CN104468585A - Proxy-based user equipment trusted access authentication method - Google Patents

Abstract

The invention discloses an agent-based user equipment trusted access authentication method. It mainly solves the problems that the existing user equipment authentication time is too long, the coverage area of the wireless network is small, and the security of the wireless network cannot be guaranteed. The technical solution is: the user equipment searches for the authentication server, and if the authentication server can be found, the user equipment and the authentication server perform two-way identity authentication; otherwise, the user equipment and the parent node perform permission judgment; if the parent node is an authenticated node, the user The device and the parent node conduct two-way identity authentication; if the parent node is an unauthenticated node, the parent node repeats the user device discovery and authentication process, and then performs authentication with the user device to complete trusted access authentication. The invention reduces the authentication time, expands the coverage area of the wireless network, and improves the security of the network. Can be used to protect network security.

Description

Proxy-based user equipment trusted access authentication method

technical field

The invention belongs to the technical field of wireless networks, in particular to a user equipment trusted access authentication method, which can be used to protect network security.

Background technique

In recent years, wireless network technology has developed rapidly, and new technology types and application modes emerge in an endless stream. A large number of services oriented to the communication network environment, such as e-commerce, e-government, audio and video services, and intranet construction of enterprises and institutions, etc., can be It is widely used in wireless network environment. The wireless network has great convenience. Users only need a mobile device to access the network anytime and anywhere, thus greatly improving work efficiency. However, due to the weak computing power of mobile devices, limited storage space, and easy interception of wireless signals, etc. Shortcomings, it also has great potential safety hazards. For wireless network environments, attack methods such as sniffing, eavesdropping, identity impersonation, and distributed denial of service are common methods. After mobile devices are attacked, sensitive data may be leaked, device information may be tampered with, and intruders may obtain network management information through wireless networks. Permissions and other serious consequences.

In the face of potential security risks in the wireless network environment, traditional security solutions may not be ideal. For example, firewalls do not work on wireless network communications, and anyone within the coverage of wireless signals can intercept data; limitations, computationally intensive encryption/decryption algorithms are not suitable for mobile devices, etc. In this context, trusted authentication technology, as a new idea for security threats to wireless networks and mobile devices, has become a hot spot in the industry. Trusted authentication is a method of two-way authentication of user identities through cryptographic technology. Using this method to build a network can deny access to illegal nodes that forge identities, thereby ensuring that all user devices connected to the network are trusted. In the actual authentication process, due to the uncertainty of the boundary of the wireless network and the mobility of the user equipment, the authentication request packet sent by the user equipment may not be able to reach the authentication server, resulting in too long authentication time for the user equipment, or even failure to access the authentication server. network, and the security of the wireless network cannot be guaranteed.

Contents of the invention

The purpose of the present invention is to propose a proxy-based user equipment trusted access authentication method to solve the problems in the prior art that the user equipment authentication time is too long, the wireless network coverage is small, and the security of the wireless network cannot be guaranteed .

The main idea of realizing the object of the present invention is: send the search request data packet to the authentication server through the user equipment, if the authentication server receives the search request data packet from the user equipment, then reply the search response data packet to the user equipment; If the user equipment does not receive a probe response packet from the authentication server, the user equipment should send an authentication request packet to the authentication server for two-way identity authentication; if the user equipment does not receive a probe response packet from the authentication server, the user equipment should send a Authentication request data packet, if the parent node is an authenticated node, the user device will perform two-way identity authentication with the parent node; if the parent node is an unauthenticated node, it will repeat the previous step of the user device discovery and authentication process to perform self-authentication Two-way identity authentication of the server, and then perform two-way identity authentication with the user device. After the user equipment is authenticated, it is connected to the trusted network.

According to above train of thought, the realization step of the present invention is as follows:

(1) User equipment A searches for authentication server R:

When user equipment A needs to access the network, it first sends a search request packet to authentication server R in the network, and after receiving the search request packet from user equipment A, authentication server R replies to user equipment A with a search response packet, If user equipment A receives a search response packet from authentication server R, the search process ends normally, and step (2) is performed; if user equipment A does not receive a search response packet from authentication server R, the search process ends abnormally , execute step (3);

(2) Two-way identity authentication with three handshakes between the user equipment A and the authentication server R;

(3) Permission judgment between user equipment A and parent node B:

User equipment A constructs an authentication request packet, and sends the authentication request packet to parent node B. After receiving the authentication request packet, parent node B judges whether itself is an authenticated node: if yes, then execute step (4), If not, then perform step (5);

(4) Two-way identity authentication of three-way handshake between user equipment A and parent node B;

(5) The parent node B repeats the discovery and authentication process of the user equipment A to perform the two-way identity authentication with the authentication server R, and then perform the two-way identity authentication with the user equipment A.

Compared with the prior art, the present invention has the following advantages:

1. Since the present invention uses trusted access authentication technology, it can ensure that all user equipments accessing the network are trusted, and if the network is established with the present invention, a trusted wireless local area network environment can be constructed;

2. Since the present invention uses the parent node authentication mechanism, if a large number of new users access the network at the same time, the authentication pressure on the authentication server can be alleviated, so that new users can quickly access the network;

3. Since the present invention uses the parent node authentication mechanism, if the user equipment cannot communicate with the authentication server in the network, it can also access the network by sending an authentication request to its parent node. The situation that the user equipment cannot access the network due to the mobility of the equipment and the uncertainty of the coverage of the wireless network.

Description of drawings

The realization overall flowchart of Fig. 1 the present invention;

Fig. 2 is a subflow chart of two-way identity authentication between the user equipment and the authentication server;

Fig. 3 is a sub-flow chart of two-way identity authentication between the user equipment and the parent node.

detailed description

With reference to Fig. 1, the realization steps of the present invention are as follows:

Step 1, parameter setting

The key generation center Trent selects a large prime number q according to the security parameter ^z , where q>2z, and constructs a q-order additive cyclic group G ₁ and a q-factorial cyclic group G ₂ ;

Construct a bilinear map e:G ₁ ×G ₁ →G ₂ ;

Randomly select generator P from group _G1 ;

Generate user device identity ID _A , authentication server identity ID _R , and parent node identity ID _B ;

Select a signature algorithm Sig, such as RSA algorithm;

Generate the signature private key SK _A of the user equipment A, the signature private key SK _R of the authentication server R, and the signature private key SK B of the parent node _B ;

Choose a cryptographic one-way hash function h(x).

In step 2, the user equipment A searches for the authentication server R.

When the user equipment A needs to access the network, it first sends a search request packet to the authentication server R in the network;

After the authentication server R receives the search request packet from the user equipment A, it replies to the user equipment A with a search response packet: if the user equipment A receives the search response packet from the authentication server R, the search process ends normally, and the following steps are performed: 3. If the user equipment A does not receive the search response packet from the authentication server R, the search process ends abnormally, and step 4 is executed;

In step 3, two-way identity authentication of three-way handshake is performed between the user equipment A and the authentication server R.

Referring to Figure 2, this step is specifically implemented as follows:

3a) The first handshake is performed between user equipment A and authentication server R:

3a1) User equipment A selects X _AR ∈ z _q ^* as the DH exchange temporary private key, and then calculates the DH exchange temporary public key Y _AR through the formula Y _AR =X _ARP , and user equipment A generates a random number N _AR ;

3a2) The user equipment A uses the signature algorithm Sig to calculate the identity ID _A of the user equipment A, the identity ID _R of the authentication server R, the random number N _AR , and the DH exchange temporary public key Y _AR to generate a signature Sig _AR ;

3a3) The user equipment A constructs the authentication request data packet P ₁ , and sends the authentication request data packet P ₁ to the authentication server R, and the content of the authentication request data packet P ₁ includes:

ID _A field: the identity of user equipment A;

ID _R field: the identity of the authentication server R;

N _AR field: a random number generated by user equipment A;

Y _AR field: DH exchange temporary public key selected by user equipment A;

Sig _AR field: user equipment A signs ID _A field, ID _R field, N _AR field, and Y _AR field with its own signature private key SK _A ;

3a4) When the authentication server R receives the authentication request data packet P ₁ , it verifies the correctness of the signature Sig _AR : if it is incorrect, discard the authentication request data packet P ₁ , and if it is correct, execute step 3b).

3b) The second handshake is performed between user equipment A and authentication server R:

3b1) The authentication server R selects X _RA ∈ z _q ^* as the DH exchange temporary private key, and then calculates the DH exchange temporary public key Y _RA through the formula Y _RA =X _RA P , and the authentication server R generates a random number N _RA ;

3b2) The authentication server R uses its own signature private key SK _R to calculate the identity ID R of the authentication server _R , the identity ID _A of the user equipment A, the random number N _RA , the random number N _AR , and the DH exchange temporary public key Y _RA , Generate signature Sig _RA ;

3b3) The authentication server R calculates the communication between R and A according to the DH exchanged temporary private key X _RA and the DH exchanged temporary public key Y _AR in the authentication request packet P ₁ through the formula MK _RA =e(X _RA , Y _AR ) the master key MK _RA ;

3b4) The authentication server R uses the formula MIC _RA =h(MK _RA ||ID _R ||ID _A ||N _RA ||N _AR ||Y _RA ) to calculate the message integrity check code MIC _RA ;

3b5) The authentication server R constructs the authentication response data packet P ₂ and sends the authentication response data packet P ₂ to the user equipment A. The content of the authentication response data packet P ₂ includes:

ID _A field: the identity of user equipment A;

ID _R field: the identity of the authentication server R;

N _RA field: a random number generated by the authentication server R;

N _AR field: the random number N _AR in the authentication request packet P1 received by the authentication server R _;

Y _RA field: DH exchange temporary public key selected by authentication server R;

Sig _RA field: the authentication server R uses its own signature private key SK _R to sign the ID _R field, ID _A field, N _RA field, N _AR field, and Y _RA field;

MIC _RA field: the message integrity check code calculated by the authentication server R on the MK _RA field, ID _R field, ID _A field, N _RA field, N _AR field, and Y _RA field;

3b6) After user equipment _A receives the authentication response data packet P2, judge whether the N _AR field in the authentication response data packet P2 is the same as the N _AR field in the authentication request data packet _{P1 :} if not, discard the authentication response data package P ₂ , if they are the same, execute 3b7);

3b7) The user equipment A exchanges the temporary private key X _AR with the DH and the DH exchange temporary public key Y _RA in the authentication response packet P ₂ using the formula MK _AR =e(X _AR , Y _RA ) to calculate the communication between A and R master key MK _AR ;

_3b8 ) User equipment _{A uses the formula MIC RA1 =} h _{( MK AR ||} ID _R ||ID _A || _{N RA |} |N _AR ||Y _RA ) Calculate the message integrity check code MIC _RA1 , verify whether MIC _RA1 is the same as the MIC _RA in the authentication response packet P ₂ : if they are different, discard the authentication response packet P ₂ , if they are the same, Then verify the correctness of the signature Sig _RA : if it is not correct, discard the authentication response packet P ₂ , and if it is correct, perform step 3c);

3c) The third handshake is performed between the user equipment A and the authentication server R:

_3c1 ) User equipment _A uses the _{formula MIC AR} =h( _{MK AR |} |ID _A ||ID _R ||N _RA ) calculate the message integrity check code MIC _AR ;

3c2) The user equipment A constructs the authentication confirmation data packet _P3 , and sends the authentication confirmation data packet _P3 to the authentication server R, and the content of the authentication confirmation data packet _P3 includes:

ID _A field: the identity of user equipment A;

ID _R field: the identity of the authentication server R;

N _RA field: user equipment _A receives the random number N _RA in the authentication response packet P2;

MIC _AR field: the message integrity check code calculated by user equipment A on the MK _AR field, ID _A field, ID _R field, and N _RA field;

3c3) After the authentication server R receives the authentication confirmation packet _P3 , it judges whether the random number N _RA in the authentication confirmation packet P ₃ is the same as the random number N _RA in the authentication response packet P ₂ : if they are different, discard Authentication confirmation data packet P ₃ , if they are the same, execute 3c4);

3c4) The authentication server R uses the formula MIC _AR1 ＝h(MK _RA ||ID _R ||ID _A ||N _RA ) to calculate the message integrity check for the master key MK _RA , ID _R field, ID _A field, and N _RA field. Check the code MIC _AR1 and verify whether the MIC _AR1 is the same as the MIC _AR in the authentication confirmation packet _P3 , if not, discard the authentication response packet _P3 , if they are the same, the entire authentication process is completed.

Step 4: Judgment of authority between user equipment A and parent node B.

User equipment A constructs an authentication request packet and sends the authentication request packet to parent node B. After receiving the authentication request packet, parent node B judges whether it is an authenticated node: if yes, execute step 5; if not , then go to step 6;

In step 5, two-way identity authentication of three-way handshake is performed between user equipment A and parent node B.

Referring to Figure 3, this step is specifically implemented as follows:

5a) The first handshake is performed between user equipment A and parent node B:

5a1) The user equipment A selects X _AB ∈ z _q ^* as the DH exchange temporary private key, and then calculates the DH exchange temporary public key Y _AB through the formula Y _AB =X _AB P, and the user equipment A generates a random number N _AB ;

5a2) The user equipment A uses the signature algorithm Sig to calculate the identity ID A of the user equipment A, the identity ID _B of the parent node _B , the random number N _AB , and the DH exchange temporary public key Y _AB to generate the signature Sig _AB ;

5a3) The user equipment A constructs the authentication request data packet P ₄ , and sends the authentication request data packet P ₄ to the authentication parent node B, and the content of the authentication request data packet P ₄ includes:

ID _A field: the identity of user equipment A;

ID _B field: the identity of the parent node B;

N _AB field: a random number generated by user equipment A;

Y _AB field: DH exchange temporary public key selected by user equipment A;

Sig _AB field: user equipment A signs ID _A field, ID _B field, N _AB field, Y _AB field with its own signature private key SK _A ;

_5a4 ) After the parent node B receives the authentication request packet P4, it judges whether it is an authenticated node: if it is not an authenticated node, then perform step 5, and if it is an authenticated node, then verify the correctness of the signature Sig _AB : If it is not correct, discard the authentication request packet P ₄ , if it is correct, perform step 5b);

5b) The second handshake is performed between user equipment A and parent node B:

5b1) The parent node B selects X _BA ∈ z _q ^* as the DH exchange temporary private key, and then calculates the DH exchange temporary public key Y _BA through the formula Y _BA =X _BA P , and the parent node B generates a random number N _BA ;

5b2) The parent node B uses its own signature private key SK _B to calculate the identity ID _B of the parent node B, the identity ID _A of the user equipment A, the random number N _BA , the random number N _AB , and the temporary public key Y _BA exchanged by DH, Generate signature Sig _BA ;

5b3) The parent node B exchanges the temporary private key X _BA according to the DH and the DH exchange temporary public key Y _AB in the authentication request packet P ₄ , and calculates the communication between B and A through the formula MK _BA =e(X _BA , Y _AB ) The master key MK _BA of ;

5b4) The parent node B uses the formula MIC _BA =h(MK _BA ||ID _B ||ID _A ||N _BA ||N _AB ||Y _BA ) to calculate the message integrity check code MIC _BA ;

5b5) The parent node B constructs the authentication response data packet P ₅ , and sends the authentication response data packet P ₅ to the user equipment A, the content of the authentication response data packet P ₅ includes:

ID _A field: the identity of user equipment A;

ID _B field: the identity of the parent node B;

N _BA field: random number generated by parent node B;

N _AB field: the random number N _AB in the authentication request packet P4 received by the parent node B _;

Y _BA field: DH exchange temporary public key selected by parent node B;

Sig _BA field: parent node B uses its own signature private key SK _B to sign the ID _B field, ID _A field, N _BA field, N _AB field, and Y _BA field;

MIC _BA field: the message integrity check code calculated by the parent node B for the MK _BA field, ID _B field, ID _A field, N _BA field, N _AB field, and Y _BA field.

5b6) After the user equipment _A receives the authentication response data packet _P5 , judge whether the N _AB field in the authentication response data packet _P5 is the same as the N _AB field in the authentication request data packet P4: if not, discard the authentication response data package P ₅ , if they are the same, execute step 5b7);

5b7) The user equipment A exchanges the temporary private key X _AB with the DH and the DH exchange temporary public key Y _BA in the authentication response packet P _5. Use the formula MK _AB =e(X _AB , Y _BA ) to calculate the communication between A and B master key MK _AB ;

_5b8 ) User equipment _{A uses the formula MIC BA1 = h} ( _{MK AB ||} ID _B ||ID _A || _{N BA |} |N _AB ||Y _BA ) calculate the message integrity check code MIC _BA1 , and verify whether MIC _BA1 is the same as the MIC _BA in the authentication response packet _P5 : if they are different, discard the authentication response packet _P5 ; if they are the same, Then verify the correctness of the signature Sig _BA : if it is not correct, discard the authentication response packet P ₅ , and if it is correct, perform step 5c);

5c) The third handshake is performed between user equipment A and parent node B:

_5c1 ) User equipment _A uses the _{formula MIC AB} =h( _{MK AB |} |ID _A ||ID _B ||N _BA ) calculate the message integrity check code MIC _AB ;

5c2) The user equipment A constructs the authentication confirmation data packet P ₆ , and sends the authentication confirmation data packet P ₆ to the parent node B, and the content of the authentication confirmation data packet P ₆ includes:

ID _A field: the identity of user equipment A;

ID _B field: the identity of the parent node B;

N _BA field: user equipment A receives the random number N _BA in the authentication response packet _P5 ;

MIC _AB field: the message integrity check code calculated by user equipment A on the MK _AB field, ID _A field, ID _B field, and N _BA field;

5c3) After the parent node B receives the authentication confirmation data packet _{P6, judge whether the random number N BA in the authentication confirmation data packet P 6 is the} same as the random number N _BA in the authentication response data packet P ₅ : if they are different, discard Authentication confirmation data packet P ₆ , if they are the same, execute step 5c4);

5c4) Parent node B uses the formula MIC _AB1 ＝h(MK _BA ||ID _B ||ID _A ||N _BA ) to calculate the message integrity check for the master key MK _BA , ID _B field, ID _A field, and N _BA field Check the code MIC _AB1 and verify whether the MIC _AB1 is the same as the MIC _AB in the authentication confirmation packet P ₆ : if they are different, the authentication response packet P ₆ is discarded, and if they are the same, the entire authentication process is completed.

In step 6, the parent node B repeats the discovery and authentication process of the user equipment A, so as to perform two-way identity authentication with the authentication server R, and then perform two-way identity authentication with the user equipment A.

Glossary

Trent: key generation center;

z: the security parameter selected by the key generation center Trent;

q: a large prime number greater than 2 ^z selected by the key generation center Trent;

G ₁ : the q-order additive cyclic group selected by the key generation center Trent;

G ₂ : The q factorial method cyclic group selected by the key generation center Trent;

e: the bilinear mapping on G ₁ and G ₂ selected by the key generation center Trent, that is, e: G ₁ ×G ₁ →G ₂ ;

P: generator on G ₁ , randomly selected by the key generation center Trent;

z _q ^* : non-zero multiplicative group based on prime number q;

ID _A : the identity of user equipment A generated by the key generation center Trent;

ID _R : the identity of the authentication server R generated by the key generation center Trent;

ID _B : the identity of the parent node B generated by the key generation center Trent;

SK _A : the signature private key of user equipment A;

SK _R : the signature private key of the authentication server R;

SK _B : signature private key of parent node B;

X _AR : DH selected by user equipment A to exchange temporary private keys;

Y _AR : DH exchange temporary public key calculated by user equipment A according to X _AR , Y _AR = X _ARP ;

X _RA : The DH selected by the authentication server R exchanges temporary private keys;

Y _RA : The authentication server R calculates the DH exchange temporary public key based on X _RA , Y _RA = X _RA P;

X _AB : DH selected by user equipment A to exchange temporary private keys;

Y _AB : DH exchange temporary public key calculated by user equipment A according to X _AB , Y _AB = X _AB P;

X _BA : DH selected by parent node B to exchange temporary private key;

Y _BA : DH exchange temporary public key calculated by parent node B according to X _BA , Y _BA = X _BA P;

N _AR : the random number generated by user equipment A for sending to authentication server R;

N _RA : a random number generated by the authentication server R for sending to the user equipment A;

N _AB : a random number generated by user equipment A for sending to parent node B;

N _BA : the random number generated by the parent node B for sending to the user equipment A;

Sig: the signature algorithm selected by the key generation center Trent;

h(x): cryptographic one-way hash function;

MK _AR : the communication master key calculated by user equipment A, MK _AR =e(X _AR , Y _RA );

MK _RA : the communication master key calculated by the authentication server R, MK _RA =e(X _RA , Y _AR );

MK _AB : the communication master key calculated by user equipment A, MK _AB =e(X _AB , Y _BA );

MK _BA : the communication master key calculated by the parent node B, MK _BA =e(X _BA , Y _AB );

A||B: Indicates the cascade of A and B, where A and B are linked together to form A||B, and A and B can be obtained by unlinking A||B;

MIC _RA : the message integrity check code calculated by the authentication server R, which is used to send to the user equipment A, wherein, MIC _RA =h(MK _RA ||ID _R ||ID _A ||N _RA ||N _AR | |Y _RA );

MIC _RA1 : The message integrity check code calculated by user equipment A using its own public key is used to verify whether it is the same as the received message integrity check code MIC _RA , where MIC _RA1 = h(MK _AR ||ID _R || ID _A || N _RA || N _AR || Y _RA );

MIC _AR : the message integrity check code calculated by user equipment A and sent to the authentication server R, where MIC _AR =h(MK _AR ||ID _A ||ID _R ||N _RA );

MIC _AR1 : The message integrity check code calculated by the authentication server R using its own public key, used to verify whether it is the same as the received message integrity check code MIC _AR , where MIC _AR1 = h(MK _RA ||ID _A ||ID _R ||N _RA );

MIC _BA : the message integrity check code calculated by the parent node B for sending to the user equipment A, wherein, MIC _BA =h(MK _BA ||ID _B ||ID _A ||N _BA ||N _AB | |Y _BA );

MIC _BA1 : the message integrity check code calculated by user equipment A using its own public key, used to verify whether it is the same as the received message integrity check code MIC _BA , where MIC _BA1 = h(MK _AB ||ID _B || ID _A || N _BA || N _AB || Y _BA );

MIC _AB : the message integrity check code calculated by user equipment A for sending to parent node B, where MIC _AB =h(MK _AB ||ID _A ||ID _B ||N _BA );

MIC _AB1 : The message integrity check code calculated by the parent node B using its own public key is used to verify whether it is the same as the received message integrity check code MIC _AB , where MIC _AB1 = h(MK _BA ||ID _A ||ID _B ||N _BA ).

Claims (7)

1. An agent-based user equipment trusted access authentication method, comprising the steps of: (1) User equipment A searches for authentication server R: When user equipment A needs to access the network, it first sends a search request packet to authentication server R in the network, and after receiving the search request packet from user equipment A, authentication server R replies to user equipment A with a search response packet, If user equipment A receives a search response packet from authentication server R, the search process ends normally, and step (2) is performed; if user equipment A does not receive a search response packet from authentication server R, the search process ends abnormally , execute step (3); (2) Two-way identity authentication with three handshakes between the user equipment A and the authentication server R; (3) Permission judgment between user equipment A and parent node B: User equipment A constructs an authentication request packet, and sends the authentication request packet to parent node B. After receiving the authentication request packet, parent node B judges whether itself is an authenticated node: if yes, then execute step (4), If not, then perform step (5); (4) Two-way identity authentication of three-way handshake between user equipment A and parent node B; (5) The parent node B repeats the discovery and authentication process of the user equipment A to perform the two-way identity authentication with the authentication server R, and then perform the two-way identity authentication with the user equipment A. 2. The proxy-based user equipment trusted access authentication method according to claim 1, wherein the three-way handshake two-way identity authentication process carried out between the user equipment A in the step (2) and the authentication server R, its expression as follows: 2a) The user equipment A constructs the authentication request data packet P ₁ and sends the authentication request data packet P ₁ to the authentication server R. When the authentication server R receives the authentication request data packet P ₁ , it verifies the correctness of the signature Sig _AR : if If it is not correct, discard the authentication request packet P ₁ , if it is correct, perform step 2b); 2b) The authentication server R constructs the authentication response data packet P ₂ and sends the authentication response data packet P ₂ to the user equipment A. When the user equipment A receives the authentication response data packet P ₂ , it judges the authentication response data packet P ₂ Whether the random number N _AR field is the same as the N _AR field in the received authentication request packet P1 _: if different, then discard the authentication response packet P2, if they are the same, then perform step 2c) _; 2c) User equipment A uses its own public key to calculate the message integrity check code MIC _RA1 sent by the authentication server R to user equipment _A , and verifies whether MIC _RA1 is the same as the message integrity check code in the received authentication response data packet P2 MIC _RA fields are the same: if they are different, discard the authentication response packet P ₂ , if they are the same, verify the correctness of the signature Sig _RA : if not correct, discard the authentication response packet P ₂ , if correct, go to step 2d ); 2d) The user equipment A constructs the authentication confirmation data packet _P3 , and sends the authentication confirmation data packet _P3 to the authentication server R, and when the authentication server R receives the authentication confirmation data packet _P3 , it judges whether the authentication confirmation data packet _P3 Whether the random number N _RA is the same as the random number N _RA in the received authentication response data packet P ₂ : if they are different, discard the authentication confirmation data packet P ₃ , if they are the same, perform step 2e); 2e) The authentication server R uses its own public key to calculate the message integrity check code MIC _AR1 sent by the user equipment A to the authentication server R, and verifies whether the MIC _AR1 is the same as the message integrity check code in the received authentication confirmation data packet _P3 The MIC _AR fields are the same: if they are different, the authentication confirmation data packet P ₃ is discarded; if they are the same, the entire authentication process is completed. 3. The proxy-based user equipment trusted access authentication method according to claim 1, wherein the three-way handshake two-way identity authentication process carried out between the user equipment A in the step (4) and the parent node B, its expression as follows: 4a) The user equipment A constructs the authentication request data packet P ₄ and sends the authentication request data packet P ₄ to the parent node B. After the parent node B receives the authentication request data packet P ₄ , it verifies the correctness of the signature Sig _AB : if If it is not correct, discard the authentication request packet P ₄ , if it is correct, perform step 4b); 4b) The parent node B constructs the authentication response data packet _P5 , and sends the authentication response data packet _P5 to the user equipment A, and when the user equipment A receives the authentication response data packet _P5 , it judges the authentication response data packet _P5 Whether the random number N _AB field is the same as the N _AB field in the received authentication request packet _P4 : if not, then discard the authentication response packet _P5 , if they are the same, then perform step 4c); 4c) User equipment A uses its own public key to calculate the message integrity check code MIC _BA1 sent by parent node B to user equipment A, and verifies whether the MIC _BA1 code is consistent with the message integrity in the received authentication response data packet _P5 The verification code MIC _BA fields are the same: if they are different, discard the authentication response packet P ₅ , if they are the same, verify the correctness of the signature Sig _BA : if they are not correct, discard the authentication response packet P ₅ , if they are correct, execute step 4d); 4d) The user equipment A constructs the authentication confirmation data packet _P6 , and sends the authentication confirmation data packet _P6 to the parent node B, and when the parent node B receives the authentication confirmation data packet _P6 , it judges the authentication confirmation data packet _P6 Whether the random number N _BA is the same as the random number N _BA in the received authentication response packet P ₅ : if not, discard the authentication confirmation packet P ₆ , if they are the same, execute step 4e); 4e) The parent node B uses its own public key to calculate the message integrity check code MIC _AB1 sent by the user equipment A to the parent node B, and verify whether the MIC _AB1 code is consistent with the message integrity in the received authentication confirmation data packet _P6 The fields of the check code MIC _AB are the same: if they are different, the authentication confirmation data packet P ₆ is discarded; if they are the same, the entire authentication process is completed. 4. The three-way handshake two-way identity authentication process carried out between the user equipment A and the authentication server R according to claim 2, wherein the user equipment A in the step 2c) uses its own public key to calculate the authentication server R and send it to the user equipment The message integrity check code MIC _RA1 of A is performed according to the following formula: MIC _RA1 ＝h(MK _AR ||ID _R ||ID _A ||N _RA ||N _AR ||Y _RA ) Among them, h(x) is a password one-way hash function, MK _AR is the communication master key between user equipment A and authentication server R, ID _R is the authentication response data packet P2 received by user equipment _A Server identity field, ID _A is the user equipment identity field in the authentication response packet P2 received by user equipment _A , and N _RA is the authentication server R sent to the user equipment in the authentication response packet P2 received by user equipment _A The random number field of A, N _AR is the random number field sent by user equipment _A to the authentication server R in the authentication response packet P2 received by user equipment A, and Y _RA is the authentication response packet received by user equipment A Authentication server public key field in _P2 . 5. The three-way handshake two-way identity authentication process carried out between the user equipment A and the authentication server R according to claim 2, wherein the authentication server R in the step 2e) uses its own public key to calculate the user equipment A and send it to the authentication server The message integrity check code MIC _AR1 of R is performed according to the following formula: MIC _AR1 ＝h(MK _RA ||ID _R ||ID _A ||N _RA ) Among them, h(x) is a cryptographic one-way hash function, MK _RA is the communication master key between the authentication server R and the user equipment A, ID _R is the authentication confirmation data packet _P3 received by the authentication server R Server identity field, ID _A is the user identity field in the authentication confirmation packet _P3 received by the authentication server R, and N _RA is the authentication server R sent to the user equipment A in the authentication confirmation packet _P3 received by the authentication server R random number field. 6. The three-way handshake two-way identity authentication process carried out between the user equipment A and the parent node B according to claim 3, wherein the user equipment A in the step 4c) uses its own public key to calculate the parent node B to send to the user equipment The message integrity check code MIC _BA1 of A is performed according to the following formula: MIC _BA1 ＝h(MK _AB ||ID _B ||ID _A ||N _BA ||N _AB ||Y _BA ) Among them, h(x) is a cryptographic one-way hash function, MK _AB is the communication master key between user equipment A and parent node B, and ID _B is the parent node in the authentication response packet _P5 received by user equipment A. Node identity field, ID _A is the user equipment identity field in the authentication response packet _P5 received by user equipment A, N _BA is the parent node B in the authentication response packet _P5 received by user equipment A and sent to the user equipment A random number field, N _AB is the random number field sent by user equipment A to parent node B in the received authentication response packet _P5 , Y _BA is the random number field in the authentication response packet _P5 received by user equipment A Parent node public key field. 7. The three-way handshake two-way identity authentication process carried out between the user equipment A and the parent node B according to claim 3, wherein the parent node B in the step 4e) uses its own public key to calculate that the user equipment A sends to the parent node The message integrity check code MIC _AB1 of B is performed according to the following formula: MIC _AB1 ＝h(MK _BA ||ID _B ||ID _A ||N _BA ) Among them, h(x) is a cryptographic one-way hash function, MK _BA is the communication master key between parent node B and user equipment A, and ID _B is the parent ID in the authentication confirmation packet _P6 received by parent node B. Node identity field, ID _A is the user equipment identity field in the authentication confirmation packet _P6 received by the parent node B, and N _BA is the authentication confirmation packet _P6 received by the parent node B and sent to the user equipment by the parent node B A random number field.