China Iwncomm Co., Ltd.

Guoqiang Zhang

Zhiqiang Du

Qin Li

Manxia Tie

Bianling Zhang

Xiang Yan

Xiaolong Lai

Yuehui Wang

Jun Cao

Weigang Tong

Xiaorong Zhao

Zhenhai Huang

Lin Zhu

Yuelei Xiao

Peng Li

Yonggang Xue

Ya'nan Hu

Xiaoyong Liu

Ke Wang

Kelong Yuan

Geng Chen

Weigang Chen

Jingtao Jing

Yunlong Ma

You Gai

Huanxi Wang

Runtian Kan

A method and device for identity authentication. An authentication access controller (AAC) acquires an identity ciphertext message transmitted by a requesting device (REQ), the identity ciphertext message comprising an identity information ciphertext of the REQ, the AAC decrypts the identity information ciphertext of the REQ to generate a digital certificate (Cert) of the REQ, transmits a first authentication request message comprising the Certto a first authentication server, and receives a first authentication response message transmitted by the first authentication server, the first authentication response message comprising authentication result information and a digital signature of the first authentication server, the AAC utilizes a public key of the first authentication server to verify the digital signature of the first authentication server, and if successfully verified, then the AAC determines an identity authentication result for the REQ on the basis of the verification result of the Certin the authentication result information.

Method and device for identity authentication

A digital certificate obtaining method and apparatus. The method includes: a routing device receives a network access request sent by a terminal on the basis of a first virtual local area network, wherein the first virtual local area network is associated with a uniform resource locator (URL) of a server, so that the terminal obtains, by means of the server, a digital certificate used for accessing a second virtual local area network; and in response to the network access request sent by the terminal on the basis of the first virtual local area network, the routing device sends the URL of the server to the terminal, so that the terminal obtains the digital certificate from the server according to the URL.

Digital certificate obtaining method and apparatus

A network device role self-adaptive method and apparatus are provided. Specifically, a first network device and a neighbor network device both determine their respective priority according to information including a connection result between the corresponding network device itself and a server; the first network device receives a second start frame which is sent by the neighbor network device and comprises the priority of the neighbor network device, and then determines whether its own priority and the priority of the neighbor network device meet preset conditions; and if yes, when the priority of the first network device is higher than the priority of the neighbor network device, the first network device determines its own role as an authentication access controller, and when the priority of the first network device is lower than the priority of the neighbor network device, the first network device determines its own role as a request device.

Network device role self-adaptive method and apparatus

A wireless network switching method. In the method, a station and a target access device directly generate a message integrity check key by means of a domain key, and verify an integrity code on the basis of the message integrity check key, so as to realize the authentication of two parties; and when the authentication of the opposite party is successful, session keys are generated by means of the domain key and in conjunction with random numbers of the two parties, thereby simplifying a switching process and realizing secure and efficient network switching. Further disclosed are a corresponding station and a corresponding access device.

Wireless network switching method and device

A method and device for managing a digital certificate are provided. A digital certificate requesting device negotiates with a digital certificate issuing device by using an acquired authorization code, to establish a security data channel and generate a security key, and messages can be encrypted with the generated data communication key during a process of message interaction between the digital certificate requesting device and the digital certificate issuing device, thereby effectively increasing the security in data transmission. The method and device are applicable for automatically requesting for, querying, updating, revoking a digital certificate and acquiring a digital certificate revocation list in various scenarios.

Method and device for managing digital certificate

Provided in the present invention are a digital credential management method and a device, the method comprising: a digital credential application device negotiating establishment of a secure data channel with a digital credential issuing device, and sending to the digital credential issuing device a digital credential management request message; the digital credential issuing device receiving the message, and sending to the digital credential application device a digital credential management verification request message; the digital credential application device receiving the verification request message, and sending to the digital credential issuing device a digital credential management verification response message; the digital credential issuing device receiving the digital credential management verification response message, and sending to the digital credential application device a digital credential management response message; the digital credential application device receiving the digital credential management response message, and sending to the digital credential issuing device a digital credential management confirmation message.

Digital credential management method and device

Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for mutual identity validity verification between the entities, to complete the identity validity verification between the entities.

Multi-TTP-based method and device for verifying validity of identity of entity

Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for verifying validity of an identity of one entity by the other entity, to complete identity validity verification between the entities.

An entity authentication method includes: an entity A generates and sends Nto an entity B; the entity B generates Nand ZSEED, computes a key MKA&#x2225;KEIA and first encrypted authentication data AuthEncData, and sends the N&#x2225;N&#x2225;AuthEncDatato the entity A for verification; the entity A generates ZSEED, computes second encrypted authentication data AuthEncData, a shared key seed Z, a master key MK and a first message authentication identifier MacTag, and sends the N&#x2225;N&#x2225;AuthEncData&#x2225;MacTagto the entity B for verification; the entity B computes Z, MK and MacTag, compares the MacTagwith the received MacTag, and if the two are equal, considers that the entity A is valid; the entity B computes and sends a second message authentication identifier MacTagto the entity A; and the entity A computes MacTag, compares the MacTagwith the received MacTag, and if the two are equal, considers that the entity B is valid.

Entity authentication method and device based on pre-shared key

A method and a system for authenticating an entity based on a symmetric encryption algorithm are provided. The method includes the following steps: 1) an entity A sends an authentication request message to an entity B; 2) after receiving the authentication request message, the entity B sends an authentication response message to the entity A; 3) the entity A determines the validity of the entity B according to the received authentication response message. The implementation cost of the system can be reduced by using the authentication according to the invention.

Method and system for authenticating entity based on symmetric encryption algorithm

Provided is an air interface security method. In the process of protocol transmission, the method executes: 1) a short-range coupling device sending a security parameter request message to a short-range card; 2) after receiving the security parameter request message, the short-range card conduct security parameter feedback on the short-range coupling device; and 3) the short-range coupling device and the short-range card establish a security link according to a security parameter. Provided are a short-range coupling device, a short-range card, etc. for achieving the method. By introducing a security mechanism, the present invention provides a security protection capability for an air interface, can provide identity authentication for a short-range coupling device and a short-range card to ensure the validity and authenticity of the identities of both sides in the communications, and at the same time, will not bring additional hardware overhead to the short-range coupling device and the short-range card.

Air interface security method and device

Provided are a platform authentication strategy management method for trusted connection architecture (TCA), and the trusted network connection (TNC) client, TNC access point and evaluation strategy service provider for implementing the method in the TCA. In the embodiments of the present invention, the platform authentication strategy for the access requester can be configured in the TNC access point or the evaluation strategy service provider, and the platform authentication strategy for the access requester configured in the evaluation strategy service provider can be delivered to the TNC access point. Moreover, a component-type-level convergence platform evaluation strategy can be executed in the TNC access point or the evaluation strategy service provider, to ensure that the realization of the TCA platform authentication has good application extensibility.

Growing community of inventors

Shaanxi, China

Guoqiang Zhang