A single package authorization authentication method and system based on a universal booting architecture

Abstract

This application provides a single-packet authorization authentication method and system based on a universal bootstrap architecture. The method includes: generating a shared key based on a target key and key algorithm pre-stored in a SIM card; hashing terminal authentication information using a hash algorithm to obtain authentication information, which includes the shared key and first terminal information, including at least one of B-TID, a negotiation string, a client identifier, or an application service identifier; encrypting second terminal information using an encryption algorithm to obtain encrypted second terminal information, which includes a client identifier and an application service identifier; and generating an SPA packet based on the authentication information and the encrypted second terminal information, and sending it to an authentication server for single-packet authorization authentication. This method, by entrusting key management to the client and the universal bootstrap architecture, solves the problems of key management and leakage, and improves key security.

Description

Technical Field

[0001] This application relates to communication technology, and more particularly to a single-packet authorization and authentication method and system based on a general boot architecture. Background Technology

[0002] Single Packet Authorization (SPA) is a next-generation port knocking technology that stores authentication messages within data packets before transmitting them to the server. The primary function of SPA is to make services appear invisible on the network by closing service ports by default, preventing connections and scanning. If a service is needed, a specific client sends an authentication message (SPA packet) to the server. After authenticating the message, the server opens the relevant service for that Internet Protocol (IP) address.

[0003] The keys in existing single-packet authorization and authentication architectures are typically a string of random numbers generated using client commands and included in configuration files on both the client and server sides. Generally, after being generated on the client side, it is synchronously transmitted to the server offline and configured in the server's configuration file.

[0004] This method suffers from low key security and inconvenient management. After the key is generated by the client, it needs to be distributed to the server in plaintext through offline channels and then configured on the server. If the process is not managed properly, key leakage may occur. The key is stored in plaintext on both the client and the server. If the key is leaked on one end, the entire process will no longer be secure. On the other hand, if a key needs to be changed in special circumstances, such a procedure still needs to be executed, which is quite complicated. Especially when multiple machines need to be configured with keys, the workload and complexity will increase dramatically. Summary of the Invention

[0005] This application provides a single-packet authorization and authentication method and system based on a general bootstrapping architecture to solve the problems of low security and inconvenient management of keys in the existing single-packet authorization and authentication architecture.

[0006] Firstly, this application provides a single-packet authorization and authentication method based on a general boot architecture, applied to a terminal device, the terminal device including a SIM card and the SDP client, the method comprising:

[0007] The SIM card generates a shared key based on the target key and key algorithm pre-stored in the SIM card;

[0008] The SIM card performs hash processing on the terminal authentication information according to the hash algorithm to obtain the authentication information. The terminal authentication information includes the shared key and the first terminal information. The first terminal information includes at least one of B-TID, negotiation string, client identifier or application service identifier. The negotiation string refers to a fixed string negotiated between the client and the SDP policy center. The application service identifier refers to the business service identifier that the client needs to use.

[0009] The SIM card encrypts the second terminal information according to an encryption algorithm to obtain encrypted second terminal information, which includes a client identifier and an application service identifier.

[0010] The SDP client generates an SPA packet based on the authentication information and the encrypted second terminal information, and sends it to the authentication server for single-packet authorization authentication.

[0011] Optionally, generating the SPA packet based on the authentication information and the encrypted second terminal information includes:

[0012] The message to be authenticated is signed using a public key to obtain the packet header.

[0013] The encrypted second terminal information is used as the packet payload to generate an SPA packet.

[0014] Optionally, after sending to the authentication server, the method further includes:

[0015] Receive the authentication pass response sent by the authentication server;

[0016] Send a service request to the authentication server so that the authentication server forwards the service request to the service server;

[0017] Receive the service results fed back by the service server.

[0018] Optionally, the method further includes:

[0019] The system receives a key negotiation request sent by the authentication server. The key negotiation request includes a new target key and a key algorithm corresponding to the new shared key.

[0020] Secondly, this application also provides a single-package authorization and authentication method based on a general boot architecture, applied to an authentication server, wherein the authentication server includes an SDP server and a GBA authentication client, and the method includes:

[0021] The SDP server receives an SPA packet sent by the terminal device. The SPA packet includes authentication information and encrypted second terminal information, which includes a client identifier and an application service identifier.

[0022] The authentication policy center of NAF in the GBA authentication terminal decrypts the second terminal information using a decryption algorithm to obtain the decrypted second terminal information.

[0023] The authentication policy center obtains the B-TID assigned to the terminal device from the BSF in the GBA authentication terminal based on the client identifier and application service identifier, and uses the B-TID to obtain the shared key from the HSS in the GBA authentication terminal;

[0024] The authentication policy center generates authentication information based on the shared key and the first terminal information. The first terminal information includes at least one of B-TID, negotiation string, client identifier, or application service identifier. The negotiation string is a fixed string negotiated between the client and the SDP policy center, and the application service identifier is a business service identifier that the client needs to use.

[0025] After confirming that the information to be authenticated and the authentication information are consistent, the authentication policy center sends authentication pass information to the SDP server.

[0026] The SDP server performs a temporary firewall clearance operation to allow the terminal device to access the business server.

[0027] Optionally, the header of the SPA packet is a header signed with a public key. Before the NAF authentication policy center in the GBA authentication terminal decrypts the second terminal information using a decryption algorithm to obtain the decrypted second terminal information, the method further includes:

[0028] The authentication policy center performs digital signature verification on the header of the SPA packet using a private key, and the verification is successful.

[0029] Optionally, the method further includes:

[0030] The authentication policy center obtains the reception frequency of the SPA packet;

[0031] The authentication strategy center determines whether the receiving frequency is greater than a preset frequency;

[0032] If not, continue the operation of decrypting the client encryption identifier in the SPA package;

[0033] If so, a key negotiation request is sent to the terminal device, the key negotiation request including a new target key and a key algorithm corresponding to the new shared key.

[0034] Optionally, before sending the key negotiation request to the terminal device, the method further includes:

[0035] An alarm message is sent to the terminal device, and the authentication service channel of the terminal device is closed.

[0036] Optionally, after the SDP server performs a temporary firewall clearance operation, the method further includes:

[0037] Receive service requests sent by the terminal device;

[0038] The service request is forwarded to the service server so that the service server can provide the service result to the terminal device.

[0039] Thirdly, this application also provides a single-package authorization and authentication system based on a general boot architecture.

[0040] The system includes terminal devices, an authentication server, and a service server; wherein...

[0041] The terminal device is used to execute the method described in the first aspect;

[0042] The authentication server is used to perform the method described in the second aspect;

[0043] The service server is used to provide service after the terminal device has been authenticated.

[0044] This application provides a single-packet authorization authentication method and system based on a general bootstrap architecture. The method includes: generating a shared key based on a target key and key algorithm pre-stored in a SIM card; hashing terminal authentication information using a hash algorithm to obtain authentication information, which includes the shared key and first terminal information, including at least one of B-TID, a negotiation string, a client identifier, or an application service identifier; encrypting second terminal information using an encryption algorithm to obtain encrypted second terminal information, which includes a client identifier and an application service identifier; and generating an SPA packet based on the authentication information and the encrypted second terminal information, and sending it to an authentication server for single-packet authorization authentication. This method, by entrusting key management to the client and the general bootstrap architecture, solves the problems of key management and leakage, and improves key security. Attached Figure Description

[0045] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0046] Figure 1 A system architecture diagram of a single-package authorization and authentication method based on a general bootstrapping architecture is provided for embodiments of this application;

[0047] Figure 2 Signaling for a single-packet authorization and authentication method based on a general boot architecture provided in this application embodiment Figure 1 ;

[0048] Figure 3 Signaling for a single-packet authorization and authentication method based on a general boot architecture provided in this application embodiment Figure 2 ;

[0049] Figure 4 Signaling for a single-packet authorization and authentication method based on a general boot architecture provided in this application embodiment Figure 3 .

[0050] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0051] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0052] In a single-package authorization and authentication architecture, keys play a crucial role in many aspects, including ensuring software security, user legitimacy, license management, preventing piracy and illegal copying, protecting intellectual property rights, providing advanced license control and authentication, and enhancing the overall security of the system. This provides software developers with a sustainable source of revenue and users with a legal, secure, and efficient software experience.

[0053] In existing single-packet authorization and authentication architectures, keys are typically generated as a string of random numbers using client commands. These generated keys are usually stored in the client's configuration file, making them accessible and potentially stealable by attackers. Therefore, key security is low, and they are susceptible to malicious attacks. Furthermore, key management can be inconvenient because keys need to be transmitted offline to the server. If key updates or rotations are required across multiple clients, manual operation may be necessary, increasing the risk of human error.

[0054] Based on this, this application provides a single-package authorization and authentication method and system based on a general bootstrapping architecture.

[0055] By processing terminal authentication information containing a shared key using the terminal device to generate authentication information and second terminal information, and then encrypting this information to generate an SPA packet, which is sent to the authentication server, the authentication server verifies the legitimacy of the SPA packet using a corresponding algorithm and performs authentication comparison on the authentication information within it. Once the authentication comparison is successful, the terminal device can complete the business request through the business server, reducing the risk of SPA packet information being tampered with and ensuring the integrity and security of the information within the SPA packet. Simultaneously, when the authentication server detects a shared key leak, it can promptly notify the terminal device and negotiate a replacement of the shared key, eliminating the need for manual key creation or updating. This reduces the risk of key leakage during transmission, solves the problem of inconvenient key management, and improves key security.

[0056] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0057] Figure 1 A structural diagram of a single-package authorization and authentication system based on a general boot architecture provided in this application embodiment is shown below. Figure 1 As shown, the system includes: terminal devices, an authentication server, and a business server.

[0058] The terminal equipment includes a SIM card and an SDP client;

[0059] The authentication server includes the SDP server and the NAF authentication policy center, BSF, and HSS in the GBA authentication server;

[0060] The business server includes the server-side component.

[0061] The embodiments of this application are mainly used in communication technology. Among them, the Subscriber Identity Module (SIM) card in the terminal device is an integrated circuit card used to store mobile device user information, algorithms, and keys, etc., to allow the device to authenticate and authorize with the mobile operator's network, thereby enabling communication.

[0062] A Session Description Protocol (SDP) client is primarily used to communicate with the SDP server to request, access, and process service data. An SDP client can be part of an application, device, or system, responsible for creating and assembling SPA packages and interacting with the SDP server to obtain the required data or perform specific service operations.

[0063] The SDP server in the authentication server is mainly used for data communication between the client and the server. It accepts single-packet authorization and authentication requests (SPA packets) initiated by SDP clients, performs single-packet authorization and authentication through the Generic Bootstrapping Architecture (GBA) authentication terminal, and sets firewall access policies to pass business requests from SDP clients.

[0064] The GBA authentication client is a general bootstrapping architecture designed to provide secure authentication and key negotiation mechanisms to enhance security in mobile communication networks. The core objective of GBA is to ensure the confidentiality and integrity of communications, as well as to protect user privacy. In this embodiment, the GBA authentication client mainly includes the authentication policy center for the Network Application Function (NAF), a Bootstrapping Server Function (BSF), and a Home Subscriber Server (HSS).

[0065] The NAF's authentication policy center is responsible for designing and verifying SPA packets sent from the SDP server to confirm the integrity of the data packets. It also completes the authentication of the entire information by communicating with the BSF and HSS to ensure that only legitimate users and devices can access network resources, while maintaining the security of communication.

[0066] BSF is a core component of the GBA architecture, responsible for handling the boot process of user equipment. Its main responsibilities include generating the Bearer Token Identifier (B-TID) and providing the HSS interface to verify the identity of the user equipment to ensure that it has the authority to access the mobile network.

[0067] HSS is used to store user identity information and key materials. BSF typically communicates with HSS to obtain user security information.

[0068] Business servers are typically used to host business logic, process client requests, and manage databases and resources in order to provide services for specific business applications.

[0069] This application provides a single-packet authorization and authentication system based on a general boot architecture. The system completes single-packet authorization and authentication of the terminal device through the joint cooperation of the terminal device, the authentication server, and the business server, which enhances the security of the system, reduces the risk of terminal device information being tampered with, and improves the business response speed.

[0070] Figure 2 Signaling for a single-packet authorization and authentication method based on a general boot architecture provided in this application embodiment Figure 1 .like Figure 2 As shown, the method includes:

[0071] S101, the SIM card generates a shared key based on the pre-stored target key and key algorithm;

[0072] The target key and key algorithm refer to the key and algorithm agreed upon and negotiated in advance by the client application and the service provider, and are pre-built into the SIM card to generate a shared key for subsequent identity authentication operations.

[0073] In this embodiment, the SIM card generates a shared key by calling the built-in security chip based on the pre-stored target key and key algorithm.

[0074] S102, The SIM card performs hash processing on the terminal authentication information according to the hash algorithm to obtain the authentication information;

[0075] Terminal authentication information includes a shared key and first terminal information, wherein the first terminal information includes at least one of B-TID, negotiation string, client identifier or application service identifier;

[0076] A hash algorithm is a mathematical algorithm that converts input data (messages or text) into a fixed-length string or number. The algorithm is irreversible, meaning that the original input data cannot be recovered from the hash value, thus ensuring the integrity of the information.

[0077] Terminal authentication information refers to the information used by terminal devices to prove their identity in a communication system. This information is typically used for authentication and authorization to ensure that only legitimate terminal devices can access the network or system.

[0078] The negotiation string refers to a fixed string negotiated between the client and the SDP policy center. This string is present on both the client and the server. In this embodiment, it is used to fill parameters in the hash algorithm.

[0079] The User Equipment (UE) identifier is typically an IP Multimedia Private Identity (IMPI) value, used for user registration, authentication, and billing when accessing an IP Multimedia Subsystem (IMS) network.

[0080] The application service identifier refers to the business service identifier that the client actually needs to use. It is agreed upon by the client and the business service and is used to distinguish the business service port opened by the single package authorization system so that the client can make requests or connect to the business service after passing the authorization.

[0081] In this embodiment, the SIM card performs hash calculation on at least one of the shared key, B-TID, negotiation string, client identifier, or application service identifier according to a hash algorithm to obtain the authentication information. This authentication information is used for subsequent authentication comparison.

[0082] S103, the SIM card encrypts the second terminal information according to the encryption algorithm to obtain the encrypted second terminal information;

[0083] The second terminal information includes the client identifier and the application service identifier;

[0084] In this embodiment, the SIM card performs encryption calculations on the second terminal information, including the client identifier and the application service identifier, according to the built-in encryption algorithm to obtain the encrypted second terminal information.

[0085] S104: The SIM card sends the authentication information and the encrypted second terminal information to the SDP client;

[0086] In this embodiment, the SIM card sends the generated authentication information and the encrypted second terminal information to the SDP client to create and package the SPA package.

[0087] S105, the SDP client generates an SPA packet based on the authentication information and the encrypted second terminal information;

[0088] An SPA packet is a protocol-specific data packet used to transmit data streams in network communications.

[0089] In this embodiment, the SDP client creates and generates an SPA packet based on the authentication information and the encrypted second terminal information, which is used for subsequent single-packet authorization information authentication.

[0090] S106, the SDP client sends an SPA packet to the SDP server;

[0091] S107, SDP server forwards SPA packets to GBA authentication terminal;

[0092] The SPA package includes authentication information and encrypted second terminal information, which includes client identifier and application service identifier.

[0093] In this embodiment, the SDP server forwards the SPA packet sent by the SDP client, which contains the authentication information and the encrypted second terminal information, to the GBA authentication terminal for identity verification.

[0094] In the S108 and GBA authentication terminals, the NAF authentication policy center decrypts the second terminal information using a decryption algorithm to obtain the decrypted second terminal information.

[0095] In this embodiment, the GBA authentication terminal calls the NAF authentication policy center and uses the authentication policy center's decryption algorithm to decrypt the encrypted second terminal information to obtain the complete second terminal information.

[0096] S109 and GBA authentication terminals use the client identifier and application service identifier to obtain the B-TID assigned to the terminal device from the BSF, and use the B-TID to obtain the shared key from the HSS;

[0097] In this embodiment, the authentication policy center of the NAF at the GBA authentication terminal uses the client identifier and application service identifier obtained from the decrypted second terminal information to obtain B-TID information by calling the BSF interface, and then obtains shared key information from HSS based on B-TID through the shared key acquisition interface provided by BSF. The shared key is pre-stored in HSS.

[0098] In the S110 and GBA authentication terminals, the NAF authentication policy center generates authentication information by sharing the key and the first terminal information;

[0099] The first terminal information includes at least one of B-TID, negotiation string, client identifier, or application service identifier;

[0100] In this embodiment, the authentication policy center of the NAF at the GBA authentication terminal calculates and processes the authentication information using a hash algorithm based on the newly acquired shared key, B-TID, negotiation string, client identifier, or application service identifier.

[0101] S111, GBA authentication terminal confirms that the information to be authenticated and the authentication information are consistent;

[0102] In this embodiment, the GBA authentication terminal compares the information to be authenticated with the authentication information, and if the information is consistent, the authentication is successful.

[0103] S112, GBA authentication terminal sends authentication pass information to SDP server;

[0104] The SDP server receives an authentication success response from the authentication server.

[0105] In this embodiment, after the authentication information is verified, the GBA authentication terminal sends authentication verification information to the SDP server, indicating that the client is authorized to access the SDP service.

[0106] S113, the SDP server sends an authentication pass response and performs a temporary firewall pass operation;

[0107] In this embodiment, the SDP server sends an authentication pass response to the client and sets firewall policies to allow client traffic to pass through the firewall so that the client can make business service requests.

[0108] S114. The SDP client sends a service request to the SDP server.

[0109] The SDP client sends a service request to the authentication server, which then forwards the service request to the service server.

[0110] In this embodiment, the SDP client generates a business service request and sends it to the SDP server.

[0111] S115. The SDP server forwards business service requests to the business server.

[0112] In this embodiment, the SDP server forwards the service request sent by the SDP client to the service server.

[0113] S116. The service server sends the service results back to the terminal device.

[0114] The terminal device receives the service results from the service server.

[0115] In this embodiment, after receiving the request, the service server performs the corresponding operation and returns the generated response to the terminal device.

[0116] This application provides a single-packet authorization and authentication method based on a general bootstrapping architecture. It utilizes a terminal device to generate a shared key and authentication information, and transmits the SPA packet to the GBA authentication terminal via an SDP server for decryption. The decrypted SPA packet information is then obtained and calculated to acquire new authentication information. Once the authentication information and the authentication information match, the SDP client continues to execute the business request operation. This improves key confidentiality and avoids key leakage. Furthermore, encrypting the information in the SPA packet reduces the risk of information tampering and enhances the security of information transmission.

[0117] Figure 3 Signaling for a single-packet authorization and authentication method based on a general boot architecture provided in this application embodiment Figure 2 .like Figure 3 As shown, the method includes:

[0118] S201, The SIM card sends the authentication information and the encrypted second terminal information to the SDP client;

[0119] S202 and SDP clients sign the authentication information using a public key to obtain the packet header.

[0120] A public key is part of an asymmetric encryption system, used to encrypt and decrypt data. A private key is also associated with asymmetric encryption; together, they form an asymmetric key pair.

[0121] The header is the beginning of an SPA packet and contains metadata information related to data transmission. The purpose of the header is to provide necessary information at the receiving end when parsing and processing the data, ensuring data integrity.

[0122] In this embodiment, the SDP client uses a public key to sign and encrypt the information to be authenticated, forming the header of the SPA packet.

[0123] S203 and SDP clients use the encrypted second terminal information as part of the packet payload to generate SPA packets;

[0124] Packet payload refers to the data portion following the packet header, which contains the actual data information.

[0125] In this embodiment, the SDP client uses the encrypted second terminal information as the packet payload and combines it with the packet header to generate an SPA packet.

[0126] S204, the SDP client sends the SPA packet to the authentication server;

[0127] S205. The authentication server decrypts the SPA packet.

[0128] In this embodiment, the NAF authentication policy center in the authentication server uses the built-in private key to verify the signature of the SPA packet header. After the signature verification is successful, the decryption algorithm is used to decrypt the SPA packet payload.

[0129] S206. The authentication server sends an authentication success response to the SDP client.

[0130] S207, the SDP client sends a service request to the authentication server;

[0131] S208. The certificate server forwards the service request to the service server.

[0132] S209. The service server sends the service results back to the SDP client.

[0133] This application provides a single-packet authorization and authentication method based on a general bootstrap architecture. By signing the SPA header information with a public key, the integrity of the SPA packet information data is guaranteed, ensuring that the data is not tampered with or damaged during transmission, thus enhancing data security. Simultaneously, by decrypting the SPA packet and sending an authentication pass response to the SDP client, the authentication server confirms the client's legitimacy, establishing a secure communication channel between the two parties. Subsequent communication is protected, ensuring data confidentiality and integrity.

[0134] Figure 4 Signaling for a single-packet authorization and authentication method based on a general boot architecture provided in this application embodiment Figure 3 .like Figure 4 As shown, the method includes:

[0135] S301. The terminal device sends an SPA packet to the SDP server.

[0136] The header of an SPA packet is the header of a packet signed with a public key.

[0137] S302, SDP server forwards SPA packets to the authentication policy center of GBA authentication terminal;

[0138] S303, The authentication policy center obtains the receiving frequency of SPA packets;

[0139] The receiving frequency refers to the number of times the client initiates a single packet authorization authentication.

[0140] In this embodiment, the authentication policy center generates logs for the acquired SPA packets and obtains the SPA packet reception frequency.

[0141] S304. The authentication policy center determines whether the SPA packet receiving frequency is greater than the preset frequency.

[0142] In this embodiment, the authentication policy center goes online according to the system's preset receiving frequency and determines whether the SPA packet receiving frequency is greater than the preset frequency.

[0143] S305. If the authentication policy center determines that the SPA packet receiving frequency is less than the preset frequency, it will perform a decryption operation.

[0144] In this embodiment, the authentication policy center goes online according to the system's preset receiving frequency. If it determines that the SPA packet receiving frequency is less than the preset frequency, it can perform the decryption operation.

[0145] S306. If the authentication policy center determines that the SPA packet receiving frequency is greater than the preset frequency, it will close the authentication service channel of the terminal device.

[0146] In this embodiment, the authentication policy center goes online according to the system's preset receiving frequency. If it determines that the SPA packet receiving frequency is greater than the preset frequency and there is abnormal behavior, it will close the authentication service channel of the terminal device.

[0147] S307. The authentication policy center sends alarm information to the terminal device.

[0148] In this embodiment, when the authentication policy center closes the authentication service channel of the terminal device, it immediately sends an alarm message to the terminal device to remind the user of the abnormal behavior and performs key negotiation and replacement.

[0149] S308. The authentication policy center sends a key negotiation request to the terminal device.

[0150] The key negotiation request includes the new target key corresponding to the new shared key and the key algorithm;

[0151] In this embodiment, the authentication policy center negotiates with the terminal device and sends a new target key and key algorithm corresponding to the new shared key to replace the new shared key and ensure key security.

[0152] This application provides a single-packet authorization and authentication method based on a general bootstrapping architecture. By monitoring the reception frequency of SPA packets through an authentication policy center, the possibility of authentication service abuse is reduced, which helps maintain system stability and reliability. Disabling the authentication service channel on terminal devices frees up system resources and reduces server load. Simultaneously, by sending alarm information and key negotiation requests to terminal devices, the authentication policy center can respond promptly to security issues and anomalies, improving communication security and availability, and resolving the complexity of key replacement.

[0153] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A single package authorization authentication method based on a general booting architecture, characterized by, Applied to a terminal device, the terminal device including a SIM card and an SDP client, the method includes: The SIM card generates a shared key based on the target key and key algorithm pre-stored in the SIM card; The SIM card performs hash processing on the terminal authentication information according to the hash algorithm to obtain the authentication information. The terminal authentication information includes the shared key and the first terminal information. The first terminal information includes at least one of B-TID, negotiation string, client identifier or application service identifier. The negotiation string refers to a fixed string negotiated between the client and the SDP policy center. The application service identifier refers to the business service identifier that the client needs to use. The SIM card encrypts the second terminal information according to an encryption algorithm to obtain encrypted second terminal information, which includes a client identifier and an application service identifier. The SDP client generates an SPA packet based on the authentication information and the encrypted second terminal information, and sends it to the authentication server for single-packet authorization authentication.

2. The method according to claim 1, characterized in that, The step of generating an SPA packet based on the authentication information and the encrypted second terminal information includes: The message to be authenticated is signed using a public key to obtain the packet header. The encrypted second terminal information is used as the packet payload to generate an SPA packet.

3. The method according to claim 1, characterized in that, After sending to the authentication server, the method further includes: Receive the authentication pass response sent by the authentication server; Send a service request to the authentication server so that the authentication server forwards the service request to the service server; Receive the service results fed back by the service server.

4. The method according to claim 2, characterized in that, The method further includes: The system receives a key negotiation request sent by the authentication server. The key negotiation request includes a new target key and a key algorithm corresponding to the new shared key.

5. A single-package authorization and authentication method based on a general bootstrap architecture, characterized in that, Applied to an authentication server, the authentication server including an SDP server and a GBA authentication server, the method includes: The SDP server receives an SPA packet sent by the terminal device. The SPA packet includes authentication information and encrypted second terminal information, which includes a client identifier and an application service identifier. The authentication policy center of NAF in the GBA authentication terminal decrypts the second terminal information using a decryption algorithm to obtain the decrypted second terminal information. The authentication policy center obtains the B-TID assigned to the terminal device from the BSF in the GBA authentication terminal based on the client identifier and application service identifier, and uses the B-TID to obtain the shared key from the HSS in the GBA authentication terminal; The authentication policy center generates authentication information based on the shared key and the first terminal information. The first terminal information includes at least one of B-TID, negotiation string, client identifier, or application service identifier. The negotiation string is a fixed string negotiated between the client and the SDP policy center, and the application service identifier is a business service identifier that the client needs to use. After confirming that the information to be authenticated and the authentication information are consistent, the authentication policy center sends authentication pass information to the SDP server. The SDP server performs a temporary firewall clearance operation to allow the terminal device to access the business server.

6. The method according to claim 5, characterized in that, The header of the SPA packet is a header signed with a public key. Before the authentication policy center of the NAF in the GBA authentication terminal decrypts the second terminal information using a decryption algorithm to obtain the decrypted second terminal information, the method further includes: The authentication policy center performs digital signature verification on the header of the SPA packet using a private key, and the verification is successful.

7. The method according to claim 5, characterized in that, The method further includes: The authentication policy center obtains the reception frequency of the SPA packet; The authentication strategy center determines whether the receiving frequency is greater than a preset frequency; If not, continue the operation of decrypting the client encryption identifier in the SPA package; If so, a key negotiation request is sent to the terminal device, the key negotiation request including a new target key and a key algorithm corresponding to the new shared key.

8. The method according to claim 5, characterized in that, Before the terminal device sends the key negotiation request, the method further includes: An alarm message is sent to the terminal device, and the authentication service channel of the terminal device is closed.

9. The method according to claim 5, characterized in that, After the SDP server performs a temporary firewall pass-through operation, the method further includes: Receive service requests sent by the terminal device; The service request is forwarded to the service server so that the service server can provide the service result to the terminal device.

10. A single-package authorization and authentication system based on a general bootstrapping architecture, characterized in that, The system includes terminal devices, an authentication server, and a business server; in The terminal device is configured to perform the method as described in any one of claims 1 to 4; The authentication server is configured to perform the method as described in any one of claims 5 to 9; The service server is used to provide service after the terminal device has been authenticated.

Images