Authentication method, authentication device and authentication system

Abstract

The present invention discloses an authentication method, an authentication device and an authentication system, which belong to the field of communications and meet the business demand for authentication flexibility. The authentication method comprises: a first user device sends a first random parameter to a second user device; the second user device obtains a first user identifier, a second user identifier and a second random parameter, and generates a second authentication feature according to the first user identifier, the second user identifier, the first random parameter and the second random parameter, and sends the second authentication feature to the first user device; the first user device verifies the correctness of the second authentication feature, generates a first authentication feature, and sends the first authentication feature to the second user device; the second user device verifies the correctness of the first authentication feature. The present invention is used for authentication between terminals.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to an authentication method, an authentication device and an authentication system. Background Art

[0002] The future mobile communication network will include a variety of services, each of which will have different security requirements. The future mobile communication network will have a key center that can control and manage the generation and distribution of keys to meet the security requirements of the services.

[0003] However, the following problems will occur if the 2G / 3G / 4G security protection mode is used: all root keys are stored in the core node - the Home Subscriber Server (HSS), which cannot meet the business demand for authentication flexibility; if the authentication of massive devices requires the participation of HSS, the system complexity will be increased.

[0004] Therefore, in view of the future business needs for security, it is necessary to design a more flexible authentication method to meet the business needs for authentication flexibility. Summary of the invention

[0005] The embodiments of the present invention provide an authentication method, an authentication device and an authentication system to meet the business requirements for authentication flexibility.

[0006] In a first aspect, an authentication method is provided, the method comprising:

[0007] The first user equipment sends a first random parameter to the second user equipment;

[0008] The second user equipment obtains the first user identifier, the second user identifier, and the second random parameter, generates a second authentication feature according to the first user identifier, the second user identifier, the first random parameter, and the second random parameter, and sends the second authentication feature to the first user equipment;

[0009] The first user equipment verifies the correctness of the second authentication feature, generates a first authentication feature, and sends the first authentication feature to the second user equipment;

[0010] The second user equipment verifies the correctness of the first authentication feature.

[0011] The method for performing authentication between two user equipments provided in the embodiment of the present invention does not require intervention of the HSS during the authentication process, and can meet the service demand for authentication flexibility.

[0012] In the embodiment of the present invention, the first user device and the second user device may be various terminal devices, including but not limited to mobile phones, computers, smart TVs, smart refrigerators, etc.

[0013] In the embodiment of the present invention, the second user device may obtain the first user identifier, the second user identifier and the second random parameter in various different ways. One way of obtaining is that the second user device receives the first user identifier and the second user identifier from the first user device, and randomly generates the second random parameter. Another way of obtaining is that the second user device obtains the first user identifier and the second user identifier in advance, for example, obtains the first user identifier and the second user identifier in the key distribution stage, and randomly generates the second random parameter.

[0014] In the embodiment of the present invention, the authentication feature may be a message authentication code (MAC), encrypted text or a digital signature. These three situations are further described below.

[0015] In one case, the authentication feature is a MAC. In this case, after generating the second MAC, the authentication method may further include:

[0016] The second user equipment sends the first random parameter and the second random parameter to the first user equipment;

[0017] The first user equipment generating the first authentication feature includes: the first user equipment generating the first MAC according to a first random parameter and a second random parameter.

[0018] The first user equipment can conveniently calculate the first MAC by receiving the first random parameter and the second random parameter.

[0019] In the case where the authentication feature is a MAC, correspondingly, the generating of the second MAC may include:

[0020] Generate a communication shared key K_COM and / or a session key K_SESSION according to the first user identifier and the second user identifier;

[0021] A second MAC is generated according to the communication shared key K_COM or the session key K_SESSION, the first random parameter and the second random parameter.

[0022] in:

[0023] K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), where parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm may be a HASH() algorithm or an HMAC() algorithm;

[0024] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0025] Second MAC=MAC(K_COM or K_SESSION, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier))

[0026] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment.

[0027] In the case where the authentication feature is a MAC, correspondingly, the generating the first MAC may include:

[0028] The first user equipment obtains the first user identifier and the second user identifier, and generates a communication shared key K_COM and / or a session key K_SESSION according to the first user identifier and the second user identifier;

[0029] Generate a first MAC according to the communication shared key K_COM or the session key K_SESSION, the first random parameter and the second random parameter;

[0030] in:

[0031] K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), where parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm may be a HASH() algorithm or an HMAC() algorithm;

[0032] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0033] First MAC = MAC (K_COM or K_SESSION, (first random parameter, at least one of the second random parameter), (session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier))

[0034] The session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the first user equipment.

[0035] The above method provides a new MAC generation method, which can use the generated MAC to perform authentication between user devices.

[0036] In another case, the authentication feature is an encrypted text, and generating the second authentication feature according to the first user identifier, the second user identifier, the first random parameter and the second random parameter may include:

[0037] Encrypting the first user identifier, the second user identifier, the first random parameter and the second random parameter by using the first user identifier, the communication shared key K_COM or the session key K_SESSION to generate a second encrypted text;

[0038] Verifying, by the first user equipment, the correctness of the second authentication feature includes: the first user equipment decrypting the second encrypted text using the first user key, the communication shared key K_COM or the session key K_SESSION to obtain a first random parameter and a second random parameter, and determining whether the first random parameter obtained by decryption is the same as the first random parameter previously sent to the second user equipment, and if they are the same, the verification is successful;

[0039] Among them, the key used in encryption corresponds to the key used in decryption;

[0040] K_COM=E(XH(ID1),H(ID2)) or K_COM=H(E(XH(ID1),H(ID2)); or K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0041] K_SESSION=KDF(K_COM, (at least one of session identifier, first random parameter, second random parameter, service identifier, first user identifier, and second user identifier)).

[0042] The above-mentioned method of verifying the second encrypted text can verify whether the first random parameter has been changed by matching the decrypted first random parameter with the first random parameter previously sent to the second user device, thereby better authenticating the second user device.

[0043] In the case where the authentication feature is an encrypted text, the generating of the first authentication feature includes:

[0044] The first user device obtains the first user identifier and the second user identifier, and encrypts the first user identifier, the second user identifier and a second random parameter by using the first user identifier, a communication shared key K_COM or a session key K_SESSION to generate a first encrypted text;

[0045] Verifying, by the second user equipment, the correctness of the first authentication feature includes:

[0046] The second user device uses the first user key, the communication shared key K_COM or the session key K_SESSION to decrypt the first encrypted text to obtain a second random parameter, and determines whether the decrypted second random parameter is the same as the previously encrypted second random parameter. If they are the same, the verification is successful.

[0047] The above-mentioned method of verifying the first encrypted text can verify whether the second random parameter has been changed by matching the decrypted second random parameter with the second random parameter previously sent to the first user device, thereby better authenticating the first user device.

[0048] In the case where the authentication feature is an encrypted text, optionally, the first random parameter sent by the first user equipment to the second user equipment is an encrypted first random parameter. Accordingly, the authentication method may further include: the second user equipment decrypting the encrypted first random parameter to obtain the first random parameter.

[0049] The encryption method may include encryption based on the communication shared key K_COM and encryption based on the identity identifier. By encrypting the first random parameter, the security of the first random parameter can be better guaranteed.

[0050] In another case, the authentication feature is a digital signature. Accordingly, after generating the second digital signature, the method may further include:

[0051] The second user equipment sends the first random parameter and the second random parameter to the first user equipment;

[0052] The first user equipment generating the first authentication feature includes: the first user equipment generating the first digital signature according to the first random parameter and the second random parameter.

[0053] In the case where the authentication feature is a digital signature, optionally, generating the second authentication feature may include:

[0054] Second digital signature = SIGN(SK_ID2, (at least one of the first random parameter, the second random parameter), (at least one of the session identifier, the first user identifier, the second user identifier, the service identifier, the slice identifier, the link identifier, the connection identifier, the service network identifier, and the public land mobile network identifier));

[0055] In the case where the authentication feature is a digital signature, generating the first authentication feature may include:

[0056] First digital signature = SIGN(SK_ID1, (first random parameter, at least one of second random parameter), (at least one of session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier));

[0057] Among them, SK_ID1 is the first user key, and SK_ID2 is the second user key. The session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier can be pre-acquired by the second user equipment.

[0058] The above provides a new method of generating digital signatures, which can facilitate subsequent mutual authentication based on digital signatures.

[0059] In the case where the authentication feature is a digital signature, optionally, after the second user equipment verifies the correctness of the first authentication feature, the authentication method may further include:

[0060] Encrypting the session communication between the first user equipment and the second user equipment by using the communication shared key K_COM or the session key K_SESSION;

[0061] Wherein, K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0062] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0063] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment.

[0064] By encrypting the session communication using the communication shared key K_COM or the session key K_SESSION, the security of the session between the two terminals can be better ensured.

[0065] In a second aspect, another authentication method is provided, the method comprising:

[0066] The first user equipment sends a first random parameter to the second user equipment;

[0067] The first user device receives a second authentication feature from the second user device;

[0068] The first user equipment verifies the correctness of the second authentication feature, generates a first authentication feature, and sends the first authentication feature to the second user equipment.

[0069] In one case, the authentication feature is a message authentication code (MAC). In this case, before generating the first authentication feature, the method further includes:

[0070] The first user equipment receives a first random parameter and a second random parameter from the second user equipment;

[0071] Accordingly, generating the first authentication feature includes:

[0072] The first user equipment obtains the first user identifier and the second user identifier, and generates a communication shared key K_COM and / or a session key K_SESSION according to the first user identifier and the second user identifier;

[0073] The first user equipment generates a first MAC according to the communication shared key K_COM or the session key K_SESSION, the first random parameter and the second random parameter;

[0074] in:

[0075] K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), where parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm may be a HASH() algorithm or an HMAC() algorithm;

[0076] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0077] First MAC = MAC (K_COM or K_SESSION, (first random parameter, at least one of the second random parameter), (session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier))

[0078] The session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the first user equipment or received from the first user equipment.

[0079] In one case, the authentication feature is an encrypted text. In this case, the first user equipment verifies the correctness of the second authentication feature includes:

[0080] The first user device decrypts the second encrypted text using the first user key, the communication shared key K_COM or the session key K_SESSION to obtain a first random parameter and a second random parameter, and determines whether the decrypted first random parameter is the same as the first random parameter previously sent to the second user device, and if they are the same, the verification is successful;

[0081] Wherein, K_COM=E(XH(ID1),H(ID2)) or K_COM=H(E(XH(ID1),H(ID2)); or K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0082] K_SESSION=KDF(K_COM, (at least one of session identifier, first random parameter, second random parameter, service identifier, first user identifier, and second user identifier)).

[0083] In the case where the authentication feature is encrypted text, generating the first authentication feature includes:

[0084] The first user device obtains the first user identifier and the second user identifier, and uses the first user identifier, the communication shared key K_COM or the session key K_SESSION to encrypt the first user identifier, the second user identifier and a second random parameter to generate a first encrypted text.

[0085] In one case, the authentication feature is a digital signature. In this case, before generating the first authentication feature, the method further includes:

[0086] The first user equipment receives a first random parameter and a second random parameter from the second user equipment;

[0087] Generating the first authentication feature includes: calculating a first digital signature based on a first random parameter, a second random parameter and a first user key;

[0088] Wherein, the first digital signature = SIGN(SK_ID1, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, the first user identifier, the second user identifier, the service identifier, the slice identifier, the link identifier, the connection identifier, the service network identifier, and the public land mobile network identifier));

[0089] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0090] In a third aspect, an authentication method is provided, the method comprising:

[0091] The second user equipment receives the first random parameter from the first user equipment;

[0092] The second user equipment obtains the first user identifier, the second user identifier, and the second random parameter, generates a second authentication feature according to the first user identifier, the second user identifier, the first random parameter, and the second random parameter, and sends the second authentication feature to the first user equipment;

[0093] The second user equipment receives a first authentication feature from the first user equipment;

[0094] The second user equipment verifies the correctness of the first authentication feature.

[0095] In one case, the authentication feature is a message authentication code (MAC), in which case, after generating the second MAC, the method further includes:

[0096] The second user equipment sends the first random parameter and the second random parameter to the first user equipment.

[0097] In the case where the authentication feature is a message authentication code, generating the second MAC includes:

[0098] Generate a communication shared key K_COM and / or a session key K_SESSION according to the first user identifier and the second user identifier;

[0099] Generate a second MAC according to the communication shared key K_COM or the session key K_SESSION, the first random parameter and the second random parameter;

[0100] Wherein, K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0101] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0102] Second MAC=MAC(K_COM or K_SESSION, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier))

[0103] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0104] In one case, the authentication feature is an encrypted text. In this case, generating the second authentication feature according to the first user identifier, the second user identifier, the first random parameter and the second random parameter includes:

[0105] Encrypting the first user identifier, the second user identifier, the first random parameter and the second random parameter by using the first user identifier, the communication shared key K_COM or the session key K_SESSION to generate a second encrypted text;

[0106] When the authentication feature is an encrypted text, the second user equipment verifying the correctness of the first authentication feature may include:

[0107] The second user device decrypts the first encrypted text using the first user key, the communication shared key K_COM or the session key K_SESSION to obtain a second random parameter, and determines whether the decrypted second random parameter is the same as the previously encrypted second random parameter, and if they are the same, the verification is successful;

[0108] Wherein, K_COM=E(XH(ID1),H(ID2)) or K_COM=H(E(XH(ID1),H(ID2)); or K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0109] K_SESSION = KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier))

[0110] In one case, the authentication feature is a digital signature, in which case, generating the second authentication feature includes:

[0111] Second digital signature = SIGN(SK_ID2, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier));

[0112] In the case where the authentication feature is a digital signature, after generating the second digital signature, the method further includes: the second user equipment sending the first random parameter and the second random parameter to the first user equipment.

[0113] In a fourth aspect, an authentication device is provided, the authentication device comprising:

[0114] A sending module, configured to send a first random parameter to a second user equipment;

[0115] A receiving module, configured to receive a second authentication feature from the second user equipment;

[0116] A processing module, used to verify the correctness of the second authentication feature and generate a first authentication feature;

[0117] The sending module is further configured to send the first authentication feature to the second user equipment.

[0118] In one case, the authentication feature is a message authentication code. In this case, before generating the first authentication feature, the receiving module is further used to: receive a first random parameter and a second random parameter from the second user equipment;

[0119] The processing module is specifically used to: obtain the first user identifier and the second user identifier, and generate a communication shared key K_COM and / or a session key K_SESSION according to the first user identifier and the second user identifier; generate a first MAC according to the communication shared key K_COM or the session key K_SESSION, a first random parameter and a second random parameter;

[0120] in:

[0121] K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), where parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm may be a HASH() algorithm or an HMAC() algorithm;

[0122] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0123] First MAC = MAC (K_COM or K_SESSION, (first random parameter, at least one of the second random parameter), (session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier))

[0124] The session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the first user equipment or received from the first user equipment.

[0125] In one case, the authentication feature is an encrypted text. In this case, the processing module is specifically used to:

[0126] Decrypt the second encrypted text using the first user key, the communication shared key K_COM or the session key K_SESSION to obtain a first random parameter and a second random parameter, and determine whether the decrypted first random parameter is the same as the first random parameter previously sent to the second user device, if they are the same, the verification is successful;

[0127] Wherein, K_COM=E(XH(ID1),H(ID2)) or K_COM=H(E(XH(ID1),H(ID2)); or K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0128] K_SESSION=KDF(K_COM, (at least one of session identifier, first random parameter, second random parameter, service identifier, first user identifier, and second user identifier)).

[0129] When the authentication feature is an encrypted text, the processing module is specifically used to:

[0130] The first user identifier and the second user identifier are obtained, and the first user identifier, the communication shared key K_COM or the session key K_SESSION are used to encrypt the first user identifier, the second user identifier and the second random parameter to generate a first encrypted text.

[0131] In one case, the authentication feature is a digital signature, in which case the receiving module is further used for: the first user equipment receiving a first random parameter and a second random parameter from the second user equipment;

[0132] The processing module is specifically used to: calculate a first digital signature according to a first random parameter, a second random parameter and a first user key;

[0133] Wherein, the first digital signature = SIGN(SK_ID1, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, the first user identifier, the second user identifier, the service identifier, the slice identifier, the link identifier, the connection identifier, the service network identifier, and the public land mobile network identifier));

[0134] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0135] In a fifth aspect, an authentication device is provided, wherein the authentication device comprises:

[0136] A receiving module, configured to receive a first random parameter from a first user equipment;

[0137] a processing module, configured to obtain a first user identifier, a second user identifier, and a second random parameter, generate a second authentication feature according to the first user identifier, the second user identifier, the first random parameter, and the second random parameter, and send the second authentication feature to the first user device;

[0138] The receiving module is further configured to receive a first authentication feature from the first user equipment;

[0139] The processing module is further used to verify the correctness of the first authentication feature.

[0140] In one case, the authentication feature is a message authentication code, and the authentication device further includes a sending module, which is used to:

[0141] After the processing module generates the second MAC, the first random parameter and the second random parameter are sent to the first user equipment.

[0142] When the authentication feature is a message authentication code, the processing module is specifically configured to:

[0143] Generate a communication shared key K_com and / or a session key K_session according to the first user identifier and the second user identifier;

[0144] Generate a second MAC according to the communication shared key K_com or the session key K_session, the first random parameter and the second random parameter;

[0145] Wherein, K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0146] K_session=KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0147] Second MAC=MAC(K_com or K_session, (first random parameter, at least one of second random parameter), (at least one of session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier))

[0148] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0149] In one case, the authentication feature is an encrypted text, and the processing module is specifically used to:

[0150] Encrypting the first user identifier, the second user identifier, the first random parameter and the second random parameter using the first user identifier, the communication shared key K_com or the session key K_session to generate a second encrypted text;

[0151] Verifying the correctness of the first authentication feature includes:

[0152] Decrypt the first encrypted text using the first user key, the communication shared key K_com or the session key K_session to obtain a second random parameter, and determine whether the decrypted second random parameter is the same as the previously encrypted second random parameter. If they are the same, the verification is successful.

[0153] Wherein, K_com=e(xH(ID1),H(ID2)) or K_com=H(e(xH(ID1),H(ID2)); or K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0154] K_session = KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier))

[0155] In one embodiment, the authentication feature is a digital signature.

[0156] The processing module is specifically used to generate a second digital signature in the following manner:

[0157] Second digital signature = Sign(SK_ID2, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier));

[0158] After the processing module generates the second digital signature, the authentication device further includes a sending module, configured to send the first random parameter and the second random parameter to the first user equipment.

[0159] In a sixth aspect, an authentication system is provided, comprising the first authentication device described in the fourth aspect and the second authentication device described in the fifth aspect.

[0160] The authentication method, authentication device and authentication system provided by the embodiments of the present invention perform authentication between two terminal devices by means of MAC, encrypted text or digital signature. During the authentication process, no HSS intervention is required, which can meet the business requirements for authentication flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0161] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0162] Figure 1 is an architecture diagram of a communication system provided by an embodiment of the present invention;

[0163] Figure 2 It is a flow chart of a key distribution method based on an operator KMS provided in an embodiment of the present invention;

[0164] Figure 3 It is a flow chart of a key distribution method based on an operator KMS provided in an embodiment of the present invention;

[0165] Figure 4 It is a flow chart of a key distribution method based on an operator KMS provided in an embodiment of the present invention;

[0166] Figure 5 It is a flow chart of a key distribution method based on an operator KMS provided in an embodiment of the present invention;

[0167] Figure 6 It is a flow chart of a key distribution method based on a third-party KMS provided by an embodiment of the present invention;

[0168] Figure 7 It is a flow chart of a key distribution method based on a third-party KMS provided by an embodiment of the present invention;

[0169] Fig. 8A is a flow chart of a three-round authentication method provided by an embodiment of the present invention;

[0170] Figure 8BIt is a schematic diagram of a three-round authentication method for completing mutual authentication based on MAC provided by an embodiment of the present invention;

[0171] Fig. 9 Schematic diagram of a three-round authentication method for completing mutual authentication based on encryption provided by an embodiment of the present invention;

[0172] Fig.10 It is a schematic diagram of a three-round authentication method for completing mutual authentication based on signatures provided by an embodiment of the present invention;

[0173] Fig.11 It is a schematic diagram of a two-round authentication method for completing mutual authentication based on MAC provided by an embodiment of the present invention;

[0174] Fig.12 It is a schematic diagram of a two-round authentication method for completing mutual authentication based on signatures provided by an embodiment of the present invention;

[0175] Fig.13 is a structural block diagram of an authentication device provided by an embodiment of the present invention;

[0176] Fig.14 is a structural block diagram of another authentication device provided by an embodiment of the present invention;

[0177] Fig.15 is a schematic diagram of the structure of a terminal provided by an embodiment of the present invention;

[0178] Fig.16 It is a schematic diagram of the structure of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0179] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0180] Figure 1 is an architecture diagram of a communication system provided by an embodiment of the present invention. Figure 1 The key distribution system provided in the embodiment of the present invention may include UE 101, communication network element 102 and HSS 103, wherein the communication network element 102 and HSS 103 are devices in the operator network, and the communication network element 102 may be, for example, an authentication center, a control node, etc. Figure 1As shown, the key distribution system provided by the embodiment of the present invention may also include a key management center (Key Management System, KMS) 104, and KMS 104 plays the function of generating, distributing and managing user private keys. Among them, in the embodiment of the present invention, KMS 104 can be integrated into various network devices as a functional module, such as integrated into the communication network element 102, HSS 103, etc., or it can be used as an independent network device. When KMS 104 is an independent network device, it can be deployed outside the operator or outside the operator network. KMS 104 can have an interface with the network equipment of the operator network (such as communication network element 102, HSS103). It is also possible that KMS directly interfaces with UE 101, and in this case KMS can directly distribute keys to UE 101 without going through the operator network. In the key distribution system provided by the embodiment of the present invention, UE 101 will first communicate with the communication network element 102 and HSS 103 to complete the AKA network access authentication. After the AKA network access authentication is successful, key distribution is performed.

[0181] The key distribution method provided by the embodiment of the present invention may include a key distribution method based on the operator KMS and a key distribution method based on the third-party KMS. In the key distribution method based on the operator KMS, the KMS belongs to the network element of the operator, and in the key distribution method based on the third-party KMS, the KMS may also be controlled by a third party.

[0182] In an embodiment of the present invention, the key distribution method based on the operator KMS may include the following scenarios: 1) KMS is deployed in the communication network element, and the communication network element distributes the private key; 2) KMS is deployed in the HSS, and the HSS distributes the private key; 3) KMS is deployed independently of the communication network element, but has an interface with the communication network element, and the KMS generates the user private key, and the communication network element distributes the user private key to the UE; 4) KMS is deployed independently of the HSS, but has an interface with the HSS, and the KMS generates the user private key, and the communication network element distributes the user private key to the UE.

[0183] In an embodiment of the present invention, the key distribution method based on a third-party KMS may include the following scenarios: 1) KMS is deployed as an independent network element, and KMS sends the message authentication code (MAC) from the UE to the operator network element for verification, and distributes the user private key after the operator network element verification is passed; 2) KMS is deployed as an independent network element, and KMS sends the token from the UE to the operator network element for verification, and distributes the user private key after the operator network element verification is passed.

[0184] The following first describes the key distribution method based on the operator KMS provided by an embodiment of the present invention. Figure 2 1 is a flow chart of a key distribution method based on an operator KMS provided by an embodiment of the present invention. Figure 2 In the key distribution method based on the operator KMS shown, the KMS is deployed in the communication network element, the communication network element generates a user private key (SK_ID1), and distributes the user private key to the UE after the UE authentication is passed.

[0185] Reference Figure 2 The key distribution method based on the operator KMS provided in the embodiment of the present invention may include:

[0186] 201. The UE initiates a request to a communication network element, and the request may carry an IMSI, a user identity (ID1) and an indicator. Optionally, the request may only carry the IMSI and the indicator.

[0187] In the embodiment of the present invention, the communication network element may be an authentication center or a control node, but both include a KMS function module. The request may be specifically a user identity request (User Identity Request), and of course, it may also be various customized requests. The embodiment of the present invention does not limit the specific request name, and only requires that the request carry IMSI, user identity ID1 and an indicator.

[0188] Among them, the user in the user identification can be an industry user, a company, or a terminal user or a terminal. The user identification can be any of the following: an industry user identification, a business identification, a company identification, and an individual user identification. The identification of an individual user can be, for example, an international mobile phone equipment identity (IMEI), an international mobile subscriber identity (IMSI), an IP Multimedia Private Identity (IMPI), a temporary mobile subscriber identity (TMSI), an IP Multimedia Public Identity (IMPU), a medium access control (MAC) address, an IP address, a mobile phone number and a GUTI, a service identification (service ID), a user's application identification (user App ID), and a device ID. In the case where the user identification is an identification of an individual user and the identification of the individual user is IMSI, the request may only carry the IMSI and an indicator. In the case where the identification of the individual user is not IMSI, the request may carry the IMSI, the user identification (ID1) and the indicator, or the request may carry the IMSI and the indicator.

[0189] The indicator is used to indicate to the network that this request is used to initiate AKA authentication and obtain an identity-based private key.

[0190] 202. The communication network element receives the request sent by the UE, and sends the IMSI from the UE to the HSS through a message. After the communication network element obtains the request from the UE, it can know that key distribution is required later according to the indicator.

[0191] Among them, the message sent by the communication network element to the HSS in this step may also include the indicator in step 201.

[0192] 203. HSS receives the IMSI and performs the following operations: Calculate the authentication vector (AV), where AV = (RAND, AUTN, XRES, K asme ). Among them, RAND is the authentication random number, XRES is the response value, AUTN is the authentication value, K ASME The shared key after authentication.

[0193] If the message in step 202 contains an indicator, the HSS can be informed of the need for key distribution based on the indicator. At the same time, optionally, in the process of generating AV, the HSS can set the Xth bit of the Authentication Management Field (AMF) parameter in AUTN to 1, where 1≤X≤7. In this way, the communication network element can subsequently use this parameter to determine whether the authentication process for the UE includes identity-based key distribution. Of course, in this step, the HSS may not set the AMF parameter, that is, not set the bit in the AMF parameter. In this way, the communication network element can still determine in step 202 whether the received message contains an indicator to determine whether the authentication process for the UE includes identity-based key distribution.

[0194] If there is no indicator in the message received by the HSS from the communication network element, the HSS may not set the bit in the AMF and perform authentication in the traditional AKA manner.

[0195] 204. After generating the AV, the HSS sends the AV to the communication network element. Optionally, the HSS may also send an indicator to the communication network element.

[0196] It can be seen from the above steps 201 to 204 that the communication network element may send an indicator to the HSS or not; after receiving the indicator from the communication network element, the HSS may set the bit in the AMF parameter, and may choose to send an indicator to the communication network element or not.

[0197] 205. After receiving the AV from the HSS, the communication network element sends RAND and AUTN to the UE.

[0198] 206. The UE verifies AUTN, and after the verification is correct, calculates RES as a response to the communication network element.

[0199] 207. The UE sends a RES to the communication network element via a message.

[0200] 208. After receiving RES, the communication network element verifies whether RES is the same as XRES in AV. If they are the same, the verification is successful; if they are different, the authentication failure is returned. When the communication network element succeeds in the verification, the communication network element generates the user private key (SK_ID1) using an identity-based algorithm.

[0201] The identifiers used by the communication network element when calculating SK_ID1 may be the following: 1) user identifier (ID1); 2) operator identifier||user identifier, (ID||ID1), where || is in the form of cascade, indicating that the operator identifier and the user identifier are connected together as one identifier. The operator identifier may be a public land mobile network identifier (PLMN ID), a serving network identifier (servingnetwork ID), a local operator network identifier, etc.; 3) operator identifier||user identifier||time (ID||ID1||time), or user identifier||time (ID1||time).

[0202] It should be noted here that, when the request sent by the UE to the communication network element only carries the IMSI and the indicator and the IMSI is not used as the identity of the individual user, after the communication network element successfully verifies, the UE can send the user identity to the communication network element. In this way, after receiving the user identity, the communication network element can generate the user private key (SK_ID1) according to the user identity.

[0203] 209. The communication network element sends SK_ID1 to the UE. As an optional method, in this step, the communication network element may also send SK_ID1 and GPK to the UE, where GPK is a global public key.

[0204] 210. The UE sends a response to the communication network element. This step is optional, and in the embodiment of the present invention, the UE may not send a response to the communication network element.

[0205] The key distribution method based on the operator KMS (deployed inside the communication network element) provided in the embodiment of the present invention sends an indicator to the communication network element through the UE, and the communication network element can learn that the UE's authentication process needs to include identity-based key distribution. When the communication network element authenticates the UE, the private key can be distributed to the UE. Moreover, since the key distribution method based on the operator KMS deploys the KMS in the operator's communication network element, after the UE is authenticated, the operator does not need to perform further verification, and the private key can be distributed to the UE, saving communication overhead.

[0206] Figure 3 1 is a flow chart of a key distribution method based on an operator KMS provided by an embodiment of the present invention. Figure 3 In the key distribution method based on the operator KMS shown, the KMS is deployed in the HSS, the HSS generates the user private key (SK_ID1), and distributes the user private key to the UE after the UE passes the authentication.

[0207] Reference Figure 3 The key distribution method based on the operator KMS provided in the embodiment of the present invention may include:

[0208] 301. The UE initiates a request to the communication network element, and the request may carry IMSI, user identification (ID1) and indicator. Optionally, the request may only carry IMSI and indicator. In the embodiment of the present invention, the request may be specifically a user identification request (User Identity Request), and of course, it may also be various customized requests. The embodiment of the present invention does not limit the specific request name, and only requires that the request carry IMSI, user identification ID1 and indicator.

[0209] For the description of the user identification and the indicator, please refer to the corresponding content under step 201.

[0210] 302. The communication network element receives the request sent by the UE, and sends the IMSI, the indicator and the user identity from the UE to the HSS through a message. After the communication network element obtains the request from the UE, it can know that key distribution is required later according to the indicator.

[0211] In this step, the message sent by the communication network element to the HSS may only include the IMSI and the user identity. In this case, the HSS may determine whether identity-based key distribution is required based on the UE information stored in the HSS.

[0212] 303. HSS receives the IMSI and the indicator, and performs the following operations: Calculate an authentication vector (AuthenticationVector, AV), where AV = (RAND, AUTN, XRES, K asme ), KMS uses an identity-based algorithm to generate the user's private key (SK_ID1).

[0213] Among them, RAND is the authentication random number, XRES is the response value, AUTN is the authentication value, K ASME The shared key after authentication.

[0214] The identifiers used by KMS when calculating SK_ID1 may be the following: 1) user identifier (ID1); 2) operator identifier||user identifier, (ID||ID1), where the operator identifier may be a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID), a local operator network identifier, etc.; 3) operator identifier||user identifier||time (ID||ID1||time), or user identifier||time (ID1||time).

[0215] Optionally, after receiving the indicator, the HSS may set the Xth bit of the AMF parameter in the AUTN to 1 during the process of generating the AV, where 1≤X≤7. In this way, the communication network element can subsequently use this parameter to determine whether the authentication process for the UE includes identity-based key distribution. Of course, in this step, the HSS may not set the AMF parameter, that is, it may not set the bit in the AMF parameter, but instead send an indicator to the communication network element. In this way, the communication network element can subsequently still determine whether the authentication process for the UE includes identity-based key distribution by determining whether the received message contains an indicator.

[0216] If there is no indicator in the message received by the HSS, it indicates that the authentication process for the UE does not include identity-based key distribution. In this case, the HSS performs authentication in a traditional AKA manner.

[0217] It can be seen from the above steps 301 to 303 that the communication network element can send an indicator to the HSS, and the HSS can send an indicator to the communication network element when not performing a set operation. After performing a set operation, the HSS may or may not send an indicator to the communication network element.

[0218] 304. After generating the AV and the user private key (SK_ID1), the HSS sends the AV and the user private key (SK_ID1) to the communication network element through a message. Optionally, the HSS may also send the GPK to the communication network element.

[0219] 305. After receiving the AV and user private key (SK_ID1) from the HSS, the communication network element sends RAND and AUTN to the UE.

[0220] 306. After receiving RAND and AUTN, the UE verifies AUTN and calculates RES as a response to the communication network element after the verification is correct.

[0221] 307. The UE sends a RES to the communication network element via a message.

[0222] 308. After receiving RES, the communication network element verifies whether RES is the same as XRES in AV. If they are the same, the verification is successful; if they are different, the authentication failure is returned.

[0223] 309. After successful verification, the communication network element sends SK_ID1 to the UE via a message. As an optional method, in this step, the communication network element may also send SK_ID1 and GPK to the UE, where GPK is a global public key.

[0224] It should be noted here that, in the case where the request sent by the UE to the communication network element only carries the IMSI and the indicator and the IMSI is not used as the identity of the individual user, after the communication network element successfully verifies, the UE can send the user identity to the communication network element. In this way, after receiving the user identity, the communication network element can generate a user private key (SK_ID1) based on the user identity and send SK_ID1 to the UE.

[0225] 310. The UE sends a response to the communication network element. This step is optional, and in the embodiment of the present invention, the UE may not send a response to the communication network element.

[0226] The key distribution method based on the operator KMS provided in the embodiment of the present invention sends an indicator to the communication network element through the UE, and the communication network element can learn that the UE's authentication process needs to include identity-based key distribution. When the communication network element authenticates the UE, the private key can be distributed to the UE. Moreover, since the key distribution method based on the operator KMS deploys the KMS in the operator's HSS, after the UE is authenticated, the operator does not need to perform further verification, and the private key can be distributed to the UE, saving communication overhead.

[0227] Figure 4 1 is a flow chart of a key distribution method based on an operator KMS provided by an embodiment of the present invention. Figure 4 In the key distribution method based on the operator KMS shown in the figure, the KMS is deployed independently of the communication network element, but has an interface with the communication network element. The KMS generates the user private key (SK_ID1), and the communication network element distributes the user private key to the UE after the UE passes the authentication. Figure 4 In the illustrated embodiment, after AKA authentication is successful, the communication network element will initiate a request to the KMS to obtain the user's private key.

[0228] Reference Figure 4 The key distribution method based on the operator KMS provided in the embodiment of the present invention may include:

[0229] 401. UE1 initiates a request to the communication network element, and the request may carry IMSI, user identification (ID1) and indicator. Optionally, the request may only carry IMSI and indicator. In the embodiment of the present invention, the request may be specifically a user identification request (User Identity Request), and of course, it may also be various customized requests. The embodiment of the present invention does not limit the specific request name, and only requires that the request carry IMSI, user identification (ID1) and indicator.

[0230] For a description of the user identification and indicator, please refer to the content below step 201.

[0231] 402. The communication network element receives the request sent by the UE and sends the IMSI from the UE to the HSS through a message. Optionally, the communication network element may also send the indicator to the HSS. After the communication network element obtains the request from the UE, it can know that key distribution is required later according to the indicator.

[0232] 403. HSS receives the IMSI and performs the following operations: Calculate the authentication vector (AV), where AV = (RAND, AUTN, XRES, K asme ). Among them, RAND is the authentication random number, XRES is the response value, AUTH is the authentication value, K ASME The shared key after authentication.

[0233] If the communication network element sends the indicator to the HSS in step 402, the HSS can be informed of the need for key distribution based on the indicator. At the same time, optionally, in the process of generating AV, the HSS can set the Xth bit of the AMF parameter in AUTN to 1, where 1≤X≤7. In this way, the communication network element can subsequently use this parameter to determine whether the authentication process for the UE includes identity-based key distribution. Of course, in this step, the HSS may not set the AMF parameter, that is, not set the bit in the AMF parameter. In this way, the communication network element can subsequently determine in step 404 whether the received message contains an indicator to determine whether the authentication process for the UE includes identity-based key distribution.

[0234] If the indicator is not present in the message received by the HSS from the communication network element, the HSS does not set the bit in the AMF.

[0235] 404. After generating the AV, the HSS sends the AV to the communication network element through a message. Optionally, the HSS may also send an indicator to the communication network element.

[0236] It can be seen from the above steps 401 to 404 that the communication network element may send an indicator to the HSS or not; after receiving the indicator from the communication network element, the HSS may set the bit in the AMF parameter, and may choose to send an indicator to the communication network element or not.

[0237] 405. After receiving the AV from the HSS, the communication network element sends RAND and AUTN to the UE.

[0238] 406. The UE verifies AUTN, and after the verification is correct, calculates RES as a response to the communication network element.

[0239] 407. The UE sends a RES to the communication network element via a message.

[0240] 408. After receiving RES, the communication network element verifies whether RES is the same as XRES in AV. If they are the same, the verification is successful; if they are different, the authentication failure is returned.

[0241] 409. When the communication network element succeeds in verification, the communication network element sends a user identifier (ID1) to the KMS, wherein the user identifier may come from the user identifier in step 401, or may come from the user identifier sent by the UE immediately after learning that the communication network element verification succeeds.

[0242] 410. KMS uses an identity-based algorithm to generate a user private key (SK_ID1).

[0243] The identifiers used by KMS when calculating SK_ID1 may be the following: 1) user identifier (ID1); 2) operator identifier||user identifier, (ID||ID1), where the operator identifier may be a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID), a local operator network identifier, etc.; 3) operator identifier||user identifier||time (ID||ID1||time), or user identifier||time (ID1||time).

[0244] 411. KMS sends the user private key (SK_ID1) to the communication network element. As an optional method, in this step, KMS can also send SK_ID1 and GPK to the communication network element, where GPK is a global public key.

[0245] 412. After receiving the user private key (SK_ID1), the communication network element sends the user private key (SK_ID1) to the UE. Of course, when the communication network element receives the user private key (SK_ID1) and GPK, it sends the user private key (SK_ID1) and GPK to the UE.

[0246] 413. After receiving the user private key (SK_ID1), or the user private key (SK_ID1) and the GPK, the UE sends a response to the communication network element. This step is optional, and in the embodiment of the present invention, the UE may not send a response to the communication network element.

[0247] It should be noted here that in the embodiment of the present invention, optionally, in step 401, the request sent by the user to the communication network element may only carry the IMSI and an indicator. Accordingly, after step 407, that is, after the AKA authentication is successful, the UE may send a user identity to the communication network element to request an identity-based user private key.

[0248] The key distribution method based on the operator KMS provided in the embodiment of the present invention sends an indicator to the communication network element through the UE, and the communication network element can learn that the UE's authentication process needs to include identity-based key distribution. When the communication network element authenticates the UE, it can request the user private key from the KMS, and distribute it to the UE after obtaining the user private key generated by the KMS. Moreover, since this key distribution method based on the operator KMS deploys the KMS in the operator network, the UE does not need to be further verified by the operator after the authentication is passed, and the user private key can be distributed directly to the UE by the communication network element, saving communication overhead.

[0249] Figure 5 1 is a flow chart of a key distribution method based on an operator KMS provided by an embodiment of the present invention. Figure 5 In the key distribution method based on the operator KMS shown, the KMS is deployed independently of the HSS, but has an interface with the HSS. The KMS generates the user private key, and the communication network element distributes the user private key to the UE.

[0250] Reference Figure 5 The key distribution method based on the operator KMS provided in the embodiment of the present invention may include:

[0251] 501. The UE initiates a request to the communication network element, and the request may carry IMSI, user identification (ID1) and indicator. In the embodiment of the present invention, the request may be a user identification request (User Identity Request), and of course, it may also be various customized requests. The embodiment of the present invention does not limit the specific request name, and only requires that the request carry IMSI, user identification ID1 and indicator.

[0252] For the description of the user identification and the indicator, please refer to the corresponding content under step 201.

[0253] 502. The communication network element receives the request sent by the UE, and sends the IMSI, the user identity and the indicator from the UE to the HSS through a message.

[0254] 503. The HSS receives the IMSI, the user identity and the indicator, and performs the following operations: Calculate an authentication vector (AV), where AV = (RAND, AUTN, XRES, K asme ), where RAND is the authentication random number, XRES is the response value, AUTH is the authentication value, and K ASME The shared key after authentication.

[0255] Optionally, after receiving the indicator, the HSS may set the Xth bit of the AMF parameter in the AUTN to 1 during the process of generating the AV, where 1≤X≤7. In this way, the communication network element can subsequently use this parameter to determine whether the authentication process for the UE includes identity-based key distribution. Of course, in this step, the HSS may not set the AMF parameter, that is, it may not set the bit in the AMF parameter, but instead send an indicator to the communication network element. In this way, the communication network element can subsequently still determine whether the authentication process for the UE includes identity-based key distribution by determining whether the received message contains an indicator.

[0256] If there is no indicator in the message received by the HSS, it indicates that the authentication process for the UE does not include identity-based key distribution. In this case, the HSS performs authentication in a traditional AKA manner.

[0257] 504. HSS sends the user identification (ID1) to KMS via a message.

[0258] 505. After receiving the user identifier (ID1) from the HSS, the KMS generates the user private key (SK_ID1) using an identity-based algorithm. The identifiers used by the KMS to calculate SK_ID1 may be the following: 1) user identifier (ID1); 2) operator identifier||user identifier, (ID||ID1), where the operator identifier may be a public land mobile network identifier (PLMNID), a serving network identifier (serving network ID), a local operator network identifier, etc.; 3) operator identifier||user identifier||time (ID||ID1||time), or user identifier||time (ID1||time).

[0259] 506. KMS sends the user private key (SK_ID1) to HSS. Optionally, KMS may send the user private key (SK_ID1) and GPK.

[0260] 507. After obtaining the AV and the user private key (SK_ID1), the HSS sends the AV and the user private key (SK_ID1) to the communication network element through a message. Optionally, the GPK may also be sent to the communication network element.

[0261] 508. After receiving the AV and user private key (SK_ID1) from the HSS, the communication network element sends RAND and AUTN to the UE.

[0262] 509. After receiving RAND and AUTN, the UE verifies AUTN and calculates RES as a response to the communication network element after the verification is correct.

[0263] 510. The UE sends a RES to the communication network element via a message.

[0264] 511. After receiving RES, the communication network element verifies whether RES is the same as XRES in AV. If they are the same, the verification is successful; if they are different, the authentication failure is returned.

[0265] 512. After successful verification, the communication network element sends SK_ID1 to the UE via a message. As an optional method, in this step, the communication network element may send SK_ID1 and GPK to the UE, where GPK is a global public key.

[0266] 513. The UE sends a response to the communication network element. This step is optional, and in the embodiment of the present invention, the UE may not send a response to the communication network element.

[0267] It is pointed out here that in Figure 5 In the illustrated embodiment, the communication network element may send an indicator to the HSS, and the HSS may send an indicator to the communication network element when not performing a set operation, and the HSS may or may not send an indicator to the communication network element after performing a set operation.

[0268] The key distribution method based on the operator KMS provided in the embodiment of the present invention sends an indicator to the communication network element through the UE, and the communication network element can learn that the authentication process of the UE needs to include identity-based key distribution; the communication network element requests the user private key from the KMS through the HSS, and after obtaining the user private key generated by the KMS, it distributes it to the UE when the communication network element authenticates the UE. Moreover, since this key distribution method based on the operator KMS deploys the KMS in the operator network, the UE does not need to be further verified by the operator after the authentication is passed, and the user private key can be directly distributed to the UE by the communication network element, saving communication overhead.

[0269] against Figure 2-Figure 5 The process described may also include the following process. After the UE establishes a secure link with the core network using traditional AKA or other methods, it sends a key request to the KMS, which contains a user ID. After the KMS obtains this ID, it generates a key SK_ID1 using the above method and sends SK_ID1 to the UE.

[0270] The following describes a key distribution method based on a third-party KMS provided in an embodiment of the present invention. Figure 6 1 is a flow chart of a key distribution method based on a third-party KMS provided by an embodiment of the present invention. Figure 6In the key distribution method based on the third-party KMS shown in the figure, the KMS is deployed as an independent network element. The KMS sends the message authentication code (MAC) from the UE to the operator network element for verification, and distributes the user private key to the UE after the operator network element passes the verification.

[0271] Reference Figure 6 The key distribution method based on the third-party KMS provided in the embodiment of the present invention may include:

[0272] 601. UE sends IMSI to a communication network element.

[0273] 602. The communication network element sends the IMSI to the HSS.

[0274] 603. HSS generates an authentication vector (AV), where AV = (RAND, AUTN, XRES, K asme ). RAND is the authentication random number, XRES is the response value, AUTH is the authentication value, K ASME The shared key after authentication.

[0275] 604. After generating the AV, the HSS sends the AV to the communication network element.

[0276] 605. After receiving the AV from the HSS, the communication network element sends RAND and AUTN to the UE.

[0277] 606. The UE verifies AUTN, and after the verification is correct, calculates RES as a response to the communication network element.

[0278] 607. The UE sends a RES to the communication network element via a message.

[0279] 608. After receiving RES, the communication network element verifies whether RES is the same as XRES in AV. If they are the same, the verification is successful; if they are different, the authentication failure is returned.

[0280] 609, UE based on AKA authentication shared key (including but not limited to K asme , CK, IK) to calculate the message authentication code MAC1, and based on the shared key (including but not limited to K asme , CK, IK) to calculate K, where K is the protection key. The calculation formula is as follows: MAC1 = MAC ((K asme , CK, or at least one of ID), (at least one of user identification and parameter 1)), K=KDF((K asme , CK, or at least one of ID), (user ID and at least one of parameter 1), third-party KMS ID);

[0281] For a description of the user identification, refer to the corresponding content under step 201.

[0282] Parameter 1 can be a random parameter, such as nonce, sequence number (SQN), connection ID, fresh parameter, random number, etc.

[0283] 610. UE1 sends the user identification, MAC1 and parameter 1 to the third-party KMS.

[0284] 611. The third-party KMS sends the user ID, MAC1 and parameter 1 to the Key Distribution Center (KDC).

[0285] 612. KDC sends the user ID, MAC1 and parameter 1 to the HSS or communication network element.

[0286] 613. The HSS or the communication network element verifies MAC1. After successful verification, it can generate a random key or a shared key (including but not limited to K asme , CK, IK) to derive K, for example, K = KDF ((K asme , CK, or IK), (third-party KMS identifier, user identifier and at least one of parameter 1)).

[0287] If the HSS or the communication network element uses CK and / or IK to verify MAC1, the HSS or the communication network element is required to receive CK and / or IK during the AKA process.

[0288] 614. HSS / communication network element sends K to KDC.

[0289] 615. KDC sends K to the third-party KMS.

[0290] 616. The third-party KMS uses an identity-based algorithm to generate the user's private key (SK_ID1) and uses K to encrypt SK_ID1 and GPK.

[0291] The identifiers used by KMS when calculating SK_ID1 may be the following: 1) user identifier (ID1); 2) operator identifier||user identifier, (ID||ID1), where the operator identifier may be a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID), a local operator network identifier, etc.; 3) operator identifier||user identifier||time (ID||ID1||time), or user identifier||time (ID1||time).

[0292] 617. The third-party KMS sends the encrypted SK_ID1 and GPK to the UE.

[0293] 618. UE uses K to perform decryption and obtains SK_ID1 and GPK.

[0294] It should be pointed out here that Figure 6 In the embodiment shown, there may be no KDC. In this way, the third-party KMS may directly send the user identity, MAC1 and parameter 1 to the HSS / communication network element. Meanwhile, optionally, the UE may not calculate K in step 609, but calculate K after step 617.

[0295] In the key distribution method based on a third-party KMS provided in an embodiment of the present invention, KMS is deployed as an independent network element. KMS sends the MAC from the UE to the operator network element for verification, and generates a user private key after the operator network element passes the verification and distributes it to the UE. This key distribution method based on a third-party KMS can improve the security of communication because the UE needs to be further verified by the operator after passing the AKA authentication.

[0296] Figure 7 1 is a flow chart of a key distribution method based on a third-party KMS provided by an embodiment of the present invention. Figure 7 In the key distribution method based on a third-party KMS shown in the figure, the KMS is deployed as an independent network element. The KMS sends the token from the UE to the operator network element for verification, and distributes the user private key after the operator network element passes the verification. Figure 7 In the illustrated embodiment, the HSS shares a key K1 with a third-party KMS.

[0297] Reference Figure 7 The key distribution method based on the third-party KMS provided in the embodiment of the present invention may include:

[0298] 701. The UE initiates a request to the communication network element, and the request may carry an IMSI and an indicator. Optionally, the request may also carry a user identity (ID1). In the embodiment of the present invention, the request may be specifically a user identity request (User Identity Request), and of course, it may also be various customized requests. The embodiment of the present invention does not limit the specific request name, and only requires that the request carry the corresponding content.

[0299] For the description of the user identification and the indicator, please refer to the corresponding content under step 201.

[0300] 702. The communication network element receives the request sent by the UE, and sends the IMSI and the indicator from the UE to the HSS through a message. Optionally, the communication network element may also send a user identity to the HSS.

[0301] 703. The HSS receives the IMSI and the indicator, and performs the following operations: calculating an authentication vector (AV) and calculating a token and K2. Optionally, the HSS may also receive a user identity.

[0302] The communication network element and HSS can be informed of the need for subsequent key distribution based on the indicator.

[0303] K2 can be randomly generated or use the user root key, or K asme , or CK, or IK derived, AV = (RAND, AUTN, XRES, K asme ), token = Enc(K1, MAC(K1, (ID1, third-party KMS identifier, at least one of the network IDs), K2), that is, the token is the encryption of MAC(K1, (ID1, third-party KMS identifier, at least one of the network identifiers) and K2 using key K1. Among them, MAC(K1, (ID1, third-party KMS ID, at least one of the network IDs)), that is, MAC is the authentication protection of ID1, third-party KMS identifier, and network identifier using key K1, which can be used by third-party KMS to verify the correctness of the message. K1 is the shared key between HSS and third-party KMS. K2 is used to encrypt the communication between UE and third-party KMS to ensure security. Among them, RAND is the authentication random number, XRES is the response value, AUTN is the authentication value, K ASME The shared key after authentication.

[0304] Optionally, after receiving the indicator, the HSS may set the Xth bit of the AMF parameter in the AUTN to 1 during the process of generating the AV, where 1≤X≤7. In this way, the communication network element can subsequently use this parameter to determine whether the authentication process for the UE includes identity-based key distribution. Of course, in this step, the HSS may not set the AMF parameter, that is, it may not set the bit in the AMF parameter, but instead send an indicator to the communication network element. In this way, the communication network element can subsequently still determine whether the authentication process for the UE includes identity-based key distribution by determining whether the received message contains an indicator.

[0305] If there is no indicator in the message received by the HSS, it indicates that the authentication process for the UE does not include identity-based key distribution. In this case, the HSS performs authentication in a traditional AKA manner.

[0306] 704. After generating AV, token and K2, HSS sends AV, token and K2 to the communication network element through a message.

[0307] It can be seen from the above steps 701 to 703 that the communication network element can send an indicator to the HSS, and the HSS can send an indicator to the communication network element when not performing a set operation. After performing a set operation, the HSS may or may not send an indicator to the communication network element.

[0308] 705. After receiving the AV, token and K2 from the HSS, the communication network element sends RAND and AUTN to the UE.

[0309] 706. After receiving RAND and AUTN, the UE verifies AUTN and calculates RES as a response to the communication network element after the verification is correct.

[0310] 707. The UE sends a RES to the communication network element via a message.

[0311] 708. After receiving RES, the communication network element verifies whether RES is the same as XRES in AV. If they are the same, the verification is successful; if they are different, the authentication failure is returned.

[0312] 709. After successful verification, the communication network element sends a token and K2 to the UE via a message.

[0313] 710. The UE sends a response to the communication network element. This step is optional, and in the embodiment of the present invention, the UE may not send a response to the communication network element.

[0314] 711. The UE initiates a request to send a user ID, an operator network ID, and a token to a third-party KMS.

[0315] 712. The third-party KMS uses the operator network ID to retrieve the shared key K1, and uses the shared key K1 to decrypt the token to obtain MAC (K1, ID1, third-party KMS ID, network ID) and K2. Then, K1 is used to verify the correctness of MAC.

[0316] 713. When the MAC verification is correct, the third-party KMS uses an identity-based algorithm to generate the user's private key (SK_ID1), and uses K2 to encrypt SK_ID1 and GPK.

[0317] The identifiers used by KMS when calculating SK_ID1 may be the following: 1) user identifier (ID1); 2) operator identifier||user identifier, (ID||ID1), where the operator identifier may be a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID), a local operator network identifier, etc.; 3) operator ID||ID1||time, or in the form of ID1||time.

[0318] 714. The third-party KMS sends the encrypted SK_ID1 and GPK to the UE.

[0319] 715. UE uses K2 to perform decryption and obtain SK_ID1 and GPK.

[0320] In the key distribution method based on a third-party KMS provided in an embodiment of the present invention, KMS is deployed as an independent network element. After AKA authentication is successful, UE sends a MAC from UE to the third-party KMS, and KMS sends the MAC from UE to the operator network element for verification. After the operator network element verification is passed, the user private key is generated and distributed to the UE. This key distribution method based on a third-party KMS can improve the security of communication because the UE needs to be further verified by the operator after AKA authentication is passed.

[0321] For all the above embodiments, it is also possible that the message sent by the UE does not carry an indicator. The HSS can determine whether the UE needs identity-based key distribution from its own database through the IMSI or user identifier. If it is determined that identity-based distribution is not required, the HSS performs the traditional AKA operation. If it is determined that identity-based key distribution is required, the same actions as all the previous embodiments are performed again, including but not limited to: the HSS performs a setting operation on the AMF and only sends the AV to the communication network element, so that the communication network element can determine whether identity-based key distribution needs to be performed through the setting operation; or the HSS sends indicator 2 to the communication network element to notify the communication network element that identity-based key distribution needs to be performed.

[0322] The authentication method provided by the embodiment of the present invention may include a three-round authentication method and a two-round authentication method. Among them, three rounds and two rounds indicate the number of times the message is transmitted between the communication devices. The three-round authentication method may include the following methods: mutual authentication based on MAC, mutual authentication based on encryption, and mutual authentication based on signature. The two-round authentication method may include the following methods: mutual authentication based on MAC and mutual authentication based on signature.

[0323] The following first describes an authentication method based on a three-round authentication process provided by an embodiment of the present invention.

[0324] In the following embodiments, the session identifier is used to identify the current session, which can be randomly selected or derived from the previous session identifier, for example, by adding 1 to the previous session identifier. Nonce1 can be randomly selected to reflect freshness. The service identifier is the identifier of the service between UE1 and UE2.

[0325] In each of the following embodiments, the first user identifier and the second user identifier may be applicable to the corresponding description under step 201.

[0326] Fig. 8A : is a flow chart of a three-round authentication method provided by an embodiment of the present invention. Fig. 8A The three-round authentication method provided by the embodiment of the present invention may include:

[0327] 800. The first user equipment sends a first random parameter to the second user equipment;

[0328] 900. The second user equipment obtains a first user identifier, a second user identifier, and a second random parameter, generates a second authentication feature according to the first user identifier, the second user identifier, the first random parameter, and the second random parameter, and sends the second authentication feature to the first user equipment;

[0329] 1000. The first user equipment verifies the correctness of the second authentication feature, generates a first authentication feature, and sends the first authentication feature to the second user equipment;

[0330] 1100. The second user equipment verifies the correctness of the first authentication feature.

[0331] The authentication method provided in the embodiment of the present invention performs authentication between two terminal devices by means of MAC, encrypted text or digital signature. During the authentication process, no intervention of HSS is required, and the business demand for authentication flexibility can be met.

[0332] Refer to the following Figure 8B to Figure 12 To further explain the authentication method provided by the embodiment of the present invention. Figure 11-12 is a schematic diagram of an authentication method based on a two-round authentication process.

[0333] Figure 8B 1 is a flow chart of a three-round authentication method for completing mutual authentication based on MAC provided by an embodiment of the present invention. Figure 8B In the illustrated embodiment, UE1 may have a first user identifier (ID1), a first user key (SK_ID1) and a global public key (GPK), and UE2 may have a second user identifier (ID2), a second user key (SK_ID2) and a global public key (GPK).

[0334] Reference Figure 8B The authentication method based on the three-round authentication process provided by the embodiment of the present invention may include:

[0335] 801. UE1 sends a session identifier (session ID), a first random parameter (Nonce1), a first user identifier (ID1), and a service identifier (service ID) to UE2, and may also include a second user identifier (ID2).

[0336] 802. UE2 calculates the communication shared key K_com based on GPK, ID2, SK_ID2 and ID1. GPK and SK_ID2 can be pre-acquired in the key distribution stage.

[0337] There are two possibilities for the calculation formula:

[0338] 1) K_com = e(xH(ID1), H(ID2)), or K_com = H(e(xH(ID1), H(ID2)).

[0339] Specifically, if user 1 and user 2 want to communicate securely, their respective parameters are as follows: user 1's identity is ID1, and its identity-based private key is SK_ID1=xH(ID1); user 2's identity is ID2, and its identity-based private key is SK_ID2=xH(ID2). Without the need for message interaction, user 1 and user 2 can calculate the unique shared key K_com=e(xH(ID1), H(ID2)).

[0340] 2) K_com = H(e(xH(ID1), H(ID2))^{H(parameter 1)}), where the key K is bound to parameter 1. Parameter 1 may be at least one of a service ID, a slice ID, a link ID, a connection ID, a session ID, a serving network ID, a public land mobile network ID (PLMN ID), ID 1, and ID2; wherein the H() algorithm may be a Hash() algorithm or a HMAC() algorithm.

[0341] 803. UE2 randomly selects a second random parameter (nonce2), derives a session key K_session using the communication shared key K_com, and calculates a second message authentication code (MAC2) based on K_com or K_session.

[0342] Among them, K_session=KDF(K_com, (session identifier, nonce1, nonce2, service identifier, first user identifier, at least one of the second user identifier)), MAC2=MAC(K_com or K_session, (at least one of nonce1, nonce2), (session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, at least one of PLMN ID)).

[0343] 804. UE2 sends the session identifier, nonce1, nonce2, and MAC2 to UE1. Optionally, UE2 may also send the service identifier and ID2 to UE1.

[0344] 805. UE1 generates a shared key K_com based on GPK, ID1, SK_ID1 and ID2 using the same parameter input as UE2, and derives K_session using the same parameter input as UE2. UE1 verifies the correctness of MAC2 using K_com or K_session. If the verification is successful, MAC1 is calculated. If the verification is unsuccessful, MAC1 is not calculated. Successful verification indicates that the message has not been tampered with.

[0345] Among them, MAC1=MAC(K_com or K_session, (at least one of nonce1, nonce2), (at least one of session identifier, ID1, ID2, service identifier, slice ID, link ID, connection identifier, service network identifier, PLMN ID)).

[0346] The key used to verify the correctness of MAC2 is the same as the key used to calculate MAC2 in step 803.

[0347] 806. UE1 sends MAC1 to UE2.

[0348] 807. UE2 uses K_com or K_session to verify the correctness of MAC1.

[0349] In the embodiment shown in Fig. 8, the calculation method of MAC (including MAC1 and MAC2) can be based on K_com or K_session. However, no matter which one is used, the same key must be used to calculate MAC and verify MAC.

[0350] In the authentication method based on the three-round authentication process provided by the embodiment of the present invention, UE1 uses K_com or K_session to verify MAC2 from UE2, and then UE2 uses K_com or K_session to verify MAC from UE1. In this way, mutual authentication can be completed based on MAC, meeting the business demand for authentication flexibility.

[0351] Fig. 9 1 is a flowchart of a three-round authentication method for completing mutual authentication based on encryption provided by an embodiment of the present invention. Fig. 9 In the illustrated embodiment, UE1 may have a first user identifier (ID1), a first user key (SK_ID1), and a global public key (GPK), and UE2 may have a second user identifier (ID2), a second user key (SK_ID2), and a global public key (GPK). Fig. 9 In the illustrated embodiment, UE1 and UE2 prove their authenticity to each other by calculating their own encrypted texts.

[0352] Reference Fig. 9 The authentication method based on the three-round authentication process provided by the embodiment of the present invention may include:

[0353] 901. UE1 sends a session identifier (session ID), a first user identifier (ID1), a service identifier (service ID), En (ID2, Nonce1), and possibly a second user identifier (ID2) to UE2.

[0354] There are two possibilities for the encryption method of En(ID2, Nonce1): encryption based on the shared key K, in which case UE1 needs to generate the shared key K_com first; and identity-based encryption, using ID2 to encrypt nonce1.

[0355] 902. UE2 calculates the shared key K_com based on GPK, ID2, SK_ID2 and ID1. The calculation formula has the following two possibilities:

[0356] 1) K_com = e(xH(ID1), H(ID2)) or K_com = H(e(xH(ID1), H(ID2)).

[0357] Specifically, if user 1 and user 2 want to communicate securely, their respective parameters are as follows: user 1's identity is ID1, and its identity-based private key is SK_ID1=xH(ID1); user 2's identity is ID2, and its identity-based private key is SK_ID2=xH(ID2). Without the need for message interaction, user 1 and user 2 can calculate the unique shared key K_com=e(xH(ID1), H(ID2)).

[0358] 2) K_com = H(e(xH(ID1), H(ID2))^{H(parameter 1)}), where the key K is bound to parameter 1; parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; wherein the H() algorithm may be a Hash() algorithm or a HMAC() algorithm.

[0359] 903. UE2 obtains nonce1 and randomly selects nonce2, and calculates a second encrypted text (ciphertext2) based on nonce1 and nonce2, where ciphertext2 = En(ID1, ID2, nonce1, nonce2).

[0360] Among them, if En(ID2, Nonce1) is encrypted based on the shared key K_com, UE2 needs to generate the shared key K_com first, and then decrypt nonce1. If En(ID2, Nonce1) is encrypted based on identity ID2, UE2 uses SK_ID2 to decrypt nonce1.

[0361] Optionally, in step 903, UE2 may also use the shared key K_com to derive a session key K_session=KDF(K_com, (at least one of the session identifier, nonce1, nonce2, service identifier, ID1, ID2)).

[0362] Possibilities of encrypting to obtain the second encrypted text (ciphertext2) include: encrypting ID1, ID2, nonce1, nonce2 based on the shared key K_com to obtain the second encrypted text (ciphertext2); identity-based encryption, using ID1 to encrypt ID1, ID2, nonce1, nonce2 to obtain the second encrypted text (ciphertext2); encrypting ID1, ID2, nonce1, nonce2 based on the session key K_session to obtain the second encrypted text (ciphertext2).

[0363] 904. UE2 sends a first user identifier (ID1), a second user identifier (ID2), and a second encrypted text (ciphertext2) to UE1.

[0364] 905. After receiving ID1, ID2, and the second encrypted text (ciphertext2), UE1 decrypts the second encrypted text (ciphertext2) to obtain nonce 1 and the second random parameter, and verifies nonce 1. When the verification is successful, UE1 generates the first encrypted text (ciphertext1), where ciphertext1 = En (ID1, ID2, nonce2).

[0365] Among them, when decrypting ciphertext2, if ciphertext2 is encrypted based on the shared key K, UE1 needs to generate the shared key K_com first, and then decrypt nonce1 and nonce2. If ciphertext2 is encrypted based on identity, UE1 uses SK_ID1 to decrypt nonce1 and nonce2. If ciphertext2 is encrypted based on the shared key K_session, UE1 needs to generate the shared key K_com first, then generate K_session, and then decrypt nonce1 and nonce2.

[0366] After decrypting nonce1 and nonce2, UE1 determines whether nonce1 is the same as nonce1 encrypted in step 901. If they are the same, the verification is successful and the first encrypted text (ciphertext1) is generated. If they are not the same, the verification fails and the first encrypted text may not be generated.

[0367] Optionally, UE1 may generate a shared key K_com based on GPK, ID1, SK_ID1 and ID2 using the same parameter input as UE2, and then derive K_session using the same parameter input as UE2;

[0368] The possibilities of encrypting ciphertext1 include: encrypting ID1, ID2, nonce2 based on the shared key K_com to obtain the first encrypted text (ciphertext1); identity-based encryption, using ID2 to encrypt ID1, ID2, nonce2 to obtain the first encrypted text (ciphertext1); encrypting ID1, ID2, nonce2 based on the session key K_session to obtain the first encrypted text (ciphertext1).

[0369] 906. UE1 sends a first encrypted text (ciphertext1) to UE2.

[0370] 907. UE2 uses SK_ID2 or K_com or K_session to decrypt the first encrypted text, decrypts nonce2, and determines whether the decrypted nonce2 is the same as the nonce2 encrypted in step 903. If they are the same, UE1 is authenticated successfully.

[0371] It should be pointed out that in Fig. 9 In the illustrated embodiment, nonce 1 in step 901 may not need to be encrypted and may be directly sent from UE1 to UE2. Alternatively, in step 906, nonce 2 may also be directly sent from UE1 to UE2 without being encrypted.

[0372] In the authentication method based on the three-round authentication process provided by the embodiment of the present invention, UE1 uses the shared key K_com or SK_ID1 to verify the second encrypted text (ciphertext2) from UE2, and then UE2 uses SK_ID2 or the shared key K_com to verify the first encrypted text (ciphertext1) from UE1. In this way, mutual authentication can be completed based on encryption, meeting the business requirements for authentication flexibility.

[0373] Fig.10 1 is a flowchart of a three-round authentication method for completing mutual authentication based on signatures provided by an embodiment of the present invention. Fig.10 In the illustrated embodiment, UE1 may have a first user identifier (ID1), a first user key (SK_ID1), and a global public key (GPK), and UE2 may have a first user identifier (ID2), a second user key (SK_ID2), and a global public key (GPK). Fig.10 In the illustrated embodiment, UE1 and UE2 prove their authenticity to each other through their respective digital signatures.

[0374] The difference between this embodiment and the embodiment shown in FIG. 8 is that this embodiment uses a digital signature to replace the MAC in the embodiment shown in FIG. 8 .

[0375] Reference Fig.10 The authentication method based on the three-round authentication process provided by the embodiment of the present invention may include:

[0376] 1001. UE1 sends a session identifier (session ID), Nonce1, ID1, a service identifier (serviceID), and possibly a second user identifier (ID2) to UE2.

[0377] 1002. UE2 obtains nonce1 and randomly selects nonce2. UE2 can calculate K_com in the same manner as in the above embodiment, and derive K_session = KDF ((K_com, at least one of nonce1 and nonce2), (at least one of session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier)).

[0378] 1003. UE2 calculates a second digital signature (signature2) based on the second user key (SK_ID2), signature2 = Sign(SK_ID2, (at least one of nonce1, nonce2), (at least one of session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier)).

[0379] 1004. UE2 sends nonce1, nonce2 and a second digital signature (signature2) to UE1, which may also include at least one of ID1 and ID2.

[0380] 1005. UE1 verifies the correctness of the second digital signature (signature2) based on the second user identifier (ID2). When the verification is correct, UE calculates the first digital signature (signature1) based on the first user key (SK_ID1), Signature1 = Sign(SK_ID1, (at least one of nonce1, nonce2), (at least one of session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier)). If the verification is incorrect, the first digital signature may not be calculated.

[0381] At the same time, UE1 can calculate K_com and K_session in the same way.

[0382] 1006. UE1 sends a first digital signature (signature1) to UE2.

[0383] 1007. UE2 verifies the correctness of the first digital signature (signature1) based on the first user identifier (ID1). After the verification is successful, UE1 and UE2 share K_session. In addition, the communication session between UE1 and UE2 can be encrypted using K_session to ensure security.

[0384] In the authentication method based on the three-round authentication process provided by the embodiment of the present invention, UE1 verifies the correctness of the second digital signature (Signature2) based on ID2, and UE2 verifies the correctness of the first digital signature (Signature1) based on ID1. In this way, mutual authentication can be completed based on digital signatures, meeting the business requirements for authentication flexibility.

[0385] The following describes an authentication method based on a two-round authentication process provided by an embodiment of the present invention.

[0386] Fig.11 1 is a flow chart of a two-round authentication method for completing mutual authentication based on MAC provided by an embodiment of the present invention. Fig.11 In the illustrated embodiment, UE1 may have a first user identifier (ID1), a first user key (SK_ID1) and a global public key (GPK), and UE2 may have a second user identifier (ID2), a second user key (SK_ID2) and a global public key (GPK).

[0387] Fig.11 The authentication process of the embodiment shown is generally similar to that of the embodiment shown in FIG8 . The difference is that UE2 can verify the legitimacy of UE1 after receiving the first message from UE1. In the three rounds of authentication shown in FIG8 , UE2 verifies the legitimacy of UE1 only after receiving the second message from UE1.

[0388] Reference Fig.11 , the authentication method based on the two-round authentication process provided by the embodiment of the present invention may include:

[0389] 1101. UE1 generates a shared key K_com.

[0390] There are two possibilities for the calculation formula:

[0391] 1) K_com = e(xH(ID1), H(ID2)), or K_com = H(e(xH(ID1), H(ID2)).

[0392] Specifically, if user 1 and user 2 want to communicate securely, their respective parameters are as follows: user 1's identity is ID1, and its identity-based private key is SK_ID1=s H(ID1); user 2's identity is ID2, and its identity-based private key is SK_ID2=sH(ID2). Without the need for message interaction, user 1 and user 2 can calculate the unique shared key K=e(xH(ID1),H(ID2)).

[0393] 2) K_com = H(e(xH(ID1), H(ID2))^{H(parameter 1)}), where the key K is bound to parameter 1. Parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; wherein the H() algorithm may be a Hash() algorithm or a HMAC() algorithm.

[0394] 1102. UE1 randomly selects nonce1 and uses K_com to calculate MAC1.

[0395] Among them, MAC1=MAC(K_com, nonce1, (session identifier, ID1, ID2, service identifier, slice ID, link ID, connection identifier, session identifier, service network identifier, public land mobile network identifier, first user identifier and second user identifier)).

[0396] 1103. UE1 sends a session identifier, Nonce1, a first user identifier, a second user identifier and MAC1 to UE2.

[0397] 1104. UE2 generates K_com.

[0398] There are two possibilities for the calculation formula:

[0399] 1) K_com = e(xH(ID1), H(ID2)), or K_com = H(e(xH(ID1), H(ID2)).

[0400] Specifically, if user 1 and user 2 want to communicate securely, their respective parameters are as follows: user 1's identity is ID1, and its identity-based private key is SK_ID1=s H(ID1); user 2's identity is ID2, and its identity-based private key is SK_ID2=sH(ID2). Without the need for message interaction, user 1 and user 2 can calculate the unique shared key K=e(xH(ID1),H(ID2)).

[0401] 2) K_com = H(e(xH(ID1), H(ID2))^{H(parameter 1)}), where the key K is bound to parameter 1. Parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; wherein the H() algorithm may be a Hash() algorithm or a HMAC() algorithm.

[0402] 1105. UE2 verifies the correctness of MAC1, and calculates MAC2 based on the randomly selected nonce2 and K_com when the verification is correct.

[0403] Wherein MAC2=MAC(K_com, nonce1, nonce2, (session identifier, ID1, ID2, service identifier, slice ID, link ID, connection identifier, session identifier, service network identifier, public land mobile network identifier, first user identifier and second user identifier, at least one item)).

[0404] 1106. UE2 sends nonce1, nonce2, the first user identifier, the second user identifier, and MAC2 to UE1.

[0405] 1107. UE1 verifies the correctness of MAC2, and derives the session key K_session=KDF(K_com, (at least one of the session identifier, nonce1, nonce2, service identifier, ID1, ID2)).

[0406] 1108. UE2 derives the session key K_session=KDF(K_com, (session identifier, nonce1, nonce2, service identifier, at least one of ID1 and ID2)).

[0407] Optionally, the execution location of the action of step 1108 is adjustable and can be completed at any step after step 1104 .

[0408] Optionally, in step 1101 or 1102, UE1 can further calculate K_session, and the derivation of K_session does not include the nonce2 parameter; then UE1 can calculate MAC1 based on K_session. Correspondingly, UE2 calculates K_com and K_session, verifies the correctness of MAC1 using K_session, and after successful verification, calculates MAC2 based on K_session and sends MAC2 to UE1, so that UE1 verifies the authenticity of MAC2. Thus, mutual authentication of both parties is completed.

[0409] In the authentication method based on the two-round authentication process provided by the embodiment of the present invention, UE2 uses K_com or K_session to verify the MAC from UE1, and then UE1 uses K_com or K_session to verify the MAC2 from UE2. In this way, mutual authentication can be completed based on MAC, meeting the business demand for authentication flexibility.

[0410] Fig.12 1 is a flow chart of a two-round authentication method for completing mutual authentication based on signatures provided by an embodiment of the present invention. Fig.12 In the illustrated embodiment, UE1 may have a first user identifier (ID1), a first user key (SK_ID1) and a global public key (GPK), and UE2 may have a second user identifier (ID2), a second user key (SK_ID2) and a global public key (GPK).

[0411] Fig.12 The embodiment shown and Fig.11 The authentication process of the embodiment shown is generally similar. The difference is that this embodiment uses a digital signature to replace Fig.11 MAC in the illustrated embodiment.

[0412] Reference Fig.12 , the authentication method based on the two-round authentication process provided by the embodiment of the present invention may include:

[0413] 1201. UE1 generates K_com in the same manner as the above embodiment.

[0414] 1202. UE1 randomly selects nonce1 and uses SK_ID1 to calculate the first digital signature (signature1), where signature1 = Sign(SK_ID1, (at least one of nonce1, session identifier, ID1, ID2, service identifier, slice ID, link ID, connection identifier, session identifier, service network identifier, and PLMN ID)).

[0415] 1203. UE1 sends a session identifier, Nonce1, ID1, ID2 and a first digital signature (signature1) to UE2.

[0416] 1204. UE2 generates K_com in the same manner.

[0417] 1205. UE2 uses ID1 to verify the correctness of the first digital signature (signature1). After successful verification, it uses SK_ID2 to calculate the second digital signature (signature2), signature2 = Sign(SK_ID2, (at least one of nonce1, nonce2), (session identifier, ID1, ID2, service identifier, slice ID, link ID, connection identifier, service network identifier, at least one of PLMN ID)).

[0418] 1206. UE2 sends Nonce1, nonce2, the first user identifier, the second user identifier, and the second digital signature (signature2) to UE1.

[0419] 1207. UE1 verifies the correctness of the second digital signature (signature2), and derives the session key K_session=KDF(K_com, (at least one of the session identifier, nonce1, nonce2, service identifier, ID1, ID2)).

[0420] 1208. UE2 derives the session key K_session=KDF(K_com, (session identifier, nonce1, nonce2, service identifier, at least one of ID1 and ID2)).

[0421] Optionally, the derivation of the session key K_session in step 1208 may be completed in any step after step 1204 .

[0422] Optionally, in step 1201 or 1202, UE1 may further calculate K_session, and the derivation of K_session does not include the nonce2 parameter. Accordingly, UE2 calculates K_com and calculates K_session in the same way as UE1.

[0423] In the authentication method based on the two-round authentication process provided by the embodiment of the present invention, UE2 verifies the correctness of the first digital signature (Signature1) based on ID1, and UE1 verifies the correctness of the second digital signature (Signature2) based on ID2. In this way, mutual authentication can be completed based on digital signatures, meeting the business requirements for authentication flexibility.

[0424] It should be noted that the above embodiments are all based on the session method, adding a session ID to the sent message, and adding a parameter session ID in key derivation and authentication. The above method also supports the mode of slice, flow and bearer, that is, adding a slice ID, flow ID or bearer ID to the sent message, and adding a slice ID, flow ID or bearer ID parameter in key derivation and authentication.

[0425] Fig.13 is a structural block diagram of an authentication device provided by an embodiment of the present invention. Fig.13 The authentication device 1300 includes a sending module 1301, a receiving module 1302 and a processing module 1303. Among them:

[0426] A sending module 1301, configured to send a first random parameter to a second user equipment;

[0427] A receiving module 1302 is configured to receive a second authentication feature from the second user equipment;

[0428] The processing module 1303 is used to verify the correctness of the second authentication feature and generate a first authentication feature;

[0429] The sending module 1301 is further configured to send the first authentication feature to the second user equipment.

[0430] In one case, the authentication feature is a message authentication code. In this case, before generating the first authentication feature, the receiving module 1302 is further used to: receive a first random parameter and a second random parameter from the second user equipment;

[0431] The processing module 1303 is specifically used to: obtain the first user identifier and the second user identifier, and generate a communication shared key K_com and / or a session key K_session according to the first user identifier and the second user identifier; generate a first MAC according to the communication shared key K_com or the session key K_session, the first random parameter and the second random parameter;

[0432] in:

[0433] K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0434] K_session=KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0435] First MAC = MAC (K_com or K_session, (first random parameter, at least one of the second random parameter), (session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier))

[0436] The session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the first user equipment or received from the first user equipment.

[0437] In one case, the authentication feature is an encrypted text. In this case, the processing module 1303 is specifically used to:

[0438] Decrypt the second encrypted text using the first user key, the communication shared key K_com or the session key K_session to obtain a first random parameter and a second random parameter, and determine whether the decrypted first random parameter is the same as the first random parameter previously sent to the second user device. If they are the same, the verification is successful;

[0439] Wherein, K_com=e(xH(ID1),H(ID2)) or K_com=H(e(xH(ID1),H(ID2)); or K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0440] K_session=KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, at least one of first user identifier and second user identifier)).

[0441] When the authentication feature is an encrypted text, the processing module 1303 is specifically used to:

[0442] The first user identifier and the second user identifier are obtained, and the first user identifier, the communication shared key K_com or the session key K_session are used to encrypt the first user identifier, the second user identifier and the second random parameter to generate a first encrypted text.

[0443] In one case, the authentication feature is a digital signature, in which case the receiving module 1302 is further used to: receive a first random parameter and a second random parameter from the second user equipment;

[0444] The processing module 1303 is specifically used to: calculate the first digital signature according to the first random parameter, the second random parameter and the first user key;

[0445] Wherein, the first digital signature = Sign(SK_ID2, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, the first user identifier, the second user identifier, the service identifier, the slice identifier, the link identifier, the connection identifier, the service network identifier, and the public land mobile network identifier));

[0446] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0447] The authentication device provided in the embodiment of the present invention performs authentication between two terminal devices by means of MAC, encrypted text or digital signature. During the authentication process, no intervention of HSS is required, and the business demand for authentication flexibility can be met.

[0448] Fig.14 is a structural block diagram of an authentication device provided by an embodiment of the present invention. Fig.14 The authentication device 1400 includes a sending module 1401, a receiving module 1402 and a processing module 1403. Among them:

[0449] The receiving module 1402 is configured to receive a first random parameter from a first user equipment;

[0450] The processing module 1403 is used to obtain a first user identifier, a second user identifier, and a second random parameter, generate a second authentication feature according to the first user identifier, the second user identifier, the first random parameter, and the second random parameter, and send the second authentication feature to the first user device;

[0451] The receiving module 1402 is further configured to receive a first authentication feature from the first user equipment;

[0452] The processing module 1403 is further used to verify the correctness of the first authentication feature.

[0453] In one case, the authentication feature is a message authentication code, and the sending module 1401 is used to:

[0454] After the processing module 1403 generates the second MAC, the first random parameter and the second random parameter are sent to the first user equipment.

[0455] When the authentication feature is a message authentication code, the processing module 1403 is specifically used to:

[0456] Generate a communication shared key K_com and / or a session key K_session according to the first user identifier and the second user identifier;

[0457] Generate a second MAC according to the communication shared key K_com or the session key K_session, the first random parameter and the second random parameter;

[0458] Wherein, K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0459] K_session=KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0460] Second MAC=MAC(K_com or K_session, (first random parameter, at least one of second random parameter), (at least one of session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier))

[0461] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0462] In one case, the authentication feature is an encrypted text, and the processing module 1403 is specifically used to:

[0463] Encrypting the first user identifier, the second user identifier, the first random parameter and the second random parameter using the first user identifier, the communication shared key K_com or the session key K_session to generate a second encrypted text;

[0464] Verifying the correctness of the first authentication feature includes:

[0465] Decrypt the first encrypted text using the first user key, the communication shared key K_com or the session key K_session to obtain a second random parameter, and determine whether the decrypted second random parameter is the same as the previously encrypted second random parameter. If they are the same, the verification is successful.

[0466] Wherein, K_com=e(xH(ID1),H(ID2)) or K_com=H(e(xH(ID1),H(ID2)); or K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0467] K_session = KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier))

[0468] In one embodiment, the authentication feature is a digital signature.

[0469] The processing module 1403 is specifically used to generate a second digital signature in the following manner:

[0470] Second digital signature = Sign(SK_ID2, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier));

[0471] After the processing module 1403 generates the second digital signature, the sending module 1401 is used to send the first random parameter and the second random parameter to the first user equipment.

[0472] The authentication device provided in the embodiment of the present invention performs authentication between two terminal devices by means of MAC, encrypted text or digital signature. During the authentication process, no intervention of HSS is required, and the business demand for authentication flexibility can be met.

[0473] Fig.15 Schematic diagram of a terminal device provided by an embodiment of the present invention. Fig.15The terminal 1500 provided in the embodiment of the present invention may include: at least one processor 1501, a memory 1502, a communication interface 1503 and a bus. The processor 1501, the memory 1502 and the communication interface 1503 are connected through a bus and communicate with each other. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.15 Only one thick line is used in the diagram, but it does not mean that there is only one bus or one type of bus.

[0474] The memory 1502 is used to store executable program codes, which include computer operation instructions. The memory 1502 may be a high-speed RAM memory, or may be a non-volatile memory, such as at least one disk memory.

[0475] The processor 1501 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1502, so as to:

[0476] Sending a first random parameter to a second user equipment;

[0477] receiving a second authentication feature from the second user device;

[0478] The correctness of the second authentication feature is verified, a first authentication feature is generated, and the first authentication feature is sent to the second user equipment.

[0479] In one case, the authentication feature is a message authentication code MAC, and the processor 1501 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1502, so as to:

[0480] Before generating the first authentication feature, receiving a first random parameter and a second random parameter from the second user device;

[0481] Obtain the first user identifier and the second user identifier, and generate a communication shared key K_com and / or a session key K_session according to the first user identifier and the second user identifier;

[0482] Generate a first MAC according to the communication shared key K_com or the session key K_session, the first random parameter and the second random parameter;

[0483] in:

[0484] K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0485] K_session=KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0486] First MAC = MAC (K_com or K_session, (first random parameter, at least one of the second random parameter), (session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, public land mobile network identifier))

[0487] The session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the first user equipment or received from the second user equipment.

[0488] In another case, the authentication feature is an encrypted text, and the processor 1501 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1502, so as to:

[0489] Decrypt the second encrypted text using the first user key, the communication shared key K_com or the session key K_session to obtain a first random parameter and a second random parameter, and determine whether the decrypted first random parameter is the same as the first random parameter previously sent to the second user device. If they are the same, the verification is successful;

[0490] Wherein, K_com=e(xH(ID1),H(ID2)) or K_com=H(e(xH(ID1),H(ID2)); or K_com=H(e(xH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a Hash() algorithm or an HMAC() algorithm;

[0491] K_session=KDF(K_com, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0492] When the authentication feature is an encrypted text, the processor 1501 reads the executable program code to obtain the first user identifier and the second user identifier, and encrypt the first user identifier, the second user identifier and the second random parameter using the first user identifier, the communication shared key K_com or the session key K_session to generate a first encrypted text.

[0493] In another case, the authentication feature is a digital signature, and the processor 1501 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1502, so as to: before generating the first authentication feature, receive the first random parameter and the second random parameter from the second user equipment;

[0494] Calculate a first digital signature based on the first random parameter, the second random parameter and the first user key;

[0495] Wherein, the first digital signature = SIGN(SK_ID1, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, the first user identifier, the second user identifier, the service identifier, the slice identifier, the link identifier, the connection identifier, the service network identifier, and the public land mobile network identifier));

[0496] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0497] The terminal provided in the embodiment of the present invention performs authentication between two terminal devices by means of MAC, encrypted text or digital signature. During the authentication process, no intervention of HSS is required, which can meet the business requirements for authentication flexibility.

[0498] Fig.16 Schematic diagram of a terminal device provided by an embodiment of the present invention. Fig.16 , the terminal 1600 provided in the embodiment of the present invention may include: at least one processor 1601, a memory 1602, a communication interface 1603 and a bus. The processor 1601, the memory 1602 and the communication interface 1603 are connected through a bus and communicate with each other. The bus may be an industrial standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus or an extended industrial standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.16 Only one thick line is used in the diagram, but it does not mean that there is only one bus or one type of bus.

[0499] The memory 1602 is used to store executable program codes, which include computer operation instructions. The memory 1602 may be a high-speed RAM memory, or may be a non-volatile memory (NON-VOLATILE MEMORY), such as at least one disk memory.

[0500] The processor 1601 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1602, so as to:

[0501] receiving a first random parameter from a first user equipment;

[0502] Obtaining a first user identifier, a second user identifier, and a second random parameter, generating a second authentication feature according to the first user identifier, the second user identifier, the first random parameter, and the second random parameter, and sending the second authentication feature to the first user device;

[0503] receiving a first authentication feature from the first user device;

[0504] Verify the correctness of the first authentication feature.

[0505] In one case, the authentication feature is a message authentication code (MAC), and the processor 1601 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1602, so as to:

[0506] Generate a communication shared key K_COM and / or a session key K_SESSION according to the first user identifier and the second user identifier;

[0507] Generate a second MAC according to the communication shared key K_COM or the session key K_SESSION, the first random parameter and the second random parameter;

[0508] Wherein, K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0509] K_SESSION=KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier));

[0510] Second MAC=MAC(K_COM or K_SESSION, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier))

[0511] Among them, the session identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier are pre-acquired by the second user equipment or received from the first user equipment.

[0512] After the second MAC is generated, the first random parameter and the second random parameter may be sent to the first user equipment.

[0513] In another case, the authentication feature is an encrypted text, and the processor 1601 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1602, so as to:

[0514] Encrypting the first user identifier, the second user identifier, the first random parameter and the second random parameter by using the first user identifier, the communication shared key K_COM or the session key K_SESSION to generate a second encrypted text;

[0515] Decrypt the first encrypted text using the first user key, the communication shared key K_COM or the session key K_SESSION to obtain a second random parameter, and determine whether the decrypted second random parameter is the same as the previously encrypted second random parameter. If they are the same, the verification is successful.

[0516] Wherein, K_COM=E(XH(ID1),H(ID2)) or K_COM=H(E(XH(ID1),H(ID2)); or K_COM=H(E(XH(ID1),H(ID2))^{H(parameter 1)}), wherein parameter 1 may be at least one of a service identifier, a slice identifier, a link identifier, a connection identifier, a session identifier, a service network identifier, a public land mobile network identifier, a first user identifier, and a second user identifier; the H() algorithm is a HASH() algorithm or an HMAC() algorithm;

[0517] K_SESSION = KDF(K_COM, (session identifier, first random parameter, second random parameter, service identifier, first user identifier, at least one of the second user identifier))

[0518] In another case, the authentication feature is a digital signature, and the processor 1601 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 1602, so as to:

[0519] Second digital signature = SIGN(SK_ID2, (first random parameter, at least one of the second random parameter), (at least one of the session identifier, first user identifier, second user identifier, service identifier, slice identifier, link identifier, connection identifier, service network identifier, and public land mobile network identifier));

[0520] After the second digital signature is generated, the first random parameter and the second random parameter are sent to the first user equipment.

[0521] The terminal provided in the embodiment of the present invention performs authentication between two terminal devices by means of MAC, encrypted text or digital signature. During the authentication process, no intervention of HSS is required, which can meet the business requirements for authentication flexibility.

[0522] It should be noted that the authentication system provided by the embodiment of the present invention may include Fig.15 The terminal and Fig.16 Terminal shown. Fig.15 and 16 The terminal shown in the figure may be the user equipment mentioned above, and the relevant contents of the terminal embodiment and the authentication method embodiment may refer to each other.

[0523] It should be noted that the authentication device provided in the above embodiment is only illustrated by taking the modules included above as an example. In actual applications, one or more modules can be added or reduced as needed to complete all or part of the functions described above. In addition, the authentication device and authentication method embodiments provided in the above embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0524] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0525] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0526] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0527] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An authentication method, characterized in that: The method comprises: The communication network element receives a request sent by a user equipment UE, wherein the request includes a first identifier; In response to the request, the communication network element sends the first identifier to a home subscriber server; The communication network element receives the authentication vector sent by the home user server, where the authentication vector includes an authentication random number RAND, a first response value XRES and an authentication value AUTN; The communication network element sends the RAND and AUTN to the UE; The communication network element receives a second response value RES sent by the UE; The communication network element determines whether the XRES is the same as the RES; If the XRES is the same as the RES, the communication network element sends a second identifier to the key management center; The key management center generates a user private key corresponding to the second identifier; The key management center sends the user private key to the communication network element; and The communication network element sends the user private key to the UE.

2. The method according to claim 1, characterized in that The key management center generates a user private key corresponding to the second identifier, including: The key management center generates the user private key using the second identifier.

3. The method according to claim 1, characterized in that The key management center generates a user private key corresponding to the second identifier, including: The key management center generates the user private key using the operator identifier and the second identifier.

4. The method according to claim 3, characterized in that The operator identifier is a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID) or a local operator network identifier.

5. The method according to claim 3 or 4, characterized in that: The second identifier is any one of the following: an industry user identifier, a business identifier, a company identifier, and an individual user identifier.

6. The method according to any one of claims 1 to 4, characterized in that: The request also includes an indicator, where the indicator is used to instruct to obtain a private key corresponding to the second identifier.

7. An authentication method, characterized in that: The method comprises: The user equipment UE sends a request to the communication network element; wherein the request includes a first identifier and a second identifier; the first identifier is an international mobile user identity code; the second identifier is any one of the following: an industry user identifier, a service identifier, a company identifier, and an individual user identifier; The UE receives an authentication random number RAND and an authentication value AUTN; The UE verifies the AUTN; If the verification of the AUTN is successful, the UE calculates a first response value RES and sends the RES to the communication network element; The UE receives a user private key corresponding to the second identifier sent by the communication network element.

8. The method according to claim 7, characterized in that The user private key is generated according to the second private key.

9. The method according to claim 7, characterized in that: The user private key is generated according to the operator identifier and the second identifier.

10. The method according to claim 9, characterized in that The operator identifier is a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID) or a local operator network identifier.

11. The method according to any one of claims 7 to 10, characterized in that: The request also includes an indicator, where the indicator is used to instruct to obtain a private key corresponding to the second identifier.

12. A communication device, characterized in that: The device comprises: A sending module, configured to send a request to a communication network element; wherein the request includes a first identifier and a second identifier; the first identifier is an international mobile subscriber identity code; the second identifier is any one of the following: an industry user identifier, a service identifier, a company identifier, and an individual user identifier; A receiving module, used to receive an authentication random number RAND and an authentication value AUTN sent by the communication network element; A processing module, configured to verify the AUTN; if the verification of the AUTN is successful, calculate a first response value RES; The sending module is further used to send the RES to the communication network element; The receiving module is used to receive a user private key corresponding to the second identifier sent by the communication network element.

13. The device according to claim 12, characterized in that The user private key is generated according to the second private key.

14. The device according to claim 12, characterized in that The user private key is generated according to the operator identifier and the second identifier.

15. The device according to claim 14, characterized in that The operator identifier is a public land mobile network identifier (PLMN ID), a serving network identifier (serving network ID) or a local operator network identifier.

16. The device according to any one of claims 12 to 15, characterized in that The request also includes an indicator, where the indicator is used to instruct to obtain a private key corresponding to the second identifier.

17. A communication device, characterized in that: comprising at least one processor and a memory, the memory being configured to store computer instructions; The processor is coupled to the memory and is used to call the computer instructions in the memory so that the device executes the method according to any one of claims 7 to 11.

Images