Identity authentication system and method for terminal access network, and network equipment

Abstract

The invention discloses an identity authentication system and method for a terminal to access a network, and network equipment. A primary ePDG network element in the system firstly receives an authentication message sent by terminal equipment, performs first identity authentication on the terminal equipment according to the authentication message, receives a first EAP authentication response message sent by the terminal equipment if the authentication is passed, and sends a first access request message carrying a terminal identifier to a 3A server; and then, the 3A server performs secondary identity authentication on the terminal equipment according to the terminal identifier, and transmits a result of the secondary identity authentication to the terminal equipment through the primary ePDG network element, and the terminal equipment determines whether to access the communication network according to the result of the secondary identity authentication. According to the invention, the technical problem that the security and continuity of the terminal communication service are poor because the related terminal access network technology lacks the identity authentication of the 3A server to the terminal and the disaster recovery mechanism of the ePDG network element is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to an identity authentication system and method for a terminal to access a network, and a network device. Background Art

[0002] VoWiFi (Voice over WiFi) is a telecommunications-class basic voice service based on WiFi wireless access, core network and IMS (IP Multimedia Subsystem) network, carried on packet network. At present, UE (User Equipment) can request access to the communication network according to the following process, including: (1) UE first sends an access request to the ePDG network element as an untrusted WiFi access gateway; (2) ePDG network element communicates with HSS (Home Subscriber Server) network element or fused HSS+UDM (Unified Data Management) network element to request UE's authentication information, and generates one or more authentication neighbors, such as Rand (random number), Autn (authentication token), CK (encryption key), IK (integrity protection key), etc., and sends them to the ePDG network element; (3) ePDG network element uses IKEv2 protocol to perform EAP-AKA (Extensible Authentication Protocol-Authentication and Key Agreement, Extensible Authentication Protocol and Authentication and Key Agreement) authentication, in which the ePDG network element sends a challenge message to the UE, including Rand (random number) and Autn (authentication token); (4) The UE uses the Ki (long-term key) in its USIM card and the received Rand to calculate the response (RES) and confirmation (AUTN), and sends this information as the authentication response to the ePDG network element; (5) The ePDG network element compares the authentication response fed back by the UE with the expected result provided by the HSS network element or the converged HSS+UDM network element. If the match is successful, it means that the authentication is successful. Otherwise, if the match is unsuccessful, it means that the authentication fails; (6) If the authentication is successful, IPsec security management will be established between the ePDG network element and the UE to ensure the security of data transmission.

[0003] However, the above access authentication process still has the following problems: (1) The 3GPP AAA server cannot authenticate the UE, so it is difficult to solve the problem of suspicious UE tampering with access; (2) The existing architecture cannot dynamically expand and horizontally scale the ePDG network elements, making it difficult to achieve load balancing for the entire system.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide an identity authentication system and method for a terminal to access a network, as well as a network device, so as to at least solve the technical problem that the relevant terminal access network technology lacks identity authentication of the terminal by a 3A server and a disaster recovery mechanism of an ePDG network element, resulting in poor security and continuity of terminal communication services.

[0006] According to one aspect of an embodiment of the present application, there is provided an identity authentication system for a terminal to access a network, the system comprising: a terminal device, a primary ePDG network element and a plurality of backup ePDG network elements, and a 3A server for providing authentication, authorization, and billing, wherein the primary ePDG network element is used to receive an authentication message sent by the terminal device, wherein the authentication message carries only a terminal identifier of the terminal device; perform a first identity authentication on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is passed, receive a first EAP authentication response message sent by the terminal device carrying the terminal identifier, and send a first access request message carrying the terminal identifier to the 3A server; the 3A server is used to perform a second identity authentication on the terminal device according to the terminal identifier in the first access request message, and feed back a first access response message carrying the result of the second identity authentication to the primary ePDG network element; the primary ePDG network element is further used to feed back an identity authentication response message carrying the result of the second identity authentication to the terminal device, wherein the terminal device is used to determine whether to access the communication network according to the result of the second identity authentication.

[0007] Optionally, the main ePDG network element includes: a first authentication module, wherein the first authentication module is used to receive an authentication message sent by a terminal device and carrying only a terminal identifier; perform a first identity authentication on the terminal device based on the terminal identifier in the authentication message and using an EAP-AKA algorithm; when the result of the first identity authentication is that the authentication is successful, an authentication response message carrying the result of the first identity authentication and an EAP identity request is fed back to the terminal device; when the result of the first identity authentication is that the authentication is successful, an authentication response message carrying only the result of the first identity authentication is fed back to the terminal device.

[0008] Optionally, the first authentication module is further used to receive an interaction message sent by the terminal device before receiving an authentication message sent by the terminal device that carries only a terminal identifier, wherein the interaction message carries at least a target payload for reflecting that the terminal device supports multiple identity authentications; and to feed back an interaction response message to the terminal device based on the target payload in the interaction message, wherein the interaction response message carries at least payload information required for establishing an IP security tunnel between the first authentication module and the terminal device, and the payload information does not include a traffic selector payload.

[0009] Optionally, the 3A server includes: a second authentication module, wherein the first authentication module is used to receive a first EAP authentication response message carrying a terminal identifier sent by a terminal device, and send a first access request message carrying the terminal identifier to the second authentication module; the second authentication module is used to send a first access challenge message to the first authentication module, wherein the first access challenge message carries the terminal identifier, an EAP list consisting of all versions of EAP supported by the 3A server, and identity information to be obtained; the first authentication module is also used to feedback a first EAP request message to the terminal device based on the terminal identifier in the first access challenge message, wherein the first EAP request message carries the EAP list and identity information to be obtained; the terminal device is also used to select a target EAP supported by itself from the EAP list, determine the target identity information corresponding to the identity information to be obtained, and send the target EAP and the target identity information to the first authentication module through a second EAP response message; the first authentication module is also used to send the target EAP and the target identity information in the second EAP response message to the second authentication module through a second access request message.

[0010] Optionally, the second authentication module is further used to encrypt any random number using the target EAP to obtain a corresponding message verification code; send the random number to the first authentication module through a second challenge message; the first authentication module is further used to send the random number to the terminal device through a second EAP request message; the terminal device is further used to encrypt the random number using the target EAP supported by itself to obtain an encryption result, and send the encryption result to the first authentication module through a second EAP response message; the first authentication module is further used to send the encryption result to the second authentication module through a third access request message; the second authentication module is further used to determine whether the encryption result is the same as the message verification code; when the encryption result is the same as the message verification code, determine that the result of the second identity authentication of the terminal device is successful authentication, and feedback a first access success response message to the first authentication module; when the encryption result is different from the message verification code, determine that the result of the second identity authentication of the terminal device is failed authentication, and feedback a first access failure response message to the first authentication module.

[0011] Optionally, the active ePDG network element interacts with the terminal device based on the IKEv2 protocol; the active ePDG network element interacts with the 3A server based on the Diameter protocol.

[0012] Optionally, the active ePDG network element also includes: a high availability module, wherein the high availability module is used to construct a first IP security tunnel between the terminal device and the active ePDG network element based on Cluster IP; and to construct a second IP security tunnel between multiple ePDG network elements based on Cluster IP.

[0013] According to another aspect of an embodiment of the present application, there is also provided an identity authentication method for a terminal accessing a network, which is applied to a primary ePDG network element in an identity authentication system for a terminal accessing the network, and includes: receiving an authentication message sent by a terminal device, wherein the authentication message carries only a terminal identification of the terminal device; performing a first identity authentication on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is passed, receiving a first EAP authentication response message carrying the terminal identification sent by the terminal device, and sending a first access request message carrying at least the terminal identification to a 3A server, wherein the 3A server is used to perform a second identity authentication on the terminal device according to the terminal identification in the first access request message, and to feed back a first access response message carrying the result of the second identity authentication; and feeding back the identity authentication response message carrying the result of the second identity authentication to the terminal device, wherein the terminal device is used to determine whether to access the communication network according to the result of the second identity authentication.

[0014] Optionally, before receiving the authentication message sent by the terminal device, the method also includes: receiving an interaction message sent by the terminal device, wherein the interaction message carries at least a target payload for reflecting that the terminal device supports multiple identity authentications; and feeding back an interaction response message to the terminal device, wherein the interaction response message carries at least payload information required for establishing an IP security tunnel with the terminal device, and the payload information does not include a traffic selector payload.

[0015] According to another aspect of an embodiment of the present application, there is also provided an identity authentication method for terminal access to a network, which is applied to a 3A server in an identity authentication system for terminal access to the network, and includes: when the result of the first identity authentication performed by the primary ePDG network element on the terminal device is that the authentication is successful, receiving a first access request message carrying a terminal identifier of the terminal device sent by the primary ePDG network element, wherein the primary ePDG network element is used to receive an authentication message sent by the terminal device, and the authentication message only carries the terminal identifier; performing a first identity authentication on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is successful, receiving a first EAP authentication response message carrying the terminal identifier sent by the terminal device; performing a second identity authentication on the terminal device according to the terminal identifier in the first access request message, and feeding back a first access response message carrying the result of the second identity authentication to the primary ePDG network element, wherein the primary ePDG network element is also used to feed back an identity authentication response message carrying the result of the second identity authentication to the terminal device, and the terminal device is used to determine whether to access the communication network according to the result of the second identity authentication.

[0016] According to another aspect of an embodiment of the present application, a network device is further provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned identity authentication method for terminal access to the network through the computer program.

[0017] In an embodiment of the present application, the identity authentication system of the terminal access network includes a primary ePDG network element and multiple backup ePDG network elements, so that when the primary ePDG network element fails, it can smoothly switch to any backup ePDG network element to ensure that the mobile communication service of the terminal is not interrupted. In addition, after the primary ePDG network element successfully performs the first identity authentication on the terminal device, the primary ePDG network element receives the first EAP authentication response message carrying the terminal identification sent by the terminal device, and sends the first access request message carrying the terminal identification to the 3A server; the 3A server can perform a second identity authentication on the terminal device according to the terminal identification information, and feed back the first access response message carrying the result of the second identity authentication to the primary ePDG network element; further, the primary ePDG network element continues to feed back the identity authentication response message carrying the result of the second identity authentication to the terminal device, and the terminal device determines whether to access the communication network based on the result of the second identity authentication, wherein if the result of the second identity authentication is a successful authentication, the terminal device can access the communication network; conversely, if the result of the second identity authentication is a failed authentication, the terminal device cannot access the communication network. Thus, the terminal device, the main ePDG network element and the 3A server complete the double verification of the terminal device through the above-mentioned interactive process, thereby ensuring the terminal's secure access to reinforced authentication. Therefore, the identity authentication system for terminal access network provided by the embodiment of the present application can solve the technical problem that the relevant terminal access network technology lacks the identity authentication of the terminal by the 3A server and the disaster recovery mechanism of the ePDG network element, resulting in poor security and continuity of the terminal communication service. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 is a schematic diagram of the structure of an optional identity authentication system for terminal access to a network according to an embodiment of the present application;

[0020] Figure 2 is an interactive schematic diagram of an optional identity authentication system for terminal access to a network according to an embodiment of the present application;

[0021] Figure 3 It is a flowchart of an optional identity authentication method for a terminal to access a network according to an embodiment of the present application;

[0022] Figure 4 It is a flowchart of another optional identity authentication method for terminal access to a network according to an embodiment of the present application;

[0023] Figure 5It is a schematic diagram of the structure of an optional network device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In addition, the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0027] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0028] VoWiFi (Voice over WiFi) is a telecom-grade basic voice service based on WiFi wireless access, LTE core network and IMS network, carried on the packet network. After the mobile terminal user accesses the communication network, the call is connected after registering on the LTE network and IMS network respectively.

[0029] ePDG (Evolved Packet Data Gateway): As a gateway for untrusted WiFi to access EPC, it provides Wi-Fi users with a secure connection to the Evolved Packet Core (EPC) network and enables seamless mobility between Long Term Evolution (LTE) and Wi-Fi.

[0030] 3GPP AAA: Provides AAA (Authentication, Authorisation, Accounting) functions, allowing non-3GPP access, such as Wi-Fi, to access the operator's EPC (Evolved Packet Core).

[0031] IKEv2 (Internet Key Exchange Version 2) protocol: is a protocol used to establish a secure connection between two peers. It is mainly used in the IPSec tunneling protocol suite. IKEv2 is designed to automatically negotiate and maintain encryption keys used by the protocol while ensuring the security and privacy of data transmission. The protocol supports identity authentication, key exchange, SA (Security Association) negotiation, and key material generation.

[0032] The Diameter protocol is selected by the AAA working group of the IETF (Internet Engineering Task Force) as the next generation AAA protocol standard. The Diameter protocol includes: NAS (Non-Access Stratum) protocol, EAP, MIP (Mobile IP) protocol, CMS (Cryptographic Message Syntax) protocol, etc. The Diameter protocol supports authentication, authorization and billing of mobile IP, NAS requests and mobile agents. The implementation of this protocol is similar to RADIUS, both of which use AVP and attribute value (in the form of Attribute-Length-Value triples) pairs to implement it.

[0033] EAP (Extensible Authentication Protocol): is an authentication framework used in wireless networks or point-to-point protocols. As an authentication framework, EAP can provide some common functions and allow the authentication mechanisms desired by the protocol, which are called EAP methods.

[0034] Example 1

[0035] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example: Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE Frequency Division Duplex (FDD) system, LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system or 5G system, etc.

[0036] For example, the architecture diagram of the identity authentication system for terminal access to the network provided in the embodiment of the present application is as follows: Figure 1 As shown. The system 10 includes: a terminal device 11, a primary ePDG network element 12i and multiple backup ePDG network elements 12j (i, j∈[1,n], and i is not equal to j), a 3A server 13 for providing authentication, authorization, and billing, and multiple ePDG network elements are in a primary and backup relationship with each other. Specifically, each component in the above system 10 can perform authentication operations on the terminal device 11 to be connected to the communication network according to the following process, including:

[0037] First, the active ePDG network element 12i receives the authentication message sent by the terminal device 11. The authentication message only carries the terminal identification of the terminal device 11, such as user name, IP, port and other information.

[0038] Next, the primary ePDG network element 12i performs a first identity authentication on the terminal device 11 according to the authentication message, and when the result of the first identity authentication is that the authentication is passed, receives a first EAP authentication response message carrying the terminal identifier sent by the terminal device, and sends a first access request message carrying the terminal identifier to the 3A server 13;

[0039] Then, the 3A server 13 performs a second identity authentication on the terminal device 11 according to the terminal identifier in the first access request message, and feeds back a first access response message carrying the result of the second identity authentication to the active ePDG network element 12i;

[0040] Then, the active ePDG network element 12i feeds back an identity authentication response message carrying the result of the second identity authentication to the terminal device 11;

[0041] Finally, the terminal device 11 determines whether to access the communication network based on the result of the second identity authentication. If the result of the second identity authentication is successful, the terminal device can access the communication network; otherwise, if the result of the second identity authentication is failed, the terminal device cannot access the communication network.

[0042] It should be noted that the above Figure 1 The system shown is for illustration only and does not limit the structure of the system. The system 10 may include but is not limited to Figure 1 The components shown in .

[0043] The following will combine the above Figure 1 and Figure 2 The terminal access authentication flow chart shown further introduces the composition and functions of each component in the system 10.

[0044] Specifically, as used herein, "terminal equipment" includes but is not limited to connection via a wired line, such as via a Public Switched Telephone Networks (PSTN), a Digital Subscriber Line (DSL), a digital cable, a direct cable connection; and / or another data connection / network; and / or via a wireless interface, such as, for a cellular network, a Wireless Local Area Network (WLAN), a digital television network such as a DVB-H network, a satellite network, an AM-FM broadcast transmitter; and / or a device of another user equipment configured to receive / send communication signals; and / or an Internet of Things (IoT) device. A terminal equipment configured to communicate via a wireless interface may be referred to as a "wireless communication terminal", "wireless terminal" or "mobile terminal". Examples of mobile terminals include, but are not limited to, satellite or cellular telephones; Personal Communications System (PCS) terminals that may combine cellular radiotelephones with data processing, fax, and data communications capabilities; PDAs that may include radiotelephones, pagers, Internet / Intranet access, Web browsers, notepads, calendars, and / or Global Positioning System (GPS) receivers; and conventional laptop and / or palmtop receivers or other electronic devices that include radiotelephone transceivers. A terminal device may refer to an access terminal, user equipment (UE), a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device. The access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network, etc.

[0045] (1) The primary ePDG network element 12i performs a first-level identity authentication on the terminal device 11.

[0046] Specifically, the main ePDG network element 12i interacts with the terminal device 11 using the IKEv2 protocol, and the main ePDG network element 12i includes: a first authentication module 12i1. Therefore, the module 12i1 can negotiate with the first authentication module 12i1 in advance (i.e., IKE_SA_INIT) to establish a security association called IKE_SA. This negotiation process includes making and receiving proposals for encryption and authentication parameters, and performing key exchange. Typically, the IKEv2 protocol can use the Diffie-Hellman key exchange algorithm to ensure that the first authentication module 12i1 and the terminal device 11 can securely exchange encryption keys even in an insecure channel. In addition, in the above-mentioned negotiation stage, the first authentication module 12i1 and the terminal device 11 can verify each other's identity in a variety of ways, such as a pre-shared key (PSK), a digital integer, an EAP method, etc.

[0047] Once the IKE_SA security association is established between the first authentication module 12i1 and the terminal device 11, both parties can perform the first identity authentication on the terminal device 11 in the exchange phase (IKE_AUTH) according to the following process, including:

[0048] Step 1: The first authentication module 12i1 receives an interaction message sent by the terminal device 11, wherein the interaction message carries at least a target payload (Auth_Follow payload) for reflecting that the terminal device supports multiple identity authentications.

[0049] Step 2: The first authentication module 12i1 feeds back an interactive response message to the terminal device 11 based on the target payload in the interactive message, wherein the interactive response message carries at least the payload information required for establishing an IP security tunnel (IPsec) between the first authentication module and the terminal device, and since the TSSA payload (traffic selector) has been pre-configured before the IKE_SA_INIT (negotiation) phase, the payload information contained in the interactive response message will no longer contain the TS SA payload.

[0050] Step 3: The first authentication module 12i1 receives the authentication message sent by the terminal device 11 and carrying only the terminal identification.

[0051] Step 4: The first authentication module 12i1 performs the first identity authentication on the terminal device 11 according to the terminal identifier in the authentication message and adopts the EAP-AKA algorithm. If the result of the first identity authentication is that the authentication is passed, the fifth step is executed; otherwise, the sixth step is executed.

[0052] Step 5: The first authentication module 12i1 feeds back an authentication (success) response message carrying the result of the first identity authentication and the extensible authentication protocol EAP identity request to the terminal device 11.

[0053] Step 6: The first authentication module 12i1 feeds back an authentication (failure) response message carrying only the result of the first identity authentication to the terminal device 11 .

[0054] It should be noted that the first authentication module 12i1 uses the EAP-AKA algorithm to perform the first identity authentication on the terminal device 11, which is a prior art, and this application will not elaborate on the authentication process.

[0055] (2) The 3A server 13 performs a second level of identity authentication on the terminal device 11 .

[0056] Specifically, the 3A server 13 and the primary ePDG network element 12i interact with each other using the Diameter protocol, and the 3A server 13 includes: a second authentication module 131. Therefore, the first authentication module 12i1 in the primary ePDG network element 12i interacts with the second authentication module 131 in the 3A server 13 using the Diameter protocol, and the first authentication module 12i1 in the primary ePDG network element 12i interacts with the terminal device 11 using the IKEv2 protocol.

[0057] Since the 3A server 13 does not include information related to the terminal device 11, before performing the second identity authentication, the second authentication module 131, the first authentication module 12i1, and the terminal device 11 can interact according to the following process, so that the 3A server 13 first obtains information related to the terminal device 11, including:

[0058] First, the first authentication module 12i1 receives an EAP authentication response message carrying a terminal identifier sent by the terminal device 11 , and sends a first access request message carrying a terminal identifier to the second authentication module 131 .

[0059] Next, the second authentication module 131 sends a first access challenge message to the first authentication module 12i1, wherein the first access challenge message carries the terminal identification, an EAP list (Version_List) consisting of all versions of EAP supported by the 3A server, and identity information to be obtained (Fullauth_ID).

[0060] Then, the first authentication module 12i1 feeds back a first EAP request message to the terminal device 11 according to the terminal identifier in the first access challenge message, wherein the first EAP request message carries the EAP list and the identity information to be obtained.

[0061] Then, the terminal device 11 selects the target EAP supported by itself from the EAP list, and determines the target identity information corresponding to the identity information to be obtained, and sends the target EAP and target identity information to the first authentication module 12i1 through a second EAP response message, wherein the target identity information can be in the form of an international mobile subscriber identity (International MobileSubscriber Identity, IMSI), a temporary mobile subscriber identity (Temporary Mobile SubscriberIdentity, TMSI), a (4G / 5G) globally unique temporary identifier (Globally Unique Temporary Identifier GUTI), etc.

[0062] Finally, the first authentication module 12i1 sends the target EAP and target identity information in the second EAP response message to the second authentication module 131 through the second access request message.

[0063] Furthermore, the second authentication module 131, the first authentication module 12i1, and the terminal device 11 may interact according to the following process so that the 3A server 13 completes the identity authentication of the terminal device 11, including:

[0064] Step 1: The second authentication module 131 uses the target EAP to encrypt any random number (AT_Rand) to obtain the corresponding message authentication code (AT_Autn);

[0065] Step 2: The second authentication module 131 sends a random number (AT_Rand) to the first authentication module 12i1 through a second challenge message;

[0066] Step 3: The first authentication module 12i1 sends the random number to the terminal device 11 through a second EAP request message;

[0067] Step 4: The terminal device 11 encrypts the random number using the target EAP supported by itself to obtain an encryption result;

[0068] Step 5: The terminal device 11 sends the encryption result to the first authentication module 12i1 through a second EAP response message;

[0069] Step 6: The first authentication module 12i1 sends the encryption result to the second authentication module 131 through the third access request message;

[0070] Step 7: The second authentication module 131 determines whether the encryption result is the same as the message authentication code, wherein if they are the same, the eighth step is executed, otherwise the ninth step is executed:

[0071] Step 8: The second authentication module 131 determines that the result of the second identity authentication of the terminal device is successful, and feeds back a first access success response message to the first authentication module 12i1;

[0072] Step 9: The second authentication module 131 determines that the result of the second identity authentication of the terminal device is authentication failure, and feeds back a first access failure response message to the first authentication module 12i1.

[0073] As an optional implementation, the above-mentioned main ePDG network element 12i also includes: a high-availability module 12i2, wherein the module 12i can build a first IP security tunnel between the terminal device 11 and the main ePDG network element 12i based on Cluster IP; and build a second IP security tunnel between multiple ePDG network elements (12i, 122, ..., 12i) based on Cluster IP.

[0074] That is to say, the above-mentioned high-availability module 12i2 adopts the active-standby ePDG disaster recovery backup mechanism. When the active ePDG network element fails, all communication links, service message contexts, etc. are switched to the standby ePDG network element, so that the standby ePDG network element automatically takes over all existing IKE_SA and Child_SA, thereby ensuring that the interface communication between the ePDG network element 12 and UE11 and the interface communication between the ePDG network element 12 and the 3A server 13 are not interrupted.

[0075] Based on the above system architecture, it can be known that the ePDG network element in the identity authentication system of the terminal access network adopts a master-slave disaster recovery mechanism, so that when the main ePDG network element 12i fails, it can smoothly switch to any backup ePDG network element to ensure that the mobile communication service of the terminal device 11 is not interrupted. In addition, after the primary ePDG network element 12i successfully performs the first identity authentication on the terminal device 11, the primary ePDG network element 12i receives the first EAP authentication response message carrying the terminal identification sent by the terminal device 11, and sends the first access request message carrying the terminal identification to the 3A server 13; the 3A server 13 can perform the second identity authentication on the terminal device according to the terminal identification information, and feed back the first access response message carrying the result of the second identity authentication to the primary ePDG network element 12i; further, the primary ePDG network element 12i continues to feed back the identity authentication response message carrying the result of the second identity authentication to the terminal device 11, and the terminal device 11 determines whether to access the communication network according to the result of the second identity authentication, wherein if the result of the second identity authentication is authentication success, the terminal device can access the communication network; conversely, if the result of the second identity authentication is authentication failure, the terminal device cannot access the communication network. Thus, the terminal device 11, the primary ePDG network element 12i and the 3A server 131 complete the double verification of the terminal device through the above-mentioned interactive process, thereby ensuring the secure access of the terminal device to the reinforced authentication. Therefore, the system 10 provided in the embodiment of the present application can solve the technical problem that the relevant terminal access network technology lacks 3A server identity authentication for the terminal and the disaster recovery mechanism of the ePDG network element, resulting in poor security and continuity of the terminal communication service.

[0076] Example 2

[0077] The embodiment of the present application also provides an identity authentication method for a terminal accessing a network of a primary ePDG network element among multiple ePDG network elements. Figure 3 FIG. 1 is a flow chart of an optional method for authenticating a terminal accessing a network according to an embodiment of the present application. Figure 3 As shown, the method at least includes steps S302-S306, wherein:

[0078] Step S302: receiving an authentication message sent by a terminal device.

[0079] The above authentication message only carries the terminal identification of the terminal device.

[0080] It should be noted that before receiving the authentication message sent by the terminal device, the primary ePDG network can also receive the interaction message sent by the terminal device, wherein the interaction message carries at least a target payload for reflecting that the terminal device supports multiple identity authentications; and based on the target payload in the interaction message, an interaction response message is fed back to the terminal device, wherein the interaction response message carries at least the payload information required to establish an IP security tunnel with the terminal device, and the payload information does not include a traffic selector payload.

[0081] Step S304: Perform a first identity authentication on the terminal device according to the authentication message, and if the result of the first identity authentication is authentication passed, receive a first EAP authentication response message carrying the terminal identifier sent by the terminal device, and send a first access request message carrying the terminal identifier to the 3A server.

[0082] Among them, the primary ePDG network element performs the first identity authentication on the terminal device 11 based on the terminal identifier and the EAP-AKA algorithm, wherein the first identity authentication on the terminal device 11 using the EAP-AKA algorithm is a prior art, and this application will not elaborate on the authentication process. The above-mentioned 3A server can perform a second identity authentication on the terminal device based on the terminal identifier in the first access request message, and feedback a first access response message carrying the result of the second identity authentication.

[0083] Step S306: Feedback an identity authentication response message carrying the result of the second identity authentication to the terminal device.

[0084] Among them, the above-mentioned terminal device can determine whether to access the communication network based on the result of the second identity authentication. When the result of the second identity authentication is successful, the communication network can be accessed; when the result of the second identity authentication is successful, the communication network cannot be accessed.

[0085] Example 3

[0086] The embodiment of the present application also provides an identity authentication method for a terminal accessing a network applied to a 3A server. Figure 4 FIG. 1 is a flow chart of an optional method for authenticating a terminal accessing a network according to an embodiment of the present application. Figure 4 As shown, the method at least includes steps S402-S404, wherein:

[0087] Step S402: When the result of the first identity authentication performed by the active ePDG network element on the terminal device is that the authentication is successful, a first access request message carrying the terminal identifier sent by the active ePDG network element is received.

[0088] Among them, the main ePDG network element can receive the authentication message sent by the terminal device, and the authentication message only carries the terminal identification of the terminal device; the first identity authentication is performed on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is passed, the first EAP authentication response message carrying the terminal identification sent by the terminal device is received.

[0089] Step S404: Perform a second identity authentication on the terminal device according to the terminal identifier in the first access request message, and feed back a first access response message carrying the result of the second identity authentication to the active ePDG network element.

[0090] Among them, the active ePDG network element can feed back an authentication response message carrying the result of the second authentication to the terminal device, and the terminal device is used to determine whether to access the communication network based on the result of the second authentication.

[0091] Example 3

[0092] According to an embodiment of the present application, a network device is also provided, wherein: Figure 5 is a schematic diagram of the structure of an optional network device according to an embodiment of the present application, such as Figure 5 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the identity authentication method for terminal access to the network or the identity authentication method for terminal access to the network in the above-mentioned embodiment 2 when running.

[0093] Optionally, the processor is configured to execute the following steps through a computer program: receiving an authentication message sent by a terminal device, wherein the authentication message carries only a terminal identifier of the terminal device; performing a first identity authentication on the terminal device based on the authentication message, and when the result of the first identity authentication is that the authentication is passed, receiving a first EAP authentication response message sent by the terminal device carrying the terminal identifier, and sending a first access request message carrying at least the terminal identifier to a 3A server, wherein the 3A server is used to perform a second identity authentication on the terminal device based on the terminal identifier in the first access request message, and feed back a first access response message carrying the result of the second identity authentication; and feeding back the identity authentication response message carrying the result of the second identity authentication to the terminal device, wherein the terminal device is used to determine whether to access the communication network based on the result of the second identity authentication.

[0094] Optionally, the processor is configured to execute the following steps through a computer program: when the result of the first identity authentication performed by the primary ePDG network element on the terminal device is that the authentication is successful, receiving a first access request message carrying the terminal identifier sent by the primary ePDG network element, wherein the primary ePDG network element is used to receive an authentication message sent by the terminal device, and the authentication message only carries the terminal identifier of the terminal device; performing a first identity authentication on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is successful, receiving a first EAP authentication response message carrying the terminal identifier sent by the terminal device; performing a second identity authentication on the terminal device according to the terminal identifier in the first access request message, and feeding back a first access response message carrying the result of the second identity authentication to the primary ePDG network element, wherein the primary ePDG network element is also used to feed back an authentication response message carrying the result of the second identity authentication to the terminal device, and the terminal device is used to determine whether to access the communication network based on the result of the second identity authentication.

[0095] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0096] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0098] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0099] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0100] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0101] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An identity authentication system for a terminal to access a network, characterized in that: The system includes: a terminal device, a primary evolved packet data gateway ePDG network element and multiple standby ePDG network elements, and a 3A server for providing authentication, authorization, and billing, wherein: The primary ePDG network element is configured to receive an authentication message sent by the terminal device, wherein the authentication message carries only the terminal identifier of the terminal device; perform a first identity authentication on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is passed, receive a first extensible authentication protocol EAP authentication response message sent by the terminal device carrying the terminal identifier, and send a first access request message carrying the terminal identifier to the 3A server; The 3A server is configured to perform a second identity authentication on the terminal device according to the terminal identifier in the first access request message, and feed back a first access response message carrying a result of the second identity authentication to the primary ePDG network element; The primary ePDG network element is further used to feed back an authentication response message carrying the result of the second authentication to the terminal device, wherein the terminal device is used to determine whether to access the communication network based on the result of the second authentication.

2. The system according to claim 1, characterized in that The primary ePDG network element includes: a first authentication module, wherein: The first authentication module is used to receive an authentication message sent by the terminal device and carrying only the terminal identifier; perform a first identity authentication on the terminal device based on the terminal identifier in the authentication message and using the extensible authentication protocol and authentication and key agreement EAP-AKA algorithm; if the result of the first identity authentication is that the authentication is successful, an authentication response message carrying the result of the first identity authentication and an EAP identity request is fed back to the terminal device; if the result of the first identity authentication is that the authentication is successful, an authentication response message carrying only the result of the first identity authentication is fed back to the terminal device.

3. The system according to claim 2, characterized in that The first authentication module is further used to receive an interaction message sent by the terminal device before receiving an authentication message sent by the terminal device that only carries the terminal identifier, wherein the interaction message carries at least a target payload for reflecting that the terminal device supports multiple identity authentications; and to feed back an interaction response message to the terminal device based on the target payload in the interaction message, wherein the interaction response message carries at least payload information required for establishing an IP security tunnel between the first authentication module and the terminal device, and the payload information does not include a traffic selector payload.

4. The system according to claim 2, characterized in that The 3A server includes: a second authentication module, wherein: The first authentication module is configured to receive a first EAP authentication response message carrying the terminal identifier sent by the terminal device, and send a first access request message carrying the terminal identifier to the second authentication module; The second authentication module is used to send a first access challenge message to the first authentication module, wherein the first access challenge message carries the terminal identifier, an EAP list consisting of all versions of EAP supported by the 3A server, and identity information to be obtained; The first authentication module is further configured to feed back a first EAP request message to the terminal device according to the terminal identifier in the first access challenge message, wherein the first EAP request message carries the EAP list and the identity information to be obtained; The terminal device is further configured to select a target EAP supported by the terminal device from the EAP list, and determine target identity information corresponding to the identity information to be obtained; and send the target EAP and the target identity information to the first authentication module via a second EAP response message; The first authentication module is further configured to send the target EAP and target identity information in the second EAP response message to the second authentication module via a second access request message.

5. The system according to claim 4, characterized in that The second authentication module is further configured to encrypt any random number using the target EAP to obtain a corresponding message verification code; and send the random number to the first authentication module via a second challenge message; The first authentication module is further configured to send the random number to the terminal device through a second EAP request message; The terminal device is further configured to encrypt the random number using a target EAP supported by the terminal device to obtain an encryption result, and send the encryption result to the first authentication module through a second EAP response message; The first authentication module is further configured to send the encryption result to the second authentication module via a third access request message; The second authentication module is also used to determine whether the encryption result is the same as the message verification code; when the encryption result is the same as the message verification code, determine that the result of the second identity authentication of the terminal device is successful authentication, and feedback a first access success response message to the first authentication module; when the encryption result is different from the message verification code, determine that the result of the second identity authentication of the terminal device is failed authentication, and feedback a first access failure response message to the first authentication module.

6. The system according to claim 1, characterized in that The primary ePDG network element and the terminal device interact based on the IKEv2 protocol; The active ePDG network element interacts with the 3A server based on the Diameter protocol.

7. The system according to claim 1, characterized in that The main ePDG network element also includes: a high availability module, wherein: The high availability module is used to construct a first IP security tunnel between the terminal device and the active ePDG network element based on Cluster IP; and to construct a second IP security tunnel between each of the ePDG network elements based on Cluster IP.

8. A method for authenticating a terminal accessing a network, characterized in that: The method is applied to a primary ePDG network element in an identity authentication system for a terminal access network, and includes: Receiving an authentication message sent by a terminal device, wherein the authentication message carries only a terminal identifier of the terminal device; performing a first identity authentication on the terminal device according to the authentication message, and if the result of the first identity authentication is authentication success, receiving a first EAP authentication response message carrying the terminal identifier sent by the terminal device, and sending a first access request message carrying at least the terminal identifier to the 3A server, wherein the 3A server is used to perform a second identity authentication on the terminal device according to the terminal identifier in the first access request message, and feeding back a first access response message carrying the result of the second identity authentication; An identity authentication response message carrying the result of the second identity authentication is fed back to the terminal device, wherein the terminal device is used to determine whether to access the communication network according to the result of the second identity authentication.

9. The method according to claim 8, characterized in that Before receiving the authentication message sent by the terminal device, the method further includes: Receiving an interaction message sent by the terminal device, wherein the interaction message carries at least a target payload for reflecting that the terminal device supports multiple identity authentications; An interactive response message is fed back to the terminal device, wherein the interactive response message carries at least the load information required for establishing an IP security tunnel with the terminal device, and the load information does not include a traffic selector load.

10. A method for authenticating a terminal accessing a network, characterized in that: The method is applied to a 3A server in an identity authentication system for a terminal to access a network, and includes: When the result of the first identity authentication performed by the primary ePDG network element on the terminal device is that the authentication is passed, receiving a first access request message carrying the terminal identifier of the terminal device sent by the primary ePDG network element, wherein the primary ePDG network element is used to receive an authentication message sent by the terminal device, and the authentication message only carries the terminal identifier; performing a first identity authentication on the terminal device according to the authentication message, and when the result of the first identity authentication is that the authentication is passed, receiving a first EAP authentication response message carrying the terminal identifier sent by the terminal device; The terminal device is authenticated for the second time based on the terminal identifier in the first access request message, and the first access response message carrying the result of the second authentication is fed back to the primary ePDG network element, wherein the primary ePDG network element is also used to feed back the authentication response message carrying the result of the second authentication to the terminal device, and the terminal device is used to determine whether to access the communication network based on the result of the second authentication.

11. A network device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program, when running, executes the identity authentication method for terminal access to a network as described in any one of claims 8 to 10.

Images