WO2021093811A1 - 一种网络接入方法及相关设备 - Google Patents
一种网络接入方法及相关设备 Download PDFInfo
- Publication number
- WO2021093811A1 WO2021093811A1 PCT/CN2020/128381 CN2020128381W WO2021093811A1 WO 2021093811 A1 WO2021093811 A1 WO 2021093811A1 CN 2020128381 W CN2020128381 W CN 2020128381W WO 2021093811 A1 WO2021093811 A1 WO 2021093811A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- terminal
- ids
- authentication
- access
- network device
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3218—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
- H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/80—Wireless
Definitions
- This application relates to the field of communication technology, and in particular to a network access method and related equipment.
- wireless such as wireless fidelity WiFi
- Internet access Service public places must implement online real-name authentication.
- the network access service provider usually requires real-name authentication of the terminal.
- the most common method is to use the SMS verification code method to authenticate the real-name identification (ID) of the terminal, such as The mobile phone number is authenticated; as shown in Figure 1, the current conventional authentication process is as follows:
- the terminal 101 requests the network access service provider 102 to access the network;
- the network access service provider 102 requests the terminal 101 to provide a real-name ID
- the terminal 101 sends a real-name ID (such as a mobile phone number) to the network access service provider 102;
- the network access service provider 102 generates a token, such as a short message verification code, and requests the short message platform (identity provider, IDP) 103 to send the short message verification code to the terminal 101 corresponding to the real-name ID.
- a token such as a short message verification code
- the IDP103 sends the short message verification code (Token) to the terminal 101.
- Token short message verification code
- Only the terminal 101 with the mobile phone number can receive the short message verification code.
- the user inputs the short message verification code to the terminal 101, and the terminal 101 sends the short message verification code to the network access service provider 102.
- the network access service provider 102 compares the Token, that is, compares the SMS verification code sent by IDP103 to the terminal 101 and the SMS verification code received from the terminal 103, if the SMS verification code sent to the terminal is verified with the SMS verification code received from the terminal If the code is the same, the terminal is allowed to access.
- the network access service providers of public places (such as airports, parks, bars, shopping malls) cannot be fully trusted by the terminal.
- the network access service providers of these places may be tempted by their own commercial interests or the network system adopts Insufficient security measures are vulnerable to attacks and reveal privacy. Therefore, how to protect the network access security of the terminal in the public field is a technical problem being studied by those skilled in the art.
- the embodiment of the present application discloses a network access method and related equipment, which can protect the privacy and security of the terminal.
- an embodiment of the present application provides a network access method, which includes:
- the terminal sends a first request message to the management server, where the first request message is used to determine the identity of the terminal;
- the terminal receives the zero-knowledge token and n pairs of IDs sent by the management server, wherein each pair of IDs in the n pairs of IDs includes a first ID and a second ID, and the n pairs of IDs include n
- the first ID is obtained by encrypting the identity identifier, and the second ID in any pair of IDs is an ID after blinding the first ID in any pair of IDs;
- the zero-knowledge token is generated according to the n second IDs included in the n pairs of IDs; wherein, the zero-knowledge token is used for the terminal and the access network device to perform initial network access authentication, the The n pair ID is used for the terminal to perform subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the method further includes:
- the terminal receives a challenge response message sent by the network device under the condition of verifying that the zero-knowledge token is legal, where the challenge response message includes the signature of the access network device, the first random number, and Second random number
- the terminal verifies the challenge response message, and if the verification succeeds, sends zero-knowledge evidence to the access network device, where the zero-knowledge evidence is generated according to the second random number;
- the terminal accesses the access network device for the first time.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the method further includes:
- the terminal generates the intermediate node value on the path to the root node of the trusted Merkle tree according to the m second IDs in the m pair IDs in the n pairs of IDs, and m is a positive integer less than or equal to n;
- the terminal receives a signature for each of the m second IDs sent by the access network device, where the access network device is configured to perform the processing according to the intermediate node
- the access network device is configured to perform the processing according to the intermediate node
- the terminal determines m authentication keys with the access network device according to the signatures of the m second IDs, where one of the second IDs is used to determine one of the authentication keys; Each of the m authentication keys is used for the terminal and the access network device to perform network access authentication once.
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- the third possible implementation manner of the first aspect after any network access authentication is passed, the next network is executed after a preset time period.
- the authentication key used for any two network access authentications is determined according to different signatures of the second ID.
- the terminal determines and After the m authentication keys of the access network device, it further includes:
- the terminal sends a second network access request to the access network device, where the second network access request includes the i-th first ID and a third random number, where the i-th first ID is associated with
- the second ID used for calculating the i-th authentication key among the m authentication keys belongs to a pair of IDs;
- the terminal receives a first hash operation message authentication code HMAC sent by the access network device, where the first HMAC is the access network device according to the first key, the i-th first ID, and the Generated by the third random number, the first key is an encryption key that the access network device determines to communicate with the terminal according to the i-th first ID;
- the terminal verifies the first HMAC through the i-th authentication key, and if the verification succeeds, then according to the i-th authentication key, the i-th first ID, the third random number and The fourth random number generates the second HMAC;
- the terminal accesses the access network device again.
- an embodiment of the present application provides a network access method, which includes:
- the management server receives the first request message sent by the terminal, and determines the identity of the terminal according to the first request message;
- the management server encrypts the identity identifier to obtain n first IDs
- the management server performs blinding on the n first IDs to obtain n second IDs, wherein one of the first IDs is used for blinding to obtain one of the first IDs;
- the management server generates a zero-knowledge token according to the n second IDs;
- the management server sends the zero-knowledge token and n pairs of IDs to the terminal, wherein each pair of IDs in the n pairs of IDs includes one of the first ID and one of the second IDs, any pair of IDs
- the second ID in the ID is the ID after blinding the first ID in the any pair of IDs; wherein, the zero-knowledge token is used for the first network connection between the terminal and the access network device.
- the n pairs of IDs are used by the terminal to perform subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the management server generating a zero-knowledge token according to the n second IDs includes:
- the management server uses the n second IDs as leaf nodes to generate a root node value of a trusted Merkle tree
- the management server generates a zero-knowledge token according to the value of the root node of the Merkle tree.
- an embodiment of the present application provides a network access method, which includes:
- the access network device receives a first network access request sent by the terminal, where the first network access request includes a zero-knowledge token; the zero-knowledge token is generated according to n second IDs included in n pairs of IDs, The n second IDs are obtained by blinding the n first IDs respectively, and the n first IDs are obtained by encrypting the identity of the terminal;
- the access network device After passing the initial network access authentication of the terminal, the access network device performs subsequent network access authentication to the terminal based on n pairs of IDs, where each pair of IDs in the n pairs of IDs includes the n A first ID of the first ID type and a second ID of the n second IDs, and the second ID in any pair of IDs is the first ID in the pair of IDs ID after blinding.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the access network device performs initial network access authentication on the terminal based on the zero-knowledge token, including:
- the network device verifies whether the zero-knowledge token in the first network access request is legal
- the challenge response message includes the signature of the access network device, the first random number, and the second random number;
- the terminal is allowed to access the network.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the subsequent network access authentication is performed on the terminal based on the n-pair ID, include:
- the access network device receives the m second IDs among the m pair IDs in the n pair IDs and the intermediate node value on the path of the root node of the trusted Merkle tree sent by the terminal, and the intermediate node value Is generated according to the m second IDs;
- the value of the root node of the Merkle tree determined according to the intermediate node value is equal to the value of the root node of the stored Merkle tree
- the m second IDs are signed, and the value of the root node of the stored Merkle tree is equal to The value is sent to the access network device after the terminal successfully accesses the access network device;
- the access network device sends the signature of each of the m second IDs to the terminal, and the signature of each of the m second IDs Used for the terminal to generate m authentication keys; wherein one of the second IDs is used for generating one of the authentication keys;
- the access network device and the terminal perform network access authentication based on one authentication key among the m authentication keys.
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- each of the m authentication keys is used for all authentication keys.
- the terminal and the access network device perform one network access authentication, the next network access authentication is performed after a preset period of time after any network access authentication is passed, and the authentication secret used for any two network access authentications
- the key is determined according to the different signatures of the second ID.
- the access network device and the terminal are based on the m authentication secrets
- One of the authentication keys is used for network access authentication, including:
- the access network device receives a second network access request sent by the terminal, where the second network access request includes an i-th first ID and a third random number, where the i-th first ID Belongs to the same pair of IDs as the second ID used for calculating the i-th authentication key among the m authentication keys;
- the access network device generates a first hash operation message authentication code HMAC according to the first key, the i-th first ID, and the third random number, and the first key is based on the i-th A first ID to determine an encryption key for communicating with the terminal;
- the access network device receives a second HMAC, the second HMAC is sent by the terminal after the first HMAC is verified by the i-th authentication key, and the second HMAC is based on the Generated by the i-th authentication key, the i-th first ID, the third random number, and the fourth random number;
- the access network device verifies that the second HMAC is passed through the first key, the terminal is allowed to access the network again.
- an embodiment of the present application provides a network access terminal.
- the terminal includes a processor, a memory, and a transceiver.
- the memory is used to store a computer program, and the processor calls the computer program to execute Do as follows:
- a zero-knowledge token and n pairs of IDs are received through the transceiver, wherein each pair of IDs in the n pairs of IDs includes a first ID and a second ID, and the n pairs of IDs include n of the first IDs.
- the ID is obtained by encrypting the identity, the second ID in any pair of IDs is the ID after blinding the first ID in any pair of IDs; the zero-knowledge token It is generated according to the n second IDs included in the n pairs of IDs; wherein the zero-knowledge token is used for the first network access authentication between the terminal and the access network device, and the n pairs of IDs are used After the terminal accesses the access network device, subsequent network access authentication is performed with the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the processor is further configured to:
- the transceiver After receiving the zero-knowledge token and n pairs of IDs through the transceiver, send a first network access request to the access network device, where the first network access request includes the zero-knowledge token and First random number
- the challenge response message sent by the network device under the condition of verifying that the zero-knowledge token is legal is received through the transceiver, wherein the challenge response message includes the signature of the access network device, the first random Number and second random number;
- Verify the challenge response message and if the verification is passed, send zero-knowledge evidence to the access network device, where the zero-knowledge evidence is generated according to the second random number;
- the access network device If the zero-knowledge proof is verified by the access network device, the access network device is accessed for the first time.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the processor is further configured to:
- n After the terminal accesses the access network device, generate the intermediate node value on the path to the root node of the trusted Merkle tree according to the m second IDs among the m pair IDs in the n pairs of IDs, m is a positive integer less than or equal to n;
- the signature of each of the m second IDs sent by the access network device is received through the transceiver, where the access network device is configured to perform the processing according to the intermediate If the value of the root node of the Merkle tree determined by the node value is equal to the value of the root node of the stored Merkle tree, the second ID is signed, and the value of the root node of the stored Merkle tree is successfully connected to the terminal. Sent to the access network device after entering the access network device;
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- the next network is executed after a preset time period.
- the authentication key used for any two network access authentications is determined according to different signatures of the second ID.
- the processor is further configured to:
- a second network access request is sent to the access network device through the transceiver, so The second network access request includes the i-th first ID and the third random number, where the i-th first ID is used to calculate the i-th authentication key among the m authentication keys
- the second ID belongs to a pair of IDs
- the first HMAC is the access network device according to the first key and the i-th first ID
- the first key is an encryption key that the access network device determines to communicate with the terminal according to the i-th first ID
- the first HMAC is verified by the i-th authentication key, and if the verification is passed, the first HMAC is verified according to the i-th authentication key, the i-th first ID, the third random number, and the fourth random number. Number to generate the second HMAC;
- the access network device is accessed again.
- an embodiment of the present application provides a management server, which includes a processor, a memory, and a transceiver, where the memory is used to store a computer program, and the processor invokes the computer program to perform the following operations:
- the zero-knowledge token and n pairs of IDs are sent to the terminal through the transceiver, wherein each pair of IDs in the n pairs of IDs includes one of the first ID and one of the second ID, any pair The second ID in the ID is the ID after blinding the first ID in the any pair of IDs; wherein, the zero-knowledge token is used for the terminal and the access network device to perform the initial network
- the n pairs of IDs are used by the terminal to perform subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the generating of the zero-knowledge token according to the n second IDs is specifically:
- a zero-knowledge token is generated according to the value of the root node of the Merkle tree.
- an embodiment of the present application provides an access network device, the access network device includes a processor, a memory, and a transceiver, wherein the memory is used to store a computer program, and the processor invokes the computer program To perform the following operations:
- a first network access request sent by a terminal is received through the transceiver, where the first network access request includes a zero-knowledge token; the zero-knowledge token is generated according to n second IDs included in n pairs of IDs , The n second IDs are obtained by blinding the n first IDs respectively, and the n first IDs are obtained by encrypting the identity of the terminal;
- each pair of IDs in the n pairs of IDs includes one of the n first ID types A first ID and a second ID among the n second IDs, and the second ID in any pair of IDs is an ID after blinding the first ID in the arbitrary pair of IDs.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the first network access authentication of the terminal based on the zero-knowledge token is specifically:
- the transceiver If it is valid, send a challenge response message to the terminal through the transceiver, where the challenge response message includes the signature of the access network device, the first random number, and the second random number;
- the terminal is allowed to access the network.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- a second possible implementation manner of the sixth aspect it is characterized in that the subsequent network is performed on the terminal based on the n-pair ID.
- Access authentication specifically:
- the m second IDs of the m pair IDs in the n pairs of IDs and the intermediate node value on the root node path of the trusted Merkle tree sent by the terminal are received by the transceiver, and the intermediate node value is Generated according to the m second IDs;
- the value of the root node of the Merkle tree determined according to the intermediate node value is equal to the value of the root node of the stored Merkle tree
- the m second IDs are signed, and the value of the root node of the stored Merkle tree is equal to The value is sent to the access network device after the terminal successfully accesses the access network device;
- the signature of each of the m second IDs is sent to the terminal through the transceiver, and the signature of each of the m second IDs is used Generating m authentication keys in the terminal; wherein one of the second IDs is used to generate one of the authentication keys;
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- each of the m authentication keys is used for all authentication keys.
- the terminal and the access network device perform one network access authentication, the next network access authentication is performed after a preset period of time after any network access authentication is passed, and the authentication secret used for any two network access authentications
- the key is determined according to the different signatures of the second ID.
- the communication with the terminal is based on one of the m authentication keys
- the authentication key performs network access authentication, specifically:
- a second network access request sent by the terminal is received through the transceiver, where the second network access request includes the i-th first ID and a third random number, wherein the i-th first ID is associated with
- the second ID used for calculating the i-th authentication key among the m authentication keys belongs to a pair of IDs;
- a second HMAC is received through the transceiver, the second HMAC is sent by the terminal after the first HMAC is verified by the i-th authentication key, and the second HMAC is based on the Generated by the i-th authentication key, the i-th first ID, the third random number, and the fourth random number;
- the terminal is allowed to access the network again.
- an embodiment of the present application provides a terminal, and the terminal includes:
- the first sending unit is configured to send a first request message to the management server, where the first request message is used to determine the identity of the terminal;
- the first receiving unit is configured to receive a zero-knowledge token and n pairs of IDs, wherein each pair of IDs in the n pairs of IDs includes a first ID and a second ID, and the n pairs of IDs include n
- the first ID is obtained by encrypting the identity identifier, and the second ID in any pair of IDs is the ID after blinding the first ID in any pair of IDs; the zero knowledge The token is generated according to the n second IDs included in the n pairs of IDs; wherein, the zero-knowledge token is used for the first network access authentication between the terminal and the access network device, and the n pairs
- the ID is used for the terminal to perform subsequent network access authentication with the access network device after accessing the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the terminal further includes:
- the second sending unit is configured to send a first network access request to the access network device after the first receiving unit receives the zero-knowledge token and n pairs of IDs, wherein the first network access request Including the zero-knowledge token and the first random number;
- the second receiving unit is configured to receive a challenge response message sent by the network device under the condition of verifying that the zero-knowledge token is legal, wherein the challenge response message includes the signature of the access network device, the first A random number and a second random number;
- the first verification unit is configured to verify the challenge response message, and if the verification is passed, send a zero-knowledge proof to the access network device, where the zero-knowledge proof is generated based on the second random number;
- the first access unit is configured to access the access network device for the first time when the zero-knowledge proof is verified by the access network device.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the terminal further includes:
- the generating unit is configured to generate a path to the root node of a trusted Merkle tree according to the m second IDs among the m pairs of IDs in the n pairs of IDs after the terminal accesses the access network equipment
- the intermediate node value, m is a positive integer less than or equal to n;
- a third sending unit configured to send the m second IDs and the intermediate node value to the access network device
- the third receiving unit is configured to receive a signature for each of the m second IDs sent by the access network device, where the access network device is configured to receive the signature according to the If the value of the root node of the Merkle tree determined by the intermediate node value is equal to the value of the root node of the stored Merkle tree, the second ID is signed, and the value of the root node of the stored Merkle tree is the terminal Sent to the access network device after successfully accessing the access network device;
- a determining unit configured to determine m authentication keys with the access network device according to the signatures of the m second IDs, wherein one of the second IDs is used to determine one of the authentication keys, Each of the m authentication keys is used for the terminal and the access network device to perform network access authentication once.
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- the next network is executed after a preset time period.
- the authentication key used for any two network access authentications is determined according to different signatures of the second ID.
- the terminal further includes:
- the fourth sending unit is configured to send a second second ID to the access network device after the determining unit determines the m authentication keys with the access network device according to the signatures of the m second IDs.
- a network access request where the second network access request includes an i-th first ID and a third random number, wherein the i-th first ID and the i-th one among the m authentication keys are calculated.
- the second ID used for the authentication key belongs to a pair of IDs;
- the fourth receiving unit is configured to receive a first hash operation message authentication code HMAC sent by the access network device, where the first HMAC is the access network device according to the first key and the i-th An ID and the third random number, the first key is an encryption key that the access network device determines to communicate with the terminal according to the i-th first ID;
- the second verification unit is configured to verify the first HMAC through the i-th authentication key, and if the verification succeeds, then according to the i-th authentication key, the i-th first ID, and the i-th first HMAC. Three random numbers and a fourth random number generate the second HMAC;
- a fifth sending unit configured to send the second HMAC to the access network device
- the second access unit is configured to access the access network device again when the second HMAC is verified by the access network device through the first key.
- an embodiment of the present application provides a management server, and the management server includes:
- a receiving unit configured to receive a first request message sent by a terminal, and determine the identity of the terminal according to the first request message
- An encryption unit configured to encrypt the identity identifier to obtain n first IDs
- a blinding unit configured to perform blinding on the n first IDs to obtain n second IDs, wherein one of the first IDs is used for blinding to obtain one of the first IDs;
- a generating unit configured to generate a zero-knowledge token according to the n second IDs
- the sending unit is configured to send the zero-knowledge token and n pairs of IDs to the terminal, wherein each pair of IDs in the n pairs of IDs includes one of the first ID and one of the second IDs, any pair The second ID in the ID is the ID after blinding the first ID in the any pair of IDs; wherein, the zero-knowledge token is used for the terminal and the access network device to perform the initial network For access authentication, the n pairs of IDs are used by the terminal to perform subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the generating unit is configured to generate a zero-knowledge token according to the n second IDs, specifically:
- a zero-knowledge token is generated according to the value of the root node of the Merkle tree.
- an embodiment of the present application provides an access network device, and the access network device includes:
- the first receiving unit is configured to receive a first network access request sent by the terminal, where the first network access request includes a zero-knowledge token;
- the zero-knowledge token is n second IDs included according to n pairs of IDs Generated, the n second IDs are obtained by blinding n first IDs respectively, and the n first IDs are obtained by encrypting the identity of the terminal;
- the first authentication unit is configured to perform initial network access authentication on the terminal based on the zero-knowledge token
- the second authentication unit is configured to perform subsequent network access authentication on the terminal based on n pairs of IDs after passing the initial network access authentication for the terminal, where each pair of IDs in the n pairs of IDs includes the n A first ID of the first ID type and a second ID of the n second IDs, the second ID in any pair of IDs is a pair of the first ID in the any pair of IDs The ID after ID blinding.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the first authentication unit is configured to perform initial network access authentication on the terminal based on the zero-knowledge token, specifically:
- the challenge response message includes the signature of the access network device, the first random number, and the second random number;
- the terminal is allowed to access the network.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the second authentication unit performs subsequent network operations on the terminal based on n pairs of IDs.
- Access authentication specifically:
- the value of the root node of the Merkle tree determined according to the intermediate node value is equal to the value of the root node of the stored Merkle tree
- the m second IDs are signed, and the value of the root node of the stored Merkle tree is equal to The value is sent to the access network device after the terminal successfully accesses the access network device;
- the signature of each of the m second IDs is sent to the terminal, and the signature of each of the m second IDs is used by the terminal to generate m authentication keys; wherein one of the second IDs is used to generate one of the authentication keys;
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- each of the m authentication keys is used for all authentication keys.
- the terminal and the access network device perform one network access authentication, the next network access authentication is performed after a preset period of time after any network access authentication is passed, and the authentication secret used for any two network access authentications
- the key is determined according to the different signatures of the second ID.
- the communication with the terminal is based on one of the m authentication keys
- the authentication key performs network access authentication, specifically:
- the second network access request includes an i-th first ID and a third random number, wherein the i-th first ID is associated with the calculation of the m
- the second ID used by the i-th authentication key in the authentication key belongs to a pair of IDs
- the second HMAC is sent by the terminal after the terminal passes the i-th authentication key to verify the first HMAC, and the second HMAC is based on the i-th authentication key Key, the i-th first ID, the third random number, and the fourth random number;
- the terminal is allowed to access the network again.
- an embodiment of the present application provides a chip system.
- the chip system includes at least one processor, a memory, and an interface circuit.
- the memory, the transceiver, and the at least one processor are interconnected by wires, and the At least one memory stores a computer program; when the computer program is executed by the processor, the first aspect, or any possible implementation manner of the first aspect, or the second aspect, or any of the second aspects are implemented.
- the possible implementation is the method described in the third aspect, or any possible implementation of the third aspect.
- an embodiment of the present application provides a computer-readable storage medium in which a computer program is stored, and when it runs on a processor, it implements the first aspect, or the first aspect Any possible implementation manner, or the second aspect, or any possible implementation manner of the second aspect, the third aspect, or the method described in any possible implementation manner of the third aspect.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment, because the first ID contained in each pair of IDs is encrypted by encrypting the terminal’s identity. Obtained, the second ID in each pair of IDs is obtained by blinding the first ID among them, and the zero-knowledge token is not obtained directly based on the identity, so the terminal subsequently passes the zero-knowledge token and n
- the ID and the access network equipment are authenticated and communicated with the access network equipment, the information that can be traced back to the terminal's identity will not be leaked to the access network equipment, effectively protecting the privacy of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- Fig. 1 is a schematic flowchart of a method for accessing a network in the prior art
- FIG. 2 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
- FIG. 3 is a schematic flowchart of a network access method provided by an embodiment of the present application.
- 4A is a schematic diagram of a private information issuance process provided by an embodiment of the present application.
- 4B is a schematic structural diagram of a trusted tree provided by an embodiment of the present application.
- 4C is a schematic diagram of a message structure of a zero-knowledge token and n-pair ID provided by an embodiment of the present application;
- FIG. 5 is a schematic diagram of a process for first authenticating legitimacy according to an embodiment of the present application.
- FIG. 6 is a schematic diagram of a process for obtaining a blind signature token according to an embodiment of the present application.
- FIG. 7 is a schematic diagram of a subsequent legality authentication process provided by an embodiment of the present application.
- FIG. 8 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
- FIG. 9 is a schematic structural diagram of a management server provided by an embodiment of the present application.
- FIG. 10 is a schematic structural diagram of an access network device provided by an embodiment of the present application.
- FIG. 11 is a schematic structural diagram of another terminal provided by an embodiment of the present application.
- FIG. 13 is a schematic structural diagram of another access network device provided by an embodiment of the present application.
- Figure 2 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
- the system includes a terminal 201, an access network device 202, and a management server 203.
- the terminal 201, the access network device 202, and the management server 203 The servers 203 are connected by wire, or the terminal 201, the access network device 202 and the management server 203 are connected by wireless, or some two of them are connected by wire and the other two are connected by wireless.
- the terminal 201 is a device with network connection and privacy protection requirements, and its real identity information is managed by an identity manager.
- a corresponding computer program can be configured in the terminal 201 to realize the above-mentioned functions.
- the terminal may specifically be a handheld device (for example, a mobile phone, a tablet computer, a palmtop computer, a portable notebook, etc.), a vehicle-mounted device (for example, a car, a bicycle, an electric vehicle, an airplane, a ship, etc.), a wearable device (such as a smart watch) (Such as iWatch, etc.), smart bracelets, pedometers, etc.), smart home equipment (for example, refrigerators, TVs, air conditioners, etc.), smart robots, workshop equipment, various forms of user equipment (UE), mobile Station (mobile station, MS), terminal equipment (terminal equipment), etc.
- UE user equipment
- MS mobile station
- terminal equipment terminal equipment
- the management server 203 is used to manage the identity information of one or more terminals 201, for example, to receive a private information request sent by the terminal 201, and to authenticate the identity of the terminal 201 based on the private information request, so as to generate information for hiding the identity of the terminal 201
- a privacy ID is generated based on the identification ID of the terminal 201
- a blind ID is obtained by blinding the privacy ID
- a zero-knowledge token is generated based on the blind ID.
- the management server 203 has symmetric and asymmetric cryptographic computing capabilities.
- a corresponding computer program can be configured in the management server 203 to realize the above-mentioned functions.
- the management server 203 may be a single server or a server cluster composed of multiple servers.
- the access network device 202 is an entity that can provide network access, and it needs to authenticate the legitimacy of the terminal 201 to be accessed.
- the access network device 202 may be specifically a network access service provider that is not trusted by the terminal 201 and the management server 203, such as a wireless fidelity (WIFI) device in an airport, a WIFI device in a bar, and so on.
- the access network device 202 may also be a wireless access point (such as a base station (such as an eNB, gNB, etc.)) in a cellular network.
- FIG. 3 is a network access method provided by an embodiment of the present application. The method can be implemented based on the system shown in FIG. 2, and the method includes:
- S31 The management server issues private information to the terminal based on the identity of the terminal.
- the terminal requests a privacy identity from the management server; correspondingly, the management server generates a privacy identification ID for the terminal, which can be referred to as the first ID in the following, and blindly obtains the blinded ID by blinding the privacy ID, which can be referred to as the second Second ID, then generate a zero-knowledge token based on the blinded ID, and then send private information to the terminal.
- the private information includes a zero-knowledge token and a pair of private IDs.
- Each pair of IDs includes a private ID and a blinded ID, namely Including a first ID and a second ID.
- the issuance process shown in Figure 4A includes steps 1.1 to 1.5, where steps 1.1 to 1.5 are specifically as follows:
- the terminal sends the first request message to the management server.
- the terminal before the terminal needs to access the WIFI in a nearby public place, it sends the first request message to the management server of the operator through the cellular network.
- the management server of the operator can be regarded as a recognized safe network entity; in this scenario, the following description
- the access network equipment is the WIFI router in the public place.
- the first request message is used to determine the identity of the terminal.
- Two possible solutions are exemplified below:
- the first request message includes the terminal's identity PID UE (also called a permanent identifier), which is an identity that can be distinguished from other devices in a certain space, region, or time domain,
- PID UE also called a permanent identifier
- the identity can also be a mobile phone number, or the mobile phone’s international mobile equipment identity (IMEI), subscriber permanent identifier (SUPI), etc.
- IMEI international mobile equipment identity
- SUPI subscriber permanent identifier
- the terminal is a vehicle, and the identity identifier may be a driving license number, or frame number, or license plate number corresponding to the vehicle; when the terminal is another device, there will also be a corresponding identifier.
- the first request message may not include the identity of the terminal, but may include other information, which can allow the management server to directly or indirectly determine the identity of the terminal.
- the management server has established a session connection with the terminal in advance, and has stored the identity of the terminal; in this case, if the first request message carries the session identity of the session but does not carry the identity, the management server The identity of the terminal is determined based on the session identifier carried in the first request message, so as to be used for subsequent calculation processing.
- the management server receives the first request message and obtains the identity PID UE from it .
- the private key in the key can also be called the signature private key; r is the private key in the asymmetric key of the management server.
- the management server generates n pairs of IDs and zero-knowledge tokens according to the identity identification, as follows:
- n first IDs may be unrelated and independent of each other; the first ID may also be called a privacy ID,
- the n first IDs can be expressed as ⁇ EID 1 , EID 2 , EID 3 , EID 4 , ..., EID n-1 , EID n ⁇ , and each term in the formula represents a first ID.
- the n first IDs are respectively blinded using the blinding factor b shared with the terminal to obtain n second IDs, where one of the first IDs is used for blinding to obtain one of the second IDs, for example,
- the process of blinding is The output of the Greek function performs b exponential operations, and the second ID obtained by blinding the i-th first ID of the n first ID types can be called the i-th second ID, and the above EID i is the i-th ID First ID, the above B_EID i is the i-th second ID.
- a zero-knowledge token is generated according to the n second IDs; for example, a trusted Merkle tree is generated using the n second IDs as leaf nodes, and the root node value BlindRootID of the Merckle tree is obtained.
- the zero-knowledge token token can also be generated in other ways based on the n second IDs, and other calculation methods are not given here.
- the management server sends a zero-knowledge token and n pairs of IDs to the terminal.
- each pair of IDs in the n pairs of IDs includes a first ID and a second ID
- the second ID in any pair of IDs is the first ID in the pair of IDs.
- ID after blinding; for example, the n pairs of ID can be expressed as ⁇ (EID 1 , B_EID 1 ), (EID 2 , B_EID 2 )..., (EID n-1 , B_EID n-1 ), (EID n , B_EID n ) ⁇ , where (EID 1 , B_EID 1 ) is a pair of IDs, (EID 2 , B_EID 2 ) is also a pair of IDs, and so on.
- the format of the zero-knowledge token and the n-pair ID may be as shown in FIG. 4C.
- the terminal receives the zero-knowledge token and n pairs of IDs.
- the terminal may analyze the zero-knowledge token and/or the n-pair ID to obtain specific content therein.
- S32 The access network equipment and the terminal perform legality authentication for the first time.
- the terminal sends a message containing a zero-knowledge token (which can be referred to as a first network access request) to the access network device to request access to the network, and the access network device verifies the zero-knowledge token, and uses the digital certificate and The signature proves to the terminal the legitimacy of the identity of the access network device, and the terminal generates zero-knowledge evidence when verifying the legitimacy of the identity of the access network device to prove the legitimacy of the terminal's identity to the access network device.
- a zero-knowledge token which can be referred to as a first network access request
- the access network device verifies the zero-knowledge token, and uses the digital certificate and
- the signature proves to the terminal the legitimacy of the identity of the access network device, and the terminal generates zero-knowledge evidence when verifying the legitimacy of the identity of the access network device to prove the legitimacy of the terminal's identity to the access network device.
- the process of authenticating legitimacy shown in Figure 5 includes steps 2.1 to 2.9, where steps 2.1 to 2.9 are as follows:
- the terminal sends the first network access request to the access network device.
- the terminal can first update the zero-knowledge token received from the management server.
- the terminal also obtains the public key identifier PubKeyID of the management server, and generates the first random number nonce.
- the terminal sends a first network access request to the access network device.
- the first network access request may include the updated zero-knowledge token and the first random number, and of course may also include the management server's Public key identifier PubKeyID.
- the zero-knowledge token may not be updated and used directly when sending the first network access request.
- the access network device receives the first network access request, and then parses the first network access request to obtain the zero-knowledge token, the first random number, and the public key identifier PubKeyID of the management server. And other information.
- the message type of the first network access request may be message 1, that is, Msg1.
- the access network device verifies the first network access request.
- the access network device can learn that the terminal is requesting to join the network according to the first network access request. Therefore, the information in the first network access request needs to be verified.
- the verification process and other related processes can be as follows :
- the challenge response message includes the signature Sig1 of the access network device, the first random number, and the second random number, in addition to the PKI digital certificate of the access network device.
- the challenge response message may not include the first random number.
- the message type of the challenge response message may be message 2, namely Msg2.
- the access network device sends a challenge response message to the terminal.
- the terminal receives the challenge response message.
- the terminal verifies the challenge response message.
- the terminal verifies the legitimacy of the PKI digital certificate in the challenge response message, and if it is legal, verifies the legitimacy of the signature in the challenge response message based on the public key in the KPI digital certificate. Of course, it can further verify the validity of the signature in the challenge response message. The other content in the challenge response message is further verified. When all the items that need to be verified are verified, the terminal is considered to verify that the challenge response message is passed.
- the terminal sends zero-knowledge evidence to the access network equipment.
- the terminal can send the zero-knowledge evidence sig2 separately or carry it in a certain type of message for sending.
- the message carrying the zero-knowledge evidence sig2 can be called an authentication response message.
- the The message type of the authentication response message can be message 3, that is, Msg3.
- the access network equipment receives zero-knowledge evidence.
- the access network equipment and the terminal are authenticated for the first time, and the authentication result is legal.
- the network equipment allows the terminal to access the network; if m'is not equal to m, the zero-knowledge proof verification fails.
- the initial legality authentication between the access network equipment and the terminal is completed, and the authentication result is illegal.
- the network equipment does not allow the terminal to access the network.
- the access network equipment can send an error notification to the terminal to indicate that the authentication fails and cannot access the network.
- S33 The terminal obtains the blind signature token from the access network device.
- the terminal sends a blind signature request to the access network device.
- the access network device verifies the legality of the content that needs to be blindly signed according to the blind signature request. And sign it if it is legal to obtain a blind signature token, and then send the blind signature token to the terminal.
- the process for obtaining a blind signature token shown in Figure 6 includes steps 3.1 to 3.7, where steps 3.1 to 3.7 are as follows:
- the terminal generates the intermediate node value on the path to the root node of the trusted Merkle tree according to the m second IDs in the m pair IDs in the n pairs of IDs, and m is a positive integer less than or equal to n , That is, the m second IDs can be all of the n second IDs, or part of the n second IDs. When they are partial, they can be selected from the n second IDs according to the predefined rules.
- a selection part, or just a random selection part, the representation of the m second IDs can be ⁇ B_EID 1 , B_EID 2 (2003), B_EID m-1 , B_EID m ⁇ .
- m is equal to 1.
- the terminal sends a blind signature request to the access network device.
- the blind signature request includes the m second IDs and the intermediate node value, and the blind signature request can be carried in other information. Sending can also be sent independently.
- the access network device receives the blind signature request.
- the access network device can obtain the m second ID ⁇ B_EID 1 , B_EID 2 ..., B_EID m-1 , B_EID m ⁇ and the intermediate node from the blind signature request.
- the access network device signs the m second IDs in the blind signature request, as follows: According to the m second IDs ⁇ B_EID 1 , B_EID 2 ..., B_EID m-1 , B_EID m ⁇ and the above
- the intermediate node calculates the Merkle tree root node value BlindRoutID ′ , and further determines whether the current Merkle tree root node value BlindRoutID′ calculated by itself is equal to the Merkle tree root node value BlindRoutID in the zero-knowledge token received in the previous step, if Equal, the access network device uses its own private key a to sign each of the m second IDs ⁇ B_EID 1 , B_EID 2 (2003), B_EID m-1 , B_EID m ⁇ , and get access
- the terminal receives the signature of each of the m second IDs sent by the access network device.
- the terminal determines m authentication keys with the access network device according to the signature of the m second IDs, where the signature of a second ID is used to determine an authentication key; for example, the terminal determines an authentication key according to the i-th second ID.
- the generation timing for generating the m authentication keys is not limited here, and it can be generated in advance for backup, or it can be regenerated when it is needed.
- the m authentication keys are used for subsequent network access authentication between the terminal and the access network device. It should be noted that the corresponding application scenarios will be different if the value of m is different. For example, when m is greater than 1, it means that multiple authentication keys have been obtained at one time, because subsequent authentication is a continuous process ( That is to say, re-authentication is required every once in a while, the interval can be regular or irregular, depending on how to configure), so subsequent terminal and access network equipment verification (identification legality) does not have to be every time First, get an authentication key, and directly select an unused one from the multiple authentication keys to use. Of course, when m is equal to 1, the subsequent terminal and the access network equipment will directly use this authentication key when verifying (authentication legitimacy), and subsequent verification is required to obtain the authentication key again in advance. The method of obtaining can refer to the previous description.
- the signature obtained by signing the second ID by the access network device may also be referred to as a blind signature token.
- S34 The access network device and the terminal perform subsequent legality authentication.
- the terminal reconnects to the network based on the first ID according to a fixed period, or a fixed time interval, or a non-fixed time interval, or other rules.
- the access process requires re-validity authentication.
- the legality authentication process It is based on the above authentication key. For ease of understanding, the following is an example of a subsequent legality authentication process in conjunction with Figure 7.
- the legality authentication process shown in Figure 7 includes steps 4.1 to 4.9, where steps 4.1 to 4.9 are as follows:
- the terminal sends a second network access request to the access network device, where the second network access request includes the i-th first ID and a third random number, where the i-th first ID and The second ID used to calculate the i-th authentication key among the m authentication keys belongs to a pair of IDs, that is, the i-th first ID is the m first IDs corresponding to the m second IDs.
- One of the first IDs of the species specifically which of the m first IDs is not limited here, can be preset rules to select the i-th first ID from the m first ID species.
- the message type of the second network access request may be message 1, that is, Msg1.
- the access network device receives the second network access request.
- the access network device generates a first hash operation message authentication code HMAC according to the first key, the i-th first ID and the third random number, which can be expressed as HMAC1; for example, the access network device
- the first key K EIID0 can be calculated according to the i-th first ID EID i .
- the hash function can be implemented using the hash algorithm SHA256 or SM3. EID i and nonce3 are the inputs of the hash function.
- the access network device may also generate a random number, which may be called the fourth random number nonce4.
- the access network device sends the first HMAC and the fourth random number nonce4 to the terminal.
- the first HMAC and the fourth random number nonce4 may be encapsulated in a certain message for transmission.
- the message type of the message may be message 2, that is, Msg2.
- the terminal receives the first HMAC and the fourth random number nonce4.
- the terminal verifies the first HMAC. Since the second network access request sent by the terminal previously carries the i-th first ID, the terminal uses the i-th authentication corresponding to the i-th first ID
- the i-th authentication key K EIID on the terminal is the same as the i-th first key K EIID0 generated by the access network device.
- the terminal sends a second HMAC to the access network device, where the second HMAC is generated after the terminal passes the verification of the first HMAC, for example, according to the i-th authentication key and the i-th first ID
- the second HMAC may be encapsulated in a certain message for transmission.
- the message type of the message may be message 3, that is, Msg3.
- the access network device receives the second HMAC.
- the access network device and the terminal are currently authenticated for legality this time, and the authentication result is If it is illegal, the access network device does not allow the terminal to access the network.
- the access network device can send an error prompt to the terminal to indicate that the authentication fails and cannot access the network.
- the next network access authentication is performed after a preset period of time.
- the terminal can perform the next network access authentication according to a fixed period, or a fixed time interval, or a non-fixed time interval, or other rules are based on
- the privacy ID i.e. the first ID
- the key is different, the corresponding first ID is also different, and the corresponding second ID is also different.
- EID i can be used as the last 64-bit interface ID value of the source IPV6 address.
- the length of EID i is less than or equal to 64 bits. If the length of EID i is less than 64 bits, the extra interface can be filled.
- the audit subject can trace the identity of the terminal using the first ID, or second ID, or zero-knowledge token, or other information used by the terminal in the communication process, for example.
- the above-mentioned management server opens the corresponding relationship between the identity of the terminal and the first ID, or second ID, or zero-knowledge token, or other information to the audit subject, so the audit subject can find the corresponding terminal based on the corresponding relationship.
- the management server provides the audit subject with relevant rules for calculating the first ID and the second ID based on the identity, and the audit subject derives the corresponding identity based on the relevant rules to determine the corresponding terminal. It can be understood that the management server will not share information related to user privacy to the access network device.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment, because the first ID contained in each pair of IDs is through the identification of the terminal Encrypted, the second ID in each pair of IDs is obtained by blinding the first ID, and the zero-knowledge token is not directly obtained based on the identity, so the terminal subsequently passes the zero-knowledge order
- the ID and the access network equipment are authenticated and communicated with the ID card and the access network equipment, they will not leak information that can be traced back to the terminal's identity to the access network equipment, effectively protecting the privacy of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- FIG. 8 is a schematic structural diagram of a terminal 80 according to an embodiment of the present application.
- the terminal 80 may include a first sending unit 801 and a first receiving unit 802.
- the detailed description of each unit is as follows.
- the first sending unit 801 is configured to send a first request message to the management server, where the first request message is used to determine the identity of the terminal;
- the first receiving unit 802 is configured to receive a zero-knowledge token and n pairs of IDs, where each pair of IDs in the n pairs of IDs includes a first ID and a second ID, and the n pairs of IDs include n
- the first ID is obtained by encrypting the identity identifier, and the second ID in any pair of IDs is an ID after blinding the first ID in any pair of IDs; the zero The knowledge token is generated according to the n second IDs included in the n pairs of IDs; wherein the zero-knowledge token is used for the terminal and the access network device to perform initial network access authentication, and the n
- the ID is used for the terminal to perform subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the terminal further includes:
- the second sending unit is configured to send a first network access request to the access network device after the first receiving unit receives the zero-knowledge token and n pairs of IDs, wherein the first network access request Including the zero-knowledge token and the first random number;
- the second receiving unit is configured to receive a challenge response message sent by the network device under the condition of verifying that the zero-knowledge token is legal, wherein the challenge response message includes the signature of the access network device, the first A random number and a second random number;
- the first verification unit is configured to verify the challenge response message, and if the verification is passed, send a zero-knowledge proof to the access network device, where the zero-knowledge proof is generated according to the second random number;
- the first access unit is configured to access the access network device for the first time when the zero-knowledge proof is verified by the access network device.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the terminal further includes:
- the generating unit is configured to generate a path to the root node of a trusted Merkle tree according to the m second IDs among the m pairs of IDs in the n pairs of IDs after the terminal accesses the access network equipment
- the intermediate node value, m is a positive integer less than or equal to n;
- a third sending unit configured to send the m second IDs and the intermediate node value to the access network device
- the third receiving unit is configured to receive a signature for each of the m second IDs sent by the access network device, where the access network device is configured to receive the signature according to the If the value of the root node of the Merkle tree determined by the intermediate node value is equal to the value of the root node of the stored Merkle tree, the second ID is signed, and the value of the root node of the stored Merkle tree is the terminal Sent to the access network device after successfully accessing the access network device;
- a determining unit configured to determine m authentication keys with the access network device according to the signatures of the m second IDs, wherein one of the second IDs is used to determine one of the authentication keys;
- Each of the m authentication keys is used for the terminal and the access network device to perform network access authentication once.
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- next network access authentication is performed after a preset period of time after any one network access authentication is passed, and the authentication keys used for any two network access authentications are based on different ones.
- the signature of the second ID is confirmed.
- the terminal further includes:
- the fourth sending unit is configured to send a second second ID to the access network device after the determining unit determines the m authentication keys with the access network device according to the signatures of the m second IDs.
- a network access request where the second network access request includes an i-th first ID and a third random number, wherein the i-th first ID and the i-th one among the m authentication keys are calculated.
- the second ID used for the authentication key belongs to a pair of IDs;
- the fourth receiving unit is configured to receive a first hash operation message authentication code HMAC sent by the access network device, where the first HMAC is the access network device according to the first key and the i-th An ID and the third random number, the first key is an encryption key that the access network device determines to communicate with the terminal according to the i-th first ID;
- the second verification unit is configured to verify the first HMAC through the i-th authentication key, and if the verification succeeds, then according to the i-th authentication key, the i-th first ID, and the i-th first HMAC. Three random numbers and a fourth random number generate the second HMAC;
- a fifth sending unit configured to send the second HMAC to the access network device
- the second access unit is configured to access the access network device again when the second HMAC is verified by the access network device through the first key.
- FIG. 9 is a schematic structural diagram of a management server 90 provided by an embodiment of the present application.
- the management server 90 may include a receiving unit 901, an encryption unit 902, a blinding unit 903, a generating unit 904, and a sending unit 905. Among them, the detailed description of each unit is as follows.
- the receiving unit 901 is configured to receive a first request message sent by a terminal, and determine the identity of the terminal according to the first request message;
- the encryption unit 902 is configured to encrypt the identity identifier to obtain n first IDs
- the blinding unit 903 is configured to perform blinding on the n first IDs to obtain n second IDs, wherein one of the first IDs is used for blinding to obtain one of the first IDs;
- a generating unit 904 configured to generate a zero-knowledge token according to the n second IDs
- the sending unit 905 is configured to send the zero-knowledge token and n pairs of IDs to the terminal, where each pair of IDs in the n pairs of IDs includes one of the first ID and one of the second IDs, either The second ID in the pair ID is the ID after blinding the first ID in any pair of IDs; wherein, the zero-knowledge token is used for the terminal and the access network device to perform the initial For network access authentication, the n-pair ID is used for subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the generating unit 904 is configured to generate a zero-knowledge token according to the n second IDs, specifically:
- a zero-knowledge token is generated according to the value of the root node of the Merkle tree.
- the access network device 100 may include a first receiving unit 1001, a first authentication unit 1002, and a second authentication unit 1003. , Among them, the detailed description of each unit is as follows.
- the first receiving unit 1001 is configured to receive a first network access request sent by a terminal, where the first network access request includes a zero-knowledge token; the zero-knowledge token is n number of second networks included according to n pairs of IDs. ID generation, the n second IDs are obtained by blinding n first IDs, and the n first IDs are obtained by encrypting the identity of the terminal;
- the first authentication unit 1002 is configured to perform initial network access authentication on the terminal based on the zero-knowledge token
- the second authentication unit 1003 is configured to perform subsequent network access authentication on the terminal based on n pairs of IDs after passing the initial network access authentication for the terminal, where each pair of IDs in the n pairs of IDs includes the A first ID of the n first IDs and a second ID of the n second IDs, the second ID in any pair of IDs is a pair of the first ID in the any pair of IDs An ID after ID blinding.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the first authentication unit is configured to perform initial network access authentication on the terminal based on the zero-knowledge token, specifically:
- the challenge response message includes the signature of the access network device, the first random number, and the second random number;
- the terminal is allowed to access the network.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the second authentication unit performs subsequent network access authentication on the terminal based on the n-pair ID, specifically:
- the value of the root node of the Merkle tree determined according to the intermediate node value is equal to the value of the root node of the stored Merkle tree
- the m second IDs are signed, and the value of the root node of the stored Merkle tree is equal to The value is sent to the access network device after the terminal successfully accesses the access network device;
- the signature of each of the m second IDs is sent to the terminal, and the signature of each of the m second IDs is used by the terminal to generate m authentication keys; wherein one of the second IDs is used to generate one of the authentication keys;
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- each of the m authentication keys is used for the terminal and the access network device to perform network access authentication once, after any network access authentication is passed The next network access authentication is performed after a preset time period, and the authentication keys used for any two network access authentications are determined according to different signatures of the second ID.
- the performing network access authentication with the terminal based on one of the m authentication keys is specifically:
- the second network access request includes an i-th first ID and a third random number, wherein the i-th first ID is associated with the calculation of the m
- the second ID used by the i-th authentication key in the authentication key belongs to a pair of IDs
- the second HMAC is sent by the terminal after the terminal passes the i-th authentication key to verify the first HMAC, and the second HMAC is based on the i-th authentication key Key, the i-th first ID, the third random number, and the fourth random number;
- the terminal is allowed to access the network again.
- the terminal 110 includes a processor 1101, a memory 1102, and a transceiver 1103.
- the processor 1101, the memory 1102, and the transceiver 1103 are connected to each other through a bus. .
- the memory 1102 includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or Portable read-only memory (compact IDsc read-only memory, CD-ROM), the memory 1102 is used for related computer programs and data.
- the transceiver 1103 is used to receive and send data.
- the transceiver 1103 may be a radio frequency module, and the processor may be a baseband chip or a general-purpose chip.
- the processor 1101 may be one or more central processing units (CPUs).
- CPUs central processing units
- the processor 1101 is a CPU
- the CPU may be a single-core CPU or a multi-core CPU.
- the processor 1101 is configured to read the computer program stored in the memory 1102, and perform the following operations:
- a zero-knowledge token and n pairs of IDs are received through the transceiver, wherein each pair of IDs in the n pairs of IDs includes a first ID and a second ID, and the n pairs of IDs include n of the first IDs.
- the ID is obtained by encrypting the identity, the second ID in any pair of IDs is the ID after blinding the first ID in any pair of IDs; the zero-knowledge token It is generated according to the n second IDs included in the n pairs of IDs; wherein the zero-knowledge token is used for the first network access authentication between the terminal and the access network device, and the n pairs of IDs are used After the terminal accesses the access network device, subsequent network access authentication is performed with the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the processor is further configured to:
- the transceiver After receiving the zero-knowledge token and n pairs of IDs through the transceiver, send a first network access request to the access network device, where the first network access request includes the zero-knowledge token and First random number
- the challenge response message sent by the network device under the condition of verifying that the zero-knowledge token is legal is received through the transceiver, wherein the challenge response message includes the signature of the access network device, the first random Number and second random number;
- Verify the challenge response message and if the verification is passed, send zero-knowledge evidence to the access network device, where the zero-knowledge evidence is generated according to the second random number;
- the access network device If the zero-knowledge proof is verified by the access network device, the access network device is accessed for the first time.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the processor is further configured to:
- n After the terminal accesses the access network device, generate the intermediate node value on the path to the root node of the trusted Merkle tree according to the m second IDs among the m pair IDs in the n pairs of IDs, m is a positive integer less than or equal to n;
- the signature of each of the m second IDs sent by the access network device is received through the transceiver, where the access network device is configured to perform the processing according to the intermediate If the value of the root node of the Merkle tree determined by the node value is equal to the value of the root node of the stored Merkle tree, the second ID is signed, and the value of the root node of the stored Merkle tree is successfully connected to the terminal. Sent to the access network device after entering the access network device;
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- next network access authentication is performed after a preset period of time after any one network access authentication is passed, and the authentication keys used for any two network access authentications are based on different ones.
- the signature of the second ID is confirmed.
- the processor is further configured to:
- a second network access request is sent to the access network device through the transceiver, so The second network access request includes the i-th first ID and the third random number, where the i-th first ID is used to calculate the i-th authentication key among the m authentication keys
- the second ID belongs to a pair of IDs
- the first HMAC is the access network device according to the first key and the i-th first ID
- the first key is an encryption key that the access network device determines to communicate with the terminal according to the i-th first ID
- the first HMAC is verified by the i-th authentication key, and if the verification is passed, the first HMAC is verified according to the i-th authentication key, the i-th first ID, the third random number, and the fourth random number. Number to generate the second HMAC;
- the access network device is accessed again.
- FIG. 12 is a management server 120 provided by an embodiment of the present application.
- the management server 120 includes a processor 1201, a memory 1202, and a transceiver 1203.
- the processor 1201, the memory 1202, and the transceiver 1203 pass through a bus. Connect to each other.
- the memory 1202 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or Portable read-only memory (compact IDsc read-only memory, CD-ROM), the memory 1202 is used for related computer programs and data.
- the transceiver 1203 is used to receive and send data.
- the transceiver 1203 may be a radio frequency module
- the processor may be a baseband chip or a general-purpose chip.
- the processor 1201 may be one or more central processing units (CPU).
- CPU central processing units
- the CPU may be a single-core CPU or a multi-core CPU.
- the processor 1201 is configured to read the computer program stored in the memory 1202, and perform the following operations:
- the zero-knowledge token and n pairs of IDs are sent to the terminal through the transceiver, wherein each pair of IDs in the n pairs of IDs includes one of the first ID and one of the second ID, any pair The second ID in the ID is the ID after blinding the first ID in the any pair of IDs; wherein, the zero-knowledge token is used for the terminal and the access network device to perform the initial network
- the n pairs of IDs are used by the terminal to perform subsequent network access authentication with the access network device after the terminal accesses the access network device, and n is a positive integer greater than or equal to 1.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the generating of a zero-knowledge token according to the n second IDs is specifically:
- a zero-knowledge token is generated according to the value of the root node of the Merkle tree.
- FIG. 13 is an access network device 130 provided by an embodiment of the present application.
- the access network device 130 includes a processor 1301, a memory 1302, and a transceiver 1303.
- the devices 1303 are connected to each other through a bus.
- the memory 1302 includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or Portable read-only memory (compact IDsc read-only memory, CD-ROM), the memory 1302 is used for related computer programs and data.
- the transceiver 1303 is used to receive and send data.
- the transceiver 1303 may be a radio frequency module
- the processor may be a baseband chip or a general-purpose chip.
- the processor 1301 may be one or more central processing units (CPU).
- CPU central processing units
- the CPU may be a single-core CPU or a multi-core CPU.
- the processor 1301 is configured to read the computer program stored in the memory 1302, and perform the following operations:
- a first network access request sent by a terminal is received through the transceiver, where the first network access request includes a zero-knowledge token; the zero-knowledge token is generated according to n second IDs included in n pairs of IDs , The n second IDs are obtained by blinding the n first IDs respectively, and the n first IDs are obtained by encrypting the identity of the terminal;
- each pair of IDs in the n pairs of IDs includes one of the n first ID types A first ID and a second ID among the n second IDs, and the second ID in any pair of IDs is an ID after blinding the first ID in the arbitrary pair of IDs.
- the terminal first obtains the zero-knowledge token and n pairs of IDs from the management server before accessing the access network equipment. Since the first ID contained in each pair of IDs is obtained by encrypting the terminal’s identity, The second ID in each pair of IDs is obtained by blinding the first ID in it, and the zero-knowledge token is not obtained directly based on the identity. Therefore, the terminal subsequently passes the zero-knowledge token and n pairs of IDs. When performing access legality authentication and communication with the access network device, the information that can be traced back to the terminal's identity will not be leaked to the access network device, effectively protecting the privacy and security of the terminal.
- the n-pair ID is used for the subsequent legal authentication between the terminal and the access network equipment, that is, the terminal and the access network equipment
- the legality authentication between the two is a continuous and continuous process of changing the basis of authentication. Therefore, it is possible to avoid the access network equipment from deriving the identity of the terminal based on the terminal operation behavior or data during the communication with the terminal, which further protects the privacy of the terminal Safety.
- the audit subject can cooperate with the management server to trace the identity of the terminal when necessary.
- the first network access authentication of the terminal based on the zero-knowledge token is specifically:
- the transceiver If it is valid, send a challenge response message to the terminal through the transceiver, where the challenge response message includes the signature of the access network device, the first random number, and the second random number;
- the terminal is allowed to access the network.
- the terminal and the management server can complete the legality authentication based on the zero-knowledge token; in this process, the zero-knowledge token is used Instead of the terminal’s identity, it authenticates the legitimacy of the terminal, which protects the privacy and security of the terminal.
- the subsequent network access authentication of the terminal based on the n-pair ID is specifically:
- the m second IDs of the m pair IDs in the n pairs of IDs and the intermediate node value on the root node path of the trusted Merkle tree sent by the terminal are received by the transceiver, and the intermediate node value is Generated according to the m second IDs;
- the value of the root node of the Merkle tree determined according to the intermediate node value is equal to the value of the root node of the stored Merkle tree
- the m second IDs are signed, and the value of the root node of the stored Merkle tree is equal to The value is sent to the access network device after the terminal successfully accesses the access network device;
- the signature of each of the m second IDs is sent to the terminal through the transceiver, and the signature of each of the m second IDs is used Generating m authentication keys in the terminal; wherein one of the second IDs is used to generate one of the authentication keys;
- the management server only needs to sign the root node of the Merkle tree with a small amount of data to generate a zero-knowledge token, instead of requiring every second ID Signing to generate tokens or certificates greatly reduces the amount of calculation on the management server.
- the two parties generate the same authentication key (called the first key on the access network device side) based on the information provided by the other party and their own information; subsequent terminals and access network devices can proceed based on the authentication key
- the network access authentication does not need to generate a zero-knowledge token first for each network access authentication, which significantly reduces the computational overhead of network access authentication and improves the efficiency of network access authentication.
- each of the m authentication keys is used for the terminal and the access network device to perform network access authentication once, after any network access authentication is passed The next network access authentication is performed after a preset time period, and the authentication keys used for any two network access authentications are determined according to different signatures of the second ID.
- the performing network access authentication with the terminal based on one of the m authentication keys is specifically:
- a second network access request sent by the terminal is received through the transceiver, where the second network access request includes the i-th first ID and a third random number, wherein the i-th first ID is associated with
- the second ID used for calculating the i-th authentication key among the m authentication keys belongs to a pair of IDs;
- a second HMAC is received through the transceiver, the second HMAC is sent by the terminal after the first HMAC is verified by the i-th authentication key, and the second HMAC is based on the Generated by the i-th authentication key, the i-th first ID, the third random number, and the fourth random number;
- the terminal is allowed to access the network again.
- An embodiment of the present application also provides a chip system.
- the chip system includes at least one processor, a memory, and an interface circuit.
- the memory, the transceiver, and the at least one processor are interconnected by wires, and the at least one memory
- a computer program is stored therein; when the computer program is executed by the processor, the method flow shown in FIG. 3 is realized.
- the embodiment of the present application also provides a computer-readable storage medium in which a computer program is stored, and when it runs on a processor, the method flow shown in FIG. 3 is implemented.
- the embodiment of the present application also provides a computer program product.
- the computer program product runs on a processor, the method flow shown in FIG. 3 is implemented.
- the computer program can be stored in a computer readable storage medium.
- the computer program During execution, it may include the processes of the foregoing method embodiments.
- the aforementioned storage media include: ROM or random storage RAM, magnetic disks or optical discs and other media that can store computer program codes.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
本申请实施例提供一种网络接入方法及相关设备,该方法包括:终端向管理服务器发送第一请求消息,第一请求消息用于确定终端的身份标识;终端接收管理服务器发送的零知识令牌和n对ID,其中,n对ID中每对ID包括一个第一ID和一个第二ID,n对ID包括的n个第一ID为对身份标识进行加密得到的,任意一对ID中的第二ID为对任意一对ID中的第一ID盲化后的ID;零知识令牌为根据n对ID包括的n个第二ID生成的;其中,零知识令牌用于终端与接入网设备进行初次网络接入认证,n对ID用于终端接入接入网设备之后,与接入网设备进行后续网络接入认证。采用本申请实施例,能够保护终端的隐私安全。
Description
本申请要求于2019年11月14日提交中国专利局、申请号为201911125165.0、申请名称为“一种网络接入方法及相关设备”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请涉及通信技术领域,尤其涉及一种网络接入方法及相关设备。
随着通信技术的快速发展,通信设备的体量以及通信设备之间的信息交互量也越来越大;出于对非法或可疑流量的追踪审计目的,提供无线(如无线保真WiFi)上网服务的公共场所必须落实上网实名认证。例如,终端在请求接入公开场所WIFI时,网络接入服务提供方通常要求对终端进行实名认证,最常用的方法是使用短信验证码方式对终端的实名标识(identifier,ID)进行认证,如对手机号进行认证;如图1,目前常规的认证流程如下:
(1)终端101向网络接入服务提供方102请求接入网络;
(2)网络接入服务提供方102请求终端101提供实名ID;
(3)终端101发送实名ID(如手机号)给网络接入服务提供方102;
(4)网络接入服务提供方102生成一个令牌Token,如短信验证码,并请求短信平台(identity provider,IDP)103发送该短信验证码给实名ID对应的终端101。
(5)IDP103向该终端101发送该短信验证码(Token)。
(6)只有拥有该手机号码的终端101才能接收该短信验证码,用户向该终端101输入短信验证码,由该终端101将该短信验证码发给网络接入服务提供方102。该网络接入服务提供方102比对Token,即对比由IDP103发送给终端101的短信验证码与从终端103接收的短信验证码,若发送给终端的短信验证码与从该终端接收的短信验证码相同,则允许终端接入。
而实际上,公共场所(如机场、公园、酒吧、商场)的网络接入服务提供方并不能被终端完全信任,这些场所的网络接入服务提供方可能由于本身存在商业利益诱惑或者网络系统采取的安全措施不足容易遭受攻击而泄露隐私。因此,如何保护终端在公共场的网络接入安全是本领域的技术人员正在研究的技术问题。
发明内容
本申请实施例公开了一种网络接入方法及相关设备,能够保护终端的隐私安全。
第一方面,本申请实施例提供一种网络接入方法,该方法包括:
终端向管理服务器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;
所述终端接收所述管理服务器发送的零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份 标识进行加密得到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第一方面,在第一方面的第一种可能的实现方式中,所述终端接收所述管理服务器发送的零知识令牌和n对ID之后,还包括:
所述终端向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
所述终端接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
所述终端验证所述挑战响应消息,若验证通过,则向所述接入网设备发送零知识证据,所述零知识证据是根据所述第二随机数生成的;
若所述零知识证据被所述接入网设备验证通过,则所述终端初次接入所述接入网设备。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
结合第一方面,或者第一方面的上述任一种可能的实现方式,在第一方面的第二种可能的实现方式中,所述终端接入网设备之后,还包括:
所述终端根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;
所述终端向所述接入网设备发送所述m个所述第二ID和所述中间结点值;
所述终端接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
所述终端根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥, 其中,一个所述第二ID用于确定一个所述认证密钥;所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
结合第一方面,或者第一方面的上述任一种可能的实现方式,在第一方面的第三种可能的实现方式中,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
结合第一方面,或者第一方面的上述任一种可能的实现方式,在第一方面的第四种可能的实现方式中,所述终端根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,还包括:
所述终端向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
所述终端接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的,所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;
所述终端通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;
所述终端向所述接入网设备发送所述第二HMAC;
若所述第二HMAC被所述接入网设备通过所述第一密钥验证通过,则所述终端再次接入所述接入网设备。
第二方面,本申请实施例提供一种网络接入方法,该方法包括:
管理服务器接收终端发送的第一请求消息,并根据所述第一请求消息确定所述终端的身份标识;
所述管理服务器对所述身份标识进行加密得到n个第一ID;
所述管理服务器对所述n个第一ID分别进行盲化得到n个第二ID,其中,一个所述第一ID用于盲化得到一个所述第一ID;
所述管理服务器根据所述n个第二ID生成零知识令牌;
所述管理服务器向所述终端发送所述零知识令牌和n对ID,其中,所述n对ID中每 对ID包括一个所述第一ID和一个所述第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第二方面,在第二方面的第一种可能的实现方式中,所述管理服务器根据所述n个第二ID生成零知识令牌,包括:
所述管理服务器以所述n个第二ID为叶子节点生成可信Merkle树的根节点值;
所述管理服务器根据所述Merkle树的根节点值生成零知识令牌。
第三方面,本申请实施例提供一种网络接入方法,该方法包括:
接入网设备接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;
所述接入网设备基于所述零知识令牌对所述终端进行初次网络接入认证;
所述接入网设备对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终 端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第三方面,在第三方面的第一种可能的实现方式中,所述接入网设备基于所述零知识令牌对所述终端进行初次网络接入认证,包括:
所述接入网设备接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
所述网络设备验证所述第一网络接入请求中的零知识令牌是否合法;
若合法,则向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
所述接入网设备在所述终端验证所述挑战响应消息通过的情况下发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;
若所述接入网设备验证所述零知识证据通过,则允许所述终端接入网络。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
结合第三方面,或者第三方面的上述任一种可能的实现方式,在第三方面的第二种可能的实现方式中,所述基于n对ID对所述终端进行后续网络接入认证,包括:
所述接入网设备接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;
在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
所述接入网设备向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;
所述接入网设备与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
结合第三方面,或者第三方面的上述任一种可能的实现方式,在第三方面的第三种可能的实现方式中,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
结合第三方面,或者第三方面的上述任一种可能的实现方式,在第三方面的第四种可能的实现方式中,所述接入网设备与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,包括:
所述接入网设备接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;
所述接入网设备向所述终端发送所述第一HMAC;
所述接入网设备接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;
若所述接入网设备通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
第四方面,本申请实施例提供的一种网络接入终端,该终端包括处理器、存储器和收发器,所述存储器用于存储计算机程序,所述处理器调用所述计算机程序,用于执行如下操作:
通过所述收发器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;
通过所述收发器接收零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份标识进行加密得到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的 终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第四方面,在第四方面的第一种可能的实现方式中,所述处理器还用于:
在通过所述收发器接收零知识令牌和n对ID之后,向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
通过所述收发器接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
验证所述挑战响应消息,若验证通过,则向所述接入网设备发送零知识证据,所述零知识证据是根据所述第二随机数生成的;
若所述零知识证据被所述接入网设备验证通过,则初次接入所述接入网设备。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
结合第四方面,或者第四方面的上述任一种可能的实现方式,在第四方面的第二种可能的实现方式中,所述处理器还用于:
在所述终端接入所述接入网设备之后,根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;
通过所述收发器向所述接入网设备发送所述m个所述第二ID和所述中间结点值;
通过所述收发器接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥,其中,一个所述第二ID用于确定一个所述认证密钥;所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
结合第四方面,或者第四方面的上述任一种可能的实现方式,在第四方面的第三种可能的实现方式中,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外, 由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
结合第四方面,或者第四方面的上述任一种可能的实现方式,在第四方面的第四种可能的实现方式中,所述处理器还用于:
在根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,通过所述收发器向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
通过所述收发器接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的,所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;
通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;
通过所述收发器向所述接入网设备发送所述第二HMAC,
若所述第二HMAC被所述接入网设备通过所述第一密钥验证通过,则再次接入所述接入网设备。
第五方面,本申请实施例提供一种管理服务器,该服务器包括处理器、存储器和收发器,其中,存储器用于存储计算机程序,所述处理器调用所述计算机程序,用于执行如下操作:
通过所述收发器接收终端发送的第一请求消息,并根据所述第一请求消息确定所述终端的身份标识;
对所述身份标识进行加密得到n个第一ID;
对所述n个第一ID分别进行盲化得到n个第二ID,其中,一个所述第一ID用于盲化得到一个所述第一ID;
根据所述n个第二ID生成零知识令牌;
通过所述收发器向所述终端发送所述零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个所述第一ID和一个所述第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个 持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第五方面,在第五方面的第一种可能的实现方式中,所述根据所述n个第二ID生成零知识令牌,具体为:
以所述n个第二ID为叶子节点生成可信Merkle树的根节点值;
根据所述Merkle树的根节点值生成零知识令牌。
第六方面,本申请实施例提供一种接入网设备,该接入网设备包括处理器、存储器和收发器,其中,所述存储器用于存储计算机程序,所述处理器调用所述计算机程序,用于执行如下操作:
通过所述收发器接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;
基于所述零知识令牌对所述终端进行初次网络接入认证;
对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第六方面,在第六方面的第一种可能的实现方式中,所述基于所述零知识令牌对所述终端进行初次网络接入认证,具体为:
通过所述收发器接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
验证所述第一网络接入请求中的零知识令牌是否合法;
若合法,则通过所述收发器向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
在所述终端验证所述挑战响应消息通过的情况下通过所述收发器发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;
若验证所述零知识证据通过,则允许所述终端接入网络。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
结合第六方面,或者第六方面的上述任一种可能的实现方式,在第六方面的第二种可能的实现方式中,其特征在于,所述基于n对ID对所述终端进行后续网络接入认证,具体为:
通过所述收发器接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;
在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
通过所述收发器向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;
与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
结合第六方面,或者第六方面的上述任一种可能的实现方式,在第六方面的第三种可能的实现方式中,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
结合第六方面,或者第六方面的上述任一种可能的实现方式,在第六方面的第四种可能的实现方式中,所述与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,具体为:
通过所述收发器接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i 个认证密钥用到的第二ID同属一对ID;
根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;
通过所述收发器向所述终端发送所述第一HMAC;
通过所述收发器接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;
若通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
第七方面,本申请实施例提供一种终端,该终端包括:
第一发送单元,用于向管理服务器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;
第一接收单元,用于接收零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份标识进行加密得到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第七方面,在第七方面的第一种可能的实现方式中,所述终端还包括:
第二发送单元,用于在所述第一接收单元接收零知识令牌和n对ID之后,向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
第二接收单元,用于接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
第一验证单元,用于验证所述挑战响应消息,若验证通过,则向所述接入网设备发送 零知识证据,所述零知识证据是根据所述第二随机数生成的;
第一接入单元,用于在所述零知识证据被所述接入网设备验证通过的情况下,则初次接入所述接入网设备。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
结合第七方面,或者第七方面的上述任一种可能的实现方式,在第七方面的第二种可能的实现方式中,所述终端还包括:
生成单元,用于在所述终端接入所述接入网设备之后,根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;
第三发送单元,用于向所述接入网设备发送所述m个所述第二ID和所述中间结点值;
第三接收单元,用于接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
确定单元,用于根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥,其中,一个所述第二ID用于确定一个所述认证密钥,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
结合第七方面,或者第七方面的上述任一种可能的实现方式,在第七方面的第三种可能的实现方式中,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
结合第七方面,或者第七方面的上述任一种可能的实现方式,在第七方面的第四种可能的实现方式中,所述终端还包括:
第四发送单元,用于在所述确定单元根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
第四接收单元,用于接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的,所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;
第二验证单元,用于通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;
第五发送单元,用于向所述接入网设备发送所述第二HMAC;
第二接入单元,用于在所述第二HMAC被所述接入网设备通过所述第一密钥验证通过的情况下,再次接入所述接入网设备。
第八方面,本申请实施例提供一种管理服务器,该管理服务器包括:
接收单元,用于接收终端发送的第一请求消息,并根据所述第一请求消息确定所述终端的身份标识;
加密单元,用于对所述身份标识进行加密得到n个第一ID;
盲化单元,用于对所述n个第一ID分别进行盲化得到n个第二ID,其中,一个所述第一ID用于盲化得到一个所述第一ID;
生成单元,用于根据所述n个第二ID生成零知识令牌;
发送单元,用于向所述终端发送所述零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个所述第一ID和一个所述第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第八方面,在第八方面的第一种可能的实现方式中,所述生成单元,用于根据所述n个第二ID生成零知识令牌,具体为:
以所述n个第二ID为叶子节点生成可信Merkle树的根节点值;
根据所述Merkle树的根节点值生成零知识令牌。
第九方面,本申请实施例提供一种接入网设备,该接入网设备包括:
第一接收单元,用于接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;
第一认证单元,用于基于所述零知识令牌对所述终端进行初次网络接入认证;
第二认证单元,用于对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
结合第九方面,在第九方面的第一种可能的实现方式中,所述第一认证单元,用于基于所述零知识令牌对所述终端进行初次网络接入认证,具体为:
接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
验证所述第一网络接入请求中的零知识令牌是否合法;
若合法,则向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
在所述终端验证所述挑战响应消息通过的情况下发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;
若所述接入网设备验证所述零知识证据通过,则允许所述终端接入网络。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
结合第九方面,或者第九方面的上述任一种可能的实现方式,在第九方面的第二种可能的实现方式中,所述第二认证单元基于n对ID对所述终端进行后续网络接入认证,具体为:
接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;
在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;
与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
结合第九方面,或者第九方面的上述任一种可能的实现方式,在第九方面的第三种可能的实现方式中,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
结合第九方面,或者第九方面的上述任一种可能的实现方式,在第九方面的第四种可能的实现方式中,所述与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,具体为:
接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;
向所述终端发送所述第一HMAC;
接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;
若通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
第十方面,本申请实施例提供一种芯片系统,所述芯片系统包括至少一个处理器,存 储器和接口电路,所述存储器、所述收发器和所述至少一个处理器通过线路互联,所述至少一个存储器中存储有计算机程序;所述计算机程序被所述处理器执行时,实现第一方面,或者第一方面的任一可能的实现方式,或者第二方面,或者第二方面的任一可能的实现方式,第三方面,或者第三方面的任一可能的实现方式所描述的方法。
第十一方面,本申请实施例提供一种计算机可读存储介质,所述计算机可读存储介质中存储有计算机程序,当其在处理器上运行时,实现第一方面,或者第一方面的任一可能的实现方式,或者第二方面,或者第二方面的任一可能的实现方式,第三方面,或者第三方面的任一可能的实现方式所描述的方法。
通过实施本申请实施例,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
以下对本申请实施例用到的附图进行介绍。
图1是现有技术中的一种接入网络方法的流程示意图;
图2是本申请实施例提供的一种通信系统的结构示意图;
图3是本申请实施例提供的一种网络接入方法的流程示意图;
图4A是本申请实施例提供的一种隐私信息的颁发流程示意图;
图4B是本申请实施例提供的一种可信树的结构示意图;
图4C是本申请实施例提供的一种零知识令牌和n对ID的消息结构示意图;
图5是本申请实施例提供的一种初次鉴别合法性的流程示意图;
图6是本申请实施例提供的一种获取盲签名令牌的流程示意图;
图7是本申请实施例提供的一种后续进行合法性鉴别的流程示意图;
图8是本申请实施例提供的一种终端的结构示意图;
图9是本申请实施例提供的一种管理服务器的结构示意图;
图10是本申请实施例提供的一种接入网设备的结构示意图;
图11是本申请实施例提供的又一种终端的结构示意图;
图12是本申请实施例提供的又一种管理服务器的结构示意图;
图13是本申请实施例提供的又一种接入网设备的结构示意图。
下面结合本申请实施例中的附图对本申请实施例进行描述。
请参见图2,图2是本申请实施例提供的一种通信系统的结构示意图,该系统包括终端201、接入网设备202和管理服务器203,其中,终端201、接入网设备202和管理服务器203之间通过有线进行连接,或者终端201、接入网设备202和管理服务器203之间通过无线进行连接,或者其中某两个之间通过有线连接另外两个之间通过无线连接。
该终端201为具备连接网络和保护隐私需求的设备,其真实身份信息由身份管理者管理。可以在该终端201中配置相应的计算机程序来实现上述功能。例如,该终端可以具体为手持设备(例如,手机、平板电脑、掌上电脑、便携笔记本等)、车载设备(例如,汽车、自行车、电动车、飞机、船舶等)、可穿戴设备(如智能手表(如iWatch等)、智能手环、计步器等)、智能家居设备(例如,冰箱、电视、空调等)、智能机器人、车间设备、各种形式的用户设备(user equipment,UE)、移动台(mobile station,MS)、终端设备(terminal equipment),等等。
管理服务器203用于管理一个或者多个终端201的身份信息,例如,用于接收终端201发送的隐私信息请求,基于该隐私信息请求对终端201的身份进行鉴别,从而生成用于隐藏终端201身份的隐私信息,例如,基于终端201的身份标识ID来生成隐私ID,对隐私ID进行盲化得到盲化ID,基于盲化ID生成零知识令牌等。可以理解,管理服务器203具备对称和非对称密码计算能力。另外,可以在该管理服务器203中配置相应的计算机程序来实现上述功能。该管理服务器203可以为单个服务器,也可以为由多个服务器组成的服务器集群。
接入网设备202为能过提供网络接入的实体,其需要对待接入的终端201的合法性进行鉴别。可选的,接入网设备202可以具体为不被终端201和管理服务器203信任的网络接入服务提供者,如机场的无线保真(wireless fidelity,WIFI)设备、酒吧的WIFI设备等。可选的,该接入网设备202还可以为蜂窝网络中的无线接入点(如基站(如eNB、gNB等))。
请参见图3,图3是本申请实施例提供的一种网络接入方法,该方法可以基于图2所示的系统来实现,该方法包括:
S31:管理服务器基于终端的身份标识向终端颁发隐私信息。
具体地,终端向管理服务器请求隐私身份;相应的,该管理服务器为终端生成隐私身份标识ID,后续可称为第一ID,并对隐私ID进行盲化得到盲化ID,后续可称为第二ID,接着基于盲化ID生成零知识令牌,然后向终端发送隐私信息,该隐私信息包括零知识令牌和成对的隐私ID,每对ID包括一个隐私ID和一个盲化ID,即包括一个第一ID和一个第二ID。为了便于理解,下面结合图4A例举一种隐私信息的更具体的颁发过程,图4A所示的颁发过程包括步骤1.1-步骤1.5,其中,步骤1.1-步骤1.5具体如下:
1.1、终端向管理服务器发送第一请求消息。
例如,终端需要接入到附近公共场所的WIFI之前,通过蜂窝网络向运营商的管理服务器发送第一请求消息,运营商的管理服务器可以认为是被公认安全的网络实体;这个场景中,后续描述的接入网设备是就是该公共场所的WIFI的路由器。
该第一请求消息用于确定该终端的身份标识,下面例举两种可能方案:
方案一,所述第一请求消息包含所述终端的身份标识PID
UE(也可以称为永久标识符),该身份标识为能够在一定空间或者地域或者时域上与其他设备进行区分的标识,例如,如果该终端为手机,那么该身份标识还可以为手机号,或者该手机的国际移动设备身份(international mobile equipment identity,IMEI)、用户永久标识符(subscriber permanent identifier,SUPI)等等;如果该终端为车辆,该身份标识可以为车辆对应的行驶证编号、或者车架号、或者车牌号等;当该终端为其他设备时,也会有对应的标识。
方案二,该第一请求消息中也可以不包含该终端的身份标识,而是包含其他信息,该其他信息能够让管理服务器直接或者间接的确定出该终端的身份标识。例如,该管理服务器已经预先与终端建立了会话连接,且存储了该终端的身份标识;这种情况下,该第一请求消息中携带该会话的会话标识但未携带该身份标识,该管理服务器基于该第一请求消息携带的会话标识确定出该终端的身份标识,以用于后续的计算处理。
1.2、管理服务器接收第一请求消息,从中获取身份标识PID
UE。
可选的,该管理服务器还从存储的资料库中查询与该终端对应的公钥U=X
r、用于盲化的盲化因子b、以及该管理服务器的公钥PubK=(G,q,X,Y=X
k)以供后续使用,其中G是一个阶为q的循环群,X是G的生成元,K
E为管理服务器的对称加密的私钥,k为管理服务器的非对称密钥中的私钥,也可以称为签名私钥;r为管理服务器的非对称密钥中的私钥。这里涉及的某些参数也可能是终端或者其他设备发送给管理服务器的。
1.3、该管理服务器根据身份标识生成n对ID和零知识令牌,具体如下:
对该身份标识PID
UE使用管理服务器的私钥K
E进行加密得到n个第一ID;该n个第一ID之间可以互不关联,相互独立;该第一ID也可以称为隐私ID,该n个第一ID可以表示为{EID
1,EID
2,EID
3,EID
4,……,EID
n-1,EID
n},该式子中每一项代表一个第一ID。
使用与终端共享的盲化因子b对所述n个第一ID分别进行盲化得到n个第二ID,其中,一个所述第一ID用于盲化得到一个所述第二ID,例如,盲化的计算方式可以为B_EID
i=[H
1(EID
i)]
b,H
1()是一个单向哈希函数,可以采用杂凑算法SHA256或者SM3等实现,盲化的过程就是对该哈希函数的输出进行b次指数运算,对该n个第一ID种的第i个第一ID进行盲化后得到的第二ID可以称为第i个第二ID,上述EID
i为第i个第一ID,上述B_EID
i为第i个第二ID。
根据所述n个第二ID生成零知识令牌;例如,以该n个第二ID为叶子节点生成可信Merkle树,得到Merckle树的根节点值BlindRootID,该Merkle树如图4B所示。然后,生成一个随机数w,计算A=X
w(生成w和计算A也可以在其他时机预先完成),接着计算c=H
2(X,Y,A,U,BlindRootID),其中,H
2()是一个基于安全单向函数的算法,例如,可以采用哈希算法、杂凑算法SHA256或者SM3等实现;进一步计算s=(w-c*k)mod q,最后计算零知识令牌token={c,s,BlindRootID}。当然还可以通过其他方式基于n个第二ID生成零知识令牌token,其他计算方式此处不一一举例。
1.4、管理服务器向终端发送零知识令牌和n对ID。
具体地,所述n对ID中每对ID包括一个第一ID和一个第二ID,其中任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;例如,该n对ID可以 表示为{(EID
1,B_EID
1),(EID
2,B_EID
2)……,(EID
n-1,B_EID
n-1),(EID
n,B_EID
n)},其中,(EID
1,B_EID
1)为一对ID,(EID
2,B_EID
2)也为一对ID,其余依此类推。
可选的,该零知识令牌和该n对ID的格式可以如图4C所示。
1.5,终端接收该零知识令牌和n对ID。
可选的,该终端可以对该零知识令牌和/或该n对ID进行解析以获取其中的具体内容。
S32:接入网设备与终端初次进行合法性鉴别。
具体地,终端向接入网设备发送包含零知识令牌的消息(可称为第一网络接入请求)以请求接入网络,接入网设备验证该零知识令牌,并使用数字证书和签名向终端证明接入网设备身份的合法性,终端在验证出接入网设备的身份合法的情况下生成零知识证据,以向接入网设备证明终端身份的合法性。为了便于理解,下面结合图5例举一种初次鉴别合法性的流程,图5所示的鉴别合法性的流程包括步骤2.1-步骤2.9,其中,步骤2.1-步骤2.9具体如下:
2.1、终端向接入网设备发送第一网络接入请求。
可选的,该终端可以先更新从管理服务器接收的零知识令牌,例如,由于零知识令牌Token跟s有关,可以通过更新s来更新零知识令牌Token,如s=(s-c*r)mod q,Token={s,c,BlindRootID,U},其中,U为该终端的公钥。另外,该终端还获取上述管理服务器的公钥标识符PubKeyID,并生成第一随机数nonce。然后,该终端向接入网设备发送第一网络接入请求,该第一网络接入请求可以包括更新后的所述零知识令牌和该第一随机数,当然还可以包括上述管理服务器的公钥标识符PubKeyID。可选的,该零知识令牌也可以不更新,直接在发送第一网络接入请求时使用。
2.2、该接入网设备接收该第一网络接入请求,然后对该第一网络接入请求进行解析,从而获得其中的零知识令牌、第一随机数、管理服务器的公钥标识符PubKeyID等信息。
可选的,该第一网络接入请求的消息类型可以为消息1,即Msg1。
2.3、接入网设备验证该第一网络接入请求。
具体地,该接入网设备根据该第一网络接入请求可以获知该终端是在请求加入网络,因此要对该第一网络接入请求中的信息进行验证,验证流程以及其他相关流程可以如下:
A、验证该第一网络接入请求中的零知识令牌Token,具体是根据上述管理服务器的公钥标识符PubKeyID提取管理服务器的公钥PubK={G,q,X,Y=X
k};可以理解,如果该接入网设备中缓存了该公钥标识符PubKeyID对应的公钥PubK,则直接使用即可,如果该接入网设备中没有缓存该公钥标识符PubKeyID对应的公钥PubK,则可以向该管理服务器请求该PubKeyID对应的公钥PubK。获得公钥PubK后,计算A
′=X
sY
cU
c=X
w-c*k-c*rX
k*cX
r*c,接着生成c′=H
2(X,Y,A
w,U,BlindRootID),然后判断计算出的c
′是否等于零知识令牌中的c,即c′==c,若等于则表明对零知识令牌Token的验证通过并进行后续计算,否则验证不通过并向终端发送错误提示消息。
B、生成第二随机数,并使用公钥基础设施(Public Key Infrastructure,PKI)数字证书中公钥对应的私钥对包含该第一随机数、第二随机数的消息进行数字签名,得到该接入网设备的签名Sig1。
C、生成挑战响应消息,该挑战响应消息包括所述接入网设备的签名Sig1、第一随机数和第二随机数,除此之外还可以包括接入网设备的PKI数字证书。可选的,该挑战响应消息也可以不包括所述第一随机数。
可选的,该挑战响应消息的消息类型可以为消息2,即Msg2。
2.4、接入网设备向终端发送挑战响应消息。
2.5、终端接收该挑战响应消息。
2.6、该终端验证该挑战响应消息。
例如,终端验证挑战响应消息中的PKI数字证书的合法性,在合法的情况下基于该KPI数字证书中的公钥验证挑战响应消息中的签名的合法性,当然还可以在此基础上进一步对挑战响应消息中的其他内容做进一步验证。当需要验证的项目都验证通过后,则认为终端验证该挑战响应消息通过。然后生成一个随机数t,计算Q=X
t,计算m=H
2(U,Q,nonce1,nonce2),计算s=(t-m*r)mod q,得到终端的零知识证据sig2=(m,s),其中,nonce1为第一随机数,nonce2为第二随机数。
2.7、该终端向接入网设备发送零知识证据。
具体地,该终端可以单独的发送该零知识证据sig2,也可以将其携带在某类消息中进行发送,例如,携带该零知识证据sig2的消息可以称为鉴别响应消息,可选的,该鉴别响应消息的消息类型可以消息3,即Msg3。
2.8、接入网设备接收零知识证据。
2.9、接入网设备对零知识证据进行验证,具体如下:计算Q
′=X
s*U
m=X
t-m*r*X
r*m,以及计算m′=H
2(U,Q′,nonce1,nonce2),接着判断m′==m,如果m′等于m,则对零知识证据的验证通过,至此,接入网设备与终端初次进行合法性鉴别完成,且鉴别结果为合法,接入网设备允许终端接入到网络;如果m′不等于m,则对零知识证据的验证没有通过,至此,接入网设备与终端初次进行合法性鉴别完成,且鉴别结果为不合法,接入网设备不允许终端接入到网络,当然,接入网设备可以向终端发送错误提示,以提示鉴别失败,无法接入到网络。
S33:终端从接入网设备获取盲签名令牌。
具体地,终端与接入网设备之间的初次鉴别成功后,终端向接入网设备发送盲签名请求,相应的,该接入网设备根据该盲签名请求验证需要进行盲签名的内容的合法性,并在合法的情况下对其进行签名以得到盲签名令牌,然后向该终端发送该盲签名令牌。为了便于理解,下面结合图6例举一种获取盲签名令牌的流程,图6所示的获取盲签名令牌的流程包括步骤3.1-步骤3.7,其中,步骤3.1-步骤3.7具体如下:
3.1、所述终端根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数,即m个第二ID可以为n个第二ID中的全部,也可以为n个第二ID中的部分,当为部分的时候,可以是按照预先定义的规则来从n个第二ID种选择部分,或者就随机挑选部分,这m个第二ID的表示方式可以为{B_EID
1,B_EID
2……,B_EID
m-1,B_EID
m}。另外,还有一种极端的情况是m等于1。
3.2、所述终端向所述接入网设备发送盲签名请求,该盲签名请求包括所述m个所述第 二ID和所述中间结点值,其中盲签名请求可以携带在其他信息中进行发送,也可以独立发送。
3.3、接入网设备接收该盲签名请求。该接入网设备从盲签名请求中可以获得上述m个第二ID{B_EID
1,B_EID
2……,B_EID
m-1,B_EID
m}和所述中间结点。
3.4、接入网设备对盲签名请求中的m个第二ID进行签名,具体如下:根据上述m个第二ID{B_EID
1,B_EID
2……,B_EID
m-1,B_EID
m}和所述中间结点计算得到Merkle树根节点值BlindRoutID
′,并进一步判断当前自己计算出的Merkle树根节点值BlindRoutID′与前面步骤中接收的零知识令牌中的Merkle树根节点值BlindRoutID是否相等,若相等,则接入网设备使用自己的私钥a对该m个第二ID{B_EID
1,B_EID
2……,B_EID
m-1,B_EID
m}中的每一个第二ID进行签名,得到接入网设备对每个第二ID的签名,例如,对第二ID B_EID
m的签名可以表示为sig(B_EID
m)=(B_EID
m)
a,本申请实施例中,(B_EID
m)
a=H
1(EID
m)
ba。另外,对每个第二ID的签名也可以视为一个盲签名令牌,这样总共得到了m个盲签名令牌。
3.5、接入网设备向该终端发送该接入网设备对该m个第二ID的签名;可选的,该m个第二ID的签名可以与其他信息一起发送,例如,每个签名与关联的第二ID一起发送,也样可以使得接收该信息的终端获知哪个签名是对哪个第二ID签名得到的;可选的,发送的这m个第二签名和对应的m个第二ID可以表示为:{<B_EID
1,sig(B_EID
1)>,<B_EID
2,sig(B_EID
2)>……,<B_EID
m-1,sig(B_EID
m-1)>,<B_EID
m,sig(B_EID
m)>}。
3.6、终端接收接入网设备发送的对该m个第二ID中每个第二ID的签名。
3.7、终端根据该m个第二ID的签名确定与接入网设备的m个认证密钥,其中,一个第二ID的签名用于确定一个认证密钥;例如,终端根据第i个第二ID的签名sig(B_EID
i)确定第i个认证密钥K
EIID的方式可以为:K
EIID=H
3(EID
i,W
i),其中,W
i=(sig(B-EID
i))
1/b,H
3()是一种安全的单向函数,可以采用哈希算法、杂凑算法SHA256或者SM3等实现。另外,生成m个认证密钥的生成时机此处不作限定,可以提前生成好以供备用,也可以在要用的时候再生成。
所述m个认证密钥用于所述终端与所述接入网设备进行后续网络接入认证。需要说明的是,m的取值不同则对应的应用场景也会有所差异,例如,当m大于1时,表明一次性获取了多个认证密钥,由于后续的认证是一个持续的过程(即每隔一段时间要重新认证一次,间隔时间可以是规律的也可以是不规律的,具体看怎么配置),因此后续终端与接入网设备进行验证(鉴别合法性)的时候就不用每次都先来获取一个认证密钥,直接从该多个认证密钥中选择一个未被使用的来用即可。当然,当m等于1时,后续终端与接入网设备进行验证(鉴别合法性)的时候就直接使用这一个认证密钥,后续再需要进行验证则提前再获取一次认证密钥,认证密钥的获取方式可以参照前面的描述。
本申请实施例中,该接入网设备对第二ID进行签名得到的签名也可以称为盲签名令牌。
S34:接入网设备与终端后续进行合法性鉴别。
具体地,终端按照固定周期,或者固定的时间间隔,或者非固定的时间间隔,或者其他规则基于第一ID重新接入网络,接入的过程需要重新进行合法性鉴别,该合法性鉴别的 流程是基于上述认证密钥进行的。为了便于理解,下面结合图7例举一种后续鉴别合法性的流程,图7所示的鉴别合法性的流程包括步骤4.1-步骤4.9,其中,步骤4.1-步骤4.9具体如下:
4.1、所述终端向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中该第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID,即该第i个第一ID是上述m个第二ID分别对应的m个第一ID种的某一个第一ID,具体是该m个第一ID中哪一个此处不作限定,可以预先设置规则来从m个第一ID种选择出该第i个第一ID。
可选的,第二网络接入请求的消息类型可以为消息1,即Msg1。
4.2、接入网设备接收该第二网络接入请求。
4.3、接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,可以表示为HMAC1;例如,该接入网设备可以先根据第i个第一ID EID
i计算第一密钥K
EIID0,计算逻辑如下:W
i=[H
1(EID
i)]
a,以及K
EIID0=H
3(EID
i,W
i),其中H
3()是一个安全的单向函数,可以采用杂凑算法SHA256或者SM3等实现。然后基于第一密钥K
EIID0、第i个第一ID和第三随机数nonce3生成HMAC1,如HMAC1=H
4(K
EIID0,EID
i,nonce3),H
4()是一种带密钥的杂凑函数,可以采用杂凑算法SHA256或者SM3等实现,EID
i和nonce3是杂凑函数的输入。这里,该接入网设备还可以生成一个随机数,可以称为第四随机数nonce4。
4.4、该接入网设备向终端发送该第一HMAC和第四随机数nonce4。
本申请实施例中,该第一HMAC和第四随机数nonce4可以封装在某个消息中进行发送,可选的,该消息的消息类型可以为消息2,即Msg2。
4.5、终端接收该第一HMAC和第四随机数nonce4。
4.6、终端验证该第一HMAC,由于该终端前面发送的第二网络接入请求中携带的是第i个第一ID,因此,该终端使用该第i个第一ID对应的第i个认证密钥K
EIID来验证该第一HMAC,具体如下:根据第i个认证密钥K
EIID生成用于校验的HAMC,表述为HMAC1′,其中,HMAC1′=H
4(K
EIID,EID
i,nonce3),如果HMAC1′等于第一HMAC(即HMAC1),则终端对第一HMAC的验证通过。
可以理解,终端上的第i个认证密钥K
EIID与接入网设备生成的第i个第一密钥K
EIID0是相同的。
4.7、终端向接入网设备发送第二HMAC,其中,第二HMAC是该终端在对第一HMAC验证通过之后生成的,例如,根据第i个认证密钥、所述第i个第一ID、所述第三随机数nonce3和第四随机数nonce4生成的,如HMAC2=H
4(K
EIID,EID
i,nonce3,nonce4),其中,EID
i、nonce3和nonce4是杂凑函数的输入。本申请实施例中,该第二HMAC可以封装在某个消息中进行发送,可选的,该消息的消息类型可以为消息3,即Msg3。
4.8、接入网设备接收该第二HMAC。
4.9、接入网设备验证该第二HMAC,例如,根据K
EIID0生成校验HMAC,表述为HMAC2′,如HMAC2′=H
4(K
EIID0,EID
i,nonce3,nonce4),如果HMAC2′等于第二HMAC(即HMAC2),则接入网设备对第二HMAC验证通过,至此,接入网设备与终端当前这一次进 行合法性鉴别完成,且鉴别结果为合法,接入网设备允许终端接入到网络;如果HMAC2′不等于第二HMAC(即HMAC2),则接入网设备对第二HMAC验证没有通过,至此,接入网设备与终端当前这一次进行合法性鉴别完成,且鉴别结果为不合法,该接入网设备不允许终端接入到网络,当然,该接入网设备可以向终端发送错误提示,以提示鉴别失败,无法接入到网络。
可选的,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,例如,终端可以按照固定周期,或者固定的时间间隔,或者非固定的时间间隔,或者其他规则基于隐私ID(即第一ID)重新接入网络,这种情况下,每次重新接入到网络都可以执行一次上述步骤4.1到步骤4.3,任意两次执行步骤4.1到步骤4.3所用到的认证密钥不同,相应的第一ID也不同,相应的第二ID也不同。
可选的,本申请实施例中,在初次或者后续每次鉴别成功之后,终端发送的IPV6数据包中,可以使用EID
i作为源IPV6地址的后64位接口ID值。EID
i的长度小于或等于64比特,如果EID
i的长度小于64比特,则可以对多出的接口进行填充。
需要说明的是,当存在审计需求时,审计主体可以终端在通信过程中使用的第一ID、或者第二ID,或者零知识令牌,或者其他信息来追溯到上述终端的身份标识,例如,上述管理服务器对审计主体开放终端的身份标识与第一ID、或者第二ID,或者零知识令牌,或者其他信息之间的对应关系,因此该审计主体可以基于该对应关系找到相应的终端。当然,也可能该管理服务器向审计主体提供了基于身份标识计算第一ID、第二ID的相关规则,该审计主体基于该相关规则反向推导出相应的身份标识,从而确定出相应的终端。可以理解,该管理服务器不会向接入网设备共享与用户隐私相关的信息。
在图3所示的方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
上述详细阐述了本申请实施例的方法,下面提供了本申请实施例的装置。
请参见图8,图8是本申请实施例提供的一种终端80的结构示意图,该终端80可以包括第一发送单元801、第一接收单元802,其中,各个单元的详细描述如下。
第一发送单元801,用于向管理服务器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;
第一接收单元802,用于接收零知识令牌和n对ID,其中,所述n对ID中每对ID包 括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份标识进行加密得到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
在一种可能的实现方式中,所述终端还包括:
第二发送单元,用于在所述第一接收单元接收零知识令牌和n对ID之后,向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
第二接收单元,用于接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
第一验证单元,用于验证所述挑战响应消息,若验证通过,则向所述接入网设备发送零知识证据,所述零知识证据是根据所述第二随机数生成的;
第一接入单元,用于在所述零知识证据被所述接入网设备验证通过的情况下,则初次接入所述接入网设备。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
在一种可能的实现方式中,所述终端还包括:
生成单元,用于在所述终端接入所述接入网设备之后,根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;
第三发送单元,用于向所述接入网设备发送所述m个所述第二ID和所述中间结点值;
第三接收单元,用于接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根 节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
确定单元,用于根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥,其中,一个所述第二ID用于确定一个所述认证密钥;所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
在一种可能的实现方式中,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
在一种可能的实现方式中,所述终端还包括:
第四发送单元,用于在所述确定单元根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
第四接收单元,用于接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的,所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;
第二验证单元,用于通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;
第五发送单元,用于向所述接入网设备发送所述第二HMAC;
第二接入单元,用于在所述第二HMAC被所述接入网设备通过所述第一密钥验证通过的情况下,再次接入所述接入网设备。
需要说明的是,各个单元的实现及有益效果还可以对应参照图3所示的方法实施例的相应描述。
请参见图9,图9是本申请实施例提供的一种管理服务器90的结构示意图,该管理服务器90可以包括接收单元901、加密单元902、盲化单元903、生成单元904和发送单元 905,其中,各个单元的详细描述如下。
接收单元901,用于接收终端发送的第一请求消息,并根据所述第一请求消息确定所述终端的身份标识;
加密单元902,用于对所述身份标识进行加密得到n个第一ID;
盲化单元903,用于对所述n个第一ID分别进行盲化得到n个第二ID,其中,一个所述第一ID用于盲化得到一个所述第一ID;
生成单元904,用于根据所述n个第二ID生成零知识令牌;
发送单元905,用于向所述终端发送所述零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个所述第一ID和一个所述第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
在一种可能的实现方式中,所述生成单元904,用于根据所述n个第二ID生成零知识令牌,具体为:
以所述n个第二ID为叶子节点生成可信Merkle树的根节点值;
根据所述Merkle树的根节点值生成零知识令牌。
需要说明的是,各个单元的实现及有益效果还可以对应参照图3所示的方法实施例的相应描述。
请参见图10,图10是本申请实施例提供的一种接入网设备100的结构示意图,该接入网设备100可以包括第一接收单元1001、第一认证单元1002和第二认证单元1003,其中,各个单元的详细描述如下。
第一接收单元1001,用于接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;
第一认证单元1002,用于基于所述零知识令牌对所述终端进行初次网络接入认证;
第二认证单元1003,用于对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
在一种可能的实现方式中,所述第一认证单元,用于基于所述零知识令牌对所述终端进行初次网络接入认证,具体为:
接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
验证所述第一网络接入请求中的零知识令牌是否合法;
若合法,则向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
在所述终端验证所述挑战响应消息通过的情况下发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;
若所述接入网设备验证所述零知识证据通过,则允许所述终端接入网络。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
在一种可能的实现方式中,所述第二认证单元基于n对ID对所述终端进行后续网络接入认证,具体为:
接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;
在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;
与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
在一种可能的实现方式中,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
在一种可能的实现方式中,所述与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,具体为:
接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;
向所述终端发送所述第一HMAC;
接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;
若通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
需要说明的是,各个单元的实现及有益效果还可以对应参照图3所示的方法实施例的相应描述。
请参见图11,图11是本申请实施例提供的一种终端110,该终端110包括处理器1101、存储器1102和收发器1103,所述处理器1101、存储器1102和收发器1103通过总线相互连接。
存储器1102包括但不限于是随机存储记忆体(random access memory,RAM)、只读存储器(read-only memory,ROM)、可擦除可编程只读存储器(erasable programmable read only memory,EPROM)、或便携式只读存储器(compact IDsc read-only memory,CD-ROM),该存储器1102用于相关计算机程序及数据。收发器1103用于接收和发送数据。
可选的,该收发器1103可以为射频模块,该处理器可以为基带芯片,也可以为通用芯 片。
处理器1101可以是一个或多个中央处理器(central processing unit,CPU),在处理器1101是一个CPU的情况下,该CPU可以是单核CPU,也可以是多核CPU。
该处理器1101用于读取所述存储器1102中存储的计算机程序,执行以下操作:
通过所述收发器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;
通过所述收发器接收零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份标识进行加密得到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
在一种可能的实现方式中,所述处理器还用于:
在通过所述收发器接收零知识令牌和n对ID之后,向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
通过所述收发器接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
验证所述挑战响应消息,若验证通过,则向所述接入网设备发送零知识证据,所述零知识证据是根据所述第二随机数生成的;
若所述零知识证据被所述接入网设备验证通过,则初次接入所述接入网设备。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
在一种可能的实现方式中,所述处理器还用于:
在所述终端接入所述接入网设备之后,根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;
通过所述收发器向所述接入网设备发送所述m个所述第二ID和所述中间结点值;
通过所述收发器接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥,其中,一个所述第二ID用于确定一个所述认证密钥;所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
在一种可能的实现方式中,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
在一种可能的实现方式中,所述处理器还用于:
在根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,通过所述收发器向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
通过所述收发器接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的,所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;
通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;
通过所述收发器向所述接入网设备发送所述第二HMAC,
若所述第二HMAC被所述接入网设备通过所述第一密钥验证通过,则再次接入所述接入网设备。
需要说明的是,各个模块的实现及有益效果还可以对应参照图3所示的方法实施例的相应描述。
请参见图12,图12是本申请实施例提供的一种管理服务器120,该管理服务器120包括处理器1201、存储器1202和收发器1203,所述处理器1201、存储器1202和收发器1203 通过总线相互连接。
存储器1202包括但不限于是随机存储记忆体(random access memory,RAM)、只读存储器(read-only memory,ROM)、可擦除可编程只读存储器(erasable programmable read only memory,EPROM)、或便携式只读存储器(compact IDsc read-only memory,CD-ROM),该存储器1202用于相关计算机程序及数据。收发器1203用于接收和发送数据。
可选的,该收发器1203可以为射频模块,该处理器可以为基带芯片,也可以为通用芯片。
处理器1201可以是一个或多个中央处理器(central processing unit,CPU),在处理器1201是一个CPU的情况下,该CPU可以是单核CPU,也可以是多核CPU。
该处理器1201用于读取所述存储器1202中存储的计算机程序,执行以下操作:
通过所述收发器接收终端发送的第一请求消息,并根据所述第一请求消息确定所述终端的身份标识;
对所述身份标识进行加密得到n个第一ID;
对所述n个第一ID分别进行盲化得到n个第二ID,其中,一个所述第一ID用于盲化得到一个所述第一ID;
根据所述n个第二ID生成零知识令牌;
通过所述收发器向所述终端发送所述零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个所述第一ID和一个所述第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
在一种可能的实现方式中,所述根据所述n个第二ID生成零知识令牌,具体为:
以所述n个第二ID为叶子节点生成可信Merkle树的根节点值;
根据所述Merkle树的根节点值生成零知识令牌。
需要说明的是,各个模块的实现及有益效果还可以对应参照图3所示的方法实施例的相应描述。
请参见图13,图13是本申请实施例提供的一种接入网设备130,该接入网设备130包括处理器1301、存储器1302和收发器1303,所述处理器1301、存储器1302和收发器1303通过总线相互连接。
存储器1302包括但不限于是随机存储记忆体(random access memory,RAM)、只读存储器(read-only memory,ROM)、可擦除可编程只读存储器(erasable programmable read only memory,EPROM)、或便携式只读存储器(compact IDsc read-only memory,CD-ROM),该存储器1302用于相关计算机程序及数据。收发器1303用于接收和发送数据。
可选的,该收发器1303可以为射频模块,该处理器可以为基带芯片,也可以为通用芯片。
处理器1301可以是一个或多个中央处理器(central processing unit,CPU),在处理器1301是一个CPU的情况下,该CPU可以是单核CPU,也可以是多核CPU。
该处理器1301用于读取所述存储器1302中存储的计算机程序,执行以下操作:
通过所述收发器接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;
基于所述零知识令牌对所述终端进行初次网络接入认证;
对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
上述方法中,终端要接入到接入网设备之前先从管理服务器获取零知识令牌和n对ID,由于每对ID中包含的第一ID是通过对终端的身份标识进行加密得到的,每对ID中的第二ID是通过对其中的第一ID盲化得到的,且零知识令牌也不是根据该身份标识直接得到的,因此该终端后续通过该零知识令牌和n对ID与接入网设备进行接入的合法性鉴别及通信时,不会向接入网设备泄露能够追溯到该终端身份的信息,有效地保护了该终端的隐私安全。另外,由于零知识令牌用于该终端与接入网设备进行初次的合法性鉴别,该n对ID用于该终端与接入网设备进行后续的合法性鉴别,即终端与接入网设备之间的合法性鉴别是一个持续且不断更换鉴别依据的过程,因此能够尽量避免接入网设备根据与终端通信过程中的终端操作行为或数据推导出该终端的身份,进一步保护了终端的隐私安全。另外,由于终端的身份标识在管理服务器中进行了记载,因此审计主体可以与管理服务器进行协作以在必要的时候追溯终端的身份。
在一种可能的实现方式中,所述基于所述零知识令牌对所述终端进行初次网络接入认证,具体为:
通过所述收发器接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;
验证所述第一网络接入请求中的零知识令牌是否合法;
若合法,则通过所述收发器向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;
在所述终端验证所述挑战响应消息通过的情况下通过所述收发器发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;
若验证所述零知识证据通过,则允许所述终端接入网络。
可以理解,由于该零知识令牌是由被各方都信任的管理服务器颁发给终端的,因此终端与管理服务器能够基于零知识令牌能够完成合法性的鉴别;这个过程中,使用零知识令牌而不是终端的身份标识进行合法性的鉴别,保护了终端的隐私安全。
在一种可能的实现方式中,其特征在于,所述基于n对ID对所述终端进行后续网络接入认证,具体为:
通过所述收发器接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;
在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;
通过所述收发器向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;
与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
采用上述方法,构建以m个第二ID作为叶子节点的可信Merkle树,管理服务器仅需要对数据量较小的Merkle树根节点签名生成零知识令牌,而不需要为每一个第二ID进行签名生成令牌或证书,大大减少了管理服务器的计算量。之后,双方基于对方提供的信息和自有的信息生成相同的认证密钥(在接入网设备侧称为第一密钥);后续终端与接入网设备就可以基于该认证密钥来进行网络的接入认证,而无需每次网络接入认证都先生成一个零知识令牌,显著降低了网络接入认证的计算开销,提高了网络接入认证的效率。
在一种可能的实现方式中,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
可以理解,当m大于1时,相当于一次性获取了多个认证密钥,后续每次接入网络使用其中一个,相比于每次获取一个认证密钥而言,这种方式的通信及计算开销更小;另外,由于不同次使用的认证密钥不一样,能够避免接入网设备根据用户操作记录推导出终端的身份。
在一种可能的实现方式中,所述与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,具体为:
通过所述收发器接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;
根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码 HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;
通过所述收发器向所述终端发送所述第一HMAC;
通过所述收发器接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;
若通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
需要说明的是,各个模块的实现及有益效果还可以对应参照图3所示的方法实施例的相应描述。
本申请实施例还提供一种芯片系统,所述芯片系统包括至少一个处理器,存储器和接口电路,所述存储器、所述收发器和所述至少一个处理器通过线路互联,所述至少一个存储器中存储有计算机程序;所述计算机程序被所述处理器执行时,实现图3所示的方法流程。
本申请实施例还提供一种计算机可读存储介质,所述计算机可读存储介质中存储有计算机程序,当其在处理器上运行时,实现图3所示的方法流程。
本申请实施例还提供一种计算机程序产品,当所述计算机程序产品在处理器上运行时,实现图3所示的方法流程。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程,该流程可以由计算机程序来计算机程序相关的硬件完成,该计算机程序可存储于计算机可读取存储介质中,该计算机程序在执行时,可包括如上述各方法实施例的流程。而前述的存储介质包括:ROM或随机存储记忆体RAM、磁碟或者光盘等各种可存储计算机程序代码的介质。
Claims (20)
- 一种网络接入方法,其特征在于,包括:终端向管理服务器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;所述终端接收所述管理服务器发送的零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份标识进行加密得到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
- 根据权利要求1所述的方法,其特征在于,所述终端接收所述管理服务器发送的零知识令牌和n对ID之后,还包括:所述终端向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;所述终端接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;所述终端验证所述挑战响应消息,若验证通过,则向所述接入网设备发送零知识证据,所述零知识证据是根据所述第二随机数生成的;若所述零知识证据被所述接入网设备验证通过,则所述终端初次接入所述接入网设备。
- 根据权利要求1或2所述的方法,其特征在于,所述终端接入所述接入网设备之后,还包括:所述终端根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;所述终端向所述接入网设备发送所述m个所述第二ID和所述中间结点值;所述终端接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;所述终端根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥,其中,一个所述第二ID用于确定一个所述认证密钥;所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
- 根据权利要求3所述的方法,其特征在于,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同 的所述第二ID的签名确定的。
- 根据权利要求3或4所述的方法,其特征在于,所述终端根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,还包括:所述终端向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;所述终端接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的,所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;所述终端通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;所述终端向所述接入网设备发送所述第二HMAC,若所述第二HMAC被所述接入网设备通过所述第一密钥验证通过,则所述终端再次接入所述接入网设备。
- 一种网络接入方法,其特征在于,包括:接入网设备接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;所述接入网设备基于所述零知识令牌对所述终端进行初次网络接入认证;所述接入网设备对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
- 根据权利要求6所述的方法,其特征在于,所述接入网设备基于所述零知识令牌对所述终端进行初次网络接入认证,包括:所述接入网设备接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;所述网络设备验证所述第一网络接入请求中的零知识令牌是否合法;若合法,则向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;所述接入网设备在所述终端验证所述挑战响应消息通过的情况下发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;若所述接入网设备验证所述零知识证据通过,则允许所述终端接入网络。
- 根据权利要求6或7所述的方法,其特征在于,所述基于n对ID对所述终端进行 后续网络接入认证,包括:所述接入网设备接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;所述接入网设备向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;所述接入网设备与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
- 根据权利要求8所述的方法,其特征在于,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
- 根据权利要求8或9所述的方法,其特征在于,所述接入网设备与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,包括:所述接入网设备接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;所述接入网设备向所述终端发送所述第一HMAC;所述接入网设备接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;若所述接入网设备通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
- 一种网络接入终端,其特征在于,包括处理器、存储器和收发器,所述存储器用于存储计算机程序,所述处理器调用所述计算机程序,用于执行如下操作:通过所述收发器发送第一请求消息,所述第一请求消息用于确定所述终端的身份标识;通过所述收发器接收零知识令牌和n对ID,其中,所述n对ID中每对ID包括一个第一ID和一个第二ID,所述n对ID包括的n个所述第一ID为对所述身份标识进行加密得 到的,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID;所述零知识令牌为根据所述n对ID包括的n个所述第二ID生成的;其中,所述零知识令牌用于所述终端与接入网设备进行初次网络接入认证,所述n对ID用于所述终端接入所述接入网设备之后,与接入网设备进行后续网络接入认证,n为大于或者等于1的正整数。
- 根据权利要求11所述的终端,其特征在于,所述处理器还用于:在通过所述收发器接收零知识令牌和n对ID之后,向所述接入网设备发送第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;通过所述收发器接收所述网络设备在验证所述零知识令牌合法的情况下发送的挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;验证所述挑战响应消息,若验证通过,则向所述接入网设备发送零知识证据,所述零知识证据是根据所述第二随机数生成的;若所述零知识证据被所述接入网设备验证通过,则初次接入所述接入网设备。
- 根据权利要求11或12所述的终端,其特征在于,所述处理器还用于:在所述终端接入所述接入网设备之后,根据所述n对ID中的m对ID中的m个所述第二ID生成到可信Merkle树根节点路径上的中间结点值,m为小于或者等于n的正整数;通过所述收发器向所述接入网设备发送所述m个所述第二ID和所述中间结点值;通过所述收发器接收所述接入网设备发送的对所述m个所述第二ID中每个所述第二ID的签名,其中,所述接入网设备用于在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥,其中,一个所述第二ID用于确定一个所述认证密钥;所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证。
- 根据权利要求13所述的终端,其特征在于,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
- 根据权利要求13或14所述的终端,其特征在于,所述处理器还用于:在根据所述m个所述第二ID的签名确定与所述接入网设备的m个认证密钥之后,通过所述收发器向所述接入网设备发送第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;通过所述收发器接收所述接入网设备发送的第一哈希运算消息认证码HMAC,所述第一HMAC是所述接入网设备根据第一密钥、所述第i个第一ID和所述第三随机数生成的, 所述第一密钥为所述接入网设备根据所述第i个第一ID确定与所述终端通信的加密密钥;通过所述第i个认证密钥验证所述第一HMAC,若验证通过,则根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成第二HMAC;通过所述收发器向所述接入网设备发送所述第二HMAC,若所述第二HMAC被所述接入网设备通过所述第一密钥验证通过,则再次接入所述接入网设备。
- 一种接入网设备,其特征在于,包括处理器、存储器和收发器,其中,所述存储器用于存储计算机程序,所述处理器调用所述计算机程序,用于执行如下操作:通过所述收发器接收终端发送的第一网络接入请求,所述第一网络接入请求包括零知识令牌;所述零知识令牌为根据n对ID包括的n个第二ID生成的,所述n个第二ID为对n个第一ID分别盲化得到的,所述n个第一ID为对所述终端的身份标识进行加密得到的;基于所述零知识令牌对所述终端进行初次网络接入认证;对所述终端初次网络接入认证通过后,基于n对ID对所述终端进行后续网络接入认证,其中,所述n对ID中每一对ID包括所述n个第一ID种的一个第一ID和所述n个第二ID中的一个第二ID,任意一对ID中的所述第二ID为对所述任意一对ID中的所述第一ID盲化后的ID。
- 根据权利要求16所述的接入网设备,其特征在于,所述基于所述零知识令牌对所述终端进行初次网络接入认证,具体为:通过所述收发器接收所述终端发送的第一网络接入请求,其中,所述第一网络接入请求包括所述零知识令牌和第一随机数;验证所述第一网络接入请求中的零知识令牌是否合法;若合法,则通过所述收发器向所述终端发送挑战响应消息,其中,所述挑战响应消息包括所述接入网设备的签名、所述第一随机数和第二随机数;在所述终端验证所述挑战响应消息通过的情况下通过所述收发器发送的零知识证据,所述零知识证据是根据所述第二随机数生成的;若验证所述零知识证据通过,则允许所述终端接入网络。
- 根据权利要求16或17所述的接入网设备,其特征在于,所述基于n对ID对所述终端进行后续网络接入认证,具体为:通过所述收发器接收所述终端发送的所述n对ID中的m对ID中的m个第二ID和可信Merkle树根节点路径上的中间结点值,所述中间结点值为根据所述m个所述第二ID生成的;在根据所述中间结点值确定出的Merkle树根节点的值与存储的Merkle树根节点的值相等的情况下对所述m个第二ID进行签名,所述存储的Merkle树根节点的值为所述终端成功接入所述接入网设备之后发送给所述接入网设备的;通过所述收发器向所述终端发送所述m个所述第二ID中每个所述第二ID的签名,所 述m个所述第二ID中每个所述第二ID的签名用于所述终端生成m个认证密钥;其中,一个所述第二ID用于生成一个所述认证密钥;与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证。
- 根据权利要求18所述的接入网设备,其特征在于,所述m个认证密钥中的每个认证密钥用于所述终端与所述接入网设备进行一次网络接入认证,任意一次网络接入认证通过后经过预设时间段执行下一次网络接入认证,任意两次网络接入认证使用的所述认证密钥为根据不同的所述第二ID的签名确定的。
- 根据权利要求18或19所述的接入网设备,其特征在于,所述与所述终端基于所述m个认证密钥中的一个认证密钥进行网络接入认证,具体为:通过所述收发器接收所述终端发送的第二网络接入请求,所述第二网络接入请求包括第i个第一ID和第三随机数,其中,所述第i个第一ID与计算所述m个认证密钥中的第i个认证密钥用到的第二ID同属一对ID;根据第一密钥、所述第i个第一ID和所述第三随机数生成第一哈希运算消息认证码HMAC,所述第一密钥为根据所述第i个第一ID确定与所述终端通信的加密密钥;通过所述收发器向所述终端发送所述第一HMAC;通过所述收发器接收第二HMAC,所述第二HMAC是所述终端在通过所述第i个认证密钥对所述第一HMAC验证通过后发送的,所述第二HMAC为根据所述第i个认证密钥、所述第i个第一ID、所述第三随机数和第四随机数生成的;若通过所述第一密钥验证所述第二HMAC通过,则允许所述终端再次接入网络。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201911125165.0 | 2019-11-14 | ||
CN201911125165.0A CN112887979A (zh) | 2019-11-14 | 2019-11-14 | 一种网络接入方法及相关设备 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2021093811A1 true WO2021093811A1 (zh) | 2021-05-20 |
Family
ID=75911440
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2020/128381 WO2021093811A1 (zh) | 2019-11-14 | 2020-11-12 | 一种网络接入方法及相关设备 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN112887979A (zh) |
WO (1) | WO2021093811A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115914316A (zh) * | 2023-03-14 | 2023-04-04 | 深圳中集智能科技有限公司 | 区块链的物流数据传输方法及可信物联网系统 |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113872752B (zh) * | 2021-09-07 | 2023-10-13 | 哲库科技(北京)有限公司 | 安全引擎模组、安全引擎装置和通信设备 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN103546480A (zh) * | 2013-10-30 | 2014-01-29 | 宇龙计算机通信科技(深圳)有限公司 | 一种隐私信息的保护方法、终端及系统 |
US20140101444A1 (en) * | 2012-10-09 | 2014-04-10 | Samsung Sds Co., Ltd. | Apparatus and method for transmitting data, and recording medium storing program for executing method of the same in computer |
CN106792501A (zh) * | 2016-11-17 | 2017-05-31 | 广东工业大学 | 一种lbs用户位置及身份隐私保护方法 |
CN107968999A (zh) * | 2016-10-18 | 2018-04-27 | 华为技术有限公司 | 一种隐私保护方法及相关设备 |
CN108521424A (zh) * | 2018-04-10 | 2018-09-11 | 肖恒念 | 面向异构终端设备的分布式数据处理方法 |
-
2019
- 2019-11-14 CN CN201911125165.0A patent/CN112887979A/zh active Pending
-
2020
- 2020-11-12 WO PCT/CN2020/128381 patent/WO2021093811A1/zh active Application Filing
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20140101444A1 (en) * | 2012-10-09 | 2014-04-10 | Samsung Sds Co., Ltd. | Apparatus and method for transmitting data, and recording medium storing program for executing method of the same in computer |
CN103546480A (zh) * | 2013-10-30 | 2014-01-29 | 宇龙计算机通信科技(深圳)有限公司 | 一种隐私信息的保护方法、终端及系统 |
CN107968999A (zh) * | 2016-10-18 | 2018-04-27 | 华为技术有限公司 | 一种隐私保护方法及相关设备 |
CN106792501A (zh) * | 2016-11-17 | 2017-05-31 | 广东工业大学 | 一种lbs用户位置及身份隐私保护方法 |
CN108521424A (zh) * | 2018-04-10 | 2018-09-11 | 肖恒念 | 面向异构终端设备的分布式数据处理方法 |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115914316A (zh) * | 2023-03-14 | 2023-04-04 | 深圳中集智能科技有限公司 | 区块链的物流数据传输方法及可信物联网系统 |
CN115914316B (zh) * | 2023-03-14 | 2023-06-06 | 深圳中集智能科技有限公司 | 区块链的物流数据传输方法及可信物联网系统 |
Also Published As
Publication number | Publication date |
---|---|
CN112887979A (zh) | 2021-06-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10638321B2 (en) | Wireless network connection method and apparatus, and storage medium | |
JP5579872B2 (ja) | 安全な複数uim認証および鍵交換 | |
US10411884B2 (en) | Secure bootstrapping architecture method based on password-based digest authentication | |
US11075752B2 (en) | Network authentication method, and related device and system | |
KR101158956B1 (ko) | 통신 시스템에 증명서를 배분하는 방법 | |
ES2769528T3 (es) | Autentificación de usuarios | |
CN101969638B (zh) | 一种移动通信中对imsi进行保护的方法 | |
US20090239503A1 (en) | System and Method for Securely Issuing Subscription Credentials to Communication Devices | |
US9608971B2 (en) | Method and apparatus for using a bootstrapping protocol to secure communication between a terminal and cooperating servers | |
KR20070096060A (ko) | 무선 통신을 위한 안전한 부트스트래핑 | |
TW201014314A (en) | Techniques for secure channelization between UICC and a terminal | |
CN111970699B (zh) | 一种基于ipk的终端wifi登录认证方法以及系统 | |
CN101409619A (zh) | 闪存卡及虚拟专用网密钥交换的实现方法 | |
CN112311543B (zh) | Gba的密钥生成方法、终端和naf网元 | |
WO2021093811A1 (zh) | 一种网络接入方法及相关设备 | |
CN101192927B (zh) | 基于身份保密的授权与多重认证方法 | |
CN110012467B (zh) | 窄带物联网的分组认证方法 | |
CN114331456A (zh) | 一种通信方法、装置、系统以及可读存储介质 | |
CN112333705B (zh) | 一种用于5g通信网络的身份认证方法及系统 | |
US11838428B2 (en) | Certificate-based local UE authentication | |
CN112242993A (zh) | 双向认证方法及系统 | |
WO2021236078A1 (en) | Simplified method for onboarding and authentication of identities for network access | |
KR20090013319A (ko) | 무선 통신 네트워크 상에서의 사용자 인증 방법 | |
Jain et al. | SAP: a low-latency protocol for mitigating evil twin attacks and high computation overhead in WI-FI networks | |
WO2024041177A1 (zh) | 验证接入请求的方法、用户终端和基站 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 20887371 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 20887371 Country of ref document: EP Kind code of ref document: A1 |