WO2018219181A1 - 确定终端设备的标识的方法和装置 - Google Patents

确定终端设备的标识的方法和装置 Download PDF

Info

Publication number
WO2018219181A1
WO2018219181A1 PCT/CN2018/087935 CN2018087935W WO2018219181A1 WO 2018219181 A1 WO2018219181 A1 WO 2018219181A1 CN 2018087935 W CN2018087935 W CN 2018087935W WO 2018219181 A1 WO2018219181 A1 WO 2018219181A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
server
communication system
terminal device
consensus node
Prior art date
Application number
PCT/CN2018/087935
Other languages
English (en)
French (fr)
Inventor
吴义镇
黄亚达
黄敏
关贺
梅岭
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018219181A1 publication Critical patent/WO2018219181A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data
    • H04W8/245—Transfer of terminal data from a network towards a terminal

Definitions

  • the present application relates to the field of communications and, more particularly, to a method and apparatus for determining an identity of a terminal device.
  • the terminal device When the terminal device communicates in the network, it is necessary to use an identifier capable of indicating the identity of the terminal device in the network (hereinafter, referred to as "identity" for ease of understanding and distinction).
  • identity an identifier capable of indicating the identity of the terminal device in the network
  • the network side device when the terminal device enters the network (for example, access is attached), the network side device performs operations such as authentication, authentication, and key agreement on the terminal device according to the identity identifier of the terminal device.
  • the identity identifier is distributed and managed by the operator of the network. For example, when the user of the terminal device completes the contract with the operator of the network, the identity of the terminal device is burned at the terminal. In the device, for example, the identity of the terminal device is burned in the Universal Subscriber Identity Module (USIM) of the terminal device.
  • USIM Universal Subscriber Identity Module
  • the user before using the terminal device for communication, the user must obtain the identity identifier assigned by the operator for the terminal device, which affects the user experience.
  • the present application provides a method and apparatus for determining an identity of a terminal device, which can improve the user experience and reduce the burden and cost of the operator's allocation and management of the identity of the terminal device in the communication system.
  • a method for determining an identity of a terminal device is provided, which is performed in a communication system including at least two consensus nodes, the method comprising: the first consensus node receiving a first identity from the first server, wherein the first a server is a server of a manufacturer of the first terminal device; the first consensus node and the at least one second consensus node perform negotiation for the first identifier to determine whether the first identifier can be used as the first terminal device in the communication The device ID (or identity) in the system.
  • a method for determining an identity of a terminal device determines a first identity by a server of a manufacturer of the first terminal device, and transmits the first identifier to at least one consensus node in the communication system, and is configured by the communication system
  • the at least two consensus nodes negotiate to determine whether the first identifier can be used as the identity of the first terminal device, and can prevent the user from obtaining the identity identifier for the terminal device, thereby improving the user experience, and since the first identifier is
  • the manufacturer's server determines that it can reduce the burden and cost of the operator's assignment and management of the identity.
  • the first consensus node is a server of an operator of a network used by the communication system.
  • the negotiation process for the identity of the first terminal device in the communication system can be performed for the first identity device, so that the operator can participate in the authentication process for the identity identifier, which is convenient for the operator to Network management to improve the security of the network.
  • the first consensus node is an access network device (eg, a base station) or a core network device in the communication system.
  • an access network device eg, a base station
  • a core network device in the communication system.
  • the communication system is a system that stores data based on a block chain technique.
  • the at least two consensus nodes store data based on a blockchain technique.
  • the at least two consensus nodes are consensus nodes in the blockchain system.
  • the first consensus node and the at least one second consensus node perform the negotiation for the first identifier, including: the first consensus node is based on the blockchain technology, and the at least one second consensus node performs the first Negotiation of the logo.
  • the identification, verification, and storage process of the identity identification can be easily implemented by applying the blockchain technology to the method for determining the identity of the terminal device in the embodiment of the present invention.
  • the first consensus node and the at least one consensus node perform the negotiation for the first identifier, where the first consensus node verifies the first identifier according to the at least one second identifier, the at least one second The identifier is determined after negotiation by at least two consensus nodes, the at least one second identifier is allocated to the at least one second terminal device, wherein the verification is performed if the first identifier does not belong to the at least one second identifier.
  • the result is that the first identifier can be used as the device identifier of the terminal device in the communication system, and the first identifier belongs to the at least one second identifier, and the result of the verification is that the first identifier cannot be used as the terminal device in the communication system.
  • the device identifier in the first consensus node performs negotiation with the at least one second consensus node for the first identifier according to the result of the verification.
  • the first identifier can be avoided as the identity of the different terminal device at the same time, thereby avoiding communication errors, improving the security and reliability of the communication, and further improving the user experience.
  • the second consensus node does not support the first identifier as a device identifier of the terminal device in the communication system; and the first identifier does not belong to the at least In the case of a second identity, the second consensus node supports the first identity as the device identity of the terminal device in the communication system.
  • the first consensus node and the at least one second consensus node perform a negotiation for the first identifier to determine whether the first identifier can be used as a device identifier of the first terminal device in the communication system, including: The first consensus node determines that the number of the consensus nodes that the first identifier can support as the device identifier of the first terminal device in the communication system is greater than or equal to a preset first threshold value. The first identifier can be used as the device identifier of the first terminal device in the communication system.
  • the first consensus node and the at least one second consensus node perform a negotiation for the first identifier to determine whether the first identifier can be used as a device identifier of the first terminal device in the communication system, including: And determining, by the first consensus node, that the proportion of the consensus identifier of the device identifier that is the first terminal device in the communication system is greater than or equal to a preset second threshold value The first identifier can be used as the device identifier of the first terminal device in the communication system.
  • the first consensus node and the at least one second consensus node perform a negotiation for the first identifier to determine whether the first identifier can be used as a device identifier of the first terminal device in the communication system, including: The first consensus node determines that the number of the consensus nodes that can be used as the device identifier of the first terminal device in the communication system is greater than or equal to the preset third threshold value. The first identifier cannot be used as the device identifier of the first terminal device in the communication system.
  • the first consensus node and the at least one second consensus node perform a negotiation for the first identifier to determine whether the first identifier can be used as a device identifier of the first terminal device in the communication system, including: The first consensus node determines that the proportion of the consensus node that can be used as the device identifier of the first terminal device in the communication system is greater than or equal to a preset fourth threshold value. The first identifier cannot be used as the device identifier of the first terminal device in the communication system.
  • the first consensus node receives the first identifier from the first server, where the first consensus node receives registration information from the first server, where the registration information is that the second server is configured according to the first encryption information.
  • An identifier is generated after the encryption process is performed; the first consensus node decrypts the registration information according to the first decryption information to obtain the first identifier, where the first decryption information corresponds to the first encrypted information,
  • the first server is a consensus node in the communication system, and the first decryption information is decryption information used by the consensus node other than the first server in the communication system to communicate with the first server.
  • the encryption process is a signature process
  • the decryption process is a verification process
  • the security of information transmission between the first server and the first consensus node can be improved.
  • the first encryption information is a private key used by the first server
  • the first decryption information is a public key used by the first server
  • the first decryption information is an identifier of the first server.
  • the registration information is generated by the second server encrypting the first identifier and the public key used by the first terminal device according to the first encryption information.
  • the first consensus node can obtain the public key used by the first terminal device, so that the access network device or the core network device managed by the first consensus node does not need to initiate authentication when authenticating the first terminal device.
  • the process of obtaining a public key thereby saving signaling overhead.
  • the method further includes: sending, by the first consensus node, the response information to the first server, where the response information is used to indicate whether the first identifier is a device identifier of the first terminal device in the communication system.
  • the first server can be reliably determined whether the first identifier can be used as the device identifier of the first terminal device in the communication system, thereby improving the efficiency and reliability of the method for determining the identifier of the terminal device in the embodiment of the present invention.
  • the at least one second consensus node comprises an access network device in the communication system, a core network device in the communication system, a server of an application service provider, and at least one device in the first server.
  • a method for determining an identity of a terminal device is provided, which is performed in a communication system including at least two consensus nodes, the method comprising: the first server determining the first identity, wherein the first server is the first a server of a manufacturer of the terminal device; the first server sends the first identifier to the at least one first consensus node, so that at least two consensus nodes including the at least one first consensus node perform the first identifier for the first identifier Negotiation to determine whether the first identifier can be used as the device identifier of the first terminal device in the communication system.
  • a method for determining an identity of a terminal device determines a first identity by a server of a manufacturer of the first terminal device, and transmits the first identifier to at least one consensus node in the communication system, and is configured by the communication system
  • the at least two consensus nodes negotiate to determine whether the first identifier can be used as the identity of the first terminal device, and can prevent the user from obtaining the identity identifier for the terminal device, thereby improving the user experience, and since the first identifier is
  • the manufacturer's server determines that it can reduce the burden and cost of the operator's assignment and management of the identity.
  • the first consensus node is a server of an operator of a network used by the communication system.
  • the negotiation process for the identity of the first terminal device in the communication system can be performed for the first identity device, so that the operator can participate in the authentication process for the identity identifier, which is convenient for the operator to Network management to improve the security of the network.
  • the first consensus node is an access network device (eg, a base station) or a core network device in the communication system.
  • an access network device eg, a base station
  • a core network device in the communication system.
  • the communication system is a system that stores data based on a block chain technique.
  • the at least two consensus nodes store data based on a blockchain technique.
  • the at least two consensus nodes are consensus nodes in the blockchain system.
  • the first server is a consensus node in the communication system, and the method further includes: the first server and the at least one consensus node including the first node perform negotiation for the first identifier.
  • the first server performs negotiation for the first identifier with at least one consensus node including the first node: the first server is based on a blockchain technology and at least one including the first node The consensus node performs a negotiation for the first identity.
  • the identification, verification, and storage process of the identity identification can be easily implemented by applying the blockchain technology to the method for determining the identity of the terminal device in the embodiment of the present invention.
  • the first server performs the negotiation for the first identifier with the at least one consensus node that includes the first node, where the first server verifies the first identifier according to the at least one second identifier.
  • the at least one second identifier is determined after negotiation by the at least two consensus nodes, the at least one second identifier is allocated to the at least one second terminal device, where the first identifier does not belong to the at least one second identifier.
  • the result of the verification is that the first identifier can be used as the device identifier of the terminal device in the communication system, and the first identifier belongs to the at least one second identifier, and the result of the verification is that the first identifier cannot be used as the terminal.
  • the device identifier of the device in the communication system the first server performs negotiation for the first identifier with at least one consensus node including the first node according to the result of the verification.
  • the first identifier can be avoided as the identity of the different terminal device at the same time, thereby avoiding communication errors, improving the security and reliability of the communication, and further improving the user experience.
  • the at least one consensus node including the first node does not support the first identifier as a device identifier of the terminal device in the communication system; And the at least one consensus node including the first node supports the first identifier as a device identifier of the terminal device in the communication system if the first identifier does not belong to the at least one second identifier
  • the first server and the at least one consensus node including the first node perform the negotiation for the first identifier, including: supporting the first identifier in the at least two consensus nodes that are negotiated as the first
  • the first server determines that the first identifier can be used as the device identifier of the first terminal device in the communication system.
  • the first server and the at least one consensus node including the first node perform the negotiation for the first identifier, including: supporting the first identifier in the at least two consensus nodes that are negotiated as the first
  • the first server determines that the first identifier can be used as the device identifier of the first terminal device in the communication system.
  • the first server and the at least one consensus node including the first node perform negotiation for the first identifier, including: when the at least two consensus nodes that perform negotiation do not support the first identifier, the first identifier can be used as the first When the number of the consensus nodes of the device identifier in the communication system is greater than or equal to the preset third threshold, the first server determines that the first identifier cannot be used as the device identifier of the first terminal device in the communication system. .
  • the first server and the at least one consensus node including the first node perform negotiation for the first identifier, including: when the at least two consensus nodes that perform negotiation do not support the first identifier, the first identifier can be used as the first When the proportion of the consensus node of the device identifier in the communication system is greater than or equal to the preset fourth threshold, the first server determines that the first identifier cannot be used as the device identifier of the first terminal device in the communication system. .
  • the first server sends the first identifier to the at least one first consensus node, including: the first server encrypts the first identifier according to the first encryption information, to generate registration information, where the first An encrypted information corresponding to the first decrypted information, the first decrypted information is decryption information used by the consensus node other than the first server in the communication system to communicate with the first server; the first server is at least one The first consensus node sends the registration information.
  • the encryption process is a signature process
  • the decryption process is a verification process
  • the security of information transmission between the first server and the first consensus node can be improved.
  • the first encryption information is a private key used by the first server
  • the first decryption information is a public key used by the first server
  • the first decryption information is an identifier of the first server.
  • the first server encrypts the first identifier according to the first encryption information, and the first server encrypts the first identifier and the public key used by the first terminal device according to the first encryption information. deal with.
  • the first consensus node can obtain the public key used by the first terminal device, so that when the first terminal device performs the network managed by the first consensus node, the process of acquiring the public key does not need to be initiated, thereby saving the letter. Make the cost.
  • the determining, by the first server, the first identifier includes: determining, by the first server, the first identifier according to the at least one second identifier, so that the first identifier is different from each of the at least one second identifier, The at least one second identifier is determined after negotiation by at least two consensus nodes, and the at least one second identifier is allocated to the at least one second terminal device.
  • the first identifier can be avoided as the identity of the different terminal device at the same time, thereby avoiding communication errors, improving the security and reliability of the communication, and further improving the user experience.
  • the at least one first consensus node includes the at least one first consensus node including an access network device in the communication system, a core network device in the communication system, a server of an application service provider, and a network used by the communication system. At least one device in the carrier's server.
  • an apparatus for determining an identity of a terminal device comprising means for performing the steps of the method of determining the identity of the terminal device in the first aspect and the implementations of the first aspect.
  • an apparatus for determining an identity of a terminal device comprising means for performing the steps of the method for determining the identity of the terminal device in the second aspect and the implementations of the second aspect.
  • a device for determining an identity of a terminal device having a function of implementing the behavior of the first consensus node in the first aspect and the implementations of the first aspect.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a device for determining an identity of a terminal device having a function of implementing the behavior of the first server in each of the second aspect and the second aspect.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a server comprising a processor.
  • the processor is configured to support a server to perform the first aspect and corresponding functions of the various implementations of the first aspect.
  • the server may further include a transceiver for supporting the server to receive or transmit information.
  • the server may also include a memory for coupling with the processor to store the necessary program instructions and data for the server.
  • the server includes a memory and a processor for storing a computer program for calling and running the computer program from the memory, such that the server performs any of the first aspect described above and various implementations thereof A method of determining an identity of a terminal device.
  • a server comprising a processor.
  • the processor is configured to support a server to perform the second aspect and corresponding functions of the implementations of the second aspect.
  • the server may further include a transceiver for supporting the server to receive or transmit information.
  • the server may also include a memory for coupling with the processor to store the necessary program instructions and data for the server.
  • the server includes a memory and a processor for storing a computer program for calling and running the computer program from the memory, such that the server performs any of the second aspect described above and various implementations thereof. A method of determining an identity of a terminal device.
  • a computer program product comprising: computer program code for causing execution of a server when the computer program code is executed by a processing unit, a communication unit or a processor of the server, and a transceiver A method of determining an identity of a terminal device in any of the above first aspects and various implementations thereof.
  • a computer program product comprising: computer program code for causing execution of a server when the computer program code is executed by a processing unit, a communication unit or a processor of the server, and a transceiver A method of determining an identity of a terminal device in any of the above second aspects and various implementations thereof.
  • a computer readable storage medium storing a program, the program causing a server to perform any one of the first aspect and various implementations thereof to determine a terminal device The method of identification.
  • the computer readable storage medium is for storing computer software instructions for use in the server described above, comprising a program designed to perform the method of the first aspect described above.
  • a twelfth aspect a computer readable storage medium storing a program, the program causing a server to perform any one of the second aspect and various implementations thereof to determine a terminal device The method of identification.
  • the computer readable storage medium is for storing computer software instructions for use by the server, comprising a program designed to perform the method of the second aspect above
  • a chip system comprising a processor for supporting a server to implement the functions involved in the first aspect, for example, receiving a first identifier from a first server, and at least one The second consensus node performs negotiation for the first identifier to determine whether the first identifier can be used as the device identifier of the first terminal device in the communication system.
  • the chip system further includes a memory for storing necessary program instructions and data of the server.
  • a chip system comprising a processor for supporting a server to implement the functions involved in the first aspect, for example, receiving a first identifier from a first server, and at least one The second consensus node performs negotiation for the first identifier to determine whether the first identifier can be used as the device identifier of the first terminal device in the communication system.
  • the chip system further includes a memory for storing necessary program instructions and data of the server.
  • FIG. 1 is a schematic diagram showing an example of a communication system of a method and apparatus for determining an identity of a terminal device according to an embodiment of the present invention.
  • Fig. 2 is a schematic diagram showing another example of the communication system of the embodiment of the invention.
  • Fig. 3 is a schematic diagram showing still another example of the communication system of the embodiment of the invention.
  • FIG. 4 is a schematic diagram of a registration process of a consensus node in an embodiment of the invention.
  • FIG. 5 is a schematic interaction diagram of a method for determining an identity of a terminal device according to an embodiment of the present invention.
  • FIG. 6 is a schematic interaction diagram of a network access process of a terminal device to which an embodiment of the present invention is applied.
  • FIG. 7 is a schematic block diagram showing an example of an apparatus for determining an identifier of a terminal device according to an embodiment of the present invention.
  • FIG. 8 is a schematic block diagram of another example of an apparatus for determining an identifier of a terminal device according to an embodiment of the present invention.
  • the method for determining the identifier of the terminal device may be applied to a computer, where the computer includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and a memory (also referred to as main memory).
  • CPU central processing unit
  • MMU memory management unit
  • main memory also referred to as main memory
  • the operating system may be any one or more computer operating systems that implement business processing through a process, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a Windows operating system.
  • the application layer includes applications such as browsers, contacts, word processing software, and instant messaging software.
  • the embodiment of the present invention does not specifically limit the specific structure of the execution body of the method provided by the embodiment of the present invention, as long as it can be provided according to the embodiment of the present invention by running a program for recording the code of the method provided by the embodiment of the present invention.
  • the method can be communicated.
  • the execution body of the method provided by the embodiment of the present invention may be a computer device or a functional module of the computer device capable of calling a program and executing the program.
  • the computer device may be a handheld device such as a smart phone, or may be a terminal device such as a personal computer, or the computer may be a server.
  • the program for recording the code of the method for determining the identity of the terminal device according to the embodiment of the present invention is used to determine the identity of the terminal device in the network according to the method for determining the identity of the terminal device according to the embodiment of the present invention.
  • the server also called the server, is a device that provides computing services. Since the server needs to respond to service requests and process them, the server should generally have the ability to take on the service and secure the service.
  • the server consists of a processor, a hard disk, a memory, a system bus, etc., similar to a general-purpose computer architecture, but because of the need to provide highly reliable services, processing power, stability, reliability, security, scalability, and Management and other aspects are more demanding.
  • the execution body of the path detection in the embodiment of the present invention may be a computer device or a functional module in the computer device capable of calling a program and executing the program.
  • the term "article of manufacture” as used in this application encompasses a computer program accessible from any computer-readable device, carrier, or media.
  • the computer readable medium may include, but is not limited to, a magnetic storage device (eg, a hard disk, a floppy disk, or a magnetic tape, etc.), such as a compact disc (CD), a digital versatile disc (Digital Versatile Disc, DVD). Etc.), smart cards and flash memory devices (eg, Erasable Programmable Read-Only Memory (EPROM), cards, sticks or key drivers, etc.).
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, without limitation, a wireless channel and various other mediums capable of storing, containing, and/or carrying instructions and/or data.
  • the communication system 100 includes an architecture for implementing communication of the terminal device (hereinafter, for ease of understanding and explanation, it is referred to as: Architecture #1).
  • the communication system 100 includes a layer for performing an identification of a terminal device used in the communication system 100 (or a network used by the communication system 100) (hereinafter, referred to as an identity for ease of understanding and explanation).
  • the architecture (below, for ease of understanding and explanation, is noted as: Architecture #2).
  • the communication system 100 includes an access network device 102, which may include one antenna or multiple antennas such as antennas 104, 106, 108, 110, 112, and 114.
  • access network device 102 may additionally include a transmitter chain and a receiver chain, as will be understood by those of ordinary skill in the art, which may include multiple components associated with signal transmission and reception (eg, processor, modulator, complex) Consumer, demodulator, demultiplexer or antenna, etc.).
  • Access network device 102 can communicate with a plurality of terminal devices, such as terminal device 116 and terminal device 122. However, it will be appreciated that the access network device 102 can communicate with any number of terminal devices similar to the terminal device 116 or the terminal device 122.
  • Terminal devices 116 and 122 may be, for example, cellular telephones, smart phones, portable computers, handheld communication devices, handheld computing devices, satellite radios, global positioning systems, PDAs, and/or any other suitable for communicating over wireless communication system 100. device.
  • terminal device 116 is in communication with antennas 112 and 114, wherein antennas 112 and 114 transmit information to terminal device 116 over a forward link (also referred to as downlink) 118 and through the reverse link (also Information referred to as uplink 120 receives information from terminal device 116.
  • terminal device 122 is in communication with antennas 104 and 106, wherein antennas 104 and 106 transmit information to terminal device 122 over forward link 124 and receive information from terminal device 122 over reverse link 126.
  • forward link 118 can use a different frequency band than reverse link 120, and forward link 124 can be used differently than reverse link 126. Frequency band.
  • FDD Frequency Division Duplex
  • the forward link 118 and the reverse link 120 can use a common frequency band, a forward link 124, and a reverse link.
  • Link 126 can use a common frequency band.
  • Each antenna (or set of antennas consisting of multiple antennas) and/or regions designed for communication is referred to as a sector of the access network device 102.
  • the antenna group can be designed to communicate with terminal devices in sectors of the coverage area of the access network device 102.
  • the access network device can transmit signals to all of the terminal devices in its corresponding sector by single antenna or multi-antenna transmit diversity.
  • the transmit antenna of the access network device 102 can also utilize beamforming to improve the forward links 118 and 124. Signal to noise ratio.
  • the access network device 102 utilizes beamforming to selectively distribute the terminal devices 116 and 122 in the associated coverage area as compared to the manner in which the access network device transmits signals to all of its terminal devices through single antenna or multi-antenna transmit diversity.
  • beamforming When transmitting a signal, mobile devices in neighboring cells are subject to less interference.
  • the access network device 102, the terminal device 116, or the terminal device 122 may be a wireless communication transmitting device and/or a wireless communication receiving device.
  • the wireless communication transmitting device can encode the data for transmission.
  • the wireless communication transmitting device may acquire (eg, generate, receive from other communication devices, or store in memory, etc.) a certain number of data bits to be transmitted over the channel to the wireless communication receiving device.
  • Such data bits may be included in a transport block (or multiple transport blocks) of data that may be segmented to produce multiple code blocks.
  • the communication system 100 may be a PLMN network or a D2D network or an M2M network or other network.
  • FIG. 1 is only a simplified schematic diagram of an example, and the network may also include, for example, a core network device, etc., which is not shown in FIG.
  • the communication system 100 may be, for example, a Global System of Mobile communication (GSM) system, a Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, Advanced Long Term Evolution (Advanced Long Term Evolution, LTE-A) system, Universal Mobile Telecommunication System (UMTS), Wireless Local Area Networks (WLAN), Wireless Fidelity (WiFi), or next-generation communication systems.
  • GSM Global System of Mobile communication
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • LTE-A Advanced Long Term Evolution
  • UMTS Universal Mobile Telecommunication System
  • WLAN Wireless Fidelity
  • WiFi Wireless Fidelity
  • D2D Device to Device
  • M2M Machine to Machine
  • MTC Machine Type Communication
  • V2V Vehicle to Vehicle
  • the terminal device may also be referred to as a user equipment (User Equipment, UE), an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, and a user.
  • the terminal device can be a station in the WLAN (STAION, ST), which can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, and a personal digital processing.
  • WLAN STAION, ST
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • PDA handheld device with wireless communication capabilities
  • computing device or other processing device connected to a wireless modem
  • in-vehicle device wearable device
  • next-generation communication system for example, fifth-generation communication (fifth- Generation, 5G)
  • 5G fifth-generation communication
  • PLMN Public Land Mobile Network
  • the terminal device may also be a wearable device.
  • a wearable device which can also be called a wearable smart device, is a general term for applying wearable technology to intelligently design and wear wearable devices such as glasses, gloves, watches, clothing, and shoes.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are more than just a hardware device, but they also implement powerful functions through software support, data interaction, and cloud interaction.
  • Generalized wearable smart devices include full-featured, large-size, non-reliable smartphones for full or partial functions, such as smart watches or smart glasses, and focus on only one type of application, and need to work with other devices such as smartphones. Use, such as various smart bracelets for smart signs monitoring, smart jewelry, etc.
  • the terminal device may be an Internet of Things (IoT) device, and the Internet of Things is also called a sensor network, and is briefly an extension of the Internet from a person to a thing.
  • IoT Internet of Things
  • Internet of Things refers to a huge network formed by combining various information sensing devices, such as radio frequency identification devices, infrared sensors, global positioning systems, laser scanners, and the like, with the Internet. The goal is to have all the items connected to the network for easy identification and management.
  • the access network device may be a device for accessing the mobile device, such as an access network device, and the access network device may be an access point (AP) in the WLAN, GSM or A Base Transceiver Station (BTS) in CDMA, which may also be a base station (NodeB, NB) in WCDMA, or an evolved base station (Evolutional Node B, eNB or eNodeB) in LTE, or a relay station or an access point. Or an in-vehicle device, a wearable device, and an access network device in a future 5G network or an access network device in a future evolved PLMN network.
  • AP access point
  • GSM Global System for Mobile communications
  • BTS Base Transceiver Station
  • CDMA Code Division Multiple Access
  • NodeB base station
  • Evolutional Node B, eNB or eNodeB evolved base station
  • the access network device provides a service for the cell
  • the terminal device communicates with the access network device by using a transmission resource (for example, a frequency domain resource, or a spectrum resource) used by the cell
  • a transmission resource for example, a frequency domain resource, or a spectrum resource
  • the cell It may be a cell corresponding to an access network device (for example, a base station), and the cell may belong to a macro base station or a base station corresponding to a small cell, where the small cell may include: a metro cell and a micro cell ( Micro cell), Pico cell, Femto cell, etc.
  • Micro cell Micro cell
  • Pico cell Pico cell
  • Femto cell etc.
  • multiple carriers can work at the same frequency on the carrier in the LTE system or the 5G system.
  • the concept of the carrier and the cell can be considered to be equivalent.
  • CA carrier aggregation
  • the concept of the carrier and the cell can be considered to be equivalent, for example, the UE accessing one carrier and accessing one cell are equivalent.
  • the consensus node described in this paper refers to the basic unit capable of performing consensus operations, storing data, forwarding data, verifying data, etc., and can be composed of one or more computers.
  • the communication system 100 (specifically, in architecture #1 of the communication system 100) includes at least two consensus nodes 130.
  • At least two consensus nodes are used for data storage and negotiation decisions for the data storage.
  • the consensus nodes 130 are in communication connection with each other.
  • each consensus node 130 can make decisions based on a communication mechanism based on a negotiation mechanism.
  • a portion (eg, at least two) or all of the consensus nodes in the communication system 100 can negotiate a decision initiated by one or more consensus nodes to determine the outcome of the determination.
  • each consensus node participating in the negotiation may determine a certain event based on a preset determination rule, so that each consensus node participating in the negotiation may obtain a determination result for the event, for example, for example, The result of the determination may be "yes" or "no".
  • the determination rules used by the respective consensus nodes participating in the negotiation may be the same or different, and the present invention is not particularly limited.
  • the final determination result for the event made by the communication system 100 can be determined based on the distribution of the determination results of the consensus nodes participating in the negotiation.
  • the "determination result” may have at least two kinds of results, and the “distribution of the determination result” may refer to the number of each of the at least two determination results, or the above-mentioned “determination result”
  • the distribution may refer to a ratio between the at least two determination results, for example, the above-mentioned “distribution of determination results” may refer to a ratio or number of "yes" and "no".
  • the communication system 100 can implement the above-described negotiation mechanism based on blockchain techniques.
  • Blockchain technology implements a chained data structure consisting of chronologically connecting data and information blocks in a sequential manner, and cryptographically guaranteed non-tamperable and unforgeable distributed storage.
  • transactions the data and information in the blockchain are called "transactions.”
  • Blockchain technology is not a single-item technology, but a system that integrates applications as a point-to-point transmission, consensus mechanism, distributed data storage, and cryptography principles.
  • the system has full-featured and tamper-proof technical features.
  • point-to-point transmission the nodes participating in the blockchain are independent and peer-to-peer, and the nodes and nodes synchronize data and information through point-to-point transmission technology.
  • Nodes can be different physical machines or different instances of the cloud.
  • the consensus mechanism of the blockchain refers to the process in which the nodes participating in the multi-party participate in the agreement of specific data and information through the interaction between the nodes under the preset logic rules.
  • the consensus mechanism needs to rely on well-designed algorithms, so different consensus mechanism performance (such as transaction throughput TPS (Transaction Per Second), consensus delay, costly computing resources, costly transmission resources, etc. There are certain differences.
  • distributed data storage Distributed storage in the blockchain is that each node participating in the blockchain has independent and complete data, which ensures that the data is stored in the entire node. Unlike traditional distributed data storage, traditional distributed data storage divides data into multiple copies for backup or synchronous storage according to certain rules, while blockchain distributed data storage relies on peer-to-peer in the blockchain. A consensus between independent nodes to achieve highly consistent data storage.
  • blockchain is usually based on asymmetric encryption technology to achieve reliable information dissemination, verification and so on.
  • each "block” contains two parts, “block header” and “block body”, where “block body” contains transaction records packed into “blocks”; “block headers” contain " The root HASH of all transactions in the block and the HASH of the previous "block”.
  • the data structure of the blockchain ensures that the data stored on the blockchain has non-tamperable characteristics.
  • Blockchains can currently be divided into three categories: public, alliance, and private.
  • a public chain refers to a consensus node (also called a consensus computing node) that can participate in any block as a blockchain, and then participates in the consensus calculation of blockchain data storage and anonymously maintains the blockchain, between nodes and nodes. Do not trust each other. In this case, any node in the communication system 100 can act as a consensus node.
  • a consensus node also called a consensus computing node
  • the alliance chain increases the access authority on the basis of the public chain, so that the node with certain qualification can be used as the consensus computing node of the blockchain, and then participate in the consensus calculation of the blockchain data storage and maintain the blockchain, node There is a certain trust between the nodes.
  • the node in the communication system 100 having the qualification issued by the network operator, or the node approved by the network operator, can serve as the consensus node.
  • the private chain is more demanding than the access mechanism of the alliance chain, making the blockchain and the consensus computing node of the blockchain private.
  • the nodes controlled or maintained by the network operator in the communication system 100 are consensus. node.
  • each node in the architecture #2 may be a virtual node.
  • the functions of each node in the architecture #2 can be implemented by a virtual machine running on a computer device.
  • the virtual node in the architecture #2 can be carried in some or all of the entities in the architecture #1, or the virtual machine implementing the function of the node in the architecture #2 can be installed and run in the architecture #1 In the entity (or device, or physical device), for example, the virtual node in the architecture #2 may be carried in the access network device or the core network device in the architecture #1.
  • each virtual node in the architecture #2 is carried by the architecture #1. Physical device.
  • the communication system 100 may include a server of an operator of a network used by the communication system 100 (specifically, the architecture #1 of the communication system 100) (hereinafter, for ease of understanding and distinction, as: server #A)
  • server #A may be a server controlled, managed or maintained by the above-mentioned operator, and one or more virtual nodes in the architecture #2 may be carried by the server #A.
  • the communication system 100 may include a server facing the manufacturer of the terminal device (hereinafter, for ease of understanding and differentiation, referred to as: server #B), wherein the server #B may be controlled, managed, or The server is maintained, and one or more virtual nodes in the architecture #2 can be hosted on the server #B.
  • server #B a server facing the manufacturer of the terminal device
  • the architecture #2 may be used to implement a Home Subscriber Server (HSS) function, or the nodes in the architecture #2 may constitute an open home subscription server (Open Home Subscriber).
  • HSS Home Subscriber Server
  • OHSS Open Home Subscriber
  • the OHSS system can realize the functions of issuing, authenticating, authenticating and managing the identity of the terminal device. It should be understood that the functions implemented by the OHSS system enumerated above are merely exemplary descriptions, and the present invention is not limited thereto, and the functions implemented by the OHSS system may be similar to those implemented by the HSS devices in the prior art.
  • the communication system 100 may further include one or more consensus nodes, wherein each non-consensus node is in communication connection with at least one consensus node, and the non-consensus node may be based on the consensus node. Control or instruct to store blockchain data.
  • FIG. 3 shows an example of a physical device in the communication system 100 capable of constructing a consensus node in #2.
  • the physical device that can serve as the consensus node may include:
  • a network device for example, an access network device and/or a core network device, etc.
  • the manufacturer (or manufacturer) of the terminal device can directly participate in the management of the identity of the terminal device (for example, the function implemented by the HSS) through the server #B (ie, an example of the consensus node), Specifically, the manufacturer of the terminal device can implement the issuance and management of the identity of the terminal device through the server #B (the process will be described in detail later).
  • the operator of the network can directly participate in the management of the identity of the terminal device through the server #A (ie, another instance of the consensus node).
  • the operator of the network can implement the identity identification of the terminal device through the server #A (ie, Authentication and management of the identity assigned by the manufacturer to the terminal device (following the process in detail).
  • the main function of the network device is to authenticate and authenticate the terminal device, so that only the terminal device with the identity identification can access the network of the operator.
  • the server of the third-party application can directly utilize the identity assigned by the OHSS system to the terminal device and the authentication result of the identity of the terminal device.
  • the communication system 100 may not include the server #A.
  • the operator of the network may implement the function of the server #A described later through the network device (for example, the access network device or the core network device).
  • the communication system 100 may not include the server #A.
  • the consensus node of the communication system 100 may not include an access network device.
  • the consensus node of the communication system 100 may not include a core network device.
  • the consensus node of the communication system 100 may not include a server of a third party application.
  • the physical device in the communication system 100 can apply as a consensus node by using a registration method.
  • architecture #2 (or OHSS system of an embodiment of the invention) may be created (or initialized) by an operator of the network (eg, server #A).
  • the OHSS system may be implemented based on a blockchain technique. After initialization, the consensus node of the OHSS blockchain may include an operator controlled device (eg, server #A or network device) of the network.
  • the operator of the network can open the member ship of the OHSS system to the vertical industry, other network operators, etc., thereby enabling multiple devices (for example, server #B, The three-party application server and network equipment, etc. jointly maintain and manage the blockchain data of the OHSS system (specifically, the identity of the terminal device in the network).
  • devices for example, server #B, The three-party application server and network equipment, etc. jointly maintain and manage the blockchain data of the OHSS system (specifically, the identity of the terminal device in the network).
  • whether the device in the communication system can be used as a consensus node may be set by the network administrator and notified to each device in the communication system 100.
  • the consensus node already existing in the system may also negotiate whether the device requesting the request as the consensus node can be used as the consensus node.
  • the server #A and the consensus node already existing in the OHSS negotiate to enable the network device (for example, the access network device or the core network device).
  • the network device for example, the access network device or the core network device.
  • Registered as a consensus node in the OHSS system or architecture #2 of the communication system 100).
  • the above-mentioned negotiation (or registration) for the access node device (hereinafter, referred to as the access network device #A for ease of understanding and explanation) by the server #A is used as a consensus node.
  • the process is an example, and the registration process of the consensus node is exemplified.
  • each consensus node in the communication system may communicate by using an encryption mechanism.
  • the sender may use an encrypted information to encrypt the data to be transmitted, and generate an encryption.
  • the subsequent data is sent to the receiving end, and the receiving end decrypts the received data according to the decrypted information corresponding to the encrypted information, thereby acquiring the data to be transmitted.
  • the encrypted information used by the server #A is information #1
  • the decrypted information used by the server #A is information #2.
  • the information #1 may be a private key used by the server #A
  • the information #2 may be a public key used by the server #A.
  • the server #A and other devices may communicate using the information #1 and the information #2 based on a Public Key Infrastructure (PKI) technology.
  • PKI Public Key Infrastructure
  • the information #1 may be a private key used by the server #A
  • the information #2 may be an identifier of the server #A.
  • the server #A and other devices may be based on an identity encryption system (Identity The Based Cryptosystem (IBC) technology uses this information #1 and information #2 for communication.
  • IBC Identity The Based Cryptosystem
  • each consensus node in the communication system 100 can learn the decryption information (for example, a public key or a device identifier) of each other by means of broadcast.
  • decryption information for example, a public key or a device identifier
  • each consensus node in architecture #2 may have an identity that is unique in the network indicating the consensus node, ie, the registration process described above It can also be understood as the process of issuing and authenticating the identity of the consensus node.
  • server #A may assign an identifier to access network device #A (hereinafter, for ease of understanding and distinction, denoted as: logo #A).
  • the server #A can know the rules for verifying whether an identifier can be used as an identity identifier (hereinafter, for ease of understanding and explanation, it is recorded as: rule #1), thereby Server #A can determine the identity #A based on rule #1.
  • the rule #1 may be: if an identifier has been identified by the consensus node already existing in the communication system 100, the identifier can no longer be used as the identity of the other device.
  • the rule #1 may be that if an identifier has been carried in a certain registration message and is propagated in the communication system, the identifier cannot be used as an identity identifier for the device corresponding to the post-propagation registration message.
  • each consensus node may hold an identifier list, and the identifier list may record multiple identifiers.
  • the rule #1 may be: if an identifier has been recorded in the identifier. In the list, the ID cannot be used as an identity.
  • the identifiers stored in the consensus nodes may be the same or different, and are not specifically limited in the embodiment of the present invention.
  • the server #A can determine the logo #A based on the above rule #1.
  • server #A may learn the identity of each consensus node (eg, via a broadcast message sent by each consensus node that is present in communication system 100).
  • the server can make the determined identity #A different from the device identity of each consensus node that is present in the communication system 100.
  • the server #A can negotiate with one or more consensus nodes (hereinafter, for ease of understanding and explanation, referred to as: consensus node #A) existing in the communication system 100 to determine whether the identification #A can As the identity of the access network device #A.
  • consensus node #A one or more consensus nodes
  • the server #A can perform signature processing on the logo #A according to the information #1 to obtain signature data.
  • the server #A may also determine the public key used by the access network device #A (ie, an example of the decryption information used by the access network device #A), and the server #A may pair the identification #1 according to the information #1.
  • a and the public key used by the access network device #A perform signature processing to obtain signature data.
  • the signature data transmitted (or negotiated) between the consensus nodes may also be referred to as “transaction”.
  • transaction record obtained after the signature processing is obtained.
  • server #A can save the transaction, ie
  • server #A can carry The registration information (hereinafter, for ease of understanding and explanation, is recorded as: Register#1) is sent to the consensus node #A.
  • the consensus node #A can verify Register#1 (or registration information #1) according to the information #2, and if the verification passes, the consensus node #A can determine that the Register#1 is from a legitimate device, and further, The consensus node #A can determine that the identity #A (or the public key used by the identity #A and the access network device #A) is secure.
  • the consensus node #A can verify the identifier #A to determine whether the identifier #A can be used as the object of the current registration (ie, the access network device #A) identity, or the consensus node #A It can be determined whether the identification #A is legal. For example, the consensus node #A may determine whether the identification #A can be the object of the current registration (ie, the access network device #A) identity based on the rule #1.
  • the consensus node #A can obtain the verification result for the identifier #A, and the verification result can be: the identifier #A can be the object of the current registration (ie, the access network device #A) identity, or the identifier #A It cannot be used as the object of this registration (ie, access network device #A) identity.
  • the consensus node #A can acquire a preset determination condition (hereinafter, for ease of understanding and distinction, denoted as: determination condition #1), and based on the determination condition #1, authenticating.
  • determination condition #1 a preset determination condition
  • authenticating based on the determination condition #1, authenticating.
  • the determination condition #1 may be: if an identifier has been stored in the blockchain before one registration, the identifier cannot be used as the identity of the object of this registration.
  • the consensus node #A can determine that the verification result is: the identification #A cannot be the object of the current registration (ie, the access network device #A) identity .
  • the consensus node #A can determine that the verification result is: the identification #A can be the object of the current registration (ie, the access network device #A) identity.
  • the above-listed determination conditions are not limited thereto because of an exemplary description.
  • the determination condition #1 may also be: if one identification has been assigned to one device in one communication system before one registration , the identifier can no longer be used as the identity of other devices.
  • At S240, at least two consensus nodes including the consensus node #A may negotiate based on the respective verification results to determine whether the identifier #A can be the object of the registration (That is, the access network device #A) identity.
  • the negotiation result may be: the identifier #A can be used as the object of the current registration (ie, the access network device #A) identity.
  • the negotiation result may be: #A cannot be the object of this registration (ie, access network device #A) identity.
  • the number threshold value #1 and the number threshold value #2 may be the same or different, and the present invention is not particularly limited.
  • the proportion of the consensus node in all the consensus nodes participating in the negotiation is greater than or equal to the preset proportional threshold# 1.
  • the negotiation result may be: the identifier #A can be used as the object of the current registration (ie, the access network device #A) identity.
  • the proportion of all the consensus nodes participating in the negotiation is less than the preset proportional threshold #1.
  • the negotiation result may be: the identifier #A cannot be the object of the current registration (ie, the access network device #A) identity.
  • the proportional threshold #1 and the proportional threshold #2 may be the same or different, and the present invention is not particularly limited.
  • the consensus node can save the identifier #A to the block. In the chain.
  • the one or more consensus nodes participating in the negotiation may also send broadcast information carrying the authentication information #A to each device in the communication system 100, the authentication information #A may be used to indicate that the identifier #A is The authentication system is effective in the communication system, so that the authentication party can determine that the identification #A passes the authentication when there is a process in which authentication authentication is required.
  • the server #B may initiate the process of registering as a consensus node.
  • the difference from the process shown in FIG. 4 is that the object encrypted by the server #B is the identifier determined by the server #B.
  • the private key of the server #B is used when encrypting the identifier, and the information used when the receiving end of the information is decrypted is the public key or device identifier of the server #B.
  • other processes in which the server #B can initiate registration as a consensus node can be similar to the process shown in FIG. 4 above, and a detailed description thereof will be omitted herein to avoid redundancy.
  • FIG. 5 is a schematic diagram showing the process of issuing the identity of the terminal device #B.
  • the server #B may assign an identifier to the terminal device #B (ie, an example of the first terminal device) ( Hereinafter, in order to facilitate understanding and distinction, it is recorded as: logo #B).
  • the server #B can learn the rules for verifying whether an identifier can be used as an identity identifier (hereinafter, for ease of understanding and explanation, it is recorded as: rule #2), thereby Server #B can determine the identity #B based on rule #2.
  • the rule #2 may be: if an identifier has been identified by the consensus node already existing in the communication system 100, the identifier can no longer be used as the identity of the other device.
  • the rule #2 may be that if an identifier has been carried in a certain registration message and is propagated in the communication system, the identifier cannot be used as an identity identifier for the device corresponding to the post-propagation registration message.
  • each consensus node may hold an identifier list, and the identifier list may record multiple identifiers.
  • the rule #2 may be: if an identifier is already recorded in the identifier. In the list, the ID cannot be used as an identity.
  • the identifiers stored in the consensus nodes may be the same or different, and are not specifically limited in the embodiment of the present invention.
  • the server #B can determine the identification #B based on the above rule #2.
  • server #B can learn the identity of each consensus node (e.g., via a broadcast message sent by each consensus node that is present in communication system 100).
  • the server can cause the determined identification #B to be different from the device identification of each of the consensus nodes that are present in the communication system 100.
  • the server #B can send the identification #B to one or more consensus nodes in the communication system 100, so that at least two consensus nodes in the communication system #100 can perform the determination as to whether the identification #B can be used as Negotiation of the identity of terminal device #B.
  • server #B when server #B is not a consensus node, server #B may not participate in the above negotiation process.
  • the server #B When the server #B is a consensus node, the server #B can participate in the negotiation process.
  • the process and process of the server #B participation negotiation are taken as an example, and the process of the above negotiation is described in detail.
  • the server #B may negotiate with one or more consensus nodes (hereinafter, for ease of understanding and explanation, referred to as: consensus node #B) existing in the communication system 100 to determine the identifier.
  • #B can be used as the identity of terminal device #B.
  • the server #B can perform signature processing on the identifier #B according to the information #3 to obtain signature data.
  • the server #B may also determine the public key used by the terminal device #B, and the server #B may perform signature processing on the identification #B and the public key used by the terminal device #B according to the information #3 to obtain a signature. data.
  • the data transmitted (or negotiated) between the consensus nodes may also be referred to as “transaction”.
  • transaction obtained after the signature processing is recorded as :
  • server #B can save the transaction, ie
  • server #B can carry The registration information (hereinafter, referred to as: Register#2 for ease of understanding and explanation) is transmitted to the consensus node #B (that is, an example of the first consensus node).
  • the consensus node #B may be the above-mentioned server #A, or the consensus node #B may be a network device (for example, an access network device or a core network device) registered as a consensus node by the above server #A. .
  • the consensus node #B can verify Register #2 (or registration information #2) according to the information #2, and if the verification passes, the consensus node #A can determine that the Register#2 is from a legitimate device, and further, The consensus node #B can determine that the identity #B (or the public key used by the identity #B and the terminal device #B) is secure.
  • the consensus node #B can verify the identifier #B to determine whether the identifier #B can be used as the object of the current registration (ie, the terminal device #B) identity, or the consensus node #B can determine Whether the identifier #B is legal. For example, the consensus node #B can determine whether the identification #B can be the object of the current registration (ie, the terminal device #B) identity based on the rule #2.
  • the consensus node #B can obtain the verification result for the identifier #B, and the verification result can be: the identifier #B can be used as the object of the current registration (ie, the terminal device #B) identity, or the identifier #B cannot be used as The object of this registration (ie, terminal device #B) identity.
  • server #B can get the verification result for identification #B.
  • the consensus node #B may acquire a preset determination condition (hereinafter, for ease of understanding and distinction, denoted as: determination condition #2), and based on the determination condition #2, authenticating.
  • determination condition #2 a preset determination condition
  • the decision condition #2 may be: if an identifier has been stored in the blockchain before one registration, the identifier cannot be used as the identity of the object of the current registration.
  • the consensus node #B can determine that the verification result is that the identification #B cannot be the object of the current registration (ie, the terminal device #B) identity.
  • the consensus node #B can determine that the verification result is: the identification #B can be the object of the current registration (ie, the terminal device #B) identity.
  • the above-listed determination conditions are not limited thereto because of an exemplary description.
  • the determination condition #1 may also be: if one identification has been assigned to one device in one communication system before one registration , the identifier can no longer be used as the identity of other devices.
  • At S340 at least two consensus nodes including the consensus node #B (for example, the server #B may be included) may negotiate based on the respective verification results to determine whether the identifier #B can be the object of the registration ( That is, the terminal device #B) is identified.
  • the negotiation is performed.
  • the result may be that the identifier #B can be used as the object of the registration (ie, the terminal device #B) identity.
  • the negotiation result may be: identifier #B It cannot be used as the object of this registration (ie, terminal device #B) identity.
  • the number threshold #3 and the number threshold #4 may be the same or different, and the present invention is not particularly limited.
  • the negotiation result may be: the identifier #B can be used as the object of the current registration (ie, the terminal device #B) identity.
  • the verification result is that the proportion of the consensus node of the identity #B that can be the object of the current registration (ie, the terminal device #B) is less than the preset proportional threshold #4 in all the consensus nodes participating in the negotiation, then
  • the result of the negotiation may be: the identifier #B cannot be the object of the current registration (ie, the terminal device #B) identity.
  • the proportional threshold #3 and the proportional threshold #4 may be the same or different, and the present invention is not particularly limited.
  • the consensus node can save the identifier #B to the blockchain. .
  • the one or more consensus nodes participating in the negotiation may also send broadcast information carrying the authentication information #B to each device in the communication system 100, the authentication information #B may be used to indicate that the identifier #B is
  • the authentication system is effective in the communication system so that the authentication party can determine that the identification #B passes the authentication when there is a process in which authentication authentication is required. That is, in the embodiment of the present invention, the access network device (e.g., the access network device #A) in the communication system 100 can determine that the identity #B is legal (e.g., can pass authentication authentication).
  • the issuance process of the identity of the terminal device #B is completed, and since the identity of the terminal device #B is negotiated and verified by the consensus node (for example, the server #A) in the communication system 100, it is possible to ensure The identity of the terminal device #B can be used for authentication, authentication, and the like of the terminal device #B.
  • the consensus node for example, the server #A
  • the result of the negotiation of the verification result needs to meet the rule set by the communication system (for example, an operator), that is, an identifier can only be used as an identity of a terminal device.
  • the server #B may store (or burn) the identifier #B (ie, ID devj ) which is the identity of the terminal device #B after the above negotiation and verification into the terminal device #B. (or, in the SIM card of terminal device #B).
  • the server #B may also store (or burn) the public key used by the terminal device #B, the public key used by the server #B, and the public key used by the server #A into the terminal device #B (or Said, terminal device #B's SIM card).
  • the identifier of the terminal device in the communication system may include, but is not limited to, a global subscriber identity module (Universal Subscriber Identity Module) in the prior art. , USIM) number, Subscriber Identification Module (SIM) number, International Mobile Subscriber Identification Number (IMSI), mobile number, etc.
  • a global subscriber identity module Universal Subscriber Identity Module
  • USIM Global Subscriber Identity Module
  • SIM Subscriber Identification Module
  • IMSI International Mobile Subscriber Identification Number
  • the network access authentication and authentication process performed by the terminal device #B that is, an example of the first terminal device
  • the identity identifier for example, the above-mentioned identifier #B
  • the terminal device #B may send an access request (for example, an attach request) message to the access network device (for example, the access network device #A), and the message may be carried.
  • an access request for example, an attach request
  • the access network device for example, the access network device #A
  • logo #B There is the above logo #B.
  • the access network device #A can query whether the identifier #B is stored locally (or the registration transaction for the identifier #B), or the access network device #A can query whether the local is saved for indication.
  • the information of the identification #B is legal (hereinafter, for ease of understanding and explanation, it is recorded as: information #B).
  • the access network device #A can perform S440.
  • the access network device #A may initiate a query to one or more consensus nodes (eg, server #A) in the communication system to check whether the identification #B is legal at S430. Query process. Since the identification #B passes the negotiation authentication of at least two consensus nodes in the communication system 100, the access network device #A can determine that the identification #B is legal based on the reply of the server #A. Moreover, the server #A can send the public key used by the terminal device #B to the access network device #A in the process.
  • one or more consensus nodes eg, server #A
  • the access network device #A may generate a random number M and acquire the above transaction.
  • the access network device #A can be based on the public key used by the terminal device #B Alternatively, the identity of the terminal device #B (for example, the identifier #B) encrypts the random number M to generate cipher text #A.
  • the access network device #A can cipher the ciphertext #A and Send to terminal device #B.
  • the terminal device #B can use the private key used by the terminal device #B (where the private key Public key used with terminal device #B Corresponding, or, the private key
  • the ciphertext #A is decrypted corresponding to the identity of the terminal device #B, thereby obtaining a random number M.
  • the server #A may send the identifier of each access network device in the communication system to the terminal device #B.
  • the terminal device #B can be based on the Make sure that access network device #A is legal.
  • the terminal device #B can generate the random number #N, and the terminal device #B can use the public key used by the access network device #A.
  • the identity of the access network device #A ie, the identifier #A
  • the terminal device #B may transmit the ciphertext #B to the access network device #A.
  • the access network device #A may use the private key used by the access network device #A. (where the private key Public key used with access network device #A Corresponding, or, the private key
  • the ciphertext #B is decrypted to obtain the random number N and the random number M, so that the access network device #A completes the authentication of the terminal device #B.
  • the access network device #A can use the public key used by the terminal device #B Alternatively, the identity of the terminal device #B (ie, the identifier #B) encrypts the random number N to generate the ciphertext #C.
  • the access network device #A may generate the ciphertext #C to the terminal device #B, whereby the terminal device #B may be based on the private key used by the terminal device #B (where the private key Public key used with terminal device #B Corresponding, or, the private key The ciphertext #C is decrypted corresponding to the identity of the terminal device #B. If N is obtained, the terminal device #B completes the authentication of the access network device #A, and the network authentication and authentication ends.
  • a method for determining an identity of a terminal device determines a first identity by a server of a manufacturer of the first terminal device, and transmits the first identifier to at least one consensus node in the communication system, and is configured by the communication system
  • the at least two consensus nodes negotiate to determine whether the first identifier can be used as the identity of the first terminal device, and can prevent the user from obtaining the identity identifier for the terminal device, thereby improving the user experience, and since the first identifier is
  • the manufacturer's server determines that it can reduce the burden and cost of the operator's assignment and management of the identity.
  • FIG. 7 shows a schematic block diagram of an apparatus 500 for determining an identity of a terminal device according to an embodiment of the present invention.
  • the device 500 may correspond to (eg, may be configured or itself) the consensus node #B described by the method 300 above (eg, The server #A), and each module or unit in the device 500 is used to execute each action or process performed by the consensus node #B in the above method 300.
  • the server #A the consensus node #B described by the method 300 above
  • each module or unit in the device 500 is used to execute each action or process performed by the consensus node #B in the above method 300.
  • the apparatus 500 may include a processor and a transceiver, and the processor and the transceiver are in communication connection.
  • the device further includes a memory, and the memory is communicatively coupled to the processor.
  • the processor, the memory and the transceiver can be communicatively coupled, the memory being operative to store instructions for executing the memory stored instructions to control the transceiver to transmit information or signals.
  • the transceiver unit in the apparatus 500 shown in FIG. 7 can correspond to the transceiver, and the processing unit in the apparatus 500 shown in FIG. 7 can correspond to the processor.
  • FIG. 8 is a schematic block diagram of an apparatus 600 for determining an identity of a terminal device according to an embodiment of the present invention.
  • the device 600 may correspond to (eg, may be configured or itself) the server #B described in the foregoing method 300, and Each module or unit in the device 600 is used to execute each action or process performed by the server #B in the above method 300.
  • server #B described in the foregoing method 300
  • Each module or unit in the device 600 is used to execute each action or process performed by the server #B in the above method 300.
  • detailed description thereof will be omitted.
  • the apparatus 600 may include a processor and a transceiver, and the processor and the transceiver are in communication connection.
  • the device further includes a memory, and the memory is communicatively coupled to the processor.
  • the processor, the memory and the transceiver can be communicatively coupled, the memory being operative to store instructions for executing the memory stored instructions to control the transceiver to transmit information or signals.
  • the transceiver unit in the device 600 shown in FIG. 8 can correspond to the transceiver
  • the processing unit in the device 600 shown in FIG. 8 can correspond to the processor
  • the processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the foregoing method embodiment may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programming logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.
  • the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (Erasable PROM, EPROM), or an electric Erase programmable read only memory (EEPROM) or flash memory.
  • the volatile memory can be a Random Access Memory (RAM) that acts as an external cache.
  • RAM Random Access Memory
  • many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (Synchronous DRAM).
  • SDRAM Double Data Rate SDRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Connection Dynamic Random Access Memory
  • DR RAM direct memory bus random access memory
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and the present invention should not be The implementation of the embodiments constitutes any limitation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the embodiments of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention, or the part contributing to the prior art or the part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • the instructions include a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Abstract

本申请提供了一种确定终端设备的标识的方法，在包括至少两个共识节点的通信系统中执行，所述方法包括：第一共识节点从第一服务器接收第一标识，其中，所述第一服务器是第一终端设备的制造商的服务器；所述第一共识节点与至少一个第二共识节点进行针对所述第一标识的协商，以确定所述第一标识是否能够作为第一终端设备在所述通信系统中的设备标识，从而，能够改善用户体验、降低运营商对终端设备在通信系统中的标识的分配和管理的负担和成本。

Description

确定终端设备的标识的方法和装置
本申请要求于2017年05月31日提交中国专利局、申请号为201710398007.7、申请名称为“确定终端设备的标识的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及确定终端设备的标识的方法和装置。
背景技术
终端设备在网络中进行通信时，需要使用能够指示该终端设备在网络中的身份的标识(以下，为了便于理解和区分，记作“身份标识”)。例如，在现有技术中，终端设备在入网(例如，接入附着)时，网络侧设备根据该终端设备的身份标识，对该终端设备进行鉴权、认证及秘钥协商等操作。
在现有的通信技术中，该身份标识是网络的运营商集中进行分配和管理，例如，当终端设备的用户与网络的运营商完成签约后，该终端设备的身份标识会被烧制在终端设备中，例如，该终端设备的身份标识会被烧制在终端设备的全球用户身份模块(Universal Subscriber Identity Module，USIM)中。
在现有的通信技术中，用户在使用终端设备进行通信之前，必须为终端设备获得运营商分配的身份标识，影响了用户体验。
并且，随着通信技术例如，物联网技术的发展和普及，终端设备的数量海量增长，同时，海量增长的终端设备也导致运营商对身份标识的分配和管理的负担和成本增大。
发明内容
本申请提供一种确定终端设备的标识的方法和装置，能够改善用户体验、降低运营商对终端设备在通信系统中的标识的分配和管理的负担和成本。
第一方面，提供了一种确定终端设备的标识的方法，在包括至少两个共识节点的通信系统中执行，该方法包括：第一共识节点从第一服务器接收第一标识，其中，该第一服务器是第一终端设备的制造商的服务器；该第一共识节点与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识(或者说，身份标识)。
根据本发明实施例的确定终端设备的标识的方法通过由第一终端设备的制造商的服务器确定第一标识，并将该第一标识发送给通信系统内的至少一个共识节点，并由通信系统中的至少两个共识节点协商确定该第一标识能否作为第一终端设备的身份标识，能够避免用户为终端设备获取身份标识的操作，从而能够改善用户体验，并且，由于该第一标识由制造商的服务器确定，能够降低运营商对于身份标识的分配和管理的负担和成本。
可选地，该第一共识节点是该通信系统使用的网络的运营商的服务器。
通过使运营商的服务器作为第一共识节点，参与针对第一标识能够作为第一终端设备在通信系统中的身份标识的协商过程，能够使运营商参与针对身份标识的认证过程，便于运营商对网络的管理，提高网络的安全性。
可选地，该第一共识节点是该通信系统中的接入网设备(例如，基站)或核心网设备。
可选地，该通信系统是基于区块链(Block chain)技术存储数据的系统。
可选地，该至少两个共识节点基于区块链技术存储数据。
可选地，该至少两个共识节点是区块链系统中的共识节点。
可选地，该第一共识节点与至少一个第二共识节点进行针对该第一标识的协商，包括：该第一共识节点基于区块链技术，与至少一个第二共识节点进行针对该第一标识的协商。
通过将区块链技术应用于本发明实施例的确定终端设备的标识的方法，能够容易地实现身份标识的协商、验证和存储过程。
可选地，该第一共识节点与至少一个共识节点进行针对该第一标识的协商，包括：该第一共识节点根据至少一个第二标识，对该第一标识进行验证，该至少一个第二标识是经过至少两个共识节点协商后确定的，该至少一个第二标识被分配给至少一个第二终端设备，其中在该第一标识不属于该至少一个第二标识的情况下，该验证的结果为该第一标识能够作为终端设备在该通信系统中的设备标识，在该第一标识属于该至少一个第二标识，该验证的结果为该第一标识不能够作为终端设备在该通信系统中的设备标识；该第一共识节点根据该验证的结果与至少一个第二共识节点进行针对该第一标识的协商。
从而，能够避免该第一标识同时作为不同终端设备的身份标识，从而，能够避免通信错误，提高通信的安全性和可靠性，进一步改善用户体验。
可选地，在该第一标识属于该至少一个第二标识的情况下，第二共识节点不支持第一标识作为终端设备在该通信系统中的设备标识；在该第一标识不属于该至少一个第二标识的情况下，第二共识节点支持该第一标识作为终端设备在该通信系统中的设备标识。
可选地，该第一共识节点与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识，包括：当进行协商的至少两个共识节点中支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的数量大于或等于预设的第一阈值时，该第一共识节点确定该第一标识能够作为第一终端设备在该通信系统中的设备标识。
可选地，该第一共识节点与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识，包括：当进行协商的至少两个共识节点中支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的比例大于或等于预设的第二阈值时，该第一共识节点确定该第一标识能够作为第一终端设备在该通信系统中的设备标识。
可选地，该第一共识节点与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识，包括：当进行协商的至少两个共识节点中不支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的数量大于或等于预设的第三阈值时，该第一共识节点确定该第一标识不能作为第一终端设备在该通信系统中的设备标识。
可选地，该第一共识节点与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识，包括：当进行协商的至少两个共识节点中不支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的比例大于或等于预设的第四阈值时，该第一共识节点确定该第一标识不能作为第一终端设备在该通信系统中的设备标识。
可选地，该第一共识节点从第一服务器接收第一标识，包括：该第一共识节点从该第一服务器接收注册信息，该注册信息是该第二服务器根据第一加密信息对该第一标识进行加密处理后生成的；该第一共识节点根据第一解密信息对该注册信息进行解密，以获取该第一标识，其中，该第一解密信息与该第一加密信息相对应，该第一服务器是该通信系统中的共识节点，该第一解密信息是该通信系统中的除该第一服务器以外的共识节点与该第一服务器通信时使用的解密信息。
可选地，该加密处理为签名处理，该解密处理为验证处理。
通过基于加密机制完成第一共识节点和第一服务器之间的通信，能够提高第一服务器与第一共识节点之间的信息传输的安全性。
可选地，该第一加密信息为该第一服务器使用的私钥，该第一解密信息是该第一服务器使用的公钥，或该第一解密信息是该第一服务器的标识。
可选地，该注册信息是该第二服务器根据第一加密信息对该第一标识和该第一终端设备使用的公钥进行加密处理后生成的。
从而，能够使第一共识节点获取该第一终端设备使用的公钥，从而，在该第一共识节点管理的接入网设备或核心网设备对第一终端设备进行鉴权认证时，无需发起获取公钥的过程，从而，能够节省信令开销。
可选地，该方法还包括：该第一共识节点向该第一服务器发送应答信息，该应答信息用于指示该第一标识是否能够作为第一终端设备在该通信系统中的设备标识。
从而，能够可靠地使第一服务器确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识，进而，提高本发明实施例的确定终端设备的标识的方法的效率和可靠性。
可选地，该至少一个第二共识节点包括该通信系统中的接入网设备、该通信系统中的核心网设备、应用服务商的服务器和该第一服务器中的至少一个设备。
第二方面，提供了一种确定终端设备的标识的方法，在包括至少两个共识节点的通信系统中执行，该方法包括：第一服务器确定第一标识，其中，该第一服务器是该第一终端设备的制造商的服务器；该第一服务器向至少一个第一共识节点发送该第一标识，以便于包括该至少一个第一共识节点在内的至少两个共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识。
根据本发明实施例的确定终端设备的标识的方法通过由第一终端设备的制造商的服务器确定第一标识，并将该第一标识发送给通信系统内的至少一个共识节点，并由通信系统中的至少两个共识节点协商确定该第一标识能否作为第一终端设备的身份标识，能够避免用户为终端设备获取身份标识的操作，从而能够改善用户体验，并且，由于该第一标识由制造商的服务器确定，能够降低运营商对于身份标识的分配和管理的负担和成本。
可选地，该第一共识节点是该通信系统使用的网络的运营商的服务器。
通过使运营商的服务器作为第一共识节点，参与针对第一标识能够作为第一终端设备在通信系统中的身份标识的协商过程，能够使运营商参与针对身份标识的认证过程，便于运营商对网络的管理，提高网络的安全性。
可选地，该第一共识节点是该通信系统中的接入网设备(例如，基站)或核心网设备。
可选地，该通信系统是基于区块链(Block chain)技术存储数据的系统。
可选地，该至少两个共识节点基于区块链技术存储数据。
可选地，该至少两个共识节点是区块链系统中的共识节点。
可选地，该第一服务器为该通信系统中的共识节点，以及该方法还包括：该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商。
可选地，该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商：该第一服务器基于区块链技术与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商。
通过将区块链技术应用于本发明实施例的确定终端设备的标识的方法，能够容易地实现身份标识的协商、验证和存储过程。
可选地，该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商，包括：第一服务器根据至少一个第二标识，对该第一标识进行验证，该至少一个第二标识是经过至少两个共识节点协商后确定的，该至少一个第二标识被分配给至少一个第二终端设备，其中在该第一标识不属于该至少一个第二标识的情况下，该验证的结果为该第一标识能够作为终端设备在该通信系统中的设备标识，在该第一标识属于该至少一个第二标识，该验证的结果为该第一标识不能够作为终端设备在该通信系统中的设备标识；该第一服务器根据该验证的结果与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商。
从而，能够避免该第一标识同时作为不同终端设备的身份标识，从而，能够避免通信错误，提高通信的安全性和可靠性，进一步改善用户体验。
可选地，在该第一标识属于该至少一个第二标识的情况下，与包括该第一节点在内的至少一个共识节点不支持第一标识作为终端设备在该通信系统中的设备标识；在该第一标识不属于该至少一个第二标识的情况下与包括该第一节点在内的至少一个共识节点支持该第一标识作为终端设备在该通信系统中的设备标识
可选地，该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商，包括：当进行协商的至少两个共识节点中支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的数量大于或等于预设的第一阈值时，该第一服务器确定该第一标识能够作为第一终端设备在该通信系统中的设备标识。
可选地，该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商，包括：当进行协商的至少两个共识节点中支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的比例大于或等于预设的第二阈值时，该第一服务器确定该第一标识能够作为第一终端设备在该通信系统中的设备标识。
可选地，该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商，包括：当进行协商的至少两个共识节点中不支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的数量大于或等于预设的第三阈值时，该第一服 务器确定该第一标识不能作为第一终端设备在该通信系统中的设备标识。
可选地，该第一服务器与包括该第一节点在内的至少一个共识节点进行针对该第一标识的协商，包括：当进行协商的至少两个共识节点中不支持第一标识能够作为第一终端设备在该通信系统中的设备标识的共识节点的比例大于或等于预设的第四阈值时，该第一服务器确定该第一标识不能作为第一终端设备在该通信系统中的设备标识。
可选地，该第一服务器向至少一个第一共识节点发送该第一标识，包括：该第一服务器根据第一加密信息对该第一标识进行加密处理，以生成注册信息，其中，该第一加密信息与第一解密信息相对应，该第一解密信息是该通信系统中的除该第一服务器以外的共识节点与该第一服务器通信时使用的解密信息；该第一服务器向至少一个第一共识节点发送该注册信息。
可选地，该加密处理为签名处理，该解密处理为验证处理。
通过基于加密机制完成第一共识节点和第一服务器之间的通信，能够提高第一服务器与第一共识节点之间的信息传输的安全性。
可选地，该第一加密信息为该第一服务器使用的私钥，该第一解密信息是该第一服务器使用的公钥，或该第一解密信息是该第一服务器的标识。
可选地，该第一服务器根据第一加密信息对该第一标识进行加密处理，包括：该第一服务器根据第一加密信息对该第一标识和该第一终端设备使用的公钥进行加密处理。
从而，能够使第一共识节点获取该第一终端设备使用的公钥，从而，在第一终端设备进行该第一共识节点管理的网络时，无需发起获取公钥的过程，从而，能够节省信令开销。
可选地，第一服务器确定第一标识包括：该第一服务器根据至少一个第二标识，确定第一标识，以使该第一标识与该至少一个第二标识中的每个标识相异，该至少一个第二标识是经过至少两个共识节点协商后确定的，该至少一个第二标识被分配给至少一个第二终端设备。
从而，能够避免该第一标识同时作为不同终端设备的身份标识，从而，能够避免通信错误，提高通信的安全性和可靠性，进一步改善用户体验。
可选地，该至少一个第一共识节点包括该至少一个第一共识节点包括该通信系统中的接入网设备、该通信系统中的核心网设备、应用服务商的服务器和通信系统使用的网络的运营商的服务器中的至少一个设备。
第三方面，提供了一种确定终端设备的标识的装置，包括用于执行上述第一方面以及第一方面的各实现方式中的终端设备的标识测的方法的各步骤的单元。
第四方面，提供了一种确定终端设备的标识的装置，包括用于执行上述第二方面以及第二方面的各实现方式中的终端设备的标识测的方法的各步骤的单元。
第五方面，提供了一种确定终端设备的标识的设备，该设备具有实现上述第一方面以及第一方面的各实现方式中的第一共识节点的行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多于一个与上述功能相对应的模块。
第六方面，提供了一种确定终端设备的标识的设备，该设备具有实现上述第二方面以及第二方面的各实现方式中的第一服务器的行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多于一个与上述功能相对应的 模块。
第七方面，提供了一种服务器，服务器的结构中包括处理器。该处理器被配置为支持服务器执行第一方面以及第一方面的各实现方式中的相应的功能，在一个可能的设计中，该服务器还可以包括收发器，用于支持服务器接收或发送信息。在一个可能的设计中，该服务器还可以包括存储器，该存储器用于与处理器耦合，保存服务器必要的程序指令和数据。或者说，该服务器包括存储器和处理器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得服务器执行上述第一方面及其各种实现方式中的任一种确定终端设备的标识的方法。
第八方面，提供了一种服务器，服务器的结构中包括处理器。该处理器被配置为支持服务器执行第二方面以及第二方面的各实现方式中的相应的功能，在一个可能的设计中，该服务器还可以包括收发器，用于支持服务器接收或发送信息。在一个可能的设计中，该服务器还可以包括存储器，该存储器用于与处理器耦合，保存服务器必要的程序指令和数据。或者说，该服务器包括存储器和处理器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得服务器执行上述第二方面及其各种实现方式中的任一种确定终端设备的标识的方法。
第九方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被服务器的处理单元、通信单元或处理器、收发器运行时，使得服务器的执行上述第一方面及其各种实现方式中的任一种确定终端设备的标识的方法。
第十方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被服务器的处理单元、通信单元或处理器、收发器运行时，使得服务器的执行上述第二方面及其各种实现方式中的任一种确定终端设备的标识的方法。
第十一方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序，所述程序使得服务器执行上述第一方面及其各种实现方式中的任一种确定终端设备的标识的方法。或者说，该计算机可读存储介质用于储存为上述服务器所用的计算机软件指令，其包含用于执行上述第一方面的方法所设计的程序。
第十二方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序，所述程序使得服务器执行上述第二方面及其各种实现方式中的任一种确定终端设备的标识的方法。或者说，该计算机可读存储介质用于储存为上述服务器所用的计算机软件指令，其包含用于执行上述第二方面的方法所设计的程序
第十三方面，提供了一种芯片系统，该芯片系统包括处理器，用于支持服务器实现上述第一方面中所涉及的功能，例如，从第一服务器接收第一标识，并与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识。在一种可能的设计中，所述芯片系统还包括存储器，用于保存服务器必要的程序指令和数据。
第十四方面，提供了一种芯片系统，该芯片系统包括处理器，用于支持服务器实现上述第一方面中所涉及的功能，例如，从第一服务器接收第一标识，并与至少一个第二共识节点进行针对该第一标识的协商，以确定该第一标识是否能够作为第一终端设备在该通信系统中的设备标识。在一种可能的设计中，所述芯片系统还包括存储器，用于保存服务器必要的程序指令和数据。
从而，能够改善用户体验、降低运营商对终端设备在通信系统中的标识的分配和管理的负担和成本。
附图说明
图1是适用本发明实施例的确定终端设备的标识的方法和装置的通信系统的一例的示意图。
图2是发明实施例的通信系统的另一例的示意图。
图3是发明实施例的通信系统的再一例的示意图。
图4是发明实施例的共识节点的注册过程的示意图。
图5是适用本发明实施例的确定终端设备的标识的方法的示意性交互图。
图6是适用本发明实施例的终端设备的入网过程的示意性交互图。
图7是本发明实施例的确定终端设备的标识的装置的一例的示意性框图。
图8是本发明实施例的确定终端设备的标识的装置的另一例的示意性框图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本发明实施例提供的确定终端设备的标识的方法，可以应用于计算机上，该计算机包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。
该硬件层包括中央处理器(Central Processing Unit，CPU)、内存管理单元(Memory Management Unit，MMU)和内存(也称为主存)等硬件。
该操作系统可以是任意一种或多种通过进程(Process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。
该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。
并且，本发明实施例并未对本发明实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本发明实施例的提供的方法的代码的程序，以根据本发明实施例提供的方法进行通信即可，例如，本发明实施例提供的方法的执行主体可以是计算机设备，或者，是计算机设备中能够调用程序并执行程序的功能模块。
并且，在本发明实施例中，该计算机设备可以是智能手机等手持设备，也可以是个人计算机等终端设备，或者，该计算机也可以是服务器，本发明实施例并未特别限定，只要能够通过运行记录有本发明实施例的确定终端设备的标识的方法的代码的程序，以根据本发明实施例的确定终端设备的标识的方法确定终端设备在网络中的身份标识即可。
其中，服务器，也称伺服器，是提供计算服务的设备。由于服务器需要响应服务请求，并进行处理，因此一般来说服务器应具备承担服务并且保障服务的能力。服务器的构成包括处理器、硬盘、内存、系统总线等，和通用的计算机架构类似，但是由于需要提供高可靠的服务，因此在处理能力、稳定性、可靠性、安全性、可扩展性、可管理性等方面要求较高。
本发明实施例的路径检测的执行主体可以是计算机设备，或者，是计算机设备中能够调用程序并执行程序的功能模块。
此外，本发明实施例的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于:磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(Compact Disc，CD)、数字通用盘(Digital Versatile Disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(Erasable Programmable Read-Only Memory，EPROM)、卡、棒或钥匙驱动器等)。
另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
首先，结合图1和图2对使用本发明实施例的确定终端设备的标识的方法和装置的通信系统100进行详细说明。
在本发明实施例中，该通信系统100包括用于实现终端设备的通信的架构(以下，为了便于理解和说明，记作：架构#1)。
并且，该通信系统100包括用于执行终端设备的在该通信系统100(或者说，通信系统100所使用的网络)中使用的标识(以下，为了便于理解和说明，称为身份标识)的层面的架构(以下，为了便于理解和说明，记作：架构#2)。
下面，首先结合图1，对架构#1进行说明。
如图1所示，该通信系统100包括接入网设备102，接入网设备102可包括1个天线或多个天线例如，天线104、106、108、110、112和114。另外，接入网设备102可附加地包括发射机链和接收机链，本领域普通技术人员可以理解，它们均可包括与信号发送和接收相关的多个部件(例如处理器、调制器、复用器、解调器、解复用器或天线等)。
接入网设备102可以与多个终端设备(例如终端设备116和终端设备122)通信。然而，可以理解，接入网设备102可以与类似于终端设备116或终端设备122的任意数目的终端设备通信。终端设备116和122可以是例如蜂窝电话、智能电话、便携式电脑、手持通信设备、手持计算设备、卫星无线电装置、全球定位系统、PDA和/或用于在无线通信系统100上通信的任意其它适合设备。
如图1所示，终端设备116与天线112和114通信，其中天线112和114通过前向链路(也称为下行链路)118向终端设备116发送信息，并通过反向链路(也称为上行链路)120从终端设备116接收信息。此外，终端设备122与天线104和106通信，其中天线104和106通过前向链路124向终端设备122发送信息，并通过反向链路126从终端设备122接收信息。
例如，在频分双工(Frequency Division Duplex，FDD)系统中，例如，前向链路118可与反向链路120使用不同的频带，前向链路124可与反向链路126使用不同的频带。
再例如，在时分双工(Time Division Duplex，TDD)系统和全双工(Full Duplex)系统中，前向链路118和反向链路120可使用共同频带，前向链路124和反向链路126可使用共同频带。
被设计用于通信的每个天线(或者由多个天线组成的天线组)和/或区域称为接入网设备102的扇区。例如，可将天线组设计为与接入网设备102覆盖区域的扇区中的终端设备通信。接入网设备可以通过单个天线或多天线发射分集向其对应的扇区内所有的终端设 备发送信号。在接入网设备102通过前向链路118和124分别与终端设备116和122进行通信的过程中，接入网设备102的发射天线也可利用波束成形来改善前向链路118和124的信噪比。此外，与接入网设备通过单个天线或多天线发射分集向它所有的终端设备发送信号的方式相比，在接入网设备102利用波束成形向相关覆盖区域中随机分散的终端设备116和122发送信号时，相邻小区中的移动设备会受到较少的干扰。
在给定时间，接入网设备102、终端设备116或终端设备122可以是无线通信发送装置和/或无线通信接收装置。当发送数据时，无线通信发送装置可对数据进行编码以用于传输。具体地，无线通信发送装置可获取(例如生成、从其它通信装置接收、或在存储器中保存等)要通过信道发送至无线通信接收装置的一定数目的数据比特。这种数据比特可包含在数据的传输块(或多个传输块)中，传输块可被分段以产生多个码块。
此外，该通信系统100可以是PLMN网络或者D2D网络或者M2M网络或者其他网络，图1只是举例的简化示意图，网络中还可以包括例如，核心网设备等，图1中未予以画出。
作为示例而非限定，在本发明实施例中，该通信系统100可以是，例如：全球移动通讯(Global System of Mobile communication，GSM)系统、码分多址(Code Division Multiple Access，CDMA)系统、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统、通用分组无线业务(General Packet Radio Service，GPRS)、长期演进(Long Term Evolution，LTE)系统、先进的长期演进(Advanced long term evolution，LTE-A)系统、通用移动通信系统(Universal Mobile Telecommunication System，UMTS)、无线局域网(Wireless Local Area Networks，WLAN)、无线保真(Wireless Fidelity，WiFi)或下一代通信系统等。
通常来说，传统的通信系统支持的连接数有限，也易于实现，然而，随着通信技术的发展，移动通信系统将不仅支持传统的通信，还将支持例如，设备到设备(Device to Device，D2D)通信，机器到机器(Machine to Machine，M2M)通信，机器类型通信(Machine Type Communication，MTC)，以及车辆间(Vehicle to Vehicle，V2V)通信。
并且，在本发明实施例中，终端设备也可以称为用户设备(User Equipment，UE)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。终端设备可以是WLAN中的站点(STAION，ST)，可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)设备、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备以及下一代通信系统，例如，第五代通信(fifth-generation，5G)网络中的终端设备或者未来演进的公共陆地移动网络(Public Land Mobile Network，PLMN)网络中的终端设备等。
作为示例而非限定，在本发明实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功 能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能首饰等。
在本发明实施例中，终端设备可以是物理网(Internet of Things，IoT)设备，物联网又称传感网，简要讲就是互联网从人向物的延伸。“物联网”指的是将各种信息传感设备，如射频识别装置、红外感应器、全球定位系统、激光扫描器等种种装置与互联网结合起来而形成的一个巨大网络。其目的是让所有的物品都与网络连接在一起，方便识别和管理。
此外，在本发明实施例中，接入网设备可以是接入网设备等用于与移动设备通信的设备，接入网设备可以是WLAN中的接入点(Access Point，AP)，GSM或CDMA中的基站(Base Transceiver Station，BTS)，也可以是WCDMA中的基站(NodeB，NB)，还可以是LTE中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者中继站或接入点，或者车载设备、可穿戴设备以及未来5G网络中的接入网设备或者未来演进的PLMN网络中的接入网设备等。
另外，在本发明实施例中，接入网设备为小区提供服务，终端设备通过该小区使用的传输资源(例如，频域资源，或者说，频谱资源)与接入网设备进行通信，该小区可以是接入网设备(例如基站)对应的小区，小区可以属于宏基站，也可以属于小小区(Small cell)对应的基站，这里的小小区可以包括：城市小区(Metro cell)、微小区(Micro cell)、微微小区(Pico cell)、毫微微小区(Femto cell)等，这些小小区具有覆盖范围小、发射功率低的特点，适用于提供高速率的数据传输服务。
此外，LTE系统或5G系统中的载波上可以同时有多个小区同频工作，在某些特殊场景下，也可以认为上述载波与小区的概念等同。例如在载波聚合(Carrier Aggregation，CA)场景下，当为UE配置辅载波时，会同时携带辅载波的载波索引和工作在该辅载波的辅小区的小区标识(Cell Indentify，Cell ID)，在这种情况下，可以认为载波与小区的概念等同，比如UE接入一个载波和接入一个小区是等同的。
本文所描述的共识节点是指能够进行共识运算、存储数据、转发数据、验证数据等行为的基本单元，可以由一台或多台计算机组成。
下面，首先结合图2，对架构#2进行说明。
如图2所示，该通信系统100(具体的说，是通信系统100的架构#1中)包括至少两个共识节点130。
其中，该至少两个共识节点用于数据存储以及针对该数据存储的协商决策。
在本发明实施例中，各共识节点130彼此之间通信连接。
从而，各共识节点130可以基于通信连接，基于协商机制进行决策。
例如，该通信系统100中的部分(例如，至少两个)或全部共识节点之间能够针对由一个或多个共识节点发起的判定的协商，从而确定该判定的结果。
例如，在本发明实施例中，每个参与协商的共识节点可基于预设的判定规则针对某一事件的判定，从而，每个参与协商的共识节点可以分别得到针对该事件的判定结果，例如，该判定结果可以为“是”或“否”。这里，需要说明的是，参与协商的各共识节点使用的判定规则可以相同也可以不同，本发明并未特别限定。
其后，参与协商的各共识节点之间可以进行通信，以确定参与协商的各共识节点的判 定结果。从而，能够基于参与协商的各共识节点判定结果的分布，确定通信系统100做出的针对该事件的最终判定结果。作为示例分非限定，上述“判定结果”可以有至少两种结果，上述“判定结果的分布”可以是指该至少两种判定结果中的每种判定结果的数量，或者，上述“判定结果的分布”可以是指该至少两种判定结果之间的比例，例如，上述“判定结果的分布”可以是指“是”和“否”的比例或数量。
作为示例而非限定，该通信系统100可以是基于区块链技术实现上述协商机制。
区块链技术实现了一种按照时间顺序将数据和信息区块以顺序相连的方式组成的一种链式数据结构，并以密码学方式保证的不可篡改和不可伪造的分布式存储。一般情况下，将区块链中的数据和信息称为“交易(Transaction)”。
区块链技术不是单项的技术，而是作为点对点传输、共识机制、分布式数据存储和密码学原理集成应用的系统，该系统具有全公开和防篡改的技术特性。
第一、点对点传输：参与区块链的节点是独立的、对等的，节点与节点之间通过点对点传输技术实现数据和信息的同步。节点可以是不同的物理机器，也可以是云端不同的实例。
第二、共识机制：区块链的共识机制是指多方参与的节点在预设的逻辑规则下，通过节点间的交互实现各节点对特定数据和信息达成一致的过程。共识机制需要依赖于良好设计的算法，因此不同的共识机制性能(如：交易的吞吐量TPS(Transaction Per Second：交易/秒)、达成共识的时延、耗费的计算资源、耗费的传输资源等)存在一定的差异。
第三、分布式数据存储：区块链中的分布式存储是参与该区块链的节点各自都存有独立的、完整的数据，保证了数据存储在节点间全公开。与传统的分布式数据存储不同，传统的分布式数据存储按照一定规则将数据分成多份进行备份或同步存储，而区块链分布式数据存储则依赖于区块链中各地位对等的、独立的节点间的共识来实现高一致性的数据存储。
第四、密码学原理：区块链通常是基于非对称加密技术实现可信的信息传播、校验等。
其中“区块”的概念是将一条或多条数据记录以“块”的形式组织，“区块”的大小可以根据实际应用场景自定义；而“链”是一种数据结构，该数据结构将存储数据记录的“区块”按照时间顺序并以哈希(HASH)技术相连。在区块链中，每个“区块”包含“区块头”和“区块体”两个部分，其中“区块体”包含打包进“区块”的交易记录；“区块头”包含“区块”中所有交易的根HASH和前一“区块”的HASH。区块链的数据结构保证了区块链上存储的数据具有不可篡改的特性。
区块链目前可以分为三类：公有链、联盟链和私有链。
公有链是指参与任何节点都可以作为区块链的共识节点(也可以称为共识计算节点)，进而参与区块链数据存储的共识计算并且匿名的维护该区块链，节点与节点之间相互不信任。此情况下，通信系统100中的任何节点均可以作为共识节点。
联盟链在公有链的基础上增加了准入权限，使得具有一定资格的节点才可以作为区块链的共识计算节点，进而参与该区块链数据存储的共识计算并维护该区块链，节点与节点之间存在一定的信任。此情况下，通信系统100中的具有网络运营商颁布的资格的节点，或者说，经过网络运营商批准的节点可以作为共识节点。
私有链相比联盟链的准入机制更加苛刻，使得该区块链以及区块链的共识计算节点为 私人独有，此情况下，通信系统100中由网络运营商控制或维护的节点为共识节点。
在本发明实施例中，该架构#2中的各节点可以为虚拟节点。或者说，该架构#2中的各节点的功能可以由运行在计算机设备上的虚拟机实现。
并且，该架构#2中的虚拟节点可以承载于在架构#1中的部分或全部实体中，或者说，实现该架构#2中的节点的功能的虚拟机可以安装并运行在架构#1中的实体(或者说，设备，或物理设备)中，例如，该架构#2中的虚拟节点可以承载于在架构#1中接入网设备或核心网设备中。
应理解，以上列举的该架构#2中的虚拟节点所承载于实体仅为示例性说明，本发明并未特别限定于此，该架构#2中的各虚拟节点所承载于不属于架构#1的实体设备。
例如，通信系统100可以包括面向通信系统100(具体的说，是通信系统100的架构#1)所使用的网络的运营商的服务器(以下，为了便于理解和区分，记作：服务器#A)，其中，该服务器#A可以是由上述运营商控制、管理或维护的服务器，并且，该架构#2中的一个或多个虚拟节点可以承载于该服务器#A。
再例如，通信系统100可以包括面向通终端设备的制造商的服务器(以下，为了便于理解和区分，记作：服务器#B)，其中，该服务器#B可以是由上述制造商控制、管理或维护的服务器，并且，该架构#2中的一个或多个虚拟节点可以承载于该服务器#B。
在本发明实施例中，该架构#2可以用于实现归属签约用户服务器(Home Subscriber Server,HSS)功能，或者过，该架构#2中的各节点可以构成开放归属签约用户服务器(Open Home Subscriber Server,OHSS)系统，该OHSS系统可以实现对终端设备的身份标识的发放、认证、鉴权和管理等功能。应理解，以上列举的该OHSS系统实现的功能仅为示例性说明，本发明并未限定于此，该该OHSS系统实现的功能可以与现有技术中HSS设备实现的功能相似。
作为示例而非限定，在本发明实施例中，通信系统100中还可以包括一个或多个共识节点，其中，每个非共识节点与至少一个共识节点通信连接，非共识节点可以基于共识节点的控制或指示，进行区块链数据的存储。
图3示出了通信系统100中能够架构#2中的共识节点的实体设备的一例。作为示例而非限定，如图3所示，在本发明实施例中，能够作为共识节点的实体设备可以包括：
上述服务器#A、上述服务器#B、网络设备(例如，接入网设备和/或核心网设备等)和第三方应用的服务器。
在本发明实施例中，终端设备的制造商(或者说，生产商)可以通过服务器#B(即，共识节点的一例)直接参与终端设备的身份标识的管理(例如，HSS实现的功能)，具体地说，终端设备的制造商可以通过服务器#B实现对终端设备的身份标识的发放与管理(随后，对该过程进行详细说明)。
并且，网络的运营商可以通过服务器#A(即，共识节点的另一例)直接参与终端设备的身份标识的管理，例如，网络的运营商可以通过服务器#A实现对终端设备的身份标识(即，制造商为终端设备分配的身份标识)的认证和管理(随后，对该过程进行详细说明)。
并且，网络设备的主要功能是对终端设备进行鉴权和认证，确保只有身份标识合法的终端设备才可以接入到运营商的网络。
第三方应用的服务器可以直接利用OHSS系统为终端设备分配的身份标识以及对该 终端设备的身份标识的认证结果。
应理解，以上列举的作为共识节点的实体设备仅为示例性说明，本发明并未限定于此。
例如，该通信系统100也可以不包括服务器#A，此情况下，网络的运营商可以通过网络设备(例如，接入网设备或核心网设备)实现服务器#A的后述功能。
再例如，该通信系统100也可以不包括服务器#A。
再例如，该通信系统100的共识节点可以不包括接入网设备。
再例如，该通信系统100的共识节点可以不包括核心网设备。
再例如，该通信系统100的共识节点可以不包括第三方应用的服务器。
在本发明实施例中，通信系统100中的实体设备可以通过注册方式，申请作为共识节点。
作为示例而非限定，在本发明实施例中，架构#2(或者说，本发明实施例的OHSS系统)可以由网络的运营商(例如，服务器#A)创建(或者说，初始化)。在本发明实施例中，OHSS系统可以基于区块链技术实现，初始化之后OHSS区块链的共识节点可以包括该网络的运营商控制的设备(例如，服务器#A或网络设备)。
并且，在本发明实施例中，网络的运营商可以向垂直行业、其他的网络运营商等开放OHSS系统的会员机制(member ship)，从而，可以实现多个设备(例如，服务器#B、第三方应用的服务器和网络设备等)共同维护和管理OHSS系统的区块链的数据(具体的说，是终端设备在网络中的身份标识)。
在本发明实施例中，通信系统中的设备是否能够作为共识节点可以是由网络管理员设置并通知给通信系统100中的各设备的。
或者，在本发明实施例中，也可以使系统中已经存在的共识节点协商确定请求作为共识节点的设备是否能够作为共识节点。
例如，在本发明实施例中，上述服务器#A与OHSS中已经存在的共识节点(例如，上述服务器#B等设备)进行协商，以可将网络设备(例如，接入网设备或核心网设备)注册成为OHSS系统(或者说，通信系统100的架构#2)中的共识节点。
以下，为了便于理解和说明，以服务器#A进行的针对使一个接入网设备(以下，为了便于理解和说明，记作接入网设备#A)作为共识节点的上述协商(或者说，注册)过程为例，对共识节点的注册过程进行示例性说明。
作为示例而非限定，在本发明实施例中，通信系统中的各共识节点可以采用加密机制进行通信，作为示例而非限定，发送端可以使用一个加密信息对需要传输的数据进行加密，生成加密后的数据，并将该数据发送至接收端，接收端根据与该加密信息相对应的解密信息对所接收到的数据进行解密，从而获取上述需要传输的数据。
为了便于理解，设上该服务器#A使用的加密信息为信息#1，设该服务器#A使用的解密信息为信息#2。
其中，该信息#1可以为服务器#A使用的私钥，信息#2可以为服务器#A使用的公钥。此情况下，作为示例而非限定，服务器#A与其他设备可以基于公钥基础设施(Public Key Infrastructure，PKI)技术使用该信息#1和信息#2进行通信。
或者，该信息#1可以为服务器#A使用的私钥，信息#2可以为服务器#A的标识，此情况下，作为示例而非限定，服务器#A与其他设备可以基于身份加密系统(Identity Based  Cryptosystem，IBC)技术使用该信息#1和信息#2进行通信。
需要说明的是，在本发明实施例中，通信系统100中的各共识节点能够通过广播的方式获知彼此的解密信息(例如，公钥或设备标识)。
作为示例而限定，在本发明实施例中，架构#2(或者说，OHSS系统)中的每个共识节点可以具有在该网络中能够唯一的指示该共识节点的身份标识，即，上述注册过程也可以理解为对共识节点的身份标识的发放和认证过程。
如图4所示，在S210，服务器#A可以为接入网设备#A分配一个标识(以下，为了便于理解和区分，记作：标识#A)。
作为示例而非限定，在本发明实施例中，服务器#A可以获知各共识节点验证某一标识是否能够作为身份标识的规则(以下，为了便于理解和说明，记作：规则#1)，从而，服务器#A可以基于规则#1确定该标识#A。
例如，该规则#1可以为：如果某一标识已经被通信系统100中已经存在的共识节点作为身份标识，则该标识不能再作为其他设备的身份标识。
再例如，该规则#1可以为，如果某一标识已经被携带在某一注册消息而在通信系统中被传播，则该标识不能作为在后传播的注册消息对应的设备作为身份标识。
再例如，在本发明实施例中，每个共识节点可以保存有一个标识列表，该标识列表可以记录有多个标识，此情况下，该规则#1可以为：如果某一标识已经记录在标识列表中，则该标识不能作为身份标识。其中，各共识节点保存的标识列表可以相同，也可以不同，本发明实施例并未特别限定。
从而，服务器#A可以基于上述规则#1，确定标识#A。
例如，服务器#A可以(例如，通过通信系统100内即存的各共识节点发送的广播消息)，获知各共识节点的身份标识。
从而，服务器可以使所确定的标识#A与通信系统100内即存的各共识节点的设备标识相异。
其后，该服务器#A可以与通信系统100中即存的一个或多个共识节点(以下，为了便于理解和说明，记作：共识节点#A)进行协商，以确定该标识#A是否能够作为接入网设备#A的身份标识。
具体的说，服务器#A可以根据信息#1对标识#A进行签名处理，以获得签名数据。
可选地，服务器#A还可以确定接入网设备#A使用的公钥(即，接入网设备#A使用的解密信息的一例)，并且，服务器#A可以根据信息#1对标识#A和该接入网设备#A使用的公钥进行签名处理，以获得签名数据。
其中，在本发明实施例中，在各共识节点之间传输(或者说，协商)的签名数据也可以称为“交易”，以下，为了便于理解和说明，将经过签名处理后得到的交易记作：
Figure PCTCN2018087935-appb-000001
其中，
Figure PCTCN2018087935-appb-000002
表示信息#1，ID eNBi表示标识#A，
Figure PCTCN2018087935-appb-000003
表示接入网设备#A使用的公钥。
其后，服务器#A可以保存该交易，即
Figure PCTCN2018087935-appb-000004
在S220，服务器#A可以将携带有
Figure PCTCN2018087935-appb-000005
的注册信息(以下，为了便于理解和说明，记作：Register#1)发送给共识节点#A。
在S230，共识节点#A可以根据信息#2对Register#1(或者说，注册信息#1)进行验证，如果验证通过，则共识节点#A可以确定该Register#1来自于合法设备，进而，共识节点#A可以确定该标识#A(或者，该标识#A和接入网设备#A使用的公钥)安全。
其后，共识节点#A可以对该标识#A进行验证，以确定该标识#A是否能够作为本次注册的对象(即，接入网设备#A)身份标识，或者说，共识节点#A可以确定该标识#A是否合法。例如，共识节点#A可以基于规则#1确定该标识#A是否能够作为本次注册的对象(即，接入网设备#A)身份标识。
即，共识节点#A可以得到针对标识#A的验证结果，该验证结果可以为：标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识，或者，标识#A不能作为本次注册的对象(即，接入网设备#A)身份标识。
作为示例而非限定，在本发明实施例中，共识节点#A可以获取预设的判定条件(以下，为了便于理解和区分，记作：判定条件#1)，并基于该判定条件#1，进行验证。
例如，该判定条件#1可以为：如果在一次注册之前，一个标识已经被存储在区块链中，则该标识不能够再作为本次注册的对象的身份标识。
从而，在确定标识#A已经存储在区块链中的情况下，共识节点#A可以确定验证结果为：标识#A不能作为本次注册的对象(即，接入网设备#A)身份标识。
在确定标识#A未存储在区块链中的情况下，共识节点#A可以确定验证结果为：标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识。
应理解，以上列举的判定条件因为示例性说明，本发明并未限定于此，例如，该判定条件#1还可以为：如果在一次注册之前，一个标识已经分配给一个通信系统中的一个设备，则该标识不能够再作为其他设备的身份标识。
在S240，包括该共识节点#A在内的至少两个共识节点(例如，可以包括上述服务器#A)可以基于各自的验证结果进行协商，以确定标识#A能否作为本次注册的对象(即，接入网设备#A)身份标识。
作为示例而非限定，例如，如果验证结果为标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识的共识节点的数量大于或等于预设的数量阈值#1，则协商结果可以为：标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识。
再例如，如果验证结果为标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识的共识节点的数量小于预设的数量阈值#2，则协商结果可以为：标识#A不能够作为本次注册的对象(即，接入网设备#A)身份标识。其中，上述数量阈值#1与数量阈值#2可以相同也可以不同，本发明并未特别限定。
例如，如果验证结果为标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识的共识节点在所有参与协商的共识节点中的比例大于或等于预设的比例阈值#1，则协商结果可以为：标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识。
再例如，如果验证结果为标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识的共识节点在所有参与协商的共识节点中的比例小于预设的比例阈值#1，则协商结 果可以为：标识#A不能够作为本次注册的对象(即，接入网设备#A)身份标识。其中，上述比例阈值#1与比例阈值#2可以相同也可以不同，本发明并未特别限定。
并且，在本发明实施例中，如果协商结果为标识#A能够作为本次注册的对象(即，接入网设备#A)身份标识，则各共识节点可以将该标识#A保存至区块链中。
作为示例而非限定，参与协商的一个或多个共识节点还可以向通信系统100中的各设备发送携带有认证信息#A的广播信息，该认证信息#A可以用于指示该标识#A在通信系统中有效，以便于后述接入等存在需要进行鉴权认证的过程时，认证方能够确定该标识#A通过认证。
可选地，在本发明实施例中，服务器#B可以发起注册成为共识节点的过程，与上述图4所示过程不同的是，服务器#B加密的对象是服务器#B为自身确定的标识，并且，对该标识加密时使用的是该服务器#B的私钥，并且，信息的接收端解密时使用的信息是该服务器#B的公钥或设备标识。除此以外，服务器#B可以发起注册成为共识节点的其他过程可以与上述图4所示过程相似，这里，为了避免赘述，省略其详细说明。
图5示出了终端设备#B的身份标识的发放过程的示意图，如图5所示，在S310，服务器#B可以为终端设备#B(即，第一终端设备的一例)分配一个标识(以下，为了便于理解和区分，记作：标识#B)。
作为示例而非限定，在本发明实施例中，服务器#B可以获知各共识节点验证某一标识是否能够作为身份标识的规则(以下，为了便于理解和说明，记作：规则#2)，从而，服务器#B可以基于规则#2确定该标识#B。
例如，该规则#2可以为：如果某一标识已经被通信系统100中已经存在的共识节点作为身份标识，则该标识不能再作为其他设备的身份标识。
再例如，该规则#2可以为，如果某一标识已经被携带在某一注册消息而在通信系统中被传播，则该标识不能作为在后传播的注册消息对应的设备作为身份标识。
再例如，在本发明实施例中，每个共识节点可以保存有一个标识列表，该标识列表可以记录有多个标识，此情况下，该规则#2可以为：如果某一标识已经记录在标识列表中，则该标识不能作为身份标识。其中，各共识节点保存的标识列表可以相同，也可以不同，本发明实施例并未特别限定。
从而，服务器#B可以基于上述规则#2，确定标识#B。
例如，服务器#B可以(例如，通过通信系统100内即存的各共识节点发送的广播消息)，获知各共识节点的身份标识。
从而，服务器可以使所确定的标识#B与通信系统100内即存的各共识节点的设备标识相异。
其后，该服务器#B可以将该标识#B发送给通信系统100中的一个或多个共识节点，以便于通信系统#100中的至少两个共识节点能够进行针对该标识#B是否能够作为终端设备#B的身份标识的协商。
作为示例而非限定，当服务器#B不是共识节点时，服务器#B可以不参与上述协商处理。
当服务器#B为共识节点时，服务器#B可以参与协商处理，以下，为了便于理解和说明，以服务器#B参与协商时的动作和流程为例，对上述协商的过程进行详细说明。
即，如图5所示，服务器#B可以与通信系统100中即存的一个或多个共识节点(以下，为了便于理解和说明，记作：共识节点#B)进行协商，以确定该标识#B是否能够作为终端设备#B的身份标识。
具体的说，服务器#B可以根据信息#3对标识#B进行签名处理，以获得签名数据。
可选地，服务器#B还可以确定终端设备#B使用的公钥，并且，服务器#B可以根据信息#3对标识#B和该终端设备#B使用的公钥进行签名处理，以获得签名数据。
其中，在本发明实施例中，在各共识节点之间传输(或者说，协商)的数据也可以称为“交易”，以下，为了便于理解和说明，将签名处理后的得到的交易记作：
Figure PCTCN2018087935-appb-000006
其中，
Figure PCTCN2018087935-appb-000007
表示信息#3，ID devj表示标识#B，
Figure PCTCN2018087935-appb-000008
表示终端设备#B使用的公钥。
其后，服务器#B可以保存该交易，即
Figure PCTCN2018087935-appb-000009
在S320，服务器#B可以将携带有
Figure PCTCN2018087935-appb-000010
的注册信息(以下，为了便于理解和说明，记作：Register#2)发送给共识节点#B(即，第一共识节点的一例)。
作为示例而非限定该共识节点#B可以为上述服务器#A，或者，该共识节点#B可以为经上述服务器#A注册成为共识节点的网络设备(例如，接入网设备或核心网设备)。
在S330，共识节点#B可以根据信息#2对Register#2(或者说，注册信息#2)进行验证，如果验证通过，则共识节点#A可以确定该Register#2来自于合法设备，进而，共识节点#B可以确定该标识#B(或者，该标识#B和终端设备#B使用的公钥)安全。
其后，共识节点#B可以对该标识#B进行验证，以确定该标识#B是否能够作为本次注册的对象(即，终端设备#B)身份标识，或者说，共识节点#B可以确定该标识#B是否合法。例如，共识节点#B可以基于规则#2确定该标识#B是否能够作为本次注册的对象(即，终端设备#B)身份标识。
即，共识节点#B可以得到针对标识#B的验证结果，该验证结果可以为：标识#B能够作为本次注册的对象(即，终端设备#B)身份标识，或者，标识#B不能作为本次注册的对象(即，终端设备#B)身份标识。
类似地，服务器#B可以得到针对标识#B的验证结果。
作为示例而非限定，在本发明实施例中，共识节点#B可以获取预设的判定条件(以下，为了便于理解和区分，记作：判定条件#2)，并基于该判定条件#2，进行验证。
例如，该判定条件#2可以为：如果在一次注册之前，一个标识已经被存储在区块链中，则该标识不能够再作为本次注册的对象的身份标识。
从而，在确定标识#B已经存储在区块链中的情况下，共识节点#B可以确定验证结果为：标识#B不能作为本次注册的对象(即，终端设备#B)身份标识。
在确定标识#B未存储在区块链中的情况下，共识节点#B可以确定验证结果为：标识#B能够作为本次注册的对象(即，终端设备#B)身份标识。
应理解，以上列举的判定条件因为示例性说明，本发明并未限定于此，例如，该判定条件#1还可以为：如果在一次注册之前，一个标识已经分配给一个通信系统中的一个设 备，则该标识不能够再作为其他设备的身份标识。
在S340，包括该共识节点#B在内的至少两个共识节点(例如，可以包括上述服务器#B)可以基于各自的验证结果进行协商，以确定标识#B能否作为本次注册的对象(即，终端设备#B)身份标识。
作为示例而非限定，例如，如果验证结果为标识#B能够作为本次注册的对象(即，终端设备#B)身份标识的共识节点的数量大于或等于预设的数量阈值#3，则协商结果可以为：标识#B能够作为本次注册的对象(即，终端设备#B)身份标识。
再例如，如果验证结果为标识#B能够作为本次注册的对象(即，终端设备#B)身份标识的共识节点的数量小于预设的数量阈值#4，则协商结果可以为：标识#B不能够作为本次注册的对象(即，终端设备#B)身份标识。其中，上述数量阈值#3与数量阈值#4可以相同也可以不同，本发明并未特别限定。
例如，如果验证结果为标识#B能够作为本次注册的对象(即，终端设备#B)身份标识的共识节点在所有参与协商的共识节点中的比例大于或等于预设的比例阈值#3，则协商结果可以为：标识#B能够作为本次注册的对象(即，终端设备#B)身份标识。
再例如，如果验证结果为标识#B能够作为本次注册的对象(即，终端设备#B)身份标识的共识节点在所有参与协商的共识节点中的比例小于预设的比例阈值#4，则协商结果可以为：标识#B不能够作为本次注册的对象(即，终端设备#B)身份标识。其中，上述比例阈值#3与比例阈值#4可以相同也可以不同，本发明并未特别限定。
并且，在本发明实施例中，如果协商结果为标识#B能够作为本次注册的对象(即，终端设备#B)身份标识，则各共识节点可以将该标识#B保存至区块链中。
作为示例而非限定，参与协商的一个或多个共识节点还可以向通信系统100中的各设备发送携带有认证信息#B的广播信息，该认证信息#B可以用于指示该标识#B在通信系统中有效，以便于后述接入等存在需要进行鉴权认证的过程时，认证方能够确定该标识#B通过认证。即，在本发明实施例中，通信系统100中的接入网设备(例如，上述接入网设备#A)能够确定该标识#B合法(例如，能够通过鉴权认证)。
由此，完成了终端设备#B的身份标识的发放过程，并且，由于终端设备#B的身份标识经过通信系统100中的共识节点(例如，服务器#A)的协商和验证，从而，能够确保该终端设备#B的身份标识能够用于该终端设备#B的认证、鉴权等。
需要说明的是，在本发明实施例中，针对上述验证结果的协商的结果，需要满足通信系统(例如，运营商)设定的规则，即，一个标识仅能够作为一个终端设备的身份标识。
在本法实施例中，服务器#B可以将经过上述协商和验证后的作为终端设备#B的身份标识的标识#B(即，ID devj)存储(或者说，烧制)入终端设备#B(或者说，终端设备#B的SIM卡)中。
此外，服务器#B还可以将该终端设备#B使用的公钥、该服务器#B使用的公钥和该服务器#A使用的公钥存储(或者说，烧制)入终端设备#B(或者说，终端设备#B的SIM卡)中。
作为示例而非限定，在本发明实施例中，终端设备在通信系统中的标识(例如，上述终端设备的身份标识)可以包括但不限于现有技术中的全球用户识别模块(Universal Subscriber Identity Module，USIM)号码、客户识别模块(Subscriber Identification Module， SIM)号码，国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)，手机号码等。
下面，结合图6对终端设备#B(即，第一终端设备的一例)基于如上所述发放的身份标识(例如，上述标识#B)进行的入网鉴权与认证过程进行详细说明。
如图6所示，在S410，终端设备#B可以向接入网设备(例如，上述接入网设备#A)发送接入请求(例如，附着(Attach)请求)消息，该消息中可以携带有上述标识#B。
在S420，接入网设备#A可以查询本地是否保存有该标识#B(或者说，针对该标识#B的注册交易)，或者说，接入网设备#A可以查询本地是否保存有用于指示该标识#B合法的信息(以下，为了便于理解和说明，记作：信息#B)。
并且，如果本地保存有该标识#B或信息#B，则接入网设备#A可以进行S440。
如果本地未保存有该标识#B或信息#B，则接入网设备#A可以在S430向通信系统中的一个或多个共识节点(例如，服务器#A)发起查询该标识#B是否合法的查询过程。由于该标识#B经过通信系统100中的至少两个共识节点的协商认证，因此，接入网设备#A能够基于服务器#A的回复，确定标识#B合法。并且，服务器#A在该过程中可以将该终端设备#B使用的公钥一并发送给接入网设备#A。
在S440，接入网设备#A可以产生随机数M，并且，获取上述交易
Figure PCTCN2018087935-appb-000011
并且，接入网设备#A可以基于终端设备#B使用的公钥
Figure PCTCN2018087935-appb-000012
或者，终端设备#B的身份标识(例如，标识#B)，对该随机数M进行加密处理，生成密文#A。
在S450，接入网设备#A可以将该密文#A和
Figure PCTCN2018087935-appb-000013
发送给终端设备#B。
在S460，终端设备#B可以根据该终端设备#B使用的私钥
Figure PCTCN2018087935-appb-000014
(其中，该私钥
Figure PCTCN2018087935-appb-000015
与终端设备#B使用的公钥
Figure PCTCN2018087935-appb-000016
对应，或者，该私钥
Figure PCTCN2018087935-appb-000017
与终端设备#B的身份标识对应)对密文#A进行解密，进而获得随机数M。并且，该终端设备#B在获得作为身份标识的过程中，服务器#A可以将通信系统中的各接入网设备的标识下发给终端设备#B。从而，终端设备#B可以基于该
Figure PCTCN2018087935-appb-000018
确定接入网设备#A合法。其后，终端设备#B可以产生随机数#N，并且，终端设备#B可以根据接入网设备#A所使用的公钥
Figure PCTCN2018087935-appb-000019
或者，接入网设备#A的身份标识(即，标识#A)对随机数N和随机数M进行加密处理，以生成密文#B。
在S470，终端设备#B可以将密文#B发送给接入网设备#A。
在S480，接入网设备#A可以根据该接入网设备#A使用的私钥
Figure PCTCN2018087935-appb-000020
(其中，该私钥
Figure PCTCN2018087935-appb-000021
与接入网设备#A使用的公钥
Figure PCTCN2018087935-appb-000022
对应，或者，该私钥
Figure PCTCN2018087935-appb-000023
与接入网设备#A的身份标识对应)对密文#B进行解密，以获得随机数N和随机数M，从而，接入网设备#A完成了对终端设备#B的认证。
并且，接入网设备#A可以根据终端设备#B使用的公钥
Figure PCTCN2018087935-appb-000024
或者，终端设备#B的身份标识(即，标识#B)对随机数N进行加密，以生成密文#C。
在S490，接入网设备#A可以将密文#C发生给终端设备#B，从而，终端设备#B可以基于该终端设备#B使用的私钥
Figure PCTCN2018087935-appb-000025
(其中，该私钥
Figure PCTCN2018087935-appb-000026
与终端设备#B使用的公钥
Figure PCTCN2018087935-appb-000027
对应，或者，该私钥
Figure PCTCN2018087935-appb-000028
与终端设备#B的身份标识对应)对该密文#C进行解密，如果获得N，则终端设备#B完成了对接入网设备#A的认证，入网认证和鉴权结束。
根据本发明实施例的确定终端设备的标识的方法通过由第一终端设备的制造商的服务器确定第一标识，并将该第一标识发送给通信系统内的至少一个共识节点，并由通信系统中的至少两个共识节点协商确定该第一标识能否作为第一终端设备的身份标识，能够避免用户为终端设备获取身份标识的操作，从而能够改善用户体验，并且，由于该第一标识由制造商的服务器确定，能够降低运营商对于身份标识的分配和管理的负担和成本。
图7示出了本发明实施例的确定终端设备的标识的装置500的示意性框图，该装置500可以对应(例如，可以配置于或本身即为)上述方法300描述的共识节点#B(例如，服务器#A)，并且，装置500中各模块或单元分别用于执行上述方法300中共识节点#B所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
在本发明实施例中，该装置500可以包括：处理器和收发器，处理器和收发器通信连接，可选地，该设备还包括存储器，存储器与处理器通信连接。可选地，处理器、存储器和收发器可以通信连接，该存储器可以用于存储指令，该处理器用于执行该存储器存储的指令，以控制收发器发送信息或信号。
其中，图7所示的装置500中的收发单元可以对应该收发器，图7所示的装置500中的处理单元可以对应该处理器。
图8示出了本发明实施例的确定终端设备的标识的装置600的示意性框图，该装置600可以对应(例如，可以配置于或本身即为)上述方法300描述的服务器#B，并且，该装置600中各模块或单元分别用于执行上述方法300中服务器#B所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
在本发明实施例中，该装置600可以包括：处理器和收发器，处理器和收发器通信连接，可选地，该设备还包括存储器，存储器与处理器通信连接。可选地，处理器、存储器和收发器可以通信连接，该存储器可以用于存储指令，该处理器用于执行该存储器存储的指令，以控制收发器发送信息或信号。
其中，图8所示的装置600中的收发单元可以对应该收发器，图8所示的装置600中的处理单元可以对应该处理器。
应注意，上述方法实施例可以应用于处理器中，或者由处理器实现。处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA) 或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本发明实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本发明实施例的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明实施例的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的 部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明实施例各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明实施例的具体实施方式，但本发明实施例的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明实施例揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明实施例的保护范围之内。

Claims (30)

  1. 一种确定终端设备的标识的方法，其特征在于，在包括至少两个共识节点的通信系统中执行，所述方法包括：
    第一共识节点从第一服务器接收第一标识，其中，所述第一服务器是第一终端设备的制造商的服务器；
    所述第一共识节点与至少一个第二共识节点进行针对所述第一标识的协商，以确定所述第一标识是否能够作为第一终端设备在所述通信系统中的设备标识。
  2. 根据权利要求1所述的方法，其特征在于，所述第一共识节点是所述通信系统使用的网络的运营商的服务器。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一共识节点与至少一个共识节点进行针对所述第一标识的协商，包括：
    所述第一共识节点根据至少一个第二标识对所述第一标识进行验证，所述至少一个第二标识是经过至少两个共识节点协商后确定的，所述至少一个第二标识被分配给至少一个第二终端设备，其中
    在所述第一标识不属于所述至少一个第二标识的情况下，所述验证的结果为所述第一标识能够作为终端设备在所述通信系统中的设备标识，
    在所述第一标识属于所述至少一个第二标识，所述验证的结果为所述第一标识不能够作为终端设备在所述通信系统中的设备标识；
    所述第一共识节点根据所述验证的结果与至少一个第二共识节点进行针对所述第一标识的协商。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述第一共识节点从第一服务器接收第一标识，包括：
    所述第一共识节点从所述第一服务器接收注册信息，所述注册信息是所述第二服务器根据第一加密信息对所述第一标识进行加密处理后生成的；
    所述第一共识节点根据第一解密信息对所述注册信息进行解密，以确定所述第一标识安全，其中，所述第一解密信息与所述第一加密信息相对应，所述第一服务器是所述通信系统中的共识节点，所述第一解密信息是所述通信系统中的除所述第一服务器以外的共识节点与所述第一服务器通信时使用的解密信息。
  5. 根据权利要求4所述的方法，其特征在于，所述第一加密信息为所述第一服务器使用的私钥，
    所述第一解密信息是所述第一服务器使用的公钥，或
    所述第一解密信息是所述第一服务器的标识。
  6. 根据权利要求4或5所述的方法，其特征在于，所述注册信息是所述第二服务器根据第一加密信息对所述第一标识和所述第一终端设备使用的公钥进行加密处理后生成的。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一共识节点向所述第一服务器发送应答信息，所述应答信息用于指示所述第一 标识是否能够作为第一终端设备在所述通信系统中的设备标识。
  8. 根据权利要求1至7中任一项所述的方法，所述至少一个第二共识节点包括所述通信系统中的接入网设备、所述通信系统中的核心网设备、应用服务商的服务器和所述第一服务器中的至少一个设备。
  9. 一种确定终端设备的标识的方法，其特征在于，在包括至少两个共识节点的通信系统中执行，所述方法包括：
    第一服务器确定第一标识，其中，所述第一服务器是所述第一终端设备的制造商的服务器；
    所述第一服务器向至少一个第一共识节点发送所述第一标识，以便于包括所述至少一个第一共识节点在内的至少两个共识节点进行针对所述第一标识的协商，以确定所述第一标识是否能够作为第一终端设备在所述通信系统中的设备标识。
  10. 根据权利要求9所述的方法，其特征在于，所述第一服务器为所述通信系统中的共识节点，以及
    所述方法还包括：
    所述第一服务器与包括所述第一节点在内的至少一个共识节点进行针对所述第一标识的协商。
  11. 根据权利要求10所述的方法，其特征在于，所述第一服务器向至少一个第一共识节点发送所述第一标识，包括：
    所述第一服务器根据第一加密信息对所述第一标识进行加密处理，以生成注册信息，其中，所述第一加密信息与第一解密信息相对应，所述第一解密信息是所述通信系统中的除所述第一服务器以外的共识节点与所述第一服务器通信时使用的解密信息；
    所述第一服务器向至少一个第一共识节点发送所述注册信息。
  12. 根据权利要求11所述的方法，其特征在于，所述第一加密信息为所述第一服务器使用的私钥，
    所述第一解密信息是所述第一服务器使用的公钥，或
    所述第一解密信息是所述第一服务器的标识。
  13. 根据权利要求11或12所述的方法，其特征在于，所述第一服务器根据第一加密信息对所述第一标识进行加密处理，包括：
    所述第一服务器根据第一加密信息对所述第一标识和所述第一终端设备使用的公钥进行加密处理。
  14. 根据权利要求9至13中任一项所述的方法，其特征在于，第一服务器确定第一标识包括：
    所述第一服务器根据至少一个第二标识确定第一标识，以使所述第一标识与所述至少一个第二标识中的每个标识相异，所述至少一个第二标识是经过至少两个共识节点协商后确定的，所述至少一个第二标识被分配给至少一个第二终端设备。
  15. 根据权利要求9至14中任一项所述的方法，所述至少一个第一共识节点包括所述通信系统中的接入网设备、所述通信系统中的核心网设备、应用服务商的服务器和通信系统使用的网络的运营商的服务器中的至少一个设备。
  16. 一种确定终端设备的标识的装置，其特征在于，在包括至少两个共识节点的通信 系统中执行，所述装置为所述至少两个共识节点中的一个共识节点，所述装置包括：
    通信单元，用于从第一服务器接收第一标识，其中，所述第一服务器是第一终端设备的制造商的服务器；
    处理单元，用于控制所述通信单元与至少一个第二共识节点进行针对所述第一标识的协商，以确定所述第一标识是否能够作为第一终端设备在所述通信系统中的设备标识。
  17. 根据权利要求16所述的装置，其特征在于，所述装置配置于或本身即为所述通信系统使用的网络的运营商的服务器。
  18. 根据权利要求16或17所述的装置，其特征在于，所述处理单元还用于根据至少一个第二标识对所述第一标识进行验证，所述至少一个第二标识是经过至少两个共识节点协商后确定的，所述至少一个第二标识被分配给至少一个第二终端设备，其中
    在所述第一标识不属于所述至少一个第二标识的情况下，所述验证的结果为所述第一标识能够作为终端设备在所述通信系统中的设备标识，
    在所述第一标识属于所述至少一个第二标识，所述验证的结果为所述第一标识不能够作为终端设备在所述通信系统中的设备标识；
    所述处理单元具体用于根据所述验证的结果控制所述通信单元与至少一个第二共识节点进行针对所述第一标识的协商。
  19. 根据权利要求16至18中任一项所述的装置，其特征在于，所述通信单元具体用于从所述第一服务器接收注册信息，所述注册信息是所述第二服务器根据第一加密信息对所述第一标识进行加密处理后生成的；
    所述处理单元还用于根据第一解密信息对所述注册信息进行解密，以确定所述第一标识安全，其中，所述第一解密信息与所述第一加密信息相对应，所述第一服务器是所述通信系统中的共识节点，所述第一解密信息是所述通信系统中的除所述第一服务器以外的共识节点与所述第一服务器通信时使用的解密信息。
  20. 根据权利要求19所述的装置，其特征在于，所述第一加密信息为所述第一服务器使用的私钥，
    所述第一解密信息是所述第一服务器使用的公钥，或
    所述第一解密信息是所述第一服务器的标识。
  21. 根据权利要求19或20所述的装置，其特征在于，所述注册信息是所述第二服务器根据第一加密信息对所述第一标识和所述第一终端设备使用的公钥进行加密处理后生成的。
  22. 根据权利要求16至21中任一项所述的装置，其特征在于，所述通信单元还用于所述第一服务器发送应答信息，所述应答信息用于指示所述第一标识是否能够作为第一终端设备在所述通信系统中的设备标识。
  23. 根据权利要求16至22中任一项所述的装置，所述至少一个第二共识节点包括所述通信系统中的接入网设备、所述通信系统中的核心网设备、应用服务商的服务器和所述第一服务器中的至少一个设备。
  24. 一种确定终端设备的标识的装置，其特征在于，在包括至少两个共识节点的通信系统中执行，所述装置包括：
    处理单元，用于确定第一标识，其中，所述装置配置于或本身即为所述第一终端设备 的制造商的服务器；
    通信单元，用于向至少一个第一共识节点发送所述第一标识，以便于包括所述至少一个第一共识节点在内的至少两个共识节点进行针对所述第一标识的协商，以确定所述第一标识是否能够作为第一终端设备在所述通信系统中的设备标识。
  25. 根据权利要求24所述的装置，其特征在于，所述装置为所述通信系统中的共识节点，以及
    所述处理单元还用于控制所述通信单元与包括所述第一节点在内的至少一个共识节点进行针对所述第一标识的协商。
  26. 根据权利要求25所述的装置，其特征在于，所述处理单元还用于根据第一加密信息对所述第一标识进行加密处理，以生成注册信息，其中，所述第一加密信息与第一解密信息相对应，所述第一解密信息是所述通信系统中的除所述装置以外的共识节点与所述装置通信时使用的解密信息；
    所述通信单元具体用于向至少一个第一共识节点发送所述注册信息。
  27. 根据权利要求26所述的装置，其特征在于，所述第一加密信息为所述装置使用的私钥，
    所述第一解密信息是所述装置使用的公钥，或
    所述第一解密信息是所述装置的标识。
  28. 根据权利要求26或27所述的装置，其特征在于，所述处理单元具体用于根据第一加密信息对所述第一标识和所述第一终端设备使用的公钥进行加密处理。
  29. 根据权利要求24至28中任一项所述的装置，其特征在于，所述处理单元具体用于根据至少一个第二标识，确定第一标识，以使所述第一标识与所述至少一个第二标识中的每个标识相异，所述至少一个第二标识是经过至少两个共识节点协商后确定的，所述至少一个第二标识被分配给至少一个第二终端设备。
  30. 根据权利要求24至29中任一项所述的装置，所述至少一个第一共识节点包括所述通信系统中的接入网设备、所述通信系统中的核心网设备、应用服务商的服务器和通信系统使用的网络的运营商的服务器中的至少一个设备。
PCT/CN2018/087935 2017-05-31 2018-05-23 确定终端设备的标识的方法和装置 WO2018219181A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710398007.7A CN108990048B (zh) 2017-05-31 2017-05-31 确定终端设备的标识的方法和装置
CN201710398007.7 2017-05-31

Publications (1)

Publication Number Publication Date
WO2018219181A1 true WO2018219181A1 (zh) 2018-12-06

Family

ID=64456348

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/087935 WO2018219181A1 (zh) 2017-05-31 2018-05-23 确定终端设备的标识的方法和装置

Country Status (2)

Country Link
CN (1) CN108990048B (zh)
WO (1) WO2018219181A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112448928A (zh) * 2019-08-31 2021-03-05 华为技术有限公司 一种获取凭据的方法及装置

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109413645B (zh) * 2017-08-16 2022-08-19 华为技术有限公司 接入认证的方法和装置
CN109639715B (zh) * 2019-01-04 2021-05-18 中国联合网络通信集团有限公司 避免双花攻击的方法、装置、设备及计算机可读存储介质
CN111865569B (zh) * 2019-04-28 2022-08-26 华为技术有限公司 一种密钥协商方法及装置
CN112637300B (zh) * 2019-06-18 2022-11-11 贝富（广州）新技术有限公司 基于区块链的影视信息分布式存储以及获取方法、装置
CN110839029B (zh) * 2019-11-14 2021-06-25 腾讯科技（深圳）有限公司 一种微服务注册方法和装置
CN112987580B (zh) * 2019-12-12 2022-10-11 华为技术有限公司 一种设备的控制方法、装置、服务器以及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150244690A1 (en) * 2012-11-09 2015-08-27 Ent Technologies, Inc. Generalized entity network translation (gent)
US20160358186A1 (en) * 2015-06-04 2016-12-08 Chronicled, Inc. Open registry for identity of things
WO2017079795A1 (en) * 2015-11-09 2017-05-18 Roger Hanna A distributed user profile identity verification system for e-commerce transaction security

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105701372B (zh) * 2015-12-18 2019-04-09 布比（北京）网络技术有限公司 一种区块链身份构建及验证方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150244690A1 (en) * 2012-11-09 2015-08-27 Ent Technologies, Inc. Generalized entity network translation (gent)
US20160358186A1 (en) * 2015-06-04 2016-12-08 Chronicled, Inc. Open registry for identity of things
WO2017079795A1 (en) * 2015-11-09 2017-05-18 Roger Hanna A distributed user profile identity verification system for e-commerce transaction security

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112448928A (zh) * 2019-08-31 2021-03-05 华为技术有限公司 一种获取凭据的方法及装置
CN112448928B (zh) * 2019-08-31 2022-04-05 华为技术有限公司 一种获取凭据的方法及装置

Also Published As

Publication number Publication date
CN108990048A (zh) 2018-12-11
CN108990048B (zh) 2020-12-01

Similar Documents

Publication Publication Date Title
CN109413645B (zh) 接入认证的方法和装置
WO2018219181A1 (zh) 确定终端设备的标识的方法和装置
US11229023B2 (en) Secure communication in network access points
US20180332471A1 (en) Wireless network connection method, wireless access point, server, and system
WO2018045817A1 (zh) 移动网络的认证方法、终端设备、服务器和网络认证实体
KR102398221B1 (ko) 무선 직접통신 네트워크에서 비대칭 키를 사용하여 아이덴티티를 검증하기 위한 방법 및 장치
US8838972B2 (en) Exchange of key material
US9258692B2 (en) Relay assisted peer discovery
US10009760B2 (en) Providing network credentials
WO2013118096A1 (en) Method, apparatus and computer program for facilitating secure d2d discovery information
KR20230054421A (ko) 셀룰러 슬라이싱된 네트워크들에서의 중계기 선택의 프라이버시
US9143321B2 (en) Communication protocol for secure communications systems
WO2019019853A1 (zh) 处理数据的方法、终端设备和网络设备
US20240113878A1 (en) Subscription Concealed Identifier (SUCI) Supporting Post-Quantum Cryptography
KR102062688B1 (ko) 모바일 광대역 네트워크 환경에서 제어 패킷 및 데이터 패킷을 보호하기 위한 방법 및 시스템
US11889307B2 (en) End-to-end security for roaming 5G-NR communications
WO2017026930A1 (en) Methods and devices for privacy enhancement in networks
WO2022184174A1 (en) Wlan multi-link tdls key derivation
WO2023283789A1 (zh) 一种安全通信方法及装置、终端设备、网络设备
US9960922B2 (en) Device-to-device communication security with authentication certificates
KR20240002666A (ko) 메신저 서비스를 제공하기 위한 방법, 시스템 및 비일시성의 컴퓨터 판독 가능한 기록 매체
WO2020147602A1 (zh) 一种认证方法、装置和系统
Xiong et al. Security analysis and improvements of IEEE standard 802.16 in next generation wireless metropolitan access network
US20220103357A1 (en) Method and apparatus for key management in mission critical data communication
US11632235B2 (en) Method and apparatus for handling security procedure in mc communication system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18809796

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18809796

Country of ref document: EP

Kind code of ref document: A1