Authentication method, system, server, and client

• US 8,392,717 B2
• Filed: 05/07/2010
• Issued: 03/05/2013
• Est. Priority Date: 11/08/2007
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Chai, Xiaoqian, Gao, Hongtao, Li, Kepeng, Tian, Linyi
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US12/775,937
• Publication Number:
  US 20100217997A1
• Time in Patent Office: 1,033 Days
• Field of Search: 726/4, 726/7, 726/8, 713/168, 713/181, 713/194, 713/150, 380/259, 380/274, 455/404.1, 455/414.1, 455/414.2, 375/355, 375/376
• US Class Current: 713/181
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An authentication method is disclosed herein. The method includes: by a server, using a Trigger message nonce to generate a Trigger message, and sending the generated Trigger message to a client so that the client can extract the Trigger message nonce; after determining that the Trigger message nonce is valid, using the Trigger message nonce to generate a digest, and authenticating the Trigger message generated by using the Trigger message nonce; after the authentication succeeds, sending a session request to the server indicated by the Trigger message, where the session request carries a session ID. The corresponding system, server and client are disclosed herein. The present invention makes the authentication process more secure through the client and the server based on the DS or DM protocol.

Claims

1. In a client device configured to establish a session with a server, a method for establishing the session when the server requests the client to initiate the session using a Trigger message, the method comprising:

receiving a Trigger message from a server that includes a session ID identifying a session to be triggered, a system time of the server and a first digest;

determining that a difference between a local time of the client and the system time of the server is within a predetermined threshold;

calculating a second digest using the system time of the server;

authenticating the first digest carried in the Trigger message by comparing the first digest and the second digest; and

based on the authentication, sending a session request including the session ID carried in the Trigger message to the server.

2. The method of claim 1, wherein the session request carries authentication information, which includes a Digest generated using a client nonce.

3. A client device configured to establish a session with a server, comprising a receiver, a transmitter, a processor and computer executable instructions stored on a non-transitory computer readable storage medium, wherein:

the receiver is configured to receive a Trigger message from a server that includes a session ID identifying a session to be triggered, a system time of a server and a first digest;

the computer executable instructions stored on a non-transitory computer readable storage medium are configured such that, when executed by the processor, cause the client device to,

determine that a difference between a local time of the client and the system time of the server is within a predetermined threshold,

calculate a second digest using the system time of the server, and

authenticate the first digest carried in the Trigger message by comparing the first digest and the second digest; and

the transmitter is configured to send a session request including the session ID carried in the Trigger message to the server based on the authentication.

4. The client device of claim 3, wherein the session request carries authentication information including a Digest generated using a client nonce.