CN102938757B - The method and identity provider of user data in shared network - Google Patents

Abstract

The invention provides method, service providing server, identity provider and the user equipment of user data in a kind of shared network, wherein, the network includes identity provider and Resource Server (RS), and this method includes：Service providing server receives the access of user equipment (UE)；The service providing server directly or indirectly obtains the users to share data of user's mandate from the RS.Method, service providing server, identity provider and the user equipment of user data in above-mentioned shared network so that service providing server safely shares the user data of telecom operators.

Description

Method for sharing user data in a network and an identity providing server

technical field

The invention relates to the communication field and the Internet field, in particular to a method for sharing user data in the network, a service providing server, an identity providing server and user equipment.

Background technique

With the popularization of the Internet and the development of information technology, more and more people carry out business activities in cyberspace, such as online shopping, Internet telephony, email, blog, instant messaging, etc. Usually, telecom operators and service providers provide services to users. The telecom operators own the communication network infrastructure and provide users with rich access methods, such as asymmetric digital subscriber line (Asymmetric Digital Subscriber Line, ADSL) access. Access, third generation (The Third Generation, 3G) mobile communication access, wireless local area network (Wireless Local Area Network, WLAN) access, Ethernet access, etc.; service providers provide users with rich services, such as traditional portal websites , e-commerce, network communications, online banking and social networking, etc.

Service providers on the Internet vary in size. Although some can provide innovative services, the number of users develops slowly, and the number of users usually becomes the bottleneck of business development. In recent years, a class of providers providing identity services has emerged on the Internet, which is called an identity provider (Identity Provider, identity provider server). The identity providing server provided by the identity provider usually has relatively large user resources, and can provide services such as identity verification for other users or service providers. Telecom operators have a huge number of users and have the natural ability to provide servers for identities. However, compared with the open Internet, the telecom network is relatively closed and has a single type of business. In order to enhance the competitiveness of telecom operators, instead of just providing channels for service providers, it is necessary for telecom operators to become part of the business value chain: provide identity services as identity providing servers, share user information, provide credible security services, Provide mobile payment capabilities, etc.; service providers can reuse various capabilities provided by telecom operators as much as possible, and focus on core competitive services; for users, they can enjoy seamless service experience and improve security and personal privacy.

In the existing technology, an Application Server (Application Server, AS) in an IP Multimedia Subsystem (IP Multimedia System, IMS) can directly access subscription data of a user in a Home Subscriber Server (Home Subscriber Server, HSS). Users decide which data to share by modifying the subscription information. For service providers on the Internet, there are a large number of them, and new service providers appear constantly, so it is difficult to define contract data in advance. Therefore, there is a scalability problem in this scheme. In addition, for the third-party AS, it is guaranteed to obtain the user subscription data from the HSS according to the trust relationship, but at present, it is not possible to flexibly control the access of the AS to the user subscription data.

In the current Identity Management (IdM), three roles are involved: user, service provider and identity provider server. The current solution is mainly to solve the problem of single sign-on, such as OpenID, Liberty Alliance (Liberty Alliance), Card Space, Generic Authentication Architecture (GAA) and Kerberos model, etc. These solutions have different definitions of user identity and are completed independently. The diversity of identities still brings inconvenience to the business of users using the Internet.

Open Authorization (OAuth) is a protocol for solving authorized access to user resource data on the Internet. It does not identify users in a unified way, and does not define how to use them with resources of telecom operators.

In the current network, the user's identity is used to identify the user at the network layer, and can also be used to identify the user by the service provider, providing a unified identity for the user. However, there is currently no effective method to enable the service provider's service provider server to safely share the telecom operator's user data, which also limits the development of new services.

Contents of the invention

The invention provides a method for sharing user data in a network, a service providing server, an identity providing server and user equipment to solve the problem that existing service providing servers cannot safely share user data of telecommunication operators.

The present invention provides a method for sharing user data in a network, the method comprising:

The network includes an identity providing server and a resource server (RS), and the method includes:

The service providing server receives the access of the user equipment (UE);

The service providing server directly or indirectly acquires the user-authorized shared data from the RS.

Preferably, before the service providing server receives the access of the UE, the method further includes:

The service providing server directly or indirectly completes service access authentication for the UE.

Preferably, the service providing server directly completing the service access authentication of the UE includes:

The service providing server obtains user security parameters from the identity providing server, and completes service access authentication for the UE according to the user security parameters.

Preferably, the service providing server indirectly completing the service access authentication of the UE includes:

The service providing server obtains the service access authentication result of the identity providing server for the UE from the identity providing server.

Preferably, the user security parameter is obtained by the identity providing server according to an access authentication result of the network for the UE.

Preferably, the service access authentication result is completed by the identity providing server according to the network's access authentication result for the UE.

Preferably, the service providing server directly obtaining user-authorized user shared data from the RS includes:

The service providing server obtains a token from the identity providing server, and directly obtains user-authorized user sharing data from the RS according to the token.

Preferably, the service providing server indirectly obtaining user-authorized user-shared data from the RS includes:

The service providing server acquires user-authorized shared data through the identity providing server.

The present invention also provides a service providing server, which includes:

A receiving module, configured to receive access from a user equipment (UE);

The obtaining module is used to directly or indirectly obtain the user-authorized shared data from the resource server (RS).

Preferably, the service providing server further includes:

The service access authentication module is configured to directly or indirectly complete the service access authentication of the UE before the receiving module receives the access of the UE.

Preferably, the service access authentication module is configured to obtain user security parameters from an identity providing server, and complete service access authentication for the UE according to the user security parameters; or, obtain the user security parameters from the identity providing server The identity provides the service authentication result of the UE by the server.

Preferably, the user security parameter is obtained by the identity providing server according to the network's access authentication result for the UE; or

The service authentication result is completed by the identity providing server according to the network's access authentication result for the UE.

Preferably, the obtaining module is configured to obtain a token from the identity providing server, and directly obtain user-authorized user shared data from the RS according to the token; or obtain user authorization through the identity providing server users share data.

The present invention also provides an identity providing server, which includes:

A network access authentication module, configured to authenticate user equipment (UE) access to the network, and obtain user security parameters;

The service access authentication module is configured to complete the service access authentication of the UE according to the user security parameters obtained by the network access authentication module, and send the service access authentication result to the service providing server.

Preferably, the identity providing server further includes:

A sending module, configured to send the user security parameters obtained by the network access authentication module to the service providing server.

Preferably, said user security parameters include a session key.

Preferably, the identity providing server further includes:

The data sending module is configured to receive the data request sent by the service providing server after the service access authentication module sends the service access authentication result or the sending module sends the user security parameter to the service providing server, according to The data request obtains user-authorized user shared data from a resource server (RS), and sends the user shared data to the service providing server.

Preferably, the data sending module is further configured to receive the service provider server after the service access authentication module sends the service access authentication result or the sending module sends the user security parameter to the service provider server. A token request is sent, and a token is sent to the service providing server according to the token request, so that the service providing server obtains user-authorized user sharing data from the RS according to the token.

The present invention also provides a user equipment (UE), where the UE includes:

An access module, used to access the service providing server;

The data processing module is configured to receive the user data authorization request sent by the identity providing server according to the data request sent by the service providing server, and send the request to the identity providing server according to the authorization result of the user data carried in the user data authorization request. Returns the user's shared data authorized by the user.

Preferably, the access module is used for accessing the service providing server after the UE successfully accesses the network by using the ID and obtains the service access authentication of the service providing server.

The above method for sharing user data in the network, the service providing server, the identity providing server and the user equipment enable the service providing server to safely share the user data of the telecom operator.

Description of drawings

FIG. 1 is a schematic diagram of a scenario of sharing user data in a network according to the present invention;

FIG. 2 is a schematic diagram of the architecture of Embodiment 1 of user data in a shared network in the present invention;

FIG. 3 is a schematic diagram of the structure of Embodiment 2 of user data in the sharing network of the present invention;

FIG. 4 is a signaling flowchart of Embodiment 1 of user data in a shared network according to the present invention;

FIG. 5 is a signaling flowchart of Embodiment 2 of user data in a shared network according to the present invention;

FIG. 6 is a signaling flowchart of Embodiment 3 of user data in a shared network according to the present invention.

detailed description

In order to make the purpose, technical solution and advantages of the present invention more clear, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other.

As shown in FIG. 1 , it is a schematic diagram of a scenario of sharing user data in a network according to the present invention. In this embodiment, a social network safely shares user data in the network, such as a contact list. The sharing process includes:

Step 10, the user 100 accesses the network 102 and passes the authentication of the network 102;

Step 12, the user 100 visits the social networking site 104;

Step 14, the social networking site 104 does not have the identity information of the user 100, the social networking site 104 finds the network 102 according to the configuration information or uses the dynamic discovery protocol to find the network 102;

Step 16, the network 102 contacts the user 100, and the user 100 authorizes whether to share user data, such as a contact list;

Step 18, after the user 100 authorizes the shared user data, the network 102 continues the subsequent processing;

Step 20, the network 102 returns the information shared by the user 100 to the social network 104, such as a contact list;

Step 22 , when the user 106 accesses the social networking site 104 through the network 102 , use the user data shared by the user 100 , such as a contact list.

As shown in Figure 2, it is a schematic diagram of the structure of the user data embodiment 1 in the shared network of the present invention, the network completes the routing of the data packet through the access service node (ASN, Access Serving Node); the user equipment (UE) 200 is identified by ID . In the network, the user equipment 200 is authenticated by the identity providing server, which supports directly obtaining the data shared by the user from the resource server (ResourceServer, RS) 206 , or obtaining the data shared by the user through the identity providing server 204 . The network includes, but not limited to, a mobile communication network and an identification network. The authentication between the UE 200 and the service providing server 208 is based on the result of user access authentication. In this architecture, the network will not pass the user's security credentials to the service provider server 208, so the service provider server 208 cannot directly authenticate the user equipment 200, and needs to complete the user authentication through the interface between the UE200 and the identity provider server 204.

User equipment 200 refers to user nodes, such as mobile phones, personal computers, etc.; user equipment is pre-configured or obtains an ID from the network; user equipment has security credentials, pre-shares root keys with the network, or sets digital certificates. In the mobile communication network, the ID of the user equipment can be identified by the International Mobile Subscriber Identity (IMSI) or the Mobile Subscriber Integrated Services Digital Network (MSISDN); in the identification network, the ID of the user equipment is an access identifier (Access Identifier) , AID). The capabilities of the user equipment include but are not limited to: support for Hypertext Transfer Protocol (HTTP) Digest authentication protocol; support for Session Initiation Protocol (SIP) Digest authentication protocol; support for Extensible Authentication Protocol (EAP) and EAP authentication methods; New keying material can be derived.

The access service node 202 is located at the border of the network, and is used to provide access services for the user equipment 200, maintain the connection between the terminal and the network, implement functions such as routing and forwarding of data packets, and cooperate with the identity providing server 204 to complete the UE200 Access authentication. In the mobile communication network, the access service node is a GPRS service support node (Serving GPRSSUPPORT NODE, SGSN) and/or gateway GPRS support node (Gateway GPRS Support Node, GGSN), and in the identification network, the access service node is an ASN.

The identity providing server 204 takes the user identity ID as the core in the network, is responsible for creating, maintaining, and managing user identity information, and provides user identity verification services. The capabilities of the identity providing server 204 include, but are not limited to: providing network access authentication services; providing business access authentication services; supporting EAP functions; being able to obtain user information from RS; in specific implementation, the functions of the authentication center can be enhanced to realize identity management functions, such as supporting Web functions, HTTP (HypertextTransfer Protocol, Hypertext Transfer Protocol), HTTP Digest Authentication Protocol, and Security Assertion Markup Language (SecurityAssertion Markup Language, SAML).

Resource server (RS) 206 stores user's security information, provides user's attribute data and other data, such as contact list, avatar, photo, video and so on.

The service providing server 208 provides services to the user node 200, which can be Web services, such as portal websites and electronic malls, which usually use Hypertext Transfer Markup Language (HTML)/HTTP; they can also be non-Web services, such as e-mail , instant messaging, such services are usually based on transport layer protocols, such as Transmission Control Protocol (Transmission Control Protocol, TCP).

The following is an introduction to each interface in Figure 2:

Interface A: located between UE 200 and ASN 202, providing mutual authentication between UE 200 and ASN 202, supporting but not limited to EAP protocol;

Interface B: located between the ASN 202 and the identity providing server 204, from which the identity providing server 204 transmits the master session key to the ASN 202; supports but is not limited to passing the EAP load through the Authentication Authorization Accounting (AAA) protocol;

Interface C: located between the identity providing server 204 and the RS 206, the identity providing server 204 obtains the user's security information and other user data through the C 214 interface. The protocol of this interface includes but is not limited to: support Diameter protocol.

Interface D: located between the UE 200 and the identity providing server 204, supports single sign-on service for users, and supports secure sharing of data. The protocol of this interface includes but not limited to: support HTTP Digest protocol; support SIP Digest protocol; support SAML protocol.

Interface E: located between UE 200 and service provider server 208, UE 200 accesses services provided by service provider server 208 through this interface, the protocol of this interface includes but not limited to: support HTTP protocol; support transport layer protocol, such as TCP; support SAML protocol; support Diameter protocol; support HTTPS protocol.

Interface F: Located between the identity providing server 204 and the service providing server 208, it provides single sign-on service and supports safe data sharing. The protocol of this interface includes but not limited to: support HTTP protocol, support AAA protocol.

Interface G: located between the service providing server 208 and the RS 206, the service providing server 208 acquires user-related data through this interface. The protocol of this interface includes but is not limited to: support Diameter protocol.

As shown in FIG. 3, it is a schematic diagram of the structure of the second embodiment of the user data in the shared network of the present invention. The difference between this structure diagram and the structure diagram shown in FIG. There is no interface between them; but the network can transfer user security information (such as identification, master session key, key life cycle, etc.) to the service providing server 208, so that the service providing server 208 can directly authenticate the user equipment 200. Wherein, the user security information used in the authentication between the UE 200 and the service providing server 208 is based on the result of the user's network access authentication.

As shown in FIG. 4 , it is a signaling flowchart of Embodiment 1 of user data in a shared network in the present invention. This flowchart is completed based on the architecture shown in FIG. 2 . For authentication, the service provider server 208 obtains the token from the identity provider server 204, and directly obtains the data shared by the user from the RS 206. The identity provider server 204 and RS 206 have pre-configured a template for user data sharing, and the specific data to be shared is determined by the user. authorized.

The prerequisite for this process is that the link between UE 200 and ASN 202 has been established, and UE 200 has been pre-configured with the user's identity ID; the user data sharing process in the network includes:

Step 220, ASN 202 sends an identity request to UE 200;

Step 222, UE 200 sends a response to ASN 202, carrying the user's ID in the response;

Step 224, ASN 202 sends the response message to the identity providing server 204, and the message carries the user ID;

Step 226, the identity providing server 204 sends a message carrying an ID to the RS 206 to request key material;

Step 228, RS 206 returns the key material to the identity providing server 204;

Step 230, the UE 200 and the identity providing server 204 negotiate security parameters, including security protocols and session keys supported by both parties;

The above steps 220-230 are the network's access authentication process for the UE;

Step 232, the UE 200 accesses the services of the service providing server 208, and the service providing server 208 discovers the location of the identity providing server 204 through static configuration or dynamic;

Step 234, the service providing server 208 sends a redirect message to the UE 200, and the UE 200 sends the message to the identity providing server 204 according to the address of the identity providing server in the header of the redirect message;

Step 236, the identity providing server 204 sends an unauthorized message to the UE 200;

Step 238, the UE 200 sends a digest authentication message to the identity providing server 204, using the ID as the user name and the session key as the password;

Step 240, the identity providing server 204 verifies the identity of the user after receiving the digest authentication message;

Step 242, the identity providing server 204 requests the user data list from the RS 206, and the request carries the identity of the user;

Step 244, RS 206 returns the user list to the identity providing server 204;

Step 246, the identity providing server 204 requests user authorization by sending a list of user data to UE200;

Step 248, the UE 200 returns the user authorization result to the identity providing server 204;

Step 250, the identity providing server 204 sends a redirection message to the UE 200, and the UE 200 contacts the service providing server 208 according to the address in the message header, and the message includes an index and an authorization code;

Step 252, the service providing server 208 requests an access token from the identity providing server 204, and the request includes an index and an authorization code;

Step 254, the identity providing server 204 returns the access token to the service providing server 208, and the token contains information such as keys and key life cycles;

Step 256, the service provider server 208 obtains shared user data in batches from RS206, and RS206 performs security protection on these data, such as confidentiality protection and integrity protection; after service provider server 208 receives these user data, read them with the access token these protected data;

Step 258 , the service providing server 208 returns a result message to the UE 200 .

The following uses EAP, AAA, HTTP and SAML protocols as examples to describe the flow of user data in the secure shared network shown in Figure 4 in the form of an application example:

Step 220a, ASN 202 sends an EAP-Identity identity request to UE 200;

Step 222a, the UE 200 sends an EAP-Identity response to the ASN 202, carrying the ID of the user in the response, wherein Type-Data in the EAP-Identity response is set to ID;

In step 224a, the ASN 202 sends the EAP payload (EAP-Payload) to the identity providing server 204 through the AAA protocol. For the Diameter protocol, the EAP-Payload AVP (Attribute-Value Pair, attribute-value pair) of the Diameter-EAP-Request message is used to encapsulate the EAP-Identity load; for the Remote User Dial Authentication Service (RADIUS) protocol, the RADIUSAccess-Request message is used The EAP-Message attribute to encapsulate the EAP-Identity payload;

Step 226a, the identity providing server 204 sends the ID to the RS 206 through the Diameter protocol to obtain the key material, specifically, a multimedia authorization request (Multimedia-Auth-Request, MAR) can be used to carry the ID;

Step 228a, RS 206 returns the key material to the identity providing server 204 through the Diameter protocol. Specifically, the multimedia authorization response (Multimedia-Auth-Answer, MAA) message can be used to carry the key material, wherein the ID is mapped to the user name (User-Name) Attributes;

Step 230a, UE 200 and identity providing server 204 negotiate security parameters: (1) Negotiate EAP method (Method), such as EAP-Authentication and Key Agreement (AKA), EAK-Security Transport Layer Protocol (TLS), etc., for the Diameter protocol , use the EAP-Payload AVP (Attribute-Value Pair, attribute-value pair) of the Diameter-EAP-Request message to encapsulate EAP-AKA, EAP-TLS and other loads; for the RADIUS protocol, use RADIUS Access-Challenge and Access-Accept encapsulation EAP-AKA, EAP-TLS and other payloads. (2) The UE 200 and the identity providing server 204 negotiate MSK (Master Session Key, master session key). For the Diameter protocol, the EAP-Master-Session-Key AVP of the Diameter-EAP-Request message is used to carry the key material; for The RADIUS protocol carries the MSK through the VSA (Vendor service provider ecific Attribute, vendor-specific attribute) in the RADIUS Accept message;

In step 232a, the UE 200 sends an HTTP request to the service providing server 208, and chooses to log in through the identity providing server 204 on the service providing server 208. In the header field of the HTTP request, there is a URL (Uniform Resource Locator, Uniform Resource Locator) address of the identity providing server, and the service providing server 208 discovers the URL address of the identity providing server 204 through static configuration or dynamic discovery, and the request message carries <lib:AuthnRequest>;

Step 234a, the service providing server 208 sends an HTTP redirect message to the UE 200, and the UE 200 sends the message to the identity providing server 204 according to the URL address of the identity providing server in the header of the HTTP redirect message;

Step 236a, the identity providing server 204 sends an HTTP 401 Unauthorized (Unauthorized) message to the UE 200;

Step 238a, UE200 sends HTTP request message to identity providing server 204, uses ID as user name, MSK as password, and performs HTTP Digest authentication;

Step 240a, after the identity providing server 204 receives the HTTP Digest authentication message, it checks the local ID/MSK according to the ID, and performs the same HTTP Digest authentication algorithm. When the calculated results are consistent, the verification is passed;

Step 242a, the identity providing server 204 sends the ID to the RS 206 to request the user data list through the Diameter protocol, and uses the User Data attribute of the Push-Profile-Request message to carry the list of user data, wherein the ID is mapped to the User-Name attribute;

Step 244a, RS 206 returns the list of user data to the identity providing server 204 through the Diameter protocol, and uses the User Data attribute of the Push-Profile-Answer message to carry the list of user data, where the ID is mapped to the User-Name attribute;

Step 246a, the identity providing server 204 sends a list of user data to the UE 200 via HTTPS to request user authorization;

Step 248a, after the user is authorized, the UE 200 returns the user authorization data list to the identity providing server 204;

Step 250a, the identity providing server 204 generates a SAML Artifact (artifact) and an authorization code, and redirects the message to the UE 200 through HTTPS, and the UE 200 contacts the service providing server 208 according to the URL in the message header, wherein the SAML Artifact points to the structured structure of the SAML protocol message Data objects, SAML Artifact is relatively small and can be embedded in HTTP messages;

Step 252a, the service providing server 208 sends an HTTP GET request to the slave identity providing server 204 through HTTPS, and the message includes SAML Artifact and authorization code;

Step 254a, the identity providing server 204 returns an access token to the service providing server 208 through an HTTPS response message, and the token includes information such as a key and a key life cycle;

Step 256a, the service provider server 208 obtains the shared user data in batches from the RS 206 through the Diameter protocol, and uses the User Data attribute of the Diameter Push-Profile-Request/Answer message to obtain the shared user data in batches. RS 206 performs security protection on these data, such as confidentiality protection and integrity protection; after the service provision server 208 receives these user data, it reads these protected data with an access token;

Step 258a, the service providing server returns an HTTP 200 OK message to the UE 200 .

The above procedure is applicable to accesses that support EAP authentication, such as ADSL, WLAN, and Ethernet. For the 3G access process, the AKA authentication process is adopted, and MSK=CK||IK is set after the authentication process ends.

The identity and location separation network supports compatibility with existing terminals and access technologies, that is, no changes to terminals and access networks. In this case, the UE 200 accesses the network in an existing manner, and after passing the access authentication, the network assigns an access ID to the user equipment, and at this time, the user equipment and the network share a session key. The subsequent processing flow is exactly the same.

As shown in FIG. 5 , it is a signaling flowchart of Embodiment 2 of the user data sharing network in the present invention. This embodiment is also completed based on the architecture shown in FIG. 2 . For authentication, the service providing server 208 obtains the data shared by the user through the identity providing server 204, and the specific shared data is authorized by the user, and the real identity information of the user may not be disclosed to the service providing server.

The prerequisite for this process is that the link between UE 200 and ASN 202 has been established, UE 200 has been pre-configured with the user's identity ID or the network has assigned an ID to the user; the user data sharing process in the network includes:

Step 302, the UE 200 has passed the network access authentication, and after the authentication is completed, the UE 200 shares the session key with the identity providing server 204;

Step 302 may specifically include steps 220-230 in FIG. 4 , which will not be repeated here;

Step 304, the UE 200 accesses the services of the service providing server 208, and the service providing server 208 discovers the location of the identity providing server 204 through static configuration or dynamic;

Step 306, the service providing server 208 sends a redirect message to the UE 200, and the UE 200 sends the message to the identity providing server 204 according to the address of the identity providing server in the header of the redirect message;

Step 308, the identity providing server 204 sends an unauthorized message to the UE 200;

Step 310, the UE 200 sends a digest authentication message to the identity providing server 204, using the ID as the user name and the session key as the password;

Step 312, the identity providing server 204 verifies the identity of the user after receiving the digest authentication message;

Step 314, the identity providing server 204 sends a redirection message to the service providing server 208, and the message includes an index;

Step 316, the service providing server 208 sends a request to the identity providing server 204 to authenticate the identity of the user, and the message includes an index;

Step 318, the identity providing server 204 returns the authentication result to the service providing server 208;

Step 320, the service providing server 208 requests the user to share data to the identity providing server 204, and the message includes an index;

Step 322, the identity providing server 204 requests user data from the RS 208, and the request includes the user ID;

Step 324, RS 206 returns user data to the identity providing server;

Step 326, the identity providing server 204 sends a request to the UE 200, requesting user authorization data;

Step 328, the UE 200 returns the data authorized by the user to the identity providing server 204;

Step 330, the identity providing server 204 returns the data authorized by the user to the service providing server 208;

Step 332 , the service providing server 208 returns a result message to the UE 200 .

The following uses the HTTP and SAML protocols as examples to describe the flow of user data in the secure sharing network shown in Figure 5 in the form of an application example:

Step 302a, the UE 200 has passed the network access authentication, and after the authentication, the UE 200 shares the session key MSK with the identity providing server 204;

In step 304a, the UE 200 sends an HTTP request to the service providing server 208, and selects to log in through the identity providing server 204 on the service providing server 208. In the header field of the HTTP request, there is a URL (Uniform Resource Locator, Uniform Resource Locator) address of the identity providing server, and the service providing server 208 discovers the URL address of the identity providing server 204 through static configuration or dynamic discovery, carrying <lib:AuthnRequest> ;

Step 306a, the service providing server 208 sends an HTTP redirect message to the UE 200, and the UE 200 sends the message to the identity providing server 204 according to the URL address of the identity providing server in the header of the HTTP redirect message;

Step 308a, the identity providing server 204 sends an HTTP 401 Unauthorized message to the UE 200;

Step 310a, UE 200 sends an HTTP request message to the identity providing server 204, uses ID as the user name, MSK as the password, and performs HTTP Digest authentication;

Step 312a, after the identity providing server 204 receives the HTTP digest authentication message, it checks the local ID/MSK according to the ID, and performs the same HTTP Digest authentication algorithm. When the calculated results are consistent, the authentication is passed;

Step 314a, the identity providing server 204 generates a SAML Artifact, and sends an HTTPS redirection message to the service providing server 208, the message carries the SAML Artifact, wherein the SAML Artifact points to the structured data object of the SAML protocol message, and the SAML Artifact is relatively small and can be embedded in the HTTP message middle;

Step 316a, after the service providing server 208 receives the SAML Artifact, it sends an HTTPS request to the identity providing server 204, and the message carries the SAML Artifact; after receiving the message, the identity providing server 204 constructs a SAML assertion;

Step 318a, the identity providing server 204 returns the SAML assertion to the service providing server 208 via HTTPS;

Step 320a, after the service providing server 208 verifies the signature of the SAML assertion, it sends an HTTPS request to the identity providing server 204, requesting to share user data, and the message carries SAML Artifact;

Step 322a, the identity providing server 204 obtains the ID according to the SAML Artifact, and requests the user to share data with the RS206 through the Diameter Push-Profile-Request;

Step 324a, RS206 returns the user shared data to the identity providing server 204, and carries the user data through the User Data attribute of the Diameter Push-Profile-Answer message;

Step 326a, the identity providing server 204 sends an HTTPS request to the UE 200, requesting the user to authorize the shared data;

Step 328a, after the user authorizes the shared user data, the result is returned to the identity providing server 204;

Step 330a, after the user authorizes, the identity providing server 204 returns the data authorized by the user to the service providing server 208;

In step 332a, the service providing server 208 returns an HTTP 200 OK message to the UE 200 .

As shown in FIG. 6, it is a signaling flowchart of Embodiment 3 of user data in a secure shared network of the present invention. This flowchart is completed based on the architecture shown in FIG. 3. In this embodiment, the identity providing server 204 sends UE 200 performs access authentication, the service providing server 208 verifies the identity of the user, and then performs the process of safely sharing user data in the network.

The prerequisite for this process is that the link between UE 200 and ASN 202 has been established, UE 200 has been pre-configured with the user's identity ID or the network has assigned an ID to the user; the process includes:

Step 402, the UE 200 has passed the network access authentication, and after the authentication is completed, the UE 200 shares the session key with the identity providing server 204;

Step 404, the UE 200 accesses the services of the service providing server 208, and the service providing server 208 discovers the location of the identity providing server 204 through static configuration or dynamic;

Step 406, the service providing server 208 sends an unauthorized message to the UE 200;

Step 408, the UE 200 sends a digest authentication message to the service providing server 208, using the ID as the user name and the session key as the password;

Step 410, the service providing server 208 requests the identity providing server 204 for the security parameters of the user;

Step 412, the identity providing server 204 returns the user's security parameters to the service providing server 208;

Step 414, the service providing server 208 verifies the identity of the user, and the verification process is based on the received summary authentication message and the user's security parameters;

Step 416, the service providing server 208, the RS 206, the identity providing server 204 and the UE 200 perform a process of securely sharing user data in the network.

Wherein, the process of securely sharing data may be the same as steps 252-258 in FIG. 4, or may be the same as steps 320-332 in FIG. 5, and will not be repeated here.

The present invention also provides a service providing server, which includes:

A receiving module, configured to receive access from a user equipment (UE);

The obtaining module is used to directly or indirectly obtain the user-authorized shared data from the resource server (RS).

In addition, the service providing server may further include: a service access authentication module, configured to directly or indirectly complete service access authentication for the UE before the receiving module receives access from the UE.

Specifically, the service access authentication module is configured to obtain user security parameters from an identity providing server, and complete service access authentication for the UE according to the user security parameters; or, obtain the user security parameters from the identity providing server The identity provides the service authentication result of the UE by the server. Wherein, the user security parameter is obtained by the identity providing server according to the network's access authentication result for the UE; the service authentication result is obtained by the identity providing server according to the network's access authentication result for the UE. The authentication result is entered.

Further, the acquiring module is configured to acquire a token from the identity providing server, and directly acquire user-authorized user shared data from the RS according to the token; or acquire user authorization through the identity providing server users share data.

The service providing server can share data shared by users authorized by users in the network. The specific implementation process can be seen in FIGS. 4-6 , and will not be repeated here.

The present invention also provides an identity providing server, which includes:

A network access authentication module, configured to authenticate user equipment (UE) access to the network, and obtain user security parameters;

The service access authentication module is configured to complete the service access authentication of the UE according to the user security parameters obtained by the network access authentication module, and send the service access authentication result to the service providing server.

Wherein, the user security parameter includes a session key.

In addition, the identity providing server may further include: a sending module, configured to send the user security parameters obtained by the network access authentication module to the service providing server.

Further, the identity providing server may further include: a data sending module, configured to, after the service access authentication module sends the service access authentication result or the sending module sends the user security parameter to the service providing server, receiving the data request sent by the service providing server, obtaining user-authorized user shared data from a resource server (RS) according to the data request, and sending the user shared data to the service providing server. The data sending module is further configured to receive the command sent by the service providing server after the service access authentication module sends the service access authentication result or the sending module sends the user security parameter to the service providing server. A token request, sending a token to the service providing server according to the token request, so that the service providing server obtains user-authorized user sharing data from the RS according to the token.

The identity providing server lays the foundation for the UE to access the service providing server. At the same time, it also provides the service providing server with user-authorized user shared data, or provides the service providing server with a token, so that the service providing server can obtain the user according to the token. Authorized users share data.

The present invention also provides a user equipment (UE), where the UE includes:

An access module, used to access the service providing server;

The data processing module is configured to receive the user data authorization request sent by the identity providing server according to the data request sent by the service providing server, and send the request to the identity providing server according to the authorization result of the user data carried in the user data authorization request. Returns the user's shared data authorized by the user.

Specifically, the access module is used for accessing the service providing server after the UE successfully accesses the network by using the identifier and obtains the service access authentication of the service providing server.

After successfully accessing the network and obtaining the service access authentication of the service provider server, the UE can access the service provider server, and authorize the service provider server to share which data in the network, and then the service provider server can share the user information in the network. Users authorized by the UE share data, and the specific interaction process can be referred to in Figure 4-Figure 6.

Those skilled in the art can understand that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the above program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, and the like. Optionally, all or part of the steps in the foregoing embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiments may be implemented in the form of hardware, or may be implemented in the form of software function modules. The present invention is not limited to any specific combination of hardware and software.

The above embodiments are only used to illustrate the technical solutions of the present invention rather than limit them, and the present invention is described in detail with reference to preferred embodiments. Those skilled in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and all should be covered by the claims of the present invention.

Claims (15)

1. A method for sharing user data in a network comprising an identity providing server and a resource server RS, the method comprising: The service providing server receives the access of the user equipment UE; The service providing server directly or indirectly acquires user-authorized user shared data from the RS; Wherein, the service providing server directly obtaining user-authorized user shared data from the RS includes: The service providing server obtains a token from the identity providing server, and directly obtains user-authorized user sharing data from the RS according to the token; The service providing server indirectly obtaining user-authorized user-shared data from the RS includes: The service providing server acquires user-authorized shared data through the identity providing server. 2. The method according to claim 1, characterized in that: Before the service providing server receives the access of the UE, the method further includes: The service providing server directly or indirectly completes service access authentication for the UE. 3. The method according to claim 2, characterized in that: The service providing server directly completing the service access authentication of the UE includes: The service providing server obtains user security parameters from the identity providing server, and completes service access authentication for the UE according to the user security parameters. 4. The method according to claim 2, characterized in that: The indirect completion of the service access authentication of the UE by the service providing server includes: The service providing server obtains the service access authentication result of the identity providing server for the UE from the identity providing server. 5. The method according to claim 3, characterized in that: The user security parameter is obtained by the identity providing server according to the network's access authentication result of the UE. 6. The method according to claim 4, characterized in that: The service access authentication result is completed by the identity providing server according to the network's access authentication result for the UE. 7. A service providing server, the service providing server comprising: a receiving module, configured to receive an access from a user equipment UE; An acquisition module, configured to directly or indirectly acquire user-authorized user shared data from the resource server RS; Wherein, the obtaining module is used to obtain a token from an identity providing server, and directly obtain the user-authorized user sharing data from the RS according to the token; or obtain the user-authorized user sharing data through the identity providing server. data. 8. The service providing server according to claim 7, characterized in that, the service providing server further comprises: The service access authentication module is configured to directly or indirectly complete the service access authentication of the UE before the receiving module receives the access of the UE. 9. The service providing server according to claim 8, characterized in that: The service access authentication module is configured to obtain user security parameters from an identity providing server, and complete service access authentication for the UE according to the user security parameters; or obtain the identity provisioning server from the identity providing server. The server's service authentication result for the UE. 10. The service providing server according to claim 9, characterized in that: The user security parameter is obtained by the identity providing server according to the network's access authentication result for the UE; or The service authentication result is completed by the identity providing server according to the network's access authentication result for the UE. 11. An identity providing server, the identity providing server comprising: A network access authentication module, configured to authenticate user equipment UE access to the network and obtain user security parameters; A service access authentication module, configured to complete the service access authentication of the UE according to the user security parameters obtained by the network access authentication module, and send the service access authentication result to the service provider server; A sending module, configured to send the user security parameters obtained by the network access authentication module to the service providing server; The data sending module is configured to receive the data request sent by the service providing server after the service access authentication module sends the service access authentication result or the sending module sends the user security parameter to the service providing server, according to The data request obtains user-authorized user-shared data from the resource server RS, and sends the user-shared data to the service providing server. 12. The identity providing server according to claim 11, characterized in that: The user security parameters include a session key. 13. The identity providing server according to claim 11, characterized in that: The data sending module is further configured to receive the command sent by the service providing server after the service access authentication module sends the service access authentication result or the sending module sends the user security parameter to the service providing server. A token request, sending a token to the service providing server according to the token request, so that the service providing server obtains user-authorized user sharing data from the RS according to the token. 14. A user equipment UE, the UE comprising: An access module, used to access the service providing server; The data processing module is configured to receive the user data authorization request sent by the identity providing server according to the data request sent by the service providing server, and send the request to the identity providing server according to the authorization result of the user data carried in the user data authorization request by the user. Returns the user's shared data authorized by the user. 15. The UE according to claim 14, characterized in that: The access module is used for accessing the service providing server after the UE successfully accesses the network by using the identifier and obtains the service access authentication of the service providing server.