CN102065069A - Method and system for authenticating identity and device - Google Patents

Abstract

The embodiment of the invention discloses a method for authenticating identity. The method comprises the following steps: receiving identity of user equipment (UE) submitted by an application server in the non-internet protocol (IP) multimedia subsystem (IMS) domain and inquiring whether key information corresponding to the identity exists and is in the valid period according to the identity; and if the key information exists and is in the valid period, inquiring whether the UE has been registered in the IMS domain, if no, returning the key information and the valid period of the key information to the application server in the non-IMS domain and ensuring the application server in the non-IMS domain to use the key information and the valid period of the key information to carry out identity authentication with the UE. The embodiment of the invention achieves unified authentication and state synchronization between IMS application and non-IMS application. The embodiment of the invention also discloses a device and system applying the method.

Description

An identity authentication method, device and system

technical field

The present invention relates to the field of communication technology, in particular to an identity authentication method, device and system.

Background technique

With the development of communication networks and the promotion of various communication services, 3GPP (3rd Generation Partnership Project, the third generation mobile communication standardization partner organization) launched the IMS (IPMultimedia Subsystem, Internet Protocol Multimedia Subsystem) architecture, which can provide a standardized Open structure to realize a variety of IP (Internet Protocol, Internet Protocol) multimedia applications, providing a richer service experience.

3GPP also introduced ISIM (IMS Subscriber Identity Module, Internet Protocol Multimedia Subsystem) for IMS access, and its specific entities include CSCF (Call Session Control Function, call state control function) and HSS (Home Subscriber Server, home subscriber server ) functional entity, wherein, CSCF includes three logical entities of Serving CSCF (S-CSCF), Proxy CSCF (P-CSCF) and Inquiring CSCF (I-CSCF), and the above logical entities may be located on different physical devices or be Different functional modules in the same physical device. S-CSCF is the service switching center of IMS, which is used to perform session control, maintain session status, manage user information and generate billing information, etc.; P-CSCF is the access point for terminal users to access IMS, and is used to complete user registration, QoS (Quality of Service) control and security management, etc.; I-CSCF is responsible for the coordination and management between IMS domains, the allocation of S-CSCF, the external hiding of network topology and configuration information, and the generation of billing data. HSS (Home Subscriber Server, Home Subscriber Server) saves user subscription data, which is used to support the processing of calls and sessions by network entities, and ISIM data is stored in HSS.

Due to the introduction of the IMS, more and more service platforms are carried on the IMS, and various services such as calls and video conferencing are provided by using the characteristics of the IMS. In the IMS service, UE (User Equipment) must interact with the service platform AS (Application Server, application server) through SIP (Session Initiation Protocol) messages, but UE also needs to interact with non-IMS domain servers. For example, after the IMS enterprise communication assistant client logs in to IMS, it also needs to access the group management server (XDMS) to obtain the user's group information, and XDMS can only use XCAP (XML Configuration Access Protocol, XML Configuration Access Protocol), and HTTP (Hypertext Transfer Protocol, Hypertext Transfer Protocol) 1.1 bearer interacts directly with the terminal (client), and the communication process cannot pass through the IMS Core (IP Multimedia Subsystem Core, Internet Protocol Multimedia Subsystem Core Network). The XDMS server must first verify the user identity Confirmation is required before an XML (Extensible Markup Language, Extensible Markup Language) document operation can be initiated. In addition, after the IMS client logs in to the IMS, it needs to access the self-service portal website, and the access to the portal website also needs to use the HTTP protocol to directly interact with the client. The interaction process does not go through IMSCore, and the server must first confirm the user's identity before Personalized display.

In the process of realizing the present invention, the inventor finds that the prior art has at least the following defects:

Since the authentication mechanisms of the IMS domain and non-IMS domain are different, for example, in the IMS domain, IMS Digest (classification) and IMS AKA (Authentication and Key Agreement, authentication and key agreement) are mainly used for authentication. Authentication messages use sip messages; non-IMS applications mainly use protocols such as HTTP Digest, GBA (Generic Bootstrapping Architecture, general bootstrapping architecture), TLS (Transport Layer Security, secure transport layer protocol). Interworking; user subscription and authentication data in the IMS domain are mainly stored in the IMS HSS. HSS is the core network element, and its authentication data cannot be accessed by third-party non-IMS domain applications. User authentication prevents MS domain applications and non-IMS domain applications from sharing the authentication status, achieving unified authentication.

Contents of the invention

Embodiments of the present invention provide an identity authentication method, device and system for realizing unified authentication and state synchronization between IMS applications and non-IMS applications.

The embodiment of the present invention provides an identity authentication method, comprising the following steps:

Receiving the identity of the user equipment submitted by the non-Internet Protocol Multimedia Subsystem IMS domain application server, querying according to the identity whether there is key information corresponding to the identity and the key information is within the validity period;

If there is key information corresponding to the identity and the key information is within the validity period, query whether the user equipment is registered in the IMS domain, and if the query result is yes, apply to the non-IMS domain The server returns the key information and the validity period of the key information, so that the non-IMS domain application server uses the key information and the validity period of the key information to perform identity authentication with the user equipment.

Preferably, before receiving the identity of the user equipment submitted by the non-IMS domain application server, it also includes:

receiving a Session Initiation Protocol SIP message from the user equipment, and obtaining a registration parameter carried in the SIP message, the registration parameter being generated by the user equipment according to a public key;

Use the private key saved by itself to decrypt the obtained registration parameters, if the decryption is successful, save the key information corresponding to the identity of the user equipment, and return a registration success message to the user equipment, so that the user The device saves the key information and accesses the non-IMS domain application server according to the key information.

Preferably, before receiving the SIP message from the user equipment, it also includes:

The user equipment performs an IMS authentication process and registers in the IMS domain;

When the user equipment accesses the non-IMS domain application, check whether there is key information locally, if not, then randomly generate key information, and generate registration parameters according to the key information and public key, and send the key information through SIP message The above registration parameters.

Preferably, before the user equipment generates the registration parameters according to the key information and the public key, it further includes:

generating a public-private key pair, saving the private key in the public-private key pair, and disclosing the public key in the public-private key pair to the user equipment.

Preferably, the user equipment accesses the non-IMS domain application server according to the key information, specifically including:

The user equipment sends an access request to the non-IMS domain application server, and receives a challenge message returned by the non-IMS domain application server;

The user equipment returns a challenge response message to the non-IMS domain application server according to its own identity and the key information.

Preferably, the non-IMS domain application server uses the key information and the validity period of the key information to perform identity authentication with the user equipment, specifically including:

The non-IMS domain application server uses the key information to verify whether the challenge response message from the user equipment is correct, and if correct, returns an authentication success message to the user equipment;

The user equipment receives the authentication success message from the non-IMS domain application server, verifies whether the authentication information contained in the authentication success message is correct, and if correct, completes the two-way authentication with the non-IMS domain application server, and passes The secure channel interacts with the non-IMS domain application server.

The embodiment of the present invention also provides an authentication gateway, including:

A receiving module, configured to receive the identity of the user equipment submitted by the non-IMS domain application server;

A query module, configured to query whether there is key information corresponding to the identity according to the identity received by the receiving module and the key information is within the validity period, and if the key information corresponding to the identity is found to exist And when the key information is within the validity period, query whether the user equipment is registered in the IMS domain;

A sending module, configured to return the key information and the validity period of the key information to the non-IMS domain application server when the query module finds that the user equipment is registered in the IMS domain, so that the The non-IMS domain application server performs identity authentication with the user equipment by using the key information and the validity period of the key information.

Preferably, the receiving module is further configured to receive a SIP message from the user equipment, and obtain a registration parameter carried in the SIP message, the registration parameter is generated by the user equipment according to a public key;

The authentication gateway also includes:

A decryption module, configured to decrypt the registration parameters obtained by the receiving module by using the private key stored by itself;

The sending module is further configured to store key information corresponding to the identity of the user equipment when the decryption module successfully decrypts, and return a registration success message to the user equipment, so that the user equipment stores the key information. key information and access the non-IMS domain application server according to the key information.

Preferably, the authentication gateway further includes:

A generating module, configured to generate a public-private key pair, save the private key in the public-private key pair for use by the decryption module, and disclose the public key in the public-private key pair to the user equipment. The embodiment of the present invention also provides an identity authentication system, including:

The user equipment is configured to send an access request to a non-IMS domain application server, and receive a challenge message returned by the non-IMS domain application server; return a challenge to the non-IMS domain application server according to its own identity and the key information response message;

The non-IMS domain application server is configured to submit the identity of the user equipment to the authentication gateway, receive the key information and the validity period of the key information from the authentication gateway, and use the key information and the validity period of the key information Perform identity authentication with the user equipment during the validity period;

An authentication gateway, configured to receive the identity of the user equipment submitted by the non-IMS domain application server, and query according to the identity whether there is key information corresponding to the identity and the key information is within the validity period; if there is The key information corresponding to the identity and the key information is within the validity period, query whether the user equipment is registered in the IMS domain, and if the query result is yes, return to the non-IMS domain application server The key information and the validity period of the key information.

Preferably, the authentication gateway is further configured to receive a Session Initiation Protocol SIP message from the user equipment, and obtain a registration parameter carried in the SIP message, the registration parameter is generated by the user equipment according to a public key; using its own The saved private key decrypts the obtained registration parameters, if the decryption is successful, saves the key information corresponding to the identity of the user equipment, returns a registration success message to the user equipment, and makes the user equipment save The key information and access the non-IMS domain application server according to the key information.

Preferably, the user equipment is also used to perform an IMS authentication process and register in the IMS domain; when accessing a non-IMS domain application, check whether there is key information locally, and if not, randomly generate the key information, And generate registration parameters according to the key information and the public key, and send the registration parameters through SIP messages.

Compared with the prior art, the embodiment of the present invention has the following advantages: the embodiment of the present invention utilizes the existing security mechanism of the IMS to provide security services for the business layer, enhances the security between the UE and the AS, and does not become a system The security bottleneck; within the validity period of the key information, there is no need to repeat the registration process, which improves the efficiency of business execution.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments of the present invention or the prior art. Obviously, the accompanying drawings in the following description These are only some embodiments of the present invention, and those skilled in the art can also obtain other drawings based on these drawings without any creative effort.

Fig. 1 is a flow chart of an identity authentication method in an embodiment of the present invention;

FIG. 2 is a flow chart of identity authentication in the application scenario of the embodiment of the present invention;

FIG. 3 is a flow chart of AUG registration in the application scenario of the embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an authentication gateway in an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of an identity authentication system in an embodiment of the present invention.

Detailed ways

In the technical solution provided by the embodiment of the present invention, the core idea is to add an AUG (authentication gateway) network element in the system. There is a SIP interface between the AUG network element and the CSCF in the IMS domain, and a SIP interface between the AUG network element and the AS in the non-IMS domain. HTTP interface. The AUG network element receives the identity of the user equipment submitted by the non-IMS domain application server, and queries whether there is key information corresponding to the identity according to the identity and the key information is within the validity period; if the identity exists Corresponding key information and the key information is within the validity period, query whether the user equipment is registered in the IMS domain, and if the query result is yes, return the key to the non-IMS domain application server information and the validity period of the key information, so that the non-IMS domain application server uses the key information and the validity period of the key information to perform identity authentication with the user equipment.

The following will clearly and completely describe the technical solutions of the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

As shown in Figure 1, it is a flow chart of an identity authentication method in an embodiment of the present invention, including the following steps:

Step 101: Receive the identity of the user equipment submitted by the non-IMS domain application server, and query whether there is key information corresponding to the identity and the key information is within the validity period according to the identity. If there is key information corresponding to the identity and the key information is within the validity period, perform step 103; otherwise, perform step 102.

Specifically, the authentication gateway generates a public-private key pair in advance, saves the private key in the public-private key pair, and discloses the public key in the public-private key pair to the user equipment.

The user equipment performs an IMS authentication process and registers in the IMS domain; when the user equipment accesses a non-IMS domain application, checks whether there is key information locally, if not, randomly generates key information, and according to the encryption key information The key information and the public key are used to generate registration parameters, and the registration parameters are sent through SIP messages.

The authentication gateway receives the Session Initiation Protocol SIP message from the user equipment, acquires the registration parameter carried in the SIP message, and the registration parameter is generated by the user equipment according to the public key; The registration parameters are decrypted, if the decryption is successful, save the key information corresponding to the identity of the user equipment, and return a registration success message to the user equipment, so that the user equipment saves the key information and according to the Key information to access non-IMS domain application servers.

The user equipment accessing the non-IMS domain application server according to the key information specifically includes: the user equipment sends an access request to the non-IMS domain application server, and receives the challenge message returned by the non-IMS domain application server; The identity and the key information return a challenge response message to the non-IMS domain application server.

Step 102, returning error information to the non-IMS domain application server.

Step 103, inquire whether the user equipment is registered in the IMS domain.

If the query result is yes, execute step 104; otherwise, execute step 102.

Step 104: Return the key information and the valid period of the key information to the non-IMS domain application server, so that the non-IMS domain application server uses the key information and the valid period of the key information to perform identity authentication with the user equipment.

Specifically, the non-IMS domain application server uses the key information and the validity period of the key information to perform identity authentication with the user equipment, specifically including: the non-IMS domain application server uses the key information to verify the challenge response message from the user equipment Whether it is correct, if correct, return an authentication success message to the user equipment; the user equipment receives the authentication success message from the non-IMS domain application server, verifies whether the authentication information contained in the authentication success message is correct, if correct, The two-way authentication with the non-IMS domain application server is completed, and the non-IMS domain application server interacts with the non-IMS domain application server through a secure channel.

The embodiment of the present invention utilizes the existing security mechanism of IMS to provide security services for the service layer, which enhances the security between UE and AS, and will not become a security bottleneck of the system; within the validity period of the key information, there is no need to repeat Executing the registration process improves the efficiency of business execution.

The identity authentication method in the embodiment of the present invention will be described in detail below in combination with specific application scenarios.

As shown in Figure 2, it is a flow chart of identity authentication in the application scenario of the embodiment of the present invention, which specifically includes the following steps:

Step 201, the UE starts the non-IMS client to access the non-IMS domain application server AS2, and sends an HTTP Request (request) message to AS2.

Among them, the non-IMS domain application server AS2 can be an HTTP server, and the HTTP Request message does not pass through the IMS core.

Step 202, AS2 initiates HTTP Digest mutual authentication, and returns challenge information to UE.

Specifically, after receiving the HTTP Request message, AS2 requires the UE to perform HTTP Digest two-way authentication, and returns a 401 unauthorized HTTP Digest challenge message. The WWW-Authenticate Header parameter in the challenge message contains AS2's challenge information for the UE.

In step 203, the UE returns a challenge response message to AS2.

Specifically, UE uses IMPU (IP Multimedia Public Identity, Internet Protocol Multimedia Public Identity) as username (user name), key (key) as password (password) to calculate response (response), and returns a challenge response containing response through HTTP request message, and the Authorization (authentication) parameter Header in the response message contains the challenge response of the UE.

In step 204, AS2 submits the IMPU to the AUG, and queries the state of the UE corresponding to the IMPU in the IMS domain and related key information.

In step 205, the AUG inquires through the IMPU whether the UE has registered locally and the key is within the validity period. If the query result is yes, execute step 206; otherwise, return an error message to AS2.

In step 206, the AUG queries the HSS whether the registration status of the UE is registered. If the query result is yes, execute step 207, and if the query result is no, return an error message to AS2.

In step 207, the AUG returns the key and key validity period to AS2.

In step 208, AS2 uses the key to verify whether the response in the challenge response message from the UE is correct, and if it is correct, executes step 210; otherwise, returns an error message to the UE.

In step 209, AS2 returns an authentication success message to the UE.

Specifically, if AS2 verifies that the response is correct, it indicates that the UE has passed the access, AS2 calculates the challenge response, and returns a 200OK message to the UE, and the Authentication-InfoHeader parameter in the 200OK message contains the challenge response of AS2.

In step 210, the UE verifies whether the authentication success message is correct, and if it is correct, executes step 211; otherwise, returns an error message to AS2.

Specifically, the UE verifies whether the Authentication-Info Header parameter is correct.

Step 211, UE and AS2 complete mutual authentication, and interact with AS2 through the secure channel of HTTP Digest.

The embodiment of the present invention utilizes the existing security mechanism of IMS to provide security services for the service layer, which enhances the security between UE and AS, and will not become a security bottleneck of the system; within the validity period of the key information, there is no need to repeat Executing the registration process improves the efficiency of business execution.

Before the above application scenarios, the UE needs to register with the AUG first, so as to access the non-IMS domain application server. As shown in Figure 3, it is a flow chart of AUG registration in the application scenario of the embodiment of the present invention, which specifically includes the following steps:

In step 301, the UE starts an IMS client, executes an IMS authentication process, and performs IMS registration.

Specifically, the user opens the IMS client and logs in to the IMS network, and the IMS client will perform an IMS authentication process between the UE, CSCF, and HSS, and complete the IMS registration.

In step 302, the UE interacts with the IMS application service AS1.

Step 303, the IMS client of the UE triggers access to the non-IMS application.

In step 304, the UE checks whether the key exists locally and the key is within the validity period, and if the check result is yes, then execute step 310; otherwise, execute step 305.

In step 305, the UE randomly generates a key, and encrypts it using the PubKey (public key) of the AUG to generate Ekey=E(PubKey, key).

Among them, E is the encryption algorithm of RSA, AUG pre-generates 1024bits RSA (Rivest-Shamir-Adleman, public key algorithm) public-private key pair, the public-private key pair includes PriKey (private key) and PubKey, AUG stores PriKey secretly, The PubKey is disclosed to the IMS client and preset in the UE.

In step 306, the UE sends the Ekey as a parameter of the AUG registration message to the AUG through a sip message, requesting AUG registration.

In step 307, the AUG uses the PriKey to decrypt the Ekey, and if the decryption is successful, execute step 309; otherwise, return an error message to the UE.

Step 308, the AUG saves the key corresponding to the IMPU of the UE, and returns a sip 200 OK message to the UE.

In step 309, the UE saves the key as a temporary secret parameter for communicating with the AUG.

Step 310, the UE starts a non-IMS client to access AS2, and sends an HTTP Request message to AS2.

The embodiment of the present invention utilizes the existing security mechanism of IMS to provide security services for the service layer, which enhances the security between UE and AS, and will not become a security bottleneck of the system; within the validity period of the key information, there is no need to repeat Executing the registration process improves the efficiency of business execution.

Embodiments of the present invention provide identity authentication methods and application scenarios in the above implementation manners, and accordingly, embodiments of the present invention also provide devices and systems for applying the above identity authentication methods.

As shown in Figure 4, it is a schematic structural diagram of an authentication gateway in an embodiment of the present invention, including:

The receiving module 410 is configured to receive the identity of the user equipment submitted by the non-IMS domain application server.

The above-mentioned receiving module 410 is further configured to receive a SIP message from the user equipment, and obtain a registration parameter carried in the SIP message, and the registration parameter is generated by the user equipment according to a public key.

The query module 420 is configured to query whether the key information corresponding to the identity exists according to the identity received by the receiving module 410 and the key information is within the validity period, and if the key information corresponding to the identity is found to exist And when the key information is within the validity period, query whether the user equipment is registered in the IMS domain.

The sending module 430 is configured to return the key information and the validity period of the key information to the non-IMS domain application server when the query module 420 finds that the user equipment is registered in the IMS domain, so that the The non-IMS domain application server performs identity authentication with the user equipment by using the key information and the validity period of the key information.

The above-mentioned sending module 430 is further configured to save the key information corresponding to the identity of the user equipment when the decryption by the decryption module 440 is successful, and return a successful registration message to the user equipment, so that the user equipment saves the key information and access the non-IMS domain application server according to the key information. The generation module generates a public-private key pair, saves the private key in the public-private key pair for use by the decryption module, and discloses the public key in the public-private key pair to the user equipment.

The decryption module 440 is configured to decrypt the registration parameters acquired by the receiving module 410 by using the private key stored by itself.

The generation module 450 is configured to generate a public-private key pair, save the private key in the public-private key pair for use by the decryption module 440, and disclose the public key in the public-private key pair to the user equipment.

The embodiment of the present invention utilizes the existing security mechanism of IMS to provide security services for the service layer, which enhances the security between UE and AS, and will not become a security bottleneck of the system; within the validity period of the key information, there is no need to repeat Executing the registration process improves the efficiency of business execution.

As shown in Figure 5, it is a schematic structural diagram of an identity authentication system in an embodiment of the present invention, including:

The user equipment 510 is configured to send an access request to the non-IMS domain application server 520, and receive a challenge message returned by the non-IMS domain application server 520; Server 520 returns a challenge response message.

The above user equipment 510 is also used to execute the IMS authentication process and register in the IMS domain; when accessing non-IMS domain applications, check whether there is key information locally, if not, randomly generate key information, and according to the Generate registration parameters based on the key information and public key, and send the registration parameters through SIP messages.

The non-IMS domain application server 520 is configured to submit the identity of the user equipment to the authentication gateway 530, receive the key information and the validity period of the key information from the authentication gateway 530, and use the key information and the encryption key The validity period of the key information is used for identity authentication with the user equipment 510.

The authentication gateway 530 is configured to receive the identity of the user equipment 510 submitted by the non-IMS domain application server 520, and query whether there is key information corresponding to the identity and the key information is within the validity period according to the identity ; If there is key information corresponding to the identity and the key information is within the validity period, query whether the user equipment 510 is registered in the IMS domain, and if the query result is yes, send the non-IMS The domain application server 520 returns the key information and the validity period of the key information.

The aforementioned authentication gateway 530 is also configured to receive a SIP message from the user equipment 510, and acquire registration parameters carried in the SIP message, the registration parameters are generated by the user equipment 510 according to the public key; key to decrypt the obtained registration parameters, if the decryption is successful, save the key information corresponding to the identity of the user equipment 510, and return a registration success message to the user equipment 510, so that the user equipment 510 saves the access the non-IMS domain application server according to the key information.

The embodiment of the present invention utilizes the existing security mechanism of IMS to provide security services for the service layer, which enhances the security between UE and AS, and will not become a security bottleneck of the system; within the validity period of the key information, there is no need to repeat Executing the registration process improves the efficiency of business execution.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is a better implementation Way. Based on this understanding, the technical solution of the embodiment of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for Make a terminal device (which may be a mobile phone, a personal computer, a server, or a network device, etc.) execute the methods described in various embodiments of the present invention.

The above descriptions are only preferred implementations of the present invention. It should be pointed out that for those skilled in the art, some improvements and modifications can be made without departing from the principle of the embodiments of the present invention. These improvements and Retouching should also be considered within the protection scope of the present invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment according to the description in the embodiment, or can be located in one or more devices different from the embodiment according to corresponding changes. The modules in the above embodiments can be integrated or deployed separately; they can be combined into one module, or further split into multiple sub-modules.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

The above disclosures are only a few specific embodiments of the present invention, however, the present invention is not limited thereto, and any changes conceivable by those skilled in the art shall fall within the protection scope of the present invention.

Claims (12)

1. A method for identity authentication, characterized in that, comprising the following steps: Receiving the identity of the user equipment submitted by the non-Internet Protocol Multimedia Subsystem IMS domain application server, querying according to the identity whether there is key information corresponding to the identity and the key information is within the validity period; If there is key information corresponding to the identity and the key information is within the validity period, query whether the user equipment is registered in the IMS domain, and if the query result is yes, apply to the non-IMS domain The server returns the key information and the validity period of the key information, so that the non-IMS domain application server uses the key information and the validity period of the key information to perform identity authentication with the user equipment. 2. The method according to claim 1, wherein, before receiving the identity of the user equipment submitted by the non-IMS domain application server, further comprising: receiving a Session Initiation Protocol SIP message from the user equipment, and obtaining a registration parameter carried in the SIP message, the registration parameter being generated by the user equipment according to a public key; Use the private key saved by itself to decrypt the obtained registration parameters, if the decryption is successful, save the key information corresponding to the identity of the user equipment, and return a registration success message to the user equipment, so that the user The device saves the key information and accesses the non-IMS domain application server according to the key information. 3. The method according to claim 2, further comprising: before receiving the SIP message from the user equipment: The user equipment performs an IMS authentication process and registers in the IMS domain; When the user equipment accesses the non-IMS domain application, check whether there is key information locally, if not, then randomly generate key information, and generate registration parameters according to the key information and public key, and send the key information through SIP message The above registration parameters. 4. The method according to claim 3, wherein, before the user equipment generates registration parameters according to the key information and the public key, further comprising: generating a public-private key pair, saving the private key in the public-private key pair, and disclosing the public key in the public-private key pair to the user equipment. 5. The method according to claim 2, wherein the user equipment accesses the non-IMS domain application server according to the key information, specifically comprising: The user equipment sends an access request to the non-IMS domain application server, and receives a challenge message returned by the non-IMS domain application server; The user equipment returns a challenge response message to the non-IMS domain application server according to its own identity and the key information. 6. The method according to claim 5, wherein the non-IMS domain application server uses the key information and the validity period of the key information to perform identity authentication with the user equipment, specifically comprising: The non-IMS domain application server uses the key information to verify whether the challenge response message from the user equipment is correct, and if correct, returns an authentication success message to the user equipment; The user equipment receives the authentication success message from the non-IMS domain application server, verifies whether the authentication information contained in the authentication success message is correct, and if correct, completes the two-way authentication with the non-IMS domain application server, and passes The secure channel interacts with the non-IMS domain application server. 7. An authentication gateway, characterized in that, comprising: A receiving module, configured to receive the identity of the user equipment submitted by the non-IMS domain application server; A query module, configured to query whether there is key information corresponding to the identity according to the identity received by the receiving module and the key information is within the validity period, and if the key information corresponding to the identity is found to exist And when the key information is within the validity period, query whether the user equipment is registered in the IMS domain; A sending module, configured to return the key information and the validity period of the key information to the non-IMS domain application server when the query module finds that the user equipment is registered in the IMS domain, so that the The non-IMS domain application server performs identity authentication with the user equipment by using the key information and the validity period of the key information. 8. The authentication gateway according to claim 7, characterized in that, The receiving module is further configured to receive a SIP message from the user equipment, and obtain a registration parameter carried in the SIP message, the registration parameter is generated by the user equipment according to a public key; The authentication gateway also includes: A decryption module, configured to decrypt the registration parameters obtained by the receiving module by using the private key stored by itself; The sending module is further configured to store key information corresponding to the identity of the user equipment when the decryption module succeeds in decrypting, and return a registration success message to the user equipment, so that the user equipment stores the key information. key information and access the non-IMS domain application server according to the key information. 9. The authentication gateway according to claim 8, further comprising: A generating module, configured to generate a public-private key pair, save the private key in the public-private key pair for use by the decryption module, and disclose the public key in the public-private key pair to the user equipment. 10. An identity authentication system, characterized in that it comprises: The user equipment is configured to send an access request to a non-IMS domain application server, and receive a challenge message returned by the non-IMS domain application server; return a challenge to the non-IMS domain application server according to its own identity and the key information response message; The non-IMS domain application server is configured to submit the identity of the user equipment to the authentication gateway, receive the key information and the validity period of the key information from the authentication gateway, and use the key information and the validity period of the key information Perform identity authentication with the user equipment during the validity period; An authentication gateway, configured to receive the identity of the user equipment submitted by the non-IMS domain application server, and query according to the identity whether there is key information corresponding to the identity and the key information is within the validity period; if there is The key information corresponding to the identity and the key information is within the validity period, query whether the user equipment is registered in the IMS domain, and if the query result is yes, return to the non-IMS domain application server The key information and the validity period of the key information. 11. The system of claim 10, wherein: The authentication gateway is further configured to receive a Session Initiation Protocol SIP message from the user equipment, and obtain a registration parameter carried in the SIP message, the registration parameter is generated by the user equipment according to a public key; The key decrypts the obtained registration parameters, and if the decryption is successful, saves the key information corresponding to the identity of the user equipment, returns a registration success message to the user equipment, and makes the user equipment save the encryption key. key information and access the non-IMS domain application server according to the key information. 12. The system of claim 10, wherein: The user equipment is also used to execute the IMS authentication process and register in the IMS domain; when accessing non-IMS domain applications, check whether there is key information locally, if not, randomly generate key information, and according to the Generate registration parameters based on the key information and public key, and send the registration parameters through SIP messages.

Images