WO2010139163A1 - 一种实时数据业务的实现方法和实时数据业务*** - Google Patents

一种实时数据业务的实现方法和实时数据业务*** Download PDF

Info

Publication number
WO2010139163A1
WO2010139163A1 PCT/CN2009/075417 CN2009075417W WO2010139163A1 WO 2010139163 A1 WO2010139163 A1 WO 2010139163A1 CN 2009075417 W CN2009075417 W CN 2009075417W WO 2010139163 A1 WO2010139163 A1 WO 2010139163A1
Authority
WO
WIPO (PCT)
Prior art keywords
user terminal
real
time data
data service
verification
Prior art date
Application number
PCT/CN2009/075417
Other languages
English (en)
French (fr)
Inventor
惠毅
周洋
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US13/257,940 priority Critical patent/US8745396B2/en
Priority to EP09845443.2A priority patent/EP2426873B1/en
Publication of WO2010139163A1 publication Critical patent/WO2010139163A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H04L12/287—Remote access server, e.g. BRAS
    • H04L12/2876—Handling of subscriber policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
    • H04N21/234—Processing of video elementary streams, e.g. splicing of video streams or manipulating encoded video stream scene graphs
    • H04N21/2347—Processing of video elementary streams, e.g. splicing of video streams or manipulating encoded video stream scene graphs involving video stream encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25808—Management of client data
    • H04N21/25816—Management of client data involving client authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25866—Management of end-user data
    • H04N21/25875—Management of end-user data involving end-user authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/266—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel
    • H04N21/26613—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel for generating or managing keys in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/41—Structure of client; Structure of client peripherals
    • H04N21/4104—Peripherals receiving signals from specially adapted client devices
    • H04N21/4126—The peripheral being portable, e.g. PDAs or mobile phones
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/633—Control signals issued by server directed to the network components or client
    • H04N21/6332—Control signals issued by server directed to the network components or client directed to client
    • H04N21/6334—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key
    • H04N21/63345—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key by transmitting keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
    • H04N21/85—Assembly of content; Generation of multimedia applications
    • H04N21/854—Content authoring
    • H04N21/8549—Creating video summaries, e.g. movie trailer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/08—Access point devices

Definitions

  • the present invention relates to the field of communications, and in particular, to a method for realizing real-time data services and a real-time data service system. Background technique
  • mobile terminals for real-time data services. For example, a user can watch a mobile phone TV using a mobile TV client, and use a mobile streaming client to view audio and video programs or live audio and video programs.
  • the development of real-time data services will effectively enhance the mobile phone user experience in the 3G era.
  • the operation based on real-time data services will also become a hot spot and focus for operators in the 3G era.
  • Real-time data services include: mobile TV, video on demand, live video, and more.
  • the real-time data service server is deployed in the WLAN (Wireless Local Area Networks)
  • the user can access the real-time data service server by using the real-time data service client on the mobile terminal to obtain the real-time service data stream, including browsing the mobile TV program.
  • Real-time data service experience such as video on demand and live video.
  • WAPI Wired Equivalent Privacy
  • Wired Equivalent Privacy Wired Equivalent Privacy
  • IEEE802.il Wired Equivalent Privacy
  • the WAPI protocol mainly performs the access authentication and key negotiation of the mobile terminal through the authentication and key management procedures specified by the WAI (WLAN Authentication Infrastructure) protocol, and passes the WPI (WLAN Privacy Infrastructure, WLAN Privacy Infrastructure).
  • the encryption and decryption process specified by the protocol completes the encrypted transmission of data at the MAC (Media Access Control) layer to ensure that the legitimate mobile terminal securely accesses the real-time data service server.
  • MAC Media Access Control
  • the WAI protocol specifies two methods of authentication and key management:
  • the WLAN mobile terminal (commonly referred to as the mobile terminal) exchanges the WAPI certificate of both parties with the AP (access point), and completes the certificate authentication through the authentication server, and performs the base key in the certificate authentication process (BK).
  • BK certificate authentication process
  • the mobile terminal and the AP use the negotiated base key to negotiate the session key, and obtain a session key such as a unicast session key and a multicast key;
  • the mobile terminal and the AP respectively use the same pre-shared key (PSK) to derive the base key, and use the derived base key to negotiate the session key to obtain a unicast session key and multicast.
  • PSK pre-shared key
  • a session key such as a key.
  • Any type of authentication and key management can be used in a real-time data service system that supports wireless LAN as an access network. Certificate-based authentication and key management methods have higher security, but the process is more complicated. APs in real-time data service systems need to use ECDH (Diffie-Hellman Diffie-Herman) exchange algorithm for elliptic curve cryptosystem. Each accessed mobile terminal generates a base key, which is computationally intensive. The pre-shared key based authentication and key management method is less secure, but the process is simple, and multiple mobile terminals can use the same pre-shared key (ie, use the same base key), thereby reducing the generation of the base key. The amount of calculation and management costs.
  • FIG. 1 is a real-time real-time authentication and key management method based on pre-shared key.
  • the access point (AP) of the mobile terminal and the real-time data service system uses a pre-shared key to derive a base key (BK).
  • the mobile terminal and the AP use the base key to complete the negotiation of the session key, and negotiate a session key such as a unicast session key and a multicast session key between the mobile terminal and the AP.
  • the AP opens the control port, allowing the mobile terminal to interact with the real-time data service server of the real-time data service system.
  • the mobile terminal interacts with the real-time data service server to complete transmission of real-time data service control signaling;
  • the unicast session key negotiated in step 102 is used to encrypt and transmit the control signaling message between the mobile terminal and the AP, and there is a relatively secure communication link between the AP and the real-time data service server. Therefore, it is possible to perform plaintext transmission or use other security methods for transmission of control signaling messages.
  • control signaling includes: negotiating real-time data service parameters, establishing an audio and video transmission channel, and starting/controlling the transmission of audio and video data of real-time data services, for example:
  • the mobile terminal sends a paging request (Describe Request) signaling to the real-time data service server, and sends the media parameter supported by the mobile terminal to the real-time data service service; the real-time data service server passes the AP to the mobile terminal.
  • Describe Request a paging request
  • the media parameter selected by the real-time data service server is sent to the mobile terminal; through the signaling interaction, the mobile terminal and the real-time data service server complete the negotiation of the real-time data service media parameter;
  • the mobile terminal sends an audio and video transmission channel setup request (Setup Request) signaling to the real-time data service server through the AP; the real-time data service server sends an audio and video transmission channel construction response (Set Response) signaling to the mobile terminal through the AP; Signaling interaction, establishing an audio and video transmission channel between the mobile terminal and the real-time data service server; 103c: The mobile terminal sends audio and video data playback control signaling (for example, Play, Pause, Stop, etc.) to the real-time data service server through the AP, so as to start, pause, and stop the transmission of the audio and video data. .
  • Audio and video data playback control signaling for example, Play, Pause, Stop, etc.
  • the real-time data service server sends audio and video data to the mobile terminal through the AP.
  • the real-time data service server and the AP can transmit audio and video data messages in plain text or in other secure manners.
  • the audio and video data message is encrypted and transmitted between the AP and the mobile terminal by using the unicast session key or the multicast key negotiated in step 102.
  • the real-time data service server and the mobile terminal can transmit the control signaling message at any time, but the audio and video data and the control signal So that it will not be transmitted in the same message, that is, audio and video data and control signaling are transmitted in different logical channels.
  • the WAI authentication and key management method based on the pre-shared key can be used in the real-time data service system to eliminate the interaction process between the AP and the authentication server, and reduce the calculation amount of the AP, and increase the simultaneous access.
  • the number of mobile terminals of the AP can be provided at the same time.
  • the real-time data service operator can provide the same pre-shared key to multiple subscribers, and the user (mobile terminal) can use the pre-shared key to access the real-time data service system for previewing the real-time data service.
  • the technical problem to be solved by the present invention is to overcome the deficiencies of the prior art, and provide a real-time data service implementation method and a real-time data service system, so as to improve real-time data sharing based on pre-shared key authentication and key management.
  • the security of the data service system is to overcome the deficiencies of the prior art, and provide a real-time data service implementation method and a real-time data service system, so as to improve real-time data sharing based on pre-shared key authentication and key management.
  • a method for realizing a real-time data service comprising:
  • the AP After the AP of the real-time data service system starts to forward the data packet to the accessed user terminal, the AP verifies the user terminal, and after the verification succeeds, the AP continues to forward the data packet to the user terminal.
  • Pre-setting the preview duration value determining that the length of time that the AP forwards the data packet to the user terminal exceeds the preview duration
  • the preview data amount threshold is set in advance, and it is determined that the amount of data for forwarding the data message to the user terminal exceeds the preview data amount threshold.
  • the signature verification timer is further activated when the AP starts the verification; when the signature verification timer expires and the signature verification response from the user terminal is not received, the data message is stopped from being forwarded to the user terminal.
  • the process of performing the verification includes:
  • the AP sends a signature verification request to the user terminal.
  • the user terminal After receiving the signature verification request, the user terminal generates a signature value by using the private key corresponding to the WAPI certificate, and the signature value is carried in the signature verification response and sent to the AP;
  • the AP decrypts the received signature value by using the public key corresponding to the WAPI certificate, compares the obtained decrypted value with the data to be signed, and determines that the verification succeeds when the comparison result is consistent.
  • the signature verification response further includes a WAPI certificate of the user terminal; After receiving the signature verification response, the AP further verifies the validity of the WAPI certificate with the authentication server, and performs subsequent operations on the signature value when the WAPI certificate is valid.
  • the method for generating the signature value is:
  • the user terminal uses the random number generated by the AP or the hash value of the received data packet as the data to be signed, and uses the private key to encrypt the data to be signed to generate the signature value.
  • the AP When the verification is performed, the AP further suspends forwarding of the data message to the user terminal.
  • the method is implemented after the user terminal accesses the real-time data service system by using a pre-shared key-based authentication and key management method.
  • a real-time data service system for providing real-time data services for user terminals; the system comprises: an AP and a user terminal for accessing a real-time data service system; wherein:
  • the AP is configured to: after forwarding the data packet to the user terminal, verify the user terminal, and continue to forward the data packet to the user terminal after the verification succeeds;
  • the user terminal is configured to perform the verification by using the AP.
  • the system further includes a signature verification timer for performing timing operations under control of the AP; stopping the user when the signature verification timer expires and feedback from the user terminal for verification is not received
  • the terminal forwards data packets.
  • the system further includes an authentication server; the AP is further configured to verify the validity of the WAPI certificate included in the feedback with the authentication server upon receiving feedback for verification from the user terminal.
  • the AP is further configured to suspend forwarding of the data message to the user terminal.
  • the user terminal is a mobile terminal.
  • the method and system of the present invention are used to identify a pre-shared key based authentication.
  • the user can be authenticated before the user obtains the service data in a large amount, so that the access security can be effectively improved.
  • the method and system of the present invention can provide the user with the user first.
  • the service data is previewed for free, and the WAPI certificate and signature of the user are obtained and verified by initiating a signature authentication request to the user, and the charging is started, which facilitates the user and facilitates the operator to promote the real-time data service.
  • FIG. 1 is a flow chart of a real-time data service implementation method using a pre-shared key based authentication and key management method in the prior art
  • FIG. 2 is a flow chart of a method for realizing a real-time data service based on a wireless local area network according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of an MPDU encapsulation structure of a WPI
  • FIG. 4 is a schematic diagram of an MPDU encapsulation structure including a signature verification request identifier
  • FIG. 5 is a block diagram showing the structure of a real-time data service system in which the method of the present invention can be implemented. detailed description
  • the main idea of the present invention is: the mobile terminal accesses the real-time data service system by using the pre-shared key-based WAI authentication and key management mode, and the AP of the real-time data service system starts to transmit the pronunciation video data message to the mobile terminal.
  • the AP sends a signature verification request to the mobile terminal; the AP verifies the signature value returned by the mobile terminal, and continues to send the audio and video data message to the mobile terminal after the verification succeeds, otherwise stops sending the audio and video data message to the mobile terminal.
  • FIG. 2 is a flow chart of a method for realizing a real-time data service based on a wireless local area network according to an embodiment of the present invention, where the method includes:
  • the AP of the mobile terminal and the real-time data service system derives the BK by using a pre-shared key.
  • the AP opens the control port, allowing the mobile terminal to interact with the real-time data service server of the real-time data service system.
  • the mobile terminal interacts with the real-time data service server through the AP to perform real-time data service control signaling packet transmission, to negotiate media parameters of the real-time data service, establish an audio and video transmission channel, and finally start real-time data service.
  • the control signaling packet is encapsulated in an MPDU (MAC Protocol Data Unit) for transmission between the mobile terminal and the AP.
  • MPDU MAC Protocol Data Unit
  • the real-time data service server After the real-time data service is started, the real-time data service server sends the audio and video data packet of the real-time data service to the mobile terminal through the AP.
  • the AP After receiving the audio and video data packet sent by the real-time data service server to the mobile terminal, the AP uses the session key (multicast session key or unicast session key) negotiated in step 202 to transmit the audio and video data packet. Encryption is performed, and the encrypted audio and video data packet is encapsulated into an MPDU and sent to the mobile terminal.
  • session key multicast session key or unicast session key
  • Figure 3 is a schematic diagram of the WPI MPDU encapsulation structure, where:
  • the length of the MAC header field is 24 bytes or 30 bytes
  • the session key index field is 1 byte long and represents the USKID (unicast session key index) or MSKID (multicast session key index) or STAKeylD (inter-station key index) value, which means that the encrypted MPDU is used.
  • USKID unicast session key index
  • MSKID multicast session key index
  • STAKeylD inter-station key index
  • the reserved field is 1 byte in length
  • the length of the PN (data packet sequence number) field is 16 bytes, and the value of this field can be used as the IV (initial vector) required for data encryption and decryption;
  • the PDU (data) field is encapsulated with MPDU data, and the maximum length is 2278 bytes, which is encapsulated with high-layer protocol data packets, including control signaling packets and audio and video data of real-time data services.
  • Application layer protocol data packets such as packets;
  • the MIC (Integrity Check Code) field is 16 bytes in length
  • the length of the FCS field is 4 bytes, which is the frame check sequence of the MAC frame format.
  • FIG. 3 also shows a method for encapsulating control signaling packets and audio and video data packets of a real-time data service.
  • the control signaling packet and the audio and video data packet of the real-time data service are collectively referred to as a real-time data service packet, and are composed of a real-time data service packet header and real-time service data.
  • the types of real-time service data include: a real-time data service control signal. Audio and video data for real-time data services.
  • the real-time data service packet header contains information such as the type of real-time service data.
  • the real-time data service packet can be encapsulated in a TCP (Transfer Control Protocol) packet or a UDP (User Datagram Protocol) packet.
  • TCP Transfer Control Protocol
  • UDP User Datagram Protocol
  • the TCP header and the UDP header contain information such as the port number used by the real-time data service.
  • TCP packets and UDP packets can be encapsulated in IP (Internet Protocol) packets for transmission.
  • IP Internet Protocol
  • the IP header contains information such as the IP address of the mobile terminal/real-time data service server.
  • control signaling packet and the audio and video data packet of the real-time data service shown in FIG. 3 in the PDU field is only an example, and the control of the real-time data service may be encapsulated by other encapsulation methods.
  • Signaling message and audio and video data message are only an example, and the control of the real-time data service may be encapsulated by other encapsulation methods.
  • the mobile terminal After receiving the MPDU encapsulated with the audio and video data packet, the mobile terminal uses the session key (multicast session key or unicast session key) negotiated in step 202 to encrypt the audio and video data packet in the PDU field. After decryption, the audio and video data encapsulated in the audio and video data message is played.
  • session key multicast session key or unicast session key
  • the AP sends a signature verification request to the mobile terminal and starts a timer (which may be referred to as a signature verification timer).
  • the signature verification request sent by the AP may be an MPDU including a signature verification request identifier.
  • the reserved field in the MPDU may be used as a signature verification request identifier. For example, when the value of the field is 1, the MPDU is a signature verification request. When the field is 0, the MPDU is encapsulated with a control signaling report.
  • the PDU field of the signature verification request may include a random number generated by the AP, and the mobile terminal may use the random number as data to be signed, or use the random number to generate data to be signed.
  • the PDU field in the signature verification request may also be an encrypted audio and video data packet, that is, after the AP receives the audio and video data sent by the real-time data service server, the AP encrypts and encapsulates the audio and video data in the MPDU, and The signature verification request identifier is set in the MPDU and sent to the mobile terminal.
  • the AP may suspend the transmission of the video data message to the mobile terminal until the signature verification is passed, and then resume the pronunciation video data message.
  • the AP can buffer audio and video data messages sent by the real-time data service server to the mobile terminal.
  • the mobile terminal After receiving the signature verification request, the mobile terminal encrypts the data to be signed by using the private key corresponding to the WAPI certificate, generates a signature value, and returns a signature verification port containing the signature value to the AP.
  • the data to be signed may be all or part of the data in the PDU field of the signature verification request, or may be a hash (HASH) value of all or part of the data in the PDU field.
  • HASH hash
  • the data to be signed may be the random number itself; if the PDU field of the signature verification request includes the encrypted audio and video data message, The data to be signed may be a hash value of the audio data data message.
  • the above-mentioned data to be signed may also be generated by the mobile terminal, for example: the data to be signed is The random number generated by the mobile terminal.
  • the mobile terminal needs to include the data to be signed in the signature verification response and send it to the AP, so that the AP verifies the signature value.
  • the signature verification response may further include a WAPI certificate of the mobile terminal, and the WAPI certificate includes a public key corresponding to the certificate.
  • the signature verification response may not include the WAPI certificate.
  • the AP After receiving the signature verification response, if the response includes the WAPI certificate of the mobile terminal, the AP sends a certificate authentication request including the WAPI certificate to the authentication server of the real-time data service system to verify the validity of the WAPI certificate.
  • step 212 If the AP does not receive the signature verification response sent by the mobile terminal before the signature verification timer expires, the process jumps to step 212.
  • the authentication server After receiving the certificate authentication request, the authentication server verifies the WAPI certificate contained therein, and the certificate verification result is included in the certificate authentication response and sent to the AP.
  • the AP obtains the validity of the WAPI certificate according to the certificate verification result returned by the authentication server, or performs local verification on the WAPI certificate to determine the validity of the WAPI certificate; if the WAPI certificate of the mobile terminal is invalid (for example: the certificate has been revoked, the certificate If the signature is successful, the AP performs the step 213; if the signature verification is successful, if the WAPI certificate is valid, the AP uses the public key corresponding to the WAPI certificate to verify the signature value included in the signature verification response. If the signature verification fails, step 212 is performed.
  • the above process of verifying a signature may include the following steps:
  • 211b Compare the decrypted value with the data to be signed. If the two are the same, the signature value is considered correct, and the signature verification is successful. If the two are different, the signature value is considered incorrect, and the signature verification fails.
  • the data to be signed may be the PDU that the AP is saving when sending the signature verification request. All or part of the data in the field, or a hash value of all or part of the data in the PDU field; may also be data generated by the mobile terminal and included in the signature verification response.
  • the AP stops forwarding the received audio and video data packet to the mobile terminal; in addition, the AP may also send the data to the real-time data service server.
  • a real-time data service stop request is sent to instruct the real-time data service server to stop transmitting audio and video data to the mobile terminal.
  • the AP continues to forward the real-time data service server to the mobile terminal to send the audio and video data message.
  • the foregoing embodiment may also have multiple transformation modes, for example: (1) After sending the signature verification request, the AP may continue to transmit the pronunciation video data message to the mobile terminal until the signature verification fails or the signature verification The timer expires to prevent the cached audio and video data packets from occupying the AP's system resources.
  • the AP can also directly discard the received audio and video data packets.
  • the data to be signed may be a random number generated by the AP, a hash value of the audio data packet transmitted by the real-time data service server, or a random number generated by the mobile terminal, and the data to be signed may be a signature verification response in addition to the PDU.
  • the replay attack initiated by the illegal mobile terminal can be prevented to the greatest extent.
  • the preview time length threshold T and the preview data volume value N may also be random values.
  • the AP may start to use the WAPI certificate to charge the user (for example, according to traffic or according to the duration), or notify the charging network in the real-time data service system.
  • the element starts charging (for example, the AP sends a charging request message carrying the WAPI certificate to the charging network element every 10 minutes, indicating that the charging network element is in accordance with the time. If the AP forwards a 1M audio and video data packet, the AP sends a charging request message carrying the WAPI certificate to the charging network element, indicating that the charging network element is charged according to the traffic accounting.
  • FIG. 5 is a schematic structural diagram of a real-time data service system that can implement the method of the present invention; as shown in FIG. 5, the system includes: an AP, a real-time data service server, and an authentication server;
  • the real-time data service server is configured to access the real-time data service system by using the pre-shared key-based authentication and key management mode on the mobile terminal, and start the real-time data service, and then send the audio and video data of the real-time data service to the mobile terminal through the AP.
  • the AP is configured to forward the audio and video data packet of the real-time data service to the mobile terminal, and when the length of the voiced video data packet exceeds the preview time length, or the data volume of the forwarded audio and video data packet exceeds the preview data volume
  • the signature verification request is sent to the mobile terminal; and after receiving the signature value generated by the mobile terminal using the private key corresponding to the WAPI certificate, the signature value is verified by using the public key corresponding to the WAPI certificate, if the verification fails Then, the audio and video data message of the real-time data service is forwarded to the mobile terminal.
  • the authentication server is configured to verify the validity of the WAPI certificate included in the request after receiving the certificate authentication request, and return the certificate verification result;
  • the AP is further configured to: after receiving the signature verification response, send a certificate authentication request including the WAPI certificate of the mobile terminal to the authentication server, and determine, according to the certificate verification result returned by the authentication server, whether the WAPI certificate is a valid certificate; when the WAPI certificate is a valid certificate When the WAPI certificate is an invalid certificate, the audio and video data message of the real-time data service is stopped from being forwarded to the mobile terminal.
  • the AP is further configured to start a signature verification timer when the signature verification request is sent, and if the signature value sent by the mobile terminal is not received before the signature verification timer expires, stop forwarding the audio and video datagram of the real-time data service to the mobile terminal. Text.
  • the AP is further configured to suspend the audio and video data message of the real-time data service to the mobile terminal when the signature verification request is sent; after receiving the signature verification response, if the verification of the signature value is successful, The audio and video data message of the real-time data service is continuously forwarded to the mobile terminal.
  • a communication entity capable of performing operations such as corresponding access, authentication, and the like is not necessarily limited to a mobile terminal, and other may be via a mobile network.
  • User terminals such as fixed terminals that are indirectly accessed may perform operations such as access, authentication, and the like. In fact, regardless of the form of the user terminal, the user terminal can perform the operations such as access, authentication, and the like smoothly.
  • the method and system of the present invention when used to access the real-time data service system by using the pre-shared key-based authentication and key management mode, it is ensured that the user is performed before the user obtains a large amount of service data.
  • the authentication can effectively improve the access security.
  • the method and system of the present invention can provide the user with free preview service data, and then start the billing in the preview name, the user is convenient and beneficial. Operators promote real-time data services.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Multimedia (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Graphics (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种实时数据业务的实现方法和实时数据业务***，均可以在实时数据业务***的AP开始向接入的用户终端转发数据报文后，AP对该用户终端进行验证，并在验证成功后继续向该用户终端转发数据报文。可见，采用本发明的方法及***，在采用基于预共享密钥的鉴别和密钥管理方式接入实时数据业务***时，能够保证在用户大量获取业务数据之前进行对用户的认证，因此能有效提高接入安全性；此外，本发明的方法及***可以先向用户提供免费的预览业务数据，在预览结束后通过向用户发起签名认证请求来获取并验证用户的WAPI证书及签名，并开始进行计费，方便了用户，有利于运营商推广实时数据业务。

Description

一种实时数据业务的实现方法和实时数据业务*** 技术领域
本发明涉及通信领域， 尤其涉及一种实时数据业务的实现方法和实时 数据业务***。 背景技术
随着 3G网络的成熟以及移动终端性能的提升，利用移动终端进行实时 数据业务已经成为可能。 例如， 用户可以使用手机电视客户端观看手机电 视、 利用手机流媒体客户端进行音视频节目的点播或音视频直播节目的观 看。 实时数据业务的发展将会有效提升 3G时代的手机用户体验，基于实时 数据业务的运营也将成为 3G时代运营商关注的热点和重点。
实时数据业务包括： 手机电视、 视频点播、 视频直播等。 在 WLAN ( Wireless Local Area Networks , 无线局域网） 中部署实时数据业务服务器 后， 用户可以使用移动终端上的实时数据业务客户端接入实时数据业务服 务器， 获取实时业务数据流， 进行包括手机电视节目浏览、 视频点播、 视 频直播等实时数据业务的体验。
由于无线局域网安全性不高， 为了保护合法移动终端安全、 高质量地 使用实时数据业务， 防止非法移动终端接入实时数据业务服务器， 必须釆 用某种无线局域网认证和保护协议以提高实时数据业务的安全性， WAPI ( WLAN Authentication and Privacy Infrastructure ,无线局 i或网鉴别与保密基 础结构）协议无疑是一种最佳的选择。
WAPI是针对 IEEE802.il中 WEP ( Wried Equivalent Privacy,有线等效 隐私）等协议的安全问题， 经多方反复论证， 充分考虑各种应用模式， 在 中国无线局域网国家标准 GB15629.il中提出的 WLAN安全解决方案。 WAPI协议主要通过 WAI ( WLAN Authentication Infrastructure , 无线局 域网鉴别基础结构）协议规定的鉴别和密钥管理过程进行移动终端的接入 认证和密钥的协商， 并通过 WPI ( WLAN Privacy Infrastructure, 无线局域 网保密基础结构）协议规定的加解密过程完成数据在 MAC ( Media Access Control, 介质访问控制）层的加密传输， 以保证合法的移动终端安全地接 入实时数据业务服务器。
WAI协议规定了两种鉴别和密钥管理方式：
( 1 )基于证书的鉴别和密钥管理方式
釆用这种方式时， 无线局域网移动终端（通常简称为移动终端）与 AP (接入点） 交换双方的 WAPI证书， 并通过鉴别服务器完成证书鉴别， 在 证书鉴别过程中进行基密钥 （BK ) 的协商； 基密钥协商完成后， 移动终端 和 AP使用协商出的基密钥进行会话密钥的协商，得到单播会话密钥、组播 密钥等会话密钥；
( 2 )基于预共享密钥的鉴别和密钥管理方式
釆用这种方式时， 移动终端和 AP分别使用相同的预共享密钥 （PSK ) 导出基密钥， 并使用导出的基密钥进行会话密钥的协商， 得到单播会话密 钥、 组播密钥等会话密钥。
在支持将无线局域网作为接入网的实时数据业务***中可以釆用任意 一种鉴别和密钥管理方式。 基于证书的鉴别和密钥管理方式具有较高的安 全性， 但过程较为复杂； 实时数据业务***的 AP需要釆用 ECDH (椭圓曲 线密码体制的 Diffie-Hellman戴菲-赫曼） 交换算法为每一接入的移动终端 生成基密钥， 计算量较大。 基于预共享密钥的鉴别和密钥管理方式安全性 较低， 但过程简单， 多个移动终端可以使用相同的预共享密钥 （即使用相 同的基密钥）， 因此可以减少生成基密钥的计算量和管理成本。
图 1 是现有技术中釆用基于预共享密钥的鉴别和密钥管理方式的实时 数据业务实现方法流程图， 该方法包括：
101 : 移动终端与实时数据业务***的接入点（AP )采用预共享密钥导 出基密钥 （BK )。
102: 移动终端和 AP使用基密钥完成会话密钥的协商， 在移动终端和 AP之间协商出单播会话密钥、 组播会话密钥等会话密钥。
完成 WAI协议的鉴别和会话密钥协商过程后， AP打开控制端口， 允 许移动终端与实时数据业务***的实时数据业务服务器进行交互。
103: 移动终端和实时数据业务服务器进行交互， 完成实时数据业务控 制信令的传输；
在此过程中，移动终端和 AP之间使用步骤 102中协商得到的单播会话 密钥对控制信令报文进行加密传输，而 AP和实时数据业务服务器之间由于 存在较为安全的通信链路， 因此可以进行明文传输、 或使用其他安全方式 进行控制信令报文的传输。
其中， 控制信令的主要作用包括： 进行实时数据业务参数的协商、 建 立音视频传输通道、 启动 /控制实时数据业务音视频数据的传输等， 例如：
103a:移动终端通过 AP向实时数据业务服务器发送寻呼请求（ Describe Request )信令， 将移动终端支持的媒体参数发送给实时数据业务服务； 实时数据业务服务器通过 AP向移动终^
信令， 将实时数据业务服务器选定的媒体参数发送给移动终端； 通过上述 信令交互， 移动终端与实时数据业务服务器完成实时数据业务媒体参数的 协商；
103b:移动终端通过 AP向实时数据业务服务器发送音视频传输通道构 建请求（ Setup Request )信令； 实时数据业务服务器通过 AP向移动终端发 送音视频传输通道构建响应 （ Setup Response )信令； 通过上述信令交互， 在移动终端与实时数据业务服务器之间建立音视频传输通道； 103c:移动终端通过 AP向实时数据业务服务器发送音视频数据播放控 制信令（例如， Play (播放）、 Pause (暂停）、 Stop (停止）等）， 以便启动、 暂停、 停止音视频数据的传输。
104: 实时数据业务服务器通过 AP向移动终端发送音视频数据； 同样， 在此过程中实时数据业务服务器与 AP之间可以釆用明文方式、 或釆用其他安全方式进行音视频数据报文的传输，而在 AP和移动终端之间 使用步骤 102 中协商得到的单播会话密钥或组播密钥对音视频数据报文进 行加密传输。
需要注意的是， 在实时数据业务服务器向移动终端传输音视频数据报 文的过程中， 实时数据业务服务器和移动终端之间可以随时进行控制信令 报文的传输， 但是音视频数据和控制信令不会在相同的报文中传输， 也就 是说， 音视频数据和控制信令在不同的逻辑通道中传输。
通过以上描述可知， 在实时数据业务***中釆用基于预共享密钥的 WAI鉴别和密钥管理方式可以免去 AP与鉴别服务器的交互过程， 并减少 AP的计算量， 增加了可同时接入 AP的移动终端的数量。 同时， 实时数据 业务运营商可以向多个签约用户提供相同的预共享密钥， 用户 （移动终端） 可以使用该预共享密钥接入实时数据业务***， 进行实时数据业务的预览。
但是， 上述方法也存在以下不足之处：
1 )使用预共享密钥导出的基密钥的安全性不高， 预共享密钥泄露后， 非法用户可以使用该预共享密钥对应的基密钥与 AP进行会话密钥的协商， 接入实时数据业务***；
2 )由于基于预共享密钥的鉴别和密钥管理方式无需向实时数据业务系 统提供移动终端的 WAPI证书， 因此无法实现计费， 只能为用户提供免费 的预览节目； 用户必须使用基于证书的鉴别和密钥管理方式重新接入实时 数据业务***后才能接收收费的业务数据。 发明内容
本发明所要解决的技术问题是， 克服现有技术的不足， 提供一种实时 数据业务的实现方法和实时数据业务***， 以提高釆用基于预共享密钥的 鉴别和密钥管理方式接入实时数据业务***的安全性。
为了解决上述问题， 本发明技术方案是这样实现的：
一种实时数据业务的实现方法， 该方法包括：
在实时数据业务***的 AP 开始向接入的用户终端转发数据报文后， AP对该用户终端进行验证， 并在验证成功后继续向该用户终端转发数据报 文。
进一步包含触发 AP进行所述验证的操作：
预先设置预览时长阔值，确定 AP向所述用户终端转发数据报文的时间 长度超过该预览时长阔值；
或者， 预先设置预览数据量阔值， 确定向所述用户终端转发数据报文 的数据量超过该预览数据量阔值。
在 AP开始进行所述验证时进一步启动签名验证定时器；在该签名验证 定时器超时、 并且未收到来自所述用户终端的签名验证响应的情况下， 停 止向该用户终端转发数据报文。
进行所述验证的过程包括：
AP向用户终端发送签名验证请求；
接收到所述签名验证请求后， 用户终端使用其 WAPI证书所对应的私 钥生成签名值， 并将该签名值携带于签名验证响应中发送给 AP;
AP使用 WAPI证书所对应的公钥对收到的所述签名值进行解密， 对所 得解密值与待签名数据进行一致性对比， 并在对比结果为一致时确定验证 成功。
所述签名验证响应中还包含所述用户终端的 WAPI证书； 接收到所述签名验证响应后， AP进一步与鉴别服务器验证该 WAPI证 书的有效性， 并在该 WAPI证书有效时针对所述签名值进行后续操作。
所述签名值的生成方法为：
所述用户终端将由所述 AP生成的随机数、或者接收到的数据报文的哈 希值作为待签名数据， 使用私钥对该待签名数据进行加密生成所述签名值。
进行所述验证时， AP进一步暂停向所述用户终端转发数据报文。
该方法是在所述用户终端釆用基于预共享密钥的鉴别和密钥管理方式 接入实时数据业务***后实施的。
一种实时数据业务***， 用于为用户终端提供实时数据业务； 该*** 包含： AP以及接入实时数据业务***用户终端； 其中：
所述 AP, 用于在向所述用户终端转发数据报文后， 对该用户终端进行 验证， 并在验证成功后继续向该用户终端转发数据报文；
所述用户终端， 用于配合所述 AP进行所述验证。
该***进一步包括签名验证定时器，用于受所述 AP的控制而进行定时 操作； 在该签名验证定时器超时、 并且未收到来自所述用户终端的针对验证的反 馈时， 停止向该用户终端转发数据报文。
该***进一步包括鉴别服务器； 在接收到来自所述用户终端的针对验 证的反馈时， 所述 AP进一步用于与该鉴别服务器验证该反馈中所包含的 WAPI证书的有效性。
在进行所述验证时，所述 AP进一步用于暂停向所述用户终端转发数据 报文。
所述用户终端是移动终端。
综上所述， 釆用本发明的方法及***， 在釆用基于预共享密钥的鉴别 和密钥管理方式接入实时数据业务***时， 能够保证在用户大量获取业务 数据之前进行对用户的认证， 因此能有效提高接入安全性； 此外， 本发明 的方法及***可以先向用户提供免费的预览业务数据， 在预览结束后通过 向用户发起签名认证请求来获取并验证用户的 WAPI证书及签名， 并开始 进行计费， 方便了用户， 有利于运营商推广实时数据业务。 附图说明
图 1 是现有技术中釆用基于预共享密钥的鉴别和密钥管理方式的实时 数据业务实现方法流程图；
图 2是本发明实施例基于无线局域网的实时数据业务的实现方法流程 图；
图 3是 WPI的 MPDU封装结构示意图；
图 4是包含签名验证请求标识的 MPDU封装结构示意图；
图 5是可实现本发明方法的实时数据业务***的结构示意图。 具体实施方式
本发明的主要思路是： 移动终端釆用基于预共享密钥的 WAI鉴别和密 钥管理方式接入实时数据业务***，并且实时数据业务***的 AP开始向移 动终端转发音视频数据报文之后， AP 向移动终端发送签名验证请求； AP 对移动终端返回的签名值进行验证， 验证通过后继续向其发送音视频数据 报文， 否则停止向其发送音视频数据报文。
下面将结合附图和实施例对本发明进行详细描述。
图 2是本发明实施例基于无线局域网的实时数据业务的实现方法流程 图， 该方法包括：
201 : 移动终端与实时数据业务***的 AP采用预共享密钥导出 BK。 202: 移动终端和 AP使用基密钥完成会话密钥的协商， 在移动终端和 AP之间协商出单播会话密钥、 组播会话密钥等会话密钥。
会话密钥协商完成后， AP打开控制端口， 允许移动终端与实时数据业 务***的实时数据业务服务器进行交互。
203: 移动终端与实时数据业务服务器通过 AP进行交互， 进行实时数 据业务控制信令报文的传输， 以协商实时数据业务的媒体参数、 建立音视 频传输通道、 最终启动实时数据业务。
其中， 在移动终端和 AP之间， 控制信令报文被加密后封装在 MPDU ( MAC Protocol Data Unit, 介质访问控制协议数据单元） 中进行传输。
204: 实时数据业务启动后， 实时数据业务服务器通过 AP向移动终端 发送实时数据业务的音视频数据报文。
205: 接收到实时数据业务服务器发送给移动终端的音视频数据报文 后， AP使用步骤 202协商得到的会话密钥（组播会话密钥或单播会话密钥） 对该音视频数据报文进行加密， 并将加密后的音视频数据报文封装到 MPDU中发送给移动终端。
具体的报文封装结构可参见图 3 , 图 3是 WPI的 MPDU封装结构示意 图， 其中：
MAC头字段的长度为 24字节或 30字节；
会话密钥索引字段长度为 1个字节，表示 USKID (单播会话密钥索引） 或 MSKID (组播会话密钥索引）或 STAKeylD (站间密钥索引）值， 即表 示加密本 MPDU所使用的会话密钥的索引；
保留字段的长度为 1字节；
PN (数据分组序号）字段的长度为 16字节， 该字段的值可以作为数据 加解密时所需的 IV (初始向量）；
PDU (数据 )字段封装有 MPDU数据， 最大长度为 2278字节， 其中封 装有高层协议数据报文， 包括实时数据业务的控制信令报文和音视频数据 报文等应用层协议数据报文；
MIC (完整性校验码 )字段的长度为 16字节；
FCS字段的长度为 4字节， 为 MAC帧格式的帧校验序列。
此外， 图 3 中还示出了一种实时数据业务的控制信令报文和音视频数 据报文的封装方式。
其中， 实时数据业务的控制信令报文和音视频数据报文统称为实时数 据业务报文， 由实时数据业务报文头和实时业务数据组成； 实时业务数据 的类型包括： 实时数据业务的控制信令和实时数据业务的音视频数据。 实 时数据业务报文头中包含有实时业务数据的类型等信息。
实时数据业务报文可以封装在 TCP ( Transfer Control Protocol , 传输控 制协议）报文或 UDP ( User Datagram Protocol, 用户数据报协议）报文中 传输。 在 TCP头和 UDP头中包含有实时数据业务所使用的端口号等信息。
TCP报文和 UDP报文可以封装在 IP ( Internet Protocol , 因特网协议） 报文中传输。 在 IP头中包含有移动终端 /实时数据业务服务器的 IP地址等 信息。
需要注意的是， 图 3 所示的实时数据业务的控制信令报文和音视频数 据报文在 PDU字段中的封装方式仅是一种示例， 也可以釆用其它封装方式 封装实时数据业务的控制信令报文和音视频数据报文。
Figure imgf000011_0001
206: 接收到封装有音视频数据报文的 MPDU后， 移动终端使用步骤 202协商得到的会话密钥 （组播会话密钥或单播会话密钥）对 PDU字段中 的加密音视频数据报文进行解密后， 播放音视频数据报文中封装的音视频 数据。
207: 向移动终端加密转发音视频数据的时间长度超过预先设定的时长 (可以称为预览时长阔值 T )、 或转发的音视频数据的数据量超过预先设定 的大小 （可以称为预览数据量阔值 N )后， AP向移动终端发送签名验证请 求， 并启动定时器（可以称为签名验证定时器）。
AP发送的签名验证请求可以是包含签名验证请求标识的 MPDU。如图 4所示， 可以将 MPDU中的保留字段作为签名验证请求标识， 例如， 该字 段值为 1时表示该 MPDU是签名验证请求，该字段为 0时表示该 MPDU是 封装有控制信令报文或音视频数据报文的正常 MPDU。
签名验证请求的 PDU字段中可以包含 AP生成的随机数， 移动终端可 以将该随机数作为待签名数据、 或使用该随机数生成待签名数据。
此外，签名验证请求中的 PDU字段中也可以是加密的音视频数据报文， 即 AP接收到实时数据业务服务器发送的音视频数据之后，将该音视频数据 加密封装在 MPDU中，并在该 MPDU中设置签名验证请求标识后发送给移 动终端。
需要注意的是， 在发送签名验证请求之后， AP可以暂停向移动终端转 发音视频数据报文， 直到签名验证通过后再恢复转发音视频数据报文。 在 此过程中， AP可以緩存实时数据业务服务器发送给该移动终端的音视频数 据报文。
208: 接收到签名验证请求后， 移动终端使用 WAPI证书对应的私钥对 待签名数据进行加密， 生成签名值， 并向 AP返回包含该签名值的签名验证 口向应。
上述待签名数据可以是签名验证请求的 PDU 字段中的全部或部分数 据、 也可以是 PDU字段中的全部或部分数据的哈希 （HASH )值。 例如， 如果签名验证请求的 PDU字段中包含 AP生成的长度较小的随机数， 则待 签名数据可以是该随机数本身； 如果签名验证请求的 PDU字段中包含加密 的音视频数据报文， 则待签名数据可以是该音视频数据报文的哈希值。
此外， 上述待签名数据也可以由移动终端生成， 例如： 待签名数据是 移动终端生成的随机数。 在这种情况下， 移动终端需要把待签名数据包含 在签名验证响应中发给 AP, 以便 AP对签名值进行验证。
此外， 签名验证响应中还可以包含移动终端的 WAPI证书， WAPI证书 中包含有该证书对应的公钥。 当然， 如果 AP中已预存有移动终端的 WAPI 证书的公钥， 签名验证响应中可以不包含 WAPI证书。
209: 接收到签名验证响应后， 如果该响应中包含移动终端的 WAPI证 书，则 AP向实时数据业务***的鉴别服务器发送包含该 WAPI证书的证书 鉴别请求， 以验证该 WAPI证书的有效性。
如果在签名验证定时器超时前 AP 没有收到移动终端发送的签名验证 响应， 则跳转至步骤 212。
210: 接收到证书鉴别请求后， 鉴别服务器对其中包含的 WAPI证书进 行验证， 并将证书验证结果包含在证书鉴别响应中发送给 AP。
211 : AP根据鉴别服务器返回的证书验证结果获知 WAPI证书的有效 性，或对该 WAPI证书进行本地验证以判断 WAPI证书的有效性； 如果移动 终端的 WAPI证书无效（例如： 证书已被吊销、 证书已超期等）， 则跳转至 步骤 212; 如果 WAPI证书有效， 则 AP使用该 WAPI证书对应的公钥对签 名验证响应中包含的签名值进行验证，如果签名验证成功，则执行步骤 213; 如果签名验证失败， 则执行步骤 212。
在实际应用中， 上述验证签名的过程可以包含如下步骤：
211a:使用移动终端的 WAPI证书对应的公钥对签名验证响应中包含的 签名值进行解密， 得到解密值；
211b: 将上述解密值与待签名数据进行对比， 如果两者相同则认为签 名值正确， 确定签名验证成功； 如果两者不同则认为签名值错误， 确定签 名验证失败。
如上所述， 待签名数据可以是 AP在发送签名验证请求是保存的 PDU 字段中的全部或部分数据、 或 PDU字段中的全部或部分数据的哈希值； 也 可以是由移动终端生成并包含在签名验证响应中的数据。
212: 如果签名验证失败、 或签名验证定时器超时未收到移动终端发送 的签名验证响应， 则 AP停止向移动终端转发接收到的音视频数据报文； 此 外， AP还可以向实时数据业务服务器发送实时数据业务停止请求， 以指示 实时数据业务服务器停止向移动终端发送音视频数据。
213: 如果签名验证成功， 则 AP继续向移动终端转发实时数据业务服 务器发送音视频数据报文。
根据本发明的基本原理， 上述实施例还可以有多种变换方式， 例如： (一）发送签名验证请求之后， AP也可以继续向移动终端转发音视频 数据报文， 直至签名验证失败或签名验证定时器超时， 以避免緩存音视频 数据报文占用 AP的***资源。
此外， 发送签名验证请求之后， AP也可以直接丟弃接收到的音视频数 据报文。
(二 )待签名数据除了可以是 AP生成的随机数、 实时数据业务服务器 发送音视频数据报文的哈希值、 移动终端生成的随机数以外， 待签名数据 还可以是签名验证响应中除了 PDU字段以外的其它 MPDU字段。
当然，如果待签名数据是由 AP生成的随机数、或实时数据业务服务器 发送的音视频报文的哈希值， 可以最大程度防止非法移动终端发起的重放 攻击。
(三 )上述预览时长阔值 T和预览数据量阔值 N也可以是随机值。
(四）对移动终端的 WAPI证书以及签名值验证成功后， AP可以开始 使用 WAPI证书对用户进行计费 （例如， 按照流量或按照时长计费）， 或者 通知实时数据业务***中的计费网元开始计费 （例如， AP每隔 10分钟向 计费网元发送一个携带 WAPI证书的计费请求消息， 指示计费网元按照时 长计费；或者 AP每转发 1M音视频数据报文向计费网元发送一个携带 WAPI 证书的计费请求消息， 指示计费网元按照流量计费）。
图 5是可实现本发明方法的实时数据业务***的结构示意图； 如图 5 所示， 该***包含： AP、 实时数据业务服务器和鉴别服务器； 其中：
实时数据业务服务器用于在移动终端釆用基于预共享密钥的鉴别和密 钥管理方式接入实时数据业务***， 并启动实时数据业务后，通过 AP向移 动终端发送实时数据业务的音视频数据报文；
AP用于向移动终端转发实时数据业务的音视频数据报文， 并且当转发 音视频数据报文的时间长度超过预览时长阔值、 或转发的音视频数据报文 的数据量超过预览数据量阔值后， 向移动终端发送签名验证请求； 并在接 收到移动终端使用其 WAPI证书所对应的私钥生成的签名值后，使用 WAPI 证书所对应的公钥对该签名值进行验证， 如果验证失败， 则停止向移动终 端转发实时数据业务的音视频数据报文。
鉴别服务器用于在接收到证书鉴别请求后， 对该请求中包含的 WAPI 证书的有效性进行验证， 并返回证书验证结果；
AP还用于在接收到签名验证响应后， 向鉴别服务器发送包含移动终端 的 WAPI证书的证书鉴别请求， 并根据鉴别服务器返回的证书验证结果判 断 WAPI证书是否为有效证书； 当 WAPI证书为有效证书时， 才进行验证签 名值的操作； 当 WAPI证书为无效证书时， 停止向移动终端转发实时数据 业务的音视频数据报文。
AP还用于在发送签名验证请求时启动签名验证定时器， 并且在签名验 证定时器超时前， 如果未收到移动终端发送的签名值， 则停止向移动终端 转发实时数据业务的音视频数据报文。
AP还用于在发送签名验证请求时， 暂停向移动终端转发实时数据业务 的音视频数据报文； 接收到签名验证响应后， 如果对签名值验证成功， 则 继续向移动终端转发实时数据业务的音视频数据报文。
实时数据业务***中包含的各网元的详细功能以及相互之间的交互关 系可参见对图 4所示的方法的描述部分， 此处不再赘述。
需要说明的是， 上述的本发明方法及***均针对移动终端进行描述， 但在实际应用中， 能够进行相应接入、 认证等操作的通信实体不一定只限 于移动终端， 其它的可经由移动网络间接接入的固定终端等用户终端也可 以进行所述接入、 认证等操作。 实际上， 无论是何种形式的用户终端， 只 要该用户终端能顺利进行所述接入、 认证等操作即可。
由以上所述可见， 釆用本发明的方法及***， 在釆用基于预共享密钥 的鉴别和密钥管理方式接入实时数据业务***时， 能够保证在用户大量获 取业务数据之前进行对用户的认证， 因此能有效提高接入安全性； 此外， 由于本发明的方法及***可以先向用户提供免费的预览业务数据， 在预览 名， 再开始进行计费， 这样既方便了用户又有利于运营商推广实时数据业 务。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围， 凡在本发明的精神和原则之内所作的任何修改、 等同替换和改进 等， 均应包含在本发明的保护范围之内。

Claims

权利要求书
1、 一种实时数据业务的实现方法， 其特征在于， 该方法包括： 在实时数据业务***的接入点 AP 开始向接入的用户终端转发数据报 文后， AP对该用户终端进行验证， 并在验证成功后继续向该用户终端转发 数据报文。
2、 如权利要求 1 所述的方法， 其特征在于， 该方法进一步包含触发 AP进行所述验证的操作：
预先设置预览时长阔值，确定 AP向所述用户终端转发数据报文的时间 长度超过该预览时长阔值；
或者， 预先设置预览数据量阔值， 确定向所述用户终端转发数据报文 的数据量超过该预览数据量阔值。
3、 如权利要求 1所述的方法， 其特征在于， 在 AP开始进行所述验证 时进一步启动签名验证定时器； 在该签名验证定时器超时、 并且未收到来 自所述用户终端的签名验证响应的情况下， 停止向该用户终端转发数据报 文。
4、 如权利要求 1至 3任一项所述的方法， 其特征在于， 进行所述验证 的过程包括：
AP向用户终端发送签名验证请求；
接收到所述签名验证请求后， 用户终端使用自身的 WAPI证书所对应 的私钥生成签名值， 并将该签名值携带于签名验证响应中发送给 AP;
AP使用 WAPI证书所对应的公钥对收到的所述签名值进行解密， 对所 得解密值与待签名数据进行一致性对比， 并在对比结果为一致时确定验证 成功。
5、 如权利要求 4所述的方法， 其特征在于，
所述签名验证响应中还包含所述用户终端的 WAPI证书； 接收到所述签名验证响应后， AP进一步与鉴别服务器验证该 WAPI证 书的有效性， 并在该 WAPI证书有效时针对所述签名值进行后续操作。
6、如权利要求 4所述的方法，其特征在于， 所述签名值的生成方法为： 所述用户终端将由所述 AP生成的随机数、或者接收到的数据报文的哈 希值作为待签名数据， 使用私钥对该待签名数据进行加密生成所述签名值。
7、 如权利要求 1至 3任一项所述的方法， 其特征在于， 进行所述验证 时， AP进一步暂停向所述用户终端转发数据报文。
8、 如权利要求 1所述的方法， 其特征在于， 该方法是在所述用户终端 釆用基于预共享密钥的鉴别和密钥管理方式接入实时数据业务***后实施 的。
9、 一种实时数据业务***， 用于为用户终端提供实时数据业务； 其特 征在于， 该***包含： AP以及接入实时数据业务***用户终端； 其中： 所述 AP, 用于在向所述用户终端转发数据报文后， 对该用户终端进行 验证， 并在验证成功后继续向该用户终端转发数据报文；
所述用户终端， 用于配合所述 AP进行所述验证。
10、 如权利要求 9所述的***， 其特征在于， 该***进一步包括签名 验证定时器， 用于受所述 AP的控制而进行定时操作； 在该签名验证定时器超时、 并且未收到来自所述用户终端的针对验证的反 馈时， 停止向该用户终端转发数据报文。
11、 如权利要求 9所述的***， 其特征在于， 该***进一步包括鉴别 服务器； 在接收到来自所述用户终端的针对验证的反馈时， 所述 AP进一步 用于与该鉴别服务器验证该反馈中所包含的 WAPI证书的有效性。
12、 如权利要求 9至 11任一项所述的***， 其特征在于， 在进行所述 验证时， 所述 AP进一步用于暂停向所述用户终端转发数据报文。
13、 如权利要求 9所述的***， 其特征在于， 所述用户终端是移动终 端。
PCT/CN2009/075417 2009-06-01 2009-12-08 一种实时数据业务的实现方法和实时数据业务*** WO2010139163A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US13/257,940 US8745396B2 (en) 2009-06-01 2009-12-08 Method for implementing the real time data service and real time data service system
EP09845443.2A EP2426873B1 (en) 2009-06-01 2009-12-08 Method for implementing the real time data service and real time data service system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2009101421613A CN101583083B (zh) 2009-06-01 2009-06-01 一种实时数据业务的实现方法和实时数据业务***
CN200910142161.3 2009-06-01

Publications (1)

Publication Number Publication Date
WO2010139163A1 true WO2010139163A1 (zh) 2010-12-09

Family

ID=41364987

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/075417 WO2010139163A1 (zh) 2009-06-01 2009-12-08 一种实时数据业务的实现方法和实时数据业务***

Country Status (4)

Country Link
US (1) US8745396B2 (zh)
EP (1) EP2426873B1 (zh)
CN (1) CN101583083B (zh)
WO (1) WO2010139163A1 (zh)

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101562811B (zh) * 2009-05-14 2011-04-06 西安西电捷通无线网络通信股份有限公司 一种会聚式wlan中由wtp完成wpi时的sta漫游切换方法及其***
CN101562812B (zh) 2009-05-14 2011-06-01 西安西电捷通无线网络通信股份有限公司 会聚式wlan中由ac完成wpi时的sta切换方法及其***
CN101583083B (zh) 2009-06-01 2011-11-30 中兴通讯股份有限公司 一种实时数据业务的实现方法和实时数据业务***
CN101883118B (zh) * 2010-07-08 2012-10-17 长春吉大正元信息技术股份有限公司 针对大数据量的数字签名方法
CN102624752B (zh) * 2011-01-26 2014-06-18 天脉聚源(北京)传媒科技有限公司 一种m3u8直播流防盗链方法和***
ES2441140B1 (es) * 2012-07-30 2015-03-10 Vodafone Espana Sau Metodo, entidad de red y equipo de usuario para entregar informacion a una red de acceso de radio.
CN105025480B (zh) * 2014-04-29 2019-04-05 中国电信股份有限公司 用户卡数字签名验证的方法与***
CN105577365B (zh) * 2014-11-11 2019-04-26 ***通信集团公司 一种用户接入wlan的密钥协商方法及装置
CN108040269A (zh) * 2017-12-18 2018-05-15 西安邮电大学 一种视频监控***密钥协商的方法及***、计算机
US10993110B2 (en) * 2018-07-13 2021-04-27 Nvidia Corp. Connectionless fast method for configuring Wi-Fi on displayless Wi-Fi IoT device
US11005656B2 (en) 2018-12-07 2021-05-11 Arris Enterprises Llc Embedding information in elliptic curve base point
WO2020154872A1 (zh) * 2019-01-29 2020-08-06 华为技术有限公司 一种传输控制协议加速方法和装置
JP7372527B2 (ja) * 2019-09-26 2023-11-01 富士通株式会社 通信中継プログラム、中継装置、及び通信中継方法
CN112202826B (zh) * 2020-12-09 2021-03-05 视联动力信息技术股份有限公司 支持分控的视联网跨域通信方法、装置、设备及介质
CN116150221B (zh) * 2022-10-09 2023-07-14 浙江博观瑞思科技有限公司 服务于企业电商运营管理的信息交互方法及***

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB1562911A (en) 1976-09-17 1980-03-19 Girling Ltd Hydraulically operated disc brakes for vehicles
EP1178644A2 (en) * 2000-02-11 2002-02-06 Nokia Inc. Key management methods for wireless lans
CN1251442C (zh) * 2000-10-26 2006-04-12 通用器材公司 适用于多媒体内容的内容权利和条件的执行
CN101489094A (zh) * 2008-01-15 2009-07-22 深圳市同洲电子股份有限公司 一种加密节目的订购、预览方法和***及前端处理***
CN101547340A (zh) * 2008-03-25 2009-09-30 中国科学院软件研究所 一种视频点播***中的不可否认计费方法
CN101583083A (zh) * 2009-06-01 2009-11-18 中兴通讯股份有限公司 一种实时数据业务的实现方法和实时数据业务***

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020083438A1 (en) 2000-10-26 2002-06-27 So Nicol Chung Pang System for securely delivering encrypted content on demand with access contrl
US6978022B2 (en) 2000-10-26 2005-12-20 General Instrument Corporation System for securing encryption renewal system and for registration and remote activation of encryption device
US7080397B2 (en) 2000-10-26 2006-07-18 General Instrument Corporation Communication protocol for content on demand system with callback time
US7257227B2 (en) 2000-10-26 2007-08-14 General Instrument Corporation System for denying access to content generated by a compromised off line encryption device and for conveying cryptographic keys from multiple conditional access systems
CN1191696C (zh) 2002-11-06 2005-03-02 西安西电捷通无线网络通信有限公司 一种无线局域网移动设备安全接入及数据保密通信的方法
KR100735577B1 (ko) * 2004-08-12 2007-07-04 삼성전자주식회사 무선 네트워크의 적응형 키검색장치 및 방법
US8126145B1 (en) * 2005-05-04 2012-02-28 Marvell International Ltd. Enhanced association for access points
CN100369446C (zh) * 2006-02-28 2008-02-13 西安西电捷通无线网络通信有限公司 接入点的安全接入协议符合性测试方法及其***
CN100448239C (zh) * 2006-02-28 2008-12-31 西安西电捷通无线网络通信有限公司 鉴别服务实体的安全接入协议符合性测试的方法及其***
KR101366243B1 (ko) * 2006-12-04 2014-02-20 삼성전자주식회사 인증을 통한 데이터 전송 방법 및 그 장치
CN100496156C (zh) * 2007-02-16 2009-06-03 西安西电捷通无线网络通信有限公司 一种基于wapi的证书漫游认证方法
CN101056177B (zh) * 2007-06-01 2011-06-29 清华大学 基于无线局域网安全标准wapi的无线网状网重认证方法
US8150372B2 (en) * 2007-09-28 2012-04-03 Symbol Technologies, Inc. Method and system for distributing data within a group of mobile units
CN100512112C (zh) * 2007-10-16 2009-07-08 西安西电捷通无线网络通信有限公司 一种wapi证书鉴别方法
CN101232378B (zh) * 2007-12-29 2010-12-08 西安西电捷通无线网络通信股份有限公司 一种无线多跳网络的认证接入方法
CN101478753B (zh) * 2009-01-16 2010-12-08 中兴通讯股份有限公司 Wapi终端接入ims网络的安全管理方法及***
US8331567B2 (en) * 2009-03-30 2012-12-11 Intel Corporation Methods and apparatuses for generating dynamic pairwise master keys using an image

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB1562911A (en) 1976-09-17 1980-03-19 Girling Ltd Hydraulically operated disc brakes for vehicles
EP1178644A2 (en) * 2000-02-11 2002-02-06 Nokia Inc. Key management methods for wireless lans
CN1251442C (zh) * 2000-10-26 2006-04-12 通用器材公司 适用于多媒体内容的内容权利和条件的执行
CN101489094A (zh) * 2008-01-15 2009-07-22 深圳市同洲电子股份有限公司 一种加密节目的订购、预览方法和***及前端处理***
CN101547340A (zh) * 2008-03-25 2009-09-30 中国科学院软件研究所 一种视频点播***中的不可否认计费方法
CN101583083A (zh) * 2009-06-01 2009-11-18 中兴通讯股份有限公司 一种实时数据业务的实现方法和实时数据业务***

Also Published As

Publication number Publication date
EP2426873A4 (en) 2014-02-12
CN101583083A (zh) 2009-11-18
US8745396B2 (en) 2014-06-03
EP2426873B1 (en) 2015-04-29
EP2426873A1 (en) 2012-03-07
US20120102328A1 (en) 2012-04-26
CN101583083B (zh) 2011-11-30

Similar Documents

Publication Publication Date Title
WO2010139163A1 (zh) 一种实时数据业务的实现方法和实时数据业务***
WO2010130140A1 (zh) 实时数据业务的实现方法、实时数据业务***和移动终端
US8533461B2 (en) Wireless local area network terminal pre-authentication method and wireless local area network system
US20070297611A1 (en) Method for Security Association Negotiation with Extensible Authentication Protocol in Wireless Portable Internet System
WO2016101494A1 (zh) 一种无线智能接入方法
WO2010012203A1 (zh) 鉴权方法、重认证方法和通信装置
US7421582B2 (en) Method and apparatus for mutual authentication at handoff in a mobile wireless communication network
WO2009094942A1 (fr) Procédé et système de réseau de communication pour établir une conjonction de sécurité
WO2010127539A1 (zh) 一种流媒体业务的接入认证方法及***
WO2009097789A1 (zh) 建立安全关联的方法和通信***
WO2012083828A1 (zh) 本地路由业务的实现方法、基站及***
KR20080086127A (ko) 이동통신 네트워크 및 상기 이동통신 네트워크에서 이동 노드의 인증을 수행하는 방법 및 장치
WO2016023198A1 (zh) 异构网络之间的切换方法及切换***
US7715562B2 (en) System and method for access authentication in a mobile wireless network
WO2019001169A1 (zh) 一种基于身份代理群签名的PMIPv6认证***及方法
WO2011127774A1 (zh) 一种用户终端接入互联网方式的控制方法及装置
WO2011015060A1 (zh) 一种可扩展的鉴权协议认证方法、基站及鉴权服务器
WO2013166908A1 (zh) 密钥信息生成方法及***、终端设备、接入网设备
WO2012083873A1 (zh) 一种密钥生成方法、装置及***
WO2010121462A1 (zh) 一种自组网络下wapi站点间安全关联的建立方法
CN112399407B (zh) 一种基于dh棘轮算法的5g网络认证方法及***
WO2011143977A1 (zh) 终端移动到增强通用陆地无线接入网络（utran）时建立增强密钥的方法及***
WO2012113225A1 (zh) 安全访问wapi网络的方法、装置及***
CN112822018B (zh) 一种基于双线性对的移动设备安全认证方法及***
Rengaraju et al. Measuring and analyzing WiMAX security and QoS in testbed experiments

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09845443

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 13257940

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2009845443

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE