CN103024735B - Method and equipment for service access of card-free terminal - Google Patents

Abstract

A service access method for a cardless terminal, comprising: a cardless terminal receiving a service authentication request sent by a cardless terminal, generating a user key for the cardless terminal according to the service authentication request, and according to the user key, The cardless terminal is authenticated by interacting with the network side; after the cardless terminal passes the authentication, the cardless terminal performs service interaction with the network side according to the received service interaction request sent by the cardless terminal. The method is used to solve the problem that it is difficult for a cardless terminal to directly access network services by using the GBA process, and enhance the convenience of cardless terminals accessing network services.

Description

Service access method and device for cardless terminal

technical field

The invention relates to the field of communication technology, in particular to a service access method and device for a cardless terminal.

Background technique

In the mobile network environment, when a user uses a terminal to access certain services, it is necessary to implement mutual authentication between the terminal and the service server based on the user key and use the user key to encrypt and transmit some confidential data. It can be seen that the generation of the user key is Prerequisites for users to use such services.

To distinguish from whether the device used by the user has a SIM/USIM card (Subscriber Identity Module/Universal Subscriber Identity Module, Subscriber Identity Card/Universal Subscriber Identity Card), the current terminals can be divided into two categories: terminals with cards and terminals without cards terminal. There is a SIM/USIM card inserted in the terminal with a card, which records the personalized user root key for the user to log in to the mobile communication network, and is connected with the network side HLR/HSS (Home Location Register/Home Subscriber Server, Home Location Register/Home Subscriber Server) ) with the same key as recorded. The most common card terminal such as mobile phones. Since the key in the card has been shared between the network side and the terminal side, for a terminal with a card, mutual authentication between the terminal and the network platform can be realized based on the key and a shared user key for the service layer can be generated. At present, 3GPP defines GBA (Generic Bootstrapping Architecture, general bootstrapping architecture), which is used to generate a user key shared between the terminal and the service platform for the terminal with the card.

Since there is no SIM/USIM card inserted in the terminal without a card, the terminal does not contain any key or secret information that can be used to authenticate the user's identity, so it is impossible to generate the user key shared between the terminal and the service platform through the GBA process like a terminal with a card . Therefore, in the existing terminal service access technology, it is difficult for a cardless terminal to directly access network services through the GBA process.

As cardless terminals (such as PCs, notebooks, set-top boxes, tablet computers and e-readers, etc.), especially cardless terminals represented by tablet computers become more and more popular and popular, the resulting cardless terminals cannot The problem of using the GBA process to directly access network services needs to be solved urgently.

Contents of the invention

Embodiments of the present invention provide a service access method and device for a cardless terminal, which are used to solve the problem that it is difficult for a cardless terminal to directly access network services by using a GBA process, and enhance the convenience of cardless terminals accessing network services.

The service access method of the non-card terminal provided in the embodiment of the present invention includes the following steps:

The terminal with the card receives the service authentication request sent by the terminal without the card, generates a user key for the terminal without the card according to the service authentication request, and interacts with the network side to perform authentication on the terminal without the card according to the user key. certification;

After the cardless terminal passes the authentication, the cardless terminal performs service interaction with the network side according to the received service interaction request sent by the cardless terminal.

The terminal with a card provided by the embodiment of the present invention includes:

The first receiving module is configured to receive the service authentication request sent by the cardless terminal; and receive the service interaction request sent by the cardless terminal;

A security module, configured to generate a user key for the cardless terminal according to the service authentication request, and authenticate the cardless terminal through the network side according to the user key; and, at the network side, authenticate the cardless terminal After passing the authentication of the cardless terminal, perform service interaction with the network side according to the service interaction request sent by the cardless terminal received by the first receiving module.

The cardless terminal provided by the embodiment of the present invention includes:

A security module, used to establish a security channel with the card terminal;

The client module is configured to send a service authentication request to the terminal with the card through the secure channel, so that the terminal with the card generates a user key for the terminal without the card according to the service authentication request, and according to the user key, Authenticate the cardless terminal by interacting with the network side; and send a service interaction request to the card terminal through the secure channel, so that the card terminal performs service interaction with the network side.

Compared with the prior art, the above-mentioned embodiments of the present invention have the following beneficial technical effects:

In the embodiment of the present invention, after receiving the authentication request initiated by the cardless terminal, the cardless terminal generates a user key for the cardless terminal according to the service authentication request, and according to the user key, the cardless terminal is authenticated by the network side. The terminal authenticates, and after passing the authentication of the cardless terminal on the network side, it conducts business interaction with the network side according to the received service interaction request sent by the cardless terminal, thereby providing network access for cardless terminals that do not have the ability to access the network. The access channel enables it to access the service platform, which enhances the convenience of cardless terminals accessing network services.

Description of drawings

Fig. 1 is a flow chart of steps of a service access method for a cardless terminal provided in an embodiment of the present invention;

FIG. 2 is a schematic signaling diagram of a service access method for a cardless terminal provided by an embodiment of the present invention;

Fig. 3 is a flow chart of the steps of generating the user key of the cardless terminal and the guide identification of the user key of the cardless terminal by the middleware of the card terminal provided by the embodiment of the present invention;

Fig. 4 is the flow chart of the steps of generating the verification key of the cardless terminal user key by the BSF provided by the embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a terminal with a card provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a cardless terminal provided by an embodiment of the present invention.

Detailed ways

The following is a clear and complete description of the technical solution of the present invention in conjunction with the accompanying drawings. Apparently, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The service access system frame applicable to the embodiment of the present invention includes: a terminal with a card, a terminal without a card, a network application platform (Network Application Function, NAF) and an initialization server (Bootstrapping server function, BSF). Among them, NAF is mainly used for business authentication and business interaction with the card terminal in this embodiment; BSF is mainly used for generating the user key of the terminal without the card and sending it to the NAF, so that the NAF and the terminal with the card perform business authentication; Terminals with cards are devices without SIM/USIM cards, such as PCs, notebooks, set-top boxes, tablet computers, and e-readers; terminals without cards are devices with SIM/USIM cards, such as mobile phones.

The terminal with card in this system acts as the agent of the terminal without card, and provides functions such as user key generation, user authentication, and network access for the terminal without card. The cardless terminal does not participate in the realization of functions such as user key generation, user authentication, and network access. The business client on the cardless terminal does not need to care about key negotiation, user authentication, etc. The terminal logic initiates the service interaction process to the terminal with the card, and then the terminal with the card sends it to the NAF through the proxy mechanism.

Based on the aforementioned system architecture, the service access process of the cardless terminal provided by the embodiment of the present invention can be shown in Figure 1, including:

In step 101, a secure channel is established between a terminal without a card and a terminal with a card.

During specific implementation, the terminal without a card and the terminal with a card can use their respective stored shared keys (PSK) to authenticate each other and establish a secure channel.

Step 102, when the terminal without the card needs to access the NAF for service access, send a service authentication request to the terminal with the card through the secure channel.

Step 103, the terminal with the card generates a user key for the terminal without the card according to the service authentication request.

During specific implementation, parameters such as NAF ID (NAF identification) and Device ID (the device identification of the non-card terminal that initiates the service authentication request) can be carried in the service authentication request, and the card terminal can carry the parameters according to the information carried in the service authentication request. NAF ID and Ks (Ks is the shared key between the card terminal and BSF, i.e. the root key) is calculated to obtain the service access key Ks_NAF, and then the user key TempK_NAF and TB-TID are generated according to Ks_NAF, Device ID and other parameters, TB-TID is temporary B-TID (Bootstrapping transaction identifier, bootstrapping transaction identifier).

Step 104, the terminal with the card uses the user key to perform service authentication on the terminal without the card through the network side.

During specific implementation, the terminal with the card initiates a service authentication request to the NAF, which carries the TB-TID generated for the terminal without the card, and the NAF initiates a request to the BSF to obtain the user key, which carries the TB-TID and NAF ID; BSF Analyze TB-TID to get DeviceID, B-TID and user key expiration date (Expire Date), and calculate service access key Ks_NAF according to NAF ID and Ks, then generate user key TempK_NAF according to Ks_NAF, DeviceID and other parameters, and return to the NAF; the NAF and the terminal with the card perform business authentication on the terminal without the card based on the TempK_NAF generated for the terminal without the card.

Step 105: If the cardless terminal passes the authentication, the cardless terminal can send a service interaction request to the carded terminal through the secure channel with the carded terminal, and the carded terminal sends the service interaction request to NAF, and After receiving the service response returned by the NAF, the service response is sent to the cardless terminal through the secure channel. Meanwhile, according to business needs, the terminal with the card can use the user key TempK_NAF generated for the terminal without the card to encrypt the data sent to the NAF; the NAF can use the user key TempK_NAF of the terminal without the card to encrypt the service response before sending For a terminal with a card, in this case, the terminal with a card can use the user key TempK_NAF generated for the terminal without a card to decrypt the received service response data, and then send the decrypted service response to the terminal without a card.

It can be seen from the above process that the embodiment of the present invention has the following advantages:

1. Provide network access channels for non-card terminals that do not have the ability to access the network, so that they can access the business platform, and enhance the convenience of non-card terminals to access network services.

2. The terminal without a card does not participate in the processes of user key generation, network access, and user authentication. It only needs to initiate a service interaction request to the terminal with the card, and then the terminal with the card sends it to the service platform through the proxy mechanism, so that the terminal with the card can act as an The proxy of the cardless terminal accesses the network to access the service platform.

3. The terminal without a card uses the terminal with a card to access the network to access the service platform through an agent. The network that the terminal with a card accesses is the same as the network to which the service platform belongs, which ensures the QoS (Quality of Service, Quality of Service), the signaling response delay and packet loss can be reduced through unified network planning and upgrading.

4. Neither TempK_NAF nor Ks_NAF will issue a terminal with a card, which effectively eliminates the risk of a terminal without a card calculating the Ks_NAF of a terminal with a card through TempK_NAF, and improves the security of the user key of the business client on the terminal with a card.

5. The terminal with the card allows the terminal without the card to use the service as the user of the terminal with the card within a limited period of time. After the validity period, the user key generated for the terminal without the card becomes invalid. Establish a secure channel to guarantee the authentication of the device and the confidentiality of the connection.

In the specific implementation of the embodiment of the present invention, a security module (Secure Module, SeM) can be respectively deployed on the terminal with the card and the terminal without the card to realize the function of the terminal with the card acting as the terminal without the card to perform business authentication and network access . The SeM module on the terminal without a card includes an interface layer, and the SeM module on a terminal with a card includes an interface layer and middleware. Among them, the interface layer can adopt various software or hardware forms to ensure the communication security of the interface between the middleware on the terminal with the card and the service client of the terminal without the card. As a general capability, the middleware in the SeM module on a terminal with a card can provide functions such as user key generation, user authentication, and network access for multiple cardless terminals and multiple service clients.

Based on the above structure of the card terminal and the cardless terminal, the signaling process of the cardless terminal user key generation, user authentication, network access and service interaction process provided by the embodiment of the present invention can be shown in FIG. 2 .

Among them, during the GBA initialization process, the key calculation module in the terminal with a card and the BSF negotiate a shared key, that is, the GBA key calculation module of the terminal with a card uses the SIM/USIM card to calculate authentication information and BSF authentication, Realize the GBA initialization process and generate the root key Ks of the card terminal.

The user key generation, user authentication and business interaction process after the GBA initialization process are described in detail below in conjunction with Figure 1 and Figure 2, as shown in Figure 2, the process includes:

A secure channel is established between the terminal without a card and the terminal with a card (corresponding to step 101 in Figure 1)

Wherein, the interface layer of the SeM module of the terminal without a card and the interface layer of the SeM module of the terminal with a card use their respective stored shared keys (PSK) to authenticate each other and establish a secure channel. Wherein, the shared key may be pre-stored, or a password temporarily entered by the user.

The business authentication process carried out by the terminal with the card on behalf of the terminal without the card (corresponding to steps 102-104 in Figure 1)

When a cardless terminal needs to access NAF, the NAF client of the cardless terminal initiates an authentication request to the middleware in the SeM module of the cardless terminal, which carries the network application platform identification (NAF ID) that needs to be accessed and the cardless terminal ID. Terminal ID (Device ID).

The middleware of the card terminal sends a key request to the key operation module in the card terminal SIM/USIM to request to obtain the service key Ks_NAF of the cardless terminal; the key operation module in the SIM/USIM receives the intermediate Generate Ks_NAF after the key request of the software and send to the middleware, this Ks_NAF corresponds to the service platform identification NAF ID requested by the cardless terminal. Specifically, the key calculation module of the card terminal uses Ks, NAF ID and IP Multimedia Private Identity (IP Multimedia Private Identity, IMPI), etc. to generate Ks_NAF. The key calculation module can be in the SIM/USIM or outside the SIM/USIM, such as software or hardware on the terminal. The middleware of the terminal with the card generates the user key TempK_NAF of the terminal without the card and the temporary TB-TID of the user key of the terminal without the card according to the obtained Ks_NAF.

The middleware of the terminal with the card sends a service authentication request to the NAF, which carries the TB-TID generated for the terminal without the card; after receiving the service authentication request sent by the middleware, the NAF sends a key request to the BSF, and the key request contains Carry its own NAF ID and the TB-TID obtained from the service authentication request; BSF generates the user key TempK_NAF of the cardless terminal after receiving the key request, and sends the TempK_NAF of the cardless terminal to NAF; The middleware of the card terminal and NAF authenticate the cardless terminal based on the TempK_NAF generated for the cardless terminal, that is, the middleware and NAF complete HTTP Digest mutual authentication based on TempK_NAF, and establish a Business communication secure channel.

After the middleware of the NAF and the terminal with the card passes the authentication of the terminal without the card, the middleware sends the authentication result to the NAF client of the terminal without the card.

Preferably, the terminal with the card can prompt the user with the service authentication request of the terminal without the card on the user interface, and wait for the user to choose whether to agree, if the rejection information submitted by the user is received, the terminal with the card rejects the authentication request of the terminal without the card, If the confirmation information submitted by the user is received, the middleware of the card terminal requests the service access key (Ks_NAF) from the key calculation module.

The business interaction process performed by the terminal with the card on behalf of the terminal without the card (corresponding to step 105 in Figure 1)

After passing the authentication, the NAF client of the cardless terminal initiates a next-step service interaction request to the card terminal middleware; the card terminal middleware sends the service interaction request to the NAF through the access network of the card terminal (that is, through the The business security channel established between the card terminal and NAF sends the service interaction request); NAF receives the service interaction request sent by the card terminal middleware and performs corresponding processing, and sends the business response to the card terminal middleware ; The middleware of the terminal with the card receives the service response sent by the NAF and sends it to the NAF client of the terminal without the card; the NAF client of the terminal without the card receives the service response and performs corresponding service processing operations.

Preferably, the terminal middleware with card can choose to encrypt the service interaction request received from the cardless terminal using the TempK_NAF of the cardless terminal according to the security level of the service interaction, and send the encrypted service interaction request to NAF; The NAF can also use the TempK_NAF of the cardless terminal to encrypt the service response sent to the card terminal middleware according to the security level of the service interaction. If the service response received by the middleware of the terminal with card is encrypted, the middleware uses the corresponding TempK_NAF to decrypt the service response, and sends the decrypted service response to the NAF client of the terminal without card.

In the foregoing step 103, the middleware generates the user key of the cardless terminal and the guide identification (seeing shown in Figure 3) of the user key of the cardless terminal according to the obtained Ks_NAF, specifically comprising the following steps:

Step 301, the middleware sets the validity period (ExpireDate) for the user key of the cardless terminal according to the policy. The validity period of the user key can be flexibly set for different users and different business contents that need to be accessed, so as to satisfy different users, different business needs. During the specific operation, judge according to the type of terminal carried by the device ID without a card: if it is a terminal in the home such as a set-top box or a home device, the validity period of the key can be 1 day, and the Expire Date can be 2010- 3-2012:00:00: 2010-3-21 12:00:00; if it is a public PC and other equipment, the validity period can be 1 hour, and the Expire Date can be 2010-3-20 12:00:00: 2010 -3-21 13:00:00.

Step 302, the middleware generates the user key (TempK_NAF) and the boot identifier (TB-TID) of the cardless terminal user key according to Ks_NAF, Expire Date and Device ID.

Specifically, TempK_NAF=KDF(Ks_NAF, Device ID, Expire Date); wherein, KDF is a one-way digest function, which includes MD5, SHA1, SHA256, or HMAC algorithm.

At the same time, the middleware generates a boot identifier TB-TID for the NAF Client of the cardless terminal. specific,

The key calculation module of the terminal with the card transmits the Expire Date and TempK_NAF to the middleware of the terminal with the card; the middleware of the terminal with the card generates it according to the validity period, the device identification of the terminal without the card and the bootstrapping transaction identifier (B-TID) Temporary guidance identifier TB-TID of a terminal without a card, for example, the temporary guidance service identifier of a terminal without a card is: terminal identification validity period guidance service identifier; among them, B-TID is the terminal with a card after the terminal has performed GBA initialization, and the terminal with a card is assigned by the BSF Generated; B-TID is used to identify the user key Ks of the card terminal.

In the aforementioned step 104, the BSF generates the verification key (seeing shown in Figure 4) of the cardless terminal user key, which specifically includes the following steps:

Step 401, after receiving the key request sent by the NAF, the BSF parses the TB-TID carried in the key request, and takes out the B-TID, Device ID and Expire Date.

In step 402, the BSF judges whether the Expire Date of the TB-TID is still valid, and if it is valid, searches for Ks_NAF according to the B-TID; otherwise, returns a message that the authentication fails to the middleware.

Step 403, BSF calculates the verification key of the cardless terminal user key according to Ks_NAF, TempK_NAF=KDF(Ks_NAF, Device ID, Expire Date). Among them, KDF is a one-way digest function, which includes MD5, SHA1, SHA256, or HMAC algorithm.

It can be seen from the above process that the embodiment of the present invention also has the following advantages:

1. In the embodiment of the present invention, the functions of authentication and generation of the shared user key of the service layer are concentrated in the SeM module of the terminal with a card. The complexity of the business client on the card terminal reduces the interaction complexity between the card terminal and the cardless terminal SeM module, and improves the functional stability.

2. As a general capability, the middleware in the SeM module of the card terminal can provide authentication process and business channel security for multiple terminals and multiple clients, reducing the development cost and integration difficulty of each client. Based on the same GBA scheme and the same SIM card, the middleware can generate different identities and different service keys for its own service client and service clients on several other cardless terminals, ensuring that different service clients can use Different identities are authenticated.

An embodiment of the present invention also provides a terminal with a card. Referring to FIG. 5 , it is a schematic structural diagram of a terminal with a card provided by an embodiment of the present invention. The terminal with a card includes:

The first receiving module 501 is configured to receive the service authentication request sent by the cardless terminal; and receive the service interaction request sent by the cardless terminal;

The security module 502 is configured to generate a user key for the cardless terminal according to the service authentication request, and authenticate the cardless terminal through the network side according to the user key; A receiving module 501 performs service interaction with the network side from the service interaction request sent by the cardless terminal.

Specifically, the security module 502 is specifically configured to generate a user key and a temporary boot identifier of the user key for a cardless terminal, and initiate a service authentication request to the network application platform NAF, which carries a temporary boot identifier, so that NAF will The temporary boot ID is sent to the initialization server BSF, and the user key generated by it according to the temporary boot ID is obtained from the BSF;

The security module 502 is also used for performing authentication with the NAF based on the user key generated for the cardless terminal.

The card terminal provided by the embodiment of the present invention also includes a key calculation module 503, which is used to generate the service access key Ks_NAF according to the network platform identification NAF ID of the network side and the shared key Ks between the card terminal and the network side;

The security module 502 is also used to set the validity period for the user key of the cardless terminal, generate the user key of the cardless terminal according to Ks_NAF, the validity period and the device identification of the cardless terminal, and generate the user key of the cardless terminal according to the validity period, the device The ID and the boot ID of the user key generate a temporary boot ID of the user key of the cardless terminal.

The terminal with a card also includes: a second receiving module 504, the second receiving module 504 is used to receive the service response returned by the network side;

The security module 502 is further configured to send the service response received by the second receiving module 504 to the cardless terminal.

Specifically, the security module 502 is also configured to use the user key generated for the cardless terminal to encrypt the received service interaction request, and send the encrypted service interaction request to the network side; The generated user key decrypts the service response returned by the network side, and sends the decrypted service response to the cardless terminal.

The embodiment of the present invention also provides a cardless terminal, as shown in FIG. 6, which is a schematic structural diagram of the cardless terminal provided by the embodiment of the present invention. The cardless terminal includes:

A security module 601, configured to establish a security channel with a terminal with a card;

The client module 602 is configured to send a service authentication request to the terminal with the card through the secure channel, so that the terminal with the card generates a user key for the terminal without the card according to the service authentication request, and interacts with the network side according to the user key. Authenticating the terminal without the card; and sending a service interaction request to the terminal with the card through a secure channel, so that the terminal with the card performs service interaction with the network side.

Specifically, the client module 602 is also configured to receive a service response returned by a terminal with a card.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is a better implementation Way. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to make a A terminal device (which may be a mobile phone, a personal computer, a server, or a network device, etc.) executes the methods described in various embodiments of the present invention.

Those skilled in the art can understand that the modules in the device in the embodiment may be distributed in the device in the embodiment according to the description in the embodiment, or may be located in one or more devices different from the embodiment according to corresponding changes. The modules in the above embodiments can be combined into one module, and can also be further split into multiple sub-modules.

The above is only a preferred embodiment of the present invention, it should be pointed out that, for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (8)

1. A service access method of a cardless terminal, characterized in that, comprising: The terminal with the card receives the service authentication request sent by the terminal without the card, generates a user key for the terminal without the card according to the service authentication request, and interacts with the network side to perform authentication on the terminal without the card according to the user key. certification; After the card-free terminal passes the authentication, the card-present terminal performs service interaction with the network side according to the received service interaction request sent by the card-free terminal; The card-present terminal generates a user key for the card-free terminal according to the service authentication request, and authenticates the card-free terminal by interacting with the network side according to the user key, including: The terminal with a card generates a user key and a temporary boot identifier of the user key for the terminal without a card; The card-bearing terminal initiates a service authentication request to the network application platform NAF, which carries the temporary guidance identifier; NAF initiates a key request to the initialization server BSF, which carries the temporary guidance identifier; The BSF generates a user key according to the temporary bootstrap identifier, and returns it to the NAF; The terminal with the card and the NAF authenticate the terminal without the card based on the user key generated for the terminal without the card; The terminal with a card generates a user key and a temporary boot identifier of the user key for the terminal without a card, specifically including: The card terminal generates the service access key Ks_NAF according to the network platform identification NAF ID and the shared key Ks between the card terminal and the network side; The terminal with the card sets the validity period for the user key of the terminal without the card; The terminal with the card generates the user key of the cardless terminal according to Ks_NAF, the validity period and the device identification of the cardless terminal, and generates the user key according to the validity period, the device identification of the cardless terminal and the guide identification of the user key The temporary guide identification of the user key of the cardless terminal; The BSF generates a user key according to the temporary bootstrap identifier, specifically including: BSF obtains the cardless terminal user key's boot ID, device ID and validity period of the user key by parsing the temporary boot ID; The BSF judges whether the validity period of the user key obtained by parsing is valid, and when it is judged to be valid, searches for the corresponding service access key according to the guide identification of the user key, and according to the service access key, the device of the cardless terminal ID and validity period to generate a user key. 2. The method of claim 1, further comprising: After the terminal with the card performs service interaction with the network side, it sends the service response returned by the network side to the terminal without the card. 3. The method according to claim 2, wherein the terminal with a card performs service interaction with the network side according to the received service interaction request sent by the terminal without a card, including: The terminal with the card uses the user key generated for the terminal without the card to encrypt the received service interaction request, and sends the encrypted service interaction request to the network side; The terminal with the card sends the service response returned by the network side to the terminal without the card, including: The terminal with the card uses the user key generated for the terminal without the card to decrypt the service response returned by the network side, and sends the decrypted service response to the terminal without the card. 4. A terminal with a card, characterized in that it comprises: The first receiving module is configured to receive the service authentication request sent by the cardless terminal; and receive the service interaction request sent by the cardless terminal; A security module, configured to generate a user key for the cardless terminal according to the service authentication request, and authenticate the cardless terminal through the network side according to the user key; and, at the network side, authenticate the cardless terminal After passing the card-free terminal authentication, perform service interaction with the network side according to the service interaction request sent by the card-free terminal received by the first receiving module; The security module is specifically used to generate a user key and a temporary boot identifier of the user key for the cardless terminal, and initiate a service authentication request to the network application platform NAF, which carries the temporary boot identifier, so that the NAF Send the temporary boot ID to the initialization server BSF, and obtain from BSF the user key generated according to the temporary boot ID; The security module is also used to authenticate with the NAF based on the user key generated for the cardless terminal; The card terminal also includes: The key calculation module is used to generate the service access key Ks_NAF according to the network platform identification NAF ID on the network side and the shared key Ks between the card terminal and the network side; The security module is also used to set the validity period for the user key of the cardless terminal, generate the user key of the cardless terminal according to Ks_NAF, the validity period and the equipment identification of the cardless terminal, and generate the user key of the cardless terminal according to the validity period, the The device identifier of the cardless terminal and the boot identifier of the user key generate the temporary boot identifier of the user key of the cardless terminal. 5. The card-present terminal according to claim 4, further comprising: a second receiving module; The second receiving module is configured to receive a service response returned by the network side; The security module is further configured to send the service response received by the second receiving module to the cardless terminal. 6. The terminal with a card as claimed in claim 5, characterized in that, The security module is further configured to use the user key generated for the cardless terminal to encrypt the received service interaction request, and send the encrypted service interaction request to the network side; The user key generated by the card terminal decrypts the service response returned by the network side, and sends the decrypted service response to the cardless terminal. 7. A cardless terminal, characterized in that it comprises: A security module, used to establish a security channel with the card terminal; The client module is configured to send a service authentication request to the terminal with the card through the secure channel, so that the terminal with the card generates a user key for the terminal without the card according to the service authentication request, and according to the user key, Authenticate the cardless terminal by interacting with the network side; and send a service interaction request to the carded terminal through the secure channel, so that the carded terminal performs service interaction with the network side; Wherein, the terminal with the card generates a user key for the terminal without the card according to the service authentication request, and authenticates the terminal without the card by interacting with the network side according to the user key, including: The terminal with a card generates a user key and a temporary boot identifier of the user key for the terminal without a card; The card-bearing terminal initiates a service authentication request to the network application platform NAF, which carries the temporary guidance identifier; NAF initiates a key request to the initialization server BSF, which carries the temporary guidance identifier; The BSF generates a user key according to the temporary bootstrap identifier, and returns it to the NAF; The terminal with the card and the NAF authenticate the terminal without the card based on the user key generated for the terminal without the card; The terminal with a card generates a user key and a temporary boot identifier of the user key for the terminal without a card, specifically including: The card terminal generates the service access key Ks_NAF according to the network platform identification NAF ID and the shared key Ks between the card terminal and the network side; The terminal with the card sets the validity period for the user key of the terminal without the card; The terminal with card generates the user key of the cardless terminal according to Ks_NAF, the validity period and the device identification of the cardless terminal, and generates the user key according to the validity period, the device identification of the cardless terminal and the guide identification of the user key The temporary guide identification of the user key of the cardless terminal; The BSF generates a user key according to the temporary bootstrap identifier, specifically including: BSF obtains the cardless terminal user key's boot ID, device ID and validity period of the user key by parsing the temporary boot ID; The BSF judges whether the validity period of the user key obtained by parsing is valid, and when it is judged to be valid, searches for the corresponding service access key according to the guide identification of the user key, and according to the service access key, the device of the cardless terminal ID and validity period to generate a user key. 8 . The cardless terminal according to claim 7 , wherein the client module is further configured to receive a service response returned by a terminal with a card.