Patent ID: 8392710

Claim:
A mutual entity authentication method supporting rapid handoff, the method involving three security elements comprising two authentication elements A and B and a Trusted third Party TP, wherein the trusted third party TP is a trusted third party of the authentication elements A and B; the authentication element A comprises n authentication entities A 1 , A 2 , . . . , An, and the authentication element B comprises m authentication entities B 1 , B 2 , . . . Bm, among which synchronization information is provided; and all of the authentication entities in the same authentication element share one public key certificate or possess one public key, and for any pair of authentication entities Ai (i=1, 2, . . . , n) and Bj (j=1, 2, . . . , m), the authentication method comprises the steps of: 1) transmitting, by the authentication entity Bj, an authentication activation message INI Bj to the authentication entity Ai, wherein INI Bj =R Bj ∥ID B ∥Text1, wherein R Bj denotes a random number generated by the authentication entity Bj, ID B denotes an identifier of the authentication element B, and Text1 denotes a first optional text; 2) transmitting, by the authentication entity Ai, an access authentication request message AREQ Ai to the authentication entity Bj upon reception of the authentication activation message INI Bj , wherein AREQ Ai =R Bj ∥R Ai ∥ID A ∥Text2∥Token AB TokenAB=sS A (R Bj ∥Text2), wherein R Ai denotes a random number generated by the authentication entity Ai, ID A denotes an identifier of the authentication element A, Text2 denotes a second optional text, TokenAB denotes a token transmitted from the authentication entity Ai to the authentication entity Bj, and sS A denotes a signature of the authentication element A; 3) on receiving the access authentication request message AREQ Ai , verifying, by the authentication entity Bj, R Bj in AREQ Ai and R Bj in INI Bj for consistency, and if R Bj in AREQ Ai is consistent with R Bj in INI Bj , searching, by the authentication entity Bj, for a locally stored authentication result of the authentication element A; if there is stored an authentication result of the authentication element A, going to step 4); 4) transmitting, by the authentication entity Bj, an access authentication response message ARES Bj to the authentication entity Ai, and calculating a shared master key between the authentication entities Ai and Bj, wherein ARES Bj =IRES TP ∥R Ai ∥Text5∥Token BA TokenBA=sS B (TokenAB∥R Bj ∥Text5), wherein Text5 denotes a fifth optional text, IRES TP denotes an identity authentication response message stored locally at the authentication entity Bj which comprises the authentication result of the authentication element A, TokenBA denotes a token transmitted from the authentication entity Bj to the authentication entity Ai, and sS B denotes a signature of the authentication element B; and 5) verifying, by the authentication entity Ai, the access authentication response message ARES Bj upon reception thereof.