Key distribution method and system, and apparatus

A key distribution method, comprising:

• sending, by a terminal, an ID registration request message to an identity management server by using a unified access gateway UAG, to request to register an ID of the terminal, wherein the ID registration request message comprises AAA authentication information;
• negotiating, by the terminal and the identity management server, to generate a first key;
• receiving, by the terminal, the ID of the terminal and a private key of the terminal that are encrypted by using the first key and that are sent by the identity management server, wherein the private key is generated by a key management server by using the identity ID of the terminal as a public key;
• and
• obtaining, by the terminal, the ID of the terminal and the private key of the terminal through decryption by using the first key.

An identity management server, comprising:

• a receiving module, wherein the receiving module is configured to receive an ID registration request message that is sent by a terminal by using a unified access gateway UAG, to request to register an ID of the terminal, wherein the ID registration request message comprises AAA authentication information;
• and
• a processing module, wherein the processing module is configured to:
• determine, based on the AAA authentication information, whether AAA authentication on the terminal succeeds;
• and if the AAA authentication on the terminal succeeds, allocate the ID to the terminal, and send the ID of the terminal to a key management server;
• wherein
• the receiving module is further configured to receive a private key of the terminal that is sent by the key management server, wherein the private key is generated by the key management server by using the identity ID of the terminal as a public key;
• and
• the processing module is further configured to negotiate with the terminal to generate a first key;
• and
• a sending module, wherein the sending module is configured to send, to the terminal by using the UAG, the ID and the private key of the terminal that are encrypted by using the first key.

A terminal, comprising:

• a sending module, wherein the sending module is configured to send an ID registration request message to an identity management server by using a unified access gateway UAG, to request to register an ID of the terminal, wherein the ID registration request message comprises AAA authentication information;
• a processing module, wherein the processing module is configured to negotiate with the identity management server to generate a first key;
• and
• a receiving module, wherein the receiving module is configured to receive the ID of the terminal and a private key of the terminal that are encrypted by using the first key and that are sent by the identity management server, wherein the private key is generated by a key management server by using the identity ID of the terminal as a public key;
• wherein
• the processing module is further configured to obtain the ID of the terminal and the private key of the terminal through decryption by using the first key.