WO2016155668A1 - 集群系统中应用统一鉴权方法、服务器与终端 - Google Patents

集群系统中应用统一鉴权方法、服务器与终端 Download PDF

Info

Publication number
WO2016155668A1
WO2016155668A1 PCT/CN2016/078339 CN2016078339W WO2016155668A1 WO 2016155668 A1 WO2016155668 A1 WO 2016155668A1 CN 2016078339 W CN2016078339 W CN 2016078339W WO 2016155668 A1 WO2016155668 A1 WO 2016155668A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
network element
token
terminal
server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/078339
Other languages
English (en)
French (fr)
Inventor
魏建苗
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Chengdu TD Tech Ltd
Original Assignee
Chengdu TD Tech Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Chengdu TD Tech Ltd filed Critical Chengdu TD Tech Ltd
Priority to RS20200925A priority Critical patent/RS60661B1/sr
Priority to EP16771423.7A priority patent/EP3267704B1/en
Priority to ES16771423T priority patent/ES2805809T3/es
Publication of WO2016155668A1 publication Critical patent/WO2016155668A1/zh
Priority to US15/721,449 priority patent/US10721230B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/10—Push-to-Talk [PTT] or Push-On-Call services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Definitions

  • the embodiment of the invention relates to a cluster system, in particular to a unified authentication method, a server and a terminal in a cluster system.
  • the cluster system is a dedicated wireless communication system for specific industry applications developed to meet the needs of industry users' command and dispatch.
  • LTE-based broadband cluster system gradually evolves to user-based service management.
  • the account authentication of the account itself exists.
  • the cluster system has SIP authentication and authentication at the Session Initiation Protocol (SIP) level.
  • SIP Session Initiation Protocol
  • the traditional user name and password are used for digest authentication, that is, 401 or 407 messages are challenged and authenticated by username and password. See Request for Comments (RFC) 3261.
  • RRC Request for Comments
  • various application services in the cluster system require authentication for the terminal for security reasons.
  • the user has the authentication authentication of the account itself
  • the cluster service and the voice point call have the SIP authentication authentication
  • the other application services also have their own authentication and authentication
  • the user names and passwords of the various authentication certificates are respectively saved, and the interface will be
  • the presence of username and password information poses a significant threat to security.
  • the embodiment of the present invention provides a unified authentication method, a server, and a terminal in a cluster system.
  • the User ID as a unified identifier of each application service
  • the authentication of each application service and the user login are effectively combined to achieve uniformity. Authentication and authentication, thus improving the security of the cluster system.
  • an embodiment of the present invention provides a method for applying a unified authentication in a cluster system, including:
  • the application service network element of the server receives the registration request sent by the terminal, and the registration request carries a token indicating a unique identity of the user who initiated the registration request and an identity of the user, where the token is assigned by the authentication authentication network element of the server when the user logs in to the terminal;
  • the application service network element of the server registers the terminal according to the identity identifier; and sends the token to the authentication and authentication network element of the server;
  • the authentication and authentication network element of the server performs token authentication on the user according to the token
  • the application service network element of the server performs an application service interaction with the terminal.
  • the method before the application service network element of the server receives the registration request sent by the terminal, the method further includes:
  • the authentication and authentication network element of the server receives the login request sent by the user by using the terminal, and the login request carries the identity identifier;
  • the authentication and authentication network element of the server performs authentication and authentication on the user according to the identity identifier
  • the authentication and authentication network element of the server allocates the token to the user
  • the authentication and authentication network element of the server sends a login response message to the terminal, where the login response message carries the token.
  • the method before the application service network element of the server receives the registration request sent by the terminal, the method further includes:
  • the authentication and authentication network element of the server receives the login request sent by the user by using the terminal, and the login request carries the identity identifier;
  • the authentication and authentication network element of the server performs authentication and authentication on the user according to the identity identifier
  • the authentication and authentication network element of the server allocates the token to the user and configures a token expiration time
  • the authentication and authentication network element of the server sends a login response message to the terminal, where the login response message carries the token and the token expiration time.
  • the third one in the first aspect In an implementation manner, if the token authentication is passed, the application service network element of the server and the terminal perform an application service interaction before:
  • the authentication authentication network element of the server receives a refresh message sent by the terminal before the expiration of the token expiration time
  • the authentication and authentication network element of the server re-allocates the token and the token expiration time for the terminal according to the refresh message.
  • the application service network element of the server is connected to the terminal Before the application service interaction, it also includes:
  • the authentication authentication network element of the server sends a refresh notification to the terminal, so that the terminal acquires a new token and a token expiration time.
  • an embodiment of the present invention provides a method for applying a unified authentication in a cluster system, including:
  • the terminal sends a registration request to the application service network element of the server, where the registration request carries a token and an identity indicating the unique identity of the user who initiated the registration request, so that the application service network element of the server is identified according to the identity Registering the terminal, and sending the token to the authentication and authentication network element of the server, and then the authentication and authentication network element of the server performs token authentication on the user according to the token.
  • the token is allocated by the authentication authentication network element of the server when the user logs in to the terminal;
  • the terminal performs an application service interaction with an application service network element of the application server.
  • the method before the sending, by the terminal, the registration request to the application service network element of the server, the method further includes:
  • the terminal receives a login response message sent by the authentication authentication network element of the server, where the login response message carries the token.
  • the method before the sending, by the terminal, the registration request to the application service network element of the server, the method further includes:
  • the terminal receives a login response message sent by the authentication and authentication network element of the server, where the login response message carries the token and the token expiration time.
  • the application of the terminal and the application server if the token authentication is passed Before the service network element performs application service interaction also includes:
  • the terminal receives the authentication authentication network element of the server, and re-allocates the token and the token expiration time for the terminal according to the refresh message.
  • the application of the terminal and the application server if the token authentication is passed Before the service network element performs application service interaction it also includes:
  • the terminal sends a refresh message to the authentication and authentication network element of the server;
  • the terminal receives the authentication authentication network element of the server, and re-allocates the token and the token expiration time for the terminal according to the refresh message.
  • the embodiment of the present invention provides a server, including: an application service network element and an authentication and authentication network element, where the application service network element receives a registration request sent by the terminal, where the registration request carries an indication to initiate the registration. a token of the unique identity of the user and the identity of the user, the token being assigned by the authentication authentication network element when the user logs in to the terminal;
  • the application service network element registers the terminal according to the identity identifier; and sends the token to the authentication and authentication network element;
  • the authentication and authentication network element performs token authentication on the user according to the token
  • the application service network element performs an application service interaction with the terminal.
  • the method before the application service network element receives the registration request sent by the terminal, the method further includes:
  • the authentication and authentication network element receives a login request sent by the user by using the terminal, where the login request carries the identity identifier;
  • the authentication and authentication network element performs authentication and authentication on the user according to the identity identifier
  • the authentication and authentication network element allocates the token to the user
  • the authentication and authentication network element sends a login response message to the terminal, where the login response message carries the token.
  • the method before the application service network element receives the registration request sent by the terminal, the method further includes:
  • the authentication and authentication network element receives a login request sent by the user by using the terminal, where the login request carries the identity identifier;
  • the authentication and authentication network element performs authentication and authentication on the user according to the identity identifier
  • the authentication and authentication network element allocates the token to the user and configures a token expiration time
  • the authentication and authentication network element sends a login response message to the terminal, where the login response message carries the token and the token expiration time.
  • the application service network element is applied to the terminal if the token authentication is passed Before the service interaction, it also includes:
  • the authentication authentication network element receives a refresh message sent by the terminal before the expiration of the token expiration time
  • the authentication and authentication network element re-allocates the token and the token expiration time for the terminal according to the refresh message.
  • the application service network element is applied to the terminal if the token authentication is passed Before the service interaction, it also includes:
  • the authentication authentication network element sends a refresh notification to the terminal, so that the terminal acquires a new token and a token expiration time.
  • an embodiment of the present invention provides a terminal, including:
  • a sending module where the application service network element of the server sends a registration request, where the registration request carries a token and an identity indicating a unique identity of the user who initiated the registration request, so that the application service network element of the server is
  • the identifier is used to register the terminal, and the token is sent to the authentication authentication network element of the server, and the authentication authentication network element of the server further performs tokens on the user according to the token.
  • the authentication is performed by the authentication authentication network element of the server when the user logs in to the terminal;
  • the interaction module is configured to perform an application service interaction with the application service network element of the application server if the token authentication is passed.
  • the terminal further includes: a first receiving module,
  • the sending module is configured to send a login request to the authentication and authentication network element of the server, before sending the registration request to the application service network element of the server, so that the authentication and authentication network element of the server is according to the
  • the identity identifier authenticates the user, and the login request carries the identity identifier
  • the terminal further includes: a second receiving module
  • the sending module is configured to send a login request to the authentication and authentication network element of the server before sending the registration request to the application service network element of the server, so that the authentication and authentication network element of the server is based on the identity identifier
  • the user performs authentication authentication, and the login request carries the identity identifier
  • the second receiving module is configured to receive a login response message sent by the authentication and authentication network element of the server, where the login response message carries the token and the token expiration time.
  • the sending module is further configured to: if the token authentication is passed, Before the module performs an application service interaction with the application service network element of the application server, sending a refresh message to the authentication and authentication network element of the server before the expiration of the token expires;
  • the second receiving module is configured to receive an authentication authentication network element of the server, and re-allocate the token and the token expiration time for the terminal according to the refresh message.
  • the application of the terminal and the application server if the token authentication is passed Before the service network element performs application service interaction it also includes:
  • the second receiving module is further configured to: when the token authentication is passed, the interaction module and the application service network element of the application server perform an application service interaction, and the authentication authentication network element of the server is determined. a refresh notification sent after the expiration time expires;
  • the sending module is further configured to send a refresh message to the authentication and authentication network element of the server;
  • the second receiving module is further configured to receive an authentication authentication network element of the server, and re-allocate the token and the token expiration time for the terminal according to the refresh message.
  • the unified authentication method, the server and the terminal are applied, and the application service network element of the server receives the registration request sent by the terminal and sends the authentication authentication network element to the server, where the registration request carries the indication to initiate the registration request.
  • the unique token of the user The token is assigned by the authentication authentication network element of the server when the user logs in to the terminal. Then, the authentication authentication network element of the server performs token authentication on the user according to the token. Finally, if After the token authentication is passed, the application service network element of the server interacts with the terminal for the application service.
  • the authentication of each application service network element is performed by the authentication authentication network element of the server successfully obtained by the terminal, and the user ID is used as the unified application for each application service in the cluster communication.
  • the identification, the authentication of each application service and the effective login of the user are combined to achieve unified authentication and authentication, thereby improving the security of the cluster system.
  • Embodiment 1 is a flowchart of Embodiment 1 of a method for unified authentication of application services in a cluster system according to the present invention
  • Embodiment 2 is a flowchart of Embodiment 2 of a method for unified authentication of application services in a cluster system according to the present invention
  • FIG. 3 is a schematic diagram of a process of Embodiment 3 of a unified authentication method for application services in a cluster system according to the present invention
  • Embodiment 4 is a logical framework diagram of Embodiment 4 of applying a unified authentication method in a cluster system according to the present invention
  • Embodiment 5 is a signaling diagram of Embodiment 5 of a unified authentication method for application services in a cluster system according to the present invention
  • FIG. 6 is a signaling diagram of Embodiment 6 of a unified authentication method for application services in a cluster system according to the present invention.
  • Embodiment 7 is a schematic structural diagram of Embodiment 1 of a server according to the present invention.
  • FIG. 8 is a schematic structural diagram of Embodiment 1 of a terminal according to the present invention.
  • FIG. 9 is a schematic structural diagram of Embodiment 2 of a terminal according to the present invention.
  • FIG. 1 is a flowchart of Embodiment 1 of a method for unified authentication of application services in a cluster system according to the present invention.
  • This embodiment is a detailed description of the present invention from the perspective of a server.
  • This embodiment is applicable to an LTE broadband cluster system and requires a unified authentication for each application.
  • the authentication authentication network element of the server may be, for example, an Authentication Authorization Server (AAS) logical network element
  • the application service network element of the server may be, for example, a User Information Server (UIS).
  • AAS Authentication Authorization Server
  • UAS User Information Server
  • the logical network element, the Session Initiation Protocol core (SIP core) logical network element, the Short Data Service (SDS) logical network element, etc. are not limited by the present invention.
  • the embodiment includes the following steps:
  • the application service network element of the server receives the registration request sent by the terminal, where the registration request carries a token indicating the unique identity of the user who initiated the registration request and an identity of the user, where the token is the user.
  • the authentication authentication network element of the server is allocated to the terminal when logging in to the terminal.
  • the server may be, for example, a single sign-on server.
  • the cluster service needs to be performed.
  • the application service network element of the server can be used for application service interaction, so that the application service network element can be legally used.
  • the token is allocated by the authentication and authentication network element of the server when the user logs in to the terminal.
  • the application service network element of the server registers the terminal according to the identity identifier, and sends the registration that carries the token to an application authentication network element of the server to an authentication authentication network element of the server. request.
  • the application service network element of the server After receiving the registration request sent by the terminal, the application service network element of the server registers the end according to the identity identifier, and sends the Token carried in the registration request to the authentication authentication network element of the server, so that the authentication certificate of the server is obtained.
  • the right network element authenticates the user with the Token.
  • the authentication and authentication network element of the server performs token authentication on the user according to the token.
  • the authentication authentication network element of the server After receiving the token sent by the application service network element of the server, the authentication authentication network element of the server performs token authentication on the user according to the token.
  • the application service network element of the server performs an application service interaction with the terminal.
  • the user can perform application service interaction with the application service network element of the server to legally use the service provided by the application service network element.
  • the unified authentication method is applied to the cluster system provided by the embodiment of the present invention.
  • the application service network element of the server receives the registration request sent by the terminal and sends the authentication authentication network element to the server, where the registration request carries the unique identity of the user that initiates the registration request.
  • the token is assigned by the authentication authentication network element of the server when the user logs in to the terminal; then, the authentication authentication network element of the server performs token authentication on the user according to the token; finally, if the token authentication is passed
  • the application service network element of the server interacts with the terminal for application service. In this process, the authentication of each application service network element is performed by the authentication authentication network element of the server successfully obtained by the terminal, and the user ID is used as the unified application for each application service in the cluster communication.
  • the identification, the authentication of each application service and the effective login of the user are combined to achieve unified authentication and authentication, thereby improving the security of the cluster system.
  • the authentication authentication network element of the server before the application service network element of the server receives the registration request sent by the terminal, the authentication authentication network element of the server receives the login request sent by the user through the terminal, and the login request carries the identity identifier; The authentication authentication network element authenticates the user according to the identity identifier; if the authentication authentication is passed, the authentication authentication network element of the server allocates a token to the user; the authentication authentication network element of the server sends a login response message to the terminal, and logs in. The response message carries the token.
  • the authentication and authentication network element of the server receives the login request sent by the user, and the login request carries the identity of the user, such as a User ID and a password (Pass word); Then, the authentication authentication network element of the server authenticates the user according to the User ID Password; if the authentication is passed, the user is assigned a token indicating the unique identity of the user and sends the token to the user through the login response message. terminal.
  • the login request carries the identity of the user, such as a User ID and a password (Pass word);
  • the authentication authentication network element of the server authenticates the user according to the User ID Password; if the authentication is passed, the user is assigned a token indicating the unique identity of the user and sends the token to the user through the login response message. terminal.
  • the authentication authentication network element of the server before the application service network element of the server receives the registration request sent by the terminal, the authentication authentication network element of the server receives the login request sent by the user, and the login request carries the identity identifier of the user; The authentication authentication network element of the server authenticates the user according to the identity identifier; if the authentication authentication passes, the authentication authentication network element of the server allocates the token and the token expiration time to the user, and the request is sent through the login response message. The card and token expiration time are sent to the terminal.
  • Embodiment 2 is a flowchart of Embodiment 2 of a unified authentication method for application services in a cluster system according to the present invention.
  • This embodiment describes the present invention in detail from the perspective of a terminal.
  • This embodiment is applicable to an LTE broadband cluster system and requires a unified authentication for each application. Specifically, the embodiment includes the following steps:
  • the terminal sends a registration request to the application service network element of the server, where the registration request carries a token and an identity identifier indicating the unique identity of the user who initiated the registration request, so that the application service network element of the server is according to the
  • the identity identifier is used to register the terminal, and the token is sent to the authentication authentication network element of the server, and then the authentication authentication network element of the server performs token authentication on the user according to the token.
  • the token is allocated by the authentication authentication network element of the server when the user logs in to the terminal.
  • the terminal performs an application service interaction with an application service network element of the application server.
  • the user can perform application service interaction with the application service network element of the server to legally use the service provided by the application service network element.
  • the unified authentication method is applied to the cluster system provided by the embodiment of the present invention, and the terminal sends a registration request for the registration request carrying token to the application service network element of the server, so that the application service network element of the server sends the registration request to the authentication certificate of the server.
  • the right network element is authenticated by the server.
  • the authentication authentication network element performs token authentication on the user according to the token. If the token authentication is passed, the application service network element of the server interacts with the terminal for application service. In this process, the authentication of each application service network element is The authentication authentication network element of the server that is successfully logged in and obtained by the terminal is used for the token assigned by the terminal.
  • the user ID is used as the unified identifier of each application service in the cluster communication, and the combination of the authentication of each application service and the user login is effective. Up, we have achieved unified authentication, which improves the security of the cluster system.
  • the terminal before sending the registration request to the application service network element of the server, the terminal sends a login request to the authentication and authentication network element of the server, so that the authentication and authentication network element of the server is identified according to the identity.
  • the user is authenticated and authenticated, and the login request carries the identity identifier.
  • the terminal receives the login response message sent by the authentication and authentication network element of the server, and the login response message carries the token.
  • the terminal before sending the registration request to the application service network element of the server, the terminal sends a login request to the authentication and authentication network element of the server, so that the authentication and authentication network element of the server is identified according to the identity.
  • the user is authenticated and authenticated, and the login request carries the identity identifier.
  • the terminal receives the login response message sent by the authentication and authentication network element of the server, and the login response message carries the token and the token expiration time.
  • FIG. 3 is a schematic diagram of a process of Embodiment 3 of a unified authentication method for application services in a cluster system according to the present invention.
  • the authentication authentication network element of the server after the user logs in, the authentication authentication network element of the server performs unified authentication on the application service network elements 1 to n of the server as an example to explain the present invention in detail. Specifically, the following steps are included:
  • the terminal sends a login request to the authentication and authentication network element of the server.
  • the terminal provides a login interface.
  • the terminal enters the login interface, and after inputting the user name and password, sends a login (Log on) request to the server, and the authentication authentication network element of the server receives the login request.
  • the login request may carry a user ID (User ID), etc., and the User ID is used as a unified identifier of each application service in the cluster communication.
  • the authentication and authentication network element of the server sends a token to the terminal.
  • the authentication and authentication network element of the server After receiving the login request and authenticating the user, the authentication and authentication network element of the server allocates a token to the user and sends the token to the terminal.
  • the terminal sends a registration request carrying the token to the application service network element 1.
  • the application service network element 1 sends a token to the authentication and authentication network element to perform token authentication.
  • the application service network element 1 of the server sends a token to the authentication authentication network element of the server for token authentication.
  • the terminal sends a registration request carrying the token to the application service network element 2.
  • the application service network element 2 sends a token to the authentication and authentication network element to perform token authentication.
  • the terminal sends a registration request carrying the token to the application service network element 3.
  • the application service network element 3 sends a token to the authentication and authentication network element to perform token authentication.
  • the authentication authentication network element of the server provides a single sign-on server, and the user authenticates the authentication network element to the server to perform login authentication. After the login is successful, the authentication authentication network element of the server assigns a token to the server. Then, the terminal allocates a token. Each application service network element to the server is registered, and carries the same token. Each application service network element performs token authentication through the token to the authentication and authentication network element. After the authentication is completed, the user can work with the application service network of the server. Only when the application service interaction is performed can the service provided by each application service network element be legally used.
  • the execution of the steps 303, 305, and 307 is not strictly sequential.
  • the terminal may first go to the application service network element 2 or the application service network.
  • the element n (n ⁇ 1) is registered, and then registered to the application service network element 1.
  • the main logical network elements in the server include a User Data Center (UDC), a Multimedia Dispatch Center (MDC), an Evolved Packet Core (EPC), and a Session Initiation Protocol.
  • UDC User Data Center
  • MDC Multimedia Dispatch Center
  • EPC Evolved Packet Core
  • Session Initiation Protocol Session Initiation Protocol core, SIP core
  • SIP core Session Initiation Protocol core
  • UDC has the functions of configuring configuration of account opening data such as users and groups, as well as unified login service, user information service, policy service, security configuration service, etc., which can provide Authentication Authorization Server (AAS) and users.
  • AAS Authentication Authorization Server
  • UIS Information Service
  • QoS Quality of Service Control
  • Security Server User Management, Group Management, etc.
  • AAS is unified
  • the authentication and authentication center provides the user's login management service, the user's application service access address, and the authentication service of each application, and can be used with standard third-party authentication, authorization, and accounting (Authentication, Authorization, Accounting, AAA) services. Docking.
  • UIS can provide address book service, user static data configuration service, user rights profile download service, and group list download service for group use.
  • MDC is service-centric and can provide Push to Talk (PTT server), point-and-call service, cluster service, Push to talk over Cellular (POC) on cellular, and Short Data Service (Short Data Service). , SDS), audio and video services, etc.
  • PTT server Push to Talk
  • POC Push to talk over Cellular
  • SDS Short Data Service
  • the SIP core is a SIP access routing center that provides SIP registration and routing services.
  • SAE System Architecture Evolution
  • A1 is an interface between the UDC and the terminal, and uses Hypertext Transfer Protocol (HTTP)/Signaling Atm Adaptation Layer (SAAL) for communication;
  • A2 is UDC. Interface between the SIP core and the MDC;
  • A3 is the interface between the UDC and the MDC;
  • B1 is the interface between the terminal and the SIP core, which uses SIP for communication;
  • B2 is the interface between the interface between the SIP core and the MDC. It uses SIP to communicate;
  • B3 is the interface between the MDC and the EPC, which can be a Policy and Charging Rules Function (PCRF) interface or an Rx interface;
  • B4 is an interface between the MDC and the EPC.
  • PCRF Policy and Charging Rules Function
  • B5 is an interface between the MDC and the terminal, which can be a media interface.
  • FIG. 5 is a signaling diagram of Embodiment 5 of the application service unified authentication method in the cluster system of the present invention.
  • the authentication authentication network element of the server is AAS
  • the application service network elements of the server are respectively UIS, SIP core or
  • the invention is described in detail by taking the SDS as an example, and specifically includes the following steps:
  • the user initiates a login request.
  • the terminal enters the login page, enters the user name and password, and initiates the login process to send a login request to the AAS.
  • the Log on request carries the user ID.
  • the login request further carries a password (Pass word) and an area location identifier of the area to which the terminal belongs.
  • the AAS authenticates the user and assigns a unique identity token to the user after the authentication is passed.
  • the AAS also stores the correspondence between the User ID and the Area ID.
  • the AAS sends a login response message carrying the token to the terminal.
  • the terminal sends a registration request that carries the token and the user identifier to the UIS.
  • the terminal sends a registration request (Register) carrying the token and the user ID to the UIS.
  • a registration request (Register) carrying the token and the user ID to the UIS.
  • the UIS sends a token to the AAS for token authentication.
  • the UIS sends a token to the AAS for token authentication.
  • the UIS sends a registration response message to the terminal.
  • the UIS After the AAS passes the token authentication of the UIS, the UIS returns a session ID to the terminal, and sends a registration response message to the terminal to notify the terminal that the token authentication is passed.
  • the terminal obtains user rights from the UIS.
  • the terminal obtains the corporate address book from the UIS.
  • the terminal obtains a group information list from the UIS.
  • the terminal requests the UIS to download user profile information, a corporate address book (Address Book) content, a group information list (Group List), etc., wherein the group information list is used for the terminal to perform group scanning. , group join and display, etc.
  • a corporate address book Address Book
  • Group List group information list
  • the protocol may adopt a Hyper Text Transport Protocol (HTTP) or the like, and the present invention is not limited thereto.
  • HTTP Hyper Text Transport Protocol
  • the terminal sends a registration request that carries the token and the user identifier to the SIP core.
  • the terminal If the terminal has the user right and the group list, if the terminal has the cluster right, in this step, the terminal initiates SIP registration with the SIP core, carrying the User ID and the unique identity token obtained after successful login.
  • the SIP core sends a token to the AAS for token authentication.
  • the SIP core After receiving the registration request sent by the terminal, the SIP core sends the token and the User ID carried in the registration request to the AAS, so that the AAS performs token authentication on the user.
  • the SIP core sends a registration response message to the terminal.
  • the SIP core sends a registration response message to the terminal, for example, the SIP core returns a registration 200 OK response to the terminal.
  • the signaling establishment process of the cluster service can be performed between the terminal and the SIP core.
  • the interaction between the terminal and the SIP Core does not specifically distinguish SIP point calls, clusters, short messages, etc. at the application level, and the SIP core application is centrally registered.
  • the protocol may adopt a super-SIP protocol or the like, and the present invention is not limited thereto.
  • the terminal sends a registration request carrying the token and the user identifier to the SDS.
  • the terminal If the terminal has the user right and the group list, if the terminal has the short data service right, the terminal initiates registration with the SDS, carrying the User ID and the unique identity token obtained after successful login.
  • the SDS sends a token to the AAS for token authentication.
  • the SDS After receiving the registration request sent by the terminal, the SDS sends the token and the User ID carried in the registration request to the AAS, so that the AAS performs token authentication on the user.
  • the SDS sends a registration response message to the terminal.
  • the SDS sends a registration response message to the terminal, for example, the SIP core returns a registration command Acknowledgement Character (ACK) to the terminal.
  • ACK Acknowledgement Character
  • the terminal performs short data service interaction with the SDS.
  • the short data service interaction can be performed between the terminal and the SDS.
  • the terminal interacts with the SDS, and the protocol may use an Xml based Messaging And Presence Protocol (XMPP), etc., and the present invention is not limited thereto.
  • XMPP Xml based Messaging And Presence Protocol
  • the interaction between the terminal and the SIP core (ie, steps 510-513) and the terminal and the SDS is not strictly sequential.
  • the terminal may first interact with the SDS. Then the terminal is in the SIP core interaction; or, the terminal only interacts with the SIP core; or, the terminal only interacts with the SDS.
  • FIG. 6 is a signaling diagram of Embodiment 6 of the application service unified authentication method in the cluster system of the present invention.
  • the authentication authentication network element of the server is sent by the receiving terminal. After the login request is performed, after the terminal is authenticated, in addition to assigning a token to the terminal, the token is also assigned a token expiration time, which specifically includes the following steps;
  • the user initiates a login request.
  • the AAS authenticates the user and allocates a token and a token expiration time at time T0.
  • the AAS in addition to assigning a token to the user, the AAS also allocates the token expiration time corresponding to the token.
  • the AAS sends a login response message carrying the token and the expiration time of the token to the terminal.
  • the terminal saves the token and the token expiration time at time T1.
  • the terminal After receiving the login response message, the terminal saves the token and the token expiration time at the current time T1. For example, assuming T0 is 12:00, T1 is 12:01, and the token expiration time is 20 minutes, the token assigned at time T0 will expire at 12:21.
  • the terminal and the UIS perform the authentication authentication and the application service interaction by using the token allocated at the time T0.
  • the terminal performs the application registration before the token expiration time.
  • the terminal registers with the UIS and performs subsequent user profile, address book, and group list downloading. For details, refer to steps 507-509 above, and details are not described herein.
  • the terminal sends a refresh message to the AAS at time T2.
  • the AAS sends a refresh response message carrying the new token and the new token expiration time to the terminal.
  • the terminal may actively send a refresh process to the AAS to obtain a new token and a token expiration time
  • the AAS may send a refresh notification to the terminal, so that the terminal receives the refresh notification when receiving the AAS.
  • the token refresh process is initiated in the AAS. For details, see Step 608.
  • the AAS sends a refresh notification to the terminal at time T3.
  • the AAS sends a refresh notification to the terminal before the token expiration time expires, so that the terminal acquires a new token and token expiration time.
  • T3 T0+token expiration time, following the example in step 604, when T3 is 12:20, the terminal sends a refresh message to the AAS to acquire a new token and token. expire date.
  • the terminal sends a refresh message to the AAS.
  • the terminal sends a refresh message to the AAS to obtain a new token and token expiration time.
  • the AAS sends a refresh response message carrying the new token and the new token expiration time to the terminal.
  • the above steps 608-610 can be regarded as an abnormal protection process, that is, when the terminal is not at T1. Steps 608-610 are initiated when the refresh process is initiated, that is, when the above steps 606, 607 are not performed.
  • the terminal initiates the refresh process and the AAS notifies the terminal to initiate the refresh process as a parallel solution, and the present invention is not limited thereto.
  • the terminal and the SIP core use the newly allocated token for authentication and application service interaction.
  • FIG. 7 is a schematic structural diagram of Embodiment 1 of a server according to the present invention.
  • the server provided in this embodiment can implement various steps of the method applied to the server provided by any embodiment of the present invention.
  • the server provided in this embodiment specifically includes: an application service network element 11 and an authentication and authentication network element 12.
  • the application service network element 11 receives a registration request sent by the terminal, where the registration request carries a token indicating a unique identity of the user who initiated the registration request and an identity identifier of the user, where the token is the When the user logs in to the terminal, the authentication and authentication network element 12 allocates it;
  • the application service network element 11 registers the terminal according to the identity identifier, and sends the token to the authentication authentication network element 12;
  • the authentication and authentication network element 12 performs token authentication on the user according to the token
  • the application service network element 11 performs an application service interaction with the terminal.
  • the server receives the registration request sent by the terminal and sends the registration request sent by the terminal to the authentication authentication network element of the server, where the registration request carries a token indicating the unique identity of the user who initiated the registration request, and the token is
  • the authentication authentication network element of the server allocates it; then, the authentication and authentication network element of the server performs token authentication on the user according to the token; finally, if the token authentication passes, the application service network of the server The element interacts with the terminal for application services.
  • the authentication of each application service network element is performed by the authentication authentication network element of the server successfully obtained by the terminal, and the user ID is used as the unified application for each application service in the cluster communication.
  • the identification, the authentication of each application service and the effective login of the user are combined to achieve unified authentication and authentication, thereby improving the security of the cluster system.
  • the method before the application service network element 11 receives the registration request sent by the terminal, the method further includes:
  • the authentication and authentication network element 12 receives the login request sent by the user through the terminal,
  • the login request carries the identity identifier
  • the authentication and authentication network element 12 performs authentication and authentication on the user according to the identity identifier.
  • the authentication and authentication network element 12 allocates the token to the user
  • the authentication and authentication network element 12 sends a login response message to the terminal, where the login response message carries the token.
  • the method before the application service network element 11 receives the registration request sent by the terminal, the method further includes:
  • the authentication and authentication network element 12 receives a login request sent by the user through the terminal, where the login request carries the identity identifier;
  • the authentication and authentication network element 12 performs authentication and authentication on the user according to the identity identifier.
  • the authentication and authentication network element 12 allocates the token to the user and configures a token expiration time
  • the authentication and authentication network element 12 sends a login response message to the terminal, where the login response message carries the token and the token expiration time.
  • the application service network element 11 further includes:
  • the authentication and authentication network element 12 receives a refresh message sent by the terminal before the expiration of the token expires;
  • the authentication and authentication network element 12 re-allocates the token and the token expiration time for the terminal according to the refresh message.
  • the application service network element 11 further includes:
  • the authentication authentication network element 12 sends a refresh notification to the terminal to enable the terminal to acquire a new token and token expiration time.
  • FIG. 8 is a schematic structural diagram of Embodiment 1 of a terminal according to the present invention.
  • the terminal provided in this embodiment can implement various steps of the method applied to the terminal provided by any embodiment of the present invention.
  • the terminal provided in this embodiment specifically includes:
  • the sending module 21 the application service network element for the server sends a registration request, where the registration request carries a token and an identity indicating the unique identity of the user who initiated the registration request, so that the application service network element of the server is based on The identity identifies the terminal and will
  • the token is sent to the authentication and authentication network element of the server, and the authentication authentication network element of the server performs token authentication on the user according to the token, where the token is the user login
  • the authentication authentication network element of the server is allocated for the terminal;
  • the interaction module 22 is configured to perform an application service interaction with an application service network element of the application server if the token authentication is passed.
  • FIG. 9 is a schematic structural diagram of Embodiment 2 of a terminal according to the present invention. As shown in FIG. 9, the terminal provided in this embodiment is based on the terminal shown in FIG. 8, and further includes: a first receiving module 23,
  • the sending module 21 is configured to send a login request to the authentication and authentication network element of the server before sending the registration request to the application service network element of the server, so that the authentication and authentication network element of the server is
  • the identity identifier performs authentication authentication on the user, and the login request carries the identity identifier
  • the terminal further includes: a second receiving module 24,
  • the sending module 21 is configured to send a login request to the authentication and authentication network element of the server before sending the registration request to the application service network element of the server, so that the authentication and authentication network element of the server is identified according to the identity identifier.
  • the user performs authentication authentication, and the login request carries the identity identifier;
  • the second receiving module 24 is configured to receive a login response message sent by the authentication and authentication network element of the server, where the login response message carries the token and the token expiration time.
  • the sending module 21 is further configured to perform an application service interaction between the interaction module 22 and an application service network element of the application server, if the token authentication is passed. Previously, sending a refresh message to the authentication authentication network element of the server before the expiration of the token expires;
  • the second receiving module 24 is configured to receive an authentication authentication network element of the server, and re-allocate the token and the token expiration time for the terminal according to the refresh message.
  • the method further includes:
  • the second receiving module 24 is further configured to: before the token authentication is passed, the interaction module 22 receives the service before performing an application service interaction with the application service network element of the application server.
  • the authentication authentication network element of the server determines the refresh notification sent after the expiration time expires;
  • the sending module 21 is further configured to send a refresh message to the authentication and authentication network element of the server;
  • the second receiving module 24 is further configured to receive an authentication authentication network element of the server, and re-allocate the token and the token expiration time for the terminal according to the refresh message.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例提供一种集群系统中应用统一鉴权方法、服务器与终端，该方法包括：服务器的应用服务网元接收终端发送的注册请求并发送给认证鉴权网元，注册请求携带指示发起注册请求的用户的唯一身份的令牌，令牌为用户登录终端时服务器的认证鉴权网元为其分配的；然后，认证鉴权网元根据令牌，对用户进行令牌认证；最后，若令牌认证通过，则应用服务网元与终端进行应用服务交互。该过程中，对各应用服务网元的鉴权是通过终端成功登录并获得的认证鉴权网元为其分配的令牌进行的，集群通信中使用该User ID作为各个应用业务的统一标识，各应用服务的鉴权和用户登录有效的结合起来，做到统一鉴权认证，从而提高集群系统的安全性。

Description

集群系统中应用统一鉴权方法、服务器与终端 技术领域
本发明实施例涉及集群系统，尤其涉及一种集群系统中应用统一鉴权方法、服务器与终端。
背景技术
集群系统是一种为满足行业用户指挥调度等需求而开发的面向特定行业应用的专用无线通信系统。
基于长期演进(Long Term Evolution，LTE)的宽带集群系统逐步向以用户为基础的业务管理演进，用户账号注册时本身存在账号的鉴权认证。另外，集群系统在会话初始协议(Session Initiation Protocol，SIP)层面有SIP认证和鉴权，其使用传统的用户名和密码进行摘要认证，即通过用户名和密码进行401或者407消息进行挑战鉴权，详细可参见标准(Request For Comments，RFC)3261；而且，集群系统中各种应用服务出于安全性考虑，也需要对终端进行鉴权认证。
现有技术中，用户本身存在账号的鉴权认证，集群业务、语音点呼有SIP认证鉴权，其它应用服务也有各自的认证鉴权，各种鉴权认证的用户名和密码各自保存，接口中会存在用户名和密码信息，对安全构成很大威胁。
发明内容
本发明实施例提供一种集群系统中应用统一鉴权方法、服务器与终端，通过使用该User ID作为各个应用业务的统一标识，各应用服务的鉴权和用户登录有效的结合起来，做到了统一鉴权认证，从而提高了集群系统的安全性。
第一个方面，本发明实施例提供一种集群系统中应用统一鉴权方法，包括：
服务器的应用服务网元接收终端发送的注册请求，所述注册请求携带 指示发起所述注册请求的用户的唯一身份的令牌和所述用户的身份标识，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
所述服务器的应用服务网元根据所述身份标识对所述终端进行注册；并向所述服务器的认证鉴权网元发送所述令牌；
所述服务器的认证鉴权网元根据所述令牌，对所述用户进行令牌认证；
若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互。
在第一个方面的第一种可能的实现方式中，所述服务器的应用服务网元接收终端发送的注册请求之前，还包括：
所述服务器的认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
若鉴权认证通过，则所述服务器的认证鉴权网元为所述用户分配所述令牌；
所述服务器的认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌。
在第一个方面的第二种可能的实现方式中，所述服务器的应用服务网元接收终端发送的注册请求之前，还包括：
所述服务器的认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
若鉴权认证通过，则所述服务器的认证鉴权网元为所述用户分配所述令牌并配置令牌过期时间；
所述服务器的认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌及所述令牌过期时间。
结合第一个方面的第二种可能的实现方式，在第一个方面的第三种可 能的实现方式中，若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互之前还包括：
所述服务器的认证鉴权网元接收所述终端在所述令牌过期时间到期之前发送的刷新消息；
所述服务器的认证鉴权网元根据所述刷新消息，为所述终端重新分配令牌和令牌过期时间。
结合第一个方面的第二种可能的实现方式，在第一个方面的第四种可能的实现方式中，若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互之前还包括：
所述服务器的认证鉴权网元向所述终端发送刷新通知，以使所述终端获取新的令牌和令牌过期时间。
第二个方面，本发明实施例提供一种集群系统中应用统一鉴权方法，包括：
终端向服务器的应用服务网元发送注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌及身份标识，以使所述服务器的应用服务网元根据所述身份标识对所述终端进行注册，并将所述令牌发送给所述服务器的认证鉴权网元，进而由所述服务器的认证鉴权网元根据令牌，对所述用户进行令牌认证，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互。
在第二个方面的第一种可能的实现方式中，所述终端向服务器的应用服务网元发送注册请求之前，还包括：
所述终端向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
所述终端接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌。
在第二个方面的第二种可能的实现方式中，所述终端向服务器的应用服务网元发送注册请求之前，还包括：
所述终端向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
所述终端接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌和令牌过期时间。
结合第二个方面的第二种可能的实现方式，在第二个方面的第三种可能的实现方式中，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
所述终端在所述令牌过期时间到期之前向所述服务器的认证鉴权网元发送刷新消息；
所述终端接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
结合第二个方面的第二种可能的实现方式，在第二个方面的第四种可能的实现方式中，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
所述终端接收所述服务器的认证鉴权网元在判断出所述生效时间过期后发送的刷新通知；
所述终端向所述服务器的认证鉴权网元发送刷新消息；
所述终端接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
第三个方面，本发明实施例提供一种服务器，包括：应用服务网元与认证鉴权网元，所述应用服务网元接收终端发送的注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌和所述用户的身份标识，所述令牌为所述用户登录所述终端时所述认证鉴权网元为其分配的；
所述应用服务网元根据所述身份标识对所述终端进行注册；并向所述认证鉴权网元发送所述令牌；
所述认证鉴权网元根据所述令牌，对所述用户进行令牌认证；
若所述令牌认证通过，则所述应用服务网元与所述终端进行应用服务交互。
在第三个方面的第一种可能的实现方式中，所述应用服务网元接收终端发送的注册请求之前，还包括：
所述认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
所述认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
若鉴权认证通过，则所述认证鉴权网元为所述用户分配所述令牌；
所述认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌。
在第三个方面的第二种可能的实现方式中，所述应用服务网元接收终端发送的注册请求之前，还包括：
所述认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
所述认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
若鉴权认证通过，则所述认证鉴权网元为所述用户分配所述令牌并配置令牌过期时间；
所述认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌及所述令牌过期时间。
结合第三个方面的第二种可能的实现方式，在第三个方面的第三种可能的实现方式中，若所述令牌认证通过，则所述应用服务网元与所述终端进行应用服务交互之前还包括：
所述认证鉴权网元接收所述终端在所述令牌过期时间到期之前发送的刷新消息；
所述认证鉴权网元根据所述刷新消息，为所述终端重新分配令牌和令牌过期时间。
结合第三个方面的第二种可能的实现方式，在第三个方面的第四种可能的实现方式中，若所述令牌认证通过，则所述应用服务网元与所述终端进行应用服务交互之前还包括：
所述认证鉴权网元向所述终端发送刷新通知，以使所述终端获取新的令牌和令牌过期时间。
第四个方面，本发明实施例提供一种终端，包括：
发送模块，用于服务器的应用服务网元发送注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌及身份标识，以使所述服务器的应用服务网元根据所述身份标识对所述终端进行注册，并将所述令牌发送给所述服务器的认证鉴权网元，进而由所述服务器的认证鉴权网元根据令牌，对所述用户进行令牌认证，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
交互模块，用于若所述令牌认证通过，则与所述应用服务器的应用服务网元进行应用服务交互。
在第四个方面的第一种可能的实现方式中，所述终端还包括：第一接收模块，
所述发送模块，用于在向所述服务器的应用服务网元发送注册请求之前，向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
所述终端接收，用于接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌。
在第四个方面的第二种可能的实现方式中，所述终端还包括：第二接收模块，
所述发送模块，用于在向服务器的应用服务网元发送注册请求之前，向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
所述第二接收模块，用于接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌和令牌过期时间。
结合第四个方面的第二种可能的实现方式，在第四个方面的第三种可能的实现方式中，所述发送模块，还用于若所述令牌认证通过，则在所述交互模块与所述应用服务器的应用服务网元进行应用服务交互之前，在所述令牌过期时间到期之前向所述服务器的认证鉴权网元发送刷新消息；
所述第二接收模块，用于接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
结合第四个方面的第二种可能的实现方式，在第四个方面的第四种可能的实现方式中，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
所述第二接收模块，还用于若所述令牌认证通过，所述交互模块与所述应用服务器的应用服务网元进行应用服务交互之前，接收所述服务器的认证鉴权网元在判断出所述生效时间过期后发送的刷新通知；
所述发送模块，还用于向所述服务器的认证鉴权网元发送刷新消息；
所述第二接收模块，还用于接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
本发明实施例提供的集群系统中应用统一鉴权方法、服务器与终端，服务器的应用服务网元接收终端发送的注册请求并发送给服务器的认证鉴权网元，注册请求携带指示发起注册请求的用户的唯一身份的令牌，令牌为用户登录终端时服务器的认证鉴权网元为其分配的；然后，服务器的认证鉴权网元根据令牌，对用户进行令牌认证；最后，若令牌认证通过，则服务器的应用服务网元与终端进行应用服务交互。该过程中，对各应用服务网元的鉴权是通过终端成功登录并获得的服务器的认证鉴权网元为其分配的令牌进行的，集群通信中使用该User ID作为各个应用业务的统一标识，各应用服务的鉴权和用户登录有效的结合起来，做到了统一鉴权认证，从而提高了集群系统的安全性。
附图说明
图1为本发明集群系统中应用服务统一鉴权方法实施例一的流程图；
图2为本发明集群系统中应用服务统一鉴权方法实施例二的流程图；
图3为本发明集群系统中应用服务统一鉴权方法实施例三的过程示意图；
图4为本发明集群系统中应用统一鉴权方法实施例四的逻辑框架图；
图5为本发明集群系统中应用服务统一鉴权方法实施例五的信令图；
图6为本发明集群系统中应用服务统一鉴权方法实施例六的信令图
图7为本发明服务器实施例一的结构示意图；
图8为本发明终端实施例一的结构示意图；
图9为本发明终端实施例二的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1为本发明集群系统中应用服务统一鉴权方法实施例一的流程图。本实施例是从服务器的角度对本发明进行详细阐述，本实施例适用于LTE宽带集群系统中，需要对各应用统一鉴权的场景。本发明实施例中，服务器的认证鉴权网元例如可以是鉴权认证服务(Authentication Authorization Server，AAS)逻辑网元，服务器的应用服务网元例如可以是用户信息服务(User Information Server，UIS)逻辑网元、会话初始协议核心(Session Initiation Protocol core，SIP core)逻辑网元、短数据服务(Short Data Service，SDS)逻辑网元等，本发明并不以此为限制。具体的，本实施例包括如下步骤：
101、服务器的应用服务网元接收终端发送的注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌和所述用户的身份标识，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的。
本发明实施例中，服务器例如可以为单点登录服务器，当用户通过终端提供的登录界面成功登录并获得服务器的认证鉴权网元为其分配的令牌(Token)后，需要进行集群业务时，向服务器的应用服务网元发送注册请求以进行应用服务的鉴权认证，鉴权认证完成后才可以与该服务器的应用服务网元进行应用服务交互，才可以合法使用该应用服务网元提供的业务。其中，令牌为用户登录终端时由服务器的认证鉴权网元为其分配的。
102、所述服务器的应用服务网元根据所述身份标识对所述终端进行注册；并向所述服务器的应用服务网元向服务器的认证鉴权网元发送携带所述令牌的所述注册请求。
服务器的应用服务网元在接收到终端发送的注册请求后，根据身份标识对所端进行注册，并将该注册请求中携带的Token发送到服务器的认证鉴权网元，以使得服务器的认证鉴权网元通过该Token对用户进行令牌认证。
103、所述服务器的认证鉴权网元根据所述令牌，对所述用户进行令牌认证。
在接收到服务器的应用服务网元发送的令牌后，服务器的认证鉴权网元根据该令牌，对用户进行令牌认证。
104、若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互。
令牌认证完成后，用户才可以与该服务器的应用服务网元进行应用服务交互，才可以合法使用该应用服务网元提供的业务。
本发明实施例提供的集群系统中应用统一鉴权方法，服务器的应用服务网元接收终端发送的注册请求并发送给服务器的认证鉴权网元，注册请求携带指示发起注册请求的用户的唯一身份的令牌，令牌为用户登录终端时服务器的认证鉴权网元为其分配的；然后，服务器的认证鉴权网元根据令牌，对用户进行令牌认证；最后，若令牌认证通过，则服务器的应用服务网元与终端进行应用服务交互。该过程中，对各应用服务网元的鉴权是通过终端成功登录并获得的服务器的认证鉴权网元为其分配的令牌进行的，集群通信中使用该User ID作为各个应用业务的统一标识，各应用服务的鉴权和用户登录有效的结合起来，做到了统一鉴权认证，从而提高了集群系统的安全性。
可选的，在本发明一实施例中，服务器的应用服务网元接收终端发送的注册请求之前，服务器的认证鉴权网元接收用户通过终端发送的登录请求，登录请求携带身份标识；服务器的认证鉴权网元根据身份标识对用户进行鉴权认证；若鉴权认证通过，则服务器的认证鉴权网元为用户分配令牌；服务器的认证鉴权网元向终端发送登录响应消息，登录响应消息携带令牌。
具体的，服务器的认证鉴权网元接收用户通过终端发送的登录请求，该登录请求携带用户的身份标识，如User ID、登录密码(Pass word)； 然后，服务器的认证鉴权网元根据User ID Password等对用户进行鉴权认证；若鉴权认证通过，则为用户分配指示该用户唯一身份的令牌并通过登录响应消息将该令牌发送给终端。
可选的，在本发明一实施例中，服务器的应用服务网元接收终端发送的注册请求之前，服务器的认证鉴权网元接收用户通过终端发送的登录请求，登录请求携带用户的身份标识；服务器的认证鉴权网元根据身份标识对用户进行鉴权认证；若鉴权认证通过，则服务器的认证鉴权网元为用户分配令牌和令牌过期时间，并通过登录响应消息将该令牌和令牌过期时间发送给终端。
图2为本发明集群系统中应用服务统一鉴权方法实施例二的流程图。本实施例是从终端的角度对本发明进行详细阐述，本实施例适用于LTE宽带集群系统中，需要对各应用统一鉴权的场景。具体的，本实施例包括如下步骤：
201、终端向服务器的应用服务网元发送注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌及身份标识，以使所述服务器的应用服务网元根据所述身份标识对所述终端进行注册，并将所述令牌发送给所述服务器的认证鉴权网元，进而由所述服务器的认证鉴权网元根据令牌，对所述用户进行令牌认证，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的。
本实施例中有关服务器的应用服务网元、服务器的认证鉴权网元等的描述可参见图1所示实施例，在此不再赘述。
202、若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互。
令牌认证完成后，用户才可以与该服务器的应用服务网元进行应用服务交互，才可以合法使用该应用服务网元提供的业务。
本发明实施例提供的集群系统中应用统一鉴权方法，终端向服务器的应用服务网元发送注册请求携带令牌的注册请求，使得服务器的应用服务网元将该注册请求发送给服务器的认证鉴权网元，由服务器的认证鉴权网元根据令牌，对用户进行令牌认证，若令牌认证通过，则服务器的应用服务网元与终端进行应用服务交互。该过程中，对各应用服务网元的鉴权是 通过终端成功登录并获得的服务器的认证鉴权网元为其分配的令牌进行的，集群通信中使用该User ID作为各个应用业务的统一标识，各应用服务的鉴权和用户登录有效的结合起来，做到了统一鉴权认证，从而提高了集群系统的安全性。
可选的，在本发明二实施例中，终端向服务器的应用服务网元发送注册请求之前，还向服务器的认证鉴权网元发送登录请求，以使服务器的认证鉴权网元根据身份标识对用户进行鉴权认证，登录请求携带身份标识；然后，终端接收服务器的认证鉴权网元发送的登录响应消息，登录响应消息携带令牌。
可选的，在本发明二实施例中，终端向服务器的应用服务网元发送注册请求之前，还向服务器的认证鉴权网元发送登录请求，以使服务器的认证鉴权网元根据身份标识对用户进行鉴权认证，登录请求携带身份标识；然后，终端接收服务器的认证鉴权网元发送的登录响应消息，登录响应消息携带令牌和令牌过期时间。
图3为本发明集群系统中应用服务统一鉴权方法实施例三的过程示意图。本实施例是以用户登录后，服务器的认证鉴权网元对服务器的应用服务网元1～n进行统一鉴权为例对本发明进行详细阐述的。具体包括如下步骤：
301、终端向服务器的认证鉴权网元发送登录请求。
本步骤中，终端提供登录界面，当用户需要登录时，终端进入登录界面，输入用户名和密码后向服务器发送登录(Log on)请求，服务器的认证鉴权网元接收该登录请求。该过程中，可选的，登录请求可携带用户标识(User ID)等，User ID作为集群通信中各个应用服务的统一标识。
302、服务器的认证鉴权网元向终端发送令牌。
服务器的认证鉴权网元在接收到登录请求，对用户鉴权通过后，为用户分配令牌并发送给终端。
303、终端向应用服务网元1发送携带令牌的注册请求。
304、应用服务网元1向认证鉴权网元发送令牌以进行令牌认证。
本步骤中，服务器的应用服务网元1发送令牌到服务器的认证鉴权网元以进行令牌认证。
305、终端向应用服务网元2发送携带令牌的注册请求。
306、应用服务网元2向认证鉴权网元发送令牌以进行令牌认证。
307、终端向应用服务网元3发送携带令牌的注册请求。
308、应用服务网元3向认证鉴权网元发送令牌以进行令牌认证。
由图3可知，服务器的认证鉴权网元提供单点登录服务器，用户到服务器的认证鉴权网元进行登录认证，成功登录后由服务器的认证鉴权网元为其分配token；然后，终端到服务器的各应用服务网元进行注册，携带同一个token，各应用服务网元通过该token到认证鉴权网元进行令牌认证，认证完成后，用户才可以与该服务器的各应用服务网元进行应用服务交互，才可以合法使用各应用服务网元提供的业务。
需要说明的是，本实施例中，步骤303、305、307的执行并无严格的先后顺序，例如，在其他可行的实现方式中，也可以是终端先到应用服务网元2或应用服务网元n(n≠1)进行注册，然后到应用服务网元1进行注册。
图4为本发明集群系统中应用统一鉴权方法实施例四的逻辑框架图。请参照图4，服务器中的主要逻辑网元有用户数据中心(User Data Center，UDC)、多媒体调度中心(Multimedia Dispatch Center，MDC)、核心分组网演进(Evolved Packet core，EPC)、会话初始协议核心(Session Initiation Protocol core，SIP core)等，后续的流程实现以该框架为基础进行阐述。
其中，UDC具有承担用户、群组等开户数据的配置管理，以及统一登录服务、用户信息服务、策略服务、安全配置服务等功能，其可提供鉴权认证服务(Authentication Authorization Server，AAS)、用户信息服务(User Information Server，UIS)、服务质量控制(Quality Of Service Control，QoS)、安全服务(Security Server)、用户管理(User Management)、群组管理(Group Management)等，其中，AAS为统一鉴权认证中心，提供用户的登录管理服务、用户的应用服务接入地址、各应用的鉴权服务等，可和标准的第三方验证、授权和记账(Authentication、Authorization、Accounting，AAA)服务对接。UIS可提供通讯录服务、用户静态数据配置服务、用户权限Profile下载服务以及提供给群组使用的群组列表下载服务等。
MDC以业务为中心，可提供组呼(Push to Talk，PTT server)、点呼服务、集群服务、蜂窝上的实时集群对讲业务(Push to talk over Cellular，POC)、短数据服务(Short Data Service，SDS)、录音录像服务等。
SIP core为SIP接入路由中心，提供SIP注册和路由服务。
EPC为系统演进结构(System Architecture Evolution，SAE)的主要组成部分。
如图4所示，A1为UDC与终端之间的接口，其采用超文本传输协议(Hyper Text Transfer Protocol，HTTP)/信令适配层(Signaling Atm Adaptation Layer，SAAL)进行通信；A2为UDC与SIP core之间的接口；A3为UDC与MDC之间的接口；B1为终端与SIP core之间的接口，其采用SIP进行通信；B2为SIP core与MDC之间的接口之间的接口，其采用SIP进行通信；B3为MDC与EPC之间的接口，其可为策略和计费规则功能(Policy And Charging Rules Function，PCRF)接口或Rx接口；B4为MDC与EPC之间的接口，其可为MB2-C接口或MB2-U接口；B5为MDC与终端之间的接口，其可为媒体面接口。下面，结合图3，对本发明集群系统中应用统一鉴权方法进行详细说明。具体可参见图5与图6。
图5为本发明集群系统中应用服务统一鉴权方法实施例五的信令图，本实施例是以服务器的认证鉴权网元为AAS，服务器的应用服务网元分别为UIS、SIP core或SDS为例对本发明进行详细阐述的，其具体包括如下步骤：
501、用户发起登录请求。
终端进入登录界面，输入用户的用户名和密码后发起登录过程，向AAS发送登录(Log on)请求，该Log on请求携带用户标识User ID。可选的，该登录请求还携带用户密码(Pass word)以及终端所属区域的区域位置标识Area ID等。
502、对用户鉴权并分配令牌。
AAS对用户进行认证鉴权，鉴权通过后为用户分配唯一身份令牌。可选的，鉴权通过后，AAS还保存User ID和Area ID的对应关系。
503、AAS向终端发送携带令牌的登录响应消息。
504、终端向UIS发送携带令牌和用户标识的注册请求。
当服务器的应用服务网元为UIS时，终端向UIS发送携带令牌和用户标识(User ID)的注册请求(Register)。
505、UIS向AAS发送令牌以进行令牌认证。
本步骤中，UIS向AAS发送令牌以进行令牌认证。
506、UIS向终端发送注册响应消息。
当AAS对UIS的令牌认证通过后，UIS向终端返回会话标识(Session ID)，并向终端发送注册响应消息以告知终端令牌认证通过。
507、终端到UIS获取用户权限。
508、终端到UIS获取企业通讯录。
509、终端到UIS获取群组信息列表。
步骤507～509中，终端向UIS请求下载用户权限(Profile)信息、企业通讯录(Address Book)内容、群组信息列表(Group List)等，其中，群组信息列表用于终端做群组扫描、群组加入及显示等。
另外，步骤506～509终端与UIS的交互中，协议可采用超文本传输协议(Hyper Text Transport Protocol，HTTP)等，本发明并不以此为限制。
510、终端向SIP core发送携带令牌和用户标识的注册请求。
若终端与UIS交互获取到用户权限、群组列表后，若终端拥有集群权限，则本步骤中，终端向SIP core发起SIP注册，携带User ID和成功登录后获取的唯一身份令牌。
511、SIP core向AAS发送令牌以进行令牌认证。
SIP core接收到终端发送的注册请求后，将注册请求携带的令牌和User ID发送给AAS，以使得AAS对用户进行令牌认证。
512、SIP core向终端发送注册响应消息。
若令牌认证通过，SIP core向终端发送注册响应消息，如SIP core向终端返回注册200OK应答。
513、终端与SIP Core之间建立集群业务信令。
令牌认证通过后，终端与SIP core之间可进行集群业务的信令建立过程。
上述步骤510～513中，终端与SIP Core的交互中，在应用层面不具体区分SIP的点呼、集群、短信等，SIP core应用集中注册。
另外，步骤510～513终端与SIP core的交互中，协议可采用超SIP协议等，本发明并不以此为限制。
514、终端向SDS发送携带令牌和用户标识的注册请求。
若终端与UIS交互获取到用户权限、群组列表后，若终端拥有短数据业务权限，则本步骤中，终端向SDS发起注册，携带User ID和成功登录后获取的唯一身份令牌。
515、SDS向AAS发送令牌以进行令牌认证。
SDS接收到终端发送的注册请求后，将注册请求携带的令牌和User ID发送给AAS，以使得AAS对用户进行令牌认证。
516、SDS向终端发送注册响应消息。
若令牌认证通过，SDS向终端发送注册响应消息，如SIP core向终端返回注册命令正确应答(Acknowledgement Character，ACK)
517、终端与SDS进行短数据业务交互。
令牌认证通过后，终端与SDS之间可进行短数据业务交互。
上述步骤514～517终端与SDS的交互中，协议可采用可扩展通讯和表示协议(Xml based Messaging And Presence Protocol，XMPP)等，本发明并不以此为限制。
另外，需要说明的是，上述终端与SIP core(即步骤510～513)、终端与SDS的交互并没有严格的顺序，例如，在其他可行的实现方式中，也可以是终端先与SDS交互，然后终端在于SIP core交互；或者，终端仅与SIP core交互；或者，终端仅与SDS交互。
图6为本发明集群系统中应用服务统一鉴权方法实施例六的信令图，相较于图5所示实施例，本实施例中，服务器的认证鉴权网元在接收到终端发送的登录请求后，对终端进行鉴权后，除了为终端分配令牌，还为该令牌分配令牌过期时间，其具体包括如下步骤；
601、用户发起登录请求。
602、AAS对用户鉴权并在T0时刻分配令牌及令牌过期时间。
本步骤中，除了为用户分配令牌外，AAS还分配该令牌对应的令牌过期时间。
603、AAS向终端发送携带令牌及令牌过期时间的登录响应消息。
604、终端在T1时刻保存令牌及令牌过期时间。
在接收到登录响应消息后，终端在当前时刻T1保存令牌及令牌过期时间。例如，假设T0为12:00，T1为12:01，令牌过期时间为20分钟，则该在T0时刻分配的令牌将在12：21分过期。
605、终端与UIS采用T0时刻分配的令牌进行认证鉴权及应用服务交互。
终端执行令牌过期时间之前的应用注册，例如，终端到UIS进行注册并进行后续的用户Profile、通讯录及群组列表的下载等，具体可参见上述步骤507～509，此处不再赘述。
606、终端在T2时刻向AAS发送刷新消息。
终端在令牌过期时间到期之前，终端向AAS发送刷新消息以获取新的令牌和令牌过期时间。例如，在T2时刻，假设T2＝T1+令牌过期时间*90％时，沿用步骤604中的例子，则在T2为12:19分时，终端向AAS发送刷新消息以获取新的令牌和令牌过期时间。
607、AAS向终端发送携带新的令牌及新的令牌过期时间的刷新响应消息。
需要说明的是，除了终端可以主动向AAS发送刷新流程以获取新的令牌及令牌过期时间外，也可以是AAS主动向终端发送刷新通知，以使得终端在收到AAS在收到刷新通知后向AAS发起令牌刷新流程，具体可参见步骤608～
608、AAS在T3时刻向终端发送刷新通知。
AAS在令牌过期时间到期之前向终端发送刷新通知，以使终端获取新的令牌和令牌过期时间。例如，终端T3时刻发起刷新流程，T3＝T0+令牌过期时间时，沿用步骤604中的例子，则在T3为12:20分时，终端向AAS发送刷新消息以获取新的令牌和令牌过期时间。
609、终端向AAS发送刷新消息。
终端向AAS发送刷新消息以获取新的令牌和令牌过期时间。
610、AAS向终端发送携带新的令牌及新的令牌过期时间的刷新响应消息。
上述步骤608～610可以看成一个异常保护流程，即当终端未在T1时 刻发起刷新流程时，即上述步骤606、607未执行时才启动步骤608～610。当然，也可以将终端发起刷新流程与AAS通知终端发起刷新流程看做并列的方案，本发明并不以此为限制。
611、终端与SIP core采用新分配的令牌进行认证鉴权及应用服务交互。
图7为本发明服务器实施例一的结构示意图。本实施例提供的服务器，其可实现本发明任意实施例提供的应用于服务器的方法的各个步骤。具体的，本实施例提供的服务器具体包括：应用服务网元11与认证鉴权网元12。
其中，所述应用服务网元11接收终端发送的注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌和所述用户的身份标识，所述令牌为所述用户登录所述终端时所述认证鉴权网元12为其分配的；
所述应用服务网元11根据所述身份标识对所述终端进行注册；并向所述认证鉴权网元12发送所述令牌；
所述认证鉴权网元12根据所述令牌，对所述用户进行令牌认证；
若所述令牌认证通过，则所述应用服务网元11与所述终端进行应用服务交互。
本发明实施例提供的服务器，服务器的应用服务网元接收终端发送的注册请求并发送给服务器的认证鉴权网元，注册请求携带指示发起注册请求的用户的唯一身份的令牌，令牌为用户登录终端时服务器的认证鉴权网元为其分配的；然后，服务器的认证鉴权网元根据令牌，对用户进行令牌认证；最后，若令牌认证通过，则服务器的应用服务网元与终端进行应用服务交互。该过程中，对各应用服务网元的鉴权是通过终端成功登录并获得的服务器的认证鉴权网元为其分配的令牌进行的，集群通信中使用该User ID作为各个应用业务的统一标识，各应用服务的鉴权和用户登录有效的结合起来，做到了统一鉴权认证，从而提高了集群系统的安全性。
可选的，在本发明一实施例中，所述应用服务网元11接收终端发送的注册请求之前，还包括：
所述认证鉴权网元12接收所述用户通过所述终端发送的登录请求， 所述登录请求携带所述身份标识；
所述认证鉴权网元12根据所述身份标识对所述用户进行鉴权认证；
若鉴权认证通过，则所述认证鉴权网元12为所述用户分配所述令牌；
所述认证鉴权网元12向所述终端发送登录响应消息，所述登录响应消息携带所述令牌。
可选的，在本发明一实施例中，所述应用服务网元11接收终端发送的注册请求之前，还包括：
所述认证鉴权网元12接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
所述认证鉴权网元12根据所述身份标识对所述用户进行鉴权认证；
若鉴权认证通过，则所述认证鉴权网元12为所述用户分配所述令牌并配置令牌过期时间；
所述认证鉴权网元12向所述终端发送登录响应消息，所述登录响应消息携带所述令牌及所述令牌过期时间。
可选的，在本发明一实施例中，若所述令牌认证通过，则所述应用服务网元11与所述终端进行应用服务交互之前还包括：
所述认证鉴权网元12接收所述终端在所述令牌过期时间到期之前发送的刷新消息；
所述认证鉴权网元12根据所述刷新消息，为所述终端重新分配令牌和令牌过期时间。
可选的，在本发明一实施例中，若所述令牌认证通过，则所述应用服务网元11与所述终端进行应用服务交互之前还包括：
所述认证鉴权网元12向所述终端发送刷新通知，以使所述终端获取新的令牌和令牌过期时间。
图8为本发明终端实施例一的结构示意图。本实施例提供的终端，其可实现本发明任意实施例提供的应用于终端的方法的各个步骤。具体的，本实施例提供的终端具体包括：
发送模块21，用于服务器的应用服务网元发送注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌及身份标识，以使所述服务器的应用服务网元根据所述身份标识对所述终端进行注册，并将 所述令牌发送给所述服务器的认证鉴权网元，进而由所述服务器的认证鉴权网元根据令牌，对所述用户进行令牌认证，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
交互模块22，用于若所述令牌认证通过，则与所述应用服务器的应用服务网元进行应用服务交互。
图9为本发明终端实施例二的结构示意图。如图9所示，本实施例提供的终端在图8所示终端的基础上，进一步的，还包括：第一接收模块23，
所述发送模块21，用于在向所述服务器的应用服务网元发送注册请求之前，向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
所述终端接收，用于接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌。
再请参照图9，终端还包括：第二接收模块24，
所述发送模块21，用于在向服务器的应用服务网元发送注册请求之前，向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
所述第二接收模块24，用于接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌和令牌过期时间。
可选的，在本发明一实施例中，所述发送模块21，还用于若所述令牌认证通过，则在所述交互模块22与所述应用服务器的应用服务网元进行应用服务交互之前，在所述令牌过期时间到期之前向所述服务器的认证鉴权网元发送刷新消息；
所述第二接收模块24，用于接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
可选的，在本发明一实施例中，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
所述第二接收模块24，还用于若所述令牌认证通过，所述交互模块22与所述应用服务器的应用服务网元进行应用服务交互之前，接收所述服 务器的认证鉴权网元在判断出所述生效时间过期后发送的刷新通知；
所述发送模块21，还用于向所述服务器的认证鉴权网元发送刷新消息；
所述第二接收模块24，还用于接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (20)

  1. 一种集群系统中应用统一鉴权方法，其特征在于，包括：
    服务器的应用服务网元接收终端发送的注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌和所述用户的身份标识，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
    所述服务器的应用服务网元根据所述身份标识对所述终端进行注册；并向所述服务器的认证鉴权网元发送所述令牌；
    所述服务器的认证鉴权网元根据所述令牌，对所述用户进行令牌认证；
    若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互。
  2. 根据权利要求1所述的方法，其特征在于，所述服务器的应用服务网元接收终端发送的注册请求之前，还包括：
    所述服务器的认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
    所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
    若鉴权认证通过，则所述服务器的认证鉴权网元为所述用户分配所述令牌；
    所述服务器的认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌。
  3. 根据权利要求1所述的方法，其特征在于，所述服务器的应用服务网元接收终端发送的注册请求之前，还包括：
    所述服务器的认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
    所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
    若鉴权认证通过，则所述服务器的认证鉴权网元为所述用户分配所述令牌并配置令牌过期时间；
    所述服务器的认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌及所述令牌过期时间。
  4. 根据权利要求3所述的方法，其特征在于，若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互之前还包括：
    所述服务器的认证鉴权网元接收所述终端在所述令牌过期时间到期之前发送的刷新消息；
    所述服务器的认证鉴权网元根据所述刷新消息，为所述终端重新分配令牌和令牌过期时间。
  5. 根据权利要求3所述的方法，其特征在于，若所述令牌认证通过，则所述服务器的应用服务网元与所述终端进行应用服务交互之前还包括：
    所述服务器的认证鉴权网元向所述终端发送刷新通知，以使所述终端获取新的令牌和令牌过期时间。
  6. 一种集群系统中应用统一鉴权方法，其特征在于，包括：
    终端向服务器的应用服务网元发送注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌及身份标识，以使所述服务器的应用服务网元根据所述身份标识对所述终端进行注册，并将所述令牌发送给所述服务器的认证鉴权网元，进而由所述服务器的认证鉴权网元根据令牌，对所述用户进行令牌认证，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
    若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互。
  7. 根据权利要求6所述的方法，其特征在于，所述终端向服务器的应用服务网元发送注册请求之前，还包括：
    所述终端向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
    所述终端接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌。
  8. 根据权利要求6所述的方法，其特征在于，所述终端向服务器的应用服务网元发送注册请求之前，还包括：
    所述终端向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
    所述终端接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌和令牌过期时间。
  9. 根据权利要求8所述的方法，其特征在于，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
    所述终端在所述令牌过期时间到期之前向所述服务器的认证鉴权网元发送刷新消息；
    所述终端接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
  10. 根据权利要求8所述的方法，其特征在于，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
    所述终端接收所述服务器的认证鉴权网元在判断出所述生效时间过期后发送的刷新通知；
    所述终端向所述服务器的认证鉴权网元发送刷新消息；
    所述终端接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
  11. 一种服务器，其特征在于，包括：应用服务网元与认证鉴权网元，所述应用服务网元接收终端发送的注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌和所述用户的身份标识，所述令牌为所述用户登录所述终端时所述认证鉴权网元为其分配的；
    所述应用服务网元根据所述身份标识对所述终端进行注册；并向所述认证鉴权网元发送所述令牌；
    所述认证鉴权网元根据所述令牌，对所述用户进行令牌认证；
    若所述令牌认证通过，则所述应用服务网元与所述终端进行应用服务交互。
  12. 根据权利要求11所述的服务器，其特征在于，所述应用服务网 元接收终端发送的注册请求之前，还包括：
    所述认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
    所述认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
    若鉴权认证通过，则所述认证鉴权网元为所述用户分配所述令牌；
    所述认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌。
  13. 根据权利要求11所述的服务器，其特征在于，所述应用服务网元接收终端发送的注册请求之前，还包括：
    所述认证鉴权网元接收所述用户通过所述终端发送的登录请求，所述登录请求携带所述身份标识；
    所述认证鉴权网元根据所述身份标识对所述用户进行鉴权认证；
    若鉴权认证通过，则所述认证鉴权网元为所述用户分配所述令牌并配置令牌过期时间；
    所述认证鉴权网元向所述终端发送登录响应消息，所述登录响应消息携带所述令牌及所述令牌过期时间。
  14. 根据权利要求13所述的服务器，其特征在于，若所述令牌认证通过，则所述应用服务网元与所述终端进行应用服务交互之前还包括：
    所述认证鉴权网元接收所述终端在所述令牌过期时间到期之前发送的刷新消息；
    所述认证鉴权网元根据所述刷新消息，为所述终端重新分配令牌和令牌过期时间。
  15. 根据权利要求13所述的服务器，其特征在于，若所述令牌认证通过，则所述应用服务网元与所述终端进行应用服务交互之前还包括：
    所述认证鉴权网元向所述终端发送刷新通知，以使所述终端获取新的令牌和令牌过期时间。
  16. 一种终端，其特征在于，包括：
    发送模块，用于服务器的应用服务网元发送注册请求，所述注册请求携带指示发起所述注册请求的用户的唯一身份的令牌及身份标识，以使所述服务器的应用服务网元根据所述身份标识对所述终端进行注册，并将所 述令牌发送给所述服务器的认证鉴权网元，进而由所述服务器的认证鉴权网元根据令牌，对所述用户进行令牌认证，所述令牌为所述用户登录所述终端时所述服务器的认证鉴权网元为其分配的；
    交互模块，用于若所述令牌认证通过，则与所述应用服务器的应用服务网元进行应用服务交互。
  17. 根据权利要求16所述的终端，其特征在于，还包括：第一接收模块，
    所述发送模块，用于在向所述服务器的应用服务网元发送注册请求之前，向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据所述身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
    所述终端接收，用于接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌。
  18. 根据权利要求16所述的终端，其特征在于，还包括：第二接收模块，
    所述发送模块，用于在向服务器的应用服务网元发送注册请求之前，向所述服务器的认证鉴权网元发送登录请求，以使所述服务器的认证鉴权网元根据身份标识对所述用户进行鉴权认证，所述登录请求携带所述身份标识；
    所述第二接收模块，用于接收所述服务器的认证鉴权网元发送的登录响应消息，所述登录响应消息携带所述令牌和令牌过期时间。
  19. 根据权利要求18所述的终端，其特征在于，
    所述发送模块，还用于若所述令牌认证通过，则在所述交互模块与所述应用服务器的应用服务网元进行应用服务交互之前，在所述令牌过期时间到期之前向所述服务器的认证鉴权网元发送刷新消息；
    所述第二接收模块，用于接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
  20. 根据权利要求18所述的终端，其特征在于，所述若所述令牌认证通过，则所述终端与所述应用服务器的应用服务网元进行应用服务交互之前，还包括：
    所述第二接收模块，还用于若所述令牌认证通过，所述交互模块与所 述应用服务器的应用服务网元进行应用服务交互之前，接收所述服务器的认证鉴权网元在判断出所述生效时间过期后发送的刷新通知；
    所述发送模块，还用于向所述服务器的认证鉴权网元发送刷新消息；
    所述第二接收模块，还用于接收所述服务器的认证鉴权网元根据所述刷新消息为所述终端重新分配令牌和令牌过期时间。
PCT/CN2016/078339 2015-04-02 2016-04-01 集群系统中应用统一鉴权方法、服务器与终端 Ceased WO2016155668A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
RS20200925A RS60661B1 (sr) 2015-04-02 2016-04-01 Postupak objedinjene autentifikacije za aplikaciju u sistemu za povezivanje, servera i terminala
EP16771423.7A EP3267704B1 (en) 2015-04-02 2016-04-01 Method for unified application authentication in trunking system, server and terminal
ES16771423T ES2805809T3 (es) 2015-04-02 2016-04-01 Procedimiento para la autenticación de aplicación unificada en un terminal, servidor y sistema de enlace troncal
US15/721,449 US10721230B2 (en) 2015-04-02 2017-09-29 Unified authentication method for application in trunking system, server and terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510154448.3 2015-04-02
CN201510154448.3A CN106162574B (zh) 2015-04-02 2015-04-02 集群系统中应用统一鉴权方法、服务器与终端

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/721,449 Continuation US10721230B2 (en) 2015-04-02 2017-09-29 Unified authentication method for application in trunking system, server and terminal

Publications (1)

Publication Number Publication Date
WO2016155668A1 true WO2016155668A1 (zh) 2016-10-06

Family

ID=57006506

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/078339 Ceased WO2016155668A1 (zh) 2015-04-02 2016-04-01 集群系统中应用统一鉴权方法、服务器与终端

Country Status (7)

Country Link
US (1) US10721230B2 (zh)
EP (1) EP3267704B1 (zh)
CN (1) CN106162574B (zh)
ES (1) ES2805809T3 (zh)
HU (1) HUE050072T2 (zh)
RS (1) RS60661B1 (zh)
WO (1) WO2016155668A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018068631A1 (zh) * 2016-10-10 2018-04-19 阿里巴巴集团控股有限公司 账户登录方法、设备和服务器
CN107943541A (zh) * 2017-11-22 2018-04-20 竞技世界（北京）网络技术有限公司 一种Windows本地组件的通讯方法
CN110430065A (zh) * 2019-08-08 2019-11-08 浪潮云信息技术有限公司 一种应用服务调用方法、装置及系统
CN113010880A (zh) * 2021-02-08 2021-06-22 上海新时达电气股份有限公司 电梯配件认证方法、系统、服务器和存储介质
CN113572827A (zh) * 2021-07-13 2021-10-29 支付宝(杭州)信息技术有限公司 注册处理方法及装置
CN113613178A (zh) * 2021-06-30 2021-11-05 程宗智 一种终端侧的lte集群组配置方法及配置系统
CN114186208A (zh) * 2021-12-16 2022-03-15 上海申铁信息工程有限公司 一种统一身份认证的方法及存储介质

Families Citing this family (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104869175B (zh) * 2015-06-16 2018-07-27 腾讯科技（北京）有限公司 跨平台的账号资源共享实现方法、装置及系统
EP3550780B1 (en) * 2016-12-30 2021-04-14 Huawei Technologies Co., Ltd. Verification method and apparatus for key requester
CN109150800B (zh) * 2017-06-16 2022-05-13 中兴通讯股份有限公司 一种登录访问方法、系统和存储介质
CN110022279B (zh) * 2018-01-08 2021-11-26 普天信息技术有限公司 一种微服务系统中认证鉴权的方法和系统
US12567981B2 (en) 2018-08-01 2026-03-03 Cable Television Laboratories, Inc. Systems and methods for data authentication using composite keys and signatures
CN110955871B (zh) * 2018-09-26 2022-01-28 北京国双科技有限公司 一种数据获取方法及装置
CN109558710B (zh) * 2018-12-07 2022-02-15 泰康保险集团股份有限公司 用户登录方法、装置、系统及存储介质
CN109802941A (zh) * 2018-12-14 2019-05-24 平安科技（深圳）有限公司 一种登录验证方法、装置、存储介质和服务器
CN111526111B (zh) * 2019-02-02 2021-10-22 腾讯科技（深圳）有限公司 登录轻应用的控制方法、装置和设备及计算机存储介质
CN109981478B (zh) * 2019-02-18 2022-07-22 新华三信息安全技术有限公司 一种报文处理方法及装置
CN111669351B (zh) * 2019-03-07 2022-05-31 腾讯科技（深圳）有限公司 鉴权方法、业务服务器、客户端及计算机可读存储介质
CN111786931B (zh) * 2019-04-03 2022-08-02 北京德信东方网络科技有限公司 身份认证的方法和装置
WO2020243646A1 (en) * 2019-05-31 2020-12-03 Apple Inc. Registering and associating multiple user identifiers for a service on a device
CN110266708B (zh) * 2019-06-27 2021-07-13 恒宝股份有限公司 一种基于设备集群的终端安全验证系统和方法
CN112218251B (zh) * 2019-07-09 2022-01-07 普天信息技术有限公司 宽带集群并发业务处理方法和装置
CN110493239B (zh) * 2019-08-26 2021-11-12 京东数字科技控股有限公司 鉴权的方法和装置
CN110958248A (zh) * 2019-12-03 2020-04-03 紫光云(南京)数字技术有限公司 网络服务系统间的免密认证方法、装置及系统
CN113111335B (zh) * 2020-01-13 2023-12-29 深信服科技股份有限公司 一种认证方法、装置、设备及存储介质
CN113132337B (zh) * 2020-01-15 2022-06-07 成都鼎桥通信技术有限公司 一种集群终端的sip注册方法和装置
CN113141328B (zh) * 2020-01-16 2022-06-07 成都鼎桥通信技术有限公司 终端的业务注册方法和系统
CN111431920A (zh) * 2020-03-31 2020-07-17 中国建设银行股份有限公司 一种基于动态令牌的安全控制方法及系统
CN111641697B (zh) * 2020-05-22 2023-02-10 福建北峰通信科技股份有限公司 一种公网对讲系统业务服务器的动态分布式系统及方法
CN111770068B (zh) * 2020-06-15 2022-12-30 上海翌旭网络科技有限公司 一种基于最优链路选择的一致性鉴权方法
US12028324B1 (en) * 2020-07-01 2024-07-02 Cable Television Laboratories, Inc. Systems and methods for advanced chained authentications and authorizations
US12200122B1 (en) 2020-08-06 2025-01-14 Cable Television Laboratories, Inc. Systems and methods for advanced quantum-safe PKI credentials for authentications
CN113656787B (zh) * 2021-08-12 2023-10-27 青岛海信智慧生活科技股份有限公司 服务提供设备、终端、鉴权设备、资源访问方法及系统
CN113691534B (zh) * 2021-08-24 2023-02-17 厦门熵基科技有限公司 一种身份认证计费系统和方法
CN114448703B (zh) * 2022-01-29 2023-11-17 北京百度网讯科技有限公司 请求处理方法、装置、电子设备及存储介质
US12229765B2 (en) * 2022-05-23 2025-02-18 Bank Of America Corporation De-centralized authentication in a network system
CN115242400B (zh) * 2022-06-29 2024-06-04 重庆长安汽车股份有限公司 一种车机Token唯一化与云端认证系统及方法
CN116074014A (zh) * 2022-11-25 2023-05-05 四川启睿克科技有限公司 一种多应用服务器统一认证方法及系统
CN121399982A (zh) 2023-06-27 2026-01-23 乐天交响乐株式会社 确定o-ran无线单元的认证状态信息

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070240206A1 (en) * 2006-03-22 2007-10-11 Alibaba.Com Corporation Intersystem single sign-on
CN102904895A (zh) * 2012-10-23 2013-01-30 深圳市汇智集信息科技有限公司 安全认证机制的系统及其安全认证的方法
CN103051631A (zh) * 2012-12-21 2013-04-17 国云科技股份有限公司 PaaS平台与SaaS应用系统的统一安全认证方法
CN103139168A (zh) * 2011-11-30 2013-06-05 中国移动通信集团公司 提高能力调用成功率的方法及开放平台
CN103188248A (zh) * 2011-12-31 2013-07-03 卓望数码技术（深圳）有限公司 基于单点登录的身份认证系统及方法

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2571255C (en) * 2005-12-23 2016-05-10 Bce Inc. Wireless device authentication between different networks
US20090271847A1 (en) * 2008-04-25 2009-10-29 Nokia Corporation Methods, Apparatuses, and Computer Program Products for Providing a Single Service Sign-On
US20140198687A1 (en) * 2009-01-28 2014-07-17 Headwater Partners I Llc Wireless end-user device providing ambient or sponsored services
US9578182B2 (en) * 2009-01-28 2017-02-21 Headwater Partners I Llc Mobile device and service management
US8510801B2 (en) * 2009-10-15 2013-08-13 At&T Intellectual Property I, L.P. Management of access to service in an access point
US8533803B2 (en) * 2010-02-09 2013-09-10 Interdigital Patent Holdings, Inc. Method and apparatus for trusted federated identity
US9141410B2 (en) * 2011-03-08 2015-09-22 Rackspace Us, Inc. Pluggable allocation in a cloud computing system
US8667579B2 (en) * 2011-11-29 2014-03-04 Genband Us Llc Methods, systems, and computer readable media for bridging user authentication, authorization, and access between web-based and telecom domains
US9027087B2 (en) * 2013-03-14 2015-05-05 Rackspace Us, Inc. Method and system for identity-based authentication of virtual machines
EP2809042A1 (en) * 2013-05-29 2014-12-03 Telefonica Digital España, S.L.U. Method for authenticate a user associated to a user agent implemented over SIP protocol

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070240206A1 (en) * 2006-03-22 2007-10-11 Alibaba.Com Corporation Intersystem single sign-on
CN103139168A (zh) * 2011-11-30 2013-06-05 中国移动通信集团公司 提高能力调用成功率的方法及开放平台
CN103188248A (zh) * 2011-12-31 2013-07-03 卓望数码技术（深圳）有限公司 基于单点登录的身份认证系统及方法
CN102904895A (zh) * 2012-10-23 2013-01-30 深圳市汇智集信息科技有限公司 安全认证机制的系统及其安全认证的方法
CN103051631A (zh) * 2012-12-21 2013-04-17 国云科技股份有限公司 PaaS平台与SaaS应用系统的统一安全认证方法

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018068631A1 (zh) * 2016-10-10 2018-04-19 阿里巴巴集团控股有限公司 账户登录方法、设备和服务器
US11019051B2 (en) 2016-10-10 2021-05-25 Advanced New Technologies Co., Ltd. Secure authentication using variable identifiers
US11184347B2 (en) 2016-10-10 2021-11-23 Advanced New Technologies Co., Ltd. Secure authentication using variable identifiers
CN107943541A (zh) * 2017-11-22 2018-04-20 竞技世界（北京）网络技术有限公司 一种Windows本地组件的通讯方法
CN107943541B (zh) * 2017-11-22 2020-12-04 竞技世界（北京）网络技术有限公司 一种Windows本地组件的通讯方法
CN110430065A (zh) * 2019-08-08 2019-11-08 浪潮云信息技术有限公司 一种应用服务调用方法、装置及系统
CN113010880A (zh) * 2021-02-08 2021-06-22 上海新时达电气股份有限公司 电梯配件认证方法、系统、服务器和存储介质
CN113010880B (zh) * 2021-02-08 2022-10-14 上海新时达电气股份有限公司 电梯配件认证方法、系统、服务器和存储介质
CN113613178A (zh) * 2021-06-30 2021-11-05 程宗智 一种终端侧的lte集群组配置方法及配置系统
CN113572827A (zh) * 2021-07-13 2021-10-29 支付宝(杭州)信息技术有限公司 注册处理方法及装置
CN113572827B (zh) * 2021-07-13 2024-01-16 支付宝（中国）网络技术有限公司 注册处理方法及装置
CN114186208A (zh) * 2021-12-16 2022-03-15 上海申铁信息工程有限公司 一种统一身份认证的方法及存储介质

Also Published As

Publication number Publication date
RS60661B1 (sr) 2020-09-30
ES2805809T3 (es) 2021-02-15
HUE050072T2 (hu) 2020-11-30
EP3267704B1 (en) 2020-05-06
EP3267704A4 (en) 2018-07-18
US20180026982A1 (en) 2018-01-25
EP3267704A1 (en) 2018-01-10
CN106162574B (zh) 2020-08-04
CN106162574A (zh) 2016-11-23
US10721230B2 (en) 2020-07-21

Similar Documents

Publication Publication Date Title
WO2016155668A1 (zh) 集群系统中应用统一鉴权方法、服务器与终端
US10673861B2 (en) Identity proxy to provide access control and single sign on
CN111373712B (zh) 用于认证应用程序接口(api)调用者的方法和系统
US8978100B2 (en) Policy-based authentication
US9130935B2 (en) System and method for providing access credentials
CN101099143B (zh) 使用属性证书实现网络设备授权的系统与方法
US20210112411A1 (en) Multi-factor authentication in private mobile networks
CN110800331A (zh) 网络验证方法、相关设备及系统
CN106953831B (zh) 一种用户资源的授权方法、装置及系统
CN110730174A (zh) 一种网络访问控制方法、装置、设备及介质
CN101499904A (zh) 一种安全接口调用方法、装置及系统
US10798757B2 (en) Systems, methods, and computer program products for token-based session setup in telecommunication services
CN110569638A (zh) 一种api认证的方法、装置、存储介质及计算设备
WO2021026927A1 (zh) 通信方法和相关设备
Wu et al. Design and implementation of cloud API access control based on OAuth
CN106302475B (zh) 家庭互联网业务授权方法及服务器
CN113486321B (zh) 一种基于oauth2.0的认证和退出方法及平台
WO2016050133A1 (zh) 一种认证凭证更替的方法及装置
CN118694608A (zh) 应用于fttr网关的portal认证方法、装置及存储介质
CN107770772A (zh) 一种通过app实现无感知认证上网的方法和装置
WO2024156342A1 (en) A method and devices for enabling safe data transfer between input/output device handlers
CN116266785A (zh) 密钥生成方法、mep服务器、应用服务器及核心网网元

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16771423

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2016771423

Country of ref document: EP