Method, system and authentication centre for authenticating in end-to-end communications based on a mobile network

A method of authentication inquiring, applied to a system comprising a first service entity requesting a service, a second service entity providing the service and an EAC, wherein, a mutual authentication between the first service entity and the EAC and that between the second service entity and the EAC are respectively performed, the EAC allocates temporary identities respectively for the first service entity and the second service entity and acquires the shared key materials respectively for protecting the communications with the first service entity and the second service entity, and with the EAC, the first service entity negotiates an authentication mode comprising a mechanism of authentication inquiring and a mechanism for generating a derived key;

• the method comprising:
• if the first service entity requests the service provided by the second service entity, authenticating authorities of the first service entity and the second service entity according to the temporary identities of the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode;
• and
• calculating a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the temporary identities of the first service entity and the second service entity, and the shared key material for protecting the communication with the first service entity.

A system for authenticating in end-to-end communications based on a mobile network, comprising a first service entity requesting a service, a second service entity providing a service and an EAC, wherein,

• the first service entity is configured to negotiate with the EAC an authentication mode comprising at least one mechanism related with authentication, to perform a mutual authentication between the first service sentity and the EAC according to the negotiated authentication mode, to request a service from the second service entity, and to perform a mutual authentication between the first service entity and the second service entity according to the shared derived key for protecting the communication between the first service entity and the second service entity according to the negotiated authentication mode;
• the second service entity is configured to authenticate the EAC according to the negotiated authentication mode, and to perform the mutual authentication between the second service entity and the first service entity according to the shared derived key for protecting the communication between the first service entity and the second service entity according to the negotiated authentication mode if the first service entity requests the service;
• and
• the EAC is configured to respectively perform the mutual authentication between the EAC and the first service entity and that between EAC and the second service entity according to the negotiated authentication mode, and when the first service requests the service, to provide an authentication inquiring for the first service entity and the second service entity according to the negotiated authentication mode and to generate the shared derived key for protecting the communication between the first service entity and the second service entity.