WO2006024216A1

WO2006024216A1 - A method for implementing certificating and a system thereof

Info

Publication number: WO2006024216A1
Application number: PCT/CN2005/001157
Authority: WO
Inventors: Long Luo
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2004-07-29
Filing date: 2005-07-29
Publication date: 2006-03-09
Also published as: CN100499453C; CN1728636A

Abstract

A method for implementing certificating and a system thereof. The system comprises a client, an application server and a client certification center (CCC) and the method comprises that the client sends the certification identifier to CCC through the application server; CCC certificates the client according to the received certification identifier. The present invention can improve the security and reliability substantially, enable the provider to control the key information of the client software, make it easy to update and charge the client software, and to unify and manage the behavior of the users.

Description

Method and system for realizing authentication

Technical field

The present invention relates to the field of network security, and in particular to a method and system for implementing authentication. Background of the invention

In recent years, with the continuous extension and development of information technology and network applications, the Internet has become a popular communication method. However, before the server, the servers in the network are often subjected to malicious attacks by illegal users through the client, resulting in a large amount of data loss and damage in the server.

In order to prevent malicious users from malicious attacks on the server through the client, the current main measure is to authenticate the user. The user sends the user name and password to the application server (AS) in the network through the client. The AS determines whether the user is legal according to whether the user name and password are saved. If it is legal, the authentication succeeds, and the user is allowed to access and pass the client. The terminal exchanges service data with the network side. If it is not legal, the authentication fails and the user is denied access.

However, in the prior art, when the authentication is implemented, only the user identity is authenticated, that is, if the user identity is legal, the client can establish a connection with the AS to implement the subsequent service. However, since the username and password are easily deciphered, once the illegal user deciphers the username and password, the authentication succeeds and a connection with the server is established, thereby maliciously attacking the server. Therefore, only authenticating the user's identity to ensure the legitimacy of the user does not effectively prevent the server in the network from being maliciously attacked.

It can be seen that how to adopt a more secure and reliable authentication method has become an urgent problem to be solved. Summary of the invention

It is a primary object of the present invention to provide a method of implementing authentication, and another object of the present invention is to provide a system for implementing authentication to improve the security and reliability of authentication.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A method for implementing authentication, setting a client authentication center, the method further comprising the following steps:

A. The client sends the authentication identifier to the client authentication center;

B. The client authentication center authenticates the client according to the received authentication identifier. Before the client sends the authentication identifier to the client authentication center, the step A further includes the following steps:

Al, the client will access the request. Send to the client authentication center;

A2: The client authentication center generates an authentication parameter, and then carries the generated authentication parameter in the client authentication request and sends the authentication parameter to the client;

A3. The client obtains the authentication identifier according to the authentication parameter carried in the client authentication request. The method further includes: setting a keystore including a plurality of keys, and storing the set keystore in a client authentication center and each client software, wherein different keys are correspondingly different in the keystore Key serial number;

In step A2, the step of generating the authentication parameter by the client authentication center includes: the client authentication center selects a key from the keystore saved by itself, and obtains the key sequence number corresponding to the selected key, and then generates a key. a random number, and an encryption algorithm selected by itself; the authentication parameter includes a key sequence number, a random number, and an encryption algorithm;

In step A3, the step of the client obtaining the authentication identifier according to the authentication parameter includes: the client searches for the corresponding key from the keystore saved by the client according to the obtained key sequence number, and then according to the found secret The key, the obtained random number, and the encryption algorithm encrypt the secret set in itself, and use the encrypted secret as the obtained authentication identifier; The step B includes: the client authentication center decrypts the received encrypted secret according to the selected key, the generated random number, and a decryption algorithm saved in itself, and then determines whether the decrypted secret is legal or not. Determine if the authentication is successful.

The method further includes: setting a private key corresponding to the client authentication center in the client authentication center, and setting a public key corresponding to the client authentication center in each client software; in step A2, the client authentication The step of generating a random number by the center further includes: the client authentication center signatures the generated random number by using the set private key;

The random number included in the authentication parameter is a signed random number;

Before obtaining the authentication identifier according to the authentication parameter, the step A3 further includes: the client verifying the signed random number by using the public key set in itself, and if the verification result is the signature of the client authentication center, proceeding to execute the The step of obtaining the authentication identifier according to the authentication parameter, otherwise, ending the current process.

The method further includes: assigning different client software version identifiers to each different client software, and saving each of the allocated client software version identifiers in the corresponding client software, and saving in the client authentication center. ;

The secret is a client software version identifier used by the client to use the software;

In step B, the step of the client authentication center determining whether the authentication is successful by determining whether the decrypted secret is legal or not includes: determining, by the client authentication center, whether the client with the same client software version identifier as the decrypted client is saved. End software version identifier, if yes, the authentication is successful.

The client software version identifier includes: a client software version serial number, or a client software version serial number and a issuing company identifier.

The different client software includes not

Different versions of client software provided by the developer.

The client authentication center is connected to an application server; The step A includes: the client sends the authentication identifier to the application server, and the application server sends the authentication identifier to the client authentication center.

The method further includes: pre-storing the user name and password of the registered user in the application server; the client sends the user name and password input by the user to the application server, and the application server determines whether the user name and password are the same as the received user name and password. Username and password. If yes, the authentication is successful. Otherwise, the authentication fails.

The method further includes: setting a trigger authentication policy in the application server;

In step A, the step of the client sending the authentication identifier to the application server includes: the client carrying the authentication identifier in the access request and sending the method to the application server;

After the client sends the authentication identifier to the application server in the access request, and before the application server sends the authentication identifier to the client authentication center, the step A further includes: the application server determining, according to the set trigger authentication policy Whether the client authentication process should be performed currently, and if so, the step of transmitting the authentication identifier to the client authentication center is continued, otherwise, the current process is ended.

The triggering authentication policy includes: whether the number of consecutively receiving the same client access request exceeds the set number of times threshold, or, periodically detecting, or randomly detecting, or, unconditionally detecting, or detecting a specific service, or, Billing detection.

The triggering authentication policy is whether the number of consecutively receiving the same client access request exceeds the set threshold value;

The step of determining, by the application server, whether the client authentication process should be performed currently includes: determining, by the application server, whether the number of times the client access request has been continuously received exceeds a preset threshold value, and if yes, determining that the current response should be Perform the client authentication process.

The method further includes: setting a correspondence between different authentication identifiers and different user identifiers in the client authentication center;

The step A further includes: the client acquiring the user identifier input by the user, and obtaining the obtained The extracted user ID is sent to the client authentication center;

The step B further includes: the client authentication center authenticating the client according to whether the received authentication identifier and the user identifier meet the set correspondence relationship.

The user identifier is a mobile phone number or a user name of the user.

The client accesses the visited area;

The step A includes: the client sends the authentication identifier to the client authentication center of the visited area, and the client authentication center of the visiting area sends the authentication identifier to the client authentication center of the home zone;

In step B, the client authentication center is a client authentication center of the client home zone.

A system for implementing authentication, comprising a client, an application server, and a client authentication center, wherein the application server is connected to the client and the client authentication center respectively.

The client authentication center sends the client authentication request to the application server, receives the authentication identifier sent by the application server, and then authenticates the client according to the received authentication identifier;

The application server sends a client authentication request from the client authentication center to the client, and sends the authentication identifier from the client to the client authentication center;

The client obtains the authentication identifier after receiving the client authentication request from the application server, and sends the obtained authentication identifier to the application server.

The client authentication center is a separate network entity;

The client authentication center and the application server are connected through a customized Ca interface. The client authentication center and the existing entities in the network are combined into one physical entity. The existing entities in the network are home location registers or application servers.

As can be seen from the above scheme, the present invention has the following advantages:

1. The operator assigns different client software version identifiers to different client softwares, and The authentication process is performed according to the client software version identifier, and the client software version identifier is difficult to be obtained by the illegal user. Therefore, the security and reliability of the authentication are greatly improved, and the malicious user is prevented from establishing a connection with the server. Attack, standardizing the network order.

2. In the case of high security requirements, in addition to authenticating the client, the CCC further authenticates the user identity and authenticates successfully if both the client and the user are authenticated. Therefore, the security and reliability of authentication are further improved through the two-factor authentication process.

3. In the present invention, only the regular client software released by the supplier can be authenticated, thereby improving the economic efficiency of each software supplier.

4. For the operator, the key information of the client software, that is, the client software version identifier, can be grasped, and the client software can be uniformly upgraded and charged, and the user behavior can be easily regulated and managed. BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a schematic view showing the structure of the system of the present invention.

2 is a flow chart of authenticating a client in an embodiment of the present invention.

Day

Flowchart for implementing authentication to implement the method of the present invention

In the prior art, when the authentication is implemented, only the user identity is authenticated, and the legal user identity is easily copied, thereby making the authentication process lack security and reliability. Since the user must communicate with the server in the network through the client, whether the software used by the client is legal will directly affect the legitimacy of the entire communication process, and thus related to the network. Whether the server will be attacked maliciously. Aiming at this feature, the present invention proposes a new method and system for implementing authentication. The core idea of the method is: setting a client authentication center; the client sends the authentication identifier to the client authentication center; the client authentication center The client is authenticated according to the received authentication identifier.

The authentication identifier is information that uniquely identifies the client, for example, encrypting the client software version identifier previously allocated for the software used by the client as the authentication identifier.

It can be seen that the core idea of the present invention is to authenticate the client, that is, to verify the legality of the client software used by the client. Moreover, in order to further ensure the security of the authentication process, it may further include authenticating the identity of the user.

In addition, in the specific service implementation, if all the clients must be authenticated, the load on the network side will be greatly increased. Therefore, in the present invention, the trigger authentication policy may be preset. When the AS receives the access request sent by the client, the AS does not immediately instruct the client authentication center to perform the authentication process, but firstly according to the set trigger. The authentication policy determines whether the subsequent authentication process should be performed on the client. If it is determined that the subsequent process of authenticating the client should be performed, the process of instructing the client authentication center to perform authentication is continued.

The present invention will be further described in detail below with reference to the accompanying drawings.

Figure 1 is a schematic view showing the structure of the system of the present invention. Referring to FIG. 1, the system of the present invention includes: a client, an AS, and a Client Certification Center (CCC). The CCC may be a separate network entity set up by the present invention, or may be combined with an existing entity in the network into a physical entity. For example, the CCC may be combined with a Home Location Register (HLR) or an AS as a network entity. In the system of the present invention, if the CCC is a separate network entity, the CCC and the AS are connected by the Ca interface of the present invention. 2 is a flow chart of authenticating a client in an embodiment of the present invention. . Referring to FIG. 1 and FIG. 2, applying the system of the present invention, the process of implementing the authentication by the method of the present invention specifically includes the following steps:

Step 201: Allocate different client software version identifiers for each different client software in advance, and save each of the allocated client software version identifiers in the CCC.

Here, the client software provided by different developers and the different versions of the client software provided by the same developer are different client softwares described in the present invention.

In addition, in this step, the client software version identifier includes a client software version serial number, and may further include information such as a company logo.

Step 202: Pre-set a keystore including a plurality of keys, and save the set keystore in the CCC.

Here, different keys correspond to different key sequences in the keystore.

Step 203: Pre-storing each of the allocated client software version identifiers in the corresponding client software, and storing the keystores in each client software separately.

Step 204: Set a trigger authentication policy in the AS in advance.

Here, the triggering authentication policy may be set according to the actual service requirement. The triggered authentication policy may be: whether the number of consecutively receiving the same client access request exceeds the set number of times threshold, and/or the periodicity set by the operator. Detection, random detection, unconditional detection, detection of specific services, billing detection, etc.

The above steps 201 to 204 are a series of initial setting processes performed by the present invention to implement the subsequent actual authentication process. In addition, in the initial setting process, 迩 may further set a private key corresponding to the CCC in the CCC, and set a public key corresponding to the CCC in each client software, for verifying the identity of the CCC in the subsequent authentication process. .

In addition, after installing each different client software into different clients, the subsequent actual authentication process can be performed. Step 205: The client sends an access request carrying the identifier of the client software version to the AS.

Step 206: The AS obtains the client software version identifier from the received access request, and then determines whether the current client should be authenticated according to the acquired client software version identifier and the triggering authentication policy. If yes, step 207 is performed. Otherwise, perform the existing process of allowing the client to access and establish a connection, ending the current process.

Here, the process of determining whether the current client should be authenticated may be: For example, if the preset trigger authentication policy is that the number of consecutively receiving the same client access request exceeds the set number of times threshold, the AS determines the current Whether the number of times the access request carrying the acquired client software version identifier has been continuously received exceeds the preset number of times, and if so, it is considered that the current client should be authenticated; for example, a preset trigger authentication policy For the periodic detection set by the operator, the AS determines whether it is currently in the period of periodic detection. If yes, it considers that the current client should be authenticated.

Step 207: The AS sends the obtained client software version identifier in the client authentication indication to the CCC through the Ca interface.

Step 208: The CCC selects a key from its saved keystore, generates a random number, and then uses the key number of the selected key in the keystore, the generated random number, and an encryption algorithm saved by itself. The bearer is sent to the AS through the Ca interface in the client authentication request.

Here, if the private key corresponding to the CCC is set in the CCC in advance, in this step, the CCC may further sign the generated random number using the set private key, and carry the signed random number in the client. In the end authentication request, that is, the random number carried in the client authentication request in this step may be a signed random number.

Step 209: The AS sends the received client authentication request to the client.

Step 210: The client obtains the key sequence number from the received client authentication request, and the Number of machines and encryption algorithms.

Here, if the public key corresponding to the CCC is set in the client software in advance, in this step, after receiving the client authentication request, the client obtains the signed random number from the client, and the client further uses the client. The public key corresponding to the CCC set in itself is used to verify the signed random number. If the verification result is a CCC signature, the client can confirm that the random number is sent by the CCC, that is, the random number is considered to be legal. The subsequent authentication process is continued. Otherwise, the random number is not sent by the CCC. If the random number is considered illegal, the current authentication process is terminated.

Step 211: The client searches for the corresponding key from the stored keystore according to the obtained key sequence number, and then performs the secret in itself according to the found key, the obtained random number, and the encryption algorithm. Encryption, and then the encrypted secret is carried in the client authentication response message and sent to the AS.

Here, the secret is selected from the client software version identifier. For example, if the client software version identifier includes the client software version serial number and the issuing company information, the client may select the client software version serial number as the secret for encryption.

Step 212: The AS sends the received client authentication response message to the ccc through the Ca interface.

Step 213: After receiving the client authentication response, the CCC obtains the encrypted secret therefrom, and then uses the key selected in step 208, the generated random number, and the decryption algorithm saved in itself to obtain the encrypted encrypted information. The secret is decrypted, and then it is judged whether the decrypted secret is legal. If yes, step 214 is performed; otherwise, step 215 is performed.

Here, the CCC determines whether the decrypted secret is legal by judging whether or not the same secret as the decrypted secret is stored in itself. For example, in step 211, the client selects the client software version serial number as the secret for encryption. In this step, the CCC decrypted secret is the client software version serial number of the client, and the CCC determines whether it is in the client. Has The decrypted client software version serial number is saved, and if so, the decrypted secret is considered legal.

Step 214: The CCC sends a client authentication success message to the AS through the Ca interface, and the AS notifies the client that the authentication is successful, performs a subsequent service connection process, and ends the current process.

Step 215: The CCC sends a client authentication failure message to the AS through the Ca interface, and the AS notifies the client that the authentication fails and denies the client access.

In a specific service implementation, the operator can also establish a corresponding relationship between the client software and the user in advance, that is, the operator can pre-agreed the user identifier with the user, and set different client software version identifiers in the CCC. Correspondence with different user IDs. Here, the client software version identifier includes a client software version serial number, and may further include information such as a company identifier, where the user identifier is an identifier that can uniquely prove the identity of the user, such as a mobile phone number or a user name of the user. Wait. In this manner, when the authentication is implemented, the method further includes: determining whether there is a correspondence between the current client software version identifier and the user identifier, and the specific implementation process can be seen in FIG. 3, including the following steps:

Steps 301 to 307 are the same as all descriptions of steps 201 to 207. Step 308: The CCC selects a key from its saved keystore, generates a random number, and then serializes the selected key in the keystore, the generated random number, the encryption algorithm saved by itself, and The user identification information is required to be carried in the client authentication request and sent to the AS through the Ca interface.

Step 309: The AS sends the received client authentication request to the client.

Step 310: The client obtains the key sequence number from the received client authentication request, and the The number of machines and the encryption algorithm are provided, and the user identification information is provided according to the requirements carried in the client authentication request to prompt the user to input the user identifier, and obtain the user identifier input by the user.

Step 311: The client searches for the corresponding key from the stored keystore according to the obtained key sequence number, and then performs the secret in itself according to the found key, the obtained random number, and the encryption algorithm. encryption.

Step 312: The client sends the encrypted secret and the obtained user identifier to the AS in the client authentication response message.

Here, the secret is selected from the client software version identifier. For example, the client software version identifier includes the client software version serial number and the issuing company information, and the client can select the client software version serial number as the secret for encryption.

Step 313: The AS sends the received client authentication response message to the ccc through the Ca interface.

Step 314: After receiving the client authentication response, the CCC obtains the encrypted secret and the user identifier, and then uses the key selected in step 308, the generated random number, and the decryption algorithm saved in itself to obtain the acquired The encrypted secret is decrypted, and then it is judged whether the decrypted secret is legal. If yes, step 316 is performed; otherwise, step 315 is performed.

Here, the CCC determines whether the decrypted secret is legal by judging whether or not the same secret as the decrypted secret is stored in itself. For example, in step 312, the client selects a guest. The client software version serial number is encrypted as a secret. In this step, the secret of the CCC decryption is the client software version serial number of the client, and the CCC determines whether the decrypted client software has been saved in the client software. The version serial number, if any, considers the decrypted secret to be legal.

Step 315: The CCC sends a client authentication failure message to the AS through the Ca interface, and the AS notifies the client that the authentication fails, denies the client access, and ends the current process.

Step 316: The CCC determines whether there is a preset correspondence between the decrypted secret and the acquired user identifier. If yes, step 317 is performed; otherwise, the process returns to step 315.

Step 317: The CCC sends a client authentication success message to the AS through the Ca interface, and the AS notifies the client that the authentication is successful, and performs a subsequent service connection process.

In the above implementation process of the present invention, after receiving the client authentication request sent by the client authentication center, the client sends the encrypted password as the authentication identifier, that is, the encrypted client software version identifier to the encrypted client software version identifier. In the other embodiment of the present invention, the client may also actively send the authentication identifier to the AS in the access request, and the AS sends the authentication identifier to the client authentication center. The principle is the same as that of the above embodiment.

In addition, it should be noted that, in a specific service implementation, in order to further ensure the security and reliability of the authentication process, the authentication process of the present invention may further include a currently existing process of authenticating the user identity by the AS, The specific implementation can be implemented in multiple ways. Here, the user name and the secret of the registered user are saved in the application server in advance; when the authentication is performed, the client sends the user name and password input by the user to the AS, and the AS judges itself. Whether the user name and password with the same username and password are saved. If yes, the authentication of the current user is considered successful. Otherwise, the authentication fails. Moreover, the process of authenticating the user identity in the present invention may be performed after the client authentication is successful, or may be performed before the client is authenticated. In addition, it should be noted that, since the client can directly access the AS in the home zone or access the AS through the remote agent, both the wired network and the mobile network can be divided into two types: the client accessing the home zone and the visiting zone. Happening. The foregoing process describes the process of implementing authentication when the client accesses the home zone. In a specific service implementation, when the client accesses the visited zone, the process of implementing the authentication by the present invention is the same as the above process. All the messages between the AS and the CCC need to be forwarded through the CCC (VCCC) of the visited area. That is, when the AS receives the access request sent by the client, it sends the client authentication indication to the VCCC. The VCCC forwards the client authentication indication to the CCC of the client home zone according to the client software version identifier carried in the client authentication indication, and forwards the client authentication response sent by the VCCC to the CCC of the client home zone. To AS.

In conclusion, the above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are made within the spirit and principles of the present invention, should be Within the scope of protection of the present invention.

Claims

Claim

A method for implementing authentication, characterized in that a client authentication center is set, the method further comprising the steps of:

A. The client sends the authentication identifier to the client authentication center.

B. The client authentication center authenticates the client according to the received authentication identifier.

2. The method according to claim 1, wherein the step A further comprises the following steps before the client sends the authentication identifier to the client authentication center:

Al, the client sends an access request to the client authentication center;

A2. The client authentication center generates an authentication parameter, and then carries the generated authentication parameter in the client authentication request and sends it to the client.

A3. The client obtains the authentication identifier according to the authentication parameter carried in the client authentication request.

3. The method according to claim 2, wherein the method further comprises: setting a keystore including a plurality of keys, and saving the set keystore in the client authentication center and each client In the software, wherein different keys correspond to different key sequences in the keystore;

In step A2, the step of generating the authentication parameter by the client authentication center includes: the client authentication center selects a key from the keystore saved by itself, and obtains the key serial number corresponding to the selected key, and then generates a key. a random number, and an encryption algorithm selected by itself; the authentication parameter includes a key sequence number, a random number, and an encryption algorithm;

In step A3, the step of the client obtaining the authentication identifier according to the authentication parameter includes: the client searches for the corresponding key from the keystore saved by the client according to the obtained key sequence number, and then finds the corresponding key according to the obtained key sequence. The key, the obtained random number, and the encryption algorithm encrypt the secret set in itself, and use the encrypted secret as the obtained authentication identifier;

The step B includes: the client authentication center according to the selected key, the generated The number of machines and the decryption algorithm stored in itself decrypt the received encrypted secret, and then judge whether the authentication is successful by judging whether the decrypted secret is legal.

4. The method according to claim 3, wherein the method further comprises: setting a private key corresponding to the client authentication center at the client authentication center, and setting a client authentication corresponding to each client software The public key of the center;

In step A2, the step of generating a random number by the client authentication center further includes: the client authentication center signatures the generated random number by using the set private key;

5. The method according to claim 3 or 4, characterized in that the method further comprises: assigning different client software version identifiers to each different client software, and assigning each client software version to each client. The identifier is saved in the corresponding client software and saved in the client authentication center;

The method according to claim 5, wherein the client software version identifier comprises: a client software version serial number, or a client software version serial number and a issuing company identifier.

7. The method according to claim 5, wherein the different clients are The software includes client software from different developers and different versions of client software from the same developer.

8. The method according to claim 1, wherein the client authentication center is connected to an application server;

The step A includes: the client sends the authentication identifier to the application server, and the application server sends the authentication identifier to the client authentication center.

The method according to claim 8, wherein the method further comprises: pre-storing the user name and password of the registered user in the application server; the client sends the user name and password input by the user to the application server, and the application server determines Whether the user name and password with the same user name and password are saved in the self, if yes, the authentication is successful, otherwise, the authentication fails.

The method according to claim 8 or 9, wherein the method further comprises: setting a trigger authentication policy in the application server;

The method according to claim 10, wherein the triggering the authentication policy comprises: whether the number of consecutively receiving the same client access request exceeds a threshold number of times set, or, periodically detecting, or randomly detecting , or, unconditional detection, or, for specific service detection, or, billing detection.

12. The method according to claim 11, wherein the trigger authentication policy Whether the number of consecutively receiving the same client access request is more than the set number of times threshold;

The step of determining, by the application server, whether the client authentication process should be performed currently includes: determining, by the application server, whether the number of times the client access request has been continuously received exceeds a preset threshold number, and if yes, determining that the current execution should be performed Client authentication process.

The method according to claim 1, wherein the method further comprises: setting a correspondence between different authentication identifiers and different user identifiers in the client authentication center;

The step A further includes: the client acquiring the user identifier input by the user, and sending the obtained user identifier to the client authentication center;

14. The method according to claim 13, wherein the user identifier is a mobile phone number or a user name of the user.

15. The method according to claim 1, wherein the client accesses a visited area;

16. A system for implementing authentication, comprising a client and an application server, wherein the system further comprises a client authentication center, wherein the application server is connected to the client and the client authentication center respectively.

The client authentication center sends the client authentication request to the application server, receives the authentication identifier sent by the application server, and then recognizes the client according to the received authentication identifier. Certificate

The system according to claim 16, wherein the client authentication center is a separate network entity;

The client authentication center and the application server are connected through a customized Ca interface.

18. The system according to claim 16, wherein the client authentication center and the existing entities in the network are combined into one physical entity.

The system according to claim 18, wherein the existing entity in the network is a home location register or an application server.