WO2019096051A1 - 鉴权方法、设备及系统 - Google Patents

鉴权方法、设备及系统 Download PDF

Info

Publication number
WO2019096051A1
WO2019096051A1 PCT/CN2018/114461 CN2018114461W WO2019096051A1 WO 2019096051 A1 WO2019096051 A1 WO 2019096051A1 CN 2018114461 W CN2018114461 W CN 2018114461W WO 2019096051 A1 WO2019096051 A1 WO 2019096051A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
entity
confirmation
authentication confirmation
vector
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/114461
Other languages
English (en)
French (fr)
Inventor
何承东
李华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP18878331.0A priority Critical patent/EP3668004A4/en
Publication of WO2019096051A1 publication Critical patent/WO2019096051A1/zh
Priority to US16/834,185 priority patent/US11595817B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules

Definitions

  • the present application relates to the field of communications technologies, and in particular, to an authentication method, device, and system.
  • unified data management in the home network UDM
  • the authentication algorithm selected by the entity is 5rd generation-authentication and key agreement (5G-AKA), and the UDM entity may generate n authentication vectors (AV) at a time.
  • AV authentication vectors
  • an authentication server function (AUSF) entity in the home network can receive n AVs from the UDM entity.
  • SEAF security anchor function
  • the AUSF entity may only send one AV to the SEAF entity.
  • SEAF security anchor function
  • RAND random number
  • AUTN authentication token
  • XRES* expected response
  • the embodiments of the present application provide an authentication method, device, and system to solve at least the problem of how to deal with the performance and memory resource waste that may be generated by using the unused n-1 AVs.
  • the embodiment of the present application provides the following technical solutions:
  • an authentication method comprising: an authentication entity receiving n first authentication vectors from a unified data management entity, n being a positive integer; the authentication entity is based on the n first authentications a vector, generating n second authentication vectors; the authentication entity transmitting one of the n second authentication vectors to the security anchor function entity; the authentication entity receiving the security anchor from the security anchor An authentication confirmation request of the functional entity, and performing authentication confirmation on the terminal according to the authentication confirmation request; if the authentication confirmation is successful, the authentication entity sends the n second authentication to the security anchor functional entity Other unused n-1 second authentication vectors in the vector.
  • the method further includes: the authentication entity sending an authentication confirmation identifier to the security anchor function entity, wherein the authentication confirmation identifier is used to indicate that an authentication confirmation is required.
  • the subsequent SEAF entity may send an authentication confirmation request to the AUSF entity according to the authentication confirmation identifier, and the AUSF entity further performs authentication confirmation on the terminal.
  • the method further includes the authentication entity determining that an authentication confirmation is required.
  • the authentication entity determines that an authentication confirmation is required, and the method includes: the authentication entity receives an authentication confirmation identifier from the unified data management entity, where the authentication confirmation identifier is used to indicate that an authentication confirmation is required. That is to say, whether the authentication confirmation is needed can be determined by the unified data management entity, so that the charging dispute or the denial of service attack between the visited network and the home network that may exist in the prior art can be avoided, and the security of the network is improved.
  • the authentication confirmation identifier is used to indicate that an authentication confirmation is required. That is to say, whether the authentication confirmation is needed can be determined by the unified data management entity, so that the charging dispute or the denial of service attack between the visited network and the home network that may exist in the prior art can be avoided, and the security of the network is improved.
  • the authentication entity determines that an authentication confirmation is required, including: determining, by the authentication entity, that an authentication confirmation is required according to the locally configured security policy.
  • the authentication confirmation request carries a response value RES* and a corresponding random number RAND; the authentication entity performs an authentication confirmation on the terminal according to the authentication confirmation request, including: the authentication entity according to the authentication entity
  • the RAND looks up the corresponding XRES* and authenticates the terminal by comparing the RES* with the XRES*.
  • the authentication entity In the case where the authentication entity previously receives a plurality of first authentication vectors from the unified data management entity, the authentication entity does not know which authentication vector is used to compare the XRES* with the received RES*, thereby affecting the AUSF entity.
  • the problem of processing performance can be achieved by quick authentication confirmation of the terminal.
  • an authentication method includes: the unified data management entity generates n first authentication vectors, where n is a positive integer; the unified data management entity sends the n first authentications to the authentication entity a vector; the authentication entity receives n first authentication vectors from the unified data management entity, and generates n second authentication vectors according to the n first authentication vectors; the authentication entity to the security anchor
  • the functional entity sends one of the n second authentication vectors; the authentication entity receives an authentication confirmation request from the security anchor functional entity, and performs the terminal according to the authentication confirmation request Authentication confirmation; if the authentication confirmation is successful, the authentication entity sends the other unused n-1 second authentication vectors in the n second authentication vectors to the security anchor function entity.
  • the unified data management entity generates n first authentication vectors, including: the unified data management entity generates n first authentication vectors according to the locally configured default authentication vector number n.
  • the unified data management entity may generate a corresponding number of first authentication vectors according to the authentication algorithm, instead of the authentication information sent by the authentication entity to the unified data entity, as in the prior art. The number of the authentication vectors is carried, so that the problem that the number of first authentication vectors requested by the authentication entity existing in the prior art is inconsistent with the number of first authentication vectors generated by the unified data entity can be avoided.
  • the first authentication of the authentication entity request cannot be satisfied.
  • the number of weight vectors required For example, if the number of the first authentication vectors requested by the authentication entity is multiple, and the authentication algorithm selected by the unified data management entity generates only one first authentication vector at a time, the first authentication of the authentication entity request cannot be satisfied. The number of weight vectors required.
  • the method further includes: the unified data management entity determines that an authentication confirmation is required according to the locally configured security policy; the unified data management entity sends an authentication confirmation identifier to the authentication entity, the authentication The confirmation identifier is used to indicate that an authentication confirmation is needed; the authentication entity receives the authentication confirmation identifier from the unified data management entity, and sends the authentication confirmation identifier to the security anchor function entity.
  • the unified data management entity determines that an authentication confirmation is required according to the locally configured security policy, including: the identifier of the service network where the unified data management entity is located according to the security anchor function entity, and the local The security policy of the service network in the configured security policy determines that an authentication confirmation is required. That is to say, whether the authentication confirmation is needed can be determined by the unified data management entity, so that the charging dispute or the denial of service attack between the visited network and the home network that may exist in the prior art can be avoided, and the security of the network is improved.
  • an authentication method includes: the unified data management entity determines that an authentication confirmation is required according to a locally configured security policy; and the unified data management entity sends an authentication information response to the authentication entity, the authentication The information response carries an authentication confirmation identifier, the authentication confirmation identifier is used to indicate that an authentication confirmation is needed; the authentication entity receives the authentication information response from the unified data entity; the authentication entity sends a verification to the security anchor function entity The initial response of the right carries the authentication confirmation identifier; the authentication entity receives an authentication confirmation request from the security anchor functional entity, and performs authentication confirmation on the terminal according to the authentication confirmation request.
  • the method further includes: the unified data management entity generates n first authentication vectors; correspondingly, the authentication information response further carries n first authentication vectors; the method further includes: The authentication entity generates n second authentication vectors according to the n first authentication vectors; correspondingly, the authentication initial response further carries one of the n second authentication vectors After the authentication entity receives the authentication confirmation request from the security anchor functional entity, the method further includes: if the authentication confirmation is successful, the authenticating entity sends the n to the security anchor functional entity The other unused n-1 second authentication vectors in the second vector.
  • the method further includes: the unified data management entity generates n first authentication vectors; correspondingly, the authentication information response further carries n first authentication vectors; the method further includes: The authentication entity generates n second authentication vectors according to the n first authentication vectors; correspondingly, the authentication initial response further carries the n second authentication vectors.
  • the method further includes: in the case that the authentication confirmation fails, the authentication entity Sending an authentication confirmation failure indication to the security anchor function entity, the authentication confirmation failure indication is used to indicate that the authentication confirmation fails. This allows the security anchor functional entity to be informed of the results of the authentication confirmation in a timely manner.
  • the method further includes: in the case that the authentication confirmation is successful, the authentication entity Sending an authentication confirmation success indication to the security anchor function entity, the authentication confirmation success indication is used to indicate that the authentication confirmation is successful. This allows the security anchor functional entity to be informed of the results of the authentication confirmation in a timely manner.
  • the method further includes: in the case that the authentication confirmation is successful, the authentication entity Sending an authentication confirmation identifier to the security anchor function entity, where the authentication confirmation identifier is used to indicate that an authentication confirmation is required.
  • a fourth aspect provides an authentication method, where the unified data management entity generates n first authentication vectors according to a locally configured security policy, where n is a positive integer; the unified data management entity sends an authentication entity to the authentication entity. Transmitting n first authentication vectors; the authentication entity receives n first authentication vectors from the unified data entity, and generates n second authentication vectors according to the n first authentication vectors; the authentication entity The security anchor function entity sends the n second authentication vectors. Based on the method, not only the problem of how to deal with the remaining unused n-1 first authentication vectors but also the waste of performance and memory resources existing in the prior art can be solved, thereby improving the first authentication vector.
  • the method further includes: the authentication entity receives an authentication confirmation request from the security anchor functional entity, and performs authentication confirmation on the terminal according to the authentication confirmation request; and fails in the authentication confirmation
  • the authentication entity sends an authentication confirmation failure indication to the security anchor function entity, where the authentication confirmation failure indication is used to indicate that the authentication confirmation fails. This allows the security anchor functional entity to be informed of the results of the authentication confirmation in a timely manner.
  • the method further includes: the authentication entity receives the authentication confirmation request from the security anchor functional entity, and performs authentication confirmation on the terminal according to the authentication confirmation request; and the authentication confirmation succeeds
  • the authentication entity sends an authentication confirmation success indication to the security anchor function entity, and the authentication confirmation success indication is used to indicate that the authentication confirmation is successful.
  • the unified data management entity generates n first authentication vectors according to the locally configured security policy, including: the identifier of the service network where the unified data management entity is located according to the security anchor function entity, and the The security policy of the service network in the locally configured security policy generates n first authentication vectors.
  • an authentication entity having the functionality to implement the method of the first aspect described above.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a sixth aspect provides an authentication entity, including: a processor and a memory; the memory is configured to store a computer execution instruction, and when the authentication entity is running, the processor executes the computer execution instruction stored in the memory to The authentication entity is caused to perform the authentication method as described in any of the above first aspects.
  • a seventh aspect a computer readable storage medium having stored therein instructions that, when run on a computer, cause the computer to perform the authentication described in any of the above first aspects method.
  • a computer program product comprising instructions which, when run on a computer, cause the computer to perform the authentication method of any of the above first aspects.
  • a chip system comprising a processor, configured to support an authentication entity to implement the functions involved in the foregoing aspects, for example, generating n second authentications according to n first authentication vectors Vector.
  • the chip system further comprises a memory for storing necessary program instructions and data necessary for the authentication entity.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • a tenth aspect provides an authentication system, where the authentication system includes a unified data management entity and an authentication entity; the unified data management entity is configured to generate n first authentication vectors, where n is a positive integer; the unified data The management entity is further configured to send the n first authentication vectors to the authentication entity, where the authentication entity is configured to receive n first authentication vectors from the unified data management entity, and according to the n first An authentication vector, which is used to generate n second authentication vectors; the authentication entity is further configured to send one of the n second authentication vectors to the security anchor function entity; the authentication entity And receiving an authentication confirmation request from the security anchor function entity, and performing authentication confirmation on the terminal according to the authentication confirmation request; the authentication entity is further used, if the authentication confirmation is successful, Sending to the security anchor function entity, the other unused n-1 second authentication vectors in the n second authentication vectors.
  • An eleventh aspect provides an authentication system, where the authentication system includes: a unified data management entity and an authentication entity; the unified data management entity is configured to determine, according to a locally configured security policy, an authentication confirmation required; The data management entity is further configured to send an authentication information response to the authentication entity, where the authentication information response carries an authentication confirmation identifier, where the authentication confirmation identifier is used to indicate that an authentication confirmation is needed; and the authentication entity is configured to receive the The authentication information of the unified data entity is responsive; the authentication entity is further configured to send an authentication initial response to the security anchor function entity, where the authentication initial response carries the authentication confirmation identifier; the authentication entity further uses Receiving an authentication confirmation request from the security anchor functional entity, and performing authentication confirmation on the terminal according to the authentication confirmation request.
  • the technical effects brought by the eleventh aspect can be seen in the technical effects brought about by the third aspect, and are not described herein again.
  • FIG. 1 is a schematic structural diagram of an authentication system according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a 5G network architecture provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of hardware of a communication device according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic flowchart 1 of an authentication method provided by an embodiment of the present application.
  • FIG. 5 is a second schematic flowchart of an authentication method according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of an authentication entity according to an embodiment of the present application.
  • the words “first”, “second”, and the like are used to distinguish the same items or similar items whose functions and functions are substantially the same.
  • the words “first”, “second”, and the like do not limit the number and the order of execution, and the words “first”, “second”, etc. are not necessarily limited, and the embodiments of the present application are This is not specifically limited.
  • the network architecture and the service scenario described in the embodiments of the present application are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation of the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.
  • an authentication system 10 is provided in an embodiment of the present application.
  • the authentication system 10 includes a unified data management entity 101 and an authentication entity 102.
  • the unified data management entity 101 and the authentication entity 102 can communicate directly or through the forwarding of other devices, which is not specifically limited in this embodiment.
  • the unified data management entity 101 is configured to generate n first authentication vectors, and send n first authentication vectors to the authentication entity 102, where n is a positive integer.
  • the authentication entity 102 is configured to receive n first authentication vectors from the unified data entity 101, and generate n second authentication vectors according to the n first authentication vectors.
  • the authentication entity 102 is further configured to send one of the n second authentication vectors to the security anchor function entity.
  • the authentication entity 102 is further configured to receive an authentication confirmation request from the security anchor functional entity, and perform authentication confirmation on the terminal according to the authentication confirmation request; and if the authentication confirmation is successful, to the security anchor functional entity
  • the other unused n-1 second authentication vectors in the n second evaluation vectors are transmitted.
  • the first authentication vector in the embodiment of the present application may include RAND, AUTN, XRES*, and Kasme*.
  • the second authentication vector corresponding to the first authentication vector may include RAND, AUTN, Hash XRES* (HXRES*), and Kasme*, which are collectively described herein, and are not described herein again.
  • the HXRES* is determined according to the RAND and the XRES*. For details, refer to the existing implementation manner, which is not described in this embodiment.
  • the authentication entity sends n second authentication vectors to the security anchor function entity.
  • the authentication entity in the home network from knowing when the security anchor function entity in the visited network will initiate authentication again, for example, the terminal has left the visited network where the security anchor function entity is located, or, for example, It will take a long time for the next security anchor function entity to initiate authentication again. If the aging deletion mechanism is used at this time, when the security anchor function entity requests the first authentication vector again from the authentication entity, the unified data management entity has to regenerate the required first one because the first authentication vector has been aged out.
  • the use efficiency of the authentication vector can be reduced; and the problem of authentication failure of the terminal due to the link failure between the security anchor functional entity and the authentication entity can be reduced, thereby improving the reliability of the authentication result.
  • the unified data management entity 101 is configured to generate n first authentication vectors according to the locally configured security policy, and send n first authentication vectors n to the authentication entity 102. Integer.
  • the authentication entity 102 is configured to receive n first authentication vectors from the unified data entity 101, and generate n second authentication vectors according to the n first authentication vectors, and then send n to the security anchor function entity. Second authentication vector.
  • the locally configured security policy may include a security policy list of different service networks, where the security policy list may include a security policy of the service network where the security anchor function entity currently serving the terminal is located.
  • the security policy list may include a security policy of the service network where the security anchor function entity currently serving the terminal is located. This embodiment of the present application does not specifically limit this.
  • the security policy of the service network may specifically include a trust level of the service network, and the trust level of the service network may include, for example, a high trust level or a low trust level.
  • a high trust level means trusting the service network; a low trust level means not trusting the service network.
  • the service network in the embodiment of the present application may be a home network, for example, may be a home public land mobile network (HPLMN) in a non-roaming scenario of the terminal; or the service network may also be a visited network. For example, it may be a visited public land mobile network (VPLMN) in a terminal roaming scenario, which is not specifically limited in this embodiment of the present application. In this unified description, the following will not be repeated.
  • HPLMN home public land mobile network
  • VPN visited public land mobile network
  • the locally configured security policy can be as shown in Table 1.
  • the first embodiment of the present application is a list of a locally configured security policy.
  • the security policy of the local configuration may be in other forms, such as a text format. This is not specifically limited.
  • the authentication entity In the authentication system provided by the embodiment of the present application, the authentication entity generates n first authentication vectors according to the locally configured security policy, and sends n first authentication vectors to the authentication entity, where the authentication entity is configured according to n. After the first authentication vectors are generated, the n second authentication vectors are sent to the security anchor function entity.
  • the security policy of the service network where the security anchor function entity is located has a high trust level, and multiple first authentication vectors can be generated, so that the authentication entity can obtain multiple second authentication vectors.
  • the security policy of the service network where the security anchor function entity is located has a low trust level, and may generate a first authentication vector.
  • the authentication entity can obtain a second authentication vector, it sends a second authentication vector to the security anchor function entity.
  • the unified data management entity since the unified data management entity generates n first authentication vectors according to the locally configured security policy, instead of the authentication information request sent by the authentication entity to the unified data management entity (authentication information) The number of the authentication vector is carried in the request), so that not only the authentication entity can send n second authentication vectors to the security anchor function entity in the subsequent process, but also the authentication entity request existing in the prior art can be avoided.
  • the problem that the number of first authentication vectors is inconsistent with the number of first authentication vectors actually generated by the unified data management entity.
  • the unified data management entity For example, if the number of first authentication vectors requested by the authentication entity is multiple, and the authentication algorithm selected by the unified data management entity is an enhanced authentication protocol based on authentication and key agreement (extensible authentication protocol-authentication and The key agreement, EAP-AKA' algorithm, the unified data management entity generates only one first authentication vector at a time, so that the number of first authentication vectors requested by the authentication entity cannot be met.
  • EAP-AKA' algorithm extended authentication protocol-authentication and The key agreement
  • the unified data management entity 101 is configured to send an authentication information response to the authentication entity 102 after determining that the authentication confirmation is needed according to the locally configured security policy, where the authentication information response carries the authentication.
  • a confirmation identifier the authentication confirmation identifier is used to indicate that an authentication confirmation is required.
  • the authentication entity 102 is configured to receive an authentication information response from the unified data entity, and send an authentication initial response to the security anchor function entity, where the authentication initial response carries an authentication confirmation identifier.
  • the authentication entity 102 is further configured to receive an authentication confirmation request from the security anchor function entity, and perform authentication confirmation on the terminal according to the authentication confirmation request.
  • the unified data management entity may determine, after the authentication confirmation is required, the authentication entity sends an authentication confirmation identifier to the security anchor function entity according to the locally configured security policy, and the authentication confirmation is performed.
  • the identifier is used to indicate that an authentication confirmation is needed.
  • the authentication entity may receive an authentication confirmation request from the security anchor functional entity, and perform authentication confirmation on the terminal according to the authentication confirmation request.
  • the unified data management entity can choose to reject the request or accept the request according to the security of the network.
  • Knowing whether the network is secure may directly reject it or directly accept it, thus affecting network security.
  • the malicious security anchor functional entity can take advantage of this, for example, even if the security anchor functional entity fails to authenticate the terminal, or the security anchor functional entity and the terminal never The authentication process is not performed, and the security anchor function entity can request registration and acquisition of user subscription data from the unified data management entity at any time, thereby defrauding the trust of the unified data management entity, which may result in a calculation between the visited network and the home network. Fee dispute. Or, if the unified data management entity directly rejects, even if the terminal has successfully authenticated the service network where the security anchor function entity is located, the terminal may never be successfully registered on the service network where the security anchor function entity is located, thereby being inaccessible.
  • the service network where the security anchor function entity is located has an effect similar to a deny of service. That is to say, based on the solution, the charging dispute or the denial of service attack between the visited network and the home network that may exist in the prior art can be avoided, and the security of the network is improved.
  • the authentication system 10 shown in FIG. 1 can be applied to the 5G network and other networks in the future, which is not specifically limited in this embodiment of the present invention.
  • the authentication entity may be an AUSF entity in the 5G network; the unified data management entity may be a UDM entity in the 5G network.
  • the security anchor functional entity can be a SEAF entity in a 5G network.
  • the 5G network may further include an access device and a core access and mobility management function (AMF) entity, etc., which is not specifically limited in this embodiment of the present application.
  • AMF core access and mobility management function
  • the 5G network may further include a policy control function (PCF) entity, a user plane function (UPF) entity, and a session management function (SMF) entity, etc., the present application.
  • PCF policy control function
  • UPF user plane function
  • SMF session management function
  • the SEAF entity and the AMF entity may be deployed in a unified manner, and may be deployed separately.
  • the embodiments of the present application are described as an example in which the SEAF entity and the AMF entity are separately deployed.
  • the SEAF entity in the embodiment of the present application needs to be replaced by the AMF entity. , will not repeat them below.
  • the terminal communicates with the AMF entity through the next generation (N) interface 1 (N1 for short), and the access device communicates with the AMF entity through the N interface 2 (N2 for short), and the AMF entity passes the N
  • the interface 8 (N8 for short) communicates with the UDM entity
  • the AUSF entity communicates with the UDM entity through the N interface 13 (N13 for short)
  • the SEAF entity can communicate with the AUSF entity and the AMF entity, respectively.
  • the name of the interface between the network elements in FIG. 2 is only an example. In the specific implementation, the interface name may be another name, which is not specifically limited in this embodiment of the present application.
  • the access device, the SEAF entity, the AMF entity, the AUSF entity, or the UDM entity of FIG. 2 is only a name, and the name does not limit the device itself.
  • the network element or the entity corresponding to the access device, the SEAF entity, the AMF entity, the AUSF entity, or the UDM entity may be other names, which is not specifically limited in this embodiment of the present application.
  • the UDM entity may be replaced by a home subscriber server (HSS) or a user subscription database (USD) or a database entity or a user data management entity, etc., and a unified description is provided herein. The details are not described below.
  • the terminal involved in the embodiment of the present application may include various handheld devices having wireless communication functions, in-vehicle devices, wearable devices, computing devices, or other processing devices connected to the wireless modem; Including user unit (subscriber unit), cellular phone, smart phone, wireless data card, personal digital assistant (PDA) computer, tablet computer, wireless modem (modem), handheld device Handheld, laptop computer, cordless phone or wireless local loop (WLL) station, machine type communication (MTC) terminal, user equipment (user equipment) , UE), mobile station (MS), terminal device, etc.
  • PDA personal digital assistant
  • WLL wireless local loop
  • MTC machine type communication
  • user equipment user equipment
  • UE user equipment
  • MS mobile station
  • the access device involved in the embodiment of the present application refers to a device that accesses the core network, and may be, for example, a base station, a broadband network gateway (BNG), an aggregation switch, and a non-third generation. 3rd generation partnership project (3GPP) access equipment, etc.
  • the base station may include various forms of base stations, such as macro base stations, micro base stations (also referred to as small stations), relay stations, access points, and the like.
  • the unified data management entity 101 or the authentication entity 102 in FIG. 1 may be implemented by one physical device, or may be implemented by multiple physical devices, or may be a logical functional module in a physical device. The embodiment does not specifically limit this.
  • FIG. 3 is a schematic diagram showing the hardware structure of a communication device according to an embodiment of the present application.
  • the communication device 300 includes at least one processor 301, a communication line 302, a memory 303, and at least one communication interface 304.
  • the processor 301 can be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more for controlling the execution of the program of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication line 302 can include a path for communicating information between the components described above.
  • the communication interface 304 uses a device such as any transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • a device such as any transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 303 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory may be present independently and connected to the processor via communication line 302. The memory can also be integrated with the processor.
  • the memory 303 is configured to store computer execution instructions for executing the solution of the present application, and is controlled by the processor 301 for execution.
  • the processor 301 is configured to execute computer execution instructions stored in the memory 303 to implement the authentication method provided by the following embodiments of the present application.
  • the computer-executed instructions in the embodiment of the present application may also be referred to as an application code, which is not specifically limited in this embodiment of the present application.
  • processor 301 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • communication device 300 can include multiple processors, such as processor 301 and processor 308 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • processors herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • the communication device 300 can also include an output device 305 and an input device 306.
  • Output device 305 is in communication with processor 301 and can display information in a variety of ways.
  • the output device 305 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 306 is in communication with processor 301 and can receive user input in a variety of ways.
  • input device 306 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • the communication device 300 described above may be a general purpose device or a dedicated device.
  • the communication device 300 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or the like in FIG. device.
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of the communication device 300.
  • parameter names in the following embodiments of the present application or the message names between the network elements are only an example, and may be other names in the specific implementation, which is not specifically limited in the embodiment of the present application.
  • the authentication system shown in FIG. 1 is applied to the 5G network shown in FIG. 2, as shown in FIG. 4, which is an authentication method provided by the embodiment of the present application.
  • the authentication method includes the following steps:
  • the terminal sends a registration request to the SEAF entity, so that the SEAF entity receives the registration request from the terminal.
  • the registration request carries the subscription identifier of the user.
  • the subscription identifier of the user may be, for example, an international mobile subscriber identity (IMSI) or the like.
  • IMSI international mobile subscriber identity
  • the SEAF entity sends an authentication initiation request to the AUSF entity, so that the AUSF entity receives the initial authentication request from the SEAF entity.
  • the initial request for authentication carries the subscription identifier of the user and the identifier of the service network where the SEAF entity is located.
  • the AUSF entity sends an authentication information request to the UDM entity, so that the UDM entity receives the authentication information request from the AUSF entity.
  • the authentication information request carries the subscription identifier of the user and the identifier of the service network where the SEAF entity is located.
  • the UDM entity generates n first authentication vectors, where n is a positive integer.
  • the UDM entity may select an authentication algorithm according to the configuration, and further generate a corresponding number of first authentication vectors according to the authentication algorithm. For example, if the authentication algorithm selected by the UDM entity is the 5G-AKA algorithm, the UDM entity may generate n first authentication vectors according to the locally configured default authentication vector number n; or, if the UDM entity selects the authentication
  • the algorithm is an EAP-AKA' algorithm, and the UDM entity can generate only one first authentication vector.
  • the related implementation of the UDM entity selecting the authentication algorithm according to the configuration may refer to the existing manner, and details are not described herein.
  • the number of default authentication vectors n configured by the UDM entity may be the same or different, and the embodiment of the present application does not specifically limit this.
  • the UDM entity may generate a corresponding number of first authentication vectors according to the authentication algorithm, instead of carrying the authentication vector in the authentication information request sent by the AUSF entity to the UDM entity, as in the prior art.
  • the number can be avoided, so that the problem that the number of first authentication vectors requested by the AUSF entity existing in the prior art is inconsistent with the number of first authentication vectors generated by the UDM entity can be avoided.
  • the UDM entity only generates one first authentication vector at a time, thereby failing to satisfy the The number of first authentication vectors requested by the entity.
  • the UDM entity sends an authentication information answer to the AUSF entity, so that the AUSF entity receives the authentication information response from the UDM entity.
  • the authentication information response carries n first authentication vectors.
  • the UDM entity may determine that an authentication confirmation is required according to the locally configured security policy. For example, the UDM entity may determine whether an authentication confirmation is required according to the identifier of the service network where the SEAF entity is carried in step S403 and the security policy of the service network where the SEAF entity is located in the locally configured security policy. If it is determined that the authentication confirmation is required, the authentication confirmation identifier may be carried in the authentication information response, and the authentication confirmation identifier is used to indicate that the authentication confirmation is needed, so that the subsequent SEAF entity can confirm the authentication according to the authentication. The identifier sends an authentication confirmation request to the AUSF entity, and the AUSF entity further performs authentication confirmation on the terminal.
  • the UDM entity can learn the security situation of the network, and even if the authentication confirmation result is not obtained, the charging dispute or the rejection between the visited network and the home network that may exist in the prior art can be avoided. Service attacks improve the security of the network.
  • the UDM entity may determine that an authentication confirmation is needed, and then carry the authentication confirmation in the authentication information response.
  • the UDM entity can determine that the authentication of the service network is not required, and the Authentication confirmation mark.
  • the AUSF entity generates n second authentication vectors according to the n first authentication vectors.
  • step S406 can refer to the existing implementation manner, and details are not described herein.
  • the AUSF entity sends an authentication initiation answer to the SEAF entity, so that the SEAF entity receives the authentication initial response from the AUSF entity.
  • the authentication initial response carries one of the n second authentication vectors.
  • the authentication initial response is also carried in the authentication initial response in step S407, so that the subsequent SEAF entity pairs the terminal.
  • the authentication confirmation request may be sent to the AUSF entity according to the authentication confirmation identifier, and the AUSF entity further performs authentication confirmation on the terminal.
  • the AUSF entity may determine the authentication information response from the UDM entity according to the locally configured security policy. Whether authentication confirmation is required. For example, the AUSF entity may determine whether the authentication confirmation is required according to the identifier of the service network where the SEAF entity is carried in step S402 and the security policy of the service network where the SEAF entity is located in the locally configured security policy. If it is determined that the authentication confirmation is required, the authentication confirmation identifier may be further carried in the authentication initial response in step S407, so that after the subsequent SEAF entity successfully authenticates the terminal, the authentication may be sent to the AUSF entity according to the authentication confirmation identifier. The AUSF entity further authenticates the terminal by confirming the request.
  • the AUSF entity may determine that an authentication confirmation is needed, and then carry the authentication confirmation in the initial authentication response. If the security policy of the service network where the SEAF entity is located in the locally configured security policy is that the trust level of the service network is high, the UDM entity may determine that the authentication confirmation is not required, and thus does not need to be carried in the initial authentication response. Authentication confirmation mark.
  • the security level of the service network may be high, and the AUSF entity may send an initial authentication response to the SEAF entity.
  • the authentication initial response carries n second authentication vectors, which are not specifically limited in this embodiment of the present application.
  • the AUSF entity may also save the correspondence between RAND1 and XRES1* for use in the subsequent step S414, which is not specifically limited in the embodiment of the present application.
  • the SEAF entity sends an authentication request to the terminal, so that the terminal receives the authentication request from the SEAF entity.
  • the authentication request carries RAND1 and AUTN1.
  • the SEAF entity stores the HXRES1* in the second authentication vector carried in the initial response, so as to be used in the subsequent step S412, and details are not described herein again.
  • step S408 may be performed first, and then step S409 may be performed; or step S409 may be performed first, and then step S408 may be performed; or Step S408 and step S409 can be performed at the same time, which is not specifically limited in this embodiment of the present application.
  • the terminal authenticates the service network where the SEAF entity is located according to AUTN1, and calculates RES* according to RAND1.
  • step S410 can refer to the existing implementation manner, and details are not described herein.
  • the terminal sends an authentication response to the SEAF entity, so that the SEAF entity receives an authentication response from the terminal, where the authentication response carries RES*.
  • the authentication response may further include RAND1 in the second authentication vector carried in the initial authentication response, so as to be used in the subsequent step S414, and details are not described herein again.
  • the SEAF entity authenticates the terminal.
  • the SEAF entity may calculate the HRES* according to the RES* and the algorithm defined in the 3GPP 33.501 specification, and complete the authentication of the terminal by comparing the HRES* with the HXRES1* stored in step S409. For example, if the HRES* is equal to the HXRES1* stored in the step S409, it may be determined that the terminal authentication is successful; or, if the HRES* and the HXRES1* stored in the step S409 are not equal, it may be determined that the terminal authentication fails.
  • the SEAF entity may perform the following step S413 according to the authentication confirmation identifier carried in the authentication initial response in step S407; or, after the terminal is successfully authenticated, the SEAF entity may directly execute the next In the step S413, the embodiment of the present application does not specifically limit this.
  • the SEAF entity may send a registration rejection message to the terminal, which is not specifically limited in this embodiment of the present application.
  • the SEAF entity sends an authentication confirmation request to the AUSF entity, so that the AUSF entity receives the authentication confirmation request from the SEAF entity.
  • the authentication confirmation request carries RES*.
  • step S411 further carries RAND1
  • the authentication confirmation request in step S413 further carries RAND1; or, if the authentication response in step S411 does not carry RAND1, step S413
  • the RAND1 in step S407 may also be carried in the authentication confirmation request, which is not specifically limited in this embodiment of the present application.
  • the AUSF entity performs authentication confirmation on the terminal.
  • the AUSF entity may find the XRES1* according to the RAND1 and the pre-stored correspondence between RAND1 and XRES1*. Further, by comparing XRES1* and RES*, the authentication confirmation of the terminal is completed. For example, if XRES1* and RES* are equal, it can be determined that the terminal authentication confirmation is successful; or, if XRES1* and RES* are not equal, it can be determined that the terminal authentication confirmation fails.
  • the AUSF entity After the AUSF entity receives the authentication confirmation request from the SEAF entity, since the XRES1* corresponding to the RES* can be quickly found, it can be solved in the prior art that the authentication confirmation is performed before the AUSF entity.
  • the AUSF entity does not know which of the authentication vectors used to compare the XRES* with the received RES*, thereby affecting the processing performance of the AUSF entity, and Quick authentication confirmation of the terminal.
  • the AUSF entity sends an authentication confirmation answer to the SEAF entity, so that the SEAF entity receives the authentication confirmation response from the AUSF entity.
  • the authentication confirmation response carries other n-1 second authentication vectors of the n second identification vectors.
  • the authentication confirmation response may further carry the foregoing authentication confirmation identifier.
  • the SEAF entity needs to re-authenticate the terminal, other unused n-1 second authentication vectors in the n second authentication vectors can be directly used.
  • the SEAF entity receives the periodic registration request or the tracking area update request from the terminal, the other unused n-1 second authentication vectors in the n second authentication vectors may be directly used, and the foregoing steps S408-S412 are adopted.
  • the method of authenticating the terminal is performed; or the terminal is authenticated and authenticated by the terminal in the manner of the above steps S408-S415, and the embodiments of the present application are not described herein again.
  • the authentication confirmation response may further carry the other n-1 second authentication vectors in the n second authentication vectors. Part of the second authentication vector.
  • the second authentication vector carried in the authentication confirmation response may be directly used in the foregoing manner, which is not specifically limited in this embodiment of the present application.
  • the authentication confirmation response may carry an authentication confirmation success indication, where the authentication confirmation success indication is used to indicate that the authentication confirmation is successful, so that the SEAF entity can obtain the authentication confirmation in time. the result of.
  • the authentication confirmation success indication may be, for example, a success code in the authentication confirmation response, which is not specifically limited in this embodiment of the present application.
  • the authentication confirmation response may carry an authentication confirmation failure indication, where the authentication confirmation failure indication is used to indicate that the authentication confirmation fails, so that the SEAF entity can obtain the result of the authentication confirmation in time.
  • the authentication confirmation failure indication may be, for example, a failure code in the authentication confirmation response, which is not specifically limited in this embodiment of the present application.
  • the authentication confirmation failure indication is not carried by the authentication confirmation response, but the authentication confirmation failure indication is carried by a dedicated message, which is not used by the embodiment of the present application. Specifically limited.
  • the actions of the AUSF entity and the UDM entity in the foregoing steps S401 to S415 can be performed by the processor 301 in the communication device 300 shown in FIG. 3 by calling the application code stored in the memory 303. limit.
  • the authentication system shown in FIG. 1 is applied to the 5G network shown in FIG. 2, as shown in FIG. 5, which is another authentication method provided by the embodiment of the present application, and the authentication method is provided. Including the following steps:
  • S504 The UDM entity generates n first authentication vectors according to the locally configured security policy, where n is a positive integer.
  • the UDM entity may generate n pieces according to the identifier of the service network where the SEAF entity is carried in step S403, and the security policy of the service network where the SEAF entity is located in the locally configured security policy.
  • An authentication vector may be generated n pieces according to the identifier of the service network where the SEAF entity is carried in step S403, and the security policy of the service network where the SEAF entity is located in the locally configured security policy.
  • the UDM entity may generate n first authentication vectors according to the locally configured default authentication vector number n.
  • the security policy of the service network where the SEAF entity is located in the locally configured security policy is that the trust level is low, the UDM entity may generate a first authentication vector.
  • the UDM entity may also combine the selected authentication algorithm when determining the number of the first authentication vector to be generated. For example, if the selected authentication algorithm is the 5G-AKA algorithm, the UDM entity generates n first authentication vectors according to the identifier of the service network where the SEAF entity carried in step S503 is located, and the locally configured security policy. A positive integer; if the selected authentication algorithm is the EAP-AKA' algorithm, the UDM entity may generate only one first authentication vector, which is not specifically limited in this embodiment of the present application.
  • step S507 similar to step S407, except that in the embodiment shown in FIG. 4, the authentication initial response carries one of the n second authentication vectors, and in the embodiment of the present application, Since the n first authentication vectors are generated by the UDM entity according to the locally configured security policy, the authentication initial response may carry n second authentication vectors.
  • the authentication initial response may carry n second authentication vectors.
  • the authentication method provided by the embodiment of the present application further includes the following steps:
  • the embodiment of the present application may further include the following steps:
  • the second authentication vector in the embodiment of the present application, since the n second authentication vectors have been sent to the SEAF entity in step S407, the re-authentication acknowledgement response does not need to carry n other second vector vectors.
  • the n-1 second authentication vectors that are not used may be referred to the embodiment shown in FIG. 4 for related description, and details are not described herein again.
  • the authentication method provided by the embodiment of the present application can not only solve the problem of how to deal with the performance and memory resource waste that may be generated by using the unused n-1 first authentication vectors in the prior art, thereby improving the problem.
  • the use efficiency of the first authentication vector can be reduced; and the problem of authentication failure of the terminal due to the link failure between the SEAF entity and the AUSF entity can be reduced, thereby improving the reliability of the authentication result;
  • the problem that the number of first authentication vectors of the AUSF request existing in the prior art is inconsistent with the number of first authentication vectors generated by the UDM entity is avoided.
  • the actions of the AUSF entity and the UDM entity in the foregoing steps S501 to S515 can be performed by the processor 301 in the communication device 300 shown in FIG. 3 by calling the application code stored in the memory 303, and the embodiment of the present application does not do any limit.
  • the authentication system shown in FIG. 1 is applied to the 5G network shown in FIG. 2 as an example.
  • the embodiment of the present application further provides an authentication method, where the UDM entity receives the AUSF from the AUSF. After the authentication information of the entity is determined, the authentication confirmation is required according to the locally configured security policy, and then the authentication information response is sent to the AUSF entity, where the authentication information response carries an authentication confirmation identifier, where the authentication confirmation identifier is used to indicate the need Confirmation of authentication. After receiving the authentication information response from the UDM entity, the AUSF entity sends an authentication initial response to the SEAF entity, where the authentication initial response carries an authentication confirmation identifier.
  • n first authentication vectors and n second authentication vectors may be generated in the manner of the embodiment shown in FIG. 4; or may be generated by using the embodiment shown in FIG. 5.
  • the n first authentication vectors and the n second authentication vectors are not specifically limited in this embodiment of the present application. For related description, refer to the embodiment shown in FIG. 4 or FIG. 5, and details are not described herein again.
  • the charging dispute or the denial of service attack between the visited network and the home network that may exist in the prior art can be avoided, and the security of the network is improved.
  • the foregoing authentication entity includes corresponding hardware structures and/or software modules for performing various functions.
  • the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.
  • the embodiment of the present application may perform the division of the function module on the authentication entity according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 6 shows a schematic structural diagram of an authentication entity 60.
  • the authentication entity 60 includes a transceiver module 601 and a processing module 602.
  • the transceiver module 601 is configured to receive n first authentication vectors from the unified data management entity, where n is a positive integer.
  • the processing module 602 is configured to generate n second authentication vectors according to the n first authentication vectors.
  • the transceiver module 601 is further configured to send one of the n second authentication vectors to the security anchor function entity.
  • the transceiver module 601 is further configured to receive an authentication confirmation request from the security anchor function entity, and perform authentication confirmation on the terminal according to the authentication confirmation request.
  • the transceiver module 601 is further configured to: when the authentication confirmation succeeds,
  • the security anchor function entity sends n unused second authentication vectors in the n second authentication vectors.
  • the transceiver module 601 is further configured to send an authentication confirmation identifier to the security anchor function entity, where the authentication confirmation identifier is used to indicate that an authentication confirmation is required.
  • processing module 602 is further configured to determine that an authentication confirmation is required.
  • the processing module 602 is configured to determine that an authentication confirmation is required, including: receiving an authentication confirmation identifier from the unified data management entity, where the authentication confirmation identifier is used to indicate that an authentication confirmation is required.
  • the processing module 602 is configured to determine that an authentication confirmation is required, including: determining, according to a locally configured security policy, that an authentication confirmation is required.
  • the authentication confirmation request carries the RES* and the corresponding RAND; the processing module 602 is configured to perform authentication confirmation on the terminal according to the authentication confirmation request, including: searching for the corresponding XRES* according to the RAND, and comparing the RES* Confirm the terminal with XRES*.
  • the transceiver module 601 is further configured to: when the authentication confirmation fails, send an authentication confirmation failure indication to the security anchor function entity, where the authentication confirmation failure indication is used to indicate that the authentication confirmation fails.
  • the transceiver module 601 is further configured to send an authentication confirmation success indication to the security anchor function entity if the authentication confirmation succeeds, and the authentication confirmation success indication is used to indicate that the authentication confirmation is successful.
  • the transceiver module 601 is further configured to send an authentication confirmation identifier to the security anchor function entity, where the authentication confirmation identifier is used to indicate that an authentication confirmation is required.
  • the authentication entity 60 is presented in a form that divides the various functional modules in an integrated manner.
  • a “module” herein may refer to an application-specific integrated circuit (ASIC), circuitry, a processor and memory that executes one or more software or firmware programs, integrated logic circuitry, and/or other functions that provide the functionality described above. Device.
  • ASIC application-specific integrated circuit
  • the authentication entity 60 may take the form shown in FIG.
  • the processor 301 in FIG. 3 can execute an instruction by calling a computer stored in the memory 303, so that the authentication entity 60 executes the authentication method in the above method embodiment.
  • the function/implementation process of the transceiver module 601 and the processing module 602 in FIG. 6 can be implemented by the processor 301 in FIG. 3 calling a computer execution instruction stored in the memory 303.
  • the function/implementation process of the processing module 602 in FIG. 6 can be implemented by the processor 301 in FIG. 3 calling the computer execution instruction stored in the memory 303, and the function/implementation process of the transceiver module 601 in FIG.
  • the communication interface 304 in 3 is implemented.
  • the authentication entity provided by the embodiment of the present application can be used to perform the foregoing authentication method. Therefore, the technical effects that can be obtained by reference to the foregoing method embodiments are not described herein.
  • the authentication entity 60 is presented in a form that divides the various functional modules in an integrated manner.
  • the embodiments of the present application may also be used to divide each functional module of the authentication entity corresponding to each function, which is not specifically limited in this embodiment of the present application.
  • the embodiment of the present application provides a chip system, where the chip system includes a processor, configured to support an authentication entity to implement the foregoing authentication method, for example, generating n seconds according to n first authentication vectors. Authentication vector.
  • the chip system also includes a memory. This memory is used to store the necessary program instructions and data for the authentication entity.
  • the chip system may be composed of a chip, and may also include a chip and other discrete devices. This embodiment of the present application does not specifically limit this.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server or data center via wired (eg coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device that includes one or more servers, data centers, etc. that can be integrated with the media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)) or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a DVD
  • a semiconductor medium such as a solid state disk (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供鉴权方法、设备及系统，以至少解决如何处理剩下未使用的n-1个AV而可能产生的性能和内存资源浪费的问题。方法包括：鉴权实体接收来自统一数据管理实体的n个第一鉴权矢量，n为正整数；该鉴权实体根据该n个第一鉴权矢量，生成n个第二鉴权矢量；该鉴权实体向安全锚点功能实体发送该n个第二鉴权矢量中的其中一个第二鉴权矢量；该鉴权实体接收来自该安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认；在鉴权确认成功的情况下，该鉴权实体向该安全锚点功能实体发送该n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。

Description

鉴权方法、设备及系统
本申请要求于2017年11月17日提交中国国家知识产权局、申请号为201711148923.1、发明名称为“鉴权方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及鉴权方法、设备及系统。
背景技术
在第三代合作伙伴计划(3rd generation partnership project，3GPP)技术标准(technical standard，TS)33.501 v0.40所描述的用户注册过程的鉴权流程中，若归属网络中的统一数据管理(unified data management，UDM)实体选择的鉴权算法为第五代认证和密钥协商(5rd generation-authentication and key agreement，5G-AKA)，则UDM实体可能一次产生n个鉴权矢量(authentication vector，AV)，n为正整数。进而，归属网络中的鉴权服务器功能(authentication server function，AUSF)实体可以接收来自UDM实体的n个AV。但对于某些信任类别较低的拜访网络中的安全锚点功能(security anchor function，SEAF)实体，AUSF实体可能仅向SEAF实体发送一个AV，当n＞1时，现有技术并没有明确说明剩下未使用的n-1个AV如何处理。若剩下未使用的n-1个AV都保存在AUSF实体，可能产生如下问题：
第一，可能对AUSF实体和UDM实体的处理性能产生一定影响。
第二，剩下未使用的n-1个AV保存在AUSF实体上将会占用AUSF实体的内存，比如若n＝10，由于AV包括随机数(random number，RAND)、鉴权令牌(authentication token，AUTN)、期望的响应值(expected response，XRES*)和密钥Kasme*，而AUTN和RAND分别占用16个字节，XRES*占用16个字节，Kasme*占用32个字节，则对于一个用户来说，n-1个AV保存在AUSF实体上将会占用9*(16+16+16+32)＝800个字节；对于1000万用户来说，n-1个AV保存在AUSF实体上将会占用1000万*800＝7.5GB内存。
因此，如何处理剩下未使用的n-1个AV而可能产生的性能和内存资源浪费的问题，是目前亟待解决的技术问题。
发明内容
本申请实施例提供鉴权方法、设备及系统，以至少解决如何处理剩下未使用的n-1个AV而可能产生的性能和内存资源浪费的问题。
为达到上述目的，本申请实施例提供如下技术方案：
第一方面，提供一种鉴权方法，该方法包括：鉴权实体接收来自统一数据管理实体的n个第一鉴权矢量，n为正整数；该鉴权实体根据该n个第一鉴权矢量，生成n个第二鉴权矢量；该鉴权实体向安全锚点功能实体发送该n个第二鉴权矢量中的其中一个第二鉴权矢量；该鉴权实体接收来自该安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终 端进行鉴权确认；在鉴权确认成功的情况下，该鉴权实体向该安全锚点功能实体发送该n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。基于该方案，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于安全锚点功能实体和鉴权实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
在一种可能的设计中，该方法还包括：该鉴权实体向该安全锚点功能实体发送鉴权确认标识，其中，该鉴权确认标识用于指示需要鉴权确认。这样后续SEAF实体对终端鉴权成功后，可以根据该鉴权确认标识向AUSF实体发送鉴权确认请求，由AUSF实体进一步对终端进行鉴权确认。
在一种可能的设计中，该方法还包括：该鉴权实体确定需要鉴权确认。
可选的，该鉴权实体确定需要鉴权确认，包括：该鉴权实体接收来自该统一数据管理实体的鉴权确认标识，其中，该鉴权确认标识用于指示需要鉴权确认。也就是说，可以由统一数据管理实体确定是否需要鉴权确认，从而可以避免现有技术中可能存在的拜访网络和归属网络之间的计费纠纷或者拒绝服务攻击，提升网络的安全性。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
可选的，该鉴权实体确定需要鉴权确认，包括：该鉴权实体根据本地配置的安全策略，确定需要鉴权确认。
在一种可能的设计中，该鉴权确认请求携带响应值RES*和对应的随机数RAND；该鉴权实体根据该鉴权确认请求对该终端进行鉴权确认，包括：该鉴权实体根据该RAND查找对应的XRES*，并通过比较该RES*和该XRES*对该终端进行鉴权确认。通过该方式，在鉴权实体接收来自安全锚点功能实体的鉴权确认请求之后，由于可以快速查找到与RES*对应的XRES*，因此可以解决现有技术中在进行鉴权确认时，在鉴权实体之前从统一数据管理实体中接收多个第一鉴权矢量的情况下，鉴权实体不知道使用哪个鉴权矢量中的XRES*和接收到的RES*进行比较，从而影响AUSF实体的处理性能的问题，可以实现对终端的快速鉴权确认。
第二方面，提供一种鉴权方法，该方法包括：统一数据管理实体生成n个第一鉴权矢量，n为正整数；该统一数据管理实体向鉴权实体发送该n个第一鉴权矢量；该鉴权实体接收来自该统一数据管理实体的n个第一鉴权矢量，并根据该n个第一鉴权矢量，生成n个第二鉴权矢量；该鉴权实体向安全锚点功能实体发送该n个第二鉴权矢量中的其中一个第二鉴权矢量；该鉴权实体接收来自该安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认；在鉴权确认成功的情况下，该鉴权实体向该安全锚点功能实体发送该n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。其中，第二方面所带来的技术效果可参见第一方面所带来的技术效果，此处不再赘述。
在一种可能的设计中，该统一数据管理实体生成n个第一鉴权矢量，包括：该统一数据管理实体根据本地配置的缺省鉴权矢量数目n，生成n个第一鉴权矢量。本申请实施例中，由于统一数据管理实体可以根据鉴权算法，生成相应数量的第一鉴权矢量，而不 是像现有技术一样，在鉴权实体发送给统一数据实体的鉴权信息请求中携带鉴权矢量的个数，因此可以避免现有技术中存在的鉴权实体请求的第一鉴权矢量的数量与统一数据实体生成的第一鉴权矢量的数量不一致的问题。比如，若鉴权实体请求的第一鉴权矢量的数量为多个，而统一数据管理实体选择的鉴权算法一次仅生成一个第一鉴权矢量，则无法满足鉴权实体请求的第一鉴权矢量的数量要求。
在一种可能的设计中，该方法还包括：该统一数据管理实体根据本地配置的安全策略，确定需要鉴权确认；该统一数据管理实体向该鉴权实体发送鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认；该鉴权实体接收来自该统一数据管理实体的该鉴权确认标识，并向该安全锚点功能实体发送该鉴权确认标识。
在一种可能的设计中，该统一数据管理实体根据本地配置的安全策略，确定需要鉴权确认，包括：该统一数据管理实体根据该安全锚点功能实体所在的服务网络的标识，以及该本地配置的安全策略中该服务网络的安全策略，确定需要鉴权确认。也就是说，可以由统一数据管理实体确定是否需要鉴权确认，从而可以避免现有技术中可能存在的拜访网络和归属网络之间的计费纠纷或者拒绝服务攻击，提升网络的安全性。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
第三方面，提供一种鉴权方法，该方法包括：统一数据管理实体根据本地配置的安全策略，确定需要鉴权确认；该统一数据管理实体向鉴权实体发送鉴权信息应答，该鉴权信息应答携带鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认；该鉴权实体接收来自该统一数据实体的该鉴权信息应答；该鉴权实体向安全锚点功能实体发送鉴权初始应答，该鉴权初始应答携带该鉴权确认标识；该鉴权实体接收来自该安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认。基于该方案，可以避免现有技术中可能存在的拜访网络和归属网络之间的计费纠纷或者拒绝服务攻击，提升网络的安全性。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
在一种可能的设计中，该方法还包括：该统一数据管理实体生成n个第一鉴权矢量；相应的，该鉴权信息应答还携带n个第一鉴权矢量；该方法还包括：该鉴权实体根据该n个第一鉴权矢量，生成n个第二鉴权矢量；相应的，该鉴权初始应答还携带该n个第二鉴权矢量中的其中一个第二鉴权矢量；在该鉴权实体接收来自该安全锚点功能实体的鉴权确认请求之后，该方法还包括：在鉴权确认成功的情况下，该鉴权实体向该安全锚点功能实体发送该n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。基于该方案，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于安全锚点功能实体和鉴权实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
在一种可能的设计中，该方法还包括：该统一数据管理实体生成n个第一鉴权矢量；相应的，该鉴权信息应答还携带n个第一鉴权矢量；该方法还包括：该鉴权实体根据该n个第一鉴权矢量，生成n个第二鉴权矢量；相应的，该鉴权初始应答还携带该n个第二鉴权矢量。基于该方案，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率； 而且可以减少由于安全锚点功能实体和鉴权实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
结合上述第一方面至第三方面，在一种可能的设计中，在鉴权实体根据鉴权确认请求对终端进行鉴权确认之后，还包括：在鉴权确认失败的情况下，鉴权实体向安全锚点功能实体发送鉴权确认失败指示，该鉴权确认失败指示用于指示鉴权确认失败。这样可以使得安全锚点功能实体及时获知鉴权确认的结果。
结合上述第一方面至第三方面，在一种可能的设计中，在鉴权实体根据鉴权确认请求对终端进行鉴权确认之后，还包括：在鉴权确认成功的情况下，鉴权实体向安全锚点功能实体发送鉴权确认成功指示，该鉴权确认成功指示用于指示鉴权确认成功。这样可以使得安全锚点功能实体及时获知鉴权确认的结果。
结合上述第一方面至第三方面，在一种可能的设计中，在鉴权实体根据鉴权确认请求对终端进行鉴权确认之后，还包括：在鉴权确认成功的情况下，鉴权实体向安全锚点功能实体发送鉴权确认标识，其中，该鉴权确认标识用于指示需要鉴权确认。
第四方面，提供一种鉴权方法，该鉴权方法包括：统一数据管理实体根据本地配置的安全策略，生成n个第一鉴权矢量，n为正整数；统一数据管理实体向鉴权实体发送n个第一鉴权矢量；鉴权实体接收来自该统一数据实体的n个第一鉴权矢量，并根据n个第一鉴权矢量，生成n个第二鉴权矢量；鉴权实体向该安全锚点功能实体发送该n个第二鉴权矢量。基于该方法，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于安全锚点功能实体和鉴权实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性；同时，还可以避免现有技术中存在的鉴权实体请求的第一鉴权矢量的数量与统一数据管理实体实际生成的第一鉴权矢量的数量不一致的问题。相关技术效果的分析可参考下述方法实施例部分，在此不再赘述。
在一种可能的设计中，该方法还包括：鉴权实体接收来自安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认；在鉴权确认失败的情况下，该鉴权实体向该安全锚点功能实体发送鉴权确认失败指示，该鉴权确认失败指示用于指示鉴权确认失败。这样可以使得安全锚点功能实体及时获知鉴权确认的结果。
在一种可能的设计中，该方法还包括：鉴权实体接收来自安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认；在鉴权确认成功的情况下，该鉴权实体向该安全锚点功能实体发送鉴权确认成功指示，该鉴权确认成功指示用于指示鉴权确认成功。
在一种可能的设计中，统一数据管理实体根据本地配置的安全策略，生成n个第一鉴权矢量，包括：统一数据管理实体根据该安全锚点功能实体所在的服务网络的标识，以及该本地配置的安全策略中该服务网络的安全策略，生成n个第一鉴权矢量。
第五方面，提供了一种鉴权实体，该鉴权实体具有实现上述第一方面所述的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第六方面，提供了一种鉴权实体，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该鉴权实体运行时，该处理器执行该存储器存储的该计算机执行指令，以使该鉴权实体执行如上述第一方面中任一所述的鉴权方法。
第七方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项所述的鉴权方法。
第八方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项所述的鉴权方法。
第九方面，提供了一种芯片系统，该芯片系统包括处理器，用于支持鉴权实体实现上述方面中所涉及的功能，例如根据n个第一鉴权矢量，生成n个第二鉴权矢量。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存鉴权实体必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第五方面至第九方面中任一种设计方式所带来的技术效果可参见第一方面中不同设计方式所带来的技术效果，此处不再赘述。
第十方面，提供一种鉴权系统，该鉴权系统包括统一数据管理实体和鉴权实体；该统一数据管理实体，用于生成n个第一鉴权矢量，n为正整数；该统一数据管理实体，还用于向鉴权实体发送该n个第一鉴权矢量；该鉴权实体，用于接收来自该统一数据管理实体的n个第一鉴权矢量，并根据该n个第一鉴权矢量，生成n个第二鉴权矢量；该鉴权实体，还用于向安全锚点功能实体发送该n个第二鉴权矢量中的其中一个第二鉴权矢量；该鉴权实体，还用于接收来自该安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认；该鉴权实体，还用于在鉴权确认成功的情况下，向该安全锚点功能实体发送该n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。其中，第十方面所带来的技术效果可参见第二方面所带来的技术效果，此处不再赘述。
第十一方面，提供一种鉴权系统，该鉴权系统包括：统一数据管理实体和鉴权实体；该统一数据管理实体，用于根据本地配置的安全策略，确定需要鉴权确认；该统一数据管理实体，还用于向鉴权实体发送鉴权信息应答，该鉴权信息应答携带鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认；该鉴权实体，用于接收来自该统一数据实体的该鉴权信息应答；该鉴权实体，还用于向安全锚点功能实体发送鉴权初始应答，该鉴权初始应答携带该鉴权确认标识；该鉴权实体，还用于接收来自该安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对该终端进行鉴权确认。其中，第十一方面所带来的技术效果可参见第三方面所带来的技术效果，此处不再赘述。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请实施例提供的鉴权系统的架构示意图；
图2为本申请实施例提供的5G网络架构的示意图；
图3为本申请实施例提供的通信设备的硬件结构示意图；
图4为本申请实施例提供的鉴权方法的流程示意图一；
图5为本申请实施例提供的鉴权方法的流程示意图二；
图6为本申请实施例提供的鉴权实体的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同，本申请实施例对此不作具体限定。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图1所示，为本申请实施例提供的一种鉴权系统10，该鉴权系统10包括统一数据管理实体101和鉴权实体102。其中，统一数据管理实体101和鉴权实体102之间可以直接通信，也可以通过其他设备的转发进行通信，本申请实施例对此不作具体限定。
一种可能的实现方式中，统一数据管理实体101，用于生成n个第一鉴权矢量，并向鉴权实体102发送n个第一鉴权矢量，n为正整数。
鉴权实体102，用于接收来自统一数据实体101的n个第一鉴权矢量，并根据n个第一鉴权矢量，生成n个第二鉴权矢量。
鉴权实体102，还用于向安全锚点功能实体发送n个第二鉴权矢量中的其中一个第二鉴权矢量。
鉴权实体102，还用于接收来自安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对终端进行鉴权确认；在鉴权确认成功的情况下，向安全锚点功能实体发送n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。
其中，本申请实施例中的第一鉴权矢量可以包括RAND、AUTN、XRES*和Kasme*。与该第一鉴权矢量对应的第二鉴权矢量可以包括RAND、AUTN、哈希(Hash)XRES*(HXRES*)和Kasme*，在此统一说明，以下不再赘述。其中，HXRES*是根据RAND和XRES*确定的，具体可参考现有的实现方式，本申请实施例对此不予赘述。
本申请实施例提供的鉴权系统中，鉴权实体在根据接收到的n个第一鉴权矢量生成n个第二鉴权矢量之后，向安全锚点功能实体发送n个第二鉴权矢量中的其中一个第二鉴权矢量，并在接收来自安全锚点功能实体的鉴权确认请求，且根据鉴权确认请求对终端进行鉴权确认成功之后，向安全锚点功能实体发送n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。这样，一方面，不仅可以避免每次服务网络的安全锚点功能实体重新对终端鉴权时，均需要向归属网络的鉴权实体请求第一鉴权矢量，从而对鉴权实体的处理性能产生的影响； 也可以避免归属网络中的鉴权实体并不知道拜访网络中的安全锚点功能实体何时会再次发起鉴权，比如终端已经离开了安全锚点功能实体所在的拜访网络，或者，比如距离下次安全锚点功能实体会再次发起鉴权的时间还很长。此时若采用老化删除机制，则安全锚点功能实体向鉴权实体再次请求第一鉴权矢量时，由于第一鉴权矢量已经老化被删除，统一数据管理实体还得重新生成需要的第一鉴权矢量，从而对统一数据管理实体的处理性能产生的影响；同时可以避免安全锚点功能实体向鉴权实体再次请求第一鉴权矢量时，由于安全锚点功能实体和鉴权实体之间因为链路不通而导致获取不到第一鉴权矢量，从而对终端鉴权失败的问题。另一方面，可以解决现有技术中存在的剩下未使用的n-1个第一鉴权矢量可能产生的鉴权实体的内存资源浪费的问题。也就是说，基于该方案，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于安全锚点功能实体和鉴权实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。
另一种可能的实现方式中，统一数据管理实体101，用于根据本地配置的安全策略，生成n个第一鉴权矢量，并向鉴权实体102发送n个第一鉴权矢量n为正整数。
鉴权实体102，用于接收来自统一数据实体101的n个第一鉴权矢量，并根据n个第一鉴权矢量，生成n个第二鉴权矢量后，向安全锚点功能实体发送n个第二鉴权矢量。
可选的，本申请实施例中，本地配置的安全策略可以包括不同服务网络的安全策略列表，该安全策略列表中可以包括当前为终端服务的安全锚点功能实体所在的服务网络的安全策略，本申请实施例对此不作具体限定。
其中，本申请实施例中，服务网络的安全策略具体可以包括服务网络的信任等级，该服务网络的信任等级例如可以包括信任等级高或信任等级低。信任等级高表示信任该服务网络；信任等级低表示不信任该服务网络。在此统一说明，以下不再赘述。
其中，本申请实施例中的服务网络可以是归属网络，比如可以是终端非漫游场景下的归属地公共陆地移动网络(home public land mobile network，HPLMN)；或者，该服务网络也可以是拜访网络，比如可以是终端漫游场景下的访问地公共陆地移动网络(visited public land mobile network，VPLMN)，本申请实施例对此不作具体限定。在此统一说明，以下不再赘述。
示例性的，本地配置的安全策略可以如表一所示。
表一
服务网络 安全策略
PLMN1 信任等级高
PLMN2 信任等级高
PLMN3 信任等级低
PLMN4 信任等级高
…… ……
需要说明的是，表一仅是示例性的给出了一种本地配置的安全策略的列表形式，当然，本地配置的安全策略还可能是其他的形式，比如文本形式等，本申请实施例对此不作具体限定。
本申请实施例提供的鉴权系统中，鉴权实体根据本地配置的安全策略，生成n个第一鉴权矢量，并向鉴权实体发送n个第一鉴权矢量，由鉴权实体根据n个第一鉴权矢量，生成n个第二鉴权矢量之后，向安全锚点功能实体发送n个第二鉴权矢量。比如，本地配置的安全策略中该安全锚点功能实体所在的服务网络的安全策略为信任等级高，可以生成多个第一鉴权矢量，这样鉴权实体可以得到多个第二鉴权矢量后，向安全锚点功能实体发送多个第二鉴权矢量；或者，本地配置的安全策略中该安全锚点功能实体所在的服务网络的安全策略为信任等级低，可以生成一个第一鉴权矢量，这样鉴权实体可以得到一个第二鉴权矢量后，向安全锚点功能实体发送一个第二鉴权矢量。这样，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于安全锚点功能实体和鉴权实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。同时，由于统一数据管理实体是根据本地配置的安全策略，生成n个第一鉴权矢量，而不是像现有技术一样，在鉴权实体发送给统一数据管理实体的鉴权信息请求(authentication information request)中携带鉴权矢量的个数，因此不仅使得后续过程中鉴权实体可以向安全锚点功能实体发送n个第二鉴权矢量，而且可以避免现有技术中存在的鉴权实体请求的第一鉴权矢量的数量与统一数据管理实体实际生成的第一鉴权矢量的数量不一致的问题。比如，若鉴权实体请求的第一鉴权矢量的数量为多个，而统一数据管理实体选择的鉴权算法为增强的基于认证和密钥协商的可扩展认证协议(extensible authentication protocol-authentication and key agreement，EAP-AKA')算法，则统一数据管理实体一次仅生成一个第一鉴权矢量，从而无法满足鉴权实体请求的第一鉴权矢量的数量要求。
再一种可能的实现方式中，统一数据管理实体101，用于根据本地配置的安全策略，确定需要鉴权确认后，向鉴权实体102发送鉴权信息应答，该鉴权信息应答携带鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认。其中，本地配置的安全策略的描述可参考上述实施例中的相关描述，在此不再赘述。
鉴权实体102，用于接收来自统一数据实体的鉴权信息应答，并向安全锚点功能实体发送鉴权初始应答，该鉴权初始应答携带鉴权确认标识。
鉴权实体102，还用于接收来自安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对终端进行鉴权确认。
本申请实施例提供的鉴权系统中，统一数据管理实体可以根据本地配置的安全策略，确定需要鉴权确认后，通过鉴权实体向安全锚点功能实体发送鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认；进而，鉴权实体可以接收来自安全锚点功能实体的鉴权确认请求，并根据该鉴权确认请求对终端进行鉴权确认。这样，后续安全锚点功能实体向统一数据管理实体请求注册和获取用户签约数据的过程中，即使统一数据管理实体未获取到鉴权确认结果，由于统一数据管理实体可以获知网络的安全状况，因此统一数据管理实体可以根据网络的安全情况选择拒绝请求或者接受请求。而不像现有技术中一样，在后续安全锚点功能实体向统一数据管理实体请求注册和获取用户签约数据的过程中，在统一数据管理实体未获取到鉴权确认结果的情况下，由于不知道网络是否安全，可能直接拒绝，也可能直接接受，从而对网络安全造成的影响。比如，若统一数据管理实体直接接受，则恶意的 安全锚点功能实体就可以利用这一点，比如，即使安全锚点功能实体上对终端鉴权失败，或者安全锚点功能实体和终端之间从来没有进行过鉴权流程，安全锚点功能实体也可以随时向统一数据管理实体请求注册和获取用户签约数据，从而骗取统一数据管理实体的信任，从而将可能导致拜访网络和归属网络之间的计费纠纷。或者，若统一数据管理实体直接拒绝,那么即使终端在安全锚点功能实体所在的服务网络鉴权已经成功，则终端也可能永远无法在安全锚点功能实体所在的服务网络注册成功，从而无法访问安全锚点功能实体所在的服务网络，其效果类似于拒绝服务攻击(deny of service)。也就是说，基于该方案，可以避免现有技术中可能存在的拜访网络和归属网络之间的计费纠纷或者拒绝服务攻击，提升网络的安全性。
可选的，图1所示的鉴权系统10可以应用于5G网络以及未来其它的网络，本发明实施例对此不作具体限定。
其中，若图1所示的鉴权系统10应用于5G网络，则如图2所示，则鉴权实体可以为5G网络中的AUSF实体；统一数据管理实体可以为5G网络中的UDM实体，安全锚点功能实体可以为5G网络中的SEAF实体。
此外，如图2所示，该5G网络还可以包括接入设备与接入和移动性管理(core access and mobility management function，AMF)实体等，本申请实施例对此不作具体限定。
虽然未示出，该5G网络还可以包括策略控制功能(policy control function，PCF)实体、用户面功能(user plane function，UPF)实体和会话管理功能(session management function，SMF)实体等，本申请实施例对此不作具体限定。
需要说明的是，本申请实施例中，SEAF实体和AMF实体可能合一部署，也可能分开部署，本申请实施例对此不作具体限定。其中，本申请实施例均以SEAF实体和AMF实体分开部署为例进行说明；当然，若SEAF实体和AMF实体合一部署，则本申请实施例的SEAF实体需要替换为AMF实体，在此统一说明，以下不再赘述。
其中，如图2所示，终端通过下一代网络(next generation，N)接口1(简称N1)与AMF实体通信，接入设备通过N接口2(简称N2)与AMF实体通信，AMF实体通过N接口8(简称N8)与UDM实体通信，AUSF实体通过N接口13(简称N13)与UDM实体通信，SEAF实体可以分别与AUSF实体和AMF实体通信。
需要说明的是，图2中的各个网元之间的接口名字只是一个示例，具体实现中接口名字可能为其他名字，本申请实施例对此不作具体限定。
需要说明的是，图2的接入设备、SEAF实体、AMF实体、AUSF实体或UDM实体等仅是一个名字，名字对设备本身不构成限定。在5G网络以及未来其它的网络中，接入设备、SEAF实体、AMF实体、AUSF实体或UDM实体所对应的网元或实体也可以是其他的名字，本申请实施例对此不作具体限定。例如，该UDM实体还有可能被替换为用户归属服务器(home subscriber server，HSS)或者用户签约数据库(user subscription database，USD)或者数据库实体或者用户数据管理实体，等等，在此进行统一说明，以下不再赘述。
可选的，本申请实施例中所涉及到的终端(terminal)可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备；还可以包括用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、 无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication,MTC)终端、用户设备(user equipment，UE)，移动台(mobile station，MS)，终端设备(terminal device)等。为方便描述，本申请中，上面提到的设备统称为终端。
可选的，本申请实施例中所涉及到的接入设备指的是接入核心网的设备，例如可以是基站，宽带网络业务网关(broadband network gateway，BNG)，汇聚交换机，非第三代合作伙伴计划(3rd generation partnership project，3GPP)接入设备等。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。
可选的，图1中的统一数据管理实体101或鉴权实体102可以由一个实体设备实现，也可以由多个实体设备共同实现，还可以是一个实体设备内的一个逻辑功能模块，本申请实施例对此不作具体限定。
例如，图1中的统一数据管理实体101或鉴权实体102可以通过图3中的通信设备来实现。图3所示为本申请实施例提供的通信设备的硬件结构示意图。该通信设备300包括至少一个处理器301，通信线路302，存储器303以及至少一个通信接口304。
处理器301可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路302可包括一通路，在上述组件之间传送信息。
通信接口304，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器303可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路302与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器303用于存储执行本申请方案的计算机执行指令，并由处理器301来控制执行。处理器301用于执行存储器303中存储的计算机执行指令，从而实现本申请下述实施例提供的鉴权方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器301可以包括一个或多个CPU，例如图3中的CPU0和CPU1。
在具体实现中，作为一种实施例，通信设备300可以包括多个处理器，例如图3中的处理器301和处理器308。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，通信设备300还可以包括输出设备305和输入设备306。输出设备305和处理器301通信，可以以多种方式来显示信息。例如，输出设备305可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备306和处理器301通信，可以以多种方式接收用户的输入。例如，输入设备306可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的通信设备300可以是一个通用设备或者是一个专用设备。在具体实现中，通信设备300可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端设备、嵌入式设备或有图3中类似结构的设备。本申请实施例不限定通信设备300的类型。
下面将结合图1至图3，对本申请实施例提供的鉴权方法进行具体阐述。
需要说明的是，本申请下述实施例中的参数名字或者各个网元之间的消息名字只是一个示例，具体实现中也可以是其他的名字，本申请实施例对此不作具体限定。
需要说明的是，本申请下述实施例中各个网元之间交互的消息中除了携带所描述的参数外，还可能携带其他参数，本申请实施例对此不作具体限定。
以图1所示的鉴权系统应用于如图2所示的5G网络为例，如图4所示，为本申请实施例提供的一种鉴权方法，该鉴权方法包括如下步骤：
S401、终端向SEAF实体发送注册请求(registration request)，以使得SEAF实体接收来自终端的注册请求。其中，该注册请求中携带用户的签约标识。
可选的，本申请实施例中，用户的签约标识例如可以是国际移动用户标识(international mobile subscriber identity，IMSI)或者其他，本申请实施例对此不作具体限定。
S402、SEAF实体向AUSF实体发送鉴权初始请求(authentication initiation request)，以使得AUSF实体接收来自SEAF实体的鉴权初始请求。其中，该鉴权初始请求中携带用户的签约标识以及SEAF实体所在的服务网络的标识。
S403、AUSF实体向UDM实体发送鉴权信息请求，以使得UDM实体接收来自AUSF实体的鉴权信息请求。其中，该鉴权信息请求中携带用户的签约标识以及SEAF实体所在的服务网络的标识。
S404、UDM实体生成n个第一鉴权矢量，n为正整数。
可选的，本申请实施例中，UDM实体在接收来自AUSF实体的鉴权信息请求之后，可以根据配置选择鉴权算法，进而可以根据鉴权算法，生成相应数量的第一鉴权矢量。比如，若UDM实体选择的鉴权算法为5G-AKA算法，则UDM实体可以根据本地配置的缺省鉴权矢量数目n，生成n个第一鉴权矢量；或者，若UDM实体选择的鉴权算法为EAP-AKA'算法，则UDM实体可以仅生成一个第一鉴权矢量。
其中，UDM实体根据配置选择鉴权算法的相关实现可参考现有的方式，在此不予赘述。
需要说明的是，本申请实施例中，对应不同的鉴权算法，UDM实体本地配置的缺省鉴权矢量数目n可能相同，也可能不同，本申请实施例对此不作具体限定。
本申请实施例中，由于UDM实体可以根据鉴权算法，生成相应数量的第一鉴权矢量，而不是像现有技术一样，在AUSF实体发送给UDM实体的鉴权信息请求中携带鉴权矢量的个数，因此可以避免现有技术中存在的AUSF实体请求的第一鉴权矢量的数量与UDM实体生成的第一鉴权矢量的数量不一致的问题。比如，若AUSF实体请求的第一鉴权矢量的数量为多个，而UDM实体选择的鉴权算法为EAP-AKA'算法，则UDM实体一次仅生成一个第一鉴权矢量，从而无法满足鉴权实体请求的第一鉴权矢量的数量要求。
S405、UDM实体向AUSF实体发送鉴权信息应答(authentication information answer)，以使得AUSF实体接收来自UDM实体的鉴权信息应答。其中，该鉴权信息应答中携带n个第一鉴权矢量。
可选的，本申请实施例中，UDM实体可以根据本地配置的安全策略确定需要鉴权确认。比如，UDM实体可以根据步骤S403中携带的SEAF实体所在的服务网络的标识，以及本地配置的安全策略中该SEAF实体所在的服务网络的安全策略，确定是否需要鉴权确认。若确定需要鉴权确认，可以在鉴权信息应答中携带鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认，这样后续SEAF实体对终端鉴权成功后，可以根据该鉴权确认标识向AUSF实体发送鉴权确认请求，由AUSF实体进一步对终端进行鉴权确认。若确认不需要鉴权确认，由于UDM实体可以获知网络的安全情况，即使获取不到鉴权确认结果，也可以避免现有技术中可能存在的拜访网络和归属网络之间的计费纠纷或者拒绝服务攻击，提升网络的安全性。
示例性的，若本地配置的安全策略中SEAF实体所在的服务网络的安全策略为服务网络的信任等级低，则UDM实体可以确定需要进行鉴权确认，进而在鉴权信息应答中携带鉴权确认标识；或者，若本地配置的安全策略中SEAF实体所在的服务网络的安全策略为服务网络的信任等级高，则UDM实体可以确定需要不进行鉴权确认，进而不需要在鉴权信息应答中携带鉴权确认标识。
S406、AUSF实体根据n个第一鉴权矢量，生成n个第二鉴权矢量。
其中，步骤S406的具体实现可参考现有的实现方式，在此不予赘述。
S407、AUSF实体向SEAF实体发送鉴权初始应答(authentication initiation answer)，以使得SEAF实体接收来自AUSF实体的鉴权初始应答。其中，该鉴权初始应答中携带n个第二鉴权矢量中的其中一个第二鉴权矢量。
可选的，本申请实施例中，若步骤S405中的鉴权信息应答中携带鉴权确认标识，则步骤S407中的鉴权初始应答中还携带该鉴权确认标识，这样后续SEAF实体对终端鉴权成功后，可以根据该鉴权确认标识向AUSF实体发送鉴权确认请求，由AUSF实体进一步对终端进行鉴权确认。
可选的，本申请实施例中，若步骤S405中的鉴权信息应答中未携带鉴权确认标识，则AUSF实体接收来自UDM实体的鉴权信息应答之后，可以根据本地配置的安全策略，确定是否需要鉴权确认。比如，AUSF实体可以根据步骤S402中携带的SEAF实体所在的服务网络的标识，以及本地配置的安全策略中该SEAF实体所在的服务网络的安全策略，确定是否需要鉴权确认。若确定需要鉴权确认，可以在步骤S407中的鉴权初始应答中还携带该鉴权确认标识，这样后续SEAF实体对终端鉴权成功后，可以根据该鉴权确认标识向AUSF实体发送鉴权确认请求，由AUSF实体进一步对终端进行鉴权确认。
示例性的，若本地配置的安全策略中SEAF实体所在的服务网络的安全策略为服务网络的信任等级低，则AUSF实体可以确定需要进行鉴权确认，进而在鉴权初始应答中携带鉴权确认标识；或者，若本地配置的安全策略中SEAF实体所在的服务网络的安全策略为服务网络的信任等级高，则UDM实体可以确定需要不进行鉴权确认，进而不需要在鉴权初始应答中携带鉴权确认标识。
可选的，本申请实施例中，若SEAF实体根据本地配置的安全策略确定不需要进行鉴权确认，则可能说明服务网络的信任等级高，进而AUSF实体可以向SEAF实体发送鉴权初始应答，该鉴权初始应答中携带n个第二鉴权矢量，本申请实施例对此不作具体限定。这样不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于SEAF实体和AUSF实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。
可选的，本申请实施例中，假设鉴权初始应答中携带的第二鉴权矢量为(RAND1、AUTN1、HXRES1*和Kasme1*)，对应的第一鉴权矢量为(RAND1、AUTN1、XRES1*和Kasme1*)，则AUSF实体还可能保存RAND1和XRES1*的对应关系，以便后续步骤S414中使用，本申请实施例对此不作具体限定。
S408、SEAF实体向终端发送鉴权请求(authentication request)，以使得终端接收来自SEAF实体的鉴权请求。其中，该鉴权请求中携带RAND1和AUTN1。
S409、SEAF实体存储鉴权初始应答中携带的第二鉴权矢量中的HXRES1*，以便后续步骤S412中使用，在此不再赘述。
需要说明的是，本申请实施例中，步骤S408和步骤S409之间没有必然的先后顺序，可以是先执行步骤S408，再执行步骤S409；或者，可以先执行步骤S409，再执行步骤S408；或者，可以同时执行步骤S408和步骤S409，本申请实施例对此不作具体限定。
S410、终端根据AUTN1对SEAF实体所在的服务网络进行鉴权，并根据RAND1计算RES*。
其中，步骤S410的具体实现可参考现有的实现方式，在此不予赘述。
S411、终端向SEAF实体发送鉴权响应(authentication response)，以使得SEAF实体接收来自终端的鉴权响应，其中，该鉴权响应中携带RES*。
可选的，该鉴权响应中还可以携带鉴权初始应答中携带的第二鉴权矢量中的RAND1，以便后续步骤S414中使用，在此不再赘述。
S412、SEAF实体对终端进行鉴权。
可选的，本申请实施例中，SEAF实体可以根据RES*以及3GPP 33.501规范中定义的算法，计算出HRES*，通过比较HRES*和步骤S409中存储的HXRES1*，完成对终端的鉴权。比如，若HRES*和步骤S409中存储的HXRES1*相等，则可以确定对终端鉴权成功；或者，若HRES*和步骤S409中存储的HXRES1*不相等，则可以确定对终端鉴权失败。
在对终端鉴权成功之后，SEAF实体可以根据步骤S407中的鉴权初始应答中携带的鉴权确认标识，执行下述步骤S413；或者，在对终端鉴权成功之后，SEAF实体可以直接执行下述步骤S413，本申请实施例对此不作具体限定。
当然，若对终端鉴权失败，SEAF实体可以向终端发送注册拒绝消息，本申请实施例对此不作具体限定。
S413、SEAF实体向AUSF实体发送鉴权确认请求(authentication confirmation request)，以使得AUSF实体接收来自SEAF实体的鉴权确认请求。其中，该鉴权确认请求中携带RES*。
可选的，若步骤S411中的鉴权响应中还携带RAND1，则步骤S413中的鉴权确认请求中还携带RAND1；或者，若步骤S411中的鉴权响应中未携带RAND1，则步骤S413中的鉴权确认请求中还可以携带步骤S407中的RAND1，本申请实施例对此不作具体限定。
S414、AUSF实体对终端进行鉴权确认。
可选的，本申请实施例中，若步骤S413中的鉴权确认请求中还携带RAND1，则AUSF实体可以根据该RAND1，以及预先存储的RAND1和XRES1*的对应关系，查找到该XRES1*，进而通过比较XRES1*和RES*，完成对终端的鉴权确认。比如，若XRES1*和RES*相等，则可以确定对终端鉴权确认成功；或者，若XRES1*和RES*不相等， 则可以确定对终端鉴权确认失败。通过该方式，在AUSF实体接收来自SEAF实体的鉴权确认请求之后，由于可以快速查找到与RES*对应的XRES1*，因此可以解决现有技术中在进行鉴权确认时，在AUSF实体之前从UDM实体中接收多个第一鉴权矢量的情况下，AUSF实体不知道使用哪个鉴权矢量中的XRES*和接收到的RES*进行比较，从而影响AUSF实体的处理性能的问题，可以实现对终端的快速鉴权确认。
S415、AUSF实体向SEAF实体发送鉴权确认应答(authentication confirmation answer)，以使得SEAF实体接收来自AUSF实体的鉴权确认应答。
其中，在鉴权确认成功的情况下，该鉴权确认应答中携带n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。可选的，该鉴权确认应答中还可以携带上述的鉴权确认标识。这样，后续若SEAF实体需要重新对终端鉴权时，可以直接使用n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。比如，在SEAF实体接收来自终端的周期性注册请求或者跟踪区域更新请求之后，可以直接使用n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量，采用上述步骤S408-S412的方式对终端鉴权；或者采用上述步骤S408-S415的方式对终端鉴权后再对终端进行鉴权确认，本申请实施例在此不再赘述。
可选的，本申请实施例中，在鉴权确认成功的情况下，该鉴权确认应答中还可以携带n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量中的部分第二鉴权矢量。这样，后续若SEAF实体需要重新对终端鉴权时，可以直接按照上述方式使用鉴权确认应答中携带的部分第二鉴权矢量，本申请实施例对此不作具体限定。
可选的，在鉴权确认成功的情况下，该鉴权确认应答中可以携带鉴权确认成功指示，该鉴权确认成功指示用于指示鉴权确认成功，以便SEAF实体可以及时获知鉴权确认的结果。其中，该鉴权确认成功指示例如可以是鉴权确认响应中的一个成功码，本申请实施例对此不作具体限定。
其中，在鉴权确认失败的情况下，该鉴权确认应答中可以携带鉴权确认失败指示，该鉴权确认失败指示用于指示鉴权确认失败，以便SEAF实体可以及时获知鉴权确认的结果。其中，该鉴权确认失败指示例如可以是鉴权确认响应中的一个失败码，本申请实施例对此不作具体限定。
可选的，在鉴权确认失败的情况下，还可以不通过鉴权确认应答携带鉴权确认失败指示，而是通过一个专用的消息携带该鉴权确认失败指示，本申请实施例对此不作具体限定。
基于该方案，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于SEAF实体和AUSF实体之间因为链路不通而导致的对终端鉴权失败的问题，从而提高了鉴权结果的可靠性。
其中，上述步骤S401至S415中AUSF实体和UDM实体的动作可以由图3所示的通信设备300中的处理器301调用存储器303中存储的应用程序代码来执行，本申请实施例对此不作任何限制。
可选的，以图1所示的鉴权系统应用于如图2所示的5G网络为例，如图5所示，为本申请实施例提供的另一种鉴权方法，该鉴权方法包括如下步骤：
S501-S503、同步骤S401-S403，具体可参考图4所示的实施例，在此不再赘述。
S504、UDM实体根据本地配置的安全策略，生成n个第一鉴权矢量，n为正整数。
可选的，本申请实施例中，UDM实体可以根据步骤S403中携带的SEAF实体所在的服务网络的标识，以及本地配置的安全策略中该SEAF实体所在的服务网络的安全策略，生成n个第一鉴权矢量。
示例性的，若本地配置的安全策略中SEAF实体所在的服务网络的安全策略为信任等级高，则UDM实体可以根据本地配置的缺省鉴权矢量数目n，生成n个第一鉴权矢量；或者，若本地配置的安全策略中SEAF实体所在的服务网络的安全策略为信任等级低，则UDM实体可以生成一个第一鉴权矢量。
可选的，本申请实施例中，UDM实体在确定待生成的第一鉴权矢量的数量时，也可以结合选择的鉴权算法。比如，若选择的鉴权算法为5G-AKA算法，则UDM实体再根据步骤S503中携带的SEAF实体所在的服务网络的标识，以及本地配置的安全策略，生成n个第一鉴权矢量，n为正整数；若选择的鉴权算法为EAP-AKA'算法，则UDM实体可以仅生成一个第一鉴权矢量，本申请实施例对此不作具体限定。
S505-S506、同步骤S405-S406，具体可参考图4所示的实施例，在此不再赘述。
S507、与步骤S407类似，区别仅在于，图4所示的实施例中，鉴权初始应答中携带n个第二鉴权矢量中的其中一个第二鉴权矢量；而本申请实施例中，由于n个第一鉴权矢量是UDM实体根据本地配置的安全策略生成的，因此鉴权初始应答中可以携带n个第二鉴权矢量，相关描述可参考图4所示的实施例，在此不再赘述。
假设后续使用的第二鉴权矢量为(RAND1、AUTN1、HXRES1*和Kasme1*)，则本申请实施例提供的鉴权方法还包括如下步骤：
S508-S512、同步骤S408-S412，具体可参考图4所示的实施例，在此不再赘述。
可选的，本申请实施例还可以包括如下步骤：
S513-S514、同步骤S413-S414，具体可参考图4所示的实施例，在此不再赘述。
S515、与步骤S415类似，区别仅在于，图4所示的实施例中，在鉴权确认成功的情况下，该鉴权确认应答中携带n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量；而本申请实施例中，由于步骤S407中已经将n个第二鉴权矢量发送给SEAF实体，因此不需要再鉴权确认应答中携带n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量，相关描述可参考图4所示的实施例，在此不再赘述。
基于本申请实施例提供的鉴权方法，不仅可以解决现有技术中存在的如何处理剩下未使用的n-1个第一鉴权矢量而可能产生的性能和内存资源浪费的问题，从而提高了第一鉴权矢量的使用效率；而且可以减少由于SEAF实体和AUSF实体之间因为链路不通而导致的对 终端鉴权失败的问题，从而提高了鉴权结果的可靠性；同时，还可以避免现有技术中存在的AUSF请求的第一鉴权矢量的数量与UDM实体生成的第一鉴权矢量的数量不一致的问题。
其中，上述步骤S501至S515中AUSF实体和UDM实体的动作可以由图3所示的通信设备300中的处理器301调用存储器303中存储的应用程序代码来执行，本申请实施例对此不作任何限制。
可选的，以图1所示的鉴权系统应用于如图2所示的5G网络为例，本申请实施例还提供的一种鉴权方法，该鉴权方法中，UDM实体接收来自AUSF实体的鉴权信息后，根据本地配置的安全策略，确定需要鉴权确认，进而向AUSF实体发送鉴权信息应答，该鉴权信息应答携带鉴权确认标识，该鉴权确认标识用于指示需要鉴权确认。AUSF实体接收来自UDM实体的鉴权信息应答后，向SEAF实体发送鉴权初始应答，该鉴权初始应答携带鉴权确认标识。这样，后续SEAF实体对终端鉴权成功后，可以向AUSF实体发送鉴权确认请求，以使得AUSF实体接收来自SEAF实体的鉴权确认请求后，根据该鉴权确认请求对终端进行鉴权确认。在该鉴权方法中，可以采用图4所示的实施例的方式生成n个第一鉴权矢量，以及发送n个第二鉴权矢量；也可以采用图5所示的实施例的方式生成n个第一鉴权矢量，以及发送n个第二鉴权矢量，本申请实施例对此不作具体限定。相关描述可参考图4或图5所示的实施例，在此不再赘述。
基于本申请实施例提供的鉴权方法，可以避免现有技术中可能存在的拜访网络和归属网络之间的计费纠纷或者拒绝服务攻击，提升网络的安全性。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述鉴权实体为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对鉴权实体进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
比如，以采用集成的方式划分各个功能模块的情况下，图6示出了一种鉴权实体60的结构示意图。该鉴权实体60包括：收发模块601和处理模块602。收发模块601，用于接收来自统一数据管理实体的n个第一鉴权矢量，n为正整数。处理模块602，用于根据n个第一鉴权矢量，生成n个第二鉴权矢量。收发模块601，还用于向安全锚点功能实体发送n个第二鉴权矢量中的其中一个第二鉴权矢量。收发模块601，还用于接收来自安全锚点功能实体的鉴权确认请求，并根据鉴权确认请求对终端进行鉴权确认；收发模块601，还用于在鉴权确认成功的情况下，向安全锚点功能实体发送n个第二鉴矢量中其他未使用的n-1个第 二鉴权矢量。
可选的，收发模块601，还用于向安全锚点功能实体发送鉴权确认标识，其中，该鉴权确认标识用于指示需要鉴权确认。
可选的，处理模块602，还用于确定需要鉴权确认。
在一种可能的实现方式中，处理模块602用于确定需要鉴权确认，包括：用于接收来自统一数据管理实体的鉴权确认标识，其中，鉴权确认标识用于指示需要鉴权确认。
在一种可能的实现方式中，处理模块602用于确定需要鉴权确认，包括：用于根据本地配置的安全策略，确定需要鉴权确认。
可选的，鉴权确认请求携带RES*和对应的RAND；处理模块602用于根据鉴权确认请求对终端进行鉴权确认，包括：用于根据RAND查找对应的XRES*，并通过比较RES*和XRES*对终端进行鉴权确认。
可选的，收发模块601，还用于在鉴权确认失败的情况下，向安全锚点功能实体发送鉴权确认失败指示，鉴权确认失败指示用于指示鉴权确认失败。
可选的，收发模块601，还用于在鉴权确认成功的情况下，向安全锚点功能实体发送鉴权确认成功指示，鉴权确认成功指示用于指示鉴权确认成功。
可选的，收发模块601，还用于在鉴权确认成功的情况下，向安全锚点功能实体发送鉴权确认标识，其中，鉴权确认标识用于指示需要鉴权确认。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在本实施例中，该鉴权实体60以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定应用集成电路(application-specific integrated circuit，ASIC)，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到鉴权实体60可以采用图3所示的形式。
比如，图3中的处理器301可以通过调用存储器303中存储的计算机执行指令，使得鉴权实体60执行上述方法实施例中的鉴权方法。
具体的，图6中的收发模块601和处理模块602的功能/实现过程可以通过图3中的处理器301调用存储器303中存储的计算机执行指令来实现。或者，图6中的处理模块602的功能/实现过程可以通过图3中的处理器301调用存储器303中存储的计算机执行指令来实现，图6中的收发模块601的功能/实现过程可以通过图3中的通信接口304来实现。
由于本申请实施例提供的鉴权实体可用于执行上述鉴权方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
上述实施例中，鉴权实体60以采用集成的方式划分各个功能模块的形式来呈现。当然，本申请实施例也可以对应各个功能划分鉴权实体的各个功能模块，本申请实施例对此不作具体限定。
可选的，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于支持鉴权实体实现上述的鉴权方法，例如根据n个第一鉴权矢量，生成n个第二鉴权矢量。在一种可能的设计中，该芯片系统还包括存储器。该存储器，用于保存鉴权实体必要的程序指 令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (35)

  1. 一种鉴权方法，其特征在于，所述方法包括：
    鉴权实体接收来自统一数据管理实体的第一鉴权矢量；
    所述鉴权实体根据所述第一鉴权矢量，生成第二鉴权矢量；
    所述鉴权实体向安全锚点功能实体发送所述第二鉴权矢量；
    所述鉴权实体接收来自所述安全锚点功能实体的鉴权确认请求，并根据所述鉴权确认请求对终端进行鉴权确认；
    在鉴权确认成功的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认成功指示，所述鉴权确认成功指示用于指示鉴权确认成功；或，在鉴权确认失败的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认失败指示，所述鉴权确认失败指示用于指示鉴权确认失败。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述鉴权实体向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  3. 根据权利要求1或2所述方法，其特征在于，所述方法还包括：
    所述鉴权实体确定需要鉴权确认。
  4. 根据权利要求3所述的方法，其特征在于，所述鉴权实体确定需要鉴权确认，包括：
    所述鉴权实体接收来自所述统一数据管理实体的鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  5. 根据权利要求3所述的方法，其特征在于，所述鉴权实体确定需要鉴权确认，包括：
    所述鉴权实体根据本地配置的安全策略，确定需要鉴权确认。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述第一鉴权矢量是用增强的基于认证和密钥协商的可扩展认证协议生成的。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述鉴权确认请求携带响应值RES*和对应的随机数RAND；
    所述鉴权实体根据所述鉴权确认请求对所述终端进行鉴权确认，包括：
    所述鉴权实体根据所述RAND查找对应的XRES*，并通过比较所述RES*和所述XRES*对所述终端进行鉴权确认。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，在所述鉴权实体根据所述鉴权确认请求对所述终端进行鉴权确认之后，还包括：
    在鉴权确认成功的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  9. 一种鉴权方法，该鉴权方法包括：
    统一数据管理实体生成第一鉴权矢量；
    所述统一数据管理实体向鉴权实体发送所述第一鉴权矢量；
    所述鉴权实体接收来自所述统一数据管理实体的所述第一鉴权矢量，并根据所述第一鉴权矢量，生成第二鉴权矢量；
    所述鉴权实体向安全锚点功能实体发送所述第二鉴权矢量；
    所述鉴权实体接收来自所述安全锚点功能实体的鉴权确认请求，并根据所述鉴权确认请 求对终端进行鉴权确认；
    在鉴权确认成功的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认成功指示，所述鉴权确认成功指示用于指示鉴权确认成功；或，在鉴权确认失败的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认失败指示，所述鉴权确认失败指示用于指示鉴权确认失败。
  10. 根据权利要求9所述的方法，其特征在于，所述统一数据管理实体生成第一鉴权矢量具体包括：所述统一数据管理实体根据本地配置的安全策略生成第一鉴权矢量。
  11. 根据权利要求10所述的方法，其特征在于，所述统一数据管理实体根据本地配置的安全策略，生成第一鉴权矢量，包括：所述统一数据管理实体根据所述安全锚点功能实体所在的服务网络的标识，以及所述本地配置的安全策略中所述服务网络的安全策略，生成所述第一鉴权矢量。
  12. 根据权利要求9-11任一所述的方法，所述统一数据管理实体采用增强的基于认证和密钥协商的可扩展认证协议生成所述第一鉴权矢量。
  13. 一种鉴权实体，其特征在于，所述鉴权实体包括：收发模块和处理模块；
    所述收发模块，用于接收来自统一数据管理实体的第一鉴权矢量；
    所述处理模块，用于根据所述第一鉴权矢量，生成第二鉴权矢量；
    所述收发模块，还用于向安全锚点功能实体发送所述第二鉴权矢量；
    所述收发模块，还用于接收来自所述安全锚点功能实体的鉴权确认请求，并根据所述鉴权确认请求对所述终端进行鉴权确认；
    所述收发模块，还用于在鉴权确认成功的情况下，向所述安全锚点功能实体发送鉴权确认成功指示，所述鉴权确认成功指示用于指示鉴权确认成功；或，在鉴权确认失败的情况下，向所述安全锚点功能实体发送鉴权确认失败指示，所述鉴权确认失败指示用于指示鉴权确认失败。
  14. 根据权利要求13所述的鉴权实体，其特征在于，所述收发模块，还用于向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  15. 根据权利要求13或14所述的鉴权实体，其特征在于，所述鉴权实体处理模块，还用于确定需要鉴权确认。
  16. 根据权利要求15所述的鉴权实体，其特征在于，所述处理模块用于确定需要鉴权确认，包括：
    用于接收来自所述统一数据管理实体的鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  17. 根据权利要求15所述的鉴权实体，其特征在于，所述处理模块用于确定需要鉴权确认，包括：
    用于根据本地配置的安全策略，确定需要鉴权确认。
  18. 根据权利要求13-17任一项所述的鉴权实体，其特征在于，所述鉴权确认请求携带响应值RES*和对应的随机数RAND；
    所述处理模块用于根据所述鉴权确认请求对所述终端进行鉴权确认，包括：
    用于根据所述RAND查找对应的XRES*，并通过比较所述RES*和所述XRES*对所述终端进行鉴权确认。
  19. 根据权利要求13-18任一项所述的鉴权实体，其特征在于，所述收发模块，还用于在 鉴权确认成功的情况下，向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  20. 一种鉴权系统，其特征在于，所述鉴权系统包括：统一数据管理实体和鉴权实体；
    所述统一数据管理实体，用于生成第一鉴权矢量；
    所述统一数据管理实体，还用于向鉴权实体发送所述第一鉴权矢量；
    所述鉴权实体，用于接收来自所述统一数据管理实体的所述第一鉴权矢量，并根据所述第一鉴权矢量，生成第二鉴权矢量；
    所述鉴权实体，还用于向安全锚点功能实体发送所述第二鉴权矢量；
    所述鉴权实体，还用于接收来自所述安全锚点功能实体的鉴权确认请求，并根据所述鉴权确认请求对所述终端进行鉴权确认；
    所述鉴权实体，还用于在鉴权确认成功的情况下，向所述安全锚点功能实体发送鉴权确认成功指示，所述鉴权确认成功指示用于指示鉴权确认成功；或，在鉴权确认失败的情况下，向所述安全锚点功能实体发送鉴权确认失败指示，所述鉴权确认失败指示用于指示鉴权确认失败。
  21. 根据权利要求20所述的鉴权系统，其特征在于，所述统一数据管理实体用于生成第一鉴权矢量，具体包括：所述统一数据管理实体根据本地配置的安全策略生成第一鉴权矢量。
  22. 根据权利要求21所述的鉴权系统，其特征在于，所述统一数据管理实体用于根据本地配置的安全策略，确定需要鉴权确认，包括：
    所述统一数据管理实体根据所述安全锚点功能实体所在的服务网络的标识，以及所述本地配置的安全策略中所述服务网络的安全策略，生成所述第一鉴权矢量。
  23. 一种鉴权方法，其特征在于，所述方法包括：
    鉴权实体接收来自统一数据管理实体的n个第一鉴权矢量，n为正整数；
    所述鉴权实体根据所述n个第一鉴权矢量，生成n个第二鉴权矢量；
    所述鉴权实体向安全锚点功能实体发送所述n个第二鉴权矢量中的其中一个第二鉴权矢量；
    所述鉴权实体接收来自所述安全锚点功能实体的鉴权确认请求，并根据所述鉴权确认请求对所述终端进行鉴权确认；
    在鉴权确认成功的情况下，所述鉴权实体向所述安全锚点功能实体发送所述n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。
  24. 根据权利要求23所述的方法，其特征在于，所述方法还包括：
    所述鉴权实体向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  25. 根据权利要求23或24所述方法，其特征在于，所述方法还包括：
    所述鉴权实体确定需要鉴权确认。
  26. 根据权利要求25所述的方法，其特征在于，所述鉴权实体确定需要鉴权确认，包括：
    所述鉴权实体接收来自所述统一数据管理实体的鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  27. 根据权利要求25所述的方法，其特征在于，所述鉴权实体确定需要鉴权确认，包括：
    所述鉴权实体根据本地配置的安全策略，确定需要鉴权确认。
  28. 根据权利要求23-27任一项所述的方法，其特征在于，所述鉴权确认请求携带响应 值RES*和对应的随机数RAND；
    所述鉴权实体根据所述鉴权确认请求对所述终端进行鉴权确认，包括：
    所述鉴权实体根据所述RAND查找对应的XRES*，并通过比较所述RES*和所述XRES*对所述终端进行鉴权确认。
  29. 根据权利要求23-28任一项所述的方法，其特征在于，在所述鉴权实体根据所述鉴权确认请求对所述终端进行鉴权确认之后，还包括：
    在鉴权确认成功的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认成功指示，所述鉴权确认成功指示用于指示鉴权确认成功。
  30. 根据权利要求23-29任一项所述的方法，其特征在于，在所述鉴权实体根据所述鉴权确认请求对所述终端进行鉴权确认之后，还包括：
    在鉴权确认成功的情况下，所述鉴权实体向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  31. 一种鉴权实体，其特征在于，所述鉴权实体包括：收发模块和处理模块；
    所述收发模块，用于接收来自统一数据管理实体的n个第一鉴权矢量，n为正整数；
    所述处理模块，用于根据所述n个第一鉴权矢量，生成n个第二鉴权矢量；
    所述收发模块，还用于向安全锚点功能实体发送所述n个第二鉴权矢量中的其中一个第二鉴权矢量；
    所述收发模块，还用于接收来自所述安全锚点功能实体的鉴权确认请求，并根据所述鉴权确认请求对所述终端进行鉴权确认；
    所述收发模块，还用于在鉴权确认成功的情况下，向所述安全锚点功能实体发送所述n个第二鉴矢量中其他未使用的n-1个第二鉴权矢量。
  32. 根据权利要求31所述的鉴权实体，其特征在于，所述收发模块，还用于向所述安全锚点功能实体发送鉴权确认标识，其中，所述鉴权确认标识用于指示需要鉴权确认。
  33. 一种鉴权实体，其特征在于，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述会话管理功能实体运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述鉴权实体执行如权利要求1-8任一项所述的鉴权方法。
  34. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行如权利要求1-8任一项所述的鉴权方法。
  35. 一种计算机程序产品，其特征在于，所述计算机程序产品中存储有指令，当其在计算机上运行时，使得计算机可以执行如权利要求1-8任一项所述的鉴权方法。
PCT/CN2018/114461 2017-11-17 2018-11-08 鉴权方法、设备及系统 Ceased WO2019096051A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18878331.0A EP3668004A4 (en) 2017-11-17 2018-11-08 AUTHENTICATION PROCESS, DEVICE, AND SYSTEM
US16/834,185 US11595817B2 (en) 2017-11-17 2020-03-30 Authentication method, device, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711148923.1A CN109803261B (zh) 2017-11-17 2017-11-17 鉴权方法、设备及系统
CN201711148923.1 2017-11-17

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/834,185 Continuation US11595817B2 (en) 2017-11-17 2020-03-30 Authentication method, device, and system

Publications (1)

Publication Number Publication Date
WO2019096051A1 true WO2019096051A1 (zh) 2019-05-23

Family

ID=66539341

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/114461 Ceased WO2019096051A1 (zh) 2017-11-17 2018-11-08 鉴权方法、设备及系统

Country Status (4)

Country Link
US (1) US11595817B2 (zh)
EP (1) EP3668004A4 (zh)
CN (1) CN109803261B (zh)
WO (1) WO2019096051A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021115686A1 (en) * 2019-12-11 2021-06-17 Telefonaktiebolaget Lm Ericsson (Publ) Enhancement of authentication
CN115280715B (zh) * 2020-03-31 2025-09-12 中兴通讯股份有限公司 用于应用通信建立的参数
CN117044249A (zh) * 2021-03-15 2023-11-10 联想（新加坡）私人有限公司 基于能力的注册认证
WO2023000248A1 (en) * 2021-07-22 2023-01-26 Huawei Technologies Co., Ltd. Authentication methods using zero-knowledge proof algorithms for user equipments and nodes implementing the authentication methods
CN117062071A (zh) * 2022-05-06 2023-11-14 华为技术有限公司 鉴权方法、通信装置和计算机可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1169880A1 (en) * 2000-02-22 2002-01-09 Nokia Corporation Integrity check in a communication system
CN1815954A (zh) * 2005-02-05 2006-08-09 华为技术有限公司 实现用户信息同步及对用户终端鉴权的方法
CN101772020A (zh) * 2009-01-05 2010-07-07 华为技术有限公司 鉴权处理方法和系统、3gpp认证授权计费服务器及用户设备

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100428848C (zh) 2005-05-31 2008-10-22 华为技术有限公司 一种对终端用户标识模块进行ip多媒体域鉴权的方法
WO2008036961A2 (en) * 2006-09-22 2008-03-27 Kineto Wireless, Inc. Method and apparatus for resource management
CN101998395B (zh) * 2009-08-27 2013-12-04 华为技术有限公司 鉴权矢量获取方法、归属服务器和网络系统
EP2506615B1 (en) * 2009-11-26 2019-07-24 China Mobile Communications Corporation Authentication system, method and device
CN102215474B (zh) * 2010-04-12 2014-11-05 华为技术有限公司 对通信设备进行认证的方法和装置
WO2016086355A1 (zh) * 2014-12-02 2016-06-09 华为技术有限公司 一种无线通信网络中的鉴权方法、相关装置及系统
EP3304856B1 (en) * 2015-06-05 2025-09-17 IPLA Holdings Inc. Unified authentication for integrated small cell and wi-fi networks
ES3012708T3 (en) * 2015-12-03 2025-04-09 Ericsson Telefon Ab L M Multi-rat security setup
KR102332075B1 (ko) * 2016-07-05 2021-11-29 삼성전자 주식회사 모바일 무선 네트워크 시스템에서의 액세스 인증 방법 및 시스템
CN106921965B (zh) * 2017-01-19 2020-07-21 厦门盛华电子科技有限公司 一种wlan网络中实现eap认证的方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1169880A1 (en) * 2000-02-22 2002-01-09 Nokia Corporation Integrity check in a communication system
CN1815954A (zh) * 2005-02-05 2006-08-09 华为技术有限公司 实现用户信息同步及对用户终端鉴权的方法
CN101772020A (zh) * 2009-01-05 2010-07-07 华为技术有限公司 鉴权处理方法和系统、3gpp认证授权计费服务器及用户设备

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
KP N: "Rewriting Clause 6.1.2 and 6.1.3 in Normative Language and Adding Annex A", 3GPP TSG SA WG3 (SECURITY) MEETING #88BIS ADHOC S 3-172569, 13 October 2017 (2017-10-13), XP051348440 *
KPN: "Rewriting Clause 6.1.2 and 6.1.3 in Normative Language and Adding Annex A", 3GPP TSG SA WG3 (SECURITY) MEETING #88BIS ADHOC S 3-1722224, 13 October 2017 (2017-10-13), XP051348102 *
See also references of EP3668004A4

Also Published As

Publication number Publication date
EP3668004A4 (en) 2020-11-25
US20200228982A1 (en) 2020-07-16
US11595817B2 (en) 2023-02-28
EP3668004A1 (en) 2020-06-17
CN109803261A (zh) 2019-05-24
CN109803261B (zh) 2021-06-22

Similar Documents

Publication Publication Date Title
US11451950B2 (en) Indirect registration method and apparatus
US12219356B2 (en) Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization
US11323440B2 (en) Secure access method, device, and system
US11595817B2 (en) Authentication method, device, and system
CN111465018B (zh) 一种增强跨网络访问安全的方法、设备及系统
CN109391937B (zh) 公钥的获取方法、设备及系统
CN109548010B (zh) 获取终端设备的身份标识的方法及装置
CN108738015B (zh) 网络安全保护方法、设备及系统
US20250184743A1 (en) Communication method and apparatus
US20250365272A1 (en) Attestation Method and Related Device Thereof
US20240356742A1 (en) Verification of service based architecture parameters
WO2022247812A1 (zh) 一种鉴权方法、通信装置和系统
WO2018191867A1 (zh) 终端监控信息的同步方法、设备及系统
CN104539446A (zh) 实现共享wlan管理的方法、系统及wlan共享注册服务器
US20230112506A1 (en) Systems and methods for providing access to a wireless communication network based on radio frequency response information and context information
KR20260059574A (ko) 서비스 api 호출 방법 및 장치
WO2026001734A1 (zh) 通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18878331

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018878331

Country of ref document: EP

Effective date: 20200311

NENP Non-entry into the national phase

Ref country code: DE