WO2010127539A1 - Method and system for authenticating accessing to stream media service - Google Patents

Abstract

The embodiment of the present invention discloses a method and a system for authenticating accessing to stream media service, wherein an access point(AP) of the stream media service platform puts the mobile terminal certificate which is included in the access authentication request group into the certificate authentication request group, sends to an authentication server of the stream media service platform to make certificate authentication; when the result of the certificate authentication is that the mobile terminal certificate is a legal certificate, the AP generates a random number N₂ and sends it to the mobile terminal; the mobile terminal encrypts the random number N₂ by the private key of the mobile terminal certificate in order to generate the signature value of the mobile terminal and sends the signature value to the AP; the AP decrypts the signature value by the public key of the mobile terminal certificate; when the result of the decryption is equal to the random number N₂, the mobile terminal is permitted to access to the stream media service platform through the AP. Using the method and the system of the present invention, it is ensured that the legal mobile terminal can safely access to the stream media service platform.

Description

 Access authentication method and system for streaming media service

 The present invention relates to the field of mobile communications, and in particular, to a method and system for access authentication of a streaming media service. Background technique

 With the maturity of 3G networks and the improvement of the performance of mobile terminals, operators and users hope that mobile terminals can not only support traditional voice calling functions, but also provide more business functions, entertainment functions and industrial applications. As a typical 3G application, mobile phone streaming media services can complete industrial applications and business functions including real-time information broadcast, technical lectures, education and training, and become a hot spot in the industry.

 By deploying the streaming media service platform in the WLAN, the user can access the streaming media service platform through the streaming media live client on the mobile terminal to obtain streaming media data and use the streaming media service.

 In order to ensure the legitimacy and security of the access, the first step of the mobile terminal accessing the streaming media service platform is to authenticate and authenticate the mobile terminal, and the existing streaming media service platform accesses the mobile terminal through the wireless local area network. The security of authentication and authentication is poor, and it is impossible to effectively prevent illegal terminals from accessing the streaming media service platform through the wireless local area network. Summary of the invention

 The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art, and provide a streaming media service access authentication method and system that can improve access security, so that a legitimate mobile terminal can securely access the media through a wireless local area network. Service Platform.

In order to solve the above technical problem, the present invention provides an access authentication party for a streaming media service. Method, the method includes:

 After receiving the access authentication request packet sent by the mobile terminal, the authentication server of the access service platform of the streaming media service platform performs certificate verification;

When the certificate verification result is that the mobile terminal certificate is a legal certificate, the AP generates a random number N ₂ and sends the generated random number N ₂ to the mobile terminal;

The mobile terminal encrypts the random number N ₂ using the private key of the mobile terminal certificate, generates a signature value of the mobile terminal, and sends the signature value of the mobile terminal to the AP;

The AP decrypts the signature value of the mobile terminal by using the public key of the mobile terminal certificate. When the decrypted result is equal to the random number N ₂ , the mobile terminal is allowed to access the streaming media service platform through the AP.

 In addition, the certificate authentication request packet further includes an AP certificate; the method further includes:

 The authentication server verifies the AP certificate, and sends the certificate verification result and the signature of the authentication server to the mobile terminal through the AP;

 The mobile terminal determines whether the AP certificate is a legal certificate according to the received certificate verification result and the signature of the authentication server. When the AP certificate is a legal certificate, the mobile terminal accesses the streaming media service platform through the AP certificate.

In addition, the accessing the streaming media service platform by using the AP certificate further includes: after determining that the AP certificate is a legal certificate, the mobile terminal generates a random number N _l and sends the generated random number Ni to the AP;

 The AP encrypts the random number by using the private key of the AP certificate, generates a signature value of the AP, and sends the signature value to the mobile terminal.

 The mobile terminal decrypts the signature value of the AP by using the public key of the AP certificate, and accesses the streaming media service platform through the AP certificate when the decrypted result is equal to the random number Ni.

In addition, the access authentication request packet further includes a current system time; , further comprising:

 Determining, by the AP, whether the access request packet is a repeatedly transmitted packet according to the current system time included in the access authentication request packet; and sending, when the access authentication request packet is not a repeatedly sent packet, to the authentication server The certificate authentication request packet.

 In addition, the certificate authentication request packet further includes a current system time. The authentication server performs the certificate verification after receiving the certificate authentication request packet, and further includes: whether the certificate authentication request packet is a repeatedly sent packet. The certificate verification operation is performed when the certificate authentication request packet is not a packet that is repeatedly transmitted.

 The present invention also provides an access authentication system for a streaming media service, the system comprising: a mobile terminal and a streaming media service platform; the streaming media service platform includes: an AP and an authentication server; wherein the authentication server is configured to After receiving the certificate authentication request packet sent by the AP, verifying the certificate included in the packet, and transmitting the certificate verification result to the AP;

 The AP, after receiving the access authentication request packet sent by the mobile terminal,

Generating a random number N ₂ and generating a random number N ₂ that is sent to the mobile terminal; the value is decrypted, and when the result of the decryption is equal to the random number N ₂ , allowing the mobile terminal to access the AP through the AP Streaming media service platform;

The mobile terminal is configured to encrypt the random number N ₂ by using a private key of the mobile terminal certificate, generate a signature value of the mobile terminal, and send the signature value of the mobile terminal to the AP.

 In addition, the certificate authentication request packet further includes an AP certificate;

The authentication server is further configured to verify the AP certificate and verify the certificate The mobile terminal is further configured to determine, according to the received certificate verification result and the signature of the authentication server, whether the UI certificate is a legal certificate, and when the UI certificate is a legal certificate, access the streaming media by using the UI Service Platform.

In addition, the mobile terminal is further configured to generate a random number N _l and send the generated random number Ni to the AP;

 The AP is further configured to encrypt the random number N! by using a private key of the AP certificate, generate a signature value of the AP, and send the signature value to the mobile terminal;

 The mobile terminal is further configured to decrypt the signature value of the AP by using a public key of the AP certificate, and access the streaming media service platform by using the AP when the decrypted result is equal to the random number.

 In addition, the access authentication request packet further includes a current system time;

 The AP is further configured to determine, according to the current system time included in the access authentication request packet, whether the access request packet is a repeatedly sent packet, where the access authentication request packet is not a repeatedly sent packet, Sending the certificate authentication request packet to the authentication server.

 In addition, the certificate authentication request packet further includes a current system time; a pre-system time, determining whether the certificate authentication request packet is a repeatedly transmitted packet, and when the certificate authentication request packet is not a repeatedly transmitted packet, performing the certificate Verify the operation.

In summary, with the method and system of the present invention, only a mobile terminal holding a legal certificate can access the streaming media service platform, thereby preventing the illegal mobile terminal from accessing the streaming media service platform to damage the security of the system and occupy network resources. It effectively protects the security and quality of service of streaming media services by legitimate mobile terminals and protects the interests of streaming service providers. In addition, the method and system of the present invention can also prevent the mobile terminal from accessing the illegal AP and causing information leakage. DRAWINGS

 1 is a flowchart of a method for accessing a streaming media service according to an embodiment of the present invention;

 2 is a schematic structural diagram of an access authentication system for a streaming media service according to an embodiment of the present invention. DETAILED DESCRIPTION The Wireless Local Area Network Authentication and Privacy Infrastructure (WAPI) is a security issue for the WEP (Wried Equivalent Privacy) protocol in IEEE802.il, which is repeatedly demonstrated by multiple parties. Consider the various application modes, the wireless local area network (WLAN) security solution proposed in the Chinese wireless local area network standard GB15629.il. The present invention applies the WAPI technical idea to the access authentication of the streaming media service to solve the defect of poor access security of the existing streaming media service platform.

 The invention will now be described in detail in conjunction with the drawings and embodiments.

 FIG. 1 is a flowchart of a method for accessing a streaming media service according to an embodiment of the present invention. As shown in Figure 1, the method includes the following steps:

 Step 101: The mobile terminal starts a streaming media service, and sends an access authentication request packet to an access point (AP, Access Point) of the streaming media service platform.

 The access authentication request packet includes a mobile terminal certificate; in addition, the packet may further include a current system time of the mobile terminal.

 The mobile terminal certificate is issued by an authentication server (AS) of the streaming media service platform, and may be an X.509 v3 certificate or a national standard substance (GBW) certificate; the mobile terminal certificate includes a public key of the mobile terminal and identity information of the mobile terminal, The public key of the mobile terminal is the public key of the mobile terminal certificate.

 The purpose of including the current system time in the access authentication request packet is to prevent the illegal terminal from using the access authentication request packet previously sent by the legal terminal to initiate a replay attack to the AP.

Step 102: After receiving the foregoing access authentication request packet, the AP according to the packet includes The pre-system time determines whether the access authentication request packet is a repeatedly transmitted packet, and if it is not a repeatedly transmitted packet, saves the mobile terminal certificate included in the packet, and sends a certificate authentication request packet to the AS; if it is a repeatedly transmitted packet , the access authentication request packet is discarded, and the process ends. The repeatedly sent packet is: the access authentication request packet is a packet previously intercepted by the illegal terminal.

 The foregoing certificate authentication request packet includes: a mobile terminal certificate, an AP certificate, and an AP signature; in addition, the packet may further include an AP current system time.

 The AP certificate is issued by the AS and can be an X.509 v3 certificate or a GBW certificate. The AP certificate contains the public key of the AP and the identity information of the AP. The public key of the AP is: the public key of the AP certificate.

 The purpose of including the system time in the certificate authentication request packet is to prevent the illegal AP from using the certificate authentication request packet previously sent by the legal AP to initiate a replay attack to the AS. The illegal AP is: or an illegal terminal.

 Step 103: After receiving the certificate authentication request packet, the AS determines, according to the current system time included in the packet, whether the certificate authentication request packet is a repeatedly transmitted packet, and if it is not a repeatedly transmitted packet, the mobile terminal included in the packet The certificate, the AP certificate, and the signature of the AP are verified. If the received certificate authentication request packet is a repeatedly transmitted packet, the certificate authentication request packet is discarded, and the process ends. The packet that is repeatedly sent is: the certificate authentication request packet is a packet that is previously intercepted by the illegal AP/illegal terminal.

 In this step, the AS can use the public key of the AP certificate to authenticate the signature of the AP. The authentication operation of the AS for the mobile terminal certificate and the AP certificate includes: verifying whether the certificate has been revoked, verifying whether the certificate has expired, etc., and the specific verification method See document RFC3280.

Step 104: If the AS verifies the mobile terminal certificate, the AP certificate, and the signature of the AP as follows: The mobile terminal certificate and the AP certificate are valid certificates, and the signature of the AP is correct, the AS sends the certificate verification result and the AS to the AP. Signature certificate authentication response packet, above The certificate verification result includes: the mobile terminal certificate is a legal certificate and the AP certificate is a legal certificate; otherwise, the AS discards the certificate authentication request packet, and the process ends.

 Step 105: After receiving the certificate authentication response packet, the AP verifies that the signature of the AS is correct. If the signature of the AS is incorrect, the response packet is discarded, and the process ends. If the signature of the AS is legal, if the mobile terminal certificate is legal, Then, the AP certificate, the certificate authentication result, and the signature of the AS are included in the access authentication response packet and sent to the mobile terminal. If the certificate of the mobile terminal is invalid, the AP discards the certificate authentication response packet, and the process ends.

 Step 106: After receiving the access authentication response packet, the mobile terminal determines, according to the signature of the AS and the certificate verification result included in the response packet, whether the AP certificate is a valid certificate, and if yes, performing the subsequent steps; if the AP certificate is not legal Certificate, then the process ends.

 At this point, the mobile terminal and the AP complete the verification of the mutual certificate by interacting with the AS. In the subsequent steps, the mobile terminal and the AP can further verify whether the other party is a legitimate owner of the certificate.

Step 107: the mobile terminal transmits to the AP private key verification request packet, the packet contains a random number generated by the mobile terminal requests the AP to N _l ^ signed random number, to verify whether it has a private key AP AP certificate, the AP verification i.e. Whether it is the legal owner of the AP certificate. The signing is performed by: using a private key of the AP certificate to encrypt the random number to generate a ciphertext.

Step 108: After receiving the private key verification request packet, the AP encrypts the random number Ni included in the request packet by using the private key of the AP certificate to generate a ciphertext, and sends a private key verification response packet to the mobile terminal, where the response packet is in the response packet. The signature value corresponding to the random number ^ and the random number N ₂ generated by the AP are included. The ciphertext generated by the encryption is: a signature value corresponding to the random number ^.

Step 109: After receiving the private key verification response packet sent by the AP, the mobile terminal decrypts the signature value included in the response packet by using the public key of the AP certificate, and determines whether the decrypted result is equal to the random number ^: if they are equal, Then, the AP has the private key of the AP certificate, that is, the AP is on the AP. The legal owner of the AP certificate; if not equal, it is determined that the AP does not own the private key of the AP certificate, that is, the AP is not the legal owner of the AP certificate.

Step 110: The mobile terminal encrypts the random number N ₂ using the private key of the mobile terminal certificate to generate a ciphertext, and sends a private key verification acknowledgement packet to the AP, where the packet includes a signature value corresponding to the random number N ₂ . The ciphertext generated by the encryption is: a signature value corresponding to the random number N ₂ .

Step 111: After receiving the private key verification confirmation packet, the AP decrypts the signature value included in the packet by using the public key of the mobile terminal certificate, and determines whether the decrypted result is equal to the random number N ₂ : if equal, the mobile is determined to be The terminal owns the private key of the mobile terminal certificate, that is, the mobile terminal is the legal owner of the mobile terminal certificate; if not, it determines that the mobile terminal does not own the private key of the mobile terminal certificate, that is, the mobile terminal is not the legal owner of the mobile terminal certificate. .

 Step 112: If the mobile terminal determines that the AP is the legal owner of the AP certificate, and the AP determines that the mobile terminal is the legal owner of the mobile terminal certificate, the mobile terminal accesses the streaming media service platform through the AP to perform signaling of the streaming media service. And the transmission of data; otherwise, the access fails.

 In the above embodiment, the mobile terminal and the AP in the streaming media service platform perform two-way access authentication, that is, the mobile terminal verifies the validity of the AP certificate through the AS, and uses the public key of the AP certificate to verify whether the AP is a certificate. The legal owner; at the same time, the AP verifies the mobile legal owner through the AS.

 In actual use, only one-way access authentication may be performed, that is, only the AP verifies the validity of the mobile terminal certificate, and verifies whether the mobile terminal is the legal owner of the certificate. In this case, the certificate verification result and the signature of the AS may not be included in step 105, and step 106 may be omitted; in addition, the mobile terminal does not need to send the random number to the AP.

 2 is a schematic structural diagram of an access authentication system for a streaming media service according to an embodiment of the present invention; and the following will be described in conjunction with FIG. 2.

As shown in FIG. 2, the access authentication system of the streaming media service of the present invention includes: a mobile terminal and Streaming media service platform; Streaming media service platform includes: AP and AS;

 After receiving the certificate authentication request packet sent by the AP, the AS verifies the certificate included in the packet, and sends the certificate verification result to the AP.

After receiving the access authentication request packet sent by the mobile terminal, the AP is configured to use the mobile terminal certificate as a legal certificate, and then generate a random number N ₂ and send it to the mobile terminal.

The mobile terminal is configured to encrypt the random number N ₂ using the private key of the mobile terminal certificate, generate a signature value of the mobile terminal, and send the signature value to the AP.

The AP is further configured to decrypt the signature value of the mobile terminal by using the public key of the mobile terminal certificate, and if the decrypted result is equal to the random number N ₂ , the mobile terminal is allowed to access the streaming media service through the AP, and the certificate authentication request packet is further The AS can also include an AP certificate; correspondingly, the AS is also used to activate the terminal; correspondingly, the mobile terminal is further configured to determine, according to the received certificate verification result and the signature of the AS, whether the AP certificate is a legal certificate, and when the AP certificate is a legal certificate, Access the streaming media service platform through the AP.

In addition, the mobile terminal is further configured to generate a random number N _l and send it to the AP; correspondingly, the AP is further configured to encrypt the random number by using the private key of the AP certificate, generate a signature value of the AP, and send the signature value. Correspondingly, the mobile terminal is further configured to decrypt the signature value of the AP by using the public key of the AP certificate, and access the streaming service platform through the AP when the decrypted result is equal to the random number Ni.

 The detailed functions of the network elements in the access authentication system of the streaming media service of the present invention and the connection relationship between the network elements, that is, the message interaction relationship are described in detail in the above description of the method of the present invention.

Claims

Claim A method for access authentication of a streaming media service, the method comprising: after receiving an access authentication request packet sent by a mobile terminal, the authentication server of the access service platform of the streaming media service platform performs certificate verification ; When the verification result is that the mobile terminal certificate is a legal certificate, the AP generates a random number N ₂ and sends the generated random number N ₂ to the mobile terminal; The mobile terminal encrypts the random number N ₂ using the private key of the mobile terminal certificate, generates a signature value of the mobile terminal, and sends the signature value of the mobile terminal to the AP; The AP decrypts the signature value of the mobile terminal by using the public key of the mobile terminal certificate. When the decryption result is equal to the random number N ₂ , the mobile terminal is allowed to access the streaming media service platform through the AP.  The method according to claim 1, wherein the certificate authentication request packet further includes an AP certificate; the method further includes:  The authentication server verifies the AP certificate, and sends the certificate verification result and the signature of the authentication server to the mobile terminal through the AP;  The mobile terminal determines whether the AP certificate is a legal certificate according to the received certificate verification result and the signature of the authentication server. When the AP certificate is a legal certificate, the mobile terminal accesses the streaming media service platform through the AP certificate.  The method according to claim 2, wherein the accessing the streaming media service platform by using the AP certificate further includes: After determining that the AP certificate is a legal certificate, the mobile terminal generates a random number N _l and sends the generated random number to the AP; The AP encrypts the random number by using the private key of the AP certificate, generates a signature value of the AP, and sends the signature value to the mobile terminal. The mobile terminal decrypts the signature value of the AP by using the public key of the AP certificate, and accesses the streaming media service platform through the AP certificate when the decrypted result is equal to the random number Ni.  The method according to any one of claims 1 to 3, wherein the access authentication request packet further includes a current system time; and the AP receives the access authentication request score Determining, by the AP, whether the access request packet is a repeatedly transmitted packet according to the current system time included in the access authentication request packet; and sending, when the access authentication request packet is not a repeatedly sent packet, to the authentication server The certificate authentication request packet.  The method according to any one of claims 1 to 3, wherein the certificate authentication request packet further includes a current system time; and the authentication server performs the certificate after receiving the certificate authentication request packet. The verification further includes: whether the certificate authentication request packet is a repeatedly transmitted packet, and when the certificate authentication request packet is not a repeatedly transmitted packet, performing the certificate verification operation.  An access authentication system for a streaming media service, the system comprising: a mobile terminal and a streaming media service platform; the streaming media service platform comprises: an AP and an authentication server; wherein  The authentication server is configured to: after receiving the certificate authentication request packet sent by the AP, verify the certificate included in the packet, and send the certificate verification result to the AP; The AP is configured to: after receiving the access authentication request packet sent by the mobile terminal, include the mobile terminal certificate included in the packet in a certificate authentication request packet, and send the certificate to the authentication server for certificate verification and verification. The result is that when the mobile terminal certificate is a legal certificate, a random number N _{2 is} generated, and the generated random number N _{2 is} sent to the mobile terminal; the value is decrypted, and when the decrypted result is equal to the random number N ₂ , the permission is allowed. The mobile terminal accesses the streaming media service platform through the AP; The mobile terminal is configured to encrypt the random number 使用₂ by using a private key of the mobile terminal certificate, generate a signature value of the mobile terminal, and send the signature value of the mobile terminal to the UI.  The system according to claim 6, wherein the certificate authentication request packet further includes a certificate;  The authentication server is further configured to verify the authentication certificate, and the certificate is used to verify the mobile terminal, and further configured to determine, according to the received certificate verification result and the signature of the authentication server, whether the certificate is a legal certificate. And when the ΑΡ certificate is a legal certificate, accessing the streaming media service platform by using the ΑΡ. The system of claim 7, wherein the mobile terminal is further configured to generate a random number N _l and send the generated random number to the AP;  The AP is further configured to encrypt the random number Ni by using a private key of the AP certificate, generate a signature value of the AP, and send the signature value to the mobile terminal;  The mobile terminal is further configured to decrypt the signature value of the AP by using a public key of the AP certificate, and access the streaming media service platform by using the AP when the decrypted result is equal to the random number.  The system according to any one of claims 6 to 8, wherein the access authentication request packet further includes a current system time;  The AP is further configured to determine, according to the current system time included in the access authentication request packet, whether the access request packet is a repeatedly sent packet, where the access authentication request packet is not a repeatedly sent packet, Sending the certificate authentication request packet to the authentication server. The system according to any one of claims 6 to 8, wherein the certificate authentication request packet further includes a current system time; The pre-system time is determined whether the certificate authentication request packet is a repeatedly transmitted packet, and when the certificate authentication request packet is not a repeatedly transmitted packet, the certificate verification operation is performed.