WO2006081742A1 - A method for realizing the user information synchronization and authenticating the user end - Google Patents

Abstract

A method for realizing the user information synchronisation among a plurality of BSFs includes: when the user end authenticates again and although uses the second BSF which is different from the last authentication, the second BSF can obtain the user information of the user end from the first BSF which has performed the authentication process of the user end. It ensures that the user information of the UE originating the authentication request would be synchronization in the different BSFs. Another method for realizing authentication in a plurality of BSFs ensures that the normal UE could pass the authentication based on the user information synchronisation. Otherwise, the present invention also sets the identifiers for a plurality of BSFs respectively, and realizes the identifier of BSF in the domain name of B-TID, in this way, it could indicate that which BSF has assigned the B-TID, and it is easy to be inquired by the NAF. Thereby it reduces the communication traffic among the BSFs, and increases the speed of process, and saves the network resource.

Description

 Method for realizing user information synchronization and authenticating user terminal

 The present invention relates to the field of general authentication framework technology in the third generation wireless communication, and particularly relates to a method for realizing user information synchronization and authenticating a user terminal when a plurality of BSFs are included in the same home network. Background of the invention

 In the third generation wireless communication standard, the universal authentication framework is a general structure used by various application service entities to complete the verification of the user identity, and the universal authentication framework can be used to check and verify the users of the application service. Identity. The foregoing multiple application services may be a multicast/broadcast service, a user certificate service, an information immediate service, or an agent service.

 Figure 1 shows the structure of the general framework. The universal authentication framework typically consists of a User Terminal (UE) 101, an entity (BSF) 102 performing UE Identity Initial Check Verification, a User Home Network Server (HSS) 103, and a Network Application Entity (NAF) 104. The BSF 102 is configured to mutually authenticate the identity with the user terminal 101, and simultaneously generate a shared key of the BSF 102 and the user terminal 101. The HSS 103 stores a profile file for describing user information, and the profile includes all the user identity and the like. The description information related to the user, and the HSS 103 also has the function of generating authentication vector information.

 When a user needs to use a certain service, if it knows that it needs to authenticate to the BSF, it directly interacts with the BSF to perform mutual authentication. Otherwise, the user first contacts the NAF corresponding to the service, if the NAF applies universal authentication. The framework requires the user to authenticate to the BSF, and then informs the user to apply the universal authentication framework for authentication, otherwise it handles it accordingly.

The mutual authentication process between the UE and the BSF is: The UE passes the default domain name. BSF.MCC.MNC.3GPPnetwork.org sends a request for authentication to the BSF. After receiving the authentication request from the UE, the BSF first obtains the authentication information of the UE from the HSS, and the HSS returns a group to the BSF according to the identifier of the UE. Or multiple sets of reference vectors. Since each group of authentication vectors can only be used once, the HSS can return the authentication vector information that is used only once for the BSF, but from the perspective of saving interface signaling resources, the HSS usually returns multiple sets of authentication vectors to the BSF. The information is used for multiple authentications. The HSS returns the user description information of the user to the BSF while returning to the BSF authentication vector. The BSF performs mutual authentication by performing an authentication and key agreement protocol (AKA) with the UE based on the obtained authentication vector information. After the authentication is successful, the UE and the BSF mutually authenticate the identity and simultaneously generate the shared key Ks. Afterwards, the BSF allocates a session transaction identifier (B-TID) to the UE, the format of the B-TID is RAND@BSF_server_domain_name, and the B-TID is associated with Ks, and has an expiration date. .

 After receiving the B-TID, the UE sends a connection request to the NAF. The B-TID is carried in the request message, and the UE side calculates the derived key Ks_NAF according to Ks. The NAF that has received the request confirms that the B-TID carried by the UE is not in the local area and then queries the BSF. After the BSF queries the B-TID, the BSF uses the same algorithm as the UE side to calculate the derived key Ks_NAF of the key Ks, and then gives the NAF. Sending a successful response message, the successful response includes a B-TID required by the NAF, a derived key Ks_NAF corresponding to the B-TID, and an expiration date set by the BSF for the key, if necessary, Includes user description information for the user. After receiving the success response message of the BSF, the NAF considers that the UE is a BSF-authenticated UE, and the NAF and the UE also share the Ks-NAF derived from the Ks. The NAF and the UE perform communication protection through Ks-NAF in the subsequent communication process.

When the UE finds that the key Ks or Ks_NAF is about to expire, or the NAF requires the UE to re-authenticate to the BSF, the UE repeats the above steps to re-authenticate to the BSF to obtain a new Ks and B-TID. The above description is based on the case where only one BSF is included in the general authentication framework. Multiple BSFs can also be included in the common authentication framework to avoid bottlenecks caused by a BSF overload. In a general authentication framework, that is, in a home network, the existence of multiple BSFs has become a development trend.

 There are multiple BSF processes in a common authentication framework, which is basically the same as that of only one BSF. The following only compares the differences.

 The UE sends a request for authentication to the BSF through the default domain name BSF.MCC.MNC.3GPPnetwork.org. In the actual operation of the network, the domain name is resolved to the actual BSF address by the Domain Name Resolution Server (DNS). In the case of a BSF, after the resolution of the DNS, the UE returns a BSF address, and the UE connects to the BSF according to the address, and performs subsequent operations; in the case of multiple BSFs, the DNS may return multiple BSF addresses. For the UE to randomly select one, the UE associates with the selected BSF, and performs subsequent operations. Alternatively, the DNS selects one of the multiple BSF addresses to be returned to the UE according to the pre-configured policy, and the UE connects to the UE according to the address. A BSF, and follow-up actions.

 Thus, if there are multiple BSFs in a home network, the following situations will exist in the actual application:

 Suppose there are three BSFs in a home network, which are BSF1, BSF2 and BSF3. If the mutual authentication has been performed between the BSF1 and a certain UE, the multiple sets of authentication vectors for the UE are usually obtained in the BSF1, and the multiple groups are respectively assumed to be the authentication vector 1, the authentication vector 2, and the authentication. Vector 3. This is because in order to save interface signaling resources, the HSS usually returns multiple sets of authentication vector information to the BSF for multiple authentication purposes. The authentication vector group 1 is definitely used when the UE authenticates with the BSF1 because the order of use of the authentication vectors is limited, that is, it must be used in the order of the number of the authentication vectors.

When the UE needs to re-authenticate, if for some reason, for example, the UE does not receive the response of the BSF1 within a predetermined period of time after contacting the BSF1, the UE and the BSF2 The interaction is performed to perform mutual authentication, and the BSF2 still obtains multiple sets of authentication vectors for the UE from the HSS, assuming that the multiple groups are the authentication vector 4, the authentication vector 5, and the authentication vector 6, respectively. At this time, the authentication vector 4 is definitely used when the mutual authentication operation is performed. Since the numbering sequence of the applied authentication vector can be monitored in the UE, the UE must detect that the number of the currently applied authentication vector is not continuous with the previous number, which may result in authentication failure. The root cause of the authentication failure is due to the fact that the user information between the BSF1 and the BSF2 for the UE is not synchronized. It can be seen that it is very likely that a normal UE cannot use the service due to authentication due to the network side itself, and this phenomenon is unreasonable.

 In addition, since the format of the B-TID is RAND@BSF_server_domain_name, when the NAF queries the BSF for B-TID information after the authentication is passed, in the case of a BSF, the NAF only needs to go to the BSF in the home network. In the case of multiple BSFs, NAF randomly finds a BSF according to the domain name of the B-TID, and requests B-TID information from the BSF. If the BSF confirms that there is no information queried by the NAF, Then, the BSF that receives the request from the NAF will send a query request to other BSFs in the home network in turn until the information required by the NAF is queried, or until the BSFs in the home network are not found.

 Since multiple BSFs do not have different identifiers, according to the domain name RAND@BSF-servers-domain_name of a certain B-TID, it is not possible to identify which BSF is allocated. As a result, NAF cannot quickly find the correct one. The BSF makes network processing inefficient. Summary of the invention

In view of this, an object of the present invention is to provide a method for synchronizing user information between multiple BSFs, so that user information of a TUE that initiates an authentication request is kept synchronized in different BSFs. Another object of the present invention is to provide a method for implementing an authentication method in the case of multiple BSFs to ensure that normal UEs can pass authentication.

 In order to achieve the above object, the technical solution of the present invention is achieved as follows:

 A method for synchronizing user information between multiple BSFs when the user terminal UE needs to perform mutual authentication with the BSF again. The multiple BSFs belong to the same home network, and the method includes the following steps:

 Al. The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal.

 Bl, the user terminal receives the information indicating that the first BSF cannot process the authentication request or determines that the response information from the first BSF is not received within a predetermined time, reselects a second BSF, and reselects the second BSF. The second BSF sends an authentication request, where the authentication request includes information identifying the first BSF, and the second BSF obtains and saves the user information of the user terminal from the first BSF according to the received authentication request.

 The obtaining, by the second BSF, the user information of the user terminal from the first BSF includes the following steps:

 The second BSF sends a query request for the IMPI of the user terminal to be queried to the first BSF, and the first BSF directly queries the user information of the user terminal according to the pre-stored relationship between the IMPI and the user information, and queries the user information of the user terminal. User information is returned to the second BSF; or,

 The second BSF sends a query request to the first BSF that includes the B-TID corresponding to the user terminal to be queried, and the first BSF first queries the IMPI of the user terminal according to the pre-stored correspondence between the B-TID and the IMPI, and then saves according to the pre-preservation. Corresponding relationship between the IMPI and the user information, querying the user information of the user terminal, and returning the queried user information to the second BSF.

A method for realizing multiple BSFs when a user terminal UE needs to perform mutual authentication with a BSF The method for synchronizing the user information, the multiple BSFs belong to the same home network, and the method includes the following steps:

 A2. The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal. After the first BSF determines that the request cannot be processed by the user, the first BSF sends the request to the second B SF in the home network. The proxy authentication request message of the user information of the user terminal, and then performing step b2;

 B2. The second BSF obtains and saves the user information of the UE from the proxy authentication request message. The method further includes: separately setting an identifier for multiple BSFs in the same home network; the identifier is a sequence number, or a number determined by a numbering rule of the home network, or a name recognizable by the home network.

 The user information is an authentication vector, a B-TID, information related to the B-TID, and description information of the user, or the user information is a B-TID, a B-TID-related information, and a description of the user. information.

 If the user information stored in the first BSF includes the authentication vector, after the second BSF obtains the user information from the first BSF, the method further includes: deleting, by the first BSF, the authentication vector in the user information saved by the first BSF. .

 A method for implementing an authentication method when a user terminal needs to perform mutual authentication with a BSF in the case of multiple BSFs, where the multiple BSFs belong to the same home network, and the method includes the following steps:

 Al, the user terminal sends a right request to the first BSF that has performed the mutual authentication operation with the user terminal;

B1. After receiving the information indicating that the first BSF cannot process the authentication request or determining that the response information from the first BSF is not received within a predetermined time, the user terminal reselects a second BSF and sends the second BSF to the second BSF. Sending an authentication request including identifying the first BSF information, and the second BSF obtains and saves the user end from the first BSF according to the received authentication request. End user information;

 Cl, the second BSF > obtains the authentication vector of the mutual authentication right according to the user information of the user terminal acquired from the first BSF, and performs mutual authentication operation with the user terminal.

 A method for implementing an authentication method when a user terminal needs to perform mutual authentication with a BSF in the case of multiple BSFs, where the multiple BSFs belong to the same home network, and the method includes the following steps:

 A2: The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal, and the first BSF determines that the user cannot process the request, and provides the user to the second BSF in the home network. User information of the terminal, and notifying the user terminal to perform mutual authentication in the second BSF;

 B2. The user terminal sends an authentication request to the second BSF according to the received notification. C2. The second BSF obtains the authentication vector of the mutual authentication right according to the user information of the user terminal provided by the first BSF, and the user The terminal performs mutual authentication operations.

 The obtaining, by the second BSF, the authentication vector of the current mutual authentication includes the following steps: the second BSF determines whether there is an unused authentication vector in the user information of the locally saved user terminal, and if yes, The unused authentication vector is used as the authentication vector of the mutual mutual right; otherwise, the second BSF obtains the authentication vector of the user terminal from the HSS, and uses the obtained authentication vector as the authentication of the mutual authentication right. Vector.

 The method further includes: setting an identifier for each of the multiple BSFs in the same home network in advance, and after the authentication succeeds, the domain name of the B-TID allocated by the BSF for the user terminal includes its own identification information; The identifiers set by the multiple BSFs in the network are sequential numbers, or numbers determined by the numbering rules of the home network, or names that the home network can recognize.

The method further includes: when the NAF in the network queries the BSF for the B-TID information of the user terminal, the method further includes: according to the identifier of the BSF in the B-TID domain name, the NAF directly points to The BSF with the B-TID sends a request to query the B-TID.

 The step of the first BSF providing the user information of the user terminal to the second BSF in step A2 includes the following steps:

?? 21, the first 38 to the second proxy 88 transmits a request message including the user authentication information to the user terminal; _F

 A22 After the second BSF confirms that it can process the authentication request, it acquires and saves the user information of the user terminal in the end of the proxy authentication request, and returns a successful response to the first BSF.

 The step of informing the user terminal to perform mutual authentication in the second BSF according to step A2 includes the following steps:

 The first BSF receives a notification to the user terminal that the second BSF that can identify the second BSF information is authenticated for authentication. '

 The user information is an authentication vector, a B-TID, information related to the B-TID, and description information of the user, or the user information is a B-TID, a B-TID-related information, and a description of the user. information.

Applying the method for synchronizing user information between multiple BSFs provided by the present invention, even if the user terminal re-authenticates, the second BSF with different last authentication is used, and the second BSF can be executed from the user terminal. The user information of the user terminal is obtained in the first BSF of the mutual authentication operation, so that the user information of the UE that initiates the authentication request is kept synchronized in different BSFs. The present invention also provides a method for implementing an authentication method in the case of multiple BSFs. On the basis of user information synchronization, it is ensured that normal UEs can pass authentication. In addition, the present invention also provides an identifier for each of the multiple BSFs, and the domain name of the B-TID reflects the identity of the BSF, so that it can indicate which BSF is allocated by the B-TID, which facilitates the NAF search, thereby reducing The traffic between the BSFs speeds up the processing and saves network resources. BRIEF DESCRIPTION OF THE DRAWINGS

 Figure 1 shows the structure of the general authentication framework;

 2 is a schematic flow chart showing Embodiment 1 of the present invention;

 FIG. 3 is a schematic flow chart of a second embodiment to which the present invention is applied. Mode for carrying out the invention

 The invention will be further described in detail below with reference to the drawings and specific embodiments.

 The idea of the present invention is: when the second BSF of the different last authentication is used when the user terminal re-authenticates, the second BSF can acquire the user from the first BSF that has performed the mutual authentication operation with the user terminal. User information of the terminal, thereby ensuring that the user information of the UE that initiated the authentication request is kept synchronized in different BSFs. In addition, on the basis of user information synchronization, the present invention also provides a method for implementing an authentication method in the case of multiple BSFs, which ensures that normal UEs can pass authentication. Further, the present invention further sets an identifier for a plurality of BSFs, and the domain name of the B-TID reflects the BSF identifier, so that it can indicate which BSF is allocated by the B-TID, which facilitates NAF search and improves network processing. effectiveness.

 If the UE finds that the key applied by itself is about to expire, or receives the information from the NAF that requires re-authentication, it performs the authentication operation again, that is, the condition for triggering the re-authentication is the same as the prior art. No longer detailed.

 FIG. 2 is a schematic flow chart showing the first embodiment of the present invention. In this embodiment, multiple BSFs exist in the same home network, and the UE has successfully performed the mutual authentication operation with a certain BSF. The following is convenient for description, and the mutual authentication operation has been performed with a certain user terminal. The original BSF is referred to as a first BSF, denoted as BSFo, and a new BSF that is different from the first BSF and has not performed a mutual authentication operation with the user terminal is referred to as a second BSF, and is referred to as BSFn.

Step 201: When the UE performs the mutual authentication operation again, it first sends an authentication request to the BSFo. Since the UE stores the information of the BSF that has performed the mutual authentication operation, the UE can It is enough to find the BSFo that successfully performed the mutual authentication operation last time. In this embodiment, since the BSFo determines that it cannot process the current request according to its current state, according to the previous configuration, no response is returned to the UE.

 If the UE receives the success response information from the BSFo, the process continues with the subsequent process, and the process ends. If the UE does not receive the response from the BSFo, step 202 is performed.

 Step 202: The UE selects a new BSF, that is, a BSF, that is different from the first BSF and does not perform a mutual authentication operation with the user terminal, and sends an authentication request to the BSF, where the authentication request includes the identifier that can be identified and executed by itself. BSFo information for mutual authentication operations.

 The method for the UE to select the BSFn is: the UE reselects an IP address from the IP addresses of the multiple BSFs that have been saved by the UE, and the BSF corresponding to the IP address is the BSFn; or the UE provides the default domain name of the BSF by the DNS. Returning the address of the BSF, the UE randomly selects a BSF address or uses the BSF corresponding to the address returned by the DNS to be BSFn.

 In this embodiment, if the identifiers are respectively set for multiple BSFs in the same home network, the information included in the authentication request that can identify the BSFo that has performed the mutual authentication operation with itself is the IP address of the BSFo. Or the identity of the BSFo that has been set.

 The identifier of the BSF that has been set may be the serial number of the bill, such as 1, 2, 3, etc., or may be a number determined by the numbering rule of the home network, or may be a name that the home network can recognize.

Step 203: After receiving the authentication request of the IP address or the identifier of the BSFo from the UE, the BSFn sends the BSFo the user information of the UE that sends the authentication request, if the received authentication request includes the user identity identifier ( IMPI), the query request message also includes IMPI. If the received authentication request includes a B-TID, the query request message also includes B-TIDo. If there is an unused weighting vector for the UE in the BSFo, the user information includes an authentication vector, and a B-TID, information related to the B-TID and user description information; if there is no target for the UE in the BSFo The authentication vector used, the user information includes a B-TID, information related to the B-TID, and user description information.

 Step 204: After receiving the query request from the BSFn, if the BSFo determines that the query request includes the IMPI, the BSFo directly queries the user information of the UE according to the pre-stored relationship between the IMPI and the user information, and if the query is determined, If the B-TID is included in the request, the IMPI of the UE is first queried according to the pre-stored correspondence between the B-TID and the IMPI, and the user information of the UE is queried according to the correspondence between the pre-stored IMPI and the user information. BSFo sends the obtained user information to BSFn.

 If the user information includes an authentication vector, the BSFo immediately returns the user-saved authentication vector for the UE after the BSFn returns the user information, and other user information, such as the B-TID and the information related to the B-TID, It can be temporarily deleted, to facilitate the B-TID that the NAF query is still valid. When the validity period of the B-TID expires, the BSFo deletes the B-TID and related information for the UE. After all B-TIDs saved by the BSF for one IMPI, that is, one UE, are deleted, the BSFo deletes the IMPI and user description information of the UE, and does not completely save any description information of the UE.

 Step 205: After receiving the user information returned by the BSFo and saving, the BSFn determines whether there is an unused authentication vector in the user information. If yes, step 207 is performed; otherwise, step 206 is performed.

 Step 206: The BSFn requests the HSS for the authentication vector and the user description information of the UE. The user description information is requested to update the description information that may be transformed at the same time.

 Step 207: The BSFn performs a mutual authentication operation with the UE. After the authentication succeeds, the BSFn assigns the i3-TID to the UE.

At this point, since the BSFn can obtain the user information of the UE from the BSFo, the implementation is implemented. The user information of the UE requesting the authentication is synchronized in different BSFs, and the situation that normal users cannot pass the authentication is avoided.

 FIG. 3 is a schematic flow chart of a second embodiment to which the present invention is applied. In this embodiment, multiple BSFs exist in the same home network, and the UE has successfully performed the mutual authentication operation with a certain BSF. The following is convenient for description, and the mutual authentication operation has been performed with a certain user terminal. The original BSF is referred to as a first BSF, denoted as BSFo, and a new BSF that is different from the first BSF and has not performed a mutual authentication operation with the user terminal is referred to as a second BSF, and is referred to as BSFn.

 Step 301: When the UE performs the mutual authentication operation again, it first sends an authentication request to the BSFo. Since the UE stores the information of the BSF that has performed the mutual authentication operation, the UE can find the BSFo that successfully performed the mutual authentication operation last time.

 Step 302: After receiving the authentication request from the UE, the BSFo determines that the authentication request cannot be processed by itself, for example, if the load is too heavy, for example, the BSFo is configured to notify the BSFn to authenticate the UE according to the pre-configuration. That is, a request message for proxy authentication is sent to the BSFn, and the request message includes user information of the UE.

 If there is an unused authentication vector for the UE in the BSFo, the user information includes an authentication vector, B-TID, information related to the B-TID, and user description information; if there is no unused for the UE in the BSFo The authentication vector, the user information includes a B-TID, information related to the B-TID, and user description information.

 Step 303: After receiving the request message from the BSFo, the BSFn confirms that it can perform the operation, saves the end message information of the request message, and then returns a successful response message to the BSFo.

Step 304: After receiving the success response message from the BSFn, the BSFo determines whether the user information sent to the BSFn includes an authentication vector, and if so, immediately deletes the authentication vector saved for the UE, and other users Information such as B-TID and B-TID related information can be temporarily deleted, so that the NAF query is still valid B-TID, when After the expiration of the validity period of the B-TID, the BSFo deletes the B-TID and related information for the UE. After all the B-TIDs saved by the BSF for one IMPI, that is, one UE, are deleted, the BSFo deletes the IMPI and the user description information of the UE, and does not completely save any description information of the UE.

 Afterwards, the BSFo notifies the UE to perform a mutual authentication operation to the BSFn, and the notification message includes the IP address of the BSFn. In this embodiment, if the identifiers are respectively set for multiple BSFs in the same home network, the notification may include the IP address of the BSFo or the identifier of the BSFo that has been set. The method for specifically setting the identifier of the BSF is the same as the method in the previous embodiment, and the description thereof will not be repeated here.

 Step 305: The UE sends an authentication request to the BSFn, where the authentication request is the same as the information included in the existing authentication request, and no information needs to be added.

 Step 306: After receiving the authentication request from the UE, the BSFn determines whether there is an unused authentication vector stored in the user information of the UE locally. If yes, step 307 is performed. Otherwise, step 308 is performed.

 Step 307: The BSFn requests the HSS for the authentication vector and the user description information of the UE. The user description information is requested to update the description information that may be transformed at the same time.

 Step 308: The BSFn performs a mutual authentication operation with the UE. After the authentication succeeds, the BSFn allocates a B-TID to the UE.

 So far, since the BSFn can obtain the user information of the UE from the BSFo, the user information of the UE that initiates the authentication request is synchronized in different BSFs, and the normal user cannot be authenticated.

For the above two embodiments, if the identifier of the BSF is set in advance, the BSF identifier can be reflected in the domain name of the B-TID, so that it can clearly indicate which BSF is allocated by the B-TID, which facilitates the NAF search. For example, suppose the identity of the BSFn to which the UE is connected is 11, and the B-TID assigned by the BSFn to the UE is expressed as RAND@11.BSF_servers_domain_name _{0 In} this way, when the NAF locates the BSF through the domain name of the B-TID, it is easy to find the BSF that stores the required information, and the BSF in the network is no longer required to search in turn, thereby improving the network processing efficiency.

 The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalents, and improvements made within the spirit and scope of the present invention should be included in the present invention. Within the scope of protection.

Claims

Claim  A method for synchronizing user information between a plurality of BSFs when a user terminal UE needs to perform mutual authentication with a BSF, wherein the plurality of BSFs belong to the same home network, and the method includes the following steps:  Al. The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal.  Bl, the user terminal receives the information indicating that the first 'BSF cannot process the authentication request or determines that the response information from the first BSF is not received within a predetermined time, reselects a second BSF, and reselects the second BSF. The second BSF sends an authentication request, where the authentication request includes information identifying the first BSF, and the second BSF obtains and saves the user information of the user terminal from the first BSF according to the received authentication request.  The method according to claim 1, wherein the obtaining, by the second BSF, the user information of the user terminal from the first BSF comprises the following steps:  The second BSF sends a query request for the IMPI of the user terminal to be queried to the first BSF, and the first BSF directly queries the user information of the user terminal according to the pre-stored relationship between the IMPI and the user information, and queries the user information of the user terminal. User information is returned to the second BSF; or,  The second BSF sends a query request to the first BSF that includes the B-TID corresponding to the user terminal to be queried, and the first BSF first queries the IMPI of the user terminal according to the pre-stored correspondence between the B-TID and the IMPI, and then saves according to the pre-preservation. Corresponding relationship between the IMPI and the user information, querying the user information of the user terminal, and returning the queried user information to the second BSF. 3. A method for synchronizing user information between multiple BSFs when a user terminal UE needs to perform mutual authentication with a BSF, where the multiple BSFs belong to the same home network, and are characterized in that The method includes the following steps:  A2. The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal. After the first BSF determines that the request cannot be processed by the user, the first BSF sends the request to the second BSF in the home network. a proxy authentication request message of the user information of the user terminal, and then performing step b2;  B2. The second BSF obtains and saves the user information of the UE from the proxy authentication request message. The method according to claim 1 or 3, wherein the method further comprises: separately setting an identifier for a plurality of BSFs in the same home network; the identifier is a sequence number, or is a number of the home network. The number determined by the rule, or the name that the home network can recognize.  The method according to claim 1 or 3, wherein the user information is an authentication vector, a B-TID, information related to the B-TID, and description information of the user, or the user information is B-TID, information related to B-TID and description information of the user.  The method according to claim 5, wherein, if the user information stored in the first BSF includes the authentication vector, after the second BSF obtains the user information from the first BSF, the method further includes: The BSF deletes the authentication vector in the user information saved by itself.  A method for implementing an authentication method when a user terminal needs to perform mutual authentication with a BSF in the case of multiple BSFs, where the multiple BSFs belong to the same home network, and the method includes the following steps:  Al. The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal. B1. After receiving the information indicating that the first BSF cannot process the authentication request or determining that the response information from the first BSF is not received within a predetermined time, the user terminal reselects a second BSF and sends the second BSF to the second BSF. Sending an authentication request including identifying the first BSF information, The second BSF obtains and saves user information of the user terminal from the first BSF according to the received authentication request;  The second BSF obtains the authentication vector of the mutual authentication right according to the user information of the user terminal acquired from the first BSF, and performs a mutual authentication operation with the user terminal.  A method for implementing an authentication method when a user terminal needs to perform mutual authentication with a BSF in the case of multiple BSFs, where the multiple BSFs belong to the same home network, and the method includes the following steps:  A2: The user terminal sends an authentication request to the first BSF that has performed the mutual authentication operation with the user terminal, and the first BSF determines that the user cannot process the request, and provides the user to the second BSF in the home network. User information of the terminal, and notifying the user terminal to perform mutual authentication in the second BSF;  B2. The user terminal sends an authentication request to the second BSF according to the received notification. C2. The second BSF obtains the authentication vector of the mutual authentication right according to the user information of the user terminal provided by the first BSF, and the user The terminal performs mutual authentication operations.  The method according to claim 7 or 8, wherein the obtaining, by the second BSF, the authentication vector of the mutual authentication includes the following steps:  The second BSF determines whether there is an unused authentication vector in the user information of the locally saved user terminal, and if so, uses the unused authentication vector as the authentication vector of the current mutual authentication; otherwise, the second The BSF obtains the authentication vector of the user terminal from the HSS, and uses the obtained authentication vector as the authentication vector of the current mutual authentication. The method according to claim 7 or 8, wherein the method further comprises: separately setting an identifier for a plurality of BSFs in the same home network, and after the authentication succeeds, the BSF assigns a B-TID to the user terminal. The domain name includes its own identification information; the identifiers respectively set in advance for the plurality of B SFs in the same home network are sequential numbers, or numbers determined by the numbering rules of the home network, or names identifiable by the home network. The method according to claim 10, wherein when the NAF in the network queries the BSF for B-TID information of a user terminal, the method further includes: according to the identifier of the BSF in the B-TID domain name, NAF A request to query the B-TID is sent directly to the BSF that allocates the B-TID.  The method according to claim 8, wherein the step S2, the first BSF providing the user information of the user terminal to the second BSF comprises the following steps:  A21. The first BSF sends, to the second BSF, a request message for proxy authentication including user information of the user terminal.  A22. After confirming that the second BSF can process the authentication request, obtain and save the user information of the user terminal in the end of the proxy authentication request, and return a successful response to the first BSF.  The method according to claim 12, wherein the step of informing the user terminal to perform mutual authentication in the second BSF includes the following steps:  The first BSF receives a notification to the user terminal to include authentication to the second BSF that can identify the second BSF information.  The method according to claim 7 or 8, wherein the user information is an authentication vector, a B-TID, information related to the B-TID, and description information of the user, or the user information is B-TID, information related to B-TID and description information of the user.