Authentication method and authentication device for performing group authentication using a group key

• US 9,137,226 B2
• Filed: 04/27/2011
• Issued: 09/15/2015
• Est. Priority Date: 04/27/2010
• Status: Active Grant

• Current Assignee: China Mobile Communications Corporation (China Mobile Communications Group Co., Ltd.)
• Original Assignee: China Mobile Communications Corporation (China Mobile Communications Group Co., Ltd.)
• Inventors: Zhu, Hongru, Qi, Minpeng, Jiao, Wenjuan
• Primary Examiner(s): Lewis, Lisa
• Assistant Examiner(s): Tsang, Henry
• Application Number:
  US13/643,958
• Publication Number:
  US 20130046983A1
• Time in Patent Office: 1,602 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

An authentication method and device, authentication centre and system are provided. The method comprises: receiving at least one access request and obtaining sub-key information from the access request; generating a group key according to the obtained sub-key information, and interacting with the network side according to the group key to perform the group authentication. The solution can solve the problem that the one-to-one authentication causes network load in the present art, implement the authentication of multiple nodes at one time, reduce network resources and the network load of the server, and can be appropriate for the authentication of the terminal nodes in the internet of things, and can greatly improve the availability of services in the internet of things.

Claims

1. An authentication method for performing group authentication using a group key, comprising:

receiving, by a user equipment, at least one access request and acquiring sub-key information from the access request; and

generating, by the user equipment, a group key according to the acquired sub-key information,

wherein the generating the group key comprises;

selecting, by the user equipment, t pieces of the sub-key information from all of the acquired sub-key information and locally stored sub-key information to generate the group key, wherein t is less than or equal to a total number n of nodes in the group;

marking, by the user equipment, the node corresponding to the sub-key information selected for generating the group key; and

interacting, by the user equipment, with a network according to the group key to perform a group authentication,

wherein the interacting with a network according to the group key to perform a group authentication comprises;

receiving, by the user equipment, a feedback message of a group authentication request from the network;

generating, by the user equipment, a group authentication response to be sent to the network according to the feedback message and the group key;

sending, by the user equipment, node information of the access request to the network if the group authentication is passed, wherein the node information includes marking information; and

performing a validity verification on the node information by the network according to prestored identification information of the group and the node in the group, wherein;

the identification information of the node comprises;

an ID of the node and the corresponding sub-key information; and

the node information comprises;

the ID of the node, the corresponding sub-key information, and the marking information.

2. An authentication method performing group authentication using a group key, comprising:

storing, by a home subscriber server, group information and corresponding group key information in a network; and

performing, by the home subscriber server, a group authentication of a user equipment according to the group key information,

wherein the performing the group authentication of the user equipment according to the group key information comprises;

receiving a group authentication request which includes the group information from the user equipment by the network;

searching for the corresponding group key information according to the group authentication request, generating a feedback message, and sending the feedback message to the user equipment; and

receiving a group authentication response of the user equipment, and verifying the group authentication response according to the group key; and

wherein after the verification of the group authentication response according to the group key is passed, the method further comprises;

receiving node information sent from the user equipment; and

performing a validity verification on the node information according to prestored identification information of the group and a node in the group, wherein;

the identification information of the node comprises;

an ID of the node and corresponding sub-key information; and

the node information comprises;

the ID of the node, the corresponding sub-key information and marking information, wherein the marking information is information obtained by marking the node which corresponds to the sub-key information selected for generating the group key by the user equipment.

3. An authentication device performing group authentication using a group key, comprising:

a processor and a memory, wherein the memory comprises;

an interface program configured to receive at least one access request;

a key generation program configured to acquire sub-key information from the received access request, and generate a group key according to the acquired sub-key information; and

a group authentication program configured to interact with a network according to the group key to perform a group authentication, wherein the group authentication program comprises;

a request program configured to generate a group authentication request and receive a feedback message of the group authentication request from the network; and

a response program configured to generate a group authentication response to be sent to the network according to the feedback message and the group key;

wherein the key generation program comprises;

a key recovery program configured to select t pieces of the sub-key information from all of the acquired sub-key information and locally stored sub-key information to generate the group key, wherein t is less than or equal to a total number n of terminal nodes in the group; and

a marking program configured to mark the node corresponding to the sub-key information selected for generating the group key, and add marking information into node information to be sent to the network if the group authentication is passed,

wherein the node information comprises;

an ID of the node, the corresponding sub-key information and the marking information.