Authentication method and device

Abstract

The embodiment of the invention provides an authentication method and device, the method is applied to a message system, and the method specifically comprises the following steps: when a cloud mobile phone server receives a first authentication request which is sent by a service server and is used for requesting GBA authentication information, receiving a second authentication request which is sent by the cloud mobile phone server and is used for requesting to obtain general authentication mechanism GBA authentication information; sending a third authentication request to the BSF server based on the SIM card identifier; gBA authentication information sent by the BSF server is received; and sending the GBA authentication information to the cloud mobile phone server, thereby enabling the cloud mobile phone server to send a fourth authentication request carrying the GBA authentication information to the business server, and enabling the business server to carry out GBA authentication on the cloud mobile phone based on the GBA authentication information. According to the embodiment of the invention, the problem that a terminal without an SIM card can use GBA authentication is solved.

Description

Technical Field

[0001] The present application belongs to the technical field of cloud phone general authentication mechanism (General Bootstrapping Architecture, GBA), and in particular, relates to an authentication method and device. Background Art

[0002] In a mobile network environment, when a user uses a terminal to access certain services, the service provider can use the General Bootstrapping Architecture (GBA) technology based on the Subscriber Identity Module (SIM card) to reliably authenticate the user's identity to ensure that the user can access the service reasonably.

[0003] In the prior art, GBA authentication is generally implemented based on a terminal carrying a SIM card with a preset secret key and a service server of a service provider through the HyperText Transfer Protocol (HTTP). However, this method only performs GBA authentication on the terminal with a SIM card to complete the legitimacy verification of the user identity, and cannot use GBA authentication to complete the legitimacy verification of the user identity for a third-party device that does not carry a SIM card. Summary of the invention

[0004] The embodiments of the present application provide an authentication method and device, which solve the problem that a terminal without a SIM card can use GBA authentication.

[0005] In a first aspect, an embodiment of the present application provides an authentication method, which is applied to a message system, and the method includes:

[0006] In the case where the cloud phone server receives a first authentication request for requesting GBA authentication information sent by the service server, receiving a second authentication request for requesting to obtain GBA authentication information sent by the cloud phone server, the second authentication request includes a SIM card identifier, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server;

[0007] Based on the SIM card identifier, send a third authentication request to the BSF server, where the third authentication request includes an authentication request parameter;

[0008] receiving GBA authentication information sent by the BSF server, where the GBA authentication information is determined based on authentication request parameters;

[0009] GBA authentication information is sent to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

[0010] In a second aspect, an authentication method is provided, which is applied to a cloud phone server, and the method includes:

[0011] When the cloud phone server receives the first authentication request for requesting GBA authentication information sent by the service server, a second authentication request for requesting to obtain GBA authentication information is sent to the message system, the second authentication request includes the SIM card identifier, so that the message system sends a third authentication request to the BSF server based on the SIM card identifier, the third authentication request includes authentication request parameters, and receives GBA authentication information sent by the BSF server, the GBA authentication information is determined based on the authentication request parameters, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server;

[0012] Receive GBA authentication information sent by the message system;

[0013] A fourth authentication request carrying the GBA authentication information is sent to the business server, so that the business server can perform GBA authentication on the cloud phone based on the GBA authentication information.

[0014] In a third aspect, an authentication device is provided, which is applied to a message system, and the device includes:

[0015] A receiving module, configured to receive a second authentication request sent by the cloud phone server for requesting to obtain GBA authentication information when the cloud phone server receives a first authentication request sent by the service server for requesting GBA authentication information, wherein the second authentication request includes a SIM card identifier, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server;

[0016] A sending module, configured to send a third authentication request to the BSF server based on the SIM card identifier, where the third authentication request includes authentication request parameters;

[0017] The receiving module is further used to receive GBA authentication information sent by the BSF server, where the GBA authentication information is determined based on the authentication request parameters;

[0018] The sending module is also used to send GBA authentication information to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

[0019] In a fourth aspect, an authentication device is provided, which is applied to a cloud phone server, and the device includes:

[0020] A sending module, configured to send a second authentication request for requesting GBA authentication information to a message system when the cloud phone server receives a first authentication request for requesting GBA authentication information sent by a service server, the second authentication request including a SIM card identifier, so that the message system sends a third authentication request to a BSF server based on the SIM card identifier, the third authentication request including authentication request parameters, and receives GBA authentication information sent by the BSF server, the GBA authentication information is determined based on the authentication request parameters, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server;

[0021] A receiving module, used for receiving GBA authentication information sent by a message system;

[0022] The sending module is also used to send a fourth authentication request carrying GBA authentication information to the business server, so that the business server can perform GBA authentication on the cloud phone based on the GBA authentication information.

[0023] In a fifth aspect, an electronic device is provided, comprising: a memory for storing computer program instructions; and a processor for reading and running the computer program instructions stored in the memory to execute the authentication method provided by any optional implementation in the first aspect or the second aspect.

[0024] In a sixth aspect, a computer storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the authentication method provided by any optional implementation in the first aspect or the second aspect is implemented.

[0025] In a seventh aspect, a computer program product is provided, the computer program product comprising a computer program, and when the computer program is executed by a processor, the authentication method provided by any optional implementation in the first aspect or the second aspect is implemented.

[0026] In an embodiment of the present application, the message system can receive a second authentication request sent by the cloud phone server for requesting GBA authentication information when the cloud phone server receives a first authentication request sent by the service server for requesting GBA authentication information of the general authentication mechanism. Since the second authentication request includes a SIM card identifier, the message system can send a third authentication request to the guidance service function BSF server based on the SIM card identifier. The third authentication request may include an authentication request parameter. In this way, after the BSF server determines the GBA authentication information based on the authentication request parameter, the GBA authentication information sent by the BSF server can be received, and the GBA authentication information can be sent to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the service server, so that the service server performs GBA authentication on the cloud phone based on the GBA authentication information. In this way, for a cloud phone that does not carry a SIM card, the GBA authentication information can be obtained by interacting with the BSF server through the message system based on its corresponding SIM card identifier, effectively solving the problem that a terminal without a SIM card can use GBA authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0028] Figure 1 This is one of the flowcharts of an authentication method provided in an embodiment of the present application;

[0029] Figure 2 This is a second flow chart of an authentication method provided in an embodiment of the present application;

[0030] Figure 3 This is a flowchart of an authentication method provided in an embodiment of the present application;

[0031] Figure 4 This is a fourth flow chart of an authentication method provided in an embodiment of the present application;

[0032] Figure 5 It is a structural diagram of an authentication device provided in an embodiment of the present application;

[0033] Figure 6 is a schematic diagram of the structure of another authentication device provided in an embodiment of the present application;

[0034] Figure 7 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0036] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0037] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0038] As described in the background technology, in order to solve the problem that a terminal without a SIM card cannot use GBA authentication in the prior art, the embodiment of the present application provides an authentication method and device. The message system can receive a second authentication request sent by the cloud phone server for requesting GBA authentication information when the cloud phone server receives a first authentication request sent by the service server for requesting GBA authentication information of the general authentication mechanism. Since the second authentication request includes the SIM card identifier, the message system can send a third authentication request to the boot service function BSF server based on the SIM card identifier. The third authentication request may include an authentication request parameter. In this way, after the BSF server determines the GBA authentication information based on the authentication request parameter, the GBA authentication information sent by the BSF server can be received, and the GBA authentication information can be sent to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying GBA authentication information to the service server, so that the service server performs GBA authentication on the cloud phone based on the GBA authentication information. In this way, for a cloud phone without a SIM card, the GBA authentication information can be obtained by interacting with the BSF server through the message system based on its corresponding SIM card identifier, effectively solving the problem that a terminal without a SIM card can use GBA authentication.

[0039] The authentication method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0040] Figure 1 This is one of the flow charts of the authentication method provided in the embodiment of the present application.

[0041] like Figure 1 As shown, the execution subject of the method may be a message system. Based on this, the authentication method provided in the embodiment of the present application may specifically include the following steps:

[0042] S110, when the cloud phone server receives the first authentication request sent by the business server for requesting GBA authentication information, receive the second authentication request sent by the cloud phone server for requesting to obtain GBA authentication information.

[0043] In some embodiments, the second authentication request includes a SIM card identifier, which may refer to a user number, which is not specifically limited herein. In addition, the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server.

[0044] Specifically, when the cloud phone wants to access certain business services, it needs to send a business access request to the business server through the cloud phone server. If the business server determines that the business access request sent by the cloud phone through the cloud phone server does not contain GBA authentication information, it can send a first authentication request to the cloud phone server to request GBA authentication information for GBA authentication, and then the cloud phone server can send a second authentication request to the message system. In this way, the message system can receive the second authentication request sent by the cloud phone server for requesting GBA authentication information when the cloud phone server receives the first authentication request sent by the business server for requesting GBA authentication information.

[0045] S120: Send a third authentication request to the BSF server based on the SIM card identifier.

[0046] In some embodiments, the third authentication request may include authentication request parameters.

[0047] Specifically, since the above-mentioned second authentication request can include a SIM card identifier, the message system can, after receiving the second authentication request, send a third authentication request to the bootstrapping server function (BSF) server based on the SIM card identifier in the second authentication request, so as to interact with the BSF server to obtain GBA authentication information.

[0048] S130, receiving GBA authentication information sent by the BSF server.

[0049] In some embodiments, the GBA authentication information may be determined based on authentication request parameters in the third authentication request.

[0050] Specifically, after the message system sends the third authentication request to the BSF server based on the SIM card identifier in the second authentication request, the BSF server can determine the GBA authentication information based on the authentication request parameters in the third authentication request, and then send the GBA authentication information to the message system. In this way, the message system can receive the GBA authentication information sent by the BSF server.

[0051] S140, sending GBA authentication information to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

[0052] Specifically, after the message system receives the GBA authentication information, the message system can send the GBA authentication information to the cloud phone server. In this way, the cloud phone server can send a fourth authentication request carrying the GBA authentication information to the business server, so that the business server can perform GBA authentication on the cloud phone based on the GBA authentication information.

[0053] More specifically, after the message system receives the GBA authentication information, the message system can send the GBA authentication information to the cloud phone server, so that the cloud phone server can store the GBA authentication information locally and send a fourth authentication request carrying the GBA authentication information to the business server, so that the business server can interact with the BSF server based on the GBA authentication process to obtain verification information for verifying the GBA authentication information, which is essentially also a GBA authentication information. When the verification information is the same as the above GBA authentication information, the cloud phone server and the business server complete the subsequent business process interaction. It should be noted that if the GBA authentication information that the message system can send to the cloud phone server is encrypted information, the cloud phone server needs to use the corresponding key and algorithm to decrypt it.

[0054] In an embodiment of the present application, the message system can receive a second authentication request sent by the cloud phone server for requesting GBA authentication information when the cloud phone server receives a first authentication request sent by the service server for requesting GBA authentication information of the general authentication mechanism. Since the second authentication request includes a SIM card identifier, the message system can send a third authentication request to the guidance service function BSF server based on the SIM card identifier. The third authentication request may include an authentication request parameter. In this way, after the BSF server determines the GBA authentication information based on the authentication request parameter, the GBA authentication information sent by the BSF server can be received, and the GBA authentication information can be sent to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the service server, so that the service server performs GBA authentication on the cloud phone based on the GBA authentication information. In this way, for a cloud phone that does not carry a SIM card, based on the SIM card identifier in the authentication request sent by the cloud phone server corresponding to the cloud phone, the GBA authentication information can be obtained through the interaction between the message system and the BSF server, effectively solving the problem that a terminal without a SIM card can use GBA authentication.

[0055] In one embodiment, the above-mentioned message system may include a message platform and at least one message terminal, and each message terminal carries a SIM card.

[0056] Based on this, the step of sending the third authentication request to the bootstrapping service function BSF server based on the SIM card identifier may specifically include:

[0057] Determining a target message terminal from at least one message terminal through the message platform based on the SIM card identifier;

[0058] A third authentication request is sent to the BSF server through the target message terminal.

[0059] Specifically, since the message system includes a message platform and at least one message terminal, and each message terminal carries a SIM card, based on this, the message system can determine the target message terminal carrying the SIM card corresponding to the above-mentioned SIM card identifier from at least one message terminal through the message platform based on the SIM card identifier, and then send a second authentication request to the BSF server through the target message terminal to request to obtain the corresponding GBA authentication information.

[0060] In this embodiment, when the message system includes a message platform and at least one message terminal carrying a SIM card, the target message terminal corresponding to the SIM card identifier in the second authentication request is first determined, and then the target message terminal can interact with the BSF server to accurately and effectively obtain the GBA authentication information corresponding to the cloud phone.

[0061] In one embodiment, the first authentication request further includes a GBA identifier and an initial authentication request parameter, the initial authentication request parameter includes a SIM card identifier, and the initial authentication request parameter is obtained by encrypting the cloud phone server using the first public key based on a preset encryption algorithm; wherein the preset encryption algorithm may be pre-set based on actual experience, and is not specifically limited here. In addition, the authentication request parameters in the third authentication request may include the initial authentication request parameters herein.

[0062] Based on this, before the target message terminal is determined from at least one message terminal by the message platform based on the SIM card identifier, the authentication method provided in the embodiment of the present application further includes:

[0063] Querying a first private key corresponding to the GBA identifier based on the GBA identifier through the message platform;

[0064] After decrypting the authentication request information using the first private key, the decrypted initial authentication request parameters are obtained.

[0065] Specifically, since the first authentication request also includes a GBA identifier and initial authentication request parameters, the requested authentication information includes a SIM card identifier, and the initial authentication request parameters are obtained after the cloud phone server encrypts the parameters using the first public key based on a preset encryption algorithm, the message system can query the first private key corresponding to the GBA identifier based on the GBA identifier through the message platform, and use the first private key to decrypt the requested authentication information to obtain the decrypted initial authentication request parameters.

[0066] In this embodiment, the initial authentication request parameters can be encrypted before the cloud phone server sends the second authentication request, and then decrypted using a private key through the message system. In this way, the authentication request parameters can be effectively prevented from being tampered with during transmission, thereby ensuring the accuracy of the authentication request parameters.

[0067] In one embodiment, before sending the third authentication request to the BSF server through the target message terminal, the authentication method provided in the embodiment of the present application further includes:

[0068] Sending a fifth authentication request to the target message terminal through the message platform, the fifth authentication request including an initial authentication request parameter and a GBA information flag;

[0069] Based on this, the above-mentioned sending of the third authentication request to the BSF server through the target message terminal includes:

[0070] Identify the GBA information flag bit through the target message terminal and parse to obtain the initial authentication request parameters;

[0071] A third authentication request is sent to the BSF server through the target message terminal.

[0072] Specifically, a fifth authentication request can be sent to the target message terminal through the message platform, and the fifth authentication request includes initial authentication request parameters and GBA information flags. The GBA information flags can then be identified by the target message terminal and the initial authentication request parameters can be parsed to obtain the initial authentication request parameters. Since the authentication request parameters in the third authentication request can be determined based on the initial authentication request parameters, a second authentication request can be sent to the BSF server through the target message terminal.

[0073] In one example, the initial authentication request parameters involved in the embodiment of the present application may include nonce, opaque, realm, nsf_fqdn, and SIM card identifier, wherein the above-mentioned nonce, opaque, and realm are parameters fed back by the service server to the cloud phone server, and nsf_fqdn refers to the access domain name of the service server, that is, the parameter in the first authentication request. The authentication request parameters involved in the embodiment of the present application may include information such as the GBA information flag bit and the operation type of gba_req on the basis of the above-mentioned initial authentication request parameters.

[0074] In this embodiment, after determining the target message terminal, an authentication request can be sent to the target message terminal through the message platform, so that the target message terminal establishes interaction with the BSF server, so that the target message terminal can accurately and effectively obtain GBA authentication information from the BSF server.

[0075] In some embodiments, the fifth authentication request may further include a second public key, which is used to encrypt GBA authentication information by the target message terminal. A second private key corresponding to the second public key is stored in the message platform and is used to decrypt the GBA authentication information sent by the target message terminal.

[0076] It should be noted that in order to realize the GBA authentication of the third-party system http request between the message platform and the message terminal during the message communication process, it is necessary to extend the message protocol and message structure to realize the communication of GBA authentication information. Therefore, the GBA information flag is carried in the XML message body, and the operation type of gba_req, the corresponding operation parameters nonce, opaque, nsf_fqdn and public key public_key are carried in the postback.data of the suggestion button or reply message. Among them, public_key is the public key issued by the message platform to the user's message terminal, and the public key is used to encrypt the GBA authentication information returned by the subsequent message terminal.

[0077] In this embodiment, a public key can be provided in advance to the target message terminal, so that after the target message terminal obtains the GBA authentication information, it can use the public key to encrypt the GBA authentication information, and store the second private key corresponding to the second public key in the message platform for decrypting the GBA authentication information sent by the target message terminal. In this way, the accuracy of the GBA authentication information during transmission can be effectively guaranteed.

[0078] In order to describe the authentication method provided by the embodiment of the present application in detail, in one embodiment, the initial authentication request parameter includes a SIM card identifier; before sending the fifth authentication request to the target message terminal through the message platform, the method further includes:

[0079] Generate a second public key based on a preset key generation function and a SIM card identifier;

[0080] A second private key is generated based on a preset key generation function, a SIM card identifier and a random number.

[0081] The preset key generation function may be preset based on actual experience or circumstances, and is not specifically limited here. For example, the preset key generation function may be a hash function.

[0082] Specifically, since the authentication request information may include the SIM card identifier, based on this, the message system can generate a second public key based on a preset key generation function and the SIM card identifier, and then generate a second private key based on the preset key generation function, the SIM card identifier and a random number.

[0083] In one example, the second public key and the second private key can be generated as follows: the message platform can select the addition clusters W1 and W2 on the elliptic curve, the generator of the W1 cluster is p, the order is q greater than or equal to 2l, where l is the security factor, and the generator of the W2 cluster is p.

[0084] The target message terminal UE1 selects the bilinear mapping e: W1*W2→W2, the hash function F1: {0,1}*→W1*, F2: {0,1}*→Zq*, F3: W2→Zq*, F4: W1→Zq*, selects the master key X∈Zq* in Zq*, and calculates the corresponding public key Y=xP.

[0085] In this way, the token coefficient library constructed by the message platform is {W1, W2, q, p, e, F1, F2, F3, F4, Y}. Based on this, the message platform generates a public token and a private token corresponding to the user ID (corresponding to the above-mentioned SIM card identifier), and its second public key = F1 (ID), the second private key = xF1 (ID), and records and stores them. It should be noted that the above-mentioned public key and private key generation algorithm is based on the elliptic curve algorithm, combining the user login number ID of the 5G message and a fixed random number as the generated secret key, which can then enable different users to have isolated private security encryption content when transmitting GBA authentication information.

[0086] In this embodiment, a second public key can be generated based on a preset key generation function and a SIM card identifier, and then a second private key can be generated based on the preset key generation function, the SIM card identifier and a random number. In this way, by generating an accurate key using the SIM card identifier and a random number, the accuracy of the GBA authentication information during transmission can be effectively guaranteed, and different users can have isolated private security encryption content when transmitting GBA authentication information.

[0087] In order to accurately describe the authentication method provided in the embodiment of the present application, in one embodiment, the step of receiving the GBA authentication information sent by the BSF server may specifically include:

[0088] Receiving GBA authentication information sent by the BSF server through the target message terminal;

[0089] Based on this, the above step of sending the GBA authentication information to the cloud phone server may specifically include:

[0090] Sending GBA authentication information to the message platform through the target message terminal;

[0091] Send GBA authentication information to the cloud phone server through the message platform.

[0092] Specifically, since the message system can include a message platform and at least one message terminal, the message system can receive GBA authentication information sent by the BSF server through the target message terminal, and can send GBA authentication information to the message platform through the target message terminal, and then send GBA authentication information to the cloud phone server through the message platform.

[0093] It should be noted that, in the above embodiment, the GBA authentication information is determined by the BSF server based on the authentication request parameters, and the authentication request parameters may include nonce, opaque, realm, nsf_fqdn, and public_key. In this way, the target message terminal can initiate a GBA authentication request to the BSF server in accordance with the 5G message interface specification, and the BSF server returns a 401 response and carries nonce. Wherein, nonce = "base64 (RAND + AUTN + server specific data)", where base64 refers to the encoding method, RAND is a random number, AUTN is the authentication token number, and server specific data refers to a number unique to the server. The target message terminal calculates and generates RES (response value) based on the shared secret key K and RAND of the BSF server, and re-initiates a GBA authentication request to the BSF server, which carries RES. After the BSF server authenticates and verifies that RES is legal, it generates a B-TID based on RAND, which is a boot transaction identifier, and saves IMPI, IK, and CK, where IMPI is an IP multimedia private identity, IK is an integrity key, and CK is an encryption key. Then the response 200OK is returned to the target message terminal, which carries the B-TID and the validity period of Ks. The target message terminal generates the session key Ks_NAF based on the terminal platform interface specification of the 5G message according to the FQDN. The target message terminal forms the postback field value with authentication information including B-TID, Ks_NAF, the validity period of Ks_NAF, IMPU, etc., and encrypts it with public_key and then uploads it to the 5G message platform. The message body also carries the GBA message flag of the GBA authentication message. Among them, public_key is the public key; GBA authentication information M = {B-TID, RES, Ks_NAF, the validity period of Ks_NAF, IMPI...}GBA related authentication information.

[0094] In this way, after receiving the uplink message, the message platform identifies the GBA message flag bit and parses the type of the message body postback.data as the gba authentication success type. The second private key is used to decrypt the message information to obtain the GBA authentication information M of the target information terminal. Then, the GBA authentication interface of the cloud phone server can be called back by the message platform, and the interface parameters carry the authentication information encrypted with the symmetric key pKey and the SM4 algorithm. In this embodiment, after determining the target message terminal corresponding to the SIM card identifier, the GBA authentication information can be obtained by interacting with the BSF server through the terminal, which effectively solves the problem that terminals without SIM cards can use GBA authentication.

[0095] In some embodiments, the above-mentioned message platform may include a fifth generation mobile communication technology (5th Generation Mobile Networks, 5G) message platform, and accordingly, the above-mentioned message terminal may be a 5G message terminal.

[0096] In this embodiment, when a device such as a cloud phone that does not carry a SIM card needs to perform GBA authentication, the 5G message platform can determine a 5G message terminal carrying a SIM card to replace the cloud phone to interact with the BSF server to obtain GBA authentication information, effectively solving the problem that terminals without SIM cards can use GBA authentication.

[0097] Figure 2 This is the second flow chart of an authentication method provided in an embodiment of the present application.

[0098] like Figure 2 As shown, the execution subject of the method may be a cloud phone server. Based on this, the authentication method may specifically include the following steps:

[0099] S210, when the cloud phone server receives the first authentication request sent by the business server for requesting GBA authentication information, it sends a second authentication request to the message system for requesting to obtain GBA authentication information, so that the message system can send a third authentication request to the BSF server based on the SIM card identifier, and receive the GBA authentication information sent by the BSF server.

[0100] The second authentication request includes the SIM card identifier. In addition, the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server.

[0101] S220, receiving GBA authentication information sent by the message system.

[0102] S230, sending a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

[0103] Specifically, the cloud phone can send a service access request to the business server through the cloud phone server. The business server can determine whether there is GBA authentication information in the service access request. If the business server determines that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server, it can send the first authentication request to the cloud phone server. In this way, the cloud phone server can send a first authentication request to the message system for requesting to obtain the general authentication mechanism GBA authentication information, so that the message system can send a third authentication request to the bootstrap service function BSF server based on the SIM card identifier included in the second authentication request, and receive the GBA authentication information sent by the BSF server. Then the cloud phone server can receive the GBA authentication information sent by the message system to the cloud phone server, and then can send a fourth authentication request carrying the GBA authentication information to the business server, so that the business server can perform GBA authentication on the cloud phone based on the GBA authentication information.

[0104] In an embodiment of the present application, the cloud phone server can send a first authentication request to the message system for requesting to obtain the GBA authentication information of the general authentication mechanism, and the second authentication request includes a SIM card identifier, so that the message system can send a third authentication request to the guidance service function BSF server based on the SIM card identifier, and receive the GBA authentication information sent by the BSF server, receive the GBA authentication information sent by the message system to the cloud phone server, and send a fourth authentication request carrying the GBA authentication information to the service server, so that the service server can perform GBA authentication on the cloud phone based on the GBA authentication information. In this way, for cloud phones that do not carry SIM cards, the GBA authentication information can be obtained by interacting with the BSF server through the message system based on the corresponding SIM card identifier, effectively solving the problem that terminals without SIM cards can use GBA authentication.

[0105] In one embodiment, sending a first authentication request for requesting to obtain authentication information of a general authentication mechanism GBA to a message system includes:

[0106] Receive business access requests sent by cloud phones;

[0107] Forwarding the service access request to the service server;

[0108] When the service server determines that there is no GBA authentication information in the service access request, a first authentication request sent by the service server is received.

[0109] Specifically, the cloud phone server can receive the service access request sent by the cloud phone and forward the service access request to the service server, and then receive the first authentication request sent by the service server when the service server determines that there is no GBA authentication information in the service access request.

[0110] In this embodiment, the cloud phone server can forward the service access request of the cloud phone to the service server, so as to receive the first authentication request sent by the service server when the service server determines that there is no GBA authentication information in the service access request. In this way, it is possible to accurately and effectively determine whether there is GBA authentication information in the service access request.

[0111] In one embodiment, the message system includes a message platform and at least one message terminal; the sending of the first authentication request for requesting to obtain the general authentication mechanism GBA authentication information to the message system may specifically include:

[0112] Sending a first authentication request to the message platform, so that the message platform determines a target message terminal from at least one message terminal based on the SIM card identifier, and sending a second authentication request to the BSF server through the target message terminal, and receiving GBA authentication information sent by the BSF server through the target message terminal, and sending the GBA authentication information to the message platform through the target message terminal;

[0113] The above S220 may specifically include the following steps:

[0114] The receiving message system sends the GBA authentication information through the message platform.

[0115] Specifically, since the message system includes a message platform and at least one message terminal, and each message terminal carries a SIM card, the cloud phone server can send a first authentication request to the message platform, so that the message platform can determine the target message terminal from at least one message terminal based on the SIM card identifier, and send a second authentication request to the BSF server through the target message terminal, and receive the GBA authentication information sent by the BSF server through the target message terminal, send the GBA authentication information to the message platform through the target message terminal, and then send the GBA authentication information to the cloud phone server through the message platform. In this way, the cloud phone server can receive the GBA authentication information sent by the message system through the message platform.

[0116] In this embodiment, for a cloud phone without a SIM card, the corresponding terminal carrying a SIM card can be determined based on its corresponding SIM card identifier, and the GBA authentication information can be obtained by interacting with the BSF server through the terminal, effectively solving the problem that a terminal without a SIM card can use GBA authentication.

[0117] In some embodiments, the above-mentioned message platform may include a fifth generation mobile communication technology (5th Generation Mobile Networks, 5G) message platform, and accordingly, the above-mentioned message terminal may be a 5G message terminal.

[0118] In this embodiment, when a device such as a cloud phone that does not carry a SIM card needs to perform GBA authentication, the 5G message platform can determine a 5G message terminal carrying a SIM card to replace the cloud phone to interact with the BSF server to obtain GBA authentication information, effectively solving the problem that terminals without SIM cards can use GBA authentication.

[0119] In order to fully describe an authentication method provided in an embodiment of the present application, in a complete embodiment, as shown in FIG. Figure 3 As shown, the authentication method provided in the embodiment of the present application may specifically include the following steps:

[0120] S301, the cloud phone sends a service access request to the cloud phone server.

[0121] S302, the cloud phone server forwards the service access request to the service server.

[0122] S303: The service server queries whether there is GBA authentication information in the service access request.

[0123] S304: When the service access request does not contain GBA authentication information, the service server sends a first authentication request to the cloud phone.

[0124] S305, the cloud phone server sends a second authentication request to the message platform for requesting GBA authentication information.

[0125] S306: Determine a target message terminal from at least one message terminal through the message platform based on the SIM card identifier.

[0126] S307: Send a fifth authentication request to the target message terminal.

[0127] S308: Send a third authentication request to the BSF server through the target message terminal.

[0128] S309: Receive GBA authentication information sent by the BSF server through the target message terminal.

[0129] S310, sending GBA authentication information to the message platform through the target message terminal.

[0130] S311, sending GBA authentication information to the cloud phone server through the message platform.

[0131] S312, the cloud phone server sends a fourth authentication request to the business server.

[0132] S313, the business server authenticates the cloud phone based on the GBA authentication information.

[0133] The specific process of the above S301 to S313 can be found in the above embodiments provided in the embodiments of the present application, and will not be elaborated herein.

[0134] In this embodiment, the cloud phone can send a service access request to the cloud phone server when it wants to access certain business services, and then the cloud phone server can forward the service access request to the business server. In this way, the business server can query whether there is GBA authentication information in the service access request, and send a first authentication request to the cloud phone when there is no GBA authentication information in the service access request. Then the cloud phone server can send a second authentication request for requesting GBA authentication information to the message platform, and determine the target message terminal from at least one message terminal based on the SIM card identifier through the message platform, and then send a third authentication request to the BSF server through the target message terminal, and receive the GBA authentication information sent by the BSF server through the target message terminal, and then send the GBA authentication information to the message platform through the target message terminal. And send the GBA authentication information to the cloud phone server through the message platform, so that the cloud phone can send a fourth authentication request to the business server, so that the business server performs GBA authentication on the cloud phone based on the fourth authentication request. In this way, for cloud phones that do not carry SIM cards, the GBA authentication information can be obtained by interacting with the BSF server through the message system based on its corresponding SIM card identifier, effectively solving the problem that terminals without SIM cards can use GBA authentication.

[0135] Since in the authentication method provided in the embodiment of the present application, the above-mentioned message platform may include a 5G message platform, and accordingly, the above-mentioned message terminal may include a 5G message terminal, based on this, in one embodiment, Figure 4 As shown, the authentication method provided in the embodiment of the present application may specifically include the following steps:

[0136] S401, the cloud phone sends a service access request to the cloud phone server.

[0137] S402, the cloud phone server forwards the service access request to the service server.

[0138] S403: The service server queries whether there is GBA authentication information in the service access request.

[0139] S404: When the service access request does not contain GBA authentication information, the service server sends a first authentication request to the cloud phone server.

[0140] S405, the cloud phone server sends a second authentication request to the 5G message platform to request GBA authentication information.

[0141] S406, determine the target 5G message terminal from at least one 5G message terminal through the 5G message platform based on the SIM card identifier.

[0142] S407, send a fifth authentication request to the target 5G message terminal.

[0143] S408, send a third authentication request to the BSF server through the target 5G message terminal.

[0144] S409, receiving the GBA authentication information sent by the BSF server through the target 5G message terminal.

[0145] S410, sending GBA authentication information to the 5G message platform through the target 5G message terminal.

[0146] S411, send GBA authentication information to the cloud phone server through the 5G message platform.

[0147] S412, the cloud phone server sends a fourth authentication request to the business server.

[0148] S413, the business server authenticates the cloud phone based on the GBA authentication information.

[0149] Specifically, when the cloud phone wants to access certain business services, the cloud phone can send a business access request to the cloud phone server, so that the cloud phone server forwards the business access request to the business server to request access to the business service. However, since the cloud phone does not carry a SIM card, it cannot perform GBA authentication, and accordingly, the business access request does not carry relevant information about GBA authentication.

[0150] Based on this, after receiving the business service request, the business server will query whether there is GBA authentication information in the business service request, and if there is no GBA authentication information in the business access request, the business server will send a first authentication request to the cloud phone server to request GBA authentication information, and then the cloud phone server can send a second authentication request to the 5G message platform to request GBA authentication information. Since the second authentication request can be a SIM card identifier, the 5G message platform can filter out the target 5G message terminal corresponding to the SIM card identifier from at least one 5G message terminal carrying a SIM card, and send a fifth authentication request to the target 5G message terminal.

[0151] In this way, after receiving the fifth authentication request, the target 5G message terminal can send a third authentication request to the BSF server to request the GBA authentication information of the cloud phone. In this way, the target 5G message terminal can receive the GBA authentication information sent by the BSF server and forward the GBA authentication information to the 5G message platform. The 5G message platform can then send the GBA authentication information to the cloud phone server so that the cloud phone server sends a fourth authentication request to the business server, so that the business server can authenticate the cloud phone based on the GBA authentication information.

[0152] In addition, it should be noted that the above-mentioned message platform may also be a fourth generation mobile communication technology (4th Generation Mobile Networks, 4G) message platform, and correspondingly, the above-mentioned message terminal may be a 4G message terminal. The embodiment of the present application is not specifically limited here.

[0153] In this embodiment, when a device such as a cloud phone that does not carry a SIM card needs to perform GBA authentication, the 5G message platform can determine a 5G message terminal carrying a SIM card to replace the cloud phone to interact with the BSF server to obtain GBA authentication information, effectively solving the problem that terminals without SIM cards can use GBA authentication.

[0154] Based on the same inventive concept, the embodiment of the present application also provides an authentication device, which is applied to a message system. Figure 5 The authentication device provided in the embodiment of the present application is described in detail.

[0155] Figure 5 It is a structural diagram of an authentication device provided in an embodiment of the present application.

[0156] like Figure 5 As shown, the authentication device 500 may include:

[0157] The receiving module 510 is used to receive a second authentication request sent by the cloud phone server for requesting to obtain GBA authentication information when the cloud phone server receives a first authentication request sent by the service server for requesting GBA authentication information, wherein the second authentication request includes a SIM card identifier, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server;

[0158] A sending module 520, configured to send a third authentication request to the BSF server based on the SIM card identifier, where the third authentication request includes authentication request parameters;

[0159] The receiving module 510 is further configured to receive GBA authentication information sent by the BSF server, where the GBA authentication information is determined based on the authentication request parameters;

[0160] The sending module 520 is also used to send GBA authentication information to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

[0161] In one embodiment, the message system includes a message platform and each message terminal carries a user identity module SIM card; the authentication method provided in the embodiment of the present application also includes:

[0162] A determination module, used to determine a target message terminal from at least one message terminal based on a SIM card identifier through a message platform;

[0163] The sending module is specifically configured to send a third authentication request to the BSF server through the target message terminal.

[0164] In one embodiment, the first authentication request also includes a GBA identifier and an initial authentication request parameter, the initial authentication request parameter includes a SIM card identifier, and the initial authentication request parameter is obtained by encrypting the cloud phone server using the first public key based on a preset encryption algorithm; based on this, the authentication device provided in the embodiment of the present application also includes:

[0165] A query module, used to query a first private key corresponding to the GBA identifier based on the GBA identifier through the message platform;

[0166] The decryption module is used to decrypt the authentication request information using the first private key to obtain the decrypted initial authentication request parameters.

[0167] In one embodiment, the authentication device provided in the embodiment of the present application may further include:

[0168] The sending module is further used to send a fifth authentication request to the target message terminal through the message platform, wherein the fifth authentication request includes an initial authentication request parameter and a GBA information flag;

[0169] An identification module is used to identify the GBA information flag bit through the target message terminal and parse it to obtain the initial authentication request parameters;

[0170] The sending module is further used to send a third authentication request to the BSF server through the target message terminal, where the third authentication request includes the initial authentication request parameters.

[0171] In one embodiment, the fifth authentication request also includes a second public key, which is used by the target message terminal to encrypt GBA authentication information. A second private key corresponding to the second public key is stored in the message platform and is used to decrypt the GBA authentication information sent by the target message terminal.

[0172] In one embodiment, the initial authentication request parameter includes a SIM card identifier; the authentication device provided in the embodiment of the present application may also include:

[0173] A generating module, used to generate a second public key based on a preset key generating function and a SIM card identifier;

[0174] The generating module is further used to generate a second private key based on a preset key generating function, a SIM card identification and a random number.

[0175] In one embodiment, the receiving module is specifically configured to receive GBA authentication information sent by the BSF server through the target message terminal;

[0176] The sending module is specifically used to send GBA authentication information to the message platform through the target message terminal;

[0177] Send GBA authentication information to the cloud phone server through the message platform.

[0178] In some embodiments, the message platform includes a 5G message platform, and the message terminal includes a 5G message terminal.

[0179] In an embodiment of the present application, the message system can receive a second authentication request sent by the cloud phone server for requesting to obtain the general authentication mechanism GBA authentication information when the cloud phone server receives the first authentication request sent by the service server for requesting the general authentication mechanism GBA authentication information. Since the second authentication request includes the SIM card identifier, the message system can send a third authentication request to the guidance service function BSF server based on the SIM card identifier, and then can receive the GBA authentication information sent by the BSF server, and can send the GBA authentication information to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the service server, so that the service server performs GBA authentication on the cloud phone based on the GBA authentication information. In this way, for a cloud phone that does not carry a SIM card, the message system can interact with the BSF server based on its corresponding SIM card identifier to obtain the GBA authentication information, which effectively solves the problem that a terminal without a SIM card can use GBA authentication.

[0180] Each module in the authentication device provided in the embodiment of the present application can be implemented Figure 1 The method steps of the illustrated embodiment can achieve the corresponding technical effects, and for the sake of brevity, they will not be repeated here.

[0181] Based on the same inventive concept, the embodiment of the present application also provides an authentication device, which is applied to a cloud phone server. Figure 6 The authentication device provided in the embodiment of the present application is described in detail.

[0182] Figure 6 It is a structural diagram of an authentication device provided in an embodiment of the present application.

[0183] like Figure 6 As shown, the authentication device 600 may include:

[0184] The sending module 610 is used to send a second authentication request for requesting to obtain the general authentication mechanism GBA authentication information to the message system when the cloud phone server receives the first authentication request sent by the service server for requesting the general authentication mechanism GBA authentication information, the second authentication request includes the SIM card identifier, so that the message system sends a third authentication request to the boot service function BSF server based on the SIM card identifier, the third authentication request includes the authentication request parameter, and receives the GBA authentication information sent by the BSF server, the GBA authentication information is determined based on the authentication request parameter, and the first authentication request is sent by the service server when it is determined that the cloud phone does not have the GBA authentication information in the service access request sent by the cloud phone through the cloud phone server;

[0185] The receiving module 620 is used to receive the GBA authentication information sent by the message system;

[0186] The sending module 610 is also used to send a fourth authentication request carrying GBA authentication information to the business server, so that the business server can perform GBA authentication on the cloud phone based on the GBA authentication information.

[0187] In one embodiment, the authentication method provided in the embodiment of the present application may also include the following steps:

[0188] The receiving module is also used to receive the service access request sent by the cloud phone;

[0189] A forwarding module, used to forward the service access request to the service server;

[0190] The receiving module is further configured to receive a first authentication request sent by the service server when the service server determines that no GBA authentication information exists in the service access request.

[0191] In one embodiment, the message system includes a message platform and at least one message terminal, each message terminal carries a SIM card; a sending module, specifically used to send a first authentication request to the message platform, so that the message platform determines a target message terminal from at least one message terminal based on a SIM card identifier, and sends a second authentication request to a BSF server through the target message terminal, and receives GBA authentication information sent by the BSF server through the target message terminal, and sends the GBA authentication information to the message platform through the target message terminal;

[0192] The sending module is specifically used to send GBA authentication information to the cloud phone server through the message platform.

[0193] In some embodiments, the message platform includes a 5G message platform, and the message terminal includes a 5G message terminal.

[0194] In an embodiment of the present application, the cloud phone server can send a first authentication request to the message system for requesting to obtain the GBA authentication information of the general authentication mechanism, and the second authentication request includes a SIM card identifier, so that the message system can send a third authentication request to the guidance service function BSF server based on the SIM card identifier, and receive the GBA authentication information sent by the BSF server, receive the GBA authentication information sent by the message system to the cloud phone server, and send a fourth authentication request carrying the GBA authentication information to the service server, so that the service server can perform GBA authentication on the cloud phone based on the GBA authentication information. In this way, for cloud phones that do not carry SIM cards, the GBA authentication information can be obtained by interacting with the BSF server through the message system based on the corresponding SIM card identifier, effectively solving the problem that terminals without SIM cards can use GBA authentication.

[0195] Each module in the authentication device provided in the embodiment of the present application can be implemented Figure 2 The method steps of the illustrated embodiment can achieve the corresponding technical effects, and for the sake of brevity, they will not be repeated here.

[0196] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0197] The electronic device may include a processor 701 and a memory 702 storing computer program instructions.

[0198] Specifically, the processor 701 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0199] The memory 702 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 702 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 702 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 702 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 702 is a non-volatile solid-state memory.

[0200] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0201] The processor 701 implements any one of the authentication methods in the above embodiments by reading and executing computer program instructions stored in the memory 702 .

[0202] In one example, the electronic device may further include a communication interface 703 and a bus 710. Figure 7 As shown, the processor 701, the memory 702, and the communication interface 703 are connected via a bus 710 and communicate with each other.

[0203] The communication interface 703 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0204] Bus 710 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 710 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0205] In addition, in combination with the authentication method in the above embodiment, the embodiment of the present application may provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, the authentication method provided in the embodiment of the present application is implemented.

[0206] An embodiment of the present application also provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the authentication method provided in the embodiment of the present application.

[0207] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0208] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0209] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0210] Aspects of the present disclosure are described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable authentication device to produce a machine so that these instructions executed by the processor of the computer or other programmable authentication device enable the implementation of the functions / actions specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0211] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. An authentication method, characterized in that: Applied to a message system, the method comprises: In the case where the cloud phone server receives a first authentication request for requesting GBA authentication information sent by the service server, receiving a second authentication request for requesting to obtain GBA authentication information sent by the cloud phone server, wherein the second authentication request includes a SIM card identifier, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server; Based on the SIM card identifier, sending a third authentication request to the BSF server, wherein the third authentication request includes an authentication request parameter; receiving GBA authentication information sent by the BSF server, wherein the GBA authentication information is determined based on the authentication request parameter; The GBA authentication information is sent to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

2. The method according to claim 1, characterized in that The message system includes a message platform and at least one message terminal, each of which carries a SIM card; and sending a third authentication request to a bootstrap service function BSF server based on the SIM card identifier includes: Determining, by the message platform, a target message terminal from the at least one message terminal based on the SIM card identifier; A third authentication request is sent to the BSF server through the target message terminal.

3. The method according to claim 2, characterized in that The first authentication request also includes a GBA identifier and an initial authentication request parameter, the initial authentication request parameter includes the SIM card identifier, the initial authentication request parameter is obtained by the cloud phone server after encryption using the first public key based on a preset encryption algorithm, and the authentication request parameter includes the initial authentication request parameter; Before determining the target message terminal from the at least one message terminal based on the SIM card identifier through the message platform, the method further includes: Querying a first private key corresponding to the GBA identifier based on the GBA identifier through the message platform; The initial authentication request parameters are decrypted using the first private key to obtain decrypted initial authentication request parameters.

4. The method according to claim 3, characterized in that Before sending the third authentication request to the BSF server through the target message terminal, the method further includes: Sending a fifth authentication request to the target message terminal through the message platform, wherein the fifth authentication request includes an initial authentication request parameter and a GBA information flag; The sending a third authentication request to the BSF server through the target message terminal includes: Identify the GBA information flag bit through the target message terminal and parse and obtain the initial authentication request parameter; A third authentication request is sent to the BSF server through the target message terminal, where the third authentication request includes the initial authentication request parameter.

5. The method according to claim 4, characterized in that The fifth authentication request also includes a second public key, which is used by the target message terminal to encrypt the GBA authentication information. A second private key corresponding to the second public key is stored in the message platform and is used to decrypt the GBA authentication information sent by the target message terminal.

6. The method according to claim 5, characterized in that The initial authentication request parameter includes a SIM card identifier; before sending the fifth authentication request to the target message terminal through the message platform, the method further includes: Generate a second public key based on a preset key generation function and the SIM card identifier; A second private key is generated based on the preset key generation function, the SIM card identifier and the random number.

7. The method according to claim 2, characterized in that Receive GBA authentication information sent by the BSF server, including: Receiving, through the target message terminal, GBA authentication information sent by the BSF server; Sending the GBA authentication information to the cloud phone server includes: Sending the GBA authentication information to the message platform through a target message terminal; The GBA authentication information is sent to the cloud phone server through the message platform.

8. The method according to any one of claims 2 to 7, characterized in that The message platform includes a 5G message platform, and the message terminal includes a 5G message terminal.

9. An authentication method, characterized in that: Applied to a cloud phone server, the method includes: In the case where the cloud phone server receives the first authentication request for requesting GBA authentication information sent by the service server, a second authentication request for requesting to obtain GBA authentication information is sent to the message system, the second authentication request includes a SIM card identifier, so that the message system sends a third authentication request to the BSF server based on the SIM card identifier, the third authentication request includes authentication request parameters, and receives GBA authentication information sent by the BSF server, the GBA authentication information is determined based on the authentication request parameters, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server; Receiving GBA authentication information sent by the message system; A fourth authentication request carrying the GBA authentication information is sent to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

10. The method according to claim 9, characterized in that Before sending the first authentication request for requesting to obtain GBA authentication information to the message system, the method further includes: Receiving a service access request sent by the cloud phone; forwarding the service access request to the service server; When the service server determines that there is no GBA authentication information in the service access request, a first authentication request sent by the service server is received.

11. The method according to claim 9, characterized in that The message system includes a message platform and at least one message terminal, each of which carries a SIM card; the sending of a first authentication request for requesting to obtain authentication information of a general authentication mechanism GBA to the message system includes sending the first authentication request to the message platform, so that the message platform determines a target message terminal from the at least one message terminal based on the SIM card identifier, and sends a second authentication request to a BSF server through the target message terminal, and receives GBA authentication information sent by the BSF server through the target message terminal, and sends the GBA authentication information to the message platform through the target message terminal; The receiving of GBA authentication information sent by the message system includes: The GBA authentication information is sent by the receiving message system through the message platform.

12. The method according to claim 11, characterized in that The message platform includes a 5G message platform, and the message terminal includes a 5G message terminal.

13. An authentication device, characterized in that: Applied to a message system, the device comprises: A receiving module, configured to receive a second authentication request sent by the cloud phone server for requesting to obtain GBA authentication information when the cloud phone server receives a first authentication request sent by the service server for requesting GBA authentication information, wherein the second authentication request includes a SIM card identifier, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server; A sending module, configured to send a third authentication request to a BSF server based on the SIM card identifier, wherein the third authentication request includes an authentication request parameter; The receiving module is further used to receive GBA authentication information sent by the BSF server, where the GBA authentication information is determined based on the authentication request parameters; The sending module is also used to send the GBA authentication information to the cloud phone server, so that the cloud phone server sends a fourth authentication request carrying the GBA authentication information to the business server, so that the business server performs GBA authentication on the cloud phone based on the GBA authentication information.

14. An authentication device, characterized in that: Applied to a cloud phone server, the device comprises: A sending module, configured to send a second authentication request for requesting GBA authentication information to a message system when the cloud phone server receives a first authentication request for requesting GBA authentication information sent by a service server, wherein the second authentication request includes a SIM card identifier, so that the message system sends a third authentication request to a BSF server based on the SIM card identifier, wherein the third authentication request includes authentication request parameters, and receives GBA authentication information sent by the BSF server, wherein the GBA authentication information is determined based on the authentication request parameters, and the first authentication request is sent by the service server when it is determined that there is no GBA authentication information in the service access request sent by the cloud phone through the cloud phone server; A receiving module, used for receiving the GBA authentication information sent by the message system; The sending module is also used to send a fourth authentication request carrying GBA authentication information to the business server, so that the business server can perform GBA authentication on the cloud phone based on the GBA authentication information.

Images