WO2022247938A1 - Terminal device registration method, related device, system, and storage medium - Google Patents

Abstract

Disclosed in embodiments of the present invention are a terminal device registration method, a related device, a system, and a storage medium. The present invention can ensure that a user quickly goes online at an operator network, thereby quickly implementing a communication service of the user. The method comprises: an enterprise server sends, in response to a registration request message of a terminal device, a registration response message to the terminal device; the enterprise server receives an authentication response message from an operator server, the authentication response message being used for indicating that the authentication of the terminal device succeeds, and the authentication response message carrying a first parameter; the enterprise server obtains a second parameter according to the authentication response message; and if the enterprise server determines that the first parameter and the second parameter are the same, the enterprise server determines that the registration of the terminal device succeeds.

Description

A terminal device registration method, related equipment, system and storage medium

This application claims the priority of the Chinese patent application submitted to the China Patent Office on May 28, 2021, with the application number 202110592796.4, and the title of the invention is "a method for terminal equipment registration, related equipment, systems, and storage media", all of which The contents are incorporated by reference in this application.

technical field

The present application relates to the field of communications, and in particular to a terminal device registration method, related devices, systems and storage media.

Background technique

With the popularization of IoT devices and the continuous development of communication demands in various industries, operator networks are required to provide a full network, anytime, anywhere, stable, reliable, and low-cost audio and video services for thousands of industries.

In order to realize the call from the calling user to the called user, it is necessary for the calling user and the called user to open an account at the operator's network. After the account opening is completed, the operator's network realizes the call service from the calling user to the called user.

However, the account opening process of the calling user and the called user at the operator's network is complicated, resulting in the inability of the calling user and the called user to go online immediately at the operator's network, and thus causing the calling user to be unable to quickly call the called user.

Contents of the invention

Embodiments of the present invention provide a method for registering a terminal device, related equipment, a system, and a storage medium, which can ensure that a user can quickly go online at an operator's network, thereby quickly realizing the communication service of the user.

In the first aspect, an embodiment of the present invention provides a method for registering a terminal device. The method includes: an enterprise server responds to a registration request message of a terminal device, and sends a registration response message to the terminal device; An authentication response message from the business server, the authentication response message is used to indicate that the terminal device has passed the authentication, and the authentication response message carries the first parameter; the enterprise server according to the authentication response message Acquire a second parameter; if the enterprise server determines that the first parameter is the same as the second parameter, then determine that the terminal device is registered successfully.

It can be seen that the enterprise server and the operator server can respectively authenticate the terminal device. When the terminal device passes the authentication of the operator server and the terminal device passes the authentication of the enterprise server, the registration of the terminal device is successful, and the terminal device The communication service can be realized through the operator server and the enterprise server. It can be seen that during the registration process of the terminal device, the cooperative authentication of the terminal device, the operator server and the enterprise server is required, which improves the registration efficiency of the terminal device. During the registration process of the terminal device, there is no need to rely on the relay network, but the terminal device directly interacts with the enterprise server and the operator server to realize the registration process, which reduces the complexity of registering the terminal device and reduces the maintenance of the communication network difficulty and cost.

Based on the first aspect, in an optional implementation manner, the enterprise server responds to the registration request message of the terminal device, and before sending the registration response message to the terminal device, the method further includes: the enterprise server receiving A registration request message of the device, where the registration request message is used to request a first authentication ID and first preset parameters, and the enterprise server obtains the first authentication ID according to the first enterprise authentication key; the enterprise server responds A registration request message of a terminal device, sending a registration response message to the terminal device includes: the enterprise server sending the registration response message to the terminal device, the registration response message carrying the first authentication identifier and the first The preset parameter, the first authentication identifier and the first preset parameter are used to obtain the first parameter.

Based on the first aspect, in an optional implementation manner, the enterprise server acquiring the first authentication identifier according to the first enterprise authentication key includes: the enterprise server storing the first enterprise authentication key, and the operator The server has stored the second enterprise authentication key, wherein the first enterprise authentication key and the second enterprise authentication key are symmetric keys, that is, the first enterprise authentication key and the second enterprise authentication key are the same . The enterprise server encrypts the first preset parameter by using the first enterprise authentication key to obtain the first authentication identifier.

Based on the first aspect, in an optional implementation manner, the enterprise server acquiring the first authentication identifier according to the first enterprise authentication key includes: the first enterprise authentication key and the second enterprise authentication key The authorization key is an asymmetric key, wherein the first enterprise authentication key includes the first public key and the first private key, and the second enterprise authentication key includes the second public key and the second private key, and the operator The server sends the second public key to the enterprise server, and the enterprise server sends the first public key to the operator server. Wherein, the first public key and the second private key, and the first private key and the second public key are paired keys respectively, and the enterprise server performs hash calculation on the first preset parameter to obtain the first summary information, The enterprise server encrypts the first summary information with the first private key to obtain the first signature information, and the enterprise server encrypts the first signature information and the first preset parameters with the second public key to obtain the first authentication parameters , the first authentication identifier is the first summary information.

It can be seen that the enterprise server shown in this aspect sends the first authentication ID in an encrypted manner, which effectively improves the security of sending the first authentication ID, and avoids leakage and tampering of the first authentication ID.

Based on the first aspect, in an optional implementation manner, the acquiring the second parameter by the enterprise server according to the authentication response message includes: performing, by the enterprise server, the first preset parameter by using the first user authentication key Calculate to obtain the second parameter; if the enterprise server determines that the first parameter is the same as the second parameter, after determining that the terminal device is successfully registered, the method further includes: the enterprise server sends the The operator server sends a first indication message, where the first indication message is used to indicate that the terminal device is successfully registered.

Based on the first aspect, in an optional implementation manner, the first user authentication key is a login password for the terminal device to successfully log in to the enterprise server.

It can be seen that because the first user authentication key shown in this aspect is a login password, the security of the first user authentication key is effectively improved, and the possibility of the first user authentication key being stolen is avoided.

Based on the first aspect, in an optional implementation manner, the authentication response message also carries the call identifier used by the terminal device to implement the communication service, and the enterprise server uses the first user authentication key to pair the first Before the preset parameters are calculated to obtain the second parameter, the method further includes: obtaining, by the enterprise server, the first user authentication key corresponding to the call identifier.

Based on the first aspect, in an optional implementation manner, the first user authentication key is the same as the second user authentication key, where the second user authentication key is used to obtain the first a parameter.

Based on the first aspect, in an optional implementation manner, the enterprise server responds to the registration request message of the terminal device, and before sending the registration response message to the terminal device, the method further includes: the enterprise server obtains the account opening identifier , a first account opening key, and a second preset parameter; the enterprise server calculates the second preset parameter through the first account opening key to obtain the first account opening parameter; the enterprise server sends the operation The merchant server sends an account opening request message, the account opening request message carries the account opening identifier, the second preset parameter, and the first account opening parameter; the enterprise server receives the account opening confirmation message from the operator server, and the The account opening confirmation message is used to indicate that the enterprise server has successfully opened an account.

Based on the first aspect, in an optional implementation manner, the enterprise server has installed a universal enterprise identity module (universal enterprise identity module, UEIM). The UEIM has built-in account opening information, and the enterprise server calculates the second preset parameter by using the first account opening key to obtain the first account opening parameter includes: the enterprise server reads the account opening information from the UEIM, Wherein, the processor interface circuit of the enterprise server can directly read the account opening information in the UEIM.

Based on the first aspect, in an optional implementation manner, the UEIM is a virtual UEIM, and the virtual UEIM is a software module, and the enterprise server calculates the second preset parameter by using the first account opening key to Obtaining the first account opening parameters includes: the processor interface circuit of the enterprise server reads the virtual UEIM stored in the memory to obtain the account opening information.

Based on the first aspect, in an optional implementation manner, the enterprise server calculating the second preset parameter by using the first account opening key to obtain the first account opening parameter includes: the enterprise server obtains the first account opening parameter from the home subscriber server The account opening information is received, or, the enterprise server may receive the account opening information from a service user profile function or a bootstrap server function.

In a second aspect, an embodiment of the present invention provides a method for registering a terminal device. The method includes: the operator server receives an authentication request message from the terminal device, and the authentication request message carries the first authentication identifier and the second authentication identifier. A parameter; the operator server acquires a second authentication ID according to the authentication request message; if the operator server determines that the first authentication ID is the same as the second authentication ID, it sends the enterprise server Sending an authentication response message, where the authentication response message is used to indicate that the terminal device passes the authentication, and the authentication response message carries the first parameter.

For the description of the beneficial effects shown in this aspect, please refer to the first aspect for details, and will not be repeated.

Based on the second aspect, in an optional implementation manner, the operator server obtaining the second authentication identifier according to the authentication request message includes: the operator server obtaining the The second authentication ID.

Based on the second aspect, in an optional implementation manner, the authentication request message also carries an enterprise identifier corresponding to the enterprise server, and before the operator server receives the authentication request message from the terminal device, the The method further includes: the operator server acquiring the second enterprise authentication key corresponding to the enterprise identifier.

Based on the second aspect, in an optional implementation manner, the authentication response message further carries a call identifier, and the call identifier is used to implement a communication service of the terminal device.

Based on the second aspect, in an optional implementation manner, if the operator server determines that the first authentication identifier is the same as the second authentication identifier, after sending an authentication response message to the enterprise server, the The method further includes: the operator server receiving a first indication message from the enterprise server; the operator server sending a second indication message to the terminal device according to the first indication message, and the second indication message The indication message is used to indicate that the terminal device has successfully registered.

Based on the second aspect, in an optional implementation manner, before the operator server receives the authentication request message from the terminal device, the method further includes: the operator server receives the account opening request from the enterprise server message, the account opening request message carries an account opening ID, a second preset parameter, and a first account opening parameter; the operator server acquires a second account opening key corresponding to the account opening ID; The second account opening key calculates the second preset parameter to obtain the second account opening parameter; if the operator server determines that the first account opening parameter is the same as the second account opening parameter, it sends the An account opening confirmation message, where the account opening confirmation message is used to indicate that the enterprise server has successfully opened an account.

In a third aspect, an embodiment of the present invention provides a method for registering a terminal device, the method comprising: the terminal device sends a registration request message to an enterprise server; the terminal device receives a registration response message from the enterprise server, and the The registration response message carries a first authentication identifier; the terminal device acquires a first parameter according to the registration response message; the terminal device sends an authentication request message to an operator server, and the authentication request message carries the first An authentication identifier and the first parameter; the terminal device receives an indication message from the operator server indicating that the registration is passed.

For the description of the beneficial effects shown in this aspect, please refer to the first aspect for details, and will not be repeated.

Based on the third aspect, in an optional implementation manner, the registration response message further carries a first preset parameter, and the obtaining of the first parameter by the terminal device according to the registration response message includes: the terminal device passes the second The user authentication key calculates the first preset parameter to obtain the first parameter.

Based on the third aspect, in an optional implementation manner, the method further includes: the terminal device sending a call identifier for implementing a communication service to the operator server.

In a fourth aspect, an embodiment of the present invention provides an enterprise server, including a memory and a transceiver respectively coupled to a processor, the memory stores computer program codes, and the processor invokes and executes the computer program in the memory. The program code enables the enterprise server to execute the steps in any one of the first aspect above.

For the description of the beneficial effects shown in this aspect, please refer to the first aspect for details, and will not be repeated.

In a fifth aspect, an embodiment of the present invention provides an operator server, including a memory and a transceiver respectively coupled to a processor, where computer program codes are stored in the memory, and the processor invokes and executes a program in the memory. The computer program code enables the operator server to execute the steps of any one of the second aspect above.

For the description of the beneficial effects shown in this aspect, please refer to the first aspect for details, and will not be repeated.

In a sixth aspect, an embodiment of the present invention provides a terminal device, including a memory and a transceiver respectively coupled to a processor, the memory stores computer program codes, and the processor invokes and executes the computer in the memory The program code enables the terminal device to execute the steps in any one of the third aspect above.

For the description of the beneficial effects shown in this aspect, please refer to the first aspect for details, and will not be repeated.

In a seventh aspect, an embodiment of the present invention provides a communication system, including an enterprise server and an operator server, the enterprise server is as described in the fourth aspect, and the operator server is as described in the fifth aspect.

In an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, it can complete the first aspect, the second aspect and the third aspect. The method described in any one of the aspects.

In the solution provided in any of the above aspects, the first parameter is the first expected response (expected response, XRES) or expected value, and the second parameter is the second expected response or expected value, wherein the first parameter is the enterprise server expects the terminal device to respond The second parameter is a parameter generated by the enterprise server, and the enterprise server compares the first parameter and the second parameter to determine whether the terminal device has passed the authentication of the enterprise server.

Description of drawings

Fig. 1 is an example diagram of the first network structure of the communication system provided by the present application;

FIG. 2 is an example diagram of a second network structure of the communication system provided by the present application;

FIG. 3 is a flow chart of the steps of the first embodiment of the method for terminal device registration provided by the present application;

FIG. 4 is a flow chart of the steps of the second embodiment of the method for terminal device registration provided by the present application;

FIG. 5 is a structural example diagram of an embodiment of a network device provided by the present application;

Fig. 6 is a structural example diagram of another embodiment of the network device provided by the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the protection scope of the present invention.

This application provides a terminal device registration method, which can ensure that the calling user and the called user can quickly go online on the operator's network, and avoid the situation that the operator's network obtains the private information of the calling user and the called user , in order to better understand the terminal device registration method provided in this embodiment, the network structure to which the method provided in the application is applied is firstly described as follows:

network structure 1

Referring to FIG. 1 , FIG. 1 is an example diagram of a first network structure of a communication system provided by the present application. The communication system shown in this embodiment includes a carrier network 120 and an enterprise network 130 connected in sequence. The network type of the operator network 120 shown in this embodiment can be IP multimedia subsystem (IP multimedia subsystem, IMS), wherein, IMS is a kind of brand-new multimedia business form, and it can satisfy newer, more diverse multimedia business needs. IMS is an important way to solve the convergence of mobile and fixed networks and introduce differentiated services such as voice, data, and video triple convergence.

In this example, the network type of the operator network 120 is IMS as an example. In other examples, the operator network 120 may be other real time communication (real time communication, RTC) network.

Each network element included in the operator network 120 will be described below. It should be noted that the description of each network element type in this embodiment is optional and exemplary, and is not limited.

The operator network 120 shown in this embodiment includes a home subscriber server (home subscriber server, HSS) 121, and the HSS 121 is responsible for the management and maintenance of subscription data of various types of fixed and mobile broadband and narrowband access users, and supports IMS service access authentication , Roaming registration, mobile called routing addressing functions.

The HSS 121 is respectively connected to the network element 122, the network element 123 and the network element 124, wherein the network element 122 is integrated with a multimedia resource function controller (multimedia resource function controller, MRFC) and a multimedia resource function processor (multimedia resource function processor, MRFP). The network element 123 is an application server (application server, AS). The network element 124 is integrated with an interrogating-call session control function (interrogating-call session control function, I-CSCF) and a serving-call session control function (serving-call session control function, S-CSCF). Wherein, a network element may be called a device.

The network element 124 is connected to the network element 126, wherein the network element 126 is integrated with an access session border controller (session border controller, SBC) and a proxy-call session control function (proxy-call session control function, P-CSCF).

The structure of the enterprise network 130 shown in this embodiment will be described below. It should be noted that the description of the enterprise network 130 in this embodiment is an optional example and is not limited.

The enterprise network 130 specifically includes an enterprise server 131 and a terminal device 133 , wherein the enterprise server 131 is connected to the HSS 121 and the terminal device 133 respectively. The terminal 133 is connected to the network element 126 .

Wherein, the terminal device 133 may be any device among smart terminals and computers. The terminal device 133 can install an application program or a built-in IMS software development kit (software development kit, SDK), so as to implement the method shown in this application.

Network Structure 2

Referring to FIG. 2 , FIG. 2 is an example diagram of a second network structure of the communication system provided by the present application. The communication system shown in this example includes the terminal device 200 used by the user. For the description of the terminal device 200, refer to the relevant description in FIG. 1 , and details are not repeated here.

Wherein, the terminal device 200 is connected to the enterprise server 201, and the terminal device 200 is connected to a unified control function (unified control function, UCF) 211. The UCF 211 is also respectively connected to a service enabler function (SEF) 212 and a service user profile function (SUPF) 213, and the enterprise server 201 is connected to the SUPF 213. SEF212 is respectively connected with service and application function (service and application function, SAF) 214 and SUPF213. A bootstrapping server function (bootstrapping server function, BSF) 215 is connected to SUPF 213 , UCF 211 and terminal device 200 respectively.

Wherein, the functions performed by the UCF 211 may include: processing the process of the user registering to the communication system through the terminal device 200 and performing authentication and authorization functions for the user. Interacts with SUPF213 to store, update, delete and query the profile of the calling user, where the user profile can be used for registration, authentication and authorization processes. The signaling messages from the terminal device 200 are processed, and corresponding signaling routes are determined according to different strategies. Trigger the corresponding service according to the user configuration file obtained from SUPF213. With the introduction of service-based technology, SEF212 will not only perform service-related support functions, but also complete user registration, authentication, authorization and other functions at the application layer, and be responsible for service and application management. SUPF213 is used to provide maintenance and management functions of user files, mainly including storing, updating, deleting and querying user-related data according to the requirements of UCF211. For example, a corresponding relationship between a user identification (ID) and a user configuration file is established. The SUPF213 can realize the query of the user configuration file according to the user ID, wherein the user configuration file can be provided by the operator or the user.

The terminal device registration method provided in this application may involve two processes. The first process is: the enterprise server opens an account at the operator server. The second process is: after the enterprise server opens an account at the operator server, the terminal device is authenticated at the enterprise server and the operator server respectively, so as to realize the registration of the terminal device.

Embodiment one

In this embodiment, the process of how the enterprise server opens an account at the operator server is described with reference to FIG. 3 . Wherein, FIG. 3 is a flow chart of steps in the first embodiment of the method for registering a terminal device provided in this application.

Step 301, the enterprise server acquires account opening information.

If the method shown in this embodiment is applied to the communication system shown in FIG. 1 , then the enterprise server shown in this embodiment is the enterprise server 131 shown in FIG. 1 . If the method shown in this embodiment is applied to the communication system shown in FIG. 2 , then the enterprise server shown in this embodiment is the enterprise server 201 shown in FIG. 2 .

In the method shown in this embodiment, each user in the enterprise does not need to open an account at the operator's server separately, but the enterprise server of the enterprise opens an account at the operator's server. In order for the enterprise server to open an account at the operator server, the enterprise server shown in this embodiment needs to obtain account opening information for opening an account at the operator server. Wherein, the account opening information shown in this embodiment includes an account opening ID, a first account opening key, and a second preset parameter. The second account opening key can be a verification key (Ki), and the account opening identification can be an international mobile subscriber identification number (IMSI). This embodiment does not limit the specific type of account opening identification, as long as the It only needs to have a unique corresponding relationship between the account opening ID and the enterprise server. The second preset parameter shown in this embodiment can be any parameter randomly generated by the enterprise server, and the specific value is not limited in this embodiment.

The following are examples of several optional ways for the enterprise server to obtain the account opening information:

Example 1

The enterprise server in this example has the universal enterprise identity module (UEIM) installed. The UEIM has built-in the account opening information, and when the enterprise server needs to open an account, the enterprise server can directly read the account opening information from the UEIM. Specifically, the processor interface circuit of the enterprise server can directly read the account opening information in the UEIM.

Example 2

In example 1, the UEIM is the physical hardware installed in the enterprise server, while in example 2, the UEIM can be a virtual UEIM, which is a software module. When the enterprise server needs to open an account, the processor of the enterprise server The interface circuit reads the virtual UEIM stored in the memory, and then obtains the account opening information.

Example 3

The enterprise server in this example can receive the account opening information from other network elements. This embodiment does not limit the subject that sends the account opening information to the enterprise server. For example, as shown in FIG. 1, the enterprise server can receive the account opening information from the HSS, and As shown in Figure 2, the enterprise server may receive the account opening information from SUPF or BSF.

In step 302, the enterprise server calculates the second preset parameter by using the first account opening key to obtain the first account opening parameter.

Specifically, this embodiment uses an example in which the first account opening key is a symmetric key, and the first account opening key stored in the enterprise server and the second account opening key stored in the operator server are the same as an example for illustration. In other examples, the first account opening key and the second account opening key may also be asymmetric keys.

Step 303, the enterprise server sends an account opening request message to the operator server.

In the case where the method shown in this embodiment is applied to the communication system shown in FIG. 1 , the operator server is the HSS shown in FIG. 1 . In the case where the method shown in this embodiment is applied to the communication system shown in FIG. 2 , the operator server is the SUPF shown in FIG. 2 .

The enterprise server may send the account opening request message carrying the account opening identifier, the second preset parameter and the first account opening parameter to the operator server.

Step 304, the operator server calculates the second preset parameters by using the second account opening key to obtain the second account opening parameters.

The operator server shown in this embodiment can obtain the second account opening key when receiving the account opening request message, and the optional methods for obtaining the second account opening key are described below:

The operator server shown in this embodiment may pre-configure an account opening list, and the account opening list includes correspondences between different second account opening keys and account opening identifiers of different enterprise servers. The account opening list can be seen in Table 1 below:

Table 1

Account ID	Second account key
Account ID IMSI1	The second account opening key PA1
Account ID IMSI2	The second account opening key PA2
Account ID IMSI3	The second account opening key PA3

It can be seen from this that if the account opening identification carried by the account opening request message received by the operator server is "account opening identification IMSI1", then the operator server determines the corresponding second account opening key by querying the account opening list shown in Table 1 It is the "second account opening key PA1".

When the operator server obtains the second account opening key, the operator server calculates the second preset parameter by using the determined second account opening key to obtain the second account opening parameter.

Step 305 , the operator server judges whether the first account opening parameter and the second account opening parameter are the same, if yes, execute step 306 , if not, execute step 309 .

In this embodiment, the operator server determines whether the enterprise server is a legitimate server by judging whether the first account opening parameter and the second account opening parameter are the same. Specifically, if the operator server determines that the first account opening parameter is the same as the second account opening parameter, it determines that the enterprise server is a legitimate server. If the operator server determines that the first account opening parameter is different from the second account opening parameter, it determines that the enterprise server is an illegal server.

Step 306, the operator server sends a first response message to the enterprise server.

When the operator server determines that the first account opening parameter and the second account opening parameter are the same, the operator server sends the first response message to the enterprise server, where the first response message is used to indicate that the enterprise server is a legitimate server.

Step 307, the enterprise server sends an enterprise authentication message to the operator server.

When the enterprise server determines that the enterprise server is a legitimate server according to the first response message, the enterprise server sends an enterprise authentication message to the operator server to request to verify whether the enterprise server passes the verification.

Specifically, the enterprise authentication message may include one or more of the following:

The domain name used in the enterprise authentication request, the electronic certification service (certificate authority, CA) certificate corresponding to the device certificate of the enterprise server, the trusted information of the enterprise, or the business information signed by the enterprise.

Among them, the credible information of the enterprise can be the name of the enterprise, the logo of the enterprise, pictures related to the enterprise (such as a photo or scanned copy of the business license of the enterprise), audio or video related to the enterprise, etc. The business information signed by the enterprise can be the default communication service of the enterprise. The default communication service can be that the users in the enterprise have the right to call in or out. The right to call in the enterprise refers to the communication between users in the enterprise Inbound and outbound, the authority of enterprise outbound calls is for inbound and outbound calls between users inside the enterprise and personnel outside the enterprise.

Step 308, the operator server sends an account opening confirmation message to the enterprise server.

The operator's staff may use the operator's server to verify the enterprise authentication message, or the operator's server may automatically verify the enterprise's authentication message, which is not limited in this embodiment.

After determining that the domain name used by the enterprise authentication request has not been applied for by other enterprises, and/or other information included in the enterprise authentication message is true, and/or the audio and video related to the enterprise does not involve infringement, etc., the verification of the enterprise server in this embodiment The description of is an optional description and is not limited. When the operator server determines that the enterprise authentication message has passed the verification, it sends an account opening confirmation message to the enterprise server to indicate that the enterprise server has successfully opened an account.

Step 309, the operator server sends a second response message to the enterprise server.

When the operator server determines that the first account opening parameter and the second account opening parameter are different, it sends the second response message to the enterprise server, where the second response message is used to indicate that the enterprise server is an illegal server. If the enterprise server determines that an account needs to be re-opened according to the second response message, the enterprise server may return to step 301 to perform the account opening process again.

In the account opening process shown in this embodiment, the enterprise server of the enterprise opens an account at the operator server, without the need for each user of the enterprise to apply to the operator server for account opening, and the enterprise server is responsible for opening an account at the operator server, which improves Account opening efficiency, and avoiding the situation where the user applies for account opening to the operator's server alone, causing user privacy information (such as the user's name, user number, user identity information or user email address) to leak during the account opening stage, improving Security of user privacy information.

Embodiment two

In this embodiment, after the enterprise server opens an account at the operator server as shown in FIG. 4, how the user authenticates at the enterprise server and the operator server to realize the process of user registration is described, wherein FIG. A flow chart of the steps of the second embodiment of the method for registering a terminal device.

Step 401, the terminal device sends a registration request message to the enterprise server.

The enterprise server shown in this embodiment can be applied to the communication system shown in FIG. 1 or FIG. 2 . For specific description, please refer to Embodiment 1, and details are not repeated here.

In order for the user to perform communication services through the communication network, the user needs to pass the authentication of the enterprise server and the authentication of the operator server. Wherein, the operator server shown in this embodiment can be applied to the communication system shown in FIG. 1 or FIG. 2 . For specific description, please refer to Embodiment 1, and details are not repeated here.

To do this, the user logs on to the corporate server using a terminal device. Wherein, the login method may be that the user uses a terminal device to input a login user name and a corresponding login password. After the terminal device determines that the user has successfully logged in to the enterprise server, the terminal device sends the registration request message to the enterprise server.

For example, if the enterprise server determines that the login password used by the user to log in is consistent with the login password corresponding to the user stored in advance by the enterprise server, then it is determined that the user has successfully logged in. The enterprise server sends a login success indication message to the terminal device, and the terminal device sends the registration request message to the enterprise server according to the login success indication message. If the enterprise server determines that the login password used by the user to log in is inconsistent with the login password corresponding to the user stored in advance by the enterprise server, it determines that the user has failed to log in. The enterprise server sends a login failure indication message to the terminal device, and the terminal device prompts the user to re-enter the login user name and/or login password according to the login failure indication message.

Step 402, the enterprise server sends a registration response message to the terminal device.

In this embodiment, when the enterprise server receives the registration request message, the enterprise server sends a registration response message carrying the first authentication identifier and the first preset parameters to the terminal device.

Wherein, the first authentication identifier may be a first token (token), and an optional manner for the enterprise server to obtain the first authentication identifier is described below:

Method 1 for obtaining the first authentication ID

In this method, the first authentication identifier is the token obtained by the enterprise server according to the first enterprise authentication key as an example, and the enterprise server shown in this example stores the first enterprise authentication key, and the operator server has The second enterprise authentication key is stored, wherein the first enterprise authentication key and the second enterprise authentication key are symmetric keys, that is, the first enterprise authentication key and the second enterprise authentication key are the same. The enterprise server encrypts the first preset parameter with the first enterprise authentication key to obtain the first authentication identifier, wherein the first preset parameter can be a random number randomly generated by the enterprise server. The value of a preset parameter is not limited, and in other examples, the first preset parameter may also be any parameter pre-stored by the enterprise server.

Method 2 of obtaining the first authentication ID

In this method, the first authentication identifier is the token obtained by the enterprise server according to the first enterprise authentication key as an example, and the first enterprise authentication key and the second enterprise authentication key shown in this example are not Symmetric key. Specifically, the first enterprise authentication key includes a first public key and a first private key, and the second enterprise authentication key includes a second public key and a second private key, and the operator server sends the second public key to To the enterprise server, the enterprise server sends the first public key to the operator server. Wherein, the first public key and the second private key, and the first private key and the second public key are paired keys, which can be mutually decrypted.

The enterprise server performs hash calculation on the first preset parameter to obtain the first summary information, and the enterprise server encrypts the first summary information with the first private key to obtain the first signature information. The enterprise server encrypts the first signature information and the first preset parameters with the second public key to obtain the first authentication parameters. The first authentication identifier in this example is the first summary information, and it can be seen that the enterprise server sends the first summary information in an encrypted manner. It can be seen that the enterprise server sends the first authentication ID in an encrypted manner, which effectively improves the security of sending the first authentication ID, and avoids leakage and tampering of the first authentication ID.

Method 3 of obtaining the first authentication ID

In the account opening stage, if the operator server determines that the enterprise server's enterprise authentication message has passed the verification, it will issue the first token to the enterprise server. For specific instructions on the operator server's determination that the enterprise server's enterprise authentication message has passed the verification, please refer to As shown in Embodiment 1, details are not described in detail.

Optionally, the enterprise server starts a timer, and the start time of the timer is the moment when the enterprise server sends the registration completion response message.

Step 403, the terminal device obtains the first parameter according to the registration response message.

In this embodiment, when the terminal device receives the first authentication identifier and the first preset parameter from the enterprise server, the terminal device uses the second user authentication key to calculate the first preset parameter to get the first parameter. Wherein, the second user authentication key may be a login password for the terminal device to log in to the enterprise server.

Specifically, when the terminal device successfully receives the registration response message, the terminal device prompts the user to input a login password for logging in to the enterprise server, and if the login password can successfully log in to the enterprise server, the terminal device determines that the login password is the The second user authentication key.

The first parameter shown in this embodiment may also be referred to as a first expected response (expected response, XRES) or an expected value. It can be seen that the first parameter is a parameter that the enterprise server expects the terminal device to respond to.

The description of the second user authentication key in this embodiment is an optional example, and in other examples, the second user authentication key may also be a key pre-stored in the terminal device.

Step 404, the terminal device sends an authentication request message to the forwarding network element.

If the method shown in this embodiment is applied to the communication system shown in FIG. 1 , then the forwarding network element shown in this embodiment is the P-CSCF or SBC shown in FIG. 1 . If the method shown in this embodiment is applied to the communication system shown in FIG. 2 , then the forwarding network element shown in this embodiment is the UCF shown in FIG. 2 .

The terminal device shown in this embodiment sends the authentication request message to its registered forwarding network element. Specifically, the terminal device pre-stores the address of its registered forwarding network element, and the terminal device sends the registered forwarding network element address to send the authentication request message. Wherein, the address of the forwarding network element stored in the terminal device may be an Internet Protocol (internet protocol, IP) address of the forwarding network element. In another example, the address of the forwarding network element may be a domain name address or any other type of address, which is not limited in this embodiment.

The authentication request message carries the first parameter, the first authentication identifier, the call identifier and the enterprise identifier. Wherein, the call identifier is an identifier used by the terminal device to implement communication services, and the communication services include but not limited to calling service, called service, supplementary service, intelligent service, color ring back tone service or color ring tone service, etc. The call identifier can be the user's real number, or the user's email address, or the user identifier. Wherein, the user ID has global uniqueness among all IDs logged in to the enterprise server, and it can be seen that different users who log in to the enterprise server correspond to different user IDs. The enterprise identifier is an identifier corresponding to the enterprise server. It can be known that different enterprise servers correspond to different enterprise identifiers. For example, the enterprise identifier may be the domain name address of the enterprise.

Step 405, the forwarding network element sends an authentication request message to the operator server.

Specifically, the forwarding network element obtains the address of the operator server according to the authentication request message, and the forwarding network element sends the authentication request message to the address of the operator server to ensure that the operator server can receive the authentication request message.

For example, the forwarding network element can be pre-configured with a forwarding address list, and the forwarding address list includes correspondences between different enterprise identities and addresses of different operator servers, as shown in Table 2 for example:

Table 2

Corporate logo	The IP address of the carrier's server
Corporate identity A1	IP F1
Corporate Identity A2	IP F2
Corporate Identity A3	IP F3

For example, when the forwarding network element receives the authentication request message, the enterprise identifier obtained from the authentication request message is "enterprise identifier A3", and the forwarding network element queries the forwarding address list shown in Table 2 to obtain the corresponding The address of the operator's server is "IP F3". In this embodiment, the address of the operator server is an IP address as an example. In other examples, the address of the operator server may also be a domain name address or any other type of address, which is not specifically limited in this embodiment.

Step 406, the operator server obtains the second authentication identifier according to the authentication request message.

In this embodiment, when the operator server receives the authentication request message, the operator server obtains a second authentication identifier according to the authentication request message, and the second authentication identifier can be a second token, as follows An optional way for the operator server to obtain the second authentication ID is described:

way 1

This method is based on the example of method 1 in which the enterprise server obtains the first authentication identifier shown in step 402. In this example, the authentication request message also carries the first preset parameter. The operator's server has stored the second enterprise authentication key, which is the same as the first enterprise authentication key. Please refer to step 402 for details, and will not be repeated here. The operator server encrypts the first preset parameter carried in the authentication request message according to the second enterprise authentication key to obtain the second authentication identifier.

way 2

This method is based on the example of method 2 in which the enterprise server obtains the first authentication identifier shown in step 402. In this example, the second enterprise authentication key of the operator server includes the second public key and the second private key. Please refer to step 402 for specific instructions, and details are not repeated here. The operator server decrypts the first authentication parameter carried in the authentication request message by using the second private key, so as to obtain the first signature information and the first preset parameter. The operator server decrypts the first signature information by using the first public key to obtain the first summary information (ie, the first authentication identifier). The operator server performs hash calculation on the first preset parameter to obtain the second summary information. In this example, the second summary information is the second authentication identifier.

way 3

This method is based on the example of method 3 in which the enterprise server obtains the first authentication ID shown in step 402. In this example, the operator server has pre-configured an authentication list, and the authentication list includes the The corresponding relationship of the right identifier. The operator server obtains the enterprise ID from the authentication request message, and obtains the corresponding second authentication ID by querying the authentication list.

The operator server shown in this embodiment can authenticate users from different enterprises. For this reason, the operator server can be pre-configured with an authentication identification list. The authentication identification list can be referred to in Table 3:

table 3

Corporate logo	Authentication ID
Corporate identity A1	Authentication ID G1
Corporate Identity A2	Authentication ID G2
Corporate Identity A3	Authentication mark G3

For example, if the operator server determines that the enterprise identifier carried in the authentication request message is "enterprise identifier A3", the operator server queries the authentication identifier list shown in Table 3 to determine that the corresponding "authentication identifier G3" is For the second authentication identifier, please refer to step 404 for a specific description of the enterprise identifier, and details are not repeated here.

Step 407, the operator server judges whether the first authentication ID and the second authentication ID are the same, if not, execute step 408, and if yes, execute step 409.

In this embodiment, in order to realize the communication service, the user who uses the terminal device needs the terminal device to be authenticated by the operator's server. If the provider server determines that the first authentication identifier is the same as the second authentication identifier, it means that the terminal device has passed the authentication of the operator server. If the operator server determines that the first authentication identifier is different from the second authentication identifier, it means that the terminal device has not passed the authentication of the operator server.

Step 408, the operator server sends an authentication failure response message to the enterprise server.

In the case that the operator server determines that the first authentication ID and the second authentication ID are different, the operator server sends an authentication failure response message to the enterprise server, and the authentication failure response message is used to indicate that the terminal device has not passed the operator server. authentication.

Step 409, the operator server sends an authentication response message to the enterprise server.

When the operator server determines that the first authentication ID and the second authentication ID are the same, the operator server sends an authentication response message to the enterprise server, and the authentication response message is used to instruct the terminal device to pass the authentication of the operator server. . Wherein, the authentication response message carries the first parameter and the call identifier.

In order for the operator server to send the authentication response message to the enterprise server, the operator server needs to obtain the address of the enterprise server to send the authentication response message to the address of the enterprise server. For example, the operator server may pre-configure a notification address list, which includes correspondences between different enterprise identifiers and addresses of different enterprise servers, as shown in Table 4 for example:

Table 4

Corporate logo	IP address of the enterprise server
Corporate identity A1	IP A1
Corporate Identity A2	IP A2
Corporate Identity A3	IP A3

For example, if the operator server determines that the enterprise identifier is "enterprise identifier A3", the operator server determines that the corresponding IP address is "IP A3" by querying the notification address column shown in Table 2. It can be seen that the operator server sends "IP A3" IP A3" sends an authentication response message. In this embodiment, the address of the enterprise server included in the notification address column is an IP address as an example. In other examples, the address of the enterprise server included in the notification address column can also be the domain name address of the enterprise server or any other type of address etc., which are not specifically limited in this embodiment.

Step 410, the enterprise server obtains the second parameter according to the authentication response message.

The process of obtaining the second parameter by the enterprise server is described below:

First, the enterprise server acquires the first user authentication key. Specifically, the authentication response message shown in this embodiment carries the call identifier, and the enterprise server has configured a list of user authentication keys, as shown in Table 5:

table 5

call identification	user authentication key
Call ID C1	User authentication key D1
Call ID C2	User authentication key D2
Call ID C3	User authentication key D3

In order for the enterprise server to authenticate different users who log in to the enterprise server, the enterprise server configures the user authentication key list shown in Table 5, which includes different user authentication keys and different user call ID correspondence.

It can be seen that if the enterprise server determines that the call identifier carried in the authentication response message is "call identifier C2", then the enterprise server determines that the corresponding first user authentication key is "user authentication key D2".

The second user authentication key shown in this embodiment is the same as the first user authentication key. For the description of the first user authentication key, please refer to the second user authentication key shown in step 403 above. , without going into details.

Secondly, the enterprise server calculates the first preset parameter by using the first user authentication key to obtain the second parameter.

Specifically, the first preset parameter carried in the authentication response message, or, the enterprise server acquires a list of configured preset parameters, as shown in Table 6:

Table 6

call identification

The first default parameter

Call ID C1	The first preset parameter E1
Call ID C2	The first preset parameter E2
Call ID C3	The first preset parameter E3

The preset parameter list configured by the enterprise server, as shown in Table 6, includes the corresponding relationship between different call identities and different preset parameters. It can be seen that if the enterprise server determines that the call identifier carried in the authentication response message is "call identifier C2", then the enterprise server determines that the corresponding first preset parameter is "first preset parameter E2".

The second parameter shown in this embodiment can also be referred to as the second expected response or expected value. It can be seen that the second parameter is a parameter generated by the enterprise server, and the enterprise server compares the first parameter with the second parameter to determine the terminal Whether the device has passed the authentication of the enterprise server.

Optionally, in step 402, the enterprise server has started the timer. If the enterprise server has not received the authentication response message from the operator server within the duration of the timer, it means that the registration of the terminal device has failed, and the enterprise The server directly sends a response message to the terminal device to indicate that the registration of the terminal device fails.

Step 411 , the enterprise server judges whether the first parameter and the second parameter are the same, if not, execute step 412 , and if yes, execute step 413 .

As can be seen from step 409, the authentication response message carries the first parameter, and the enterprise server judges whether the first parameter and the second parameter are the same, if the first parameter and the second parameter are the same, it means that the terminal device passes the enterprise server authentication. It can be seen that the terminal device has passed the authentication of the operator's server and the enterprise server, which means that the terminal device has passed the registration.

If the first parameter is different from the second parameter, it means that the terminal device has not passed the authentication of the enterprise server. It can be seen that the terminal device has passed the authentication of the operator's server, but has not passed the authentication of the enterprise server, which means that the registration of the terminal device has not passed.

Step 412, the enterprise server sends an authentication failure response message to the operator server.

When the enterprise server determines that the first parameter and the second parameter are different, the enterprise server sends the authentication failure response message to the operator server, where the authentication failure response message is used to indicate that the terminal device has not passed the authentication of the enterprise server.

Step 413, the enterprise server sends a first indication message to the operator server.

When the enterprise server determines that the first parameter is the same as the second parameter, the enterprise server sends the first indication message to the operator server, where the first indication message is used to indicate that the terminal device is successfully registered.

Step 414, the operator server sends a second indication message to the forwarding network element.

When the operator server receives the first indication message from the enterprise server, it determines that the terminal device is successfully registered. The operator's server registers the information related to the communication service of the terminal device to realize the communication service of the subsequent terminal device. The information related to the communication service can be the call ID, the address of the enterprise server, the address of the forwarding network element, the enterprise identification, etc. There is no limitation in this embodiment, as long as the operator server can provide the communication service for the terminal device according to the information related to the communication service.

After the operator server successfully registers the communication service-related information of the terminal device, it can send the second indication message to the forwarding network element, where the second indication message is used to notify the terminal device that the terminal device has passed the registration.

Step 415, the forwarding network element sends the second indication message to the terminal device.

When the terminal device receives the second indication message from the forwarding network element, the terminal device determines that the registration is passed, and the terminal device can use the communication network shown in FIG. 1 or FIG. 2 to implement communication services.

Using the method shown in this embodiment, the enterprise server and the operator server can respectively authenticate the terminal device. When the terminal device passes the authentication of the operator server and the terminal device passes the authentication of the enterprise server, the terminal If the device is successfully registered, the terminal device can realize communication services through the operator server and the enterprise server. It can be seen that during the registration process of the terminal device, the collaborative authentication of the terminal device, the operator server, and the enterprise server is required, which improves the terminal security. Device registration efficiency. During the registration process of the terminal device, there is no need to rely on the relay network, but the terminal device directly interacts with the enterprise server and the operator server to realize the registration process, which reduces the complexity of registering the terminal device and reduces the maintenance of the communication network difficulty and cost.

Embodiment Three

In this embodiment, the structure of the network device performing the above-mentioned call processing method is described in conjunction with FIG. 5:

The network device 500 specifically includes: a processing unit 501 and a transceiver unit 502 , where the processing unit 501 is connected to the transceiver unit 502 .

If the network device 500 shown in this embodiment is an enterprise server, the processing unit 501 is configured to execute the processing function performed by the enterprise server in either embodiment 1 or embodiment 2. The transceiving unit 502 is configured to perform the transceiving function performed by the enterprise server in either embodiment 1 or 2.

For example, in Embodiment 1, the processing unit 501 is configured to execute step 301 and step 302 . The transceiver unit 502 is configured to execute step 303 , step 307 and step 309 . As another example, in Embodiment 2, the processing unit 501 is configured to execute step 410 and step 411 . The transceiver unit 502 is configured to execute step 402 , step 412 and step 413 .

If the network device 500 shown in this embodiment is an operator server, the processing unit 501 is configured to execute the processing function performed by the operator server in either embodiment 1 or embodiment 2. The transceiving unit 502 is configured to perform the transceiving function performed by the operator's server in the first embodiment or the second embodiment.

For example, in Embodiment 1, the processing unit 501 is configured to execute step 301 and step 302 . The transceiving unit 502 is configured to perform step 306 , step 307 and step 308 . As another example, in Embodiment 2, the processing unit 501 is configured to execute step 304 and step 305 . As another example, in Embodiment 2, the processing unit 501 is configured to execute step 406 and step 407 . The transceiver unit 502 is configured to execute step 408 , step 409 and step 414 .

If the network device 500 shown in this embodiment is a terminal device, the processing unit 501 is configured to execute the processing function performed by the terminal device in any embodiment in Embodiment 2. The transceiving unit 502 is configured to execute the transceiving function performed by the terminal device in any embodiment in the second embodiment.

For example, in Embodiment 2, the processing unit 501 is configured to execute step 403 . The transceiver unit 502 is configured to execute step 404 .

If the network device 500 shown in this embodiment is a forwarding network element, the processing unit 501 is configured to execute the processing function performed by the forwarding network element in the second embodiment or any one of the embodiments. The transceiving unit 502 is configured to perform the transceiving function performed by the forwarding network element in any embodiment in the second embodiment.

For example, in Embodiment 2, the transceiving unit 502 is configured to perform step 405 and step 415 .

Embodiment Four

In this embodiment, the structure of the network device that executes the above call processing method is described in combination with that shown in FIG. enterprise server. The network device shown in this embodiment may also be the operator server shown in any one of the above-mentioned first to third embodiments. Moreover, in Embodiment 1 to Embodiment 3, the terminal device shown in any embodiment may also adopt the structure shown in this embodiment.

Specifically, the network device shown in this embodiment includes: a processor 601 , a memory 602 , a bus 603 , a transceiver 604 and a network interface 606 .

Specifically, the memory 602 may include computer storage media in the form of volatile and/or non-volatile memory, such as read-only memory and/or random access memory. Memory 602 may store operating systems, application programs, other program modules, executable code, and program data.

The transceiver 604 can be used to input commands and information to network devices, and the transceiver 604 can be connected to the processor 601 through the bus 603 . Transceiver 604 may also be used to output or input information to network devices.

The network device can be connected to the communication network through the network interface 606. In a networked environment, the computer-executed instructions stored in the network device can be stored in a remote storage device, not limited to local storage.

When the processor 601 in the network device executes the executable code or application program stored in the memory 602, the network device can perform the method operations on any side of the above method embodiments. For the specific execution process, refer to the above method embodiments, here No longer.

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still understand the foregoing The technical solutions recorded in each embodiment are modified, or some of the technical features are replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present invention.

Claims (30)

1. A method for terminal device registration, characterized in that the method includes:

   The enterprise server sends a registration response message to the terminal device in response to the registration request message of the terminal device;

   The enterprise server receives an authentication message from an operator server, the authentication message is used to indicate that the terminal device is authenticated, and the authentication message carries a first parameter;

   The enterprise server obtains the second parameter according to the authentication message;

   If the enterprise server determines that the first parameter is the same as the second parameter, it determines that the terminal device is successfully registered.
2. The method according to claim 1, wherein the enterprise server responds to the registration request message of the terminal device, and before sending the registration response message to the terminal device, the method further comprises:

   The enterprise server obtains the first authentication identifier according to the first enterprise authentication key;

   The enterprise server responds to the registration request message of the terminal device, and sends the registration response message to the terminal device including:

   The enterprise server sends the registration response message to the terminal device, the registration response message carries the first authentication identifier and first preset parameters, and the first authentication identifier and the first preset parameter is used to obtain the first parameter.
3. The method according to claim 2, wherein the first authentication identifier is a first token or first summary information obtained by performing hash calculation on the first preset parameter.
4. The method according to any one of claims 1 to 3, wherein the enterprise server obtaining the second parameter according to the authentication message includes:

   The enterprise server calculates the first preset parameter through the first user authentication key to obtain the second parameter;

   If the enterprise server determines that the first parameter is the same as the second parameter, after determining that the terminal device is successfully registered, the method further includes:

   The enterprise server sends a first indication message to the operator server, where the first indication message is used to indicate that the terminal device is successfully registered.
5. The method according to claim 4, wherein the authentication message also carries a call identifier used by the terminal device to realize the communication service, and the enterprise server uses the first user authentication key to pair the first preset Before the parameter is calculated to obtain the second parameter, the method further includes:

   The enterprise server acquires the first user authentication key corresponding to the call identifier.
6. The method according to claim 4 or 5, wherein the first user authentication key is the same as the second user authentication key, wherein the second user authentication key is used to obtain the first parameter.
7. The method according to any one of claims 1 to 6, wherein the enterprise server responds to the registration request message of the terminal device, and before sending the registration response message to the terminal device, the method further comprises:

   The enterprise server acquires an account opening identifier, a first account opening key, and a second preset parameter;

   The enterprise server calculates the second preset parameter by using the first account opening key to obtain the first account opening parameter;

   The enterprise server sends an account opening request message to the operator server, the account opening request message carrying the account opening identifier, the second preset parameter, and the first account opening parameter;

   The enterprise server receives an account opening confirmation message from the operator server, where the account opening confirmation message is used to indicate that the enterprise server has successfully opened an account.
8. A method for terminal device registration, characterized in that the method includes:

   The operator server receives an authentication request message from the terminal device, where the authentication request message carries a first authentication identifier and a first parameter;

   The operator server acquires a second authentication identifier according to the authentication request message;

   If the operator server determines that the first authentication identifier is the same as the second authentication identifier, it sends an authentication message to the enterprise server, where the authentication message is used to indicate that the terminal device has passed the authentication, so The authentication message carries the first parameter.
9. The method according to claim 8, wherein the operator server acquiring the second authentication identifier according to the authentication request message comprises:

   The operator server acquires the second authentication identifier according to the second enterprise authentication key.
10. The method according to claim 9, wherein the second authentication identifier is a second token token or the second token obtained by performing hash calculation on the first preset parameter carried in the authentication request message. 2. Summary information.
11. The method according to claim 9 or 10, wherein the authentication request message also carries an enterprise identification corresponding to the enterprise server, and before the operator server receives the authentication request message from the terminal device, the The method also includes:

    The operator server acquires the second enterprise authentication key corresponding to the enterprise identifier.
12. The method according to claim 11, wherein the authentication message further carries a call identifier, and the call identifier is used to realize the communication service of the terminal device.
13. The method according to any one of claims 8 to 12, wherein if the operator server determines that the first authentication identifier is the same as the second authentication identifier, then send an authentication message to the enterprise server Afterwards, the method also includes:

    The operator server receives a first indication message from the enterprise server;

    The operator server sends a second indication message to the terminal device according to the first indication message, where the second indication message is used to indicate that the terminal device passes registration.
14. The method according to any one of claims 8 to 13, wherein before the operator server receives the authentication request message from the terminal device, the method further includes:

    The operator server receives an account opening request message from the enterprise server, where the account opening request message carries an account opening identifier, a second preset parameter, and a first account opening parameter;

    The operator server acquires a second account opening key corresponding to the account opening identifier;

    The operator server calculates the second preset parameters by using the second account opening key to obtain second account opening parameters;

    If the operator server determines that the first account opening parameter is the same as the second account opening parameter, it sends an account opening confirmation message to the enterprise server, where the account opening confirmation message is used to indicate that the enterprise server has successfully opened an account.
15. A method for terminal device registration, characterized in that the method comprises:

    The terminal device sends a registration request message to the enterprise server;

    The terminal device receives a registration response message from the enterprise server, where the registration response message carries a first authentication identifier;

    The terminal device acquires a first parameter according to the registration response message;

    The terminal device sends an authentication request message to an operator server, where the authentication request message carries the first authentication identifier and the first parameter;

    The terminal device receives an indication message from the operator server for indicating successful registration.
16. The method according to claim 15, wherein the registration response message also carries a first preset parameter, and the obtaining of the first parameter by the terminal device according to the registration response message includes:

    The terminal device calculates the first preset parameter by using the second user authentication key to obtain the first parameter.
17. The method according to claim 15 or 16, wherein the method further comprises:

    The terminal device sends the call identifier used to realize the communication service to the operator server.
18. A method for terminal device registration, characterized in that the method comprises:

    The terminal device sends a registration request message to the enterprise server;

    The enterprise server sends a registration response message to the terminal device in response to the registration request message, where the registration response message carries a first authentication identifier;

    The terminal device acquires a first parameter according to the registration response message;

    The terminal device sends an authentication request message to the operator server, where the authentication request message carries the first authentication identifier and the first parameter;

    The operator server acquires a second authentication identifier according to the authentication request message;

    If the operator server determines that the first authentication ID is the same as the second authentication ID, it sends an authentication message to the enterprise server, where the authentication message is used to indicate that the terminal device has passed the authentication , the authentication message carries the first parameter;

    The enterprise server obtains the second parameter according to the authentication message;

    If the enterprise server determines that the first parameter is the same as the second parameter, it determines that the terminal device is successfully registered.
19. The method according to claim 18, wherein before the enterprise server responds to the registration request message and sends a registration response message to the terminal device, the method further comprises:

    The enterprise server acquires the first authentication identifier according to the first enterprise authentication key;

    The enterprise server responds to the registration request message, and sending the registration response message to the terminal device includes:

    The enterprise server sends the registration response message to the terminal device, the registration response message carries the first authentication identifier and first preset parameters, and the first authentication identifier and the first preset The parameter is used to obtain the first parameter;

    The terminal device receives the registration response message.
20. The method according to claim 19, wherein the acquiring the first parameter by the terminal device according to the registration response message comprises:

    The terminal device calculates the first preset parameter by using the second user authentication key to obtain the first parameter.
21. The method according to claim 19 or 20, wherein the enterprise server obtaining the second parameter according to the authentication message comprises:

    The enterprise server calculates the first preset parameter through the first user authentication key to obtain the second parameter;

    If the enterprise server determines that the first parameter is the same as the second parameter, after determining that the terminal device is successfully registered, the method further includes:

    The enterprise server sends a first indication message to the operator server, where the first indication message is used to indicate that the terminal device is successfully registered;

    The operator server receives the first indication message.
22. The method according to claim 21, wherein the authentication message also carries a call identifier used by the terminal device to implement communication services, and the enterprise server uses the first user authentication key to authenticate the first Before calculating the preset parameters to obtain the second parameters, the method further includes:

    The enterprise server acquires the first user authentication key corresponding to the call identifier.
23. The method according to any one of claims 18 to 22, wherein, before the enterprise server responds to the registration request message and sends a registration response message to the terminal device, the method further includes:

    The enterprise server acquires an account opening identifier, a first account opening key, and a second preset parameter;

    The enterprise server calculates the second preset parameters through the first account opening key to obtain the first account opening parameters;

    The enterprise server sends an account opening request message to the operator server, the account opening request message carrying the account opening identifier, the second preset parameter, and the first account opening parameter;

    The operator server receives the account opening request message;

    The operator server acquires a second account opening key corresponding to the account opening identifier;

    The operator server calculates the second preset parameters by using the second account opening key to obtain second account opening parameters;

    If the operator server determines that the first account opening parameter and the second account opening parameter are the same, then send an account opening confirmation message to the enterprise server, where the account opening confirmation message is used to indicate that the enterprise server has successfully opened an account;

    The enterprise server receives the account opening confirmation message.
24. The method according to any one of claims 18 to 23, wherein the first authentication identifier is a first token token or first abstract information obtained by performing hash calculation on first preset parameters;

    The second authentication identifier is a second token or second summary information obtained by performing hash calculation on the first preset parameter carried in the authentication request message.
25. An enterprise server is characterized in that it includes a memory and a transceiver respectively coupled to a processor, the memory stores computer program codes, and the processor invokes and executes the computer program codes in the memory, so that the The enterprise server executes the steps according to any one of claims 1-7.
26. An operator server, characterized in that it includes a memory and a transceiver respectively coupled to a processor, the memory stores computer program codes, and the processor invokes and executes the computer program codes in the memory, so that the The operator server executes the steps according to any one of claims 8-14.
27. A terminal device, characterized in that it includes a memory and a transceiver respectively coupled to a processor, the memory stores computer program codes, and the processor invokes and executes the computer program codes in the memory, so that the terminal device Execute the steps as described in any one of claims 15-17.
28. A communication system, characterized in that the communication system includes a terminal device, an enterprise server, and an operator server, and the communication system is used to execute the steps according to any one of claims 18-24.
29. A communication system, characterized by comprising an enterprise server and an operator server, the enterprise server as claimed in claim 25, and the operator server as claimed in claim 26.
30. A computer-readable storage medium, characterized in that,

    The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method described in any one of claims 1 to 24 can be completed.

Images