CN101119197A - A contract method and system - Google Patents

Abstract

The invention provides a signing method and system, belonging to the field of network communication. In order to solve the problem of non-real-time signing and cumbersome operation in the prior art, the present invention provides a signing method, which includes sending a signing request, generating signing information, saving signing information, updating signing information and canceling signing step. The present invention also provides a signing system, the system includes a bearer, a bearer and a signing database, the bearer includes a signing request sending module, the bearer includes a signing information generating module, and the signing database includes a signing information saving module . By adopting the technical solution of the present invention, the contracting parties can quickly, real-time, and online establish the contracting relationship, which is easy to implement; when the contracting information changes, it can be updated online; when the contracting relationship needs to be terminated, the contracting relationship can be revoked online, which is convenient for signing Both parties maintain the correctness and validity of the signing information in real time.

Description

A contract method and system

technical field

The invention relates to the field of network communication, in particular to a signing method and system.

Background technique

The end-to-end communication authentication framework is a general authentication framework applicable to different mobile network standards. Its function is to establish mutual trust relationship between different types of entities. See Figure 1 for a schematic diagram. In addition to the two types of business entities involved in the network elements in the figure: SS (Service Subscriber, business contractor) (101), SP (Service Provider, business provider) (102), there should also be a EAC (Entity Authentication Center, Entity Authentication Center) (103) and an ESD (Entity Subscription Database, Entity Subscription Database) (104).

Before the service provider can provide services to other entities, or the service contractor requests services from other entities, it should first have a contract relationship with the network and store the contract information in the ESD.

In the prior art, most of the mobile subscribers (SS or SP) sign with the mobile network through smart cards such as UICC and SIM, and the smart cards are obtained through purchasing and other means, so they are operated offline. The contracting relationship between the third-party application server (usually SP) and the mobile network may require representatives of both parties to sign a written contract or contract face to face.

The disadvantages of the prior art are:

1. The signing method between mobile users and the mobile network is not real-time, and the operation is inconvenient, time-consuming and laborious, which is not conducive to expanding the business scope of the mobile network;

2. The contracting method between the third-party application server and the mobile network is not unified, which is not convenient for both contracting parties to quickly and effectively establish a contracting relationship.

Contents of the invention

The purpose of the present invention is to overcome the problems of non-real-time and inconsistent signing methods in the prior art, so that the mobile network can establish signing relationships with more service providers. The invention provides a service-based automatic signing method. Described technical scheme is as follows:

The present invention provides a signing method, the method includes the following steps:

Step A: The bearer sends a subscription request message to the bearer, and the request message carries the identity information of the bearer and the service type to be provided:

Step B: After receiving the subscription request message, the bearer determines whether authentication is required according to the service type, and if necessary, determines the authentication method according to the service type, and the bearer and the bearer to authenticate;

Step C: The bearer generates subscription information, and sends the subscription information to the subscription database;

Step D: After receiving the signing information, the signing database saves the signing information, and sends a successful signing response to the hosted party or through the hosting party to the hosted party.

The subscription request message in step A also carries service provision capability information, authentication capability information, and authentication requirements; correspondingly, after receiving the subscription request message in step B, the bearer judges according to the service type and authentication requirements Whether authentication is required, and an authentication method is determined according to the authentication capability information, business type, and authentication requirements.

The authentication methods specifically include the following methods:

Authenticate according to local policy;

Authentication is performed according to the public key certificate or attribute certificate provided by the bearer;

Authenticate based on query to a trusted third party.

The step C also includes the step of generating a shared secret between the bearer and the bearer;

Correspondingly, in the step D, the step in which the subscription database sends a successful subscription response to the bearer through the bearer further includes:

The signing database sends a successful signing response to the bearer. The successful signing response carries signing information. After receiving the successful signing response, the bearer uses the shared secret to encrypt the signing information and sends it to the bearer.

When the bearer information changes, the method further includes updating the subscription information, specifically including the following steps:

Step E: The bearer sends a subscription information update request message to the bearer, and the request message carries the update reason and the identity information in the subscription information;

Step F: After receiving the subscription information update request, the bearer judges whether authentication is required according to the subscription information, and if necessary, determines the authentication method according to the service type, and the bearer and the bearer perform the authentication according to the authentication method certification;

Step G: The bearer sends an update request message to the subscription database, and the request message carries the update content and the identity information of the bearer;

Step H: After the subscription database receives the request message, it searches for the subscription information of the bearer in the database according to the identity information of the bearer carried in the message, and updates the subscription information according to the update content carried in the message after finding it, and Send an update confirmation response to the bearer, the subscription database searches for users who subscribe to the service provided by the bearer, and sends a subscription information update notification to the user, or the bearer sends a subscription information update notification to the service-related user.

When the bearer wants to terminate the contract relationship with the bearer, the method further includes the step of canceling the contract, which specifically includes the following steps:

Step J: The bearer sends a cancellation request message to the bearer, and the cancellation request message carries the identity information of the bearer;

Step K: After the bearer receives the cancellation request message, it judges whether authentication is required according to the subscription information, and if so, determines the authentication method according to the service type, and the bearer and the bearer Authentication method for authentication;

Step L: The bearer sends a revocation request message to the subscription database, and the revocation request message carries the identity information of the bearer;

Step M: After the subscription database receives the revocation request message, it searches for the subscription information of the bearer in the database according to the identity information of the bearer carried in the message, deletes the subscription information after finding it, and sends a revocation confirmation response to the bearer For the bearer, the subscription database searches the subscription database for users who have subscribed to the services provided by the bearer, and sends a subscription information revocation notice to the user, or the bearer sends a subscription information revocation notice to the service-related user.

When the bearer wants to terminate the contract relationship with the bearer, the method further includes the step of canceling the contract, which specifically includes the following steps:

Step 0: The bearer sends a request message for canceling the subscription relationship to the bearer;

Step P: After the bearer receives the cancellation request message, it judges whether authentication is required according to the subscription information, and if so, determines the authentication method according to the service type, and the bearer and the bearer The above authentication method is used for authentication;

Step Q: The bearer sends a revocation confirmation response to the bearer;

Step R: After receiving the revocation confirmation response, the bearer sends a revocation request message to the subscription database, and the revocation request message carries the identity information of the bearer;

Step S: After receiving the revocation request, the subscription database searches for the subscription information of the bearer in the database according to the identity information of the bearer carried in the message, deletes the subscription information after finding it, and sends a revocation confirmation response to For the bearer, the subscription database searches the subscription database for users who have subscribed to the services provided by the bearer, and sends a subscription information revocation notice to the user, or the bearer sends a subscription information revocation notice to the service-related user.

The authentication specifically includes the following methods:

Adopt the authentication method used in the contracting process;

Directly use the certification results of the signing process for certification;

A unified authentication method for the bearer and bearer is adopted.

The present invention also provides a signing system, the system includes a bearer, a bearer and a signing database, the bearer includes a signing request sending module, the bearer includes a signing information generating module, and the signing database includes a signing information saving module ;

The subscription request sending module is used for the bearer to send a subscription request message to the bearer, and the request message carries the identity information of the bearer and the service type to be provided;

The signing information generating module is used for the bearer to judge whether authentication is required according to the business type after receiving the signing request message, and if necessary, determine the authentication method according to the business type, and the bearer and the bearer according to the After the authentication is passed, the bearer generates the signing information and sends the signing information to the signing database;

The contract information storage module is used for the contract database to store the contract information after receiving the contract information, and to send a successful contract response to the bearer or through the bearer to the bearer.

The bearer also includes an update request module, the bearer also includes an authentication update module, and the subscription database also includes a subscription information update module;

The update request module is used for the bearer to send a subscription information update request message to the bearer, and the request message carries an update reason and identity information in the subscription information;

The authentication update module is used for the bearer to determine whether authentication is required according to the subscription information after receiving the subscription information update request, and if necessary, determine the authentication method according to the service type, and the bearer and the bearer The authentication method is used for authentication; after the authentication is passed, the bearer sends an update request message to the subscription database, and the request message carries the update content and the identity information of the bearer;

The subscription information update module is used to search the subscription information of the bearer in the database according to the identity information of the bearer carried in the message after the subscription database receives the request message, and after finding out, according to the update content carried in the message Update the subscription information, and send an update confirmation response to the bearer, the subscription database searches for users who subscribe to the services provided by the bearer, and sends a subscription information update notification to the user, or the bearer sends subscription information to the service-related user Update notification.

The bearer also includes a revocation request module, the bearer also includes an authentication revocation module, and the subscription database also includes a subscription information deletion module;

The revocation request module is used for the bearer to send a revocation request message to the bearer, and the revocation request message carries the identity information of the bearer;

The authentication revocation module is used for the bearer to determine whether authentication is required according to the subscription information after receiving the request message for canceling the contract relationship, and if necessary, determine the authentication method according to the service type, and the bearer and the bearer according to The authentication method is used for authentication; after the authentication is passed, the bearer sends a revocation request message to the subscription database, and the revocation request message carries the identity information of the bearer;

The subscription information deletion module is used for the subscription database to search for the subscription information of the bearer in the database according to the bearer identity information carried in the message after the subscription database receives the cancellation request message, delete the subscription information after finding it, and send Revocation confirmation is responded to the bearer, and the subscription database searches for users who have subscribed to the service provided by the bearer, and sends a subscription cancellation notification to the user, or the bearer sends a subscription cancellation notification to the service-related user.

The bearer further includes a bearer revocation request module, the bearer further includes a revocation confirmation response sending module, and the subscription database further includes a subscription information deletion module;

The bearer revocation request module is used for the bearer to send a cancellation request message to the bearer;

The revocation confirmation response sending module is used for the bearer to judge whether authentication needs to be performed according to the subscription information after receiving the request message for canceling the contract relationship, and if necessary, determine the authentication method according to the service type, the bearer and the bearer The bearer performs authentication according to the authentication method; after passing the authentication, the bearer sends a revocation confirmation response to the bearer;

The bearer revocation request module is also used for the bearer to send a revocation request message to the subscription database after receiving the revocation confirmation response sent by the revocation confirmation response sending module, and the revocation request message carries the identity information of the bearer .

The subscription information deletion module is used for the subscription database to search for the subscription information of the bearer in the database according to the bearer identity information carried in the message after the subscription database receives the cancellation request message, delete the subscription information after finding it, and send Revocation confirmation is responded to the bearer, and the subscription database searches for users who have subscribed to the service provided by the bearer, and sends a subscription cancellation notification to the user, or the bearer sends a subscription cancellation notification to the service-related user.

The beneficial effects brought by the signing method and system provided by the present invention are:

1. Both parties to the contract can quickly, real-time, and online establish a contract relationship, and the process is unified and easy to implement;

2. When the contract information changes, it can be updated online;

3. When the contract relationship needs to be terminated, the contract relationship can be revoked online, which is convenient for both parties to maintain the correctness and validity of the contract information in real time.

Description of drawings

FIG. 1 is a schematic diagram of an end-to-end communication authentication framework in the prior art;

Fig. 2 is a schematic flow chart of the signing method provided by Embodiment 1 of the present invention;

FIG. 3 is a schematic diagram of a renewal subscription process provided by Embodiment 2 of the present invention;

FIG. 4 is a schematic diagram of a process for deleting a contract relationship provided by Embodiment 3 of the present invention;

FIG. 5 is a schematic diagram of a process for deleting a contract relationship provided by Embodiment 4 of the present invention;

Fig. 6 is a schematic diagram of the signing system provided by Embodiment 5 of the present invention;

Fig. 7 is a schematic diagram of the signing system provided by Embodiment 6 of the present invention;

Fig. 8 is a schematic diagram of the signing system provided by Embodiment 7 of the present invention;

Fig. 9 is a schematic diagram of a subscription system provided by Embodiment 8 of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but not as a limitation of the present invention.

Example 1

The present invention provides a signing method, the application scope of the method is not limited to the end-to-end communication authentication process, as long as it involves the signing process and the updating of signing information between the bearer and the bearer for the provision and use of a certain resource Both the contractual relationship cancellation process apply.

In this embodiment, the SP is used as the bearer, the network is used as the bearer, and the EAC is used as the signing agent of the network party. After confirming the identity and authority of the other party, the signing information is generated and stored in the ESD. When the SS is not a mobile user but a third-party application server, if the subscription relationship has not been established with the mobile network, the subscription method provided by the present invention can also be used to execute the subscription process.

Referring to Fig. 2, the specific steps of the signing method are as follows;

Step 201: The SP sends a subscription request message to the EAC. The request message carries the identity information of the SP, the service type to be provided, service provision capability information, authentication capability information, and authentication requirements, etc., where the identity information and service type are required in the subscription request. Carried, others are optional information.

Wherein, the SP may be an entity capable of providing services, such as an application server and a mobile terminal. According to the specific type of SP, its identity information can be URL, IMSI, TMSI, IMPI or IMPU, etc., or even a pseudonym set by the SP itself. After the signing is successful, this information is stored in the ESD as part of the signing information.

The service types provided by the SP can be mobile electronic banking services, Monternet services, mail service services, etc., and can be sent to the EAC in the format of an identification code, or directly send the service name. There is no limitation here, as long as the EAC can identify it.

Service provision capability information refers to the type of service that the SP can provide and the scale of the service type.

The authentication capability information includes the authentication methods, authentication models, and cryptographic algorithms supported by the SP. After confirming that the SP identity, capability, and authority are legal, the authentication capability information is stored in the ESD as part of the contract information.

The authentication requirement refers to the method (or the authentication method of the security level) that the SP requires to be authenticated with the EAC before signing the contract. For example, SPs can provide many authentication methods, but some SPs (such as banks) may not trust the network enough, and need to propose to EAC to use a method with a higher security level to authenticate the network before signing the contract.

Step 202: After receiving the subscription request message, the EAC determines whether the two need to be authenticated, and in what way. details as follows:

The EAC determines whether authentication is required according to the security level corresponding to the service type. If the security level requirement is very low, or the SP and the EAC both trust each other, no authentication is required, and the process directly skips to step 204 . If the security level is high, the SP and EAC need to be authenticated.

When the signing request information sent by the SP contains information such as service provision capability information, authentication capability information, and authentication requirements, EAC can also determine whether authentication is required according to the service type and authentication requirements, so that the requirements of the bearer can be fully considered , when the security requirements of the business type are relatively low, but if the authentication requirements put forward by the SP are relatively high, a relatively high security authentication method should be used for authentication.

When the SP and the EAC need to perform authentication, the EAC can determine the authentication method according to the service type of the SP, or can determine the authentication method based on information such as the SP's authentication capability information, service type, authentication requirements, and network authentication capability information. The EAC can also directly use a preset authentication method for authentication without selecting an authentication method.

Step 203A: The EAC and the SP perform authentication according to the determined authentication method.

The EAC authenticates the SP so as to confirm the legitimacy of the SP's identity and the authority and/or ability to provide a certain service.

The methods used by EAC itself to confirm the legitimacy of the SP identity and the authority and/or ability to provide a certain service include:

(1) Judging whether to accept the subscription request of the service entity (SP).

The EAC judges whether to accept the subscription request of the service entity based on the local policy, and the local policy includes requirements on the legality of the identity of the service entity and the authority and/or ability to provide services. It can be expressed in the form of a list, and the entry can include information such as the type of service entity received, the type restriction of the service provided, and/or the service provision capability requirement. The present invention is not limited to the local policy that expresses whether the EAC accepts the subscription request in the form of a list, as long as the expression form contains the above-mentioned ideas, that is, the present invention does not require this.

(2) Authenticate the public key certificate provided by the SP.

When the authentication method of SP and EAC is based on public key certificate or attribute certificate, the certificate presented by SP to EAC needs to be issued by an authority, and can prove the legitimacy of SP identity and service provision capability. Service provision capability information can be placed in the extended information of the PKI public key certificate, or the SP can present to the EAC a PMI (Privilege Management Infrastructure, rights management system) attribute certificate that can prove its identity legality and the authority and/or ability to provide services.

The authentication of the EAC by the SP specifically includes: the SP judges whether the EAC is a legal entity authentication center of the mobile operator through the public key certificate of the EAC or other means.

Step 203B: When the EAC itself cannot determine the legitimacy of the SP identity and the authenticity of the authority and/or ability to provide services, it needs to query the TTP (Trusted Third Party, a trusted third party), that is, a third party trusted by the EAC To complete the verification of the identity of the SP and the authority and/or ability to provide services on its behalf.

During the authentication process of the EAC and the SP, if the security requirement of the service is high, the shared secret information of the two is generated during the authentication process; if the security requirement of the service is relatively low, the shared secret information may not be generated.

Step 204: After authentication, if the EAC confirms that the SP's identity, capability, and authority are legal, then generate contract information.

The most basic signing information is: SP’s identity information and entity business permission flag. The entity business permission flag indicates whether the SP has the right to provide a certain service. For the service that can be provided, set the service permission flag to “1” in the contract information , if the SP will no longer provide this service in the future, set it to "0".

The content of the signing information can also include: the shared secret information of SP and EAC, the validity period of the key (set the use time of the key in the transaction process in advance), and the authentication capability information of the entity, as well as the authentication of the entity corresponding to a certain business request information, etc. EAC sets the validity period for the key (used in the end-to-end authentication process), if not set, the validity period is regarded as the default value.

If the SP identity, capability, and authority have illegal information, an error response will be returned and the process will be terminated.

Step 205: EAC sends the subscription information to ESD.

Step 206: After the ESD receives the signing information, the signing information is stored in the database.

Step 207: The ESD sends a subscription success response to the SP. The subscription success response may or may not carry subscription information.

According to the specific setting of the network, the response can be directly returned to the SP, or returned to the EAC, and then returned to the SP by the EAC.

If the EAC returns a response to the SP, and the response includes the subscription information, the EAC can use its shared secret with the SP to encrypt the subscription information and return it to the SP to confirm the success of the subscription and prevent revisit attacks. According to the specific setting of the network, the subscription information may not be returned.

Step 208: After the SP receives the subscription success response, the subscription information can be stored locally or not stored locally, and the subscription is completed.

Example 2

If the bearer party has signed a contract with the bearer party, when the bearer party needs to update the subscription information, the contract update process is performed. The carried party and the bearer in this embodiment are the same as those in Embodiment 1, that is, the SP acts as the carried party, the network acts as the bearer, the EAC acts as the signing agent of the network party, and the SS serves as the user who subscribes to the services provided by the carried party.

Referring to Figure 3, updating the contract specifically includes the following steps:

Step 301: The SP sends a subscription information update request message to the EAC. The request message carries the update reason and the identity in the subscription information, so that the network can find the subscription information of the SP. The reason for updating here is at least one of the following:

1) The type of service provided by the SP changes;

2) Leakage of stored shared secrets;

3) The SP certification ability is upgraded or changed;

4) The identity information of the SP changes;

5) The certification requirement information of an SP corresponding to a certain business has changed;

6) Any changes other than those mentioned above occur in the content involved in the signing information.

If the subsequent authentication method is based on the authentication result established in the signing process, the update request message may contain the authentication result as a credential for the EAC authentication SP. The authentication result here specifically refers to the credential generated after the last successful authentication.

Step 302: After receiving the update request message, the EAC judges whether authentication is required and what method to use for authentication according to the subscription information.

Judging whether authentication is required based on the signing information is to check whether there are authentication requirements and other information in the signing information. If so, determine whether authentication is required between them according to the authentication requirements and other information. If not, check the specific business type in the signing information. What is it? Determine whether authentication is required according to the type of business. When the service security requirement is very low, or the SP and the EAC both trust each other, authentication may not be required, and the process directly skips to step 303 .

If authentication is required, there are two situations:

Step 302A: The EAC and the SP perform mutual authentication. The authentication process can adopt the mutual authentication method used in the signing process; or perform authentication based on the authentication result of the signing process (credentials generated last time), or use a simple and common method uniformly. authentication method;

The authentication process of the SP and the EAC may include the confirmation by the EAC of whether the identity of the SP is legal and the authority and/or ability to provide a certain service.

Step 302B: When the EAC itself cannot determine the legitimacy of a service provider's identity and/or the authenticity of the service provision capability, the EAC will inquire about the trusted third party TTP, that is, the third party trusted by the EAC will complete the contract on its behalf Verification of the requester's identity and/or service offering capabilities.

Step 303: After mutual authentication, if the identity, capability, and authority of the SP are confirmed to be valid, the EAC sends an update request to the ESD, carrying the corresponding update content and the identity information of the SP; otherwise, an error response is returned and the update process is terminated.

Step 304: After receiving the update request, the ESD updates the corresponding content of the subscription information. For example, if you are adding or changing a business, you need to add or change the business permission flag.

Step 305: the ESD sends an update confirmation response to the SP.

Step 306: The ESD searches for the SS that subscribes to the service provided by the SP, and sends relevant information about the change of subscription information to it.

Example 3

If the bearer party has already signed a contract with the bearer party, when the bearer party wants to terminate the contract relationship with the bearer party, it needs to cancel the contract. The carried party and the bearer in this embodiment are the same as those in Embodiment 1, that is, the SP acts as the carried party, the network acts as the bearer, the EAC acts as the signing agent of the network party, and the SS serves as the user who subscribes to the services provided by the carried party.

Referring to Figure 4, the cancellation of the contract specifically includes the following steps:

Step 401: The SP sends a request message for revoking the subscription relationship to the EAC. The request message carries the identity information in its subscription information, so that the network can find the subscription information of the SP.

Step 402: After receiving the request message for canceling the contract relationship, the EAC judges whether authentication is required and what method to use for authentication according to the subscription information. If the service security requirements are very low, or if the SP and the EAC both trust each other, authentication may not be required, and step 403 may be skipped directly.

If certification is required, it can be divided into the following two situations:

Step 402A: EAC and SP perform mutual authentication. The authentication process can adopt the mutual authentication method used in the signing process; or perform authentication based on the authentication result of the signing process; or use a simple and common authentication method, that is, a unified authentication method for both parties .

The authentication process of the SP and the EAC may include the confirmation by the EAC of the legitimacy of the identity of the SP and the authority or ability to provide a certain service.

Step 402B: When the EAC itself cannot determine the legitimacy of a service provider's identity and/or the authenticity of the service provision capability, it queries the trusted third party TTP, that is, the third party trusted by the EAC completes the signing requester's Verification of identity and/or business offering capabilities.

Step 403: After confirming that the SP's identity, capability, and authority are valid, the EAC sends a revocation request message to the ESD. The revocation request message carries the SP's identity information; otherwise, an error response is returned and the process is terminated.

Step 404: After receiving the revocation request, the ESD searches the corresponding subscription information in the database according to the identity information, and deletes the corresponding subscription information after finding it.

Step 405: The ESD sends a revocation confirmation response to the SP.

Step 406: The ESD searches for the SS that has subscribed to the service provided by the SP, and sends relevant information about revocation of subscription information to it.

Example 4

If the bearer has signed a contract with the bearer, when the bearer wants to terminate the contract relationship with the bearer, it needs to cancel the contract. The carried party and the bearer in this embodiment are the same as those in Embodiment 1, that is, the SP acts as the carried party, the network acts as the bearer, the EAC acts as the signing agent of the network party, and the SS serves as the user who subscribes to the services provided by the carried party.

Referring to Figure 5, the cancellation of the contract specifically includes the following steps:

Step 501: EAC sends a request message for revocation of subscription relationship to SP;

Step 502: After receiving the request message for canceling the contract relationship, the SP judges whether authentication is required and what method to use for authentication according to the subscription information. If the service security requirements are very low, or if the SP and the EAC both trust each other, authentication may not be required, and step 503 may be skipped directly.

The authentication process can adopt the authentication method used in the signing process; or conduct authentication based on the authentication result of the signing process; or uniformly adopt a simple and common authentication method.

Step 503: After confirming that the EAC's identity, capability, and authority are legal, the SP sends a revocation confirmation response to the EAC, indicating that it agrees to revoke the subscription information; otherwise, an error response is returned, and the process is terminated.

Step 504: After receiving the revocation confirmation response, the EAC sends a revocation request to the ESD, carrying the identity information of the SP.

Step 505: After receiving the revocation request, the ESD searches the corresponding subscription information in the database according to the identity information, and deletes the corresponding subscription information after finding it.

Step 506: The ESD sends a revocation confirmation response to the EAC, telling the EAC that the revocation of the subscription information has been completed.

Step 507: The ESD searches for the SS that has subscribed to the service provided by the SP, and sends relevant information about revocation of subscription information to it.

Example 5

Referring to Fig. 6, the present invention also provides a signing system, the system includes a bearer 601, a bearer 602 and a subscription database 603, the bearer 601 includes a signing request sending module 604, and the bearer 602 includes a signing information generating module 605 , the contract database 603 includes a contract information storage module 606; wherein,

The subscription request sending module 604 is used for the bearer to send a subscription request message to the bearer, and the request message carries the identity information of the bearer and the service type to be provided;

The subscription information generation module 605 is used for the bearer to judge whether authentication is required according to the service type after receiving the subscription request message from the subscription request sending module 604, and if necessary, determine the authentication method according to the service type, and the bearer and the carried party Perform authentication; after the authentication is passed, the bearer generates signing information and sends the signing information to the signing database;

The contract information storage module 606 is used for the contract database to store the contract information after receiving the contract information from the contract information generation module 605, and send a successful contract response to the bearer or through the bearer to the bearer.

Example 6

Referring to Fig. 7, the hosted party 601 also includes an update request module 701, the bearer 602 also includes an authentication update module 702, and the subscription database 603 also includes a subscription information update module 703;

The update request module 701 is used for the bearer to send a subscription information update request message to the bearer, the request message carrying the update reason and the identity information in the subscription information;

The authentication update module 702 is used for the bearer to judge whether authentication needs to be performed according to the subscription information after receiving the subscription information update request from the update request module 701, and if necessary, determine the authentication method according to the business type, and the bearer and the bearer to carry out the authentication according to the authentication method Authentication; after the authentication is passed, the bearer sends an update request message to the subscription database, and the request message carries the update content and the identity information of the bearer;

The subscription information update module 703 is used for the subscription database to search for the subscription information of the bearer in the database according to the bearer identity information carried in the message after receiving the request message from the authentication update module 702, and after finding it, according to the update content carried in the message Update the subscription information and send an update confirmation response to the bearer. The subscription database searches for users who subscribe to the services provided by the bearer, and sends subscription information update notifications to these users, or the bearer sends subscription information update notifications to the service-related users.

Example 7

Referring to FIG. 8, the bearer 601 further includes a revocation request module 801, the bearer 602 further includes an authentication revocation module 802, and the subscription database 603 further includes a subscription information deletion module 803;

The revocation request module 801 is used for the bearer to send a revocation request message to the bearer, and the revocation request message carries the identity information of the bearer;

The authentication revocation module 802 is used for the bearer to judge whether authentication needs to be performed according to the subscription information after receiving the cancellation request message from the revocation request module 801, and if necessary, determine the authentication method according to the service type, and the bearer and the bearer to Perform authentication; after the authentication is passed, the bearer sends a revocation request message to the subscription database, and the revocation request message carries the identity information of the bearer;

The contract information deletion module 803 is used to search the contract information of the carried party in the database according to the carried party identity information carried in the message after the contract database receives the revocation request message of the authentication revocation module 802, delete the contract information after finding it, and Send a revocation confirmation response to the bearer, and the subscription database searches for users who have subscribed to the service provided by the bearer, and sends a notice of cancellation of subscription information to these users, or the bearer sends a notice of cancellation of subscription information to the user related to the service.

Example 8

Referring to FIG. 9 , in addition, the bearer of the system can also actively send request information for canceling the contract relationship to the bearer. At this time, the bearer 602 also includes a bearer cancellation request module 901, and the bearer 601 also includes a cancellation confirmation response sending Module 902, the contract database also includes a contract information deletion module 903;

The bearer revocation request module 901 is used for the bearer to send a request message for revocation of the contract relationship to the bearer;

The revocation confirmation response sending module 902 is used for the bearer to judge whether authentication needs to be performed according to the subscription information after receiving the request message of canceling the contract relationship from the bearer revocation request module 901, and if necessary, to determine the authentication method according to the business type. The bearer and the bearer The bearer performs authentication according to the authentication method; after the authentication is passed, the bearer sends a revocation confirmation response to the bearer;

The bearer revocation request module 901 is also used for the bearer to send a revocation request message to the subscription database after receiving the revocation confirmation response sent by the revocation confirmation response sending module 902, and the revocation request message carries the identity information of the bearer.

The subscription information deletion module 903 is used for the subscription database to search for the subscription information of the bearer in the database according to the bearer identity information carried in the message after receiving the cancellation request message of the bearer cancellation request module 901, and delete the subscription information after finding , and send a revocation confirmation response to the bearer, the subscription database searches for users who have subscribed to the services provided by the bearer, and sends a notice of cancellation of subscription information to these users, or the bearer sends a notice of cancellation of subscription information to users related to the service.

The embodiments described above are only one of the more preferred specific implementations of the present invention, and the usual changes and replacements performed by those skilled in the art within the scope of the technical solutions of the present invention should be included in the protection scope of the present invention.

Claims (12)

1. A method of signing, the method comprising the steps of:

step A: a carried party sends a request message for signing to a carrying party, wherein the request message carries the identity information of the carried party and the type of service to be provided;

and B: after receiving the signing request message, the bearer judges whether authentication is needed according to the service type, if so, an authentication mode is determined according to the service type, and the bearer and the borne party perform authentication according to the authentication mode;

and C: the carrier generates subscription information and sends the subscription information to a subscription database;

step D: and after receiving the subscription information, the subscription database stores the subscription information and sends a subscription success response to the carried party or sends the subscription success response to the carried party through the carried party.

2. The subscription method according to claim 1, wherein the subscription request message in step a further carries service provision capability information, authentication capability information, and an authentication requirement; correspondingly, after receiving the signing request message in the step B, the bearer determines whether authentication is needed according to the service type and the authentication requirement, and determines the authentication mode according to the authentication capability information, the service type and the authentication requirement.

3. The subscription method according to claim 1, wherein the authentication means specifically includes the following means:

authenticating according to a local policy;

authenticating according to a public key certificate or an attribute certificate provided by a carried party;

and performing inquiry authentication to a trusted third party.

4. A subscription method as claimed in claim 1, wherein said step C further comprises the step of the bearer and the bearer generating a shared secret;

correspondingly, the step that the subscription database sends a successful subscription response to the carried party through the carrying party in the step D further includes:

the signing database sends a signing success response to the carrier, the signing success response carries signing information, and the carrier encrypts the signing information by using the shared secret and sends the signing information to the carried party after receiving the signing success response.

5. The subscription method according to claim 1, wherein when bearer information changes, the method further includes updating the subscription information, specifically including the steps of:

step E: a carried party sends a signing information updating request message to a carrying party, wherein the request message carries an updating reason and identity information in the signing information;

step F: after receiving the signing information updating request, the bearer judges whether authentication is needed according to the signing information, if so, an authentication mode is determined according to the service type, and the bearer and the borne party perform authentication according to the authentication mode;

step G: the bearer sends an update request message to a subscription database, wherein the request message carries update content and identity information of the bearer;

step H: after receiving the request message, the signing database searches the signing information of the borne party in the database according to the identity information of the borne party carried in the message, updates the signing information according to the updating content carried in the message after the signing information is found, and sends an updating confirmation response to the borne party, the signing database searches the user who subscribes the service provided by the borne party, and sends a signing information updating notice to the user, or the borne party sends a signing information updating notice to the user related to the service.

6. The subscription method according to claim 1, wherein when the bearer is to terminate the subscription relationship with the bearer, the method further comprises a step of revoking the subscription, and specifically comprises the steps of:

step J: the carried party sends a request message for canceling the subscription relationship to the carrier party, wherein the request message for canceling the subscription relationship carries the identity information of the carried party;

step K: after receiving the request message for canceling the subscription relationship, the bearer judges whether authentication is needed according to subscription information, if so, an authentication mode is determined according to the service type, and the bearer and the borne party perform authentication according to the authentication mode;

step L: the bearer sends a revocation request message to a subscription database, wherein the revocation request message carries identity information of the bearer;

step M: after receiving the revocation request message, the signing database searches the signing information of the borne party in the database according to the identity information of the borne party carried in the message, deletes the signing information after searching, and sends a revocation confirmation response to the borne party, the signing database searches the user who subscribes the service provided by the borne party, and sends a signing information revocation notice to the user, or the borne party sends a signing information revocation notice to the user related to the service.

7. The subscription method according to claim 1, wherein when the bearer is to terminate the subscription relationship with the bearer, the method further comprises a step of revoking the subscription, and specifically comprises the steps of:

step O: the bearing direction is sent by a bearing party to cancel the signing relationship request message;

step P: after receiving the request message for canceling the subscription relationship, the carried party judges whether authentication is needed according to subscription information, if so, an authentication mode is determined according to the service type, and the carried party perform authentication according to the authentication mode;

step Q: the carried direction sends cancellation confirmation response to the carrier;

step R: after receiving the revocation confirmation response, the bearer sends a revocation request message to a subscription database, wherein the revocation request message carries the identity information of the bearer;

step S: after receiving the revocation request, the signing database searches the signing information of the borne party in the database according to the identity information of the borne party carried in the message, deletes the signing information after searching, and sends a revocation confirmation response to the bearing party, the signing database searches the user who subscribes the service provided by the bearing party, and sends a signing information revocation notice to the user, or the borne party sends a signing information revocation notice to the user related to the service.

8. A subscription method according to any one of claims 5 to 7, wherein said authentication comprises in particular the following method:

adopting an authentication mode used in a signing process;

directly adopting the authentication result of the signing process to authenticate;

and adopting a unified authentication method of the carried party and the carrying party.

9. A signing system comprises a carried party, a carrying party and a signing database, and is characterized in that the carried party comprises a signing request sending module, the carrying party comprises a signing information generating module, and the signing database comprises a signing information storing module;

the signing request sending module is used for the carried party to send a signing request message to the carrying party, and the request message carries the identity information of the carried party and the service type to be provided;

the signing information generation module is used for judging whether authentication is needed or not according to the service type after the bearer receives the signing request message, if so, determining an authentication mode according to the service type, and authenticating the bearer and the borne party according to the authentication mode; after the authentication is passed, the carrier generates subscription information and sends the subscription information to a subscription database;

the signing information storage module is used for storing the signing information after the signing database receives the signing information and sending a signing success response to the borne party or sending the signing success response to the borne party through the borne party.

10. The subscription system of claim 9, wherein the hosted further includes an update request module, the hosted further includes an authentication update module, the subscription database further includes a subscription information update module;

the updating request module is used for the carried party to send a signing information updating request message to the carrying party, and the request message carries an updating reason and identity information in the signing information;

the authentication updating module is used for judging whether authentication is needed or not according to the signing information after the bearer receives the signing information updating request, if so, determining an authentication mode according to the service type, and authenticating the bearer and the borne party according to the authentication mode; after the authentication is passed, the bearer sends an update request message to a subscription database, wherein the request message carries update content and identity information of the bearer;

the signing information updating module is used for searching the signing information of the borne party in the database according to the identity information of the borne party carried in the message after the signing database receives the request message, updating the signing information according to the updating content carried in the message after the signing information is searched, sending an updating confirmation response to the borne party, searching the user who subscribes the service provided by the borne party by the signing database, and sending a signing information updating notice to the user or sending a signing information updating notice to the user related to the service by the borne party.

11. The subscription system of claim 9, wherein the hosted further includes a revocation request module, the hosted further includes an authentication revocation module, the subscription database further includes a subscription information deletion module;

the revocation request module is used for the borne party to send a revocation contract relation request message to the borne party, wherein the revocation contract relation request message carries the identity information of the borne party;

the authentication revocation module is used for judging whether authentication is needed or not according to subscription information after the bearer receives the request message for revoking the subscription relationship, if so, determining an authentication mode according to the service type, and authenticating the bearer and the borne party according to the authentication mode; after the authentication is passed, the bearer sends a revocation request message to a subscription database, wherein the revocation request message carries the identity information of the bearer;

the signing information deleting module is used for searching the signing information of the borne party in the database according to the identity information of the borne party carried in the message after the signing database receives the revocation request message, deleting the signing information after the signing information is searched, sending a revocation confirmation response to the borne party, searching a user who subscribes the service provided by the borne party by the signing database, and sending a signing information revocation notice to the user or sending a signing information revocation notice to a user related to the service by the borne party.

12. The subscription system of claim 9, wherein the bearer further comprises a bearer revocation request module, the bearer further comprises a revocation confirmation response sending module, and the subscription database further comprises a subscription information deletion module;

the bearer revocation request module is used for the bearer to send a request message for revoking the subscription relationship to the bearer;

the revocation confirmation response sending module is used for judging whether authentication is needed or not according to subscription information after the revoked subscription relationship request message is received by the carried party, if so, determining an authentication mode according to the service type, and authenticating the carried party and the carried party according to the authentication mode; after the authentication is passed, the carried party sends a revocation confirmation response to the carrying party;

the carrier revocation request module is further configured to send a revocation request message to a subscription database after the carrier receives the revocation confirmation response sent by the revocation confirmation response sending module, where the revocation request message carries the identity information of the carried party.

The signing information deleting module is used for searching the signing information of the borne party in the database according to the identity information of the borne party carried in the message after the signing database receives the revocation request message, deleting the signing information after the signing information is searched, sending a revocation confirmation response to the borne party, searching a user who subscribes the service provided by the borne party by the signing database, and sending a signing information revocation notice to the user or sending a signing information revocation notice to a user related to the service by the borne party.

Images