WO2012171283A1 - Method and system for third-party authentication and method for managing authentication state of terminal device - Google Patents

Abstract

Disclosed are a method and system for third-party authentication and a method for managing an authentication state of a terminal device. The method for managing the authentication state comprises: when the terminal and a smart card have yet to perform a bidirectional authentication, the state of the terminal device is in a machine-and-card unauthenticated state; when the bidirectional authentication passes, the terminal device converts into a machine-and-card authentication passed state or a bidirectional authentication passed state; when the bidirectional authentication fails, the terminal device converts into a machine-and-card locked state or a bidirectional authentication failed state; when a management platform passes a binding relationship authentication for the terminal and the smart card, the terminal device converts into a third-party authentication passed state or a secured state; and when the binding relationship authentication fails, the terminal device converts into a third-party authentication failed state or an unsecured state.

Description

 Method, system and authentication status management method for three-party authentication

Technical field

 The present invention relates to the field of communications technologies, and in particular, to a method and system for three-party authentication and a method for managing authentication status of a terminal device.

Background technique

 As an important part of the emerging high-tech industry, the Internet of Things has been regarded as one of the key technologies for coping with the economic crisis and revitalizing the economy. The IoT business can be widely applied to many industries, such as vehicles, electricity, finance, environmental protection, petroleum, personal and corporate security, hydrology, military, fire, weather, coal, agriculture, forestry, elevators, etc. According to experts, in the next few years, the Internet of Things business will quickly enter many industries, and its number of users will also grow rapidly. It is estimated that by the end of 2012, the number of Internet of Things users based on mobile cellular communication technology in China will reach 30-40 million. IoT applications will become one of the core applications of Long Term Evolution (LTE) technology in a few years, and have broad development prospects.

 Among the application types of the IoT service, many services require high security of the device devices of the terminal and the smart card, for example: environmental monitoring, by deploying various environmental monitoring devices in the cell, for monitoring the environmental quality of the community, including Community pollutants, noise, garbage, sewage, etc., to create a quiet, healthy and harmonious living environment for the residents of the community; and community security, because personal safety and property safety are the top priority of the community residents, the community needs to install video surveillance equipment , anti-theft alarm equipment, home security equipment, home video intercom, building access control, etc., and realize the information of the owners, property, security, neighborhood committee, public security bureau to jointly build a harmonious and safe living environment; In addition, it also includes intelligence In applications such as home, coal mine safety production and monitoring, and medical health, the requirements for application safety management are also very high.

In order to prevent the smart card from being used for other purposes or being physically stolen, it is necessary to consider the application security management of the smart card, such as the method of capturing the card binding, third-party legality authentication, etc., to realize the special card. However, the existing card binding scheme, third-party legality authentication, etc., or the binding effect is not good, it is easy to crack, or the security is not high, or the problem in the new application environment cannot be solved. Summary of the invention

 The technical problem to be solved by the present invention is to provide a method and system for three-party authentication and a method for managing authentication status of a terminal device, which can ensure security problems in various application environments.

 In order to solve the above technical problem, the present invention provides a method for three-party authentication, the method comprising:

 The two-way authentication is performed between the terminal and the smart card. If the two-way authentication is passed, the terminal reports the binding relationship between the terminal and the smart card to the management platform, and requests the management platform to perform the binding relationship. Certification

 The management platform authenticates the binding relationship between the terminal and the smart card, and if the binding relationship authentication passes, it determines that the three-party authentication passes.

 Preferably, the method further includes:

 If the binding relationship authentication fails, it is determined that the three-party authentication fails.

 Preferably, the step of performing mutual authentication between the terminal and the smart card includes:

 The smart card obtains the smart card side authentication result according to the authentication information using the algorithm 1 and encrypts the smart card side authentication result by using the algorithm 2, and sends the authentication information and the encrypted smart card side authentication result to the terminal;

 The terminal obtains the terminal side authentication result according to the authentication information sent by the smart card, and decrypts the encrypted smart card side authentication result by using the third algorithm, and decrypts the obtained smart card side authentication result with the The terminal side authentication results are compared. If they are the same, the terminal side authentication result is sent to the smart card. If they are inconsistent, the authentication fails, and the current authentication process ends.

 The smart card compares the received terminal-side authentication result with the obtained smart card-side authentication result. If the smart card is consistent, the authentication succeeds. If not, the authentication fails.

 The algorithm 3 is an inverse operation of the algorithm 2.

 Preferably, the binding relationship refers to a combination of terminal information and smart card information;

The terminal information includes one of the following information or any combination thereof: International Mobile Equipment Identity (IMEI), Electronic Serial Numbers (ESN), parameter information stored in the terminal;

 The smart card information includes one of the following information or any combination thereof: an International Mobile Subscriber Identity Number (IMSI), an Integrated Circuit Card Identity (ICCID), and a smart card. Parameter information.

 Preferably, the step of the management platform for authenticating the binding relationship between the terminal and the smart card includes:

 The management platform searches for a binding relationship between the terminal and the smart card in a local binding relation database, and if yes, determines that the binding relationship is authenticated, and if not, determines the binding relationship. The certification failed.

 Preferably, the method further includes:

 When the third platform authentication is passed, the management platform sets the state of the terminal device to a three-party authentication pass state or a security state; when it is determined that the three-party authentication fails, the state of the terminal device is set to a three-party authentication fail state. Or unsafe state.

 Preferably, the method further includes:

 When the two-way authentication is passed, the terminal and the smart card are set to a machine card authentication pass state or a two-way authentication pass state;

 When the two-way authentication fails, the terminal and the smart card are set to a card lock state or a two-way authentication fail state, and the authentication information of the smart card is set to invalid information.

 Preferably, the setting the authentication information of the smart card to invalid information comprises: changing the IMSI of the smart card to a blank, a random number, or an error message.

 The present invention further provides a method for managing an authentication state of a terminal device, where the terminal device includes a terminal and a smart card, and the authentication state management method includes:

When the terminal and the smart card have not been authenticated by the smart card, the state of the terminal device is the uncertified state of the machine card; the pass status of the card; when the two-way authentication fails, the terminal device changes to the card lock state or double To the failed state of certification;

 When the management platform passes the authentication relationship between the terminal and the smart card, the terminal device is converted into a three-party authentication pass state or a security state; when the binding relationship authentication fails, the terminal device is converted into a three-party authentication. Failed state or non-secure state.

 Preferably, the terminal device is changed from the initial state to the uncertified state of the card after the terminal is powered on and the smart card is reset.

 In addition, the present invention further provides a system for three-party authentication, the system comprising: a two-way authentication module and a binding relationship authentication request module on the terminal side, a two-way authentication module on the smart card side, and a three-party authentication module in the management platform, wherein :

 The two-way authentication module on the terminal side is configured to: perform mutual authentication with the smart card; the binding relationship authentication request module is configured to: report the terminal and the smart card to the management platform if the two-way authentication is passed Binding the relationship, and requesting the management platform to authenticate the binding relationship;

 The two-way authentication module on the smart card side is configured to: perform mutual authentication with the terminal; the three-party authentication module is configured to: set the binding relationship authentication request module request, and bind the terminal to the smart card The relationship is authenticated. If the binding relationship is authenticated, the three-party authentication is determined to pass. If the binding relationship fails, the three-party authentication is determined to have failed.

 Preferably, the two-way authentication module on the smart card side is configured to: after obtaining the smart card side authentication result according to the authentication information using the algorithm 1 and encrypting the smart card side authentication result by using the algorithm 2, the authentication information and the authentication information The encrypted smart card side authentication result is sent to the terminal; and after receiving the terminal side authentication result, comparing with the obtained smart card side authentication result, if the matching is successful, the authentication is successful, and if not, the authentication fails;

 The two-way authentication module on the terminal side is configured to: obtain the terminal side authentication result according to the authentication information sent by the smart card, and decrypt the encrypted smart card side authentication result by using the third algorithm, and decrypt the encrypted smart card side authentication result. The obtained smart card side authentication result is compared with the terminal side authentication result, and if the agreement is the same, the terminal side authentication result is sent to the smart card. If not, the authentication fails, and the current authentication process is ended;

The algorithm 3 is an inverse operation of the algorithm 2. Preferably, the three-party authentication module is configured to: determine whether a binding relationship between the terminal and the smart card exists in a binding relationship database local to the management platform, and if yes, determine that the binding relationship is authenticated, If not, determining that the binding relationship authentication fails;

 The binding relationship refers to a combination of terminal information and smart card information;

 The terminal information includes one of the following information or any combination thereof: IMEI, ESN, parameter information stored in the terminal;

 The smart card information includes one or any combination of the following information: IMSI, ICCID, parameter information stored in the smart card.

 Preferably, the system further includes a two-way authentication result implementation module on the smart card side,

 The authentication result implementation module is configured to: when the two-way authentication process passes, set the terminal and the smart card to a machine card authentication pass state or a two-way authentication pass state; when the two-way authentication fails, The terminal and the smart card are set to a card lock state or a two-way authentication fail state, and the authentication information of the smart card is set to invalid information.

 Preferably, the two-way authentication result implementation module is configured to set the authentication information of the smart card to invalid information by changing the IMSI of the smart card to a blank, a random number, or an error message.

 Through the above authentication method, the security of the terminal and the smart card are ensured. When the terminal uses the forged smart card, the terminal is locked, and the security of the terminal is ensured. When the smart card is stolen or illegally used, the terminal cannot be logged into the network, and the terminal is illegally used. When the smart card is used, the terminal can be locked in time. At the same time, the binding relationship can be dynamically authenticated, and the management and management rights of the terminal and the card device are controlled on the management platform side, which facilitates the operator to carry out his own business and truly guarantees the development. The specificity and security of terminals and smart cards for networked services. BRIEF abstract

 The drawings are intended to provide a further understanding of the invention, and are intended to be illustrative of the invention. In the drawing:

FIG. 1 is a schematic diagram of a general process of a three-party authentication method according to an embodiment of the present invention; FIG. 2 is a schematic diagram of interaction between a terminal, a smart card, and a management platform according to an embodiment of the present invention; FIG. 3 is a schematic flowchart of a two-way authentication of a terminal and a smart card according to an embodiment of the present invention;

 4 is a schematic diagram of a process for authenticating a binding relationship between a terminal and a smart card by a management platform according to an embodiment of the present invention;

 FIG. 5 is a schematic diagram of various authentication states of a terminal device according to an embodiment of the present invention; FIG.

 6 is a schematic diagram of successful three-party authentication of a terminal, a smart card, and a management platform according to Embodiment 1 of the present invention;

 FIG. 7 is a schematic diagram of a failure of a three-party authentication of a terminal, a smart card, and a management platform according to Embodiment 2 of the present invention. Preferred embodiment of the invention

 Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

 In order to enable the Internet of Things application to have a safer and more reliable operating environment, an embodiment of the present invention provides a method for three-party authentication of a mobile terminal, a smart card, and a management platform. As shown in FIG. 1, the method includes the following processes:

 Step 101: The terminal device is powered on, and after the smart card is reset, the terminal device is changed from the initial state to the uncertified state of the card.

 The terminal device refers to a device composed of a terminal and a smart card.

 Step 102: First, perform two-party authentication between the mobile terminal and the smart card. If the two-party authentication between the mobile terminal and the smart card is passed, go to step 103. If the authentication of both the terminal and the smart card fails, go to step 104.

 Step 103: If the terminal and the smart card pass the two-way mutual authentication, the state is set to the machine card authentication pass state, and the mobile terminal reports the binding relationship between the terminal and the smart card to the management platform, and requests the management platform to authenticate the binding relationship.

In step 104, the state is set to the card lock state (the terminal can be locked, the terminal is invalid, etc.), and the authentication information (especially IMSI) of the smart card is modified to be invalid information, such as changing the IMSI to blank. Random numbers, error messages, etc., to ensure that the smart card is not available, the authentication is over.

 Step 105: The management platform performs a three-party authentication process of the mobile terminal, the smart card, and the management platform. Step 106: If the management platform passes the binding relationship authentication between the terminal and the smart card, the three-party authentication is passed, the management platform returns a binding relationship authentication pass sign to the terminal, and step 107 is performed, if the management platform does not pass the binding of the terminal and the smart card. If the relationship is authenticated, the binding relationship authentication failure flag is returned to the terminal, and step 108 is performed.

 Step 107: After receiving the authentication pass sign of the management platform, the terminal sets the state of the terminal device to a security state (or a three-party authentication pass state), and allows the terminal device to run the related IoT application.

 Step 108: The terminal receives the authentication failure sign of the management platform, and sets the state of the terminal device to an unsafe state (or a three-party authentication failure state), and prohibits the terminal device from running the related Internet of Things application.

 Before the terminal device runs the related IoT application and judges that the state is the security state (the three-party authentication pass state), the related IoT application can be run, and the state is determined to be in an unsafe state (the three-party authentication fails the state), and the related matter is prohibited. Networked applications.

 The binding relationship refers to a combination of terminal information and smart card information;

 The terminal information includes one of the following information or any combination thereof: IMEI, ESN, parameter information stored in the terminal, and the like;

 The smart card information includes one of the following information or any combination thereof: IMSI, ICCID, parameter information stored in the smart card, and the like.

In the embodiment of the present invention, the two-way authentication process of the terminal and the smart card is performed by using the terminal and the smart card authentication protocol. As shown in FIG. 2, the algorithm 1 and the algorithm 2 are respectively stored in the smart card and the terminal, and the inverse of the algorithm 2 is additionally stored in the terminal. Algorithm 1 - Algorithm 3, wherein algorithm 1 is used to obtain an authentication result according to the authentication information, algorithm 2 is used to encrypt the authentication result, and algorithm 3 is used to decrypt the result of the algorithm 2. The management platform includes a card binding correspondence database for storing corresponding information of the card binding relationship. The management platform may be a network authentication platform, an application management platform, a security management platform, or the like.

 As shown in FIG. 3, the process of the authentication protocol in the embodiment of the present invention is specifically described as follows:

Step 301: The smart card uses the agreed calculation according to the authentication information (including the authentication parameter and the like). The first method obtains the smart card side operation result (hereinafter also referred to as the authentication result), and after encrypting using the algorithm 2, sends an allowable authentication command to the terminal, and carries the authentication information such as the authentication parameter, and the encrypted authentication calculated according to the authentication information. result;

 The authentication information includes one or more of a random number, an International Mobile Equipment Identity (IMSI), a user authentication key, and other information stored in the smart card.

 Step 302: The terminal performs an algorithm three operation (the inverse operation of the algorithm 2) on the encrypted operation result transmitted by the smart card, that is, performs the decryption process of the algorithm 2, and obtains the smart card side authentication result; meanwhile, the terminal uses the same information according to the information sent by the smart card. The algorithm performs an operation to obtain a terminal side authentication result.

 Step 303: Determine whether the authentication result of the smart card is the same as the authentication result of the terminal. If the same, perform step 304. If not, perform step 305.

 Step 304: If the terminal side operation result is consistent with the decrypted smart card operation result, the terminal side transmits the operation result to the smart card, and the process goes to step 306.

 Step 305: If the terminal side operation result is inconsistent with the decrypted smart card operation result, the authentication fails, and the process goes to step 308.

 Step 306: After obtaining the operation result of the terminal, the smart card compares with the result obtained by the self operation. If the same, the process proceeds to step 307. If not, the process proceeds to step 308.

 Step 307, the two-way authentication is passed, the authentication is ended, and the subsequent process is continued.

 Step 308: The authentication fails, the authentication ends, and the set terminal is in an abnormal use state (such as locking the terminal, the terminal is invalid, etc.), and the authentication information of the smart card is modified to be invalid information (such as blank, random number, error information, etc.).

 The foregoing algorithm 1 and algorithm 2 are currently known algorithms, including but not limited to the following symmetric and asymmetric algorithms and any combination thereof: data encryption algorithm (DES), 3 data encryption algorithm ( 3DES), hash algorithm (HASH), IMSI authentication algorithm A3, RSA algorithm and error checking and correction algorithm (ECC), encryption key generation algorithm A5, user key generation algorithm A8, and so on. The combination between the algorithms includes: first, using one of the algorithms, and then using the other algorithm, and the like, and so on.

The management platform authenticates the binding relationship between the smart card and the terminal. Only this binding is passed. For the authentication of the relationship, the management platform allows the device based on the terminal and the smart card to run the IoT application, otherwise the device of the terminal and the smart card is prohibited from running the Internet of Things application.

As shown in FIG. 4, the specific process of the authentication of the binding relationship by the management platform is as follows: Step 401: After the two-party authentication between the mobile terminal and the smart card is passed, the mobile terminal reports the binding to the smart card to the management platform 4. Relationship, and request management to authenticate the binding relationship.

 Step 402: The management platform verifies whether the binding relationship between the smart card and the terminal passes. If yes, step 403 is performed. If not, step 404 is performed.

 The binding relationship database between the smart card and the terminal is stored in the binding relational database local to the management platform. The management platform verifies whether the binding relationship between the smart card and the terminal passes by verifying whether the binding relationship between the smart card and the terminal exists.

 Step 403: If the binding relationship is verified, the management platform returns a three-party authentication pass indication to the terminal, and step 405 is performed.

 Step 404: If the binding relationship fails to pass the verification, the management platform returns the three-party authentication to the terminal, and the process proceeds to step 406.

 Step 405: If the terminal receives the three-party authentication pass indication returned by the management platform, the state of the terminal device is set to a security state (three-party authentication pass status).

 Step 406: If the terminal receives the three-party authentication failure indication returned by the management platform, the status of the terminal device is in an unsecured state (the three-party authentication fails the state).

 Before the IoT application is run, the terminal device first determines whether the state is a security state (three-party authentication pass state), and if it is a security state (three-party authentication pass state), the application is run, otherwise the application is not run.

The embodiment of the present invention further provides a method for managing the authentication status of the terminal device. FIG. 5 shows various authentication states of the terminal device in a specific application. As shown in FIG. 5, the status of the terminal device may be classified into the following types:

The default state of the terminal device is the initial state; When the terminal and the smart card have not been authenticated in both directions, the state of the terminal device is the uncertified state of the machine card; specifically, the terminal device is powered on, and after the smart card is reset, the terminal device is changed from the initial state to the uncertified state of the machine card;

State

 When the authentication relationship between the terminal and the smart card is passed, the terminal device changes to the three-party authentication pass state or security state. When the binding relationship fails, the terminal device changes to the three-party authentication fail state or non-secure state.

Embodiment 1

 In this embodiment, the random number and the IMSI are used as the authentication information, and the smart card and the terminal respectively store the algorithm 1 and the algorithm 2, and the terminal additionally stores the inverse algorithm 1 of the algorithm 2, and the algorithm 1 is used to obtain the authentication result according to the authentication information. Algorithm 2 is used to encrypt the authentication result, and Algorithm 3 is used to decrypt the result of Algorithm 2.

 The IoT terminal is powered on, and after the smart card is reset, the two-way authentication process of the mobile terminal and the smart card is performed. As shown in FIG. 6, the terminal, the smart card, and the management platform of the embodiment successfully perform the three-party authentication process, which specifically includes:

Step 602: The smart card sends an instruction to the terminal to notify the terminal to obtain the authentication parameter.

 Step 603: The terminal receives the command status word, identifies the permission to be authenticated, and sends a command to the smart card, requesting the smart card to send the encrypted authentication result.

 Step 604: The smart card performs an operation by using a pair of authentication parameters according to the terminal request, and performs encryption by using the algorithm 2, and transmits the encrypted authentication result to the terminal by using the command status word.

 Step 605: The terminal performs an operation on the encrypted authentication result transmitted by the smart card by using algorithm three.

(The decryption process of algorithm 2 is performed), and the authentication result of the smart card is obtained, and the terminal simultaneously performs the operation according to the authentication information sent by the smart card, and obtains the terminal side authentication result. The terminal compares the two authentication results. Step 606: The terminal compares and finds that the two authentication results are consistent, and sends a command to the smart card, and sends the unencrypted authentication result of the terminal to the smart card.

 Step 607: After obtaining the authentication result of the terminal, the smart card compares with the authentication result obtained by the smart card.

 Step 608: The smart card comparison finds that the two authentication results are the same, and notifies the terminal that the two-way authentication succeeds.

 Step 609: After receiving the notification, the terminal sets the state to the card authentication pass status, and sends the terminal device identification number and the information such as the IMSI to identify the mobile terminal and the smart card to the management platform, and report the binding relationship between the terminal and the smart card to the management platform. (Communication means can use existing technologies, such as short messages, BIP, etc.), and send request information to the management platform to request authentication of the binding relationship.

 Step 610: When the management platform receives the terminal device identification number and the IMSI pair of the binding relationship, the corresponding binding relationship database is used to find out whether the binding relationship between the terminal and the smart card exists. If there is a corresponding relationship, the three-party authentication is performed. Returns the binding relationship authentication pass flag to the terminal.

 After receiving the authentication pass sign, the terminal device sets the terminal device status to a safe state (three-party authentication pass status). Before the terminal device runs the related IoT application, it determines that the device status is a safe state (three-party authentication pass status), and starts to run related. Internet of Things applications.

Embodiment 2

 In this embodiment, the IMSI is used as the authentication information, and the smart card and the terminal respectively store the algorithm 1 and the algorithm 2, and the terminal additionally stores the inverse algorithm 1 of the algorithm 2, and the algorithm 1 is used to obtain the authentication result according to the authentication information, and the algorithm 2 Used to encrypt the authentication result, and algorithm 3 is used to decrypt the result of algorithm 2.

 After the terminal is powered on and the smart card is reset, the two-way authentication process of the mobile terminal and the smart card is performed. In this embodiment, the terminal, the smart card, and the management platform perform a process of failing the three-party authentication, as shown in FIG. 7, the process is specifically described as follows:

Step 702: The smart card simultaneously sends an instruction to the terminal to notify the terminal to obtain the authentication parameter.

Step 703: The terminal receives the command status word, identifies that the authentication is allowed, and sends a command to the smart card. Order, the smart card is required to send its encrypted authentication result.

 Step 704: The smart card performs an operation by using a pair of authentication parameters according to the terminal request, and performs encryption using algorithm 2, and transmits the encrypted authentication result to the terminal by using the command status word.

 Step 705: The terminal performs an operation on the encrypted authentication result transmitted by the smart card by using algorithm 3 (the decryption process of algorithm 2), and obtains the authentication result of the smart card, and the terminal simultaneously performs the operation according to the authentication information sent by the smart card, using the same algorithm. The terminal side operation result is obtained. Terminal comparison Whether the two authentication results are consistent.

 Step 706: The terminal compares and finds that the two authentication results are inconsistent, and sends a command to notify the smart card that the authentication fails, the terminal and the smart card end the authentication, the terminal is locked, cannot be used, and the IMSI information of the smart card is changed to a random number, even if stolen, Used for network access, the terminal device is locked in the machine card.

In addition, the embodiment of the present invention further provides a method for managing an authentication state of a terminal device, where the terminal device includes a terminal and a smart card, and the authentication state management method includes:

When the terminal and the smart card have not been authenticated in both directions, the status of the terminal device is the uncertified state of the machine card;

 When the authentication relationship between the terminal and the smart card is passed, the terminal device changes to the three-party authentication pass state or security state. When the binding relationship fails, the terminal device changes to the three-party authentication fail state or non-secure state.

 Preferably, after the terminal is powered on and the smart card is reset, the terminal device is changed from the initial state to the uncertified state of the card.

In addition, the embodiment of the present invention further provides a three-party authentication system (not shown), which mainly includes: a bidirectional authentication module and a binding relationship authentication request module on the terminal side, a two-way authentication module on the smart card side, and management A three-party authentication module in the platform, where:

The two-way authentication module on the terminal side is configured to perform mutual authentication with the smart card; The binding relationship authentication request module is configured to report the binding relationship between the terminal and the smart card to the management platform, and request the management platform to authenticate the binding relationship, where the two-way authentication module passes, and the two-way authentication module on the smart card side is set to Two-way authentication with the terminal;

 The three-party authentication module is configured to authenticate the binding relationship between the terminal and the smart card according to the request of the binding relationship authentication request module. If the binding relationship authentication is passed, the three-party authentication is determined to pass, otherwise, the three-party authentication is determined to have failed.

 Preferably, the two-way authentication module on the smart card side is configured to: after the smart card side authentication result is obtained according to the authentication information using the algorithm 1 and the smart card side authentication result is encrypted by using the algorithm 2, the authentication information and the encrypted smart card side authentication are performed. The result is sent to the terminal; and after receiving the authentication result of the terminal side, the result is compared with the obtained smart card side authentication result. If the agreement is consistent, the authentication is successful, otherwise, the authentication fails;

 The two-way authentication module on the terminal side is configured to obtain the terminal side authentication result according to the authentication information sent by the smart card, and decrypt the encrypted smart card side authentication result by using the algorithm three, and decrypt the obtained smart card side authentication result with The terminal side authentication result is compared. If the result is the same, the terminal side authentication result is sent to the smart card. Otherwise, the authentication fails, and the current authentication process is ended. The algorithm 3 is the inverse operation of the algorithm 2.

 Preferably, the three-party authentication module is configured to: determine whether the binding relationship between the terminal and the smart card exists in the binding relationship database local to the management platform, and if yes, determine that the binding relationship authentication passes; otherwise, determine that the binding relationship authentication fails. ;

 Binding relationship refers to the combination of terminal information and smart card information;

 The terminal information includes one of the following information or any combination thereof: IMEI, ESN, parameter information stored in the terminal;

 The smart card information includes one of the following information or any combination thereof: IMSI, ICCID, parameter information stored in the smart card.

 Preferably, the system further comprises a two-way authentication result implementation module on the smart card side,

The authentication result implementation module is configured to set the terminal and the smart card to the machine card authentication pass state or the two-way authentication pass state when the two-way authentication process passes; when the two-way authentication fails, the terminal and the smart card are set to the machine card lock state or two-way. The authentication fails the status and the authentication information of the smart card is set. Invalid information.

 Preferably, the two-way authentication result implementation module is configured to set the authentication information of the smart card to invalid information by: changing the IMSI of the smart card to a blank, a random number, or an error message.

The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention. The present invention may be embodied in various other embodiments without departing from the spirit and scope of the invention. Various changes and modifications may be made to the invention, and such changes and modifications are intended to be included within the scope of the appended claims.

 Obviously, those skilled in the art should understand that the above modules or steps can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device for execution by the computing device and, in some cases, may be performed in a different order than that illustrated herein. The steps are described or described, either separately as individual integrated circuit modules, or as a plurality of modules or steps in a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

Industrial applicability

 Through the above authentication method, the security of the terminal and the smart card are ensured. When the terminal uses the forged smart card, the terminal is locked, and the security of the terminal is ensured. When the smart card is stolen or illegally used, the terminal cannot be logged into the network, and the terminal is illegally used. When the smart card is used, the terminal can be locked in time. At the same time, the binding relationship can be dynamically authenticated, and the management and management rights of the terminal and the card device are controlled on the management platform side, which facilitates the operator to carry out his own business and truly guarantees the development. The specificity and security of terminals and smart cards for networked services.

Claims

Claim  A method for three-party authentication, the method comprising:  The two-way authentication is performed between the terminal and the smart card. If the two-way authentication is passed, the terminal reports the binding relationship between the terminal and the smart card to the management platform, and requests the management platform to perform the binding relationship. Certification  The management platform authenticates the binding relationship between the terminal and the smart card, and if the binding relationship authentication passes, it determines that the three-party authentication passes.  2. The method of claim 1 further comprising:  If the binding relationship authentication fails, it is determined that the three-party authentication fails.  3. The method according to claim 1, wherein the step of performing mutual authentication between the terminal and the smart card comprises: the smart card obtaining a smart card side authentication result according to the authentication information using algorithm 1 and using the algorithm two After the smart card side authentication result is encrypted, the authentication information and the encrypted smart card side authentication result are sent to the terminal;  The terminal obtains the terminal side authentication result according to the authentication information sent by the smart card, and decrypts the encrypted smart card side authentication result by using the third algorithm, and decrypts the obtained smart card side authentication result with the The terminal side authentication results are compared. If they are the same, the terminal side authentication result is sent to the smart card. If they are inconsistent, the authentication fails, and the current authentication process ends.  The smart card compares the received terminal-side authentication result with the obtained smart card-side authentication result. If the smart card is consistent, the authentication succeeds. If not, the authentication fails.  The algorithm 3 is an inverse operation of the algorithm 2.  4. The method of claim 1, wherein  The binding relationship refers to a combination of terminal information and smart card information; The terminal information includes one of the following information or any combination thereof: an International Mobile Equipment Identity (IMEI), an Electronic Serial Number (ESN), and parameter information stored in the terminal; the smart card information includes the following information. One or any combination of them: International Mobile User Knowledge Alias (IMSI), Integrated Circuit Card Identification Number (ICCID), parameter information stored in the smart card. The method according to claim 1 or 4, wherein the step of the management platform authenticating the binding relationship between the terminal and the smart card comprises:  The management platform searches for a binding relationship between the terminal and the smart card in a local binding relation database, and if yes, determines that the binding relationship is authenticated, and if not, determines the binding relationship. The certification failed.  6. The method of claim 5, the method further comprising:  When the third platform authentication is passed, the management platform sets the state of the terminal device to a three-party authentication pass state or a security state; when it is determined that the three-party authentication fails, the state of the terminal device is set to a three-party authentication fail state. Or unsafe state.  7. The method of claim 1, the method further comprising:  When the two-way authentication is passed, the terminal and the smart card are set to a machine card authentication pass state or a two-way authentication pass state;  When the two-way authentication fails, the terminal and the smart card are set to a card lock state or a two-way authentication fail state, and the authentication information of the smart card is set to invalid information.  8. The method of claim 7, wherein  The step of setting the authentication information of the smart card as invalid information includes: changing the IMSI of the smart card to a blank, a random number or an error message.  A method for managing an authentication state of a terminal device, where the terminal device includes a terminal and a smart card, and the authentication state management method includes:  When the terminal and the smart card have not been authenticated by the smart card, the state of the terminal device is the uncertified state of the machine card; the pass status of the card; when the two-way authentication fails, the terminal device changes to the card lock state or The two-way authentication fails the status; When the management platform passes the authentication relationship between the terminal and the smart card, the terminal device transits to a three-party authentication pass state or a security state; when the binding relationship authentication fails, the terminal The end device is switched to a three-party authentication failure state or non-security state.  10. The method of claim 9, wherein  The terminal device is changed from the initial state to the uncertified state of the machine card after the terminal is powered on and the smart card is just reset.  A three-party authentication system, the system comprising: a two-way authentication module and a binding relationship authentication request module on the terminal side, a two-way authentication module on the smart card side, and a three-party authentication module in the management platform, wherein:  The two-way authentication module on the terminal side is configured to: perform mutual authentication with the smart card; the binding relationship authentication request module is configured to: report the terminal and the smart card to the management platform if the two-way authentication is passed Binding the relationship, and requesting the management platform to authenticate the binding relationship;  The two-way authentication module on the smart card side is configured to: perform mutual authentication with the terminal; the three-party authentication module is configured to: bind the terminal to the smart card according to the request of the binding relationship authentication request module The relationship is authenticated. If the binding relationship authentication is passed, it is determined that the three-party authentication is passed. If the binding relationship authentication fails, it is determined that the three-party authentication fails.  12. The system of claim 11 wherein:  The two-way authentication module on the smart card side is configured to: after obtaining the smart card side authentication result according to the authentication information using the algorithm 1 and encrypting the smart card side authentication result by using the algorithm 2, the authentication information and the encrypted The smart card side authentication result is sent to the terminal; and after receiving the terminal side authentication result, comparing with the obtained smart card side authentication result, if the matching is successful, the authentication is successful, and if not, the authentication fails;  The two-way authentication module on the terminal side is configured to: obtain the terminal side authentication result according to the authentication information sent by the smart card, and decrypt the encrypted smart card side authentication result by using the third algorithm, and decrypt the encrypted smart card side authentication result. The obtained smart card side authentication result is compared with the terminal side authentication result, and if the agreement is the same, the terminal side authentication result is sent to the smart card. If not, the authentication fails, and the current authentication process is ended;  The algorithm 3 is an inverse operation of the algorithm 2. 13. The system of claim 11 or 12, wherein The three-party authentication module is configured to: determine whether a binding relationship between the terminal and the smart card exists in a binding relationship database local to the management platform, and if yes, determine that the binding relationship is authenticated, if not If yes, it is determined that the binding relationship authentication fails;  The binding relationship refers to a combination of terminal information and smart card information;  The terminal information includes one of the following information or any combination thereof: an International Mobile Equipment Identity (IMEI), an Electronic Serial Number (ESN), and parameter information stored in the terminal; the smart card information includes the following information. One or any combination thereof: International Mobile Subscriber Identity (IMSI), Integrated Circuit Card Identification Number (ICCID), parameter information stored in the smart card.  14. The system of claim 11 or 12, the system further comprising a two-way authentication result implementation module on the smart card side,  The authentication result implementation module is configured to: when the two-way authentication process passes, set the terminal and the smart card to a machine card authentication pass state or a two-way authentication pass state; when the two-way authentication fails, The terminal and the smart card are set to a card lock state or a two-way authentication fail state, and the authentication information of the smart card is set to invalid information.  15. The system of claim 14 wherein  The two-way authentication result implementation module is configured to set the authentication information of the smart card to invalid information by changing the IMSI of the smart card to a blank, a random number or an error message.