to implement The GBA-based authentication method applied to the wireless access node side according to the present disclosure.

The embodiments of the present disclosure further provide a computer storage medium, on which one or more programs are stored, and the one or more programs can be executed by one or more processors, so as to implement the application of the present disclosure on the terminal side, GBA-based authentication method on the gateway side or the wireless access node side.

Description of drawings

1 is a schematic diagram of the GBA basic architecture provided by the present disclosure;

Fig. 2 is the basic authentication flow schematic diagram of GBA provided by the present disclosure;

Fig. 3 is the schematic flowchart of the authentication method of GBA provided by the present disclosure;

4 is a schematic schematic diagram of the basic flow of applying a secret key algorithm suite to a wireless access node through an application layer gateway provided by the present disclosure;

5 is another basic schematic flow diagram of applying a key algorithm suite to a wireless access node through an application layer gateway provided by the present disclosure;

6 is another basic schematic flow chart of applying a key algorithm suite to a wireless access node through an application layer gateway provided by the present disclosure;

FIG. 7 is another schematic flow chart of applying the secret key algorithm suite to the wireless access node through the application layer gateway of the present disclosure;

Fig. 8 is the basic flow schematic diagram of the authentication method of GBA provided by the present disclosure;

FIG. 9 is a schematic diagram of the basic structure of the terminal provided by the present disclosure;

FIG. 10 is a schematic diagram of the basic structure of the gateway provided by the present disclosure; and

FIG. 11 is a schematic diagram of the basic structure of a wireless access node provided by the present disclosure.

detailed description

In order to make the objectives, technical solutions and advantages of the present disclosure more clear, the embodiments of the present disclosure will be further described in detail below through specific implementations in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present disclosure, but not to limit the present disclosure.

As shown in Figure 1, Figure 1 is a schematic diagram of the basic architecture of GBA, which includes: a user's home network server (Home Subscribe Server, HSS), a bootstrapping server function (Bootstrapping Server Function, BSF), a network application function (Network Application Function, NAF) Or wireless access node (Access Point, AP) function, ALG, it needs to be understood that NAF is used to perform the same function as AP, that is, AP or NAF only needs to exist. The ALG establishes TLS channels with the UE and the AP respectively, and performs authentication. As shown in Figure 2, the UE negotiates a TLS connection with the ALG, confirms the cipher suite used, and the cipher suite finally used is "yyzz". The UE sends a service request (HTTP GET) to the ALG, the ALG negotiates a TLS connection with the AP, and confirms the cipher suite used. The cipher suite finally used is "aabb". The ALG forwards the HTTP GET to the AP. After the AP responds with 401Unauthorized to the UE, the UE generates the first Ks_NAF/Ks_int_NAF according to the TLS cipher suite ("yyzz") negotiated with the ALG and other parameters, and then uses the first Ks_NAF/Ks_int_NAF as the key ( key) to calculate the first response (response), and send the first response to the AP through the ALG. The AP obtains the second Ks_NAF/Ks_int_NAF from the BSF according to the TLS cipher suite ("aabb") negotiated with the ALG and other parameters, and then The second Ks_NAF/Ks_int_NAF is used as the key to calculate the second response. The AP compares the second response calculated by itself with the first response sent by the UE. If the second response is consistent with the first response, the authentication is successful, but because the AP uses the The TLS cipher suite is inconsistent with the TLS cipher suite used by the UE, and the calculated Ks_NAF/Ks_int_NAF and responses will also be inconsistent, resulting in AP authentication failure.

In order to solve the problem that after the UE and the AP establish TLS tunnels with the ALG respectively, different key algorithm suites are used, which leads to authentication failure, thus affecting the authentication and authentication of the AP to the UE, the present disclosure provides a user terminal (UE) The GBA-based authentication method on the side is shown in FIG. 3, which includes steps S301 to S302.

In step S301, negotiate with the application layer gateway (ALG) on the transport layer protocol (TSL) to confirm the key algorithm suite to be used.

In step S302, the key algorithm suite is applied to the wireless access node (AP) through the ALG, so that the AP uses the key algorithm suite for authentication.

The UE negotiates a TLS connection with the ALG, and confirms the Cipher Suite used by the UE and the ALG. It should be understood that the present disclosure does not limit the manner in which the UE and the ALG negotiate the TSL, and the key algorithm suite that can be used between the UE and the ALG can finally be determined.

In the present disclosure, applying the key algorithm suite determined by the UE and the ALG to the AP includes but is not limited to the following two ways:

The first way: forward the key algorithm suite to the AP through the ALG, so as to apply the key algorithm suite to the AP;

The second way: use the secret key algorithm suite to negotiate the security transport layer protocol with the AP through the ALG, so as to apply the secret key algorithm suite to the AP.

The above-mentioned first manner may include: sending the service request to the ALG; forwarding the service request to the AP through the ALG, and the ALG carrying the key algorithm suite when forwarding the service request to the AP. The UE sends a service request to the ALG, and the ALG sends the secret key algorithm suite used by the UE side to the AP through extended parameters. When the AP authenticates, the authentication is performed according to the secret key algorithm suite sent by the ALG. For example, steps 1 to 10 are shown in FIG. 4 .

In steps 1 to 2, the UE negotiates a Transport Layer Security (TLS) connection with the ALG, and confirms that the Cipher Suite used by the UE and the ALG is "yyzz".

In step 3, the UE initiates a service request (HTTP GET) to the ALG.

In steps 4 to 5, the ALG negotiates a TLS connection with the AP, confirms the cipher suite used on the AP side, and confirms that the cipher suite finally used on the AP side is "aabb";

In step 6, the ALG forwards the HTTP GET request of the UE, and sends the cipher suite "yyzz" used by the UE side to the AP through the extended parameters, so that the AP performs the processing according to the UE carried by the ALG and the cipher suite ("yyzz") used by the ALG. Authentication, that is, applying the cipher suite to the AP through the ALG, so that the AP uses the same cipher suite ("yyzz") as the UE to achieve authentication.

In steps 7 to 8, after receiving the cipher suite "yyzz" used by the UE side, the AP sends a 401 unauthorized (unauthorized) response to the ALG, and forwards it to the UE via the ALG.

In step 9, the UE generates the first Ks_NAF/KS_int_NAF according to the UE side cipher suite ("yyzz") negotiated with the ALG and other parameters, and then uses the first Ks_NAF/KS_int_NAF as the key to calculate the first response (response), and sends it to the ALG , and then forwarded to the AP via the ALG.

In step 10, the AP obtains the second KS_NAF/KS_int_NAF from the BSF according to the cipher suite ("yyzz") used by the UE side carried by the ALG and other parameters, and then uses the second KS_NAF/KS_int_NAF as the key to calculate the second response, and the AP compares the first The first response and the second response, if the second response is consistent with the first response, the authentication is successful, because the cipher suite used by the AP is the same as the cipher suite used by the UE, the calculation of Ks_NAF/Ks_int_NAF and the response will also be consistent, and the final AP authentication success.

The above-mentioned first manner may further include: sending a service request to the ALG, where the service request carries the key algorithm suite; and forwarding the service request to the AP through the ALG. When the UE sends the service request to the ALG, the UE carries the key algorithm suite used by the UE side in the service request and sends it to the ALG, and the ALG forwards the service request to the AP. Key algorithm suite for authentication. For example, steps 1 to 10 are shown in FIG. 5 .

In step 3, the UE initiates a service request (HTTP GET) to the ALG, and the service request carries the determined cipher suite ("yyzz") through extended parameters.

In steps 4 to 5, the ALG negotiates a TLS connection with the AP, and confirms that the cipher suite used on the AP side is "aabb";

In step 6, when the ALG forwards the HTTP GET request of the UE, it transparently transmits the cipher suite ("yyzz") extended parameters sent by the UE to the AP, so that the AP can authenticate the UE according to the UE carried by the ALG and the cipher suite ("yyzz") used by the ALG. That is, the cipher suite is applied to the AP through the ALG, so that the AP uses the same cipher suite ("yyzz") as the UE to achieve authentication.

At steps 7 to 8, the AP sends a 401 unauthorized response to the ALG and to the UE via the ALG.

In step 9, the UE generates the first Ks_NAF/KS_int_NAF according to the UE side cipher suite ("yyzz") negotiated with the ALG and other parameters, and then uses the first Ks_NAF/KS_int_NAF as the key to calculate the first response (response) to the ALG, At this time, the cipher suite ("yyzz") can also be carried in the first response through the extended parameter.

Step 10: The ALG forwards the HTTP GET request of the UE, and transparently transmits the cipher suite ("yyzz") extended parameters sent by the UE to the AP. The AP obtains the first cipher suite ("yyzz") from the BSF according to the cipher suite ("yyzz") and other parameters carried by the ALG and used by the UE side. Two KS_NAF/KS_int_NAF, and then use the second KS_NAF/KS_int_NAF as the key to calculate the second response, the AP compares the first response and the second response, if the second response and the first response are consistent, the authentication is successful, because the cipher used by the AP The suite is the same as the cipher suite used by the UE. The calculation of Ks_NAF/Ks_int_NAF and the response will also be the same. Finally, the AP authentication succeeds.

The second way is to use the secret key algorithm suite to negotiate the security transport layer protocol with the AP through the ALG, so as to apply the secret key algorithm suite to the AP, for example, steps 1 to 10 shown in FIG. 6 .

In steps 1 to 2, the UE negotiates a Transport Layer Security (TLS) connection with the ALG, and confirms that the cipher suite used by the UE side is "yyzz".

In step 3, the UE initiates a service request (HTTP GET) to the ALG.

In steps 4 to 5, when the ALG negotiates a TLS connection with the AP, carry the cipher suite ("yyzz") used by the UE side to ensure that the AP side can use the same cipher suite ("yyzz") on the UE side, so that the cipher suite ("yyzz") used by the AP side can be used. The suite is also "yyzz", and the AP uses the same cipher suite ("yyzz") as the UE to implement authentication.

At step 6, the ALG forwards the UE's HTTP GET request.

In steps 7 to 8, the AP sends a 401 Unauthorized response to the UE via the ALG.

In steps 9 to 10, the UE generates the first Ks_NAF/KS_int_NAF according to the UE side cipher suite ("yyzz") negotiated with the ALG and other parameters, and then uses the first Ks_NAF/KS_int_NAF as the key to calculate the first response (response), and sends to the ALG, and then forwarded to the AP via the ALG. The AP obtains the second KS_NAF/KS_int_NAF from the BSF according to the TLS cipher suite ("yyzz") and other parameters used by the AP side, and then uses the second KS_NAF/KS_int_NAF as the key to calculate the second response, and the AP compares the first response with the second response , if the second response is consistent with the first response, the authentication is successful, because the TLS cipher suite used by the AP is the same as the TLS cipher suite used by the UE, the calculation of Ks_NAF/Ks_int_NAF and the response will also be consistent, and the final AP authentication succeeds.

Perform TLS negotiation with the ALG, and confirm the key algorithm suite used includes: perform TSL negotiation with the ALG, confirm the supported cipher suite list, and the cipher suite list includes at least two usable keys Algorithm suite, and performing TLS negotiation with the AP using the secret key algorithm suite through the ALG includes: performing the secure transport layer protocol negotiation with the AP using the secret key algorithm suite set through the ALG, and determining the secret key algorithm suite used by the ALG and the AP. For example, steps 1 to 10 as shown in FIG. 7 .

In step 1, the UE initiates TLS negotiation to the ALG, and the Client Hello carries the cipher suite list (0xC030, 0x0035, 0x002D) supported by the UE side.

In step 2, the ALG initiates the TLS negotiation with the AP. The Client Hello uses the intersection of the UE and the ALG to support the cipher suite list (0xC030, 0x002D), so that the cipher suite used by the AP side must be the cipher suite that the UE side can use.

In step 3, the ALG receives the AP's Server Hello and confirms the cipher suite (0xC030) used by the AP.

In step 4, the ALG returns Server Hello to the UE, and uses the cipher suite (0xC030) used by the AP side, so that the UE side uses the same cipher suite as the AP side.

In steps 5 to 6, the UE initiates a service request (HTTP GET), and the ALG forwards the UE's HTTP GET request.

In step 9, the UE generates the first Ks_NAF/KS_int_NAF according to the UE side cipher suite (0xC030) and other parameters negotiated with the ALG, and then uses the first Ks_NAF/KS_int_NAF as the key to calculate the first response (response), sends it to the ALG, and then It is forwarded to the AP via the ALG.

In step 10, the AP forwards the first response of the UE to the AP. The AP obtains the second KS_NAF/KS_int_NAF from the BSF according to the cipher suite (0xC030) and other parameters used by the AP side, and then uses the second KS_NAF/KS_int_NAF as the key to calculate the second response. The AP compares the second response calculated by itself with the first response sent by the UE. If the second response is consistent with the first response, the authentication is successful, because the cipher suite used by the AP is consistent with the cipher suite used by the UE, and the calculated Ks_NAF /Ks_int_NAF, the response will be the same, and the final AP authentication is successful.

The GBA-based authentication method applied to the UE side provided by the present disclosure confirms the key algorithm suite used by performing TSL negotiation with the ALG; and applies the key algorithm suite to the AP through the ALG, so that the AP uses the Authentication, that is, after the UE and the AP establish TLS tunnels with the ALG respectively, the ALG applies the secret key algorithm suite used by the UE side to the AP side, so that the AP side and the UE side use the same secret key algorithm suite to calculate the authentication parameters. Performing authentication avoids the problem of using different secret key algorithm suites after the UE and AP establish TLS tunnels with the ALG respectively, resulting in authentication failure, which affects the AP's authentication of the UE, and improves the user experience.

The present disclosure also provides a GBA-based authentication method applied to the application layer gateway (ALG) side, as shown in FIG. 8 , the method includes steps S801 to S802.

In step S801, a Transport Layer Security (TLS) negotiation is performed with a user terminal (UE) to confirm the secret key algorithm suite used by the UE.

In step S802, the secret key algorithm suite is applied to the wireless access node (AP), so that the AP uses the secret key algorithm suite for authentication.

The ALG negotiates the TLS connection with the UE, and confirms the Cipher Suite of the key algorithm suite used by the UE and the ALG. It should be understood that the present disclosure does not limit the manner in which the UE and the ALG negotiate the TSL, and the key algorithm suite that can be used between the UE and the ALG can finally be determined.

The secret key algorithm suite is applied to the AP, so that the method for the AP to use the secret key algorithm suite for authentication is the same as the method in the above example, which will not be repeated here.

The GBA-based authentication method applied to the ALG side provided by the present disclosure performs TSL negotiation with the UE to confirm the secret key algorithm suite used by the UE; applies the secret key algorithm suite to the AP, so that the AP uses the secret key algorithm suite for authentication , that is, after the UE and the AP establish TLS tunnels with the ALG respectively, the AP side and the UE side use the same secret key algorithm suite to calculate and obtain the authentication parameters for authentication, which prevents the UE and the AP from establishing TLS tunnels with the ALG respectively, using Different key algorithm suites lead to authentication failure, which affects the authentication of the AP to the UE and improves the user experience.

The present disclosure also provides a GBA-based authentication method applied to a wireless access node (AP) side, the method including but not limited to: performing authentication using a key algorithm suite applied to the AP by an application layer gateway (ALG), The secret key algorithm suite is the secret key algorithm suite used by the UE for which the ALG and the User Terminal (UE) perform Transport Layer Security (TSL) negotiation and confirmation.

The ALG negotiates a TLS connection with the UE, and after confirming the cipher suite (Cipher Suite) used by the UE and the ALG, applies the cipher suite to the AP, so that the AP performs authentication according to the cipher suite. It should be understood that the present disclosure does not limit the manner in which the UE and the ALG negotiate the TSL, and the key algorithm suite that can be used between the UE and the ALG can finally be determined.

The GBA-based authentication method applied to the AP side provided by the present disclosure uses the secret key algorithm suite applied by the ALG to the AP for authentication; the secret key algorithm suite is the secret key algorithm used by the UE for TLS negotiation and confirmation between the ALG and the UE Suite, that is, after the UE and the AP establish TLS tunnels with the ALG respectively, the AP side uses the same secret key algorithm suite as the UE side to calculate the authentication parameters for authentication, which avoids the need for the UE and AP to establish TLS tunnels with the ALG respectively. Different key algorithm suites lead to authentication failure, which affects the authentication of the AP to the UE and improves the user experience.

The present disclosure also provides a terminal including a first processor 901 , a first memory 902 and a first communication bus 903 .

The first communication bus 903 is used to realize the connection communication between the first processor 901 and the first memory 902 .

The first processor 901 is configured to execute one or more computer programs stored in the first memory 902 to implement the GBA-based authentication method executed by the user terminal side of the present disclosure.

This feedback also provides a gateway, including a second processor 1001 , a second memory 1002 and a second communication bus 1003 .

The second communication bus 1003 is used to realize the connection communication between the second processor 1001 and the second memory 1002 .

The second processor 1001 is configured to execute one or more computer programs stored in the second memory 1002 to implement the GBA-based authentication method executed by the application layer gateway side of the present disclosure.

The present disclosure also provides a wireless access node including a third processor 1101 , a third memory 1102 and a third communication bus 1103 .

The third communication bus 1103 is used to realize the connection communication between the third processor 1101 and the third memory 1102 .

The third processor 1101 is configured to execute one or more computer programs stored in the third memory 1102 to implement the GBA-based authentication method performed by the wireless access node side of the present disclosure.

The present disclosure also provides a computer-readable storage medium embodied in any method or technology for storage of information, such as computer-readable instructions, data structures, computer program modules, or other data Volatile or nonvolatile, removable or non-removable media. Computer-readable storage media include but are not limited to RAM (Random Access Memory, random access memory), ROM (Read-Only Memory, read only memory), EEPROM (Electrically Erasable Programmable read only memory, electrically erasable programmable read only memory) ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store the desired information and that can be accessed by a computer.

The computer-readable storage medium in the present disclosure can be used to store one or more computer programs, and the stored one or more computer programs can be executed by a processor to implement the application of the present disclosure to a terminal side, a gateway side or a wireless access node GBA-based authentication method on the side.

Those skilled in the art should understand that all or some of the steps in the methods disclosed above, the functional modules/units in the system and the device can be implemented as software (can be implemented by computer program codes executable by the computing device), firmware, hardware, and their appropriate combination. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .

In addition, communication media typically embodies computer readable instructions, data structures, computer program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery, as is well known to those of ordinary skill in the art medium. Therefore, the present disclosure is not limited to any particular combination of hardware and software.

The above content is a further detailed description of the embodiments of the present disclosure in combination with specific implementations, and it cannot be considered that the specific implementation of the present disclosure is limited to these descriptions. For those of ordinary skill in the technical field to which the present disclosure belongs, without departing from the concept of the present disclosure, some simple deductions or substitutions can be made, which should be regarded as belonging to the protection scope of the present disclosure.

Claims

An authentication method based on the general bootstrap architecture GBA, comprising:

Secure transport layer protocol negotiation with the application layer gateway to confirm the key algorithm suite used; and

The secret key algorithm suite is applied to the wireless access node through the application layer gateway, so that the wireless access node uses the secret key algorithm suite for authentication.
The GBA-based authentication method according to claim 1, wherein the step of applying the secret key algorithm suite to the wireless access node through the application layer gateway comprises:

forwarding the secret key algorithm suite to the wireless access node through the application layer gateway, so as to apply the secret key algorithm suite to the wireless access node;

and / or,

The application layer gateway uses the secret key algorithm suite to negotiate a secure transport layer protocol with the wireless access node, so as to apply the secret key algorithm suite to the wireless access node.
The GBA-based authentication method according to claim 2, wherein the step of forwarding the key algorithm suite to the wireless access node through the application layer gateway comprises:

sending a service request to the application layer gateway; and

The service request is forwarded to the wireless access node through the application layer gateway, wherein the application layer gateway carries the secret key algorithm suite when forwarding the service request to the wireless access node.
The GBA-based authentication method according to claim 2, wherein the step of forwarding the key algorithm suite to the wireless access node through the application layer gateway comprises:

sending a service request to the application layer gateway, wherein the service request carries the secret key algorithm suite;

The service request is forwarded to the wireless access node through the application layer gateway.
The authentication method based on GBA as claimed in claim 2, wherein, carrying out security transport layer protocol negotiation with the application layer gateway, the step of confirming the used key algorithm suite comprises:

Negotiating a secure transport layer protocol with the application layer gateway to confirm the supported set of key algorithm suites, wherein the set of secret key algorithm suites includes at least two key algorithm suites,

And the step of using the secret key algorithm suite to negotiate a security transport layer protocol with the wireless access node through the application layer gateway includes:

The key algorithm suite used by the application layer gateway and the wireless access node is determined by performing the security transport layer protocol negotiation with the wireless access node by the application layer gateway using the key algorithm suite set.
An authentication method based on the general bootstrap architecture GBA, comprising:

negotiating a secure transport layer protocol with the user terminal to confirm the key algorithm suite used by the user terminal; and

The key algorithm suite is applied to the wireless access node, so that the wireless access node uses the key algorithm suite for authentication.
An authentication method based on the general bootstrap architecture GBA, comprising:

use the secret key algorithm suite applied by the application layer gateway to the wireless access node for authentication,

Wherein, the secret key algorithm suite is the secret key algorithm suite used by the user terminal that is negotiated and confirmed by the application layer gateway and the user terminal for the security transport layer protocol.
A terminal, comprising a first processor and a first memory,

The first processor is configured to execute one or more computer programs stored in the first memory to implement the GBA-based authentication method according to any one of claims 1 to 5.
A gateway includes a second processor and a second memory,

The second processor is configured to execute one or more computer programs stored in the second memory to implement the GBA-based authentication method as claimed in claim 6 .
A wireless access node includes a third processor and a third memory,

The third processor is configured to execute one or more computer programs stored in the third memory to implement the GBA-based authentication method as claimed in claim 7 .
A computer-readable storage medium having stored thereon one or more computer programs that, when executed by one or more processors, cause the one or more processors to implement the invention as claimed in the claims The GBA-based authentication method described in any one of 1-7.