TWI598762B - A network system, method and mobile device based on remote user authentication - Google Patents

Description

Network system, method and mobile device for implementing cloud identity authentication

The invention relates to a network system, a method and a mobile device for implementing cloud identity authentication.

The authentication of the conventional mobile network is based on the SIM card information contained in the mobile device for verification. When a user uses a plurality of SIM cards, the user needs to manually change cards or use a multi-card mobile device, which may reduce the user experience or increase the cost of the mobile device.

In view of the above, it is necessary to provide a network system, method and mobile device for implementing cloud identity authentication.

A network system for implementing cloud identity authentication, the network system includes a mobile network, the network system further includes: an account database for storing information of an account applied by the user and at least one virtual SIM bound to each account The card authentication information is used to receive the account authentication information sent by the mobile device through the mobile network, and determine whether the mobile device passes the account authentication according to the received account authentication information and the account database; the account authentication The module is further configured to: when the mobile device passes the account authentication, send, to the mobile network, authentication information of the virtual SIM card bound by the account in the account authentication information sent by the mobile device; Network, based on received The authentication information of the virtual SIM card determines whether the mobile device passes the identity authentication; and the mobile network is further configured to: when the mobile device passes the identity authentication, feed back information of the successfully authenticated virtual SIM card to the mobile device.

A method for implementing cloud identity authentication, the method comprising: receiving, by a mobile network, account authentication information sent by a mobile device, and transmitting the account authentication information to an account authentication module; the account authentication module is authenticated according to the account The information and the account database determine whether the mobile device is authenticated by the account, and the account database stores information about the account applied by the user and various information of at least one virtual SIM card bound to each account; when the mobile device When the account authentication is performed, the account authentication module sends the authentication information of the virtual SIM card bound to the account in the account authentication information sent by the mobile device to the mobile network for identity authentication; the mobile network Determining, by the authentication information of the received virtual SIM card, whether the mobile device passes the identity authentication; and when the mobile device passes the identity authentication, the mobile network feeds back information of the successfully authenticated virtual SIM card to the mobile device.

A mobile device for implementing cloud identity authentication, the mobile device comprising: a communication device for performing communication; a storage device for storing configuration information of the virtual SIM card; a processor for implementing cloud identity authentication, the processor executing The following steps are: when receiving the identity authentication request through the communication device, generating account authentication information according to the account and password input by the user, the account is bound to at least one virtual SIM card; sending the account authentication information for account authentication and performing the The identity authentication of the at least one virtual SIM card bound to the account; and, when the identity authentication is performed, receiving the information of the virtual SIM card authenticated by the identity.

Compared with the prior art, the mobile device in the present invention does not include a SIM card module, and the mobile device only needs to be able to connect to the network for implementing cloud identity authentication, and enter the correct account number and password to pass the identity authentication. Through the invention, the cost of the mobile device is saved, and the user experience is improved.

1‧‧‧Network system for cloud identity authentication

10‧‧‧Mobile network

101‧‧‧ base station

102‧‧‧Control Module

103‧‧‧Transmission module

104‧‧‧Mobile User Management Module

11‧‧‧ Account Database

12‧‧‧Account Authentication Module

13‧‧‧ functional modules

2‧‧‧Mobile devices

21‧‧‧Communication device

22‧‧‧ Processor

23‧‧‧Storage device

24‧‧‧ Input device

3‧‧‧Internet

Figure 1 is a network architecture diagram of an LTE network.

2 is a structural diagram of a network system for implementing cloud identity authentication according to the present invention.

Figure 3 is a schematic diagram of an account database.

4 is a flow chart of a preferred embodiment of a method for implementing cloud identity authentication in accordance with the present invention.

FIG. 5 is a flowchart of a process of processing user data according to a preferred embodiment of the method for implementing cloud identity authentication according to the present invention.

For the sake of explanation, the following uses the LTE network as an example to introduce the network architecture of the conventional network. The LTE (Long Term Evolution) is a UMTS (Universal Mobile Telecommunications System) technical standard developed by the 3GPP (The 3rd Generation Partnership Project).

Referring to FIG. 1, it is a network architecture diagram of an LTE network. The LTE network includes, but is not limited to, a base station, a Serving GateWay (SGW), a PDN GateWay (PGW), a Mobility Management Entity (MME), and a Home Subscriber Server ( Home Subscriber Server, HSS). The mobile device includes at least one SIM card and is communicably coupled to the base station. The SIM card includes information such as a mobile subscriber identity code, a location area identifier, and a phone book. The PGW is connected to the Internet. The base station is configured to forward the signaling of the mobile device to the MME, forward the user data of the mobile device to the SGW, and forward the returned data to the mobile device. The SGW is mainly used to forward user data of the mobile device. The PGW is mainly used to forward the user data of the mobile device to the Internet, and forward the data fed back by the Internet to the SGW. The MME Signaling for processing mobile devices, for example, assigning IP, SGW, and PGW to mobile devices, transferring identity authentication information to HSS, and the like. The HSS is mainly used to manage information of all SIM cards of the LTE network, such as information such as authentication information, tariffs, and current location of a SIM card. The HSS may perform identity authentication on the mobile device according to the authentication information of the SIM card that the mobile device sends.

The process of identity authentication for a conventional mobile device is:

Step 1: When the mobile device is in communication connection with the base station, the mobile device determines identity authentication information according to the SIM card it contains, and sends the identity authentication information to the MME through the base station.

Step 2: The MME sends the received identity authentication information to the HSS for identity authentication, that is, authenticates the identity of the SIM card included in the mobile device. If the SIM card included in the mobile device passes the authentication (eg, valid, no fee, etc.), it is determined that the mobile device passes the identity authentication.

Step 3: When the identity authentication of the mobile device passes, the HSS feeds the result back to the MME, and the MME feeds back the successfully authenticated information to the mobile device through the base station, and allocates the IP, the SGW, and the PGW to the mobile device. If the identity authentication of the mobile device fails (for example, the SIM card is invalid), the MME returns the information of the authentication failure to the mobile device through the base station.

It should be noted that when the identity authentication of the mobile device is successful, the mobile device can use the LTE network without re-authentication before the current connection is disconnected. The disconnection of the connection may be actively disconnected by the mobile device, or disconnected by the HSS due to cost or the like, or disconnected by the MME because it has not been used for a long time.

The processing of the conventional user data is:

Step a, after the mobile device can normally use the LTE network, the mobile device sends the user profile according to the operation of the user. The user profile may be a text message, a phone call, an internet request, or the like.

Step b, the base station transmits the user data to the Internet through the SGW and the PGW, and receives the feedback data from the Internet through the SGW and the PGW when receiving the feedback data, and the feedback data is sent back Send to mobile device. It should be noted that when the user data is transmitted to the Internet, the corresponding server on the Internet processes the user's data and returns the result back through the Internet.

In step a and step b, the base station and the SGW transmit some information of the mobile device to the MME, for example, location information, traffic information, and the like of the mobile device. The MME sends the received information to the HSS to update the information of the SIM card used by the mobile device.

In other networks, the above nodes will change, but the identity authentication process of the mobile device is on the server that manages all the SIM card information of the network. In the LTE network, the server is a Home Subscriber Server (HSS), and in other networks, other servers, such as a Home Location Register (HLR).

The SIM card used by some mobile devices may also include some preset programs, and the programming language of the preset program is a SIM tool kit (STK), so the functions of these preset programs are Called STK function. The mobile device can generate corresponding user data related to the STK function through these preset programs, for example, requesting to obtain a list of STK functions. The processing flow of this kind of user data is the same as the processing process of the normal user data, and the user data is sent to a server on the Internet for processing, and the feedback data is received through the Internet. Because the STK function is a program stored in the SIM card, the STK function is not much and simple because of the limitation of the SIM card capacity.

Referring to FIG. 2, it is an architectural diagram of a network system for implementing cloud identity authentication according to the present invention. The network system 1 for implementing cloud identity authentication includes, but is not limited to, a mobile network 10, an account database 11, an account authentication module 12, and a function module 13. The network system 1 that implements cloud identity authentication is in communication with the mobile device 2 and the Internet 3.

The mobile device 2 includes, but is not limited to, a communication device 21, a processor 22, a storage device 23, and an input device 24. The mobile device 2 does not include a SIM card, and the mobile device 2 may be a mobile phone, a tablet computer or the like that does not include a SIM card. The communication device 21 is used to communicate with the mobile network 10 Connected, it can be a radio frequency device or the like. The storage device 23 is configured to store configuration information (such as a call record, a phone book, etc.) of the virtual SIM card, and programs (such as encryption programs, etc.) and materials installed on the mobile device 2. The storage device 23 may be a memory of the mobile device 2, and may be an external storage device such as a smart media card (Flash Media Card) or a flash memory card (Flash Card). The input device 24 is for inputting data by a user. The input device 24 can be an input device such as a keyboard, a touch screen, or a microphone.

When the mobile device 2 is communicatively connected to the network system 1 for implementing cloud identity authentication via the communication device 21, the network system 1 implementing cloud identity authentication sends an identity authentication request to the mobile device 2. The mobile device 2 receives the account number and password input by the user through the input device 24, generates account authentication information according to the account and password input by the user, and transmits the account authentication information to the network system 1 for implementing cloud identity authentication through the communication device 21. The network system 1 for implementing cloud identity authentication first performs account authentication on the account in the account authentication information, and after authenticating through the account, authenticates the virtual SIM card bound to the account, and passes the identity authentication. The information of the virtual SIM card is fed back to the mobile device. The account entered by the user and the virtual SIM card bound to the account require the user to apply to the operator and be assigned by the operator.

The mobile network 10 includes, but is not limited to, a base station 101, a control module 102, a transmission module 103, and a mobile subscriber management module 104. The mobile network 10 may be a network of the LTE standard or a network of other standards. The mobile network 10 is configured to transmit the data of the mobile device 2 to the Internet 3 and the account authentication module 12. The data may be the account authentication information of the mobile device 2 or the user profile of the mobile device 2. The user profile may be a request for making a call, sending a text message, or accessing the Internet, or may be a request related to an account number and a SIM card.

The base station 101 is configured to forward the signaling of the mobile device 2 to the control module 102, forward the user data of the mobile device 2 to the transmission module 103, and forward the returned data to the mobile mobile device 2. The control module 102 is configured to process received signaling, such as assigning IP, SGW, and PGW to the mobile device 2. The control module 102 can be an MME in an LTE network, which can be in other networks. He controls the module. The transmission module 103 is configured to forward the user data of the mobile device 2 to the Internet 3, and forward the feedback data received from the Internet 3 to the base station 101. The transmission module 103 is an SGW and a PGW in the LTE network, and may be other transmission modules in other networks. The mobile user management module 104 is configured to manage information about all SIM cards (including virtual SIM cards) of the mobile network 10, such as authentication information, tariffs, and current location information of a certain SIM card. The mobile subscriber management module 104 is an HSS in the LTE network, and may be other devices, such as an HLR, in other networks.

The account database 11 is configured to store information of each account applied by the user to the operator and various information of the virtual SIM card bound to each account, such as a mobile subscriber identity, a location area identifier, a phone book, and an exclusive account. Information such as application information. When the user applies for an account to the operator, the operator binds the account with at least one virtual SIM card, and stores the account and the virtual SIM card information applied by the user into the account database 11. If the user applies for a dedicated application, the operator binds the user-applied application to the virtual SIM card.

Referring to FIG. 3, it is a schematic diagram of the account database 11. The account number and password in FIG. 3 are the account number and password in the account authentication information of the mobile device 2. The virtual SIM card information bound to the account can be determined according to the account number and password in the account authentication information of the mobile device 2. In the figure, the account bob245 is bound with two virtual SIM card information, indicating that the user has applied for two virtual SIM cards. The ICCID in FIG. 3 is an integrated circuit card identity, and the ICCID is a unique identification number of the virtual SIM card. IMSI is an International Mobile Subscriber Identification Number (IMSI) is an identifier that distinguishes mobile users. LOCI is location information, LOCI contains location area information and so on. The virtual SIM card information may also include information such as a phone number, a phone book, a call log, and a newsletter corresponding to the virtual SIM card.

The dedicated application information in Figure 3 includes a list of exclusive applications applied by the user, as well as information and materials of various customized applications applied by the user. The dedicated application may include a charging scheme for mobile communication, and may also include services such as call answering, stock trading, e-commerce, and STK functions. example For example, the exclusive application information of a stock transaction may include the number of shares held by the user and its quantity. The exclusive application information of e-commerce can include the user's phone number, address and purchase record. The dedicated application information of the STK function may include the path of the STK function in the function module 13.

The account authentication module 12 is communicatively coupled to the mobile network 10, the account database 11, the function module 13, and the Internet 3. The account authentication module 12 implements a communication connection with the mobile network 10 by communicating with the mobile user management module 104.

The account authentication module 12 is configured to communicate with the account database 11 when receiving the account authentication information of the mobile device 2, and determine whether the mobile device 2 passes the account authentication. And when the mobile device 2 passes the account authentication, the authentication information of the virtual SIM card bound to the account in the account authentication information is transmitted to the mobile network 10 for identity authentication. Specifically, the account authentication module 12 transmits the authentication information of the virtual SIM card to the mobile user management module 104 of the mobile network 10 for identity authentication.

The account authentication module 12 is further configured to receive a request related to an account or a SIM card sent by the mobile device 2 (for example, modifying an account password, modifying a virtual SIM card information, modifying a dedicated application information, or using a dedicated application, etc.) When the account database 11 and the function module 13 are called, the request is processed and the processing result is fed back.

The function module 13 is configured to store the code and data of each dedicated application, and can be called by the account authentication module 12 to process user data related to the dedicated application, and feed the processing result back to the account authentication mode. Group 12.

In this embodiment, the account database 11, the account authentication module 12, and the function module 13 are located on the same server, and the server is connected to the mobile user management module 104 of the mobile network 10, and also Internet 3 communication connection. The account database 11, the account authentication module 12, and the function module 13 can also be located on different servers.

Referring to FIG. 4, it is a flowchart of a preferred embodiment of a method for implementing cloud identity authentication according to the present invention. In this embodiment, the execution order of the steps in the flowchart shown in FIG. 4 may be changed according to different requirements, and some steps may be omitted.

When the mobile device 2 is in communication with the mobile network 10, the mobile network 10 sends a request for identity authentication to the mobile device 2 in step S401. Specifically, when the mobile device 2 is in communication connection with the base station 101 of the mobile network 10 via the communication device 21, the control module 102 of the mobile network 10 transmits a request for identity authentication to the mobile device 2 through the base station 101.

In step S402, the mobile device 2 sends the account authentication information to the mobile network 10. When receiving the identity authentication request of the mobile network 10, the mobile device 2 prompts the user to input an account number and a password, receives the account and password input by the user through the input device 24, and generates account authentication information through the processor 22. The account authentication information includes at least an account and a password input by the user. The account authentication information may further include a specific identification code, for example, a character of the character “UserIdentify” is added as an identifier in the header of the account authentication information.

In this embodiment, the account and password in the account authentication information are encrypted. The encryption method for each account can be the same or different. If all accounts are encrypted with a fixed encryption method (such as MD5). When the mobile device 2 logs in to different accounts, the account and password in the account authentication information sent by the mobile device 2 are encrypted in the fixed encryption mode (for example, MD5). If each account has a unique encryption method. When the mobile device 2 logs in to different accounts, the account and password in the account authentication information sent by the mobile device 2 are encrypted in an encryption manner unique to each account. For example, when the account A is logged in on the mobile device 2, the account and password in the account authentication information sent by the mobile device 2 are encrypted in the first encryption mode. When the account B is logged in on the mobile device 2, the account and password in the account authentication information sent by the mobile device 2 are encrypted in the second encryption mode. In other embodiments, the account and password in the account authentication information may also be an unencrypted account and password.

It should be noted that, if the account and the password in the account authentication information are encrypted, when the mobile device 2 logs in the account, the user needs to ensure that the mobile device 2 can perform encryption in a preset encryption manner. If the encryption method of each account is a fixed encryption method (for example, MD5), the storage device 23 needs to store a program that can implement the encryption method. If each account has a unique encryption method, the storage device 23 needs to store a program that can implement an encryption method unique to the account to be logged in.

Step S403, when the mobile network 10 receives the account authentication information sent by the mobile device 2, the mobile network 10 transmits the received account authentication information to the account authentication module 12.

In this embodiment, the mobile network 10 directly transmits the account authentication information of the mobile device 2 to the account authentication module 12. Specifically, when the base station 101 receives the account authentication information sent by the mobile device 2, the mobile network 10 controls the base station 101 to transmit the account authentication information of the mobile device 2 to the account authentication mode through the control module 102 and the mobile user management module 104. Group 12. In other embodiments, the mobile network 10 can also transmit the account authentication information of the mobile device 2 to the account authentication module 12 via the Internet 3. Specifically, when the base station 101 receives the account authentication information sent by the mobile device 2, the mobile network 10 controls the base station 101 to transmit the account authentication information of the mobile device 2 to the account authentication module 12 through the transmission module 103 and the Internet 3.

Step S404, after the account authentication module 12 receives the account authentication information sent by the mobile device 2, the account authentication module 12 determines whether the mobile device 2 passes the account authentication. If the mobile device 2 fails to pass the account authentication, step S405 is performed; if the mobile device 2 passes the account authentication, step S406 is performed.

The account authentication module 12 is communicatively coupled to the account database 11. If the account and password in the account authentication information sent by the mobile device 2 are the same as the account and password in the account database 11, the account authentication module 12 determines that the mobile device 2 passes the account authentication.

It should be noted that, if the account and password in the account authentication information are a fixed encryption method or an account and password encrypted by the encryption method unique to each account, the account and password stored in the corresponding account database 11 It is also an account and password encrypted by the fixed encryption method or the encryption method unique to each account. If the account and password in the account authentication information are unencrypted accounts and passwords, the account database 11 stores the unencrypted account and password.

If the mobile device 2 fails to pass the account authentication, in step S405, the account authentication module 12 transmits the message of the account authentication failure to the mobile device 2 via the mobile network 10, and returns to step S402 to re-enter the account. When the mobile device 2 fails to pass the account authentication, the account authentication module 12 also records the number of consecutive authentication failures of the account in the account authentication information, and when the continuous authentication failure of the account exceeds a preset number of times (for example, five times) , lock the account. The account authentication module 12 locks the account by modifying the data in the account database 11. Users cannot use an account that is already locked. Users need to apply to the operator to unlock the account.

If the mobile device 2 is authenticated by the account, in step S406, the account authentication module 12 sends the authentication information of the virtual SIM card bound to the account in the account authentication information to the mobile network 10 for identity authentication, and step S407 is performed. Specifically, the account authentication module 12 sends the authentication information of the virtual SIM card bound to the account in the account authentication information to the mobile user management module 104 of the mobile network 10 to verify the identity of the virtual SIM card. It should be noted that, when the account in the account authentication information is bound to more than one virtual SIM card, the authentication information sent by the account authentication module 12 may be the authentication information of all virtual SIM cards bound to the account. It can also be the authentication information of one or multiple virtual SIM cards bound to the account.

In this embodiment, if the account in the account authentication information sent by the mobile device 2 is bound with more than one virtual SIM card, the account authentication module 12 will authenticate the authentication information of all the virtual SIM cards bound to the account. Both are sent to the mobile subscriber management module 104 of the mobile network 10 for identity authentication.

In another embodiment, if the account in the account authentication information sent by the mobile device 2 is bound to more than one virtual SIM card, the account authentication module 12 moves the list of virtual SIM cards bound to the account through the mobile device. The network 10 is sent to the mobile device 2 for selection by the user of the mobile device 2. When the user selects one or more virtual SIM cards, the mobile device 2 transmits the result of the user selection to the account authentication module 12 via the mobile network 10. When receiving one or multiple virtual SIM cards selected by the user, the account authentication module 12 transmits the authentication information of one or more virtual SIM cards selected by the user to the mobile user management module 104 of the mobile network 10 for identity authentication.

For example, the account A in the account database 11 is bound to two virtual SIM cards: SIM card 1 and SIM card 2. When the account and password sent by the mobile device 2 are the same as the account and password of the account A, the account authentication module 12 will The information of the SIM card 1 and the SIM card 2 (for example, a telephone number) is transmitted to the mobile device 2 via the mobile network 10 for selection by the user of the mobile device 2. The user can select SIM card 1 or SIM card 2. The user can also select SIM card 1 and SIM card 2 at the same time.

If the user selects the SIM card 2, the mobile device 2 transmits the result of the user selection to the account authentication module 12 via the mobile network 10. The account authentication module 12 transmits the authentication information of the SIM card 2 to the mobile user management module 104 of the mobile network 10 for identity authentication.

Step S407, the mobile network 10 determines, according to the authentication information of the received virtual SIM card, whether the mobile device 2 passes the identity authentication. If the mobile device 2 does not pass the identity authentication, step S408 is performed; if the mobile device 2 passes the identity authentication, step S409 is performed. Specifically, the mobile user management module 104 of the mobile network 10 determines whether the received virtual SIM card passes the identity authentication.

In this embodiment, when the account in the account authentication information sent by the mobile device 2 is bound with more than one virtual SIM card, the account authentication module 12 will authenticate the authentication information of all the virtual SIM cards bound to the account. Both are sent to the mobile network 10 for identity authentication. If at least one of the virtual SIM cards passes the identity authentication, the mobile network 10 determines that the mobile device 2 passes the identity authentication, and performs step S409. If all the virtual SIM cards bound to the account are not authenticated, the mobile network 10 determines that the mobile device 2 has not passed the identity authentication, and performs step S408.

In another embodiment, when the account in the account authentication information sent by the mobile device 2 is bound with more than one virtual SIM card, the account authentication module 12 prompts the user to select one or multiple virtual SIM cards for identity authentication. If at least one of the one or more virtual SIM cards passes the identity authentication, the mobile network 10 determines that the mobile device 2 passes the identity authentication, and performs step S409. If the one or more virtual SIM cards are not authenticated, the mobile network 10 prompts the user to select another virtual SIM card to re-authenticate. If all the virtual SIM cards bound to the account are not authenticated, the mobile network 10 determines that the mobile device 2 has not passed the identity authentication, and performs step S408.

When the mobile device 2 fails the identity authentication, in step S408, the mobile network 10 transmits the information of the identity authentication failure to the mobile device 2, and returns to step S402 to re-enter the account.

When the mobile device 2 passes the identity authentication, in step S409, the mobile network 10 transmits the information of the virtual SIM card authenticated by the identity to the mobile device 2, and step S410 is performed. For example, the SIM card 3 passes the identity authentication or both the SIM card 1 and the SIM card 3 pass the identity authentication.

In step S410, the mobile device 2 acquires the configuration information of the virtual SIM card that has passed the identity authentication through the communication device 21, and updates the configuration information in the storage device 23 of the mobile device 2 according to the acquired configuration information, and the process ends.

Specifically, after the mobile device 2 passes the identity authentication, the mobile network 10 sends the information of the authenticated virtual SIM card to the account authentication module 12, and the account authentication module 12 automatically obtains the account database. Obtaining the configuration information of the authenticated virtual SIM card in 11 and feeding back the configuration information to the mobile device 2 through the mobile network 10, or feeding the configuration information to the mobile device 2 through the Internet 3 and the mobile network 10 . The mobile device 2 acquires the configuration information of the virtual SIM card that is authenticated by the communication device 21, and updates the configuration information in the storage device 23 of the mobile device 2 according to the acquired configuration information. The configuration information may be obtained from the virtual SIM card information and the dedicated application resource of FIG. News. That is, the configuration information may be a subset of the virtual SIM card information and the dedicated application information.

For example, the user logs in the account A on the mobile device m and deletes the contact person S of the virtual SIM card 1 to which it is bound. When the user logs in to the account A on the mobile device n and passes the identity authentication, the mobile device n automatically acquires the configuration information of the authenticated virtual SIM card, including the phone book of the virtual SIM card 1 (excluding the contact person S). The mobile device n updates the configuration information in its storage device, such as updating the phone book.

Referring to FIG. 5, it is a flowchart of a process of processing user data of a preferred embodiment of the method for implementing cloud identity authentication according to the present invention. In this embodiment, the execution order of the steps in the flowchart shown in FIG. 5 may be changed according to different requirements, and some steps may be omitted.

After the mobile device 2 passes the identity authentication, in step S501, the mobile device 2 generates a user profile according to the user's operation, and transmits the user profile to the mobile network 10. The mobile device 2 receives the user's operation through the input device 24, and generates the user profile through the processor 22. The user profile may be a request for making a call, sending a text message, or accessing the Internet, or may be a request related to an account number and a SIM card, such as modifying an account password, modifying a virtual SIM card information, modifying a dedicated application information, or using an exclusiveization. Application and other requests.

After receiving the user profile sent by the mobile device 2, in step S502, the mobile network 10 determines whether the user profile is a request related to the account number and the SIM card. If the user profile is not a request related to the account and the SIM card, step S503 is performed; if the user profile is a request related to the account and the SIM card, step S505 is performed.

When the user profile is not a request related to the account and the SIM card, in step S503, the mobile network 10 transmits the user profile to the Internet 3, and step S504 is performed. Specifically, the mobile network 10 sends the user profile to the relevant server on the Internet 3 for processing.

In step S504, the Internet 3 returns the processing result to the mobile network 10, and performs step S507. Specifically, the related server on the Internet 3 processes the data according to the user data, and feeds the processing result to the mobile network 10 through the Internet 3.

When the user profile is a request related to the account and the SIM card, in step S505, the mobile network 10 sends the user profile to the account authentication module 12, and step S506 is performed.

In step S506, the account authentication module 12 calls the account database 11 and the function module 13 to process the user data, and returns the processing result to the mobile network 10.

Specifically, the account authentication module 12 determines whether the user profile is a request related to a dedicated application. If the user profile is not a request related to the dedicated application (for example, modifying the account password or modifying the virtual SIM card information, etc.), the account authentication module 12 calls the account database 11 to process the user profile. If the user profile is a request related to the dedicated application, the account authentication module 12 obtains the information of the dedicated application through the account database 11, and the calling function module 13 according to the user profile and the The application information is processed and the account authentication module 12 obtains the processing result from the function module 13.

In step S507, the mobile network 10 feeds back the processing result to the mobile device 2.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to be limiting, and those skilled in the art should understand that the technical solutions of the present invention may be modified or equivalently substituted without departing from the techniques of the present invention. The spirit and scope of the programme.

1‧‧‧Network system for cloud identity authentication

10‧‧‧Mobile network

101‧‧‧ base station

102‧‧‧Control Module

103‧‧‧Transmission module

104‧‧‧Mobile User Management Module

11‧‧‧ Account Database

12‧‧‧Account Authentication Module

13‧‧‧ functional modules

2‧‧‧Mobile devices

21‧‧‧Communication device

22‧‧‧ Processor

23‧‧‧Storage device

24‧‧‧ Input device

3‧‧‧Internet

Claims (15)

A network system for implementing cloud identity authentication, the network system includes a mobile network, the network system further includes: an account database for storing information of an account applied by the user and at least one virtual SIM bound to each account The card authentication information is used to receive the account authentication information sent by the mobile device through the mobile network, and determine whether the mobile device passes the account authentication according to the received account authentication information and the account database; the account authentication The module is further configured to: when the mobile device passes the account authentication, send, to the mobile network, authentication information of the virtual SIM card bound by the account in the account authentication information sent by the mobile device; a network, configured to determine, according to the authentication information of the received virtual SIM card, whether the mobile device passes the identity authentication, where the account authentication module sends the authentication information of all the virtual SIM cards bound to the account to the The mobile network, when at least one of all virtual SIM cards bound to the account is authenticated by the identity, the mobile network judges The mobile device is authenticated by the identity; the mobile network is further configured to: when the mobile device passes the identity authentication, feed back information of the successfully authenticated virtual SIM card to the mobile device; and the account authentication module And obtaining, after the mobile device is authenticated by the identity, the configuration information of the virtual SIM card that is authenticated by the identity is obtained from the account database, and the configuration information is fed back to the mobile device, where the mobile device obtains The configuration information updates the stored configuration information. The network system for implementing cloud identity authentication, as described in claim 1, wherein the network system for implementing cloud identity authentication further includes: a function module, configured to store code and data of each dedicated application, and receive the user data from the account authentication module when the user data sent by the mobile device is a request related to the dedicated application, and The processing result is fed back to the account authentication module. The network system for implementing cloud identity authentication according to claim 1, wherein when the account in the account authentication information is bound to more than one virtual SIM card, the account authentication module is bound to the account. The list of virtual SIM cards is sent to the mobile device for selection by the user of the mobile device, and the account authentication module receives the one or more virtual SIMs upon receiving one or multiple virtual SIM cards selected by the user of the mobile device The authentication information of the card is sent to the mobile network. When at least one of the one or more virtual SIM cards is authenticated by the identity, the mobile network determines that the mobile device passes the identity authentication. The network system for implementing cloud identity authentication according to claim 1, wherein the account authentication information includes an account number and a password, and the account and password are encrypted in a fixed encryption manner or are encrypted by the account. Encrypt. The network authentication system for implementing cloud identity authentication according to claim 1, wherein the account authentication module is further configured to: when the mobile device fails to pass the account authentication, send a message that the account authentication fails to the mobile network. The road is transmitted to the mobile device. The network system for implementing cloud identity authentication according to any one of claims 1 to 5, wherein the mobile device does not include a SIM card. A method for implementing cloud identity authentication, the method comprising: receiving, by a mobile network, account authentication information sent by a mobile device, and transmitting the account authentication information to an account authentication module; the account authentication module is authenticated according to the account The information and the account database determine whether the mobile device is authenticated by the account, and the account database stores information about the account applied by the user and various information of at least one virtual SIM card bound to each account; When the mobile device is authenticated by the account, the account authentication module sends the authentication information of the virtual SIM card bound to the account in the account authentication information sent by the mobile device to the mobile network for identity authentication; Determining, by the mobile network, whether the mobile device passes the identity authentication according to the authentication information of the received virtual SIM card, where the authentication information of all the virtual SIM cards bound to the account is sent to the mobile network, When at least one of all virtual SIM cards bound by the account is authenticated, the mobile network determines that the mobile device passes identity authentication; when the mobile device passes identity authentication, the mobile network authenticates The information of the successful virtual SIM card is fed back to the mobile device; and after the mobile device passes the identity authentication, the configuration information of the virtual SIM card authenticated by the identity is obtained from the account database, and the configuration information is obtained. The device is fed back to the mobile device, and the mobile device updates the stored configuration information according to the acquired configuration information. The method for implementing cloud identity authentication according to claim 7, wherein the method further comprises: when the mobile network receives the user profile sent by the mobile device, the mobile network determines whether the user profile is The account and the SIM card related request; when the user profile is a request related to the account and the SIM card, the user profile is sent to the account authentication module; the account authentication module calls the account database to process the user profile And feeding back the processing result to the mobile network; and the mobile network returns the processing result to the mobile device. The method for implementing cloud identity authentication according to claim 7, wherein the method further includes: when the account in the account authentication information is bound to more than one virtual SIM card, the account is The authentication module sends the list of virtual SIM cards bound to the account to the mobile device for selection by the user of the mobile device, and the account authentication module receives one or multiple virtual SIM cards selected by the user of the mobile device. Sending, by the mobile network, the authentication information of the one or more virtual SIM cards to the mobile network, and when at least one of the one or more virtual SIM cards is authenticated by the identity, the mobile network determines that the mobile device passes the Authentication. The method for implementing cloud identity authentication according to claim 7, wherein the account authentication information includes an account number and a password, and the account and password are encrypted in a fixed encryption manner or encrypted by using an encryption method unique to the account. . The method for implementing cloud identity authentication according to claim 7, wherein the method further comprises: when the mobile device fails to pass the account authentication, transmitting a message that the account authentication fails to the mobile device by using the mobile network. The method for implementing cloud identity authentication according to any one of claims 7 to 11, wherein the mobile device does not include a SIM card. A mobile device for implementing cloud identity authentication, the mobile device comprising: a communication device for performing communication; a storage device for storing configuration information of the virtual SIM card; a processor for implementing cloud identity authentication, the processor executing The following steps are: when receiving the identity authentication request through the communication device, generating account authentication information according to the account and password input by the user, the account is bound to at least one virtual SIM card; sending the account authentication information for account authentication and performing the An identity authentication of the at least one virtual SIM card to which the account is bound, wherein when at least one of all the virtual SIM cards bound to the account is authenticated by the identity, the mobile network determines that the mobile device passes the identity authentication; Receiving information of the virtual SIM card that passes the identity authentication when the identity is authenticated; and after the identity authentication, the mobile device obtains configuration information of the virtual SIM card that is authenticated by the communication device, and according to the obtained configuration information. Updating configuration information in the storage device. The mobile device for implementing cloud identity authentication according to claim 13, wherein the account authentication information includes an account number and a password, and the account and password may be encrypted by a fixed encryption method or may be encrypted by the account uniquely. The way to encrypt. The mobile device implementing cloud identity authentication according to any one of claims 13 to 14, wherein the mobile device does not include a SIM card.