# US 2019/0173670 A1 · Authentication method, server, terminal, and gateway

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173670 A1
- Document ID: US20190173670A1
- Status: Published application
- Kind: A1
- Application number: 16/256,129
- Filed: 2019-01-24
- Published: 2019-06-06
- Earliest claimed: 2016-08-04
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Yang XIAO; Yan LIU
- Web page: https://patentgrep.com/patent/US20190173670A1

## CPC

- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- G16Y 30/10: Security thereof
- H04L 9/06: the encryption apparatus using shift registers or memories for block-wise {or stream} coding, e.g. DES systems {or RC4; Hash functions; Pseudorandom sequence generators}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)}
- H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials}
- H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04W 12/009: {specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The method provided in the embodiments of this application includes: obtaining, by a server, a first key (Ksm) shared with a gateway; receiving, by the server, an encrypted first random factor (Rand-M-Encry), a first data digest (Data-Hash), and encrypted first data (Data-Encry) that are sent by a terminal; decrypting, by the server, the Rand-M-Encry by using the Ksm, to obtain a second random factor (Rand-M′); performing, by the server, an operation on the Rand-M′ and Kpsa-xi by using a second preset algorithm, to generate a third key (K′sx); decrypting, by the server, the Data-Encry by using the K′sx, to obtain second data (Data′); performing, by the server, an operation on the K′sx and the Data′ based on a first preset algorithm to obtain a second data digest (Data-Hash′); and if the Data-Hash′ is the same as the Data-Hash, determining, by the server, that authentication of the terminal succeeds.

## Claims

### Claim 1

An authentication method, comprising:
obtaining, by a server, a first key (Ksm) shared with a gateway;
receiving, by the server, an encrypted first random factor (Rand-M-Encry), a first data digest (Data-Hash), and encrypted first data (Data-Encry) that are sent by a terminal, wherein the Rand-M-Encry is generated by the gateway by encrypting a first random factor (Rand-M) by using the Ksm, the Data-Hash is obtained by the terminal by performing an operation on a second key (Ksx) and first data (Data) based on a first preset algorithm, the Data-Encry is obtained by encrypting the Data by using the Ksx, the Ksx is generated by performing an operation on the Rand-M and a key (Kpsa-xi) that is shared by the terminal with the server by using a second preset algorithm, the Kpsa-xi, the first preset algorithm, and the second preset algorithm are preconfigured by the terminal and the server, and the Rand-M is generated by the gateway and sent to the terminal;
decrypting, by the server, the Rand-M-Encry by using the Ksm, to obtain a second random factor (Rand-M′);
performing, by the server, an operation on the Rand-M′ and the Kpsa-xi by using the second preset algorithm, to generate a third key (K′sx);
decrypting, by the server, the Data-Encry by using the K′sx, to obtain second data (Data′);
performing, by the server, an operation on the K′sx and the Data′ based on the first preset algorithm to obtain a second data digest (Data-Hash′); and
if the Data-Hash′ is the same as the Data-Hash, determining, by the server, that authentication of the terminal succeeds.

### Claim 2 (depends on 1)

The method according to claim 1, wherein obtaining, by a server, a first key (Ksm) shared with a gateway comprises:
obtaining, by the server, a third random factor (Rand-author), wherein the Rand-author is shared by the server with the gateway; and
performing, by the server, an operation on the Rand-author and a second shared key (Kpsa-mi) based on a third preset algorithm, to generate the Ksm, wherein the Kpsa-mi is preconfigured by the server and the gateway, and the third preset algorithm is preconfigured by the server and the gateway or is determined through negotiation between the server and the gateway.

### Claim 3 (depends on 2)

The method according to claim 2, wherein obtaining, by the server, a third random factor (Rand-author) comprises:
generating, by the server, the Rand-author; or
receiving, by the server, the Rand-author sent by the gateway.

### Claim 4

An authentication method, comprising:
obtaining, by a gateway, a first key (Ksm) shared with a server;
generating, by the gateway, a first random factor (Rand-M);
encrypting, by the gateway, the Rand-M by using the Ksm, to generate an encrypted first random factor (Rand-M-Encry); and
after the gateway and a terminal complete two-way authentication, sending, by the gateway, the Rand-M-Encry and the Rand-M to the terminal for enabling the terminal to generate a second key (Ksx) based on the Rand-M.

### Claim 5 (depends on 4)

The method according to claim 4, wherein obtaining, by a gateway, a first key (Ksm) shared with a server comprises:
obtaining, by the gateway, a third random factor (Rand-author), wherein the Rand-author is shared by the server with the gateway; and
performing, by the gateway, a third preset algorithm on the Rand-author and a second shared key (Kpsa-mi) to generate the Ksm, wherein the Kpsa-mi is preconfigured by the server and the gateway, and the third preset algorithm is preconfigured by the server and the gateway or is determined through negotiation between the server and the gateway.

### Claim 6 (depends on 5)

The method according to claim 5, wherein obtaining, by the gateway, a third random factor (Rand-author) comprises:
generating, by the gateway, the Rand-author; or
receiving, by the gateway, the Rand-author sent by the server.

### Claim 7

An authentication method, comprising:
after a terminal and a gateway complete two-way authentication, receiving, by the terminal, an encrypted first random factor (Rand-M-Encry) and a first random factor (Rand-M) that are sent by the gateway, wherein the Rand-M-Encry is generated by the gateway by encrypting the Rand-M by using a first key Ksm, and the Rand-M is generated by the gateway;
performing, by the terminal, a second preset algorithm on the Rand-M and a key (Kpsa-xi) that is shared by the terminal with a server, to generate a second key (Ksx), wherein the Kpsa-xi and the second preset algorithm are preconfigured by the terminal and the server;
encrypting, by the terminal, first data (Data) by using the Ksx, to obtain Data-Encry, and performing an operation on the Ksx and the Data based on a first preset algorithm to obtain Data-Hash, wherein the first preset algorithm is preconfigured by the terminal and the server; and
sending, by the terminal, the Rand-M-Encry, the Data-Encry, and the Data-Hash to the server for enabling the server to complete authentication based on the Rand-M-Encry, the Data-Encry, and the Data-Hash.

### Claim 8 (depends on 7)

The method according to claim 7, wherein the first preset algorithm is a hash operation.

### Claim 9 (depends on 7)

The method according to claim 7, wherein the second preset algorithm is a hash-based message authentication code algorithm HMAC-SHA-256.