WO2016050133A1

WO2016050133A1 - Authentication credential replacement method and apparatus

Info

Publication number: WO2016050133A1
Application number: PCT/CN2015/089048
Authority: WO
Inventors: 张旭武; 张进生
Original assignee: 华为技术有限公司
Priority date: 2014-09-30
Filing date: 2015-09-07
Publication date: 2016-04-07
Also published as: CN105516070A; CN105516070B

Abstract

Disclosed are an authentication credential replacement method and apparatus, which relate to the field of communications and are used for solving the problem of a larger safety risk due to the fact that a terminal device uses a fixed account and password to login, and the problem of an application limitation due to the fact that the fixed account and password need to be stored in the terminal device in the prior art. The method provided in the embodiments of the present invention comprises: receiving, by a relay server, a first account and a second certificate sent by a signalling server; and generating a new first certificate according to the second certificate, wherein the new first certificate is a certificate used in a process of the relay server authenticating the terminal device in a next media relay address allocation stage, and is used for replacing a first certificate. The technical solution provided in the embodiments of the present invention can be applied in a multimedia communication process.

Description

Method and device for replacing certificate voucher

The present application claims the priority of the Chinese application filed on Sep. 30, 2014, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present invention relates to the field of communications, and in particular, to a method and apparatus for authenticating credentials.

Background technique

In the Internet (Internet) network environment, a firewall or a NAT (Network Address Translation) is generally configured between the private network and the public network. Therefore, two user equipments (UEs) in different private networks perform Communication usually needs to traverse the firewall/NAT. Currently, a scheme for implementing firewall/NAT traversal is TURN (Traversal Using Relay Network Address Translation). The basic principle of the TURN scheme is that the terminal device is connected to the relay server in the public network through one or more NATs; the relay server allocates a public network address (ie, a media relay address allocation phase) to the terminal device through a certain mechanism, and the terminal The device uses the public network address to determine a media relay path (ie, a media relay path connectivity check phase) with the communication peer end (ie, another terminal device), and sends data to the communication peer end through the media relay path.

In order to prevent illegal access, when the TURN connection is established between the terminal device and the relay server, the relay server needs to authenticate the terminal device. Currently, a long-term credential mechanism for authenticating terminal devices is defined in the TURN protocol. The so-called long-term credential authentication mechanism means that both the terminal device and the relay server pre-store a fixed account number and password, and each time the terminal device accesses the relay server, the fixed account and password are used for login, that is, each During the secondary TURN connection, the relay server authenticates the terminal device with a fixed account number and password.

In the process of authenticating the terminal device by using the long-term authentication mechanism, since the terminal device uses a fixed account and password to log in, the account and the password are easily broken offline, and the security risk is large. In addition, since the long-term authentication mechanism needs to store a fixed account and password in the terminal device, it may cause application limitations; for example, the long-term authentication mechanism does not apply to WebRTC (Web Real-Time Communication). Letter) in the scene.

It should be noted that, in the WebRTC scenario, the communication control function of the terminal device is generally implemented by the JavaScript scripting language, and the account and password stored in the terminal device are directly read by JavaScript, and the JavaScript is not compiled and encrypted, and can be read in plaintext. Therefore, it is easy to cause the stored account and password to be leaked. Therefore, the long-term authentication mechanism that needs to save a fixed account and password in the terminal device is not suitable for use in the WebRTC scenario.

Summary of the invention

An embodiment of the present invention provides a method and an apparatus for authenticating an authentication credential, which solves the problem of a large security risk caused by a terminal device using a fixed account and password for logging in in the prior art, and a need for the terminal device The problem of application limitations caused by saving a fixed account and password.

In order to achieve the above objective, the embodiments of the present invention provide the following technical solutions:

In a first aspect, a method for replacing an authentication credential is provided, comprising:

The relay server receives the first account and the second credential sent by the signaling server, where the first account is the first used by the relay server to authenticate the terminal device in the media relay address allocation phase. An account in the voucher; the second voucher is a voucher generated by the signaling server and used by the relay server to authenticate the terminal device in the media relay path connectivity check phase;

Generating a new first credential according to the second credential; wherein the new first credential is a credential used when the relay server authenticates the terminal device in a next media relay address allocation phase, The first voucher is replaced.

With the first aspect, in a first possible implementation, after the relay server receives the first account and the second credential sent by the signaling server, the method further includes:

And sending, to the terminal device, an update indication message, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.

With the first aspect or the first possible implementation of the first aspect, in a second possible implementation, the generating, according to the second credential, a new first credential comprises: using the second credential As a new first credential; or, generating a new first credential according to the first credential and the second credential.

With reference to the second possible implementation of the first aspect, in a third possible implementation, the first credential further includes a first password, and the second credential further includes a second password, The new first credential includes a new first password; the generating the new first credential according to the first credential and the second credential, comprising: generating according to the first password and the second password The new first password.

With reference to the third possible implementation of the first aspect, in a fourth possible implementation, the generating the new first password according to the first password and the second password includes: The first password and the second password are subjected to a one-way function calculation to obtain the new first password.

With reference to the third possible implementation manner of the first aspect, or the fourth possible implementation manner, in a fifth possible implementation manner, the new first credential further includes a new first account; And generating, by the first credential and the second credential, a new first credential, further comprising: generating the new first account according to the first account and the second account.

With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation, the generating, by the first account and the second account, the new first account, including: The first account and the second account perform a one-way function calculation to obtain the new first account.

In a second aspect, a method for replacing an authentication credential is provided, including:

The relay server receives an update request message that is sent by the terminal device and includes the first account and the second account. The first account is that the relay server performs the terminal device in the media relay address allocation phase. The account number in the first certificate used for the authentication, the second account is used by the signaling server, and is used by the relay server to authenticate the terminal device during the media relay path connectivity check phase. The account number in the second voucher;

And authenticating the terminal device by using the second credential;

After the authentication succeeds, generating a new first credential according to the second credential; wherein the new first credential is used when the relay server authenticates the terminal device in a next media relay address allocation phase a voucher for replacing the first voucher.

With reference to the second aspect, in a first possible implementation, after the relay server receives the update request message that is sent by the terminal device and includes the first account and the second account, the method further includes:

In combination with the second aspect or the first possible implementation of the second aspect, in the second In an implementation manner, the generating, according to the second credential, a new first credential comprises: using the second credential as a new first credential; or, according to the first credential and the second credential Generate a new first credential.

In a third aspect, a relay server is provided, including:

a receiving unit, configured to receive a first account and a second credential sent by the signaling server, where the first account is used by the relay server to authenticate the terminal device in the media relay address allocation phase An account in the first credential; the second credential is a credential generated by the signaling server and used by the relay server to authenticate the terminal device in the media relay path connectivity check phase;

And a replacement unit, configured to generate a new first credential according to the second credential; wherein the new first credential is when the relay server authenticates the terminal device in a next media relay address allocation phase A voucher used to replace the first voucher.

With reference to the third aspect, in a first possible implementation, the relay server further includes:

And a sending unit, configured to send, to the terminal device, an update indication message, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.

With reference to the third aspect or the first possible implementation manner of the third aspect, in a second possible implementation manner, the replacing unit is specifically configured to:

Using the second voucher as a new first voucher; or

Generating a new first credential based on the first credential and the second credential.

In a fourth aspect, a relay server is provided, including:

a receiving unit, configured to receive, by the terminal device, an update request message that includes a first account and a second account, where the first account is the relay server to the terminal in the media relay address allocation phase The account number in the first certificate used by the device for authentication, the second account is generated by the signaling server, and the relay server authenticates the terminal device during the media relay path connectivity check phase. The account number in the second voucher used;

An authentication unit, configured to authenticate the terminal device by using the second credential;

And a replacement unit, configured to generate a new first credential according to the second credential after the authentication unit is successfully authenticated; wherein the new first credential is the relay in a next media relay address allocation phase The server used to authenticate the terminal device The certificate is used to replace the first voucher.

A fifth aspect provides a terminal device, including:

An obtaining unit, configured to obtain a first account; wherein the first account is an account in a first credential used by the relay server to authenticate the terminal device in the media relay address allocation phase;

a receiving unit, configured to receive a second account that is sent by the signaling server, where the second account is the relay server that is generated by the signaling server and is in the media relay path connectivity check phase An account in the second credential used by the terminal device for authentication;

a sending unit, configured to send, to the relay server, an update request message that includes the first account and the second account, where the update request message is used to enable the relay server to perform the second credential according to the second credential Generating a new first credential; the new first credential is a credential used by the relay server to authenticate the terminal device in a next media relay address allocation phase, for replacing the first credential.

With reference to the fifth aspect, in a first possible implementation, the sending unit is further configured to send a credential indication message to the signaling server, where the credential indication message is used to generate the signaling server The second credential.

With the fifth aspect or the first possible implementation manner of the fifth aspect, in a second possible implementation, the receiving unit is further configured to receive an update indication message sent by the relay server;

The terminal device further includes: a replacement unit, configured to generate the new first credential according to the second credential.

According to the technical solution provided by the embodiment of the present invention, the relay server generates a new first used to replace the first credential in the media relay address allocation phase by using the second credential in the media relay path connectivity check phase. Credentials, thereby enabling dynamic replacement of authentication credentials. The method is applied to an authentication mechanism for authenticating a terminal device using a double credential (a first credential and a second credential). Compared with the long-term authentication mechanism in the prior art, the authentication mechanism using the method of replacing the authentication credential does not easily cause the account and password to be broken offline, and the security risk is small; in addition, the authentication is performed by using the method of replacing the authentication credential. The mechanism only needs to store the first credential in the terminal device, and the first credential is dynamically updated, so the authentication mechanism using the method of replacing the authentication credential does not need to save a fixed account and password in the terminal device, so the application scope is relatively Big.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a flowchart of a method for replacing an authentication credential according to Embodiment 1 of the present invention;

2 is a flowchart of a method for replacing an authentication credential according to Embodiment 2 of the present invention;

3 is a flowchart of a method for replacing an authentication credential according to Embodiment 3 of the present invention;

4 is a flowchart of a method for replacing an authentication credential provided by Embodiment 1 of the present invention;

FIG. 5 is a flowchart of a method for replacing an authentication credential according to Embodiment 2 of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a relay server according to Embodiment 4 of the present invention; FIG.

FIG. 7 is a schematic structural diagram of another relay server according to Embodiment 4 of the present invention;

FIG. 8 is a schematic structural diagram of a relay server according to Embodiment 5 of the present invention;

FIG. 9 is a schematic structural diagram of another relay server according to Embodiment 5 of the present invention;

10 is a schematic structural diagram of a relay server according to Embodiment 6 of the present invention;

FIG. 11 is a schematic structural diagram of another relay server according to Embodiment 6 of the present invention;

FIG. 12 is a schematic structural diagram of a relay server according to Embodiment 7 of the present invention;

FIG. 13 is a schematic structural diagram of another relay server according to Embodiment 7 of the present invention;

FIG. 14 is a schematic structural diagram of a terminal device according to Embodiment 8 of the present invention;

FIG. 15 is a schematic structural diagram of another terminal device according to Embodiment 8 of the present invention;

FIG. 16 is a schematic structural diagram of a terminal device according to Embodiment 9 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The term "and/or" in this context is merely an association describing the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, and both A and B exist, respectively. B these three situations. In addition, the character "/" in this article, the general table The context of the context is an "or" relationship.

The technical solution provided by the embodiment of the present invention may be applied to a firewall/NAT traversal scenario in an IP (Internet Protocol) multimedia communication process, and may be applied to establish a TURN connection between the terminal device and the relay server in the scenario. In the process. The IP multimedia communication may be a VoIP (Voice over Internet Protocol) session, an IP video communication, or the like.

There are two kinds of logical channels in the process of TURN connection, one is the TURN data channel for carrying the upper layer VoIP media, and the other is the control information channel for establishing the data channel (hereinafter referred to as "TURN control"). Channel "); TURN connection process includes media relay address allocation phase and media relay path connectivity check phase.

The media relay address allocation phase is a phase in which the relay server allocates a media relay address to the terminal device, and specifically includes: the terminal device sends a media relay address request message to the relay server; and the relay server terminal device allocates the media. a relay address; wherein the media relay address is used for media session negotiation between the terminal device and the communication peer.

The "media relay path connectivity check phase" means that the terminal device sends a media relay path connectivity check (Connectivity Check) request message, and then determines whether the media relay path is available by whether the connectivity check response message can be received. stage. The media relay path connectivity check request message includes: create permission request (create permission request) message, TURN data channel binding request message (Channel Bind request), and STUN (Simple Traversal of UDP through NAT, simple NAT of UDP packet) Traversing the STUN binding request message. Wherein, the create permission request message is used to enable the relay server to know the address of the communication peer end of the media relay address that is allowed to access the terminal device; the TURN data channel binding request message is used to create a link between the terminal device and the relay server. The TURN data channel is used to determine whether the message between the terminal device and the communication peer end can reach the communication peer end through the media relay path between the terminal device and the communication peer end.

It should be noted that the interaction message between the relay server and the terminal device follows the TURN protocol, and the interaction message is referred to as a TURN control message. The TURN protocol stipulates that the relay server needs to authenticate the terminal device after receiving each TURN control message sent by the terminal device; the relay server needs to return the request message for each TURN control message sent by the terminal device. Response message. The above "media relay address allocation stage Each TURN control message in the "section" and "media relay path connectivity check phase" follows the TURN protocol.

With the method of the authentication credential replacement provided by the embodiment of the present invention, in the process of each TURN connection, the relay server can use the first credential and the second credential to authenticate the terminal device; to ensure the information security of the terminal device, any The first credential used in the two TURN connections may be different, and the second credential used in any two TURN connections may be different. If not stated, the "first voucher" described below refers to the first voucher used in the process of the current TURN connection, and the "second voucher" refers to the second voucher used in the process of the current TURN connection. .

Specifically, the “relay server authenticates the terminal device” in the embodiment of the present invention may be: the relay server performs TURN authentication on the terminal device. The "relay server" in the embodiment of the present invention may be a TURN server or the like; the "signaling server" may be a VoIP server or the like, wherein the VoIP server may be a SIP server or a WebRTC server.

Embodiment 1

As shown in FIG. 1 , a method for replacing an authentication credential provided by an embodiment of the present invention includes:

The relay server receives the first account and the second certificate sent by the signaling server, where the first account is used when the relay server authenticates the terminal device in the media relay address allocation phase. The account number in the first voucher; the second voucher is a voucher generated by the signaling server and used by the relay server to authenticate the terminal device in the media relay path connectivity check phase.

The first credential includes a first account number and a first password. In the process of the first TURN connection, the first credential may be a credential generated by the relay server when the account opening service is issued to the terminal device; in the process of the nth (n≥2, n is an integer) TURN connection, The first voucher may be a new first voucher generated by using the technical solution provided by the embodiment of the present invention in the process of the n-1th TURN connection. The process of two adjacent TURN connections may be for the same kind of IP multimedia communication (for example, both VoIP sessions), or for different kinds of IP multimedia communication (for example, the process of one TURN connection is for a VoIP session, and the other is a TURN connection. The process is for IP video communication, etc.). Generally, the first credential may be stored in the relay server and the terminal device before the current TURN connection process, and has no relationship with the current TURN connection process.

The second credential includes a second account number and a second password. The second credential can be a signaling server Short-term credential generated for the ICE (Interactive Connectivity Establishment) client; of course, other credentials. Generally, in the process of the TURN connection, the second certificate is temporarily generated by the signaling server for the TURN connection, and has a relationship with the current TURN connection; in addition, when the TURN connection is completed, the first Two credentials can be deleted to save storage space.

Before the step 101, the method may further include: the terminal device sending a credential indication message to the signaling server, so that the signaling server generates the second credential according to the credential indication message.

It should be noted that the first account and the second account are used to identify the same terminal device, but since the first account is generated by the relay server and the second account is generated by the signaling server, the relay server cannot identify the second account. The signaling server cannot recognize the first account. Based on this, in a specific implementation, the terminal device may send the first account account in the credential indication message to the signaling server, so that the signaling server identifies the first account by identifying the credential indication message; further, the signaling server The first account and the second credential are sent to the relay server such that the relay server identifies the second credential by identifying the first account.

The signaling server may carry the first account and the second credential in the same message, and may also carry the first account and the second credential in different messages. In order to reduce the number of signaling and improve the utilization of resources, the signaling server may send the first account and the second credential to a relay server in a message (for example, an H.248 message, etc.) in the prior art.

In addition, the method may further include: establishing an interface between the relay server and the signaling server; wherein the interface is used to transmit an interaction message between the relay server and the signaling server.

Optionally, after the step 101, the method may further include: sending an update indication message to the terminal device, where the update indication message is used to enable the terminal device to generate the new according to the second credential First voucher.

Exemplarily, the present embodiment does not limit the sequence in which the relay server performs the "send update indication message to the terminal device" and the execution step 102. The information used to indicate the update indication message may be carried in a message in the prior art, or may be newly defined, in order to reduce the number of signaling and improve the utilization of resources. a message.

It should be noted that the update rule may include an update rule, where the update rule may include, but is not limited to, any one of the following: update mode, update object, and more New algorithms, etc. The update mode may be the mode 1) or the mode 2) exemplified in the following step 102; the update object may be the first password and/or the first account; the update algorithm may be a “one-way function” algorithm or the like described below. The relay server may send the update indication message to the terminal device according to the update rule used in the implementation process of updating the first credential by itself, so that the implementation process of the relay server updating the first credential is the same as the implementation process of the terminal device updating the first credential; In addition, the relay server may negotiate the update rule with the terminal device in advance, and the terminal device updates the first certificate by using the negotiated update rule when receiving the message under the update indication sent by the relay server.

102: Generate a new first credential according to the second credential; wherein the new first credential is a credential used when the relay server authenticates the terminal device in a next media relay address allocation phase Used to replace the first voucher.

Optionally, step 102 may include, but is not limited to, implemented in the following two manners:

Method 1), the second credential is taken as a new first credential.

Method 2): Generate a new first credential according to the first credential and the second credential.

Exemplarily, the new first credential includes a new first password, and the manner 2) may include: generating the new first password according to the first password and the second password. Further, the new first credential further includes a new first account, and the method 2) may further include: generating the new first account according to the first account and the second account.

Optionally, the “calculating the new first password according to the first password and the second password” may include: performing a one-way function calculation on the first password and the second password, to obtain the The new first password. Optionally, the calculating the new first account by using the first account and the second account may include: performing a one-way function calculation on the first account and the second account, to obtain the The new first account. The one-way function may be a hash function or the like.

Optionally, the relay server replaces the first credential with the new first credential. There is no limit to the way to replace, you can replace them all; you can also change only the changed content, such as account number or password.

In the method for replacing the authentication credential provided by the embodiment of the present invention, the relay server generates a new one for replacing the first credential in the media relay address allocation phase by using the second credential in the media relay path connectivity check phase. The first credential, thereby achieving dynamic replacement of the authentication credential. The method is applied to an authentication mechanism for authenticating a terminal device using a double credential (a first credential and a second credential). Compared with the long-term authentication mechanism in the prior art, the authentication mechanism using the method of replacing the authentication credential does not easily cause the account and password to be offline. Cracking, the security risk is small; in addition, since the authentication mechanism using the authentication credential replacement method only needs to store the first credential in the terminal device, and the first credential is dynamically updated, the method of replacing the authentication credential is used. The authentication mechanism does not need to save a fixed account and password in the terminal device, so the application scope is large.

Embodiment 2

As shown in FIG. 2, a method for replacing an authentication credential provided by an embodiment of the present invention includes:

201: The relay server receives an update request message that is sent by the terminal device and includes the first account and the second account. The first account is the relay server to the terminal in the media relay address allocation phase. The account number in the first certificate used by the device for authentication, the second account is generated by the signaling server, and the relay server authenticates the terminal device during the media relay path connectivity check phase. The account number in the second voucher used.

The explanation of the related content in this embodiment can be referred to the description in other embodiments herein.

In order to save the number of signaling and improve the resource utilization, the step 201 may be implemented as follows: the relay server receives the media relay path connectivity check request message sent by the terminal device, and the media relay path connectivity check request message Contains information for indicating an update request message. Exemplarily, in the optional mode, the media relay path connectivity check request message may be specifically: a create permission request message or a TURN data channel binding request message, and the like. In addition, the update request message may also be a newly defined message.

Optionally, after step 201, the method may further include: sending an update indication message to the terminal device, where the update indication message is used to enable the terminal device to generate the new according to the second credential First voucher. For an explanation of the relevant content in this alternative manner, reference may be made to the description in other embodiments herein.

202: Authenticate the terminal device by using the second credential.

The embodiment of the present invention does not limit the authentication method in step 202, and may use the authentication method in the prior art.

Before the step 101, the method may further include: receiving the second credential sent by the signaling server; the step 102 may include: acquiring the second credential to which the second account belongs according to the second account included in the update indication message, The terminal device is authenticated by using the second credential.

203: After the authentication is successful, generate a new first credential according to the second credential; wherein the new first credential is that the relay server authenticates the terminal device in a next media relay address allocation phase. The voucher used to replace the first voucher.

Optionally, “generating a new first credential according to the second credential” may include, but is not limited to, implemented in the following two manners:

Method 1), the second credential is taken as a new first credential.

In a specific implementation, if the authentication result in step 202 is an authentication failure, the method may further include: the relay server sending a response message of the authentication failure to the terminal device. In addition, according to the existing TURN protocol, in the connectivity check phase of the media relay path, if the relay server cannot complete the authentication of the terminal device within a certain period of time, the media relay assigned to the terminal device is released. Address and interrupt the TURN connection with the terminal device to save resources.

It should be noted that, in the process of the TURN connection, when receiving the TURN control message that is sent by the terminal device and includes the second account, the relay server uses the second voucher to perform the terminal device. Certification. As specified in the TURN protocol, the relay server needs to authenticate the terminal device after receiving each TURN control message sent by the terminal device; therefore, each TURN control message sent by the terminal device to the relay server includes one The account number is such that the relay server authenticates the terminal device according to the certificate to which the account belongs. In addition, in the specific implementation, the TURN control message can also The reference quantity corresponding to the account number is included, and the explanation and usage method of the “reference quantity” can be referred to the related description below.

In the method for replacing the authentication credential provided by the embodiment of the present invention, the relay server generates a new one for replacing the first credential in the media relay address allocation phase by using the second credential in the media relay path connectivity check phase. The first credential, thereby achieving dynamic replacement of the authentication credential. The method is applied to an authentication mechanism for authenticating a terminal device using a double credential (a first credential and a second credential). Compared with the long-term authentication mechanism in the prior art, the authentication mechanism using the method of replacing the authentication credential does not easily cause the account and password to be broken offline, and the security risk is small; in addition, the authentication is performed by using the method of replacing the authentication credential. The mechanism only needs to store the first credential in the terminal device, and the first credential is dynamically updated, so the authentication mechanism using the method of replacing the authentication credential does not need to save a fixed account and password in the terminal device, so the application scope is relatively Big.

Embodiment 3

As shown in FIG. 3, a method for replacing an authentication credential provided by an embodiment of the present invention includes:

301: The terminal device obtains the first account, where the first account is an account in the first credential used by the relay server to authenticate the terminal device in the media relay address allocation phase.

302: Receive a second account that is sent by the signaling server, where the second account is generated by the signaling server, and the relay server is used by the relay server in the media relay path connectivity check phase. The account number in the second voucher used for authentication.

Optionally, before step 302, the method may further include: sending a credential indication message to the signaling server; wherein the credential indication message is used to cause the signaling server to generate the second credential. In a specific implementation, in order to save signaling overhead, the credential indication message may be carried in a session call request message. Step 302 can be implemented as: receiving a second credential sent by the signaling server, where the second credential includes a second credential. In a specific implementation, in order to save signaling overhead, the second credential may be carried in the session call response message.

303: Send an update request message that includes the first account and the second account to the relay server, where the update request message is used to enable the relay server to The second credential generates a new first credential; the new first credential is a credential used by the relay server to authenticate the terminal device in a next media relay address allocation phase, and is used for replacing Said the first voucher.

Optionally, after the step 302, the method may further include: receiving an update indication message sent by the relay server; and generating the new first certificate according to the second certificate.

Optionally, the terminal device replaces the first credential with the new first credential. There is no limit to the way to replace, you can replace them all; you can also change only the changed content, such as account number or password.

Optionally, the “generating the new first credential according to the second credential” may include, but is not limited to, implemented in the following two manners:

Method 1), the second credential is taken as a new first credential.

The following provides the above by two specific embodiments (Embodiment 1 and Example 2) The authentication voucher replacement method is applied to the authentication method for explanation. It should be noted that the scenarios in which the two specific embodiments provide the authentication method are all related to the content of the two specific embodiments in the process of the TURN connection.

Example 1

As shown in FIG. 4, an authentication method provided in this embodiment includes:

401. The terminal device sends a media relay address request message to the relay server, where the allocated media relay address request message includes a first account and a reference quantity corresponding to the first account.

The reference quantity corresponding to the first account is a value or a range of values determined by the value obtained by the terminal device by using the first password and the random number according to the preset authentication algorithm, and the value is determined by the calculated value; The authentication algorithm is an algorithm pre-agreed by the terminal device and the relay server for performing hash calculation using the first password.

Step 401 can include: the terminal device sends a distribution media relay address request message to the relay server by using a TURN protocol. The "first account" can be carried by the username attribute in the existing TURN protocol attribute.

402. The relay server acquires the first credential according to the first account, and authenticates the terminal device by using the first credential and the reference quantity corresponding to the first account.

Step 402 may include: the relay server acquires the first password by using the first account, calculates the first password by using a preset authentication algorithm, and obtains a calculation result; when the reference quantity is a value, determines whether the calculation result is the same as the reference quantity. If yes, the authentication is successful; if not, the authentication fails; when the reference quantity is a range of values, it is judged whether the calculation result is within the numerical range, and if so, the authentication is successful; if not, the authentication fails. If the authentication succeeds, the terminal device is legal, and step 403 is performed; if the authentication failure indicates that the terminal device is invalid, the response message of the authentication failure is returned to the terminal device.

It should be noted that, after receiving the TURN control message sent by the terminal device, the relay server needs to authenticate the terminal device; therefore, each TURN control message sent by the terminal device to the relay server includes an account. And a reference quantity calculated by using a password corresponding to the account, so that the relay server authenticates the terminal device according to the certificate to which the account belongs.

403. After the authentication succeeds, the relay server allocates a media relay address to the terminal device according to the allocated media relay address request message.

The specific implementation method of the step 403 can refer to the prior art, and is not described here.

404. The relay server sends a media relay address response message to the terminal device, where the media relay address response message includes a media relay address allocated by the relay server for the terminal device.

Steps 401-404 are specific implementation processes in which the relay server allocates a media relay address phase to the terminal device.

405. The terminal device sends a session call request message to the signaling server, where the session call request message includes a media relay address allocated by the relay server for the terminal device, information used to represent the credential request message, and the first account.

406. The signaling server generates a second credential for the terminal device according to the information used to represent the credential request message. The second credential includes the second credential and the second credential.

407. The signaling server sends a session call response message to the terminal device, where the session call response message includes the second credential.

408. The signaling server sends an association request message to the relay server, where the association request message includes the first account and the second certificate.

In a specific implementation, the execution sequence of step 407 and step 408 is not limited in the embodiment of the present invention. For example, step 407 may be performed before step 408, or step 408 may be performed first, and step 407 may be performed first, and step 407 may be performed simultaneously. Step 408.

In addition, after performing step 407 and step 408, the signaling server may delete the second credential to save storage space.

409. The relay server establishes an association relationship between the first account and the second account.

The “establishing the association relationship between the first account and the second account” specifically refers to binding the first account and the second account that jointly identify a terminal device, so that the relay server utilizes the media relay path connectivity check phase. And authenticating the terminal device with the second credential to which the second account bound to the first account belongs; and when the credential is replaced, the relay server binds the second account by using the second credential to which the second account belongs The first certificate to which the first account belongs is updated.

It should be noted that, since the relay server stores the first account and the second account of the plurality of terminal devices connected thereto, the relay server needs to associate the first account that jointly identifies the terminal device with the second account. To realize management of the first account and the second account of different terminal devices.

410. The terminal device sends a create permission request message to the relay server, where the creation permission request message includes a reference quantity corresponding to the second account and the second account.

For example, the explanation of the reference quantity corresponding to the second account may be referred to the explanation of the reference quantity corresponding to the first account in the foregoing sixth embodiment.

411. The relay server acquires the second credential according to the second account, and authenticates the terminal device by using the second credential and the reference quantity corresponding to the second account.

412. After the authentication is successful, send a create permission response message to the terminal device, where the create permission response message includes information for indicating an update indication message, where the update indication message includes information indicating the association relationship.

413. The terminal device calculates a new first credential according to the first credential and the second credential, where the new first credential is the credential used in the process of the next TURN connection; and replaces the first credential with the new first credential.

After performing step 413, the first certificate used in the process of the current TURN connection is invalid.

The method for calculating the update of the first account and the first password is not limited in the embodiment of the present invention. The following provides a calculation method as an example:

The first account update calculation method can be:

Username_f_new=PDF(username_f_old, username_s), where username_f_new represents the new first account, PDF represents the function name of the one-way function, and also represents an algorithm, username_f_old represents the first account, and username_s represents the second account.

The update calculation method of the first password may be: PWD_f_new=KDF (PWD_f_old, PWD_s, other parameters). Among them, PWD_f_new represents a new first password, KDF represents a function name of a one-way function, and also represents an algorithm (for example, may be MD5 (Message-Digest Algorithm 5), etc.), PWD_f_old indicates A password, PWD_s is represented as a second password, and other parameters are optional parameters, for example, may be a transaction id or a NONCE parameter in the association response message.

414. The relay server calculates a new first credential according to the first credential and the second credential, where the new first credential is the credential used in the process of the next TURN connection; and replaces the first credential with the new first credential. .

For the specific update calculation method of step 414, reference may be made to step 413.

It should be noted that the relay server may send an update indication message to the terminal device according to the update rule used in the implementation process of updating the first credential by itself, so as to ensure that the relay server updates the first credential implementation process and the terminal device updates the first credential. Implementation process In addition, the relay server may negotiate the update rule with the terminal device in advance, and the terminal device updates the first certificate by using the negotiated update rule when receiving the indication of updating the first certificate sent by the relay server.

Steps 412-413 are a process for the terminal device to update the first credential. The process may be performed in any step before the end of the current TURN connection process after the terminal device learns the association relationship between the first account and the second account. Step 414 is a process for the relay server to update the first credential. The process may be performed in any step before the end of the current TURN connection process after the relay server establishes the association relationship between the first account and the second account. In addition, in the embodiment of the present invention, the process of updating the first credential by the terminal device and the execution sequence of the process of updating the first credential by the relay server are not limited.

415. The relay server uses the second credential to authenticate the terminal device when receiving the other TURN control message in the process of the current TURN connection.

Exemplarily, the TURN control message in step 415 may include: a refresh request message, a TURN data channel binding request message, and the like.

In the authentication method provided by the embodiment of the present invention, the relay server authenticates the terminal device by using the double credential (the first credential and the second credential), thereby improving the information security of the terminal device. In this embodiment, the first credential in the process of the TURN connection is updated by using the second credential in the process of the current TURN connection by using the association relationship between the first account and the second account, and the next TURN connection is obtained. The first credential in the process, thereby implementing a dynamic update of the authentication credential. Compared with the long-term authentication mechanism in the prior art, the authentication method provided by this embodiment does not easily cause the account and password to be offlinely cracked, and the security risk is small; in addition, the authentication mechanism using the method of replacing the authentication credential only needs to be The first credential is stored in the terminal device, and the first credential is dynamically updated, so the authentication mechanism using the method of replacing the authentication credential does not need to save a fixed account and password in the terminal device, so the application scope is large. In the meantime, the authentication method provided in this embodiment utilizes the interaction signaling used in the message carrying authentication process in the prior art, which reduces the number of signaling and improves the utilization of resources. In addition, the authentication method provided in this embodiment implements control of the VoIP call signaling to the media relay path connectivity check phase.

Example 2

As shown in FIG. 5, an authentication method provided in this embodiment includes:

The steps 501-504 are the same as the above steps 401-404. For details, refer to Embodiment 1, and details are not described herein again. Steps 501-504 are to assign a media address level to the terminal device for the relay server. The specific implementation process of the segment.

505. The terminal device sends a session call request message to the signaling server, where the session call request message includes a media relay address allocated by the relay server for the terminal device and information used to represent the credential request message.

It should be noted that the interaction message between the terminal device and the signaling server is called a SIP message, and the terminal device and the signaling server use the SDP (Session Description Protocol) in the SIP message to negotiate the session information of the two parties. The session information may include: a media address, codec information, and ICE related parameters. In the prior art, SIP messages need to be encrypted by TLS (Transport Layer Security) or IPSec (Internet Protocol Security). In this embodiment, it is assumed that all SIP messages have been encrypted by TLS or IPSec. Wherein, the specific encryption method can refer to the prior art.

506. The signaling server generates a second credential according to the information used to represent the credential request message. The second credential includes a second account and a second credential.

Exemplarily, the second credential may be a credential randomly generated by the signaling server.

507. The signaling server sends a session call response message to the terminal device, where the session call response message includes the second credential.

In a specific implementation, the second account in the second credential may be carried by the ICE-ufrag in the existing SDP attribute, and the second password in the second credential may be carried by the ICE-passwd attribute in the existing SDP attribute. The second voucher is specifically carried by a newly defined SDP attribute line.

508. The signaling server sends the second credential to the relay server.

In a specific implementation, the step 508 may include: the signaling server directly sends the second credential to the relay server through an interface between the signaling server and the relay server; or the pre-shared secret between the signaling server and the relay server The key, the signaling server encrypts the second credential by using the key, and then sends the encrypted information to the terminal device by using the SDP message, and the terminal device forwards the encrypted information to the relay server by using a TURN control message. The second certificate is solved by the server through the key.

The embodiment of the present invention does not limit the execution sequence of step 507 and step 508. For example, step 507 may be performed before step 508, or step 508 may be performed first, and step 507 may be performed first, and step 507 and step 508 may be performed simultaneously.

In addition, after performing step 507 and step 508, the signaling server may delete the Second voucher to save storage space.

509. The terminal device sends a create permission request message to the relay server, where the request permission message includes information for indicating an association request message, where the association request message includes the first account and the second account.

In a specific implementation, the first account and the second account in the association request message may be carried in the following two manners:

1) The first account and the second account are carried by the username attribute in the existing TURN protocol attribute, and the first account and the second account are distinguished by the agreed symbols, for example, username=“second account”||“ An account number."

2) The first account can be carried by a newly defined TURN protocol attribute, and the second account is carried by the username attribute in the existing TURN protocol attribute.

Certainly, the manner of carrying the first account and the second account in the association request message may be other manners. The foregoing two methods are only exemplary descriptions. For example, the first account and the second account may both be newly defined by the TURN protocol. Property carrying, etc.

510. The relay server obtains the second credential to which the second account belongs by using the second account carried in the association request message, and authenticates the terminal device by using the second credential.

For the specific authentication process, refer to step 502.

511. After the authentication succeeds, the relay server establishes an association relationship between the first account and the second account.

512. The relay server sends a create permission response message to the terminal device, where the creation permission response message includes information for indicating an update indication message, where the update indication message includes information for indicating the association relationship.

The information used to indicate the update indication message may be carried by the existing TURN protocol attribute or a specially defined TURN protocol attribute. In addition, the update indication message may further include an update rule, etc., and the description of the update rule may refer to the above. .

Steps 513-515 are the same as steps 413-415. For details, refer to Embodiment 1, and details are not described herein again.

In the authentication method provided by the embodiment of the present invention, the relay server authenticates the terminal device by using the double credential (the first credential and the second credential), thereby improving the information security of the terminal device. In this embodiment, the first credential in the process of the TURN connection is updated by using the second credential in the process of the current TURN connection by using the association relationship between the first account and the second account, and the next TURN connection is obtained. The first voucher in the process, thereby achieving authentication Dynamic update of the certificate. Compared with the long-term authentication mechanism in the prior art, the authentication method provided by this embodiment does not easily cause the account and password to be offlinely cracked, and the security risk is small; in addition, the authentication mechanism using the method of replacing the authentication credential only needs to be The first credential is stored in the terminal device, and the first credential is dynamically updated, so the authentication mechanism using the method of replacing the authentication credential does not need to save a fixed account and password in the terminal device, so the application scope is large. In the meantime, the authentication method provided in this embodiment utilizes the interaction signaling used in the message carrying authentication process in the prior art, which reduces the number of signaling and improves the utilization of resources. In addition, the authentication method provided in this embodiment implements control of the VoIP call signaling to the media relay path connectivity check phase.

Embodiment 4

As shown in FIG. 6, the embodiment of the present invention provides a method for the relay server 60 to perform the authentication credential replacement provided in the foregoing method embodiment. The relay server 60 includes:

The receiving unit 601 is configured to receive the first account and the second credential sent by the signaling server, where the first account is used when the relay server authenticates the terminal device in the media relay address allocation phase. The account number in the first voucher; the second voucher is a voucher generated by the signaling server and used by the relay server to authenticate the terminal device in the media relay path connectivity check phase ;

a replacement unit 602, configured to generate a new first credential according to the second credential; wherein the new first credential is that the relay server authenticates the terminal device in a next media relay address allocation phase The voucher used to replace the first voucher.

Optionally, as shown in FIG. 7, the relay server 60 further includes:

The sending unit 603 is configured to send an update indication message to the terminal device, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.

Optionally, the replacing unit 602 is specifically configured to: use the second credential as a new first credential; or generate a new first credential according to the first credential and the second credential.

Optionally, the first credential further includes a first password, the second credential further includes a second password, where the new first credential includes a new first password; as shown in FIG. 7, the replacement unit 602 includes:

The first generating sub-unit 6021 is configured to generate the new first password according to the first password and the second password.

Optionally, the first generating sub-unit 6021 is configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.

Optionally, the new first credential further includes a new first account; as shown in FIG. 7, the replacing unit 602 further includes:

The second generating sub-unit 6022 is configured to generate the new first account according to the first account and the second account.

Optionally, the second generating sub-unit 6022 is configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.

The relay server provided by the embodiment of the present invention is applied to an authentication mechanism for authenticating a terminal device by using a double credential (a first credential and a second credential). Compared with the long-term authentication mechanism in the prior art, the authentication mechanism using the method of replacing the authentication credential does not easily cause the account and password to be broken offline, and the security risk is small; in addition, the authentication is performed by using the method of replacing the authentication credential. The mechanism only needs to store the first credential in the terminal device, and the first credential is dynamically updated, so the authentication mechanism using the method of replacing the authentication credential does not need to save a fixed account and password in the terminal device, so the application scope is relatively Big.

Embodiment 5

In hardware implementation, the sending unit in Embodiment 4 may be a transmitter, the receiving unit may be a receiver, and the transmitter and the receiver may be integrated to form a transceiver; the replacing unit may be embedded or independent in hardware form. In the processor of the relay server, it may also be stored in the memory of the relay server in software, so that the processor calls to perform operations corresponding to the above units, and the processor may be a central processing unit (CPU), micro processing. , microcontroller, etc.

As shown in FIG. 8, a relay server 80 is provided to perform the method for performing authentication credential replacement provided by the foregoing method embodiment. The relay server 80 includes: a receiver 801, a memory 802, and a processing. 803 and bus system 804.

The receiver 801, the memory 802 and the processor 803 are coupled together by a bus system 804. The bus system 804 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 804 in the figure.

The receiver 801 is configured to receive the first account and the second credential sent by the signaling server, where the first account is used when the relay server authenticates the terminal device in the media relay address allocation phase. The account number in the first voucher; the second voucher is a credential generated by the signaling server and used by the relay server to authenticate the terminal device during the media relay path connectivity check phase;

The memory 802 is configured to store a set of codes, and the code stored in the memory 802 is used to control the processor 803 to generate a new first credential according to the second credential; wherein the new first credential is the next media relay A voucher used by the relay server to authenticate the terminal device in the address allocation phase, for replacing the first credential.

Optionally, as shown in FIG. 9, the relay server further includes:

The sender 805 is configured to send an update indication message to the terminal device, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.

Optionally, the processor 803 is specifically configured to: use the second credential as a new first credential; or generate a new first credential according to the first credential and the second credential.

Optionally, the first credential further includes a first password, the second credential further includes a second password, the new first credential includes a new first password, and the processor 803 is specifically configured to: The first password and the second password generate the new first password.

Optionally, the processor 803 is specifically configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.

Optionally, the new first credential further includes a new first account; the processor 803 is specifically configured to: generate the new first account according to the first account and the second account.

Optionally, the processor 803 is specifically configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.

Embodiment 6

As shown in FIG. 10, a method for the authentication server to be replaced by the relay server 100 is provided in the embodiment of the present invention. The relay server 100 includes:

The receiving unit 1001 is configured to receive, by the terminal device, the first account and the second account. The update request message of the number; wherein the first account is an account in the first credential used by the relay server to authenticate the terminal device in the media relay address allocation phase, the second The account number is an account number generated by the signaling server and used in the second credential used by the relay server to authenticate the terminal device in the media relay path connectivity check phase;

The authentication unit 1002 is configured to perform authentication on the terminal device by using the second credential;

The replacing unit 1003 is configured to generate, according to the second credential, a new first credential after the authentication unit is successfully authenticated; wherein the new first credential is in the next media relay address allocation phase a credential used by the server to authenticate the terminal device for replacing the first credential.

Optionally, as shown in FIG. 11, the relay server further includes: a sending unit 1004, configured to send an update indication message to the terminal device, where the update indication message is used to enable the terminal device to perform The second voucher generates the new first voucher.

Optionally, the replacing unit 1003 is specifically configured to: use the second credential as a new first credential; or generate a new first credential according to the first credential and the second credential.

Optionally, the first credential further includes a first password, the second credential further includes a second password, the new first credential includes a new first password, and the replacing unit 1003 is specifically configured to: The first password and the second password generate the new first password.

Optionally, the replacing unit 1003 is specifically configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.

Optionally, the new first credential further includes a new first account; the replacing unit 1003 is specifically configured to: generate the new first account according to the first account and the second account.

Optionally, the replacing unit 1003 is specifically configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.

Example 7

In the hardware implementation, the receiving unit in the sixth embodiment may be a receiver; the authentication unit and the replacement unit may be embedded in the hardware of the relay server or may be stored in the relay server in software. In the memory, in order to facilitate the processor to perform the operations corresponding to the above units, the processor may be a central processing unit (CPU), a microprocessor, a single chip microcomputer, or the like.

As shown in FIG. 12, a method for performing the authentication credential replacement provided in the foregoing method embodiment is provided in the embodiment of the present invention. The relay server 120 includes: a receiver 1201, a memory 1202, and a processing. The device 1203 and the bus system 1204.

The receiver 1201, the memory 1202 and the processor 1203 are coupled together by a bus system 1204. The bus system 1204 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 1204 in the figure.

The receiver 1201 is configured to receive, by the terminal device, an update request message that includes the first account and the second account, where the first account is the relay server in the current media relay address allocation phase. The account in the first credential used by the terminal device for authentication, the second account is generated by the signaling server, and the relay server authenticates the terminal device in the media relay path connectivity check phase. The account number in the second voucher used;

The memory 1202 is configured to store a set of codes, and the code stored in the memory 1202 is used by the control processor 1203 to perform the following actions: the terminal device is authenticated by using the second credential; after the authentication is successful, according to the second credential Generating a new first credential; wherein the new first credential is a credential used when the relay server authenticates the terminal device in a next media relay address allocation phase, and is used to replace the first credential certificate.

Optionally, as shown in FIG. 13, the relay server 120 further includes: a sender 1205, configured to send an update indication message to the terminal device, where the update indication message is used to enable the terminal device to The second credential generates the new first credential.

Optionally, the processor 1203 is specifically configured to: use the second credential as a new first credential; or generate a new first credential according to the first credential and the second credential.

Optionally, the first credential further includes a first password, the second credential further includes a second password, the new first credential includes a new first password, and the processor 1203 is specifically configured to: The first password and the second password generate the new first password.

Optionally, the processor 1203 is specifically configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.

Optionally, the new first credential further includes a new first account; the processor 1203 is specifically configured to: generate the new first account according to the first account and the second account.

Optionally, the processor 1203 is specifically configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.

Example eight

As shown in FIG. 14, a method for the terminal device 140 to perform the authentication credential replacement provided in the foregoing method embodiment is provided. The terminal device 140 includes:

The obtaining unit 1401 is configured to obtain the first account, where the first account is an account in the first credential used by the relay server to authenticate the terminal device in the media relay address allocation phase;

The receiving unit 1402 is configured to receive a second account that is sent by the signaling server, where the second account is the relay server that is generated by the signaling server and is in the media relay path connectivity check phase. An account in the second credential used by the terminal device for authentication;

The sending unit 1403 is configured to send, to the relay server, an update request message that includes the first account and the second account, where the update request message is used to enable the relay server according to the second The voucher generates a new first voucher; the new first voucher is a voucher used when the relay server authenticates the terminal device in a next media relay address allocation phase, and is used to replace the first credential .

Optionally, the sending unit 1403 is further configured to send a credential indication message to the signaling server, where the credential indication message is used to enable the signaling server to generate the second credential.

Optionally, the receiving unit 1402 is further configured to: receive an update indication message sent by the relay server; as shown in FIG. 15, the terminal device 140 further includes: an replacing unit 1404, according to the second The voucher generates the new first voucher.

Optionally, the replacing unit 1404 is specifically configured to: use the second credential as the new first credential; or generate the new first credential according to the first credential and the second credential .

Optionally, the first credential further includes a first password, the second credential further includes a second password, and the new first credential includes a new first password; as shown in FIG. 1404 includes: a first generating subunit 14041, configured to generate the new first password according to the first password and the second password.

Optionally, the first generating sub-unit 14041 is specifically configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.

Optionally, the new first credential further includes a new first account; as shown in FIG. 15, the replacing unit 1404 further includes: a second generating subunit 14042, configured to use the first account and the The second account generates the new first account.

Optionally, the second generating sub-unit 14042 is specifically configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.

The terminal device provided by the embodiment of the present invention is applied to an authentication mechanism for authenticating a terminal device by using a double credential (a first credential and a second credential). Compared with the long-term authentication mechanism in the prior art, the authentication mechanism using the method of replacing the authentication credential does not easily cause the account and password to be broken offline, and the security risk is small; in addition, the authentication is performed by using the method of replacing the authentication credential. The mechanism only needs to store the first credential in the terminal device, and the first credential is dynamically updated, so the authentication mechanism using the method of replacing the authentication credential does not need to save a fixed account and password in the terminal device, so the application scope is relatively Big.

Example nine

In hardware implementation, the sending unit in Embodiment 8 may be a transmitter, the receiving unit may be a receiver, and the transmitter and the receiver may be integrated to form a transceiver; the acquiring unit and the replacing unit may be embedded in hardware. The processor may be stored in the memory of the terminal device in software, or may be stored in a memory of the terminal device, so that the processor may perform operations corresponding to the above units, and the processor may be a central processing unit (CPU) or a micro Processor, microcontroller, etc.

As shown in FIG. 16, a terminal device 160 is provided for performing according to an embodiment of the present invention. The method for replacing the authentication credential provided in the foregoing method embodiment includes: a receiver 1601, a transmitter 1602, a memory 1603, a processor 1604, and a bus system 1605.

The receiver 1601, the transmitter 1602, the memory 1603, and the processor 1604 are coupled together by a bus system 1605. The bus system 1605 may include a power bus, a control bus, and a status signal in addition to the data bus. Bus, etc. However, for clarity of description, various buses are labeled as bus system 1605 in the figure.

The memory 1603 is configured to store a set of codes, and the code stored in the memory 1603 is used to control the processor 1604 to obtain a first account. The first account is a relay server to the terminal in the media relay address allocation phase. The account number in the first voucher used by the device for authentication;

The receiver 1601 is configured to receive a second account that is sent by the signaling server, where the second account is the relay server that is generated by the signaling server and is in the media relay path connectivity check phase. An account in the second credential used by the terminal device for authentication;

The sender 1602 is configured to send, to the relay server, an update request message that includes the first account and the second account, where the update request message is used to enable the relay server according to the second The voucher generates a new first voucher; the new first voucher is a voucher used when the relay server authenticates the terminal device in a next media relay address allocation phase, and is used to replace the first credential .

Optionally, the sender 1602 is further configured to send a credential indication message to the signaling server, where the credential indication message is used to enable the signaling server to generate the second credential.

Optionally, the receiver 1601 is further configured to receive an update indication message sent by the relay server, where the processor 1604 is further configured to generate the new first certificate according to the second certificate.

Optionally, the processor 1604 is specifically configured to: use the second credential as the new first credential; or generate the new first credential according to the first credential and the second credential .

Optionally, the first credential further includes a first password, the second credential further includes a second password, the new first credential includes a new first password, and the processor 1604 is specifically configured to: The first password and the second password generate the new first password.

Optionally, the processor 1604 is configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.

Optionally, the new first credential further includes a new first account; the processor 1604 is specifically configured to: generate the new first account according to the first account and the second account.

Optionally, the processor 1604 is specifically configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.

In addition, the embodiment of the present invention further provides a system for replacing the authentication credential, including: the signaling server and any one of the relay servers provided in Embodiment 4 to Embodiment 7 above. It should be noted that the introduction of each functional module of the relay server can be referred to the above, and details are not described herein again. In addition, one or more terminal devices may also be included in the system.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium. The above software functional unit is stored in a storage medium, A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform some of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, and the program code can be stored. Medium.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not limited thereto; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that The technical solutions described in the foregoing embodiments are modified, or the equivalents of the technical features are replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

A method for authenticating certificate credentials, comprising:

The relay server receives the first account and the second credential sent by the signaling server, where the first account is the first used by the relay server to authenticate the terminal device in the media relay address allocation phase. An account in the voucher; the second voucher is a voucher generated by the signaling server and used by the relay server to authenticate the terminal device in the media relay path connectivity check phase;

Generating a new first credential according to the second credential; wherein the new first credential is a credential used when the relay server authenticates the terminal device in a next media relay address allocation phase, The first voucher is replaced.
The method according to claim 1, wherein after the relay server receives the first account and the second credential sent by the signaling server, the method further includes:

And sending, to the terminal device, an update indication message, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.
The method according to claim 1 or 2, wherein the generating the new first credential according to the second credential comprises:

Using the second voucher as a new first voucher; or

Generating a new first credential based on the first credential and the second credential.
The method according to claim 3, wherein said first credential further comprises a first password, said second credential further comprises a second password, said new first credential comprising a new first password; Generating a new first credential according to the first credential and the second credential, including:

Generating the new first password according to the first password and the second password.
The method according to claim 4, wherein the generating the new first password according to the first password and the second password comprises:

Performing a one-way function calculation on the first password and the second password to obtain the new first password.
The method according to claim 4 or 5, wherein said new first voucher further comprises a new first account number; said generating a new first voucher based on said first voucher and said second voucher ,Also includes:

Generating the new first account according to the first account and the second account.
The method of claim 6 wherein said first according to said first The account and the second account generate the new first account, including:

Performing a one-way function calculation on the first account and the second account to obtain the new first account.
A method for authenticating certificate credentials, comprising:

The relay server receives an update request message that is sent by the terminal device and includes the first account and the second account. The first account is that the relay server performs the terminal device in the media relay address allocation phase. The account number in the first certificate used for the authentication, the second account is used by the signaling server, and is used by the relay server to authenticate the terminal device during the media relay path connectivity check phase. The account number in the second voucher;

And authenticating the terminal device by using the second credential;

After the authentication succeeds, generating a new first credential according to the second credential; wherein the new first credential is used when the relay server authenticates the terminal device in a next media relay address allocation phase a voucher for replacing the first voucher.
The method according to claim 8, wherein after the relay server receives the update request message that is sent by the terminal device and includes the first account and the second account, the method further includes:

And sending, to the terminal device, an update indication message, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.
The method according to claim 8 or 9, wherein the generating the new first credential according to the second credential comprises:

Using the second voucher as a new first voucher; or

Generating a new first credential based on the first credential and the second credential.
The method according to claim 10, wherein said first credential further comprises a first password, said second credential further comprises a second password, said new first credential comprising a new first password; Generating a new first credential according to the first credential and the second credential, including:

Generating the new first password according to the first password and the second password.
The method according to claim 11, wherein the generating the new first password according to the first password and the second password comprises:

Performing a one-way function calculation on the first password and the second password to obtain the new first password.
A relay server, comprising:

a receiving unit, configured to receive a first account and a second credential sent by the signaling server, where the first account is used by the relay server to authenticate the terminal device in the media relay address allocation phase An account in the first credential; the second credential is a credential generated by the signaling server and used by the relay server to authenticate the terminal device in the media relay path connectivity check phase;

And a replacement unit, configured to generate a new first credential according to the second credential; wherein the new first credential is when the relay server authenticates the terminal device in a next media relay address allocation phase A voucher used to replace the first voucher.
The relay server according to claim 13, wherein the relay server further comprises:

And a sending unit, configured to send, to the terminal device, an update indication message, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.
The relay server according to claim 13 or 14, wherein the replacement unit is specifically configured to:

Using the second voucher as a new first voucher; or

Generating a new first credential based on the first credential and the second credential.
The relay server according to claim 15, wherein said first credential further comprises a first password, said second credential further comprises a second password, said new first credential comprising a new first password The replacement unit includes:

a first generating subunit, configured to generate the new first password according to the first password and the second password.
The relay server according to claim 16, wherein the first generating sub-unit is configured to: perform a one-way function calculation on the first password and the second password to obtain the new one A password.
The relay server according to claim 16 or 17, wherein the new first credential further comprises a new first account; the replacing unit further comprises:

a second generating subunit, configured to generate the new first account according to the first account and the second account.
The relay server according to claim 18, wherein the second generating sub-unit is configured to: perform a one-way function calculation on the first account and the second account, to obtain the new An account.
A relay server, comprising:

a receiving unit, configured to receive, by the terminal device, an update request message that includes a first account and a second account, where the first account is the relay server to the terminal in the media relay address allocation phase The account number in the first certificate used by the device for authentication, the second account is generated by the signaling server, and the relay server authenticates the terminal device during the media relay path connectivity check phase. The account number in the second voucher used;

An authentication unit, configured to authenticate the terminal device by using the second credential;

And a replacement unit, configured to generate a new first credential according to the second credential after the authentication unit is successfully authenticated; wherein the new first credential is the relay in a next media relay address allocation phase A credential used by the server to authenticate the terminal device for replacing the first credential.
The relay server according to claim 20, wherein the relay server further comprises:

And a sending unit, configured to send, to the terminal device, an update indication message, where the update indication message is used to enable the terminal device to generate the new first credential according to the second credential.
The relay server according to claim 20 or 21, wherein the replacement unit is specifically configured to:

Using the second voucher as a new first voucher; or

Generating a new first credential based on the first credential and the second credential.
The relay server according to claim 22, wherein said first credential further comprises a first password, said second credential further comprises a second password, said new first credential comprising a new first password The replacing unit is specifically configured to: generate the new first password according to the first password and the second password.
The relay server according to claim 23, wherein the replacing unit is configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.
A terminal device, comprising:

An obtaining unit, configured to obtain a first account; wherein the first account is an account in a first credential used by the relay server to authenticate the terminal device in the media relay address allocation phase;

a receiving unit, configured to receive a second account sent by the signaling server, where the second account is a connectivity check generated by the signaling server and in the media relay path connectivity check An account in a second credential used by the relay server to authenticate the terminal device;

a sending unit, configured to send, to the relay server, an update request message that includes the first account and the second account, where the update request message is used to enable the relay server to perform the second credential according to the second credential Generating a new first credential; the new first credential is a credential used by the relay server to authenticate the terminal device in a next media relay address allocation phase, for replacing the first credential.
The terminal device according to claim 25, wherein the sending unit is further configured to send a credential indication message to the signaling server, where the credential indication message is used to generate the signaling server Said second voucher.
A terminal device according to claim 25 or 26, characterized in that

The receiving unit is further configured to receive an update indication message sent by the relay server;

The terminal device further includes: a replacement unit, configured to generate the new first credential according to the second credential.
The terminal device according to claim 27, wherein the replacement unit is specifically configured to:

Using the second voucher as the new first voucher; or

Generating the new first credential according to the first credential and the second credential.
The terminal device according to claim 28, wherein the first credential further comprises a first password, the second credential further comprises a second password, and the new first credential comprises a new first password; The replacement unit includes:

a first generating subunit, configured to generate the new first password according to the first password and the second password.
The terminal device according to claim 29, wherein the first generating sub-unit is specifically configured to perform a one-way function calculation on the first password and the second password to obtain the new first password.
The terminal device according to claim 29 or 30, wherein the new first credential further comprises a new first account; the replacing unit further comprises:

a second generating subunit, configured to generate the new first account according to the first account and the second account.
The terminal device according to claim 31, characterized in that

The second generating sub-unit is specifically configured to perform a one-way function calculation on the first account and the second account to obtain the new first account.