Security authentication method, apparatus, and system

A security authentication method, characterized by comprising:

• verifying a feature identifier to identify terminal equipment, wherein the terminal equipment is machine-to-machine equipment;
• and
• obtaining a key corresponding to the feature identifier, so as to perform secure communication with the terminal equipment according to the key, and
• wherein the feature identifier is a certificate of the terminal equipment, and the verifying of the feature identifier for identifying the terminal equipment comprises:
• if it is verified that a signature of the certificate is correct, calculating an authentication token according to a public key of the certificate, to verify legality of the certificate.

A security authentication method, characterized by comprising:

• receiving a service message which is sent by a mobility management entity and corresponds to a feature identifier for identifying terminal equipment, wherein the terminal equipment is machine-to-machine equipment;
• and
• obtaining a key according to the service message, so as to perform secure communication with the mobility management entity according to the key, and
• wherein before the receiving the service message which is sent by the mobility management entity and corresponds to the feature identifier for identifying the terminal equipment, and
• the method further comprises:
• after successfully performing the authentication and key agreement according to the user identifier of the terminal equipment, receiving a request message sent by the mobility management entity;
• encrypting the feature identifier according to a cipher key and/or an integrity key, wherein the cipher key and the integrity key are generated after authentication and key agreement succeeds;
• and
• sending the encrypted feature identifier to the mobility management entity according to the request message.

A security authentication method, characterized by comprising:

• receiving a service message which is sent by a mobility management entity and corresponds to a feature identifier for identifying terminal equipment, wherein the terminal equipment is machine-to-machine equipment;
• and
• obtaining a key according to the service message, so as to perform secure communication with the mobility management entity according to the key, and
• after performing the secure communication with the mobility management entity according to the key, determining, according to an indication identifier received from the mobility management entity or a pre-configured indication identifier, whether to delete the key.

A mobility management entity, characterized by comprising:

• the mobility management entity being computer implemented and including:
• a verification module, configured to verify a feature identifier for identifying terminal equipment, wherein the terminal equipment is machine-to-machine equipment;
• and
• an obtaining module, configured to obtain a key corresponding to the feature identifier verified by the verification module, so as to perform secure communication with the terminal equipment according to the key, and
• wherein the feature identifier is a certificate of the terminal equipment, and the verification module is specifically configured to:
• if it is verified that a signature of the certificate is correct, calculate an authentication token according to a public key of the certificate, to verify legality of the certificate.

Terminal equipment, characterized by comprising:

• a first receiving module, configured to receive a service message which is sent by a mobility management entity and corresponds to a feature identifier of a terminal equipment;
• and
• an obtaining module, configured to:
• obtain a key according to the service message received by the first receiving module, so as to perform secure communication with the mobility management entity according to the key, wherein the terminal equipment is machine-to-machine equipment,
• a second receiving module, configured to:
• after authentication and key agreement is successfully performed according to a user identifier of the terminal equipment, and before the first receiving module receives the service message, receive a request message sent by the mobility management entity;
• an encryption module, configured to:
• after the second receiving module receives the request message, encrypt the feature identifier according to a cipher key and/or an integrity key, wherein the cipher key and the integrity key are generated after the authentication and key agreement succeeds;
• and
• a third sending module, configured to send the feature identifier encrypted by the encryption module to the mobility management entity according to the request message received by the second receiving module.

Terminal equipment, characterized by comprising:

• a first receiving module, configured to receive a service message which is sent by a mobility management entity and corresponds to a feature identifier of a terminal equipment;
• and
• an obtaining module, configured to:
• obtain a key according to the service message received by the first receiving module, so as to perform secure communication with the mobility management entity according to the key, wherein the terminal equipment is machine-to-machine equipment, and
• a determining module, configured to, after the secure communication is performed with the mobility management entity according to the key obtained by the obtaining module, determine, according to an indication identifier received from the mobility management entity or a pre-configured indication identifier, whether to delete the key.