WO2019033967A1 - 安全接入方法、设备及系统 - Google Patents

安全接入方法、设备及系统 Download PDF

Info

Publication number
WO2019033967A1
WO2019033967A1 PCT/CN2018/099337 CN2018099337W WO2019033967A1 WO 2019033967 A1 WO2019033967 A1 WO 2019033967A1 CN 2018099337 W CN2018099337 W CN 2018099337W WO 2019033967 A1 WO2019033967 A1 WO 2019033967A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
authentication server
authentication
server
access
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/099337
Other languages
English (en)
French (fr)
Inventor
李华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP18845714.7A priority Critical patent/EP3644636B1/en
Publication of WO2019033967A1 publication Critical patent/WO2019033967A1/zh
Priority to US16/791,714 priority patent/US11323440B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a secure access method, device, and system.
  • the terminal when a terminal accesses a 3GPP core network through a non-3GPP access network, the terminal generally completes secure access during non-3GPP access through an extensible authentication protocol (EAP) authentication procedure.
  • EAP extensible authentication protocol
  • the terminal uses the EAP full authentication process to perform secure access when the terminal initially accesses the network.
  • the authentication server In the EAP full authentication process, the authentication server generates a fast re-authentication identifier of the terminal, and the terminal re-authenticizes the terminal. The identity is sent to the terminal.
  • the terminal can use the simplified EAP fast re-authentication procedure for secure access.
  • the terminal can directly use the fast re-authentication identifier of the terminal as the terminal identifier to securely access the terminal.
  • the embodiment of the present application provides a secure access method, device, and system, which can enable a terminal to re-authenticate at the next secure access after the terminal securely accesses through the full authentication process. The process completes secure access.
  • the embodiment of the present application provides the following technical solutions:
  • a secure access method comprising: a first authentication server receiving a first message from a non-3rd Generation Partnership Project 3GPP access device, the first message carrying a fast re-authentication identifier of the terminal The first authentication server determines to allow fast re-authentication; the first authentication server performs fast re-authentication with the terminal; the first authentication server sends a second message to the home subscriber server, the second message carrying a registration type identifier An identifier of the terminal and an address of the first authentication server, where the registration type identifier is used to indicate that the secure access of the terminal is a secure access using a fast re-authentication process; if the home subscriber server is configured according to the terminal The identifier determines that the address of the authentication server corresponding to the terminal is not stored, and the first authentication server receives the registration success indication from the home subscriber server; the first authentication server sends an access success indication to the terminal according to the registration success indication. Based on the method, after the terminal performs
  • the method further includes: the first authentication server receiving an access network type or an access network identifier from the non-3GPP access device; the first authentication server determining to allow fast re-authentication, The method includes: determining, by the first authentication server, at least one of the access network type, the access network identifier, whether the pre-configured home subscriber server supports fast re-authentication, or whether the access network is trusted. Fast re-authentication is allowed, wherein the information of whether the access network is trusted is determined according to the access network type or the access network identifier. Based on the method, the first authentication server can determine that fast re-authentication is allowed.
  • the method further includes: if the home subscriber server determines to store an address of the first authentication server according to the identifier of the terminal, the first authentication server receives a registration success indication from the home subscriber server; The first authentication server sends an access success indication to the terminal according to the registration success indication. Based on the method, the secure access of the terminal can be implemented in the case where the address of the first authentication server is stored in the home subscriber server.
  • the method further includes: if the home subscriber server determines to store an address of the second authentication server according to the identifier of the terminal, the first authentication server receives a registration failure indication from the home subscriber server, where The registration failure indication includes an address of the second authentication server, where the address of the second authentication server is used to indicate that the terminal is redirected to the second authentication server; and the first authentication server sends the connection to the terminal according to the registration failure indication. Enter the failure indication. Based on the method, the terminal can securely access the terminal through the second authentication server if the address of the second authentication server is stored in the home subscriber server.
  • the method further includes: the first authentication server determines that fast re-authentication is not allowed; and the first authentication server requests the terminal to complete secure access of the terminal based on the full authentication process. Based on the method, after the first authentication server determines that the fast re-authentication is not allowed, the terminal may be notified to initiate a secure access based on the full authentication process.
  • a second aspect provides a secure access method, the method comprising: receiving, by a home subscriber server, a second message from a first authentication server, where the second message carries a registration type identifier, an identifier of the terminal, and an address of the first authentication server
  • the registration type identifier is used to indicate that the secure access of the terminal is a secure access using the fast re-authentication process; if the home subscriber server determines, according to the identifier of the terminal, the address of the authentication server corresponding to the terminal is not stored.
  • the home subscriber server stores an address of the first authentication server according to the registration type identifier; the home subscriber server sends a registration success indication to the first authentication server, and the first authentication server sends the registration success indication to the terminal according to the registration success indication. Send an access success indication. Based on the method, after the terminal performs secure access through the full authentication process, if the terminal is logged off from the network, the secure access can still be completed through the fast re-authentication process during the next secure access.
  • the method further includes: if the home subscriber server determines to store an address of the first authentication server according to the identifier of the terminal, the home subscriber server sends a registration success indication to the first authentication server, where The first authentication server sends an access success indication to the terminal according to the registration success indication. Based on the method, the secure access of the terminal can be implemented in the case where the address of the first authentication server is stored in the home subscriber server.
  • the method further includes: if the home subscriber server determines to store an address of the second authentication server according to the identifier of the terminal, the home subscriber server sends a registration failure indication to the first authentication server, by the first An authentication server sends an access failure indication to the terminal according to the registration failure indication, where the registration failure indication includes an address of the second authentication server, and the address of the second authentication server is used to indicate that the terminal redirects to the first Two authentication servers.
  • the terminal can securely access the terminal through the second authentication server if the address of the second authentication server is stored in the home subscriber server.
  • a first authentication server having the functionality to implement the method described in the first aspect above.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a fourth aspect provides a first authentication server, including: a processor and a memory; the memory is configured to store a computer execution instruction, the processor is connected to the memory, and when the first authentication server is running, the processor executes The computer stored by the memory executes instructions to cause the first authentication server to perform the secure access method of any of the above first aspects.
  • a fifth aspect a computer readable storage medium having instructions stored therein that, when run on a computer, cause the computer to perform the secure access method of any of the above first aspects .
  • a computer program product comprising instructions which, when run on a computer, cause the computer to perform the secure access method of any of the above first aspects.
  • a chip system comprising a processor for supporting a first authentication server to implement the processing functions involved in the above aspects, such as determining to allow fast re-authentication.
  • the chip system further includes a memory for storing program instructions and data necessary for the first authentication server.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • a home subscriber server having the functionality to implement the method of the second aspect described above.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a ninth aspect provides a selective home subscriber server, including: a processor and a memory; the memory is configured to store a computer execution instruction, the processor is connected to the memory, and when the home subscriber server is running, the processor executes the The computer stored in the memory executes instructions to cause the home subscriber server to perform the secure access method of any of the second aspects above.
  • a computer readable storage medium having stored therein instructions that, when run on a computer, cause the computer to perform the secure access method of any of the above second aspects .
  • a computer program product comprising instructions which, when run on a computer, cause the computer to perform the secure access method of any of the above second aspects.
  • a chip system comprising a processor, configured to support a home subscriber server to implement a processing function involved in the foregoing aspect, for example, determining, according to an identifier of the terminal, that an authentication server corresponding to the terminal is not stored. address.
  • the chip system further includes a memory for storing program instructions and data necessary for the home subscriber server.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • a secure access system comprising the first authentication server of any of the above aspects and the home subscriber server of any of the above aspects.
  • FIG. 1 is a schematic structural diagram of a secure access system according to an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of hardware of a communication device according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart 1 of a secure access method according to an embodiment of the present disclosure
  • FIG. 4 is a second schematic flowchart of a secure access method according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a first authentication server according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a home subscriber server according to an embodiment of the present application.
  • the network architecture and the service scenario described in the embodiments of the present application are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation of the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.
  • FIG. 1 is a schematic structural diagram of a secure access system 10 according to an embodiment of the present application.
  • the secure access system 10 includes a non-3GPP access device 101, a first authentication server 102, and a home subscriber server 103.
  • the terminal accesses the 3GPP core network through the non-3GPP access device 101.
  • the non-3GPP access device 101 is configured to send a first message to the first authentication server 102, where the first message carries a fast re-authentication identifier of the terminal.
  • the first authentication server 102 is configured to receive the first message from the non-3GPP access device 101, and perform fast re-authentication with the terminal after determining that the fast re-authentication is allowed.
  • the first authentication server 102 is further configured to send a second message to the home subscriber server 103, where the second message carries a registration type identifier, an identifier of the terminal, and an address of the first authentication server, where the registration type identifier is used to indicate the current terminal.
  • Secure access is a secure access using a fast re-authentication process.
  • the home subscriber server 103 is configured to receive a second message from the first authentication server 102.
  • the home subscriber server 103 is further configured to: if the address of the authentication server corresponding to the terminal is not stored according to the identifier of the terminal, store the address of the first authentication server according to the registration type identifier, and send the registration to the first authentication server 102. Instructions.
  • the first authentication server 102 is further configured to receive a registration success indication from the home subscriber server 103, and send an access success indication to the terminal according to the registration success indication.
  • the non-3GPP access device 101, the first authentication server 102, and the home user server 103 in FIG. 1 may directly communicate with each other, and may also perform communication through forwarding of other network devices. limited.
  • the home subscriber server may send a registration success indication to the first authentication server according to the registration type identifier, so that the first authentication server may send an access success indication to the terminal according to the registration success indication.
  • the registration type identifier is used to indicate that the security access of the terminal is a secure access using the fast re-authentication process. Therefore, based on the method, after the terminal performs secure access through the full authentication process, if the terminal logs out from the network, the secure access can still be completed through the fast re-authentication process during the next secure access.
  • the secure access system 10 shown in FIG. 1 can be applied to a fourth-generation (4rd generation, 4G), fifth-generation (5rd generation, 5G) network supporting non-3GPP access, and supporting non-3GPP access.
  • 4G fourth-generation
  • 5rd generation fifth-generation
  • Other embodiments of the present application are not specifically limited in this embodiment.
  • the first authentication server may be the first 3GPP authentication, authorization, and accounting (authentication, authorization, and accounting). , AAA) server, the home subscriber server may be a home subscriber server (HSS); if the secure access system 10 shown in FIG. 1 can be applied to a 5G network supporting non-3GPP access, the first authentication described above
  • the server may be a first authentication service function (AUSF), and the home user server may be a unified data management (UDM) entity; if the security access system 10 shown in FIG. 1 can be applied to support For other networks that are not accessed by the 3GPP, the first authentication server and the home subscriber server may be other names, which are not specifically limited in this embodiment of the present application.
  • the terminal involved in the embodiment of the present application may include various handheld devices having wireless communication functions, in-vehicle devices, wearable devices, computing devices, or other processing devices connected to the wireless modem; Including user unit (subscriber unit), cellular phone, smart phone, wireless data card, personal digital assistant (PDA) computer, tablet computer, wireless modem (modem), handheld device Handheld, laptop computer, cordless phone or wireless local loop (WLL) station, machine type communication (MTC) terminal, user equipment (user equipment) , UE), mobile station (MS), terminal device, etc.
  • PDA personal digital assistant
  • WLL wireless local loop
  • MTC machine type communication
  • the terminal involved in the embodiment of the present application may be a 5G terminal, and may also be a traditional terminal, such as a 4G terminal, a 3G terminal, and the like.
  • the non-3GPP access device involved in the embodiment of the present application refers to a device that accesses the 3GPP core network through a non-3GPP network, and may be, for example, a non-3GPP gateway (N3G-GW).
  • N3G-GW non-3GPP gateway
  • the first authentication server or the home user server in FIG. 1 may be implemented by one physical device, or may be implemented by multiple physical devices, or may be a logical functional module in a physical device. This example does not specifically limit this.
  • FIG. 2 is a schematic diagram showing the hardware structure of a communication device according to an embodiment of the present application.
  • the communication device 200 includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.
  • the processor 201 can be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more for controlling the execution of the program of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication bus 202 can include a path for communicating information between the components described above.
  • the communication interface 204 uses devices such as any transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • devices such as any transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 203 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory can exist independently and be connected to the processor via a bus.
  • the memory can also be integrated with the processor.
  • the memory 203 is used to store application code for executing the solution of the present application, and is controlled by the processor 201 for execution.
  • the processor 201 is configured to execute the application code stored in the memory 203, thereby implementing the secure access method provided by the following embodiments of the present application.
  • processor 201 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • communication device 200 can include multiple processors, such as processor 201 and processor 208 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • processors herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • the communication device 200 can also include an output device 205 and an input device 206.
  • Output device 205 is in communication with processor 201 and can display information in a variety of ways.
  • the output device 205 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 206 is in communication with processor 201 and can accept user input in a variety of ways.
  • input device 206 can be a mouse, keyboard, touch screen device or sensing device, and the like.
  • the communication device 200 described above may be a general communication device or a dedicated communication device.
  • the communication device 200 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or the like in FIG. device.
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of the communication device 200.
  • the security access system 10 shown in FIG. 1 is applied to a 4G network that supports non-3GPP access.
  • the first authentication server is a first 3GPP AAA server
  • the home user server is an HSS.
  • FIG. 3 is provided in the embodiment of the present application.
  • a secure access method After the fast re-authentication of the first 3GPP AAA server and the terminal, the secure access method sends a registration type identifier to the HSS, where the registration type identifier is used to indicate that the security access of the current terminal is a fast re-authentication process. Access.
  • the registration success indication may be sent to the first 3GPP AAA server according to the registration type identifier, and the first 3GPP AAA server is configured according to the first 3GPP AAA server.
  • the registration success indication sends an access success indication to the terminal, so that the secure access is completed through the fast re-authentication procedure.
  • the method includes the following steps:
  • the terminal establishes a connection with the non-3GPP access device.
  • the non-3GPP access device sends an EAP request message 1 to the terminal. Accordingly, the terminal receives the EAP Request message 1 from the non-3GPP receiving device.
  • the EAP request message 1 is used to request the identifier of the terminal.
  • the EAP request message 1 may be, for example, an EAP-Request/identity (ID) message.
  • ID EAP-Request/identity
  • the terminal sends an EAP response message 1 to the non-3GPP access device.
  • the non-3GPP access device receives the EAP response message 1 from the terminal.
  • the EAP response message 1 carries the fast re-authentication identifier of the terminal.
  • the fast re-authentication identifier of the terminal in the embodiment of the present application is generated by the 3GPP AAA server and sent to the terminal when the terminal performs the full authentication, and may refer to the existing full authentication process. Narration.
  • the EAP response message 1 may be, for example, an EAP-Response/identity message.
  • the non-3GPP access device sends a Diameter EAP Request (DER) message 1 to the first 3GPP AAA server. Accordingly, the 3GPP AAA server receives the DER message 1 from the non-3GPP access device.
  • the DER message 1 includes an EAP response message 1.
  • the DER message 1 may further include an access network type or an access network identifier, which is not specifically limited in this embodiment of the present application.
  • the access network type may be, for example, WiFi or CDMA, and is not specifically limited in this embodiment of the present application.
  • the first 3GPP AAA server determines to allow fast re-authentication.
  • the first 3GPP AAA server may be based on the access network type in the DER message 1, the access network identifier in the DER message 1, whether the pre-configured HSS supports the fast re-authentication capability, or whether the access network is available. At least one of the information of the letter determines that fast re-authentication is allowed, wherein the information of whether the access network is trusted is determined according to the access network type in DER message 1 or the access network identifier in DER message 1.
  • the first 3GPP AAA server can determine whether to allow fast weight according to whether the configured HSS supports fast re-authentication. Authentication; or, assuming that the access network determined according to the access network type in DER message 1 or the access network identifier in DER message 1 is trusted, the first 3GPP AAA server may be based on whether the access network is trusted or not. Make sure to allow fast re-authentication.
  • the first 3GPP AAA server and the EAP authentication algorithm used by the terminal to negotiate the EAP message The first 3GPP AAA server and the EAP authentication algorithm used by the terminal to negotiate the EAP message.
  • the EAP authentication algorithm may be, for example, an EAP authentication and key agreement (EAP-AKA) authentication algorithm based on authentication and key agreement or an enhanced EAP-AKA (improved EAP-AKA, EAP-AKA'
  • EAP-AKA EAP authentication and key agreement
  • EAP-AKA enhanced EAP-AKA
  • the authentication algorithm and the like are not specifically limited in this application.
  • the related implementation of the first 3GPP AAA server and the terminal to negotiate the EAP authentication algorithm may refer to the existing implementation manner, and details are not described herein again.
  • the first 3GPP AAA server and the terminal perform fast re-authentication by using an EAP authentication algorithm.
  • the related implementation of the fast re-authentication of the first 3GPP AAA server and the terminal by using the EAP authentication algorithm may refer to the existing implementation manner, and details are not described herein again.
  • the first 3GPP AAA server sends a registration request message to the HSS. Accordingly, the HSS receives a registration request message from the first 3GPP AAA server.
  • the registration request message carries a registration type identifier, an identifier of the terminal, and an address of the first 3GPP AAA server.
  • the registration type identifier is used to indicate that the security access of the current terminal is a secure access using the fast re-authentication process.
  • the registration request message may also carry an access network identifier or an access network type, which is not specifically limited in this embodiment of the present application.
  • the identifier of the terminal may be, for example, an international mobile subscriber identity (IMSI) or the like, which is not specifically limited in this embodiment of the present application.
  • IMSI international mobile subscriber identity
  • the HSS determines, according to the identifier of the terminal, whether to store an address of a 3GPP AAA server corresponding to the terminal.
  • the HSS may query the database to determine whether to store the address of the 3GPP AAA server corresponding to the terminal.
  • steps S310-S313 are performed;
  • steps S314-S316 are performed.
  • the HSS sends a registration success indication to the first 3GPP AAA server.
  • the first 3GPP AAA server receives a registration success indication from the HSS.
  • the first 3GPP AAA server sends the DER message 2 to the non-3GPP access device according to the registration success indication. Accordingly, the non-3GPP access device receives the DER message 2 from the first 3GPP AAA server.
  • the DER message 2 includes an access success indication.
  • the DER message 2 may further include information such as a quality of service (QoS), an access point name (APN), and the like, which is not specifically limited in this embodiment of the present application.
  • QoS quality of service
  • API access point name
  • the non-3GPP access device sends an access success indication to the terminal.
  • the terminal receives an access success indication from the non-3GPP access device.
  • the first 3GPP AAA server stores an address of the first 3GPP AAA server.
  • the first 3GPP AAA server After the first 3GPP AAA server stores the address of the first 3GPP AAA server, when the subsequent terminal initiates the secure access, the first 3GPP AAA server may send a registration success indication to the first 3GPP AAA server, which is used by the embodiment of the present application. No specific limitation.
  • the HSS sends a registration failure indication to the first 3GPP AAA server.
  • the first 3GPP AAA server receives a registration failure indication from the HSS.
  • the registration failure indication includes an address of the second 3GPP AAA server for instructing the terminal to redirect to the second 3GPP AAA server.
  • the first 3GPP AAA server sends the DER message 3 to the non-3GPP access device according to the registration failure indication. Accordingly, the non-3GPP access device receives the DER message 3 from the first 3GPP AAA server.
  • the DER message 2 includes an access failure indication, where the access failure indication includes an address of the second 3GPP AAA server, and is used to instruct the terminal to redirect to the second 3GPP AAA server.
  • the non-3GPP access device sends an access failure indication to the terminal.
  • the terminal receives an access failure indication from the non-3GPP access device.
  • the terminal may be redirected to the second 3GPP AAA server according to the address of the second 3GPP AAA server.
  • the terminal may be redirected to the second 3GPP AAA server according to the address of the second 3GPP AAA server.
  • the HSS when the terminal uses the fast re-authentication procedure for secure access, if the HSS determines, according to the identifier of the terminal, that the address of the 3GPP AAA server corresponding to the terminal is not stored, the HSS may The registration type identifier sends a registration success indication to the first 3GPP AAA server, so that the first 3GPP AAA server can send an access success indication to the terminal according to the registration success indication.
  • the registration type identifier is used to indicate that the security access of the terminal is a secure access using the fast re-authentication process. Therefore, based on the method, after the terminal performs secure access through the full authentication process, if the terminal logs out from the network, the secure access can still be completed through the fast re-authentication process during the next secure access.
  • the action of the first 3GPP AAA server or the HSS in the foregoing steps S301 to S316 can be performed by the processor 201 in the communication device 200 shown in FIG. 2 by calling the application code stored in the memory 203. No restrictions are imposed.
  • the security access system 10 shown in FIG. 1 is applied to a 4G network that supports non-3GPP access.
  • the first authentication server is a first 3GPP AAA server
  • the home user server is an HSS.
  • Another secure access method provided by the embodiment.
  • the secure access method notifies the terminal to initiate secure access based on the full authentication process after the first 3GPP AAA server determines that fast re-authentication is not allowed.
  • the method includes the following steps:
  • the first 3GPP AAA server determines that fast re-authentication is not allowed.
  • the first 3GPP AAA server may be based on the access network type in the DER message 1, the access network identifier in the DER message 1, whether the pre-configured HSS supports the fast re-authentication capability, or whether the access network is available. At least one of the information of the letter determines that the fast re-authentication is not allowed, wherein the information that the access network is trusted is determined according to the access network type in the DER message 1 or the access network identifier in the DER message 1. .
  • the first 3GPP AAA server may determine that the configured HSS supports the fast re-authentication capability.
  • Fast re-authentication or, assuming that the access network determined according to the access network type in DER message 1 or the access network identity in DER message 1 is not trusted, the first 3GPP AAA server may be trusted according to the access network The information determines that fast re-authentication is not allowed.
  • the first 3GPP AAA server sends the DER message 2 to the non-3GPP access device. Accordingly, the non-3GPP access device receives the DER message 2 from the first 3GPP AAA server.
  • the DER message 2 includes an EAP request message 2.
  • the EAP request message 2 is used to request that the secure access of the terminal is completed based on the full authentication process.
  • the non-3GPP access device sends an EAP request message 2 to the terminal.
  • the terminal receives the EAP Request message 2 from the non-3GPP access device.
  • the terminal initiates a secure access based on the full authentication process according to the EAP request message 2.
  • the first 3GPP AAA server may notify the terminal to initiate secure access based on the full authentication process.
  • the action of the first 3GPP AAA server or the HSS in the foregoing steps S401 to S408 can be performed by the processor 201 in the communication device 200 shown in FIG. 2 by calling the application code stored in the memory 203. No restrictions are imposed.
  • the first authentication server or the home subscriber server includes a hardware structure and/or a software module corresponding to each function.
  • the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.
  • the embodiment of the present application may perform the division of the function module on the first authentication server or the home user server according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one process.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 5 shows a possible structural diagram of the first authentication server 50 involved in the above embodiment.
  • the first authentication server 50 includes a receiving module 501, a processing module 502, and a sending module 503.
  • the receiving module 501 is configured to receive a first message from a non-3GPP access device, where the first message carries a fast re-authentication identifier of the terminal.
  • the processing module 502 is configured to determine that fast re-authentication is allowed.
  • the processing module 502 is further configured to perform fast re-examination with the first authentication server and the terminal.
  • the sending module 503 is configured to send a second message to the home subscriber server, where the second message carries a registration type identifier, an identifier of the terminal, and an address of the first authentication server, where the registration type identifier is used to indicate that the security access of the current terminal is Secure access using the fast re-authentication process.
  • the receiving module 501 is further configured to: if the home subscriber server determines that the address of the authentication server corresponding to the terminal is not stored according to the identifier of the terminal, receive the registration success indication from the home subscriber server.
  • the sending module 503 is further configured to send an access success indication to the terminal according to the registration success indication.
  • the receiving module 501 is further configured to receive an access network type or an access network identifier from the non-3GPP access device.
  • the processing module 502 is specifically configured to: determine, according to at least one of an access network type, an access network identifier, a pre-configured home subscriber server that supports fast re-authentication, or whether the access network is trusted, Fast re-authentication, wherein the information of whether the access network is trusted is determined according to the access network type or the access network identifier.
  • the receiving module 501 is further configured to: if the home subscriber server determines to store the address of the first authentication server according to the identifier of the terminal, receive the registration success indication from the home subscriber server.
  • the sending module 503 is further configured to send an access success indication to the terminal according to the registration success indication.
  • the receiving module 501 is further configured to: if the home subscriber server determines to store the address of the second authentication server according to the identifier of the terminal, receive a registration failure indication from the home subscriber server, where the registration failure indication includes the address of the second authentication server.
  • the address of the second authentication server is used to instruct the terminal to redirect to the second authentication server.
  • the sending module 503 is further configured to send an access failure indication to the terminal according to the registration failure indication.
  • the method further includes: a processing module 502, configured to determine that fast re-authentication is not allowed.
  • the sending module 503 is further configured to request the terminal to complete the secure access of the terminal based on the full authentication process.
  • the first authentication server 50 is presented in a form that divides each functional module in an integrated manner.
  • a “module” herein may refer to an Application-Specific Integrated Circuit (ASIC), circuitry, a processor and memory that executes one or more software or firmware programs, integrated logic circuitry, and/or other functions that provide the functionality described above. Device.
  • ASIC Application-Specific Integrated Circuit
  • the first authentication server 50 can take the form shown in FIG.
  • the receiving module 501, the processing module 502, and the transmitting module 503 in FIG. 5 can be implemented by the processor 201 and the memory 203 of FIG.
  • the receiving module 501, the processing module 502, and the sending module 503 may be executed by using the application code stored in the memory 203 by the processor 201, which is not limited in this embodiment.
  • the first authentication server provided by the embodiment of the present application can be used to perform the foregoing security access method. Therefore, the technical solutions that can be obtained by reference to the foregoing method embodiments are not described herein.
  • FIG. 6 shows a possible structural diagram of the home subscriber server 60 involved in the above embodiment.
  • the home subscriber server 60 includes a receiving module 601, a processing module 602, a storage module 603, and a sending module 604.
  • the receiving module 601 is configured to receive a second message from the first authentication server, where the second message carries a registration type identifier, an identifier of the terminal, and an address of the first authentication server, where the registration type identifier is used to indicate the security connection of the current terminal.
  • the processing module 602 is configured to determine, according to the identifier of the terminal, that an address of the authentication server corresponding to the terminal is not stored.
  • the storage module 604 is configured to store an address of the first authentication server according to the registration type identifier.
  • the sending module 603 is configured to send a registration success indication to the first authentication server, and the first authentication server sends an access success indication to the terminal according to the registration success indication.
  • the processing module 602 is further configured to determine, according to the identifier of the terminal, a location where the first authentication server is stored.
  • the sending module 603 is further configured to send a registration success indication to the first authentication server, where the first authentication server sends an access success indication to the terminal according to the registration success indication.
  • the processing module 602 is further configured to determine, according to the identifier of the terminal, the address of the second authentication server.
  • the sending module 603 is further configured to send a registration failure indication to the first authentication server, where the first authentication server sends an access failure indication to the terminal according to the registration failure indication, where the registration failure indication includes an address of the second authentication server,
  • the address of the second authentication server is used to instruct the terminal to redirect to the second authentication server.
  • the home subscriber server 60 is presented in a form that divides the various functional modules in an integrated manner.
  • a “module” herein may refer to an Application-Specific Integrated Circuit (ASIC), a circuit, a processor and memory that executes one or more software or firmware programs, integrated logic circuits, and/or other functions that provide the above functionality.
  • ASIC Application-Specific Integrated Circuit
  • the home subscriber server 60 can take the form shown in FIG.
  • the receiving module 601, the processing module 602, the storage module 603, and the transmitting module 604 in FIG. 6 can be implemented by the processor 201 and the memory 203 of FIG.
  • the receiving module 601, the processing module 602, the storage module 603, and the sending module 604 can be executed by the processor 201 to call the application code stored in the memory 203, which is not limited in this embodiment.
  • the home subscriber server provided by the embodiment of the present application can be used to perform the foregoing security access method. Therefore, the technical solutions that can be obtained by reference to the foregoing method embodiments are not described herein.
  • the first authentication server and the home subscriber server are presented in a form that divides each functional module in an integrated manner.
  • the embodiments of the present application may also be used to divide each function module of the first authentication server or the home user server corresponding to each function, which is not specifically limited in this embodiment of the present application.
  • the embodiment of the present application provides a chip system, where the chip system includes a processor, configured to support the first authentication server to implement the foregoing secure access method, for example, to determine that fast re-authentication is allowed.
  • the chip system also includes a memory.
  • the memory is used to save program instructions and data necessary for the first authentication server.
  • the chip system may be composed of a chip, and may also include a chip and other discrete devices. This embodiment of the present application does not specifically limit this.
  • the embodiment of the present application provides a chip system, where the chip system includes a processor, configured to support the home user server to implement the foregoing secure access method, for example, determining, according to the identifier of the terminal, that the authentication server corresponding to the terminal is not stored. the address of.
  • the chip system also includes a memory.
  • the memory is used to store program instructions and data necessary for the home subscriber server.
  • the chip system may be composed of a chip, and may also include a chip and other discrete devices. This embodiment of the present application does not specifically limit this.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device that includes one or more servers, data centers, etc. that can be integrated with the media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a Solid State Disk (SSD)) or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a DVD
  • a semiconductor medium such as a Solid State Disk (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供安全接入方法、设备及系统，能够使得在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，在下一次安全接入时，仍然可以通过快速重鉴权流程完成安全接入。方法包括：第一认证服务器接收来自非3GPP接入设备的第一消息；确定允许进行快速重鉴权后，与终端进行快速重鉴权；向归属用户服务器发送第二消息，第二消息携带注册类型标识、终端的标识和第一认证服务器的地址，注册类型标识用于指示本次终端的安全接入为使用快速重鉴权流程的安全接入；若归属用户服务器根据终端的标识确定未存储与终端对应的认证服务器的地址，接收来自归属用户服务器的注册成功指示；并根据注册成功指示，向终端发送接入成功指示。

Description

安全接入方法、设备及系统
本申请要求于2017年8月16日提交中国专利局、申请号为201710703914.8、发明名称为“安全接入方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及安全接入方法、设备及系统。
背景技术
随着智能终端和无线保真(wireless fidelity，WiFi)技术的发展和普及，以及码分多址(code division multiple access，CDMA)运营商在长期演进(long term evolution，LTE)网络中复用CDMA原有接入网的要求，使用智能终端通过非第三代合作伙伴计划(3rd generation partnership project，3GPP)接入网(如WiFi或者CDMA)接入到3GPP核心网的需求越来越多，并广泛的应用于基于WiFi的语音业务(voice over WiFi，VoWiFi)中。
目前，终端在通过非3GPP接入网接入到3GPP核心网时，一般通过可扩展认证协议(extensible authentication protocol，EAP)鉴权流程来完成非3GPP接入时的安全接入。其中，在终端初始接入网络时，终端使用EAP全鉴权流程进行安全接入，在EAP全鉴权流程中，认证服务器生成终端的快速重鉴权标识，并将该终端的快速重鉴权标识发送给终端。这样，在终端注销前重新接入网络时，终端可以使用简化的EAP快速重鉴权流程进行安全接入。具体的，在EAP快速重鉴权流程中，终端可以直接使用终端的快速重鉴权标识作为终端标识对终端进行安全接入。
然而，在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，如何在下一次安全接入时，仍然可以通过快速重鉴权证流程完成安全接入，目前并没有相关的解决方案。
发明内容
本申请实施例提供安全接入方法、设备及系统，能够使得在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，在下一次安全接入时，仍然可以通过快速重鉴权流程完成安全接入。
为达到上述目的，本申请实施例提供如下技术方案：
第一方面，提供一种安全接入方法，该方法包括：第一认证服务器接收来自非第三代合作伙伴计划3GPP接入设备的第一消息，该第一消息携带终端的快速重鉴权标识；该第一认证服务器确定允许进行快速重鉴权；该第一认证服务器与该终端进行快速重鉴权；该第一认证服务器向归属用户服务器发送第二消息，该第二消息携带注册类型标识、该终端的标识和该第一认证服务器的地址，该注册类型标识用于指示本次该终端的安全接入为使用快速重鉴权流程的安全接入；若该归属用户服务器根据该终端的标识确定未存储与该终端对应的认证服务器的地址，该第一认证服务器接收来自该归属用户服务器的注册成功指 示；该第一认证服务器根据该注册成功指示，向该终端发送接入成功指示。基于该方法，能够使得在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，在下一次安全接入时，仍然可以通过快速重鉴权流程完成安全接入。
在一种可能的设计中，该方法还包括：该第一认证服务器接收来自该非3GPP接入设备的接入网络类型或者接入网络标识；该第一认证服务器确定允许进行快速重鉴权，包括：该第一认证服务器根据该接入网络类型、该接入网络标识、预先配置的归属用户服务器是否支持快速重鉴权的能力、或者接入网络是否可信的信息中的至少一个，确定允许进行快速重鉴权，其中，该接入网络是否可信的信息是根据该接入网络类型或者该接入网络标识确定的。基于该方法，第一认证服务器可以确定允许进行快速重鉴权。
在一种可能的设计中，该方法还包括：若该归属用户服务器根据该终端的标识确定存储该第一认证服务器的地址，该第一认证服务器接收来自该归属用户服务器的注册成功指示；该第一认证服务器根据该注册成功指示，向该终端发送接入成功指示。基于该方法，可以在归属用户服务器中存储第一认证服务器的地址的情况下，实现终端的安全接入。
在一种可能的设计中，该方法还包括：若该归属用户服务器根据该终端的标识确定存储第二认证服务器的地址，该第一认证服务器接收来自该归属用户服务器的注册失败指示，其中，该注册失败指示包括该第二认证服务器的地址，该第二认证服务器的地址用于指示该终端重定向到该第二认证服务器；该第一认证服务器根据该注册失败指示，向该终端发送接入失败指示。基于该方法，可以在归属用户服务器中存储第二认证服务器的地址的情况下，实现终端通过第二认证服务器的安全接入。
在一种可能的设计中，该方法还包括：该第一认证服务器确定不允许进行快速重鉴权；该第一认证服务器向该终端请求基于全鉴权流程完成该终端的安全接入。基于该方法，在第一认证服务器确定不允许进行快速重鉴权之后，可以通知终端发起基于全鉴权流程的安全接入。
第二方面，提供一种安全接入方法，该方法包括：归属用户服务器接收来自第一认证服务器的第二消息，该第二消息携带注册类型标识、终端的标识和该第一认证服务器的地址，该注册类型标识用于指示本次该终端的安全接入为使用快速重鉴权流程的安全接入；若该归属用户服务器根据该终端的标识确定未存储与该终端对应的认证服务器的地址，该归属用户服务器根据该注册类型标识，存储该第一认证服务器的地址；该归属用户服务器向该第一认证服务器发送注册成功指示，由该第一认证服务器根据该注册成功指示，向该终端发送接入成功指示。基于该方法，能够使得在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，在下一次安全接入时，仍然可以通过快速重鉴权流程完成安全接入。
在一种可能的设计中，该方法还包括：若该归属用户服务器根据该终端的标识确定存储该第一认证服务器的地址，该归属用户服务器向该第一认证服务器发送注册成功指示，由该第一认证服务器根据该注册成功指示，向该终端发送接入成功指示。基于该方法，可以在归属用户服务器中存储第一认证服务器的地址的情况下，实现终端的安全接入。
在一种可能的设计中，该方法还包括：若该归属用户服务器根据该终端的标识确定存储第二认证服务器的地址，该归属用户服务器向该第一认证服务器发送注册失败指示，由该第一认证服务器根据该注册失败指示，向该终端发送接入失败指示，其中，该注册失败 指示包括该第二认证服务器的地址，该第二认证服务器的地址用于指示该终端重定向到该第二认证服务器。基于该方法，可以在归属用户服务器中存储第二认证服务器的地址的情况下，实现终端通过第二认证服务器的安全接入。
第三方面，提供了一种第一认证服务器，该第一认证服务器具有实现上述第一方面所述的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面，提供了一种第一认证服务器，包括：处理器和存储器；该存储器用于存储计算机执行指令，该处理器与该存储器连接，当该第一认证服务器运行时，该处理器执行该存储器存储的该计算机执行指令，以使该第一认证服务器执行如上述第一方面中任一所述的安全接入方法。
第五方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项的安全接入方法。
第六方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项的安全接入方法。
第七方面，提供了一种芯片系统，该芯片系统包括处理器，用于支持第一认证服务器实现上述方面中所涉及的处理功能，例如确定允许进行快速重鉴权。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存第一认证服务器必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第三方面至第七方面中任一种设计方式所带来的技术效果可参见第一方面中不同设计方式所带来的技术效果，此处不再赘述。
第八方面，提供了一种归属用户服务器，该归属用户服务器具有实现上述第二方面所述的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第九方面，提供了一种选择归属用户服务器，包括：处理器和存储器；该存储器用于存储计算机执行指令，该处理器与该存储器连接，当该归属用户服务器运行时，该处理器执行该存储器存储的该计算机执行指令，以使该归属用户服务器执行如上述第二方面中任一所述的安全接入方法。
第十方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第二方面中任意一项的安全接入方法。
第十一方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第二方面中任意一项的安全接入方法。
第十二方面，提供了一种芯片系统，该芯片系统包括处理器，用于支持归属用户服务器实现上述方面中所涉及的处理功能，例如根据终端的标识确定未存储与终端对应的认证服务器的地址。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存归属用户服务器必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第八方面至第十二方面中任一种设计方式所带来的技术效果可参见第二方面中不同设计方式所带来的技术效果，此处不再赘述。
第十三方面，提供了一种安全接入系统，该安全接入系统包括上述任一方面所述的第一认证服务器和上述任一方面所述的归属用户服务器。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请实施例提供的安全接入系统的架构示意图；
图2为本申请实施例提供的通信设备的硬件结构示意图；
图3为本申请实施例提供的安全接入方法的流程示意图一；
图4为本申请实施例提供的安全接入方法的流程示意图二；
图5为本申请实施例提供的第一认证服务器的结构示意图；
图6为本申请实施例提供的归属用户服务器的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图1所示，为本申请实施例提供的安全接入系统10的架构示意图。该安全接入系统10包括非3GPP接入设备101、第一认证服务器102和归属用户服务器103。
其中，终端通过非3GPP接入设备101接入3GPP核心网。
非3GPP接入设备101，用于向第一认证服务器102发送第一消息，该第一消息携带终端的快速重鉴权标识。
第一认证服务器102，用于接收来自非3GPP接入设备101的第一消息，并在确定允许进行快速重鉴权之后，与终端进行快速重鉴权。
第一认证服务器102，还用于向归属用户服务器103发送第二消息，该第二消息携带注册类型标识、终端的标识和第一认证服务器的地址，该注册类型标识用于指示本次该终端的安全接入为使用快速重鉴权流程的安全接入。
归属用户服务器103，用于接收来自第一认证服务器102的第二消息。
归属用户服务器103，还用于若根据该终端的标识确定未存储与该终端对应的认证服务器的地址，根据注册类型标识，存储第一认证服务器的地址，以及向第一认证服务器 102发送注册成功指示。
第一认证服务器102，还用于接收来自所述归属用户服务器103的注册成功指示，并根据该注册成功指示，向该终端发送接入成功指示。
可选的，图1中的非3GPP接入设备101、第一认证服务器102和归属用户服务器103之间可能直接通信，也可能通过其他网络设备的转发进行通信，本申请实施例对此不作具体限定。
本申请实施例提供的安全接入系统中，终端在使用快速重鉴权流程进行安全接入时，若归属用户服务器根据该终端的标识确定未存储与该终端对应的认证服务器的地址，归属用户服务器可以根据注册类型标识，向第一认证服务器发送注册成功指示，这样，第一认证服务器可以根据注册成功指示，向该终端发送接入成功指示。其中，该注册类型标识用于指示本次该终端的安全接入为使用快速重鉴权流程的安全接入。因此，基于该方法，能够使得在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，在下一次安全接入时，仍然可以通过快速重鉴权流程完成安全接入。
可选的，图1所示的安全接入系统10可以应用于支持非3GPP接入的第四代(4rd generation，4G)、第五代(5rd generation，5G)网络以及支持非3GPP接入的未来其它的网络，本申请实施例对此不作具体限定。
其中，若图1所示的安全接入系统10可以应用于支持非3GPP接入的4G网络，则上述的第一认证服务器可以为第一3GPP鉴权、授权和计费(authentication，authorization and accounting，AAA)服务器，归属用户服务器可以为归属用户服务器(home subscriber server，HSS)；若图1所示的安全接入系统10可以应用于支持非3GPP接入的5G网络，则上述的第一认证服务器可以为第一鉴权服务功能实体(authentication server function，AUSF)，归属用户服务器可以为统一数据管理(unified data management，UDM)实体；若图1所示的安全接入系统10可以应用于支持非3GPP接入的其他网络，则第一认证服务器和归属用户服务器可以为其他名字，本申请实施例对此不作具体限定。
可选的，本申请实施例中所涉及到的终端(terminal)可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备；还可以包括用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication,MTC)终端、用户设备(user equipment，UE)，移动台(mobile station，MS)，终端设备(terminal device)等。为方便描述，本申请中，上面提到的设备统称为终端。此外，本申请实施例中所涉及的终端可以是5G终端，也可以是传统终端，比如4G终端，3G终端等，本申请实施例对此不作具体限定。
可选的，本申请实施例中所涉及到的非3GPP接入设备指的是通过非3GPP网络接入3GPP核心网的设备，例如可以是非3GPP接入网关(non-3GPP gateway，N3G-GW)，本申请实施例对此不作具体限定。
可选的，图1中的第一认证服务器或归属用户服务器，可以由一个实体设备实现，也 可以由多个实体设备共同实现，还可以是一个实体设备内的一个逻辑功能模块，本申请实施例对此不作具体限定。
例如，图1中的第一认证服务器或归属用户服务器可以通过图2中的通信设备来实现。图2所示为本申请实施例提供的通信设备的硬件结构示意图。通信设备200包括至少一个处理器201，通信总线202，存储器203以及至少一个通信接口204。
处理器201可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信总线202可包括一通路，在上述组件之间传送信息。
通信接口204，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器203可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器203用于存储执行本申请方案的应用程序代码，并由处理器201来控制执行。处理器201用于执行存储器203中存储的应用程序代码，从而实现本申请下述实施例提供的安全接入方法。
在具体实现中，作为一种实施例，处理器201可以包括一个或多个CPU，例如图2中的CPU0和CPU1。
在具体实现中，作为一种实施例，通信设备200可以包括多个处理器，例如图2中的处理器201和处理器208。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，通信设备200还可以包括输出设备205和输入设备206。输出设备205和处理器201通信，可以以多种方式来显示信息。例如，输出设备205可以是液晶显示器(liquid crystal display，LCD),发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备206和处理器201通信，可以以多种方式接受用户的输入。例如，输入设备206可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的通信设备200可以是一个通用通信设备或者是一个专用通信设备。在具体实现中，通信设备200可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital  assistant，PDA)、移动手机、平板电脑、无线终端设备、嵌入式设备或有图2中类似结构的设备。本申请实施例不限定通信设备200的类型。
下面将结合图1和图2对本申请实施例提供的安全接入方法进行具体阐述。
以图1所示的安全接入系统10应用于支持非3GPP接入的4G网络，第一认证服务器为第一3GPP AAA服务器，归属用户服务器为HSS为例，图3为本申请实施例提供的一种安全接入方法。该安全接入方法在第一3GPP AAA服务器和终端进行快速重鉴权之后，向HSS发送注册类型标识，该注册类型标识用于指示本次终端的安全接入为使用快速重鉴权流程的安全接入。这样，在归属用户服务器根据终端的标识确定未存储与该终端对应的3GPP AAA服务器的地址之后，可以根据该注册类型标识，向第一3GPP AAA服务器发送注册成功指示，由第一3GPP AAA服务器根据该注册成功指示，向该终端发送接入成功指示，从而通过快速重鉴权流程完成安全接入。具体的，该方法包括如下步骤：
S301、终端和非3GPP接入设备建立连接。
其中，终端和非3GPP接入设备连接建立的过程可参考现有的实现方式，在此不再赘述。
S302、非3GPP接入设备向终端发送EAP请求消息1。相应的，终端接收来自非3GPP接收设备的EAP请求消息1。
其中，该EAP请求消息1用于请求终端的标识。
可选的，该EAP请求消息1例如可以是EAP-Request/标识(identity，ID)消息。
S303、终端向非3GPP接入设备发送EAP响应消息1。相应的，非3GPP接入设备接收来自终端的EAP响应消息1。该EAP响应消息1携带终端的快速重鉴权标识。
其中，本申请实施例中终端的快速重鉴权标识为终端上次进行全鉴权时，由3GPP AAA服务器生成并发送给该终端的，具体可参考现有的全鉴权流程，在此不再赘述。
可选的，该EAP响应消息1例如可以是EAP-Response/identity消息。
S304、非3GPP接入设备向第一3GPP AAA服务器发送Diameter EAP请求(Diameter EAP Request，DER)消息1。相应的，3GPP AAA服务器接收来自非3GPP接入设备的DER消息1。该DER消息1中包括EAP响应消息1。
可选的，本申请实施例中，该DER消息1中还可以包括接入网络类型或接入网络标识等，本申请实施例对此不作具体限定。其中，该接入网络类型例如可以是WiFi或者CDMA等，本申请实施例对此不作具体限定。
S305、第一3GPP AAA服务器确定允许进行快速重鉴权。
可选的，第一3GPP AAA服务器可以根据DER消息1中的接入网络类型、DER消息1中的接入网络标识、预先配置的HSS是否支持快速重鉴权的能力、或者接入网络是否可信的信息中的至少一个，确定允许进行快速重鉴权，其中，接入网络是否可信的信息是根据DER消息1中的接入网络类型或者DER消息1中的接入网络标识确定的。
示例性的，假设配置的HSS是否支持快速重鉴权的能力为HSS支持快速重鉴权的注册，则第一3GPP AAA服务器可以根据配置的HSS是否支持快速重鉴权的能力确定允许进行快速重鉴权；或者，假设根据DER消息1中的接入网络类型或者DER消息1中的接入网络标识确定的接入网络可信，则第一3GPP AAA服务器可以根据接入网络是否可信的 信息确定允许进行快速重鉴权。
S306、第一3GPP AAA服务器和终端通过EAP消息协商使用的EAP鉴权算法。
可选的，该EAP鉴权算法例如可以是基于认证和密钥协商的EAP(EAP authentication and key agreement，EAP-AKA)鉴权算法或者增强的EAP-AKA(improved EAP-AKA，EAP-AKA')鉴权算法等，本申请对此不作具体限定。
其中，第一3GPP AAA服务器和终端协商EAP鉴权算法的相关实现可参考现有的实现方式，在此不再赘述。
S307、第一3GPP AAA服务器和终端通过EAP鉴权算法进行快速重鉴权。
其中，第一3GPP AAA服务器和终端通过EAP鉴权算法进行快速重鉴权的相关实现可参考现有的实现方式，在此不再赘述。
S308、第一3GPP AAA服务器向HSS发送注册请求消息。相应的，该HSS接收来自第一3GPP AAA服务器的注册请求消息。
其中，该注册请求消息携带注册类型标识、终端的标识和第一3GPP AAA服务器的地址。该注册类型标识用于指示本次终端的安全接入为使用快速重鉴权流程的安全接入。
可选的，该注册请求消息还可以携带接入网络标识或者接入网络类型等，本申请实施例对此不作具体限定。
可选的，终端的标识例如可以是国际移动用户标识(international mobile subscriber identity，IMSI)或者其他，本申请实施例对此不作具体限定。
S309、HSS根据终端的标识确定是否存储与终端对应的3GPP AAA服务器的地址。
可选的，HSS可以查询数据库来确定是否存储与终端对应的3GPP AAA服务器的地址。
其中，若HSS确定未存储与终端对应的3GPP AAA服务器的地址，执行步骤S310-S313；
若HSS确定存储第一3GPP AAA服务器的地址，执行步骤S310-S312；
若HSS确定存储第二3GPP AAA服务器的地址，执行步骤S314-S316。
S310、HSS向第一3GPP AAA服务器发送注册成功指示。相应的，该第一3GPP AAA服务器接收来自HSS的注册成功指示。
S311、第一3GPP AAA服务器根据注册成功指示，向非3GPP接入设备发送DER消息2。相应的，非3GPP接入设备接收来自第一3GPP AAA服务器的DER消息2。其中，该DER消息2中包括接入成功指示。
可选的，该DER消息2中还可以包括服务质量(quality of service，QoS)、接入点名称(access point name，APN)等信息，本申请实施例对此不作具体限定。
S312、非3GPP接入设备向终端发送接入成功指示。相应的，终端接收来自非3GPP接入设备的接入成功指示。
S313、第一3GPP AAA服务器存储第一3GPP AAA服务器的地址。
在第一3GPP AAA服务器存储第一3GPP AAA服务器的地址之后，后续终端发起安全接入时，可以基于该第一3GPP AAA服务器，向第一3GPP AAA服务器发送注册成功指示，本申请实施例对此不作具体限定。
S314、HSS向第一3GPP AAA服务器发送注册失败指示。相应的，该第一3GPP AAA 服务器接收来自HSS的注册失败指示。该注册失败指示包括第二3GPP AAA服务器的地址，用于指示终端重定向到第二3GPP AAA服务器。
S315、第一3GPP AAA服务器根据注册失败指示，向非3GPP接入设备发送DER消息3。相应的，非3GPP接入设备接收来自第一3GPP AAA服务器的DER消息3。其中，该DER消息2中包括接入失败指示，该接入失败指示包括第二3GPP AAA服务器的地址，用于指示终端重定向到第二3GPP AAA服务器。
S316、非3GPP接入设备向终端发送接入失败指示。相应的，终端接收来自非3GPP接入设备的接入失败指示。
可选的，终端在接收到接入失败指示之后，可以根据第二3GPP AAA服务器的地址，重定向到第二3GPP AAA服务器，具体可参考现有的重定向流程，在此不再赘述。
本申请实施例提供的安全接入方法中，终端在使用快速重鉴权流程进行安全接入时，若HSS根据该终端的标识确定未存储与该终端对应的3GPP AAA服务器的地址，HSS可以根据注册类型标识，向第一3GPP AAA服务器发送注册成功指示，这样，第一3GPP AAA服务器可以根据注册成功指示，向该终端发送接入成功指示。其中，该注册类型标识用于指示本次该终端的安全接入为使用快速重鉴权流程的安全接入。因此，基于该方法，能够使得在终端通过全鉴权流程进行安全接入之后，若终端从网络上注销，在下一次安全接入时，仍然可以通过快速重鉴权流程完成安全接入。
其中，上述步骤S301至S316中第一3GPP AAA服务器或者HSS的动作可以由图2所示的通信设备200中的处理器201调用存储器203中存储的应用程序代码来执行，本申请实施例对此不作任何限制。
可选的，以图1所示的安全接入系统10应用于支持非3GPP接入的4G网络，第一认证服务器为第一3GPP AAA服务器，归属用户服务器为HSS为例，图4为本申请实施例提供的另一种安全接入方法。该安全接入方法在第一3GPP AAA服务器确定不允许进行快速重鉴权之后，通知终端发起基于全鉴权流程的安全接入。具体的，该方法包括如下步骤：
S401-S404、同S301-S304，具体可参考图3所示的实施例，在此不再赘述。
S405、第一3GPP AAA服务器确定不允许进行快速重鉴权。
可选的，第一3GPP AAA服务器可以根据DER消息1中的接入网络类型、DER消息1中的接入网络标识、预先配置的HSS是否支持快速重鉴权的能力、或者接入网络是否可信的信息中的至少一个，确定不允许进行快速重鉴权，其中，接入网络是否可信的信息是根据DER消息1中的接入网络类型或者DER消息1中的接入网络标识确定的。
示例性的，假设配置的HSS是否支持快速重鉴权的能力为HSS不支持快速重鉴权的注册，则第一3GPP AAA服务器可以根据配置的HSS是否支持快速重鉴权的能力确定不允许进行快速重鉴权；或者，假设根据DER消息1中的接入网络类型或者DER消息1中的接入网络标识确定的接入网络不可信，则第一3GPP AAA服务器可以根据接入网络是否可信的信息确定不允许进行快速重鉴权。
S406、第一3GPP AAA服务器向非3GPP接入设备发送DER消息2。相应的，非3GPP接入设备接收来自第一3GPP AAA服务器的DER消息2。该DER消息2中包括EAP请求消息2。该EAP请求消息2用于请求基于全鉴权流程完成终端的安全接入。
S407、非3GPP接入设备向终端发送EAP请求消息2。相应的，终端接收来自非3GPP接入设备的EAP请求消息2。
S408、终端根据EAP请求消息2，发起基于全鉴权流程的安全接入。
本申请实施例提供的安全接入方法中，第一3GPP AAA服务器在确定不允许进行快速重鉴权之后，可以通知终端发起基于全鉴权流程的安全接入。
其中，上述步骤S401至S408中第一3GPP AAA服务器或者HSS的动作可以由图2所示的通信设备200中的处理器201调用存储器203中存储的应用程序代码来执行，本申请实施例对此不作任何限制。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述第一认证服务器或者归属用户服务器为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对第一认证服务器或者归属用户服务器进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
比如，在采用集成的方式划分各个功能模块的情况下，图5示出了上述实施例中所涉及的第一认证服务器50的一种可能的结构示意图。第一认证服务器50包括：接收模块501、处理模块502和发送模块503。接收模块501，用于接收来自非3GPP接入设备的第一消息，该第一消息携带终端的快速重鉴权标识。处理模块502，用于确定允许进行快速重鉴权。处理模块502，还用于第一认证服务器与终端进行快速重鉴。发送模块503，用于向归属用户服务器发送第二消息，该第二消息携带注册类型标识、终端的标识和第一认证服务器的地址，该注册类型标识用于指示本次终端的安全接入为使用快速重鉴权流程的安全接入。接收模块501，还用于若归属用户服务器根据终端的标识确定未存储与终端对应的认证服务器的地址，接收来自归属用户服务器的注册成功指示。发送模块503，还用于根据注册成功指示，向终端发送接入成功指示。
可选的，接收模块501，还用于接收来自非3GPP接入设备的接入网络类型或者接入网络标识。处理模块502具体用于：根据接入网络类型、接入网络标识、预先配置的归属用户服务器是否支持快速重鉴权的能力、或者接入网络是否可信的信息中的至少一个，确定允许进行快速重鉴权，其中，接入网络是否可信的信息是根据接入网络类型或者接入网络标识确定的。
可选的，接收模块501，还用于若归属用户服务器根据终端的标识确定存储第一认证服务器的地址，接收来自归属用户服务器的注册成功指示。发送模块503，还用于根据注册成功指示，向终端发送接入成功指示。
可选的，接收模块501，还用于若归属用户服务器根据终端的标识确定存储第二认证服务器的地址，接收来自归属用户服务器的注册失败指示，其中，注册失败指示包括第二认证服务器的地址，第二认证服务器的地址用于指示终端重定向到第二认证服务器。发送模块503，还用于根据注册失败指示，向终端发送接入失败指示。
可选的，该方法还包括：处理模块502，还用于确定不允许进行快速重鉴权。发送模块503，还用于向终端请求基于全鉴权流程完成终端的安全接入。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在本实施例中，该第一认证服务器50以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定应用集成电路(Application-Specific Integrated Circuit，ASIC)，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到第一认证服务器50可以采用图2所示的形式。比如，图5中的接收模块501、处理模块502和发送模块503可以通过图2的处理器201和存储器203来实现。具体的，接收模块501、处理模块502和发送模块503可以通过由处理器201来调用存储器203中存储的应用程序代码来执行，本申请实施例对此不作任何限制。
由于本申请实施例提供的第一认证服务器可用于执行上述安全接入方法，因此其所能获得的技术效果可参考上述方法实施例，本申请实施例在此不再赘述。
比如，在采用集成的方式划分各个功能模块的情况下，图6示出了上述实施例中所涉及的归属用户服务器60的一种可能的结构示意图。该归属用户服务器60包括：接收模块601、处理模块602、存储模块603和发送模块604。接收模块601，用于接收来自第一认证服务器的第二消息，该第二消息携带注册类型标识、终端的标识和第一认证服务器的地址，该注册类型标识用于指示本次终端的安全接入为使用快速重鉴权流程的安全接入。处理模块602，用于根据终端的标识确定未存储与终端对应的认证服务器的地址。存储模块604，用于根据注册类型标识，存储第一认证服务器的地址。发送模块603，用于向第一认证服务器发送注册成功指示，由第一认证服务器根据注册成功指示，向终端发送接入成功指示。
可选的，处理模块602，还用于根据终端的标识确定存储第一认证服务器的地。发送模块603，还用于向第一认证服务器发送注册成功指示，由第一认证服务器根据注册成功指示，向终端发送接入成功指示。
可选的，处理模块602，还用于根据终端的标识确定存储第二认证服务器的地址。发送模块603，还用于向第一认证服务器发送注册失败指示，由第一认证服务器根据注册失败指示，向终端发送接入失败指示，其中，该注册失败指示包括第二认证服务器的地址，第二认证服务器的地址用于指示终端重定向到第二认证服务器。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在本实施例中，该归属用户服务器60以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定应用集成电路(Application-Specific Integrated Circuit，ASIC)， 电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到归属用户服务器60可以采用图2所示的形式。比如，图6中的接收模块601、处理模块602、存储模块603和发送模块604可以通过图2的处理器201和存储器203来实现。具体的，接收模块601、处理模块602、存储模块603和发送模块604可以通过由处理器201来调用存储器203中存储的应用程序代码来执行，本申请实施例对此不作任何限制。
由于本申请实施例提供的归属用户服务器可用于执行上述安全接入方法，因此其所能获得的技术效果可参考上述方法实施例，本申请实施例在此不再赘述。
上述实施例中，第一认证服务器和归属用户服务器以采用集成的方式划分各个功能模块的形式来呈现。当然，本申请实施例也可以对应各个功能划分第一认证服务器或归属用户服务器的各个功能模块，本申请实施例对此不作具体限定。
可选的，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于支持第一认证服务器实现上述的安全接入方法，例如确定允许进行快速重鉴权。在一种可能的设计中，该芯片系统还包括存储器。该存储器，用于保存第一认证服务器必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
可选的，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于支持归属用户服务器实现上述的安全接入方法，例如根据终端的标识确定未存储与终端对应的认证服务器的地址。在一种可能的设计中，该芯片系统还包括存储器。该存储器，用于保存归属用户服务器必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措 施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (21)

  1. 一种安全接入方法，其特征在于，所述方法包括：
    第一认证服务器接收来自非第三代合作伙伴计划3GPP接入设备的第一消息，所述第一消息携带终端的快速重鉴权标识；
    所述第一认证服务器确定允许进行快速重鉴权；
    所述第一认证服务器与所述终端进行快速重鉴权；
    所述第一认证服务器向归属用户服务器发送第二消息，所述第二消息携带注册类型标识、所述终端的标识和所述第一认证服务器的地址，所述注册类型标识用于指示本次所述终端的安全接入为使用快速重鉴权流程的安全接入；
    若所述归属用户服务器根据所述终端的标识确定未存储与所述终端对应的认证服务器的地址，所述第一认证服务器接收来自所述归属用户服务器的注册成功指示；
    所述第一认证服务器根据所述注册成功指示，向所述终端发送接入成功指示。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一认证服务器接收来自所述非3GPP接入设备的接入网络类型或者接入网络标识；
    所述第一认证服务器确定允许进行快速重鉴权，包括：
    所述第一认证服务器根据所述接入网络类型、所述接入网络标识、预先配置的归属用户服务器是否支持快速重鉴权的能力、或者接入网络是否可信的信息中的至少一个，确定允许进行快速重鉴权，其中，所述接入网络是否可信的信息是根据所述接入网络类型或者所述接入网络标识确定的。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    若所述归属用户服务器根据所述终端的标识确定存储所述第一认证服务器的地址，所述第一认证服务器接收来自所述归属用户服务器的注册成功指示；
    所述第一认证服务器根据所述注册成功指示，向所述终端发送接入成功指示。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述方法还包括：
    若所述归属用户服务器根据所述终端的标识确定存储第二认证服务器的地址，所述第一认证服务器接收来自所述归属用户服务器的注册失败指示，其中，所述注册失败指示包括所述第二认证服务器的地址，所述第二认证服务器的地址用于指示所述终端重定向到所述第二认证服务器；
    所述第一认证服务器根据所述注册失败指示，向所述终端发送接入失败指示。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述方法还包括：
    所述第一认证服务器确定不允许进行快速重鉴权；
    所述第一认证服务器向所述终端请求基于全鉴权流程完成所述终端的安全接入。
  6. 一种安全接入方法，其特征在于，所述方法包括：
    归属用户服务器接收来自第一认证服务器的第二消息，所述第二消息携带注册类型标识、终端的标识和所述第一认证服务器的地址，所述注册类型标识用于指示本次所述终端的安全接入为使用快速重鉴权流程的安全接入；
    若所述归属用户服务器根据所述终端的标识确定未存储与所述终端对应的认证服务 器的地址，所述归属用户服务器根据所述注册类型标识，存储所述第一认证服务器的地址；
    所述归属用户服务器向所述第一认证服务器发送注册成功指示，由所述第一认证服务器根据所述注册成功指示，向所述终端发送接入成功指示。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    若所述归属用户服务器根据所述终端的标识确定存储所述第一认证服务器的地址，所述归属用户服务器向所述第一认证服务器发送注册成功指示，由所述第一认证服务器根据所述注册成功指示，向所述终端发送接入成功指示。
  8. 根据权利要求6或7所述的方法，其特征在于，所述方法还包括：
    若所述归属用户服务器根据所述终端的标识确定存储第二认证服务器的地址，所述归属用户服务器向所述第一认证服务器发送注册失败指示，由所述第一认证服务器根据所述注册失败指示，向所述终端发送接入失败指示，其中，所述注册失败指示包括所述第二认证服务器的地址，所述第二认证服务器的地址用于指示所述终端重定向到所述第二认证服务器。
  9. 一种第一认证服务器，其特征在于，所述第一认证服务器包括：接收模块、处理模块和发送模块；
    所述接收模块，用于接收来自非第三代合作伙伴计划3GPP接入设备的第一消息，所述第一消息携带终端的快速重鉴权标识；
    所述处理模块，用于确定允许进行快速重鉴权；
    所述处理模块，还用于所述第一认证服务器与所述终端进行快速重鉴权；
    所述发送模块，用于向归属用户服务器发送第二消息，所述第二消息携带注册类型标识、所述终端的标识和所述第一认证服务器的地址，所述注册类型标识用于指示本次所述终端的安全接入为使用快速重鉴权流程的安全接入；
    所述接收模块，还用于若所述归属用户服务器根据所述终端的标识确定未存储与所述终端对应的认证服务器的地址，接收来自所述归属用户服务器的注册成功指示；
    所述发送模块，还用于根据所述注册成功指示，向所述终端发送接入成功指示。
  10. 根据权利要求9所述的第一认证服务器，其特征在于，
    所述接收模块，还用于接收来自所述非3GPP接入设备的接入网络类型或者接入网络标识；
    所述处理模块具体用于：
    根据所述接入网络类型、所述接入网络标识、预先配置的归属用户服务器是否支持快速重鉴权的能力、或者接入网络是否可信的信息中的至少一个，确定允许进行快速重鉴权，其中，所述接入网络是否可信的信息是根据所述接入网络类型或者所述接入网络标识确定的。
  11. 根据权利要求9或10所述的第一认证服务器，其特征在于，
    所述接收模块，还用于若所述归属用户服务器根据所述终端的标识确定存储所述第一认证服务器的地址，接收来自所述归属用户服务器的注册成功指示；
    所述发送模块，还用于根据所述注册成功指示，向所述终端发送接入成功指示。
  12. 根据权利要求9-11任一项所述的第一认证服务器，其特征在于，
    所述接收模块，还用于若所述归属用户服务器根据所述终端的标识确定存储第二认证 服务器的地址，接收来自所述归属用户服务器的注册失败指示，其中，所述注册失败指示包括所述第二认证服务器的地址，所述第二认证服务器的地址用于指示所述终端重定向到所述第二认证服务器；
    所述发送模块，还用于根据所述注册失败指示，向所述终端发送接入失败指示。
  13. 根据权利要求9-12任一项所述的第一认证服务器，其特征在于，所述方法还包括：
    所述处理模块，还用于确定不允许进行快速重鉴权；
    所述发送模块，还用于向所述终端请求基于全鉴权流程完成所述终端的安全接入。
  14. 一种归属用户服务器，其特征在于，所述归属用户服务器包括：接收模块、处理模块、存储模块和发送模块；
    所述接收模块，用于接收来自第一认证服务器的第二消息，所述第二消息携带注册类型标识、终端的标识和所述第一认证服务器的地址，所述注册类型标识用于指示本次所述终端的安全接入为使用快速重鉴权流程的安全接入；
    所述处理模块，用于根据所述终端的标识确定未存储与所述终端对应的认证服务器的地址；
    所述存储模块，用于根据所述注册类型标识，存储所述第一认证服务器的地址；
    所述发送模块，用于向所述第一认证服务器发送注册成功指示，由所述第一认证服务器根据所述注册成功指示，向所述终端发送接入成功指示。
  15. 根据权利要求14所述的归属用户服务器，其特征在于，
    所述处理模块，还用于根据所述终端的标识确定存储所述第一认证服务器的地址；
    所述发送模块，还用于向所述第一认证服务器发送注册成功指示，由所述第一认证服务器根据所述注册成功指示，向所述终端发送接入成功指示。
  16. 根据权利要求14或15所述的归属用户服务器，其特征在于，
    所述处理模块，还用于根据所述终端的标识确定存储第二认证服务器的地址；
    所述发送模块，还用于向所述第一认证服务器发送注册失败指示，由所述第一认证服务器根据所述注册失败指示，向所述终端发送接入失败指示，其中，所述注册失败指示包括所述第二认证服务器的地址，所述第二认证服务器的地址用于指示所述终端重定向到所述第二认证服务器。
  17. 一种安全接入系统，其特征在于，所述安全接入系统包括如权利要求9-13任一项所述的第一认证服务器和如权利要求14-16任一项所述的归属用户服务器。
  18. 一种第一认证服务器，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述第一认证服务器运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述第一认证服务器执行如权利要求1-5任一项所述的安全接入方法。
  19. 一种归属用户服务器，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述归属用户服务器运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述归属用户服务器执行如权利要求6-8任一项所述的安全接入方法。
  20. 一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行如权利要求1-5任一项所述的安全接入方法。
  21. 一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行如权利要求6-8任一项所述的安全接入方法。
PCT/CN2018/099337 2017-08-16 2018-08-08 安全接入方法、设备及系统 Ceased WO2019033967A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18845714.7A EP3644636B1 (en) 2017-08-16 2018-08-08 Secure access method, device and system
US16/791,714 US11323440B2 (en) 2017-08-16 2020-02-14 Secure access method, device, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710703914.8A CN109413646B (zh) 2017-08-16 2017-08-16 安全接入方法、设备及系统
CN201710703914.8 2017-08-16

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/791,714 Continuation US11323440B2 (en) 2017-08-16 2020-02-14 Secure access method, device, and system

Publications (1)

Publication Number Publication Date
WO2019033967A1 true WO2019033967A1 (zh) 2019-02-21

Family

ID=65362462

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/099337 Ceased WO2019033967A1 (zh) 2017-08-16 2018-08-08 安全接入方法、设备及系统

Country Status (4)

Country Link
US (1) US11323440B2 (zh)
EP (1) EP3644636B1 (zh)
CN (1) CN109413646B (zh)
WO (1) WO2019033967A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114301660A (zh) * 2021-12-27 2022-04-08 西安广和通无线软件有限公司 多服务器认证方法、装置、设备及存储介质
US20230094211A1 (en) * 2020-03-19 2023-03-30 Lg Electronics Inc. Support of service continuity between snpn and plmn

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111866974B (zh) 2019-04-29 2022-12-06 华为技术有限公司 用于移动注册的方法和装置
WO2021031053A1 (zh) 2019-08-18 2021-02-25 华为技术有限公司 一种通信方法、装置及系统
US11432144B2 (en) * 2019-09-23 2022-08-30 T-Mobile Usa, Inc. Authentication system
WO2021062686A1 (zh) * 2019-09-30 2021-04-08 华为技术有限公司 一种获取位置信息的方法、装置及系统
CN113038434B (zh) * 2019-12-09 2022-10-28 华为技术有限公司 设备注册方法、装置、移动终端和存储介质
PH12023550256A1 (en) 2020-07-31 2024-04-22 Vivo Mobile Communication Co Ltd Access control method and apparatus, and communication device
CN114071465B (zh) * 2020-07-31 2024-08-06 维沃移动通信有限公司 接入控制方法、装置及通信设备
US11552943B2 (en) * 2020-11-13 2023-01-10 Cyberark Software Ltd. Native remote access to target resources using secretless connections
CN114630311B (zh) * 2020-12-11 2025-04-01 中国移动通信有限公司研究院 数据网络重鉴权方法、装置、设备及可读存储介质
CN116567626B (zh) * 2022-01-27 2025-11-25 维沃移动通信有限公司 设备鉴权方法、装置及通信设备
CN115174180B (zh) * 2022-06-28 2023-10-27 珠海奔图电子有限公司 认证方法、装置、服务器及存储介质
CN115146251A (zh) * 2022-06-29 2022-10-04 海光信息技术股份有限公司 一种处理器安全认证方法、安全模块及认证工具
CN116599740B (zh) * 2023-05-26 2025-08-29 中国联合网络通信集团有限公司 单点登录方法、装置及可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1645826A (zh) * 2004-07-05 2005-07-27 华为技术有限公司 无线局域网用户建立会话连接的方法
CN1645793A (zh) * 2004-06-24 2005-07-27 华为技术有限公司 无线局域网用户实现接入认证的方法
CN101854629A (zh) * 2010-05-21 2010-10-06 西安电子科技大学 家庭基站系统中用户终端接入认证及重认证的方法
US20140273958A1 (en) * 2013-03-15 2014-09-18 Alcatel-Lucent Usa Inc. Method of providing user equipment with access to a network and a network configured to provide access to the user equipment

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7434044B2 (en) * 2003-02-26 2008-10-07 Cisco Technology, Inc. Fast re-authentication with dynamic credentials
US8356171B2 (en) * 2006-04-26 2013-01-15 Cisco Technology, Inc. System and method for implementing fast reauthentication
CN101079786B (zh) * 2006-05-26 2011-12-07 华为技术有限公司 互连系统、互连系统中的认证方法和终端
EP3304856B1 (en) * 2015-06-05 2025-09-17 IPLA Holdings Inc. Unified authentication for integrated small cell and wi-fi networks
CN106921965B (zh) * 2017-01-19 2020-07-21 厦门盛华电子科技有限公司 一种wlan网络中实现eap认证的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1645793A (zh) * 2004-06-24 2005-07-27 华为技术有限公司 无线局域网用户实现接入认证的方法
CN1645826A (zh) * 2004-07-05 2005-07-27 华为技术有限公司 无线局域网用户建立会话连接的方法
CN101854629A (zh) * 2010-05-21 2010-10-06 西安电子科技大学 家庭基站系统中用户终端接入认证及重认证的方法
US20140273958A1 (en) * 2013-03-15 2014-09-18 Alcatel-Lucent Usa Inc. Method of providing user equipment with access to a network and a network configured to provide access to the user equipment

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3644636A4

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230094211A1 (en) * 2020-03-19 2023-03-30 Lg Electronics Inc. Support of service continuity between snpn and plmn
US12262253B2 (en) * 2020-03-19 2025-03-25 Lg Electronics Inc. Support of service continuity between SNPN and PLMN
CN114301660A (zh) * 2021-12-27 2022-04-08 西安广和通无线软件有限公司 多服务器认证方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US11323440B2 (en) 2022-05-03
CN109413646B (zh) 2020-10-16
CN109413646A (zh) 2019-03-01
EP3644636B1 (en) 2021-07-28
EP3644636A1 (en) 2020-04-29
EP3644636A4 (en) 2020-07-22
US20200186526A1 (en) 2020-06-11

Similar Documents

Publication Publication Date Title
CN109413646B (zh) 安全接入方法、设备及系统
US11870856B2 (en) Session establishment method and apparatus
US12219356B2 (en) Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization
CN109996346B (zh) 会话建立方法、设备及系统
CN111435932B (zh) 一种令牌处理方法及装置
US20200374829A1 (en) Method for determining location information and apparatus
US11595817B2 (en) Authentication method, device, and system
CN110519750B (zh) 报文处理方法、设备及系统
WO2019024744A1 (zh) 获取终端设备的身份标识的方法及装置
US12267883B2 (en) Session management method and system, and device
EP3761688B1 (en) Communication capability reporting

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18845714

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018845714

Country of ref document: EP

Effective date: 20200124

NENP Non-entry into the national phase

Ref country code: DE