WO2021168829A1

WO2021168829A1 - User identifier verification method and related device

Info

Publication number: WO2021168829A1
Application number: PCT/CN2020/077268
Authority: WO
Inventors: 杨明月; 王远; 周润泽
Original assignee: 华为技术有限公司
Priority date: 2020-02-28
Filing date: 2020-02-28
Publication date: 2021-09-02
Also published as: CN114731289A

Abstract

Provided are a user identifier verification method and a related device, which are applicable to the technical field of communications. The method comprises: a first network element receiving a user identifier from an application functional network element; the first network element acquiring a first credential from a second network element according to the user identifier, wherein the first credential is used for verifying a user account; the first network element acquiring an identifier of one or more terminal devices, wherein the identifier of the terminal devices is used for determining a target terminal; the first network element receiving a second credential from the target terminal, wherein the second credential is an identity verification credential received by the target terminal; and the first network element performing user verification according to the first credential and the second credential. A third-party application program can determine a user login according to a verification result provided by a core network, so as to prevent a user identifier from being used to log in to the third-party application program without undergoing verification, thereby ensuring the security of a user account.

Description

User identification verification method and related equipment

Technical field

The embodiments of the present application relate to the field of communication technology, and in particular, to a method for verifying a user identity and related equipment.

Background technique

In the current network architecture, Internet service providers provide users with paid service services based on the subscriber identity module (SIM) card of the terminal. For example, a user can subscribe to the paid service through the SIM card. When the user initiates When requesting a service service, the service server first needs to obtain and identify the SIM card identity, and then determine the corresponding payment service according to the SIM card identity, and provide the payment service to the terminal to which the SIM card belongs. Since the paid service subscribed by the user is bound to the SIM card, the coupling is strong, which limits the flexibility of user service migration. For example, when different users use the same terminal, the terminal wants to meet the needs of different users. Demand, it is necessary to constantly replace the SIM cards of the services set by different users. At the same time, with the advent of the fifth-generation mobile communication technology (5G) era, each user will have multiple SIM cards and multiple terminals, which will cause the services set by each terminal to be independent and discontinuous.

In the prior art, a 3GPP user account is established for each user on the 3GPP core network side of the Third Generation Partnership Project. The user can subscribe to paid services through the user account. When the user sends a service request, any SIM The card is bound to the user account, and then the business server can provide all the business services corresponding to the user account to the current SIM card, that is, the user can use any SIM card in any terminal to obtain the corresponding business services through the 3GPP user account . In addition, the operator can open the user account identification to an external third party, that is, the user can use the user account identification to register or log in to a third-party application.

Currently, there is no way to protect the security of user accounts when registering or logging in to third-party applications using user account identifiers.

Summary of the invention

The embodiment of the present application provides a user identification verification method and related equipment, which are used to ensure the security of the user account when the user account identification is used to register or log in to a third-party application.

The first aspect of the embodiments of the present application provides a method for verifying a user identity:

User accounts are established on the core network side, and different user accounts are distinguished by using different user IDs, and each user account can be bound to multiple terminal devices, and the user can use the user ID to log in to third-party applications. During the login process, when the first network element receives the user ID sent by the application function network element, the first network element needs to obtain the first credential from the second network element, and the first credential is the user account corresponding to the user ID Verification credentials. Then the first network element obtains the identity of one or more terminal devices, and determines the target terminal according to the identity of the terminal device; the first network element obtains a second credential from the target terminal, and the second credential is the identity verification credential entered by the user, Then the first network element performs user authentication based on the first credential and the second credential.

When the user ID on the core network side is used to log in to a third-party application, the core network side uses the preset first credential to verify the second credential entered by the user, so that the user ID can be used to log in to the third party without verification. The application program ensures the security of the user account.

Based on the first aspect of the embodiments of the present application, the embodiments of the present application also provide a first implementation manner of the first aspect:

The first network element can compare the obtained first credential with the second credential. If the first credential and the second credential are the same, the verification is passed, and the first network element sends a first indication that the user authentication is successful to the application function network element ; If the first credential and the second credential are different, the verification fails, and the first network element sends a second indication that the user verification fails to the application function network element.

The first network element determines the legitimacy of the user identity by comparing the first certificate and the second certificate. When the first certificate and the second certificate are the same, the first network element determines that the user is authenticated and sends the verification result to the application function network element ; In this way, the application function network element can provide corresponding services based on the verification result, ensuring the security of the user account.

Based on the first aspect of the embodiments of the present application to the first implementation manner of the first aspect, the embodiments of the present application also provide a second implementation manner of the first aspect:

The first network element needs to determine the specific terminal device to obtain the second credential entered by the user, that is, the user needs to perform user authentication through the terminal device; the first network element determines the target terminal by receiving the terminal device sent by the application function network element The identification of the target terminal is determined according to the directly obtained identification; it can also be obtained from a third network element, and the identification of one or more terminal devices corresponding to the user identification is stored in the third network element That is, the third network element stores a list of terminal devices bound to each user account.

Since the user’s business service is subscribed through the user account of the core network, the user can perform user authentication on any terminal device; when the application function network element inputs the identification of the terminal device to the first network element, the first network element is Determine the target terminal for verification according to the identification; if the application function network element does not provide the identification of the terminal device, the first network element needs to obtain the terminal device bound to the user account from the third network element, and determine the target terminal, The user can change the terminal device by unbinding or binding; this allows the user to log in to the user account on any terminal device to complete the migration of business services.

Based on the first aspect of the embodiments of the present application to the second implementation manner of the first aspect, the embodiments of the present application also provide a third implementation manner of the first aspect:

When the first network element performs user verification based on the first credential and the second credential, it can adopt multiple verification strategies, that is, different verification methods or verification algorithms, etc., so the first network element can not only provide user verification to the application function network element It can also evaluate the reliability of the verification result, that is, send an evaluation report to the application function network element; the evaluation report is used to evaluate the credibility of the verification result, and the verification process is carried out in terms of verification methods and verification algorithms. Evaluation.

The first network element not only sends the verification result to the application function network element, but also sends the reliability analysis of the verification result. In this way, the application function network element will further evaluate the legitimacy of the user's identity, and based on the verification result and evaluation report To provide business services, user accounts are more secure.

Based on the first aspect of the embodiments of the present application to the second implementation manner of the first aspect, the embodiments of the present application also provide a fourth implementation manner of the first aspect:

The first network element can analyze the credibility of the verification result by itself, and it can also send an evaluation request to the fourth network element, and the fourth network element can analyze it and generate an evaluation report; the evaluation report can analyze the verification result. Comprehensive analysis can be evaluated from the verification method, verification algorithm, and other information, and then the evaluation report is sent to the first network element, and the first network element forwards it to the application function network element.

The evaluation report generated by the fourth network element can reduce the load of the first network element and provide a new implementation method for the generation of the evaluation report.

Based on the first aspect of the embodiments of the present application to the fourth implementation manner of the first aspect, the embodiments of the present application also provide a fifth implementation manner of the first aspect:

When the application function network element notifies the core network to perform user verification, it can also instruct the core network to perform different levels of verification. For example, when it is necessary to log in to a financial third-party application, it can instruct the core network to perform a high-level verification method, that is, security. A more reliable verification method. The application network element sends the verification level to the first network element, and the first network element formulates a verification strategy according to the level of the verification. The verification strategy can include the verification method and verification algorithm, etc., and then the first network element verifies according to the verification level. Strategies to filter the first credential corresponding to the user ID, determine the type of the first credential to be authenticated by the user, and then obtain the second credential based on the first credential, and then compare the first credential and the second credential based on the verification strategy , And finally get the verification result.

The first network element formulates a verification strategy according to the verification level sent by the application function network element, which can provide a personalized verification method for each verification, so that core network resources can be more rationally utilized and the waste of core network resources can be avoided.

The second aspect of the embodiments of the present application provides a method for verifying a user identity:

When a user logs into a third-party application through a user account of the core network, the application function network element needs to send a user ID to the first network element to instruct the first network element to authenticate the user account corresponding to the user ID, and the user The account can be bound to multiple terminal devices; after the core network verifies the user account, the application function network element receives the verification result sent by the first network element, and then provides corresponding services based on the verification result.

When a user uses a user account to log in to a third-party application, there is no need for a third-party server to verify the user account, but the core network verifies it, providing a new verification method for the user account.

Based on the second aspect of the embodiments of the present application, the embodiments of the present application also provide a first implementation manner of the second aspect:

The application function network element needs to send the identities of one or more terminals to the first network element. The first network element determines the target terminal based on these terminal identities, and then the first network element obtains the identity verification identity from the target terminal and performs user verification. Then the verification result is fed back to the application function network element, and the application function network element provides services according to the verification result.

Since the first network element determines the target terminal according to the identification of the terminal device sent by the application function network element, the core network can perform user authentication on any terminal device, which facilitates the migration of business services in the user account on different terminals.

Based on the second aspect of the embodiments of the present application to the first implementation manner of the second aspect, the embodiments of the present application also provide a second implementation manner of the second aspect:

The application function network element can also receive an evaluation report sent by the first network element. The evaluation report is an evaluation of the verification method by the core network and is used to indicate the credibility of the verification result. Provide services.

The application function network element not only receives the verification result sent by the first network element, but also can receive the reliability analysis of the verification result of the first network element. In this way, the application function network element will further evaluate the legitimacy of the user’s identity, and then Verification results and evaluation reports are used to provide business services, and user accounts are more secure.

Based on the second aspect of the embodiments of the present application to the second implementation manner of the second aspect, the embodiments of the present application also provide a third implementation manner of the second aspect:

The application function network element can also send the verification level to the first network element to instruct the first network element to determine the verification strategy according to the verification level; for example, if the verification level is low, select a simple verification algorithm, and if the verification level is high, select the credibility. High verification methods and verification algorithms with high security levels, so that the core network can provide a personalized verification method for each user verification, and improve the utilization of network resources.

A third aspect of the embodiments of the present application provides a network element device, including:

A receiving module, configured to receive a user identification from an application function network element, where the user identification is used to indicate a user account, and the user account is associated with the identification of one or more terminal devices;

An obtaining module, configured to obtain a first credential from a second network element according to the user identifier, and the first credential is used to verify the user account;

The acquiring module is further configured to acquire the identification of the one or more terminal devices, and the identification of the terminal device is used to determine the target terminal;

The receiving module is further configured to receive a second credential from the target terminal, where the second credential is an identity verification credential received by the target terminal;

The verification module performs user verification according to the first credential and the second credential.

Based on the third aspect of the embodiments of the present application, the embodiments of the present application also provide a first implementation manner of the third aspect:

The verification module is specifically configured to, if the first credential and the second credential are the same, the verification module sends a first instruction to the application function network element, and the first instruction is used to indicate that the user is successfully authenticated If the first credential and the second credential are different, the verification module sends a second instruction to the application function network element, and the second instruction is used to indicate that the user verification fails.

Based on the third aspect of the embodiments of the present application to the first implementation manner of the third aspect, the embodiments of the present application also provide a second implementation manner of the third aspect:

The obtaining module is specifically configured to receive the terminal identification from the application function network element; or, obtain the identification of the one or more terminal devices corresponding to the user identification from the third network element, where: The third network element stores a mapping relationship between the user identifier and the identifier of the one or more terminal devices.

Based on the third aspect of the embodiments of the present application to the second implementation manner of the third aspect, the embodiments of the present application also provide a third implementation manner of the third aspect:

The network element equipment further includes a sending module;

The sending module is configured to send an evaluation report to the application function network element, the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification method of the user verification.

Based on the third aspect of the embodiments of the present application to the second implementation manner of the third aspect, the embodiments of the present application also provide a fourth implementation manner of the third aspect:

The network element equipment further includes a sending module;

The sending module is configured to send an evaluation request to a fourth network element, the evaluation request is used to instruct the fourth functional network element to generate an evaluation report, the evaluation report is used to indicate the credibility of the verification result, and the The reliability is related to the verification method of the user verification;

The sending module is further configured to send the evaluation report to the application function network element.

Based on the third aspect of the embodiments of the present application to the fourth implementation manner of the third aspect, the embodiments of the present application also provide a fifth implementation manner of the third aspect:

The network element equipment further includes a determining module;

The obtaining module is also used to obtain the verification level sent by the application network element;

The determining module is specifically configured to determine a verification strategy according to the verification level;

The determining module is further configured to determine the type of the first credential according to the verification policy;

The verification module is specifically configured to verify the first credential and the second credential according to the verification policy.

The fourth aspect of the embodiments of the present application provides an application function network element, including:

The sending module is configured to send a user identification to a first network element, where the user identification is used to instruct the first network element to perform identity verification on a user account corresponding to the user identification, and the user account is associated with one or more terminals Device identification association;

A receiving module, configured to receive the verification result sent by the first network element;

The processing module is used to provide services according to the verification result.

Based on the fourth aspect of the embodiments of the present application, the embodiments of the present application also provide a first implementation manner of the fourth aspect:

The sending module is further configured to send the identification of the one or more terminal devices to the first network element;

The processing module is specifically configured to provide a service to the terminal corresponding to the identifier of the terminal device according to the verification result.

Based on the fourth aspect of the embodiments of the present application to the first implementation manner of the fourth aspect, the embodiments of the present application also provide a second implementation manner of the fourth aspect:

The receiving module is further configured to receive an evaluation report sent by the first network element; the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification method of the user verification;

The processing module provides services according to the verification result and/or the evaluation report.

Based on the fourth aspect of the embodiments of the present application to the second implementation manner of the fourth aspect, the embodiments of the present application also provide a third implementation manner of the fourth aspect:

The sending module is further configured to send a verification level to the first network element, where the verification level is used to instruct the first network element to determine a verification strategy according to the verification level.

A fifth aspect of the present application provides a network element device, including: at least one processor and a memory. The memory stores computer-executable instructions that can run on the processor. When the computer-executable instructions are executed by the processor, the The network element device executes the method described in the foregoing first aspect or any one of the possible implementation manners of the first aspect.

A sixth aspect of the present application provides an application function network element, including: at least one processor and a memory, the memory stores computer-executable instructions that can run on the processor, and when the computer-executable instructions are executed by the processor, The application function network element executes the method described in the foregoing second aspect or any one of the possible implementation manners of the second aspect.

The seventh aspect of the present application provides a user identification verification system, including: a network element device and an application function network element, the network element device being described in any one of the possible implementation manners of the third aspect to the third aspect Network element equipment; the application function network element is the application function network element described in any one of the possible implementation manners of the fourth aspect to the fourth aspect.

The eighth aspect of the embodiments of the present application provides a computer storage medium, which is used to store computer software instructions used by the above-mentioned network element device or application function network element, which includes instructions for executing as a network element device or application The program designed by the functional network element.

The network element equipment may be the network element equipment described in the foregoing third aspect.

The application function network element may be the application function network element described in the foregoing fourth aspect.

A ninth aspect of the present application provides a chip or chip system. The chip or chip system includes at least one processor and a communication interface. The communication interface and the at least one processor are interconnected by wires, and the at least one processor is used to run computer programs or instructions, To perform the user identification verification method described in any one of the first aspect to any one of the possible implementation manners of the first aspect;

Among them, the communication interface in the chip can be an input/output interface, a pin, or a circuit.

In a possible implementation, the chip or chip system described above in this application further includes at least one memory, and instructions are stored in the at least one memory. The memory may be a storage unit inside the chip, for example, a register, a cache, etc., or a storage unit of the chip (for example, a read-only memory, a random access memory, etc.).

The tenth aspect of the present application provides a chip or chip system. The chip or chip system includes at least one processor and a communication interface. The communication interface and the at least one processor are interconnected by wires, and the at least one processor is used to run computer programs or instructions, To perform the user identification verification method described in any one of the second aspect to the second aspect in any one of the possible implementation manners;

The eleventh aspect of the embodiments of the present application provides a computer program product. The computer program product includes computer software instructions that can be loaded by a processor to implement any one of the user identification verification methods in the first aspect. The process in the user identification verification method of any one of the second aspect.

The twelfth aspect of the embodiments of the present application provides a computer program product, the computer program product includes computer software instructions, and the computer software instructions can be loaded by a processor to implement any one of the user identification verification methods in the first aspect. The process in the user identity verification method of any one of the second aspect and the third aspect.

In the technical solution provided by the embodiments of this application, when a user ID on the core network side is used to log in to a third-party application, the core network verifies the user ID and sends the verification result to the third-party application. The program determines the user login based on the verification result, avoiding the possibility of using the user ID to log in to third-party applications without verification, which ensures the security of the user account. At the same time, the user verification is uniformly verified by the core network, which simplifies the network Structure improves network performance.

Description of the drawings

Figure 1 is a network architecture diagram of a core network in an embodiment of the application;

FIG. 2 is a schematic diagram of a scenario where multiple users share the same terminal in time sharing in an embodiment of the application;

FIG. 3 is a schematic flowchart of a method for verifying a user identity in an embodiment of this application;

FIG. 4 is a schematic diagram of another process of a method for verifying a user identity in an embodiment of this application;

FIG. 5 is a schematic structural diagram of a network element device in an embodiment of the application;

FIG. 6 is a schematic structural diagram of an application function network element in an embodiment of this application;

FIG. 7 is a schematic structural diagram of another network element device in an embodiment of this application;

FIG. 8 is a schematic structural diagram of another application function network element in an embodiment of the application.

Detailed ways

The embodiments of the present application provide a method for verifying user identity and related equipment, which are used to verify user identity on the core network side.

Figure 1 is a network architecture diagram of the core network of the application; as shown in Figure 1, the core network functions under the 5G network architecture are divided into user plane function (UPF) and control plane network element function (control plane). function, CPF).

In Figure 1, user equipment (UE), (radio) access network ((radio) access network, (R) AN), user plane function (UPF) network element and data network (data network) , DN) is generally called the user layer network function or entity, which is mainly responsible for packet data packet forwarding, QoS control, charging information statistics, etc. The user's data traffic can be transmitted through the data transmission channel established between the UE and the DN .

Among them, UE may include: handheld terminal, notebook computer, subscriber unit, cellular phone, smart phone, wireless data card, personal digital assistant (PDA) computer, tablet Type computer, wireless modem (modem), handheld device (handheld), laptop computer (laptop computer), cordless phone (cordless phone) or wireless local loop (wireless local loop, WLL), machine type communication (machine type) communication, MTC) terminal or other devices that can access the network. The UE and the access network equipment use a certain air interface technology to communicate with each other.

The RAN equipment is mainly responsible for functions such as radio resource management, quality of service (QoS) management, data compression, and encryption on the air interface side. The access network equipment may include various forms of base stations, such as: macro base stations, micro base stations (also referred to as small stations), relay stations, access points, and so on. In systems using different wireless access technologies, the names of devices with base station functions may be different. For example, in 5G systems, they are called gNB.

The control plane network element function is mainly responsible for user registration and authentication, mobility management, and issuing data packet forwarding strategies and QoS control strategies to the user plane to achieve reliable and stable transmission of user-level traffic. Among them, the session management function (session management function, SMF) is mainly used for user-plane network element selection, user-plane network element redirection, internet protocol (IP) address allocation, bearer establishment, modification, and release, etc.; Access and mobility management function (AMF), mainly responsible for signaling processing, such as access control, mobility management, attach and detach, and network element selection functions; policy control function (policy control) function, PCF) network element, which mainly supports the provision of a unified policy framework to control network behavior, provides policy rules to the control layer network function, and is responsible for obtaining user subscription information related to policy decisions. Application function network element (AF): To support the interaction with the 3rd generation partner project (3GPP) core network to provide services, such as influencing data routing decisions, policy control functions, or providing the network side Some services of the three parties; network slice selection function (NSSF) network elements, which are mainly used for network slice selection; AUSF (authentication server function) network elements, which mainly provide authentication and authentication functions; unified data management (unified) data management, UDM), can be used for location management and subscription management; UDR (unified data repository) network element is a unified data warehouse function; network data analysis function (network data analysis function, NWDAF) represents the network analysis logic managed by the operator Function to provide network analysis information for the core network. NEF (network exposure function) network elements are mainly used for the collection, analysis and reorganization of network capabilities, as well as the opening of network capabilities.

The user authentication function (UAF) network element, the user profile management function (UPMF) network element, and the user profile repository (UDR) network element are newly added network elements applied for Logically, they are all independent functional network elements. In specific network element deployment, UAF network elements can be combined with AUSF network elements, UPMF network elements can be combined with UDM network elements, and UPR network elements can be combined with UDR network elements.

Among them, the UAF network element is responsible for the authentication and verification of the user identity and the security assessment, the UPMF network element is responsible for the management of the user account, including the acquisition, update, activation and deletion of the user account, and the UDR network element is responsible for storing information related to the user identity. .

Figure 2 is a schematic diagram of a scenario where multiple users share the same terminal in time sharing according to this application. As shown in Figure 2, a car rental company provides a shared car terminal, and users A and B need to share the terminal in a time-sharing manner. For example, user A uses it in the morning and user B uses it in the afternoon; due to the different personalized needs of users, their subscribed paid service items There will also be gaps. For example, user A subscribes to the autonomous driving service and eMBB service, but user B only requires terminal 1 to only provide the autonomous driving service, because the service providers all use the terminal SIM card to perform traffic billing or provide subscriptions Therefore, car rental companies need to constantly replace the SIM cards in the terminals to meet the needs of different users. This will bring additional management tasks, management and difficulties to the car rental companies.

For users, subscription payment services are bound to a specific SIM card. To transfer payment services from one terminal to another, the SIM card must be migrated. In the 5G era, the same user will have multiple terminals. Each terminal has an independent SIM card and account. User account management is very difficult, and multiple terminals cannot share a certain billing service at the same time. For example, a user’s SIM card subscribes to a data traffic service. When a terminal needs to be connected to the Internet at the same time, the data traffic service subscribed by the user cannot meet the user's needs.

In view of the above problems, the subject of user identification came into being. The core of the subject of user identification is to establish a uniquely marked 3GPP user account for each user on the 3GPP core network side. The user identification is independent of all existing identifications, and the user account stores the The service parameters of the user's contract.

The user account is used to record one or more of the following: the user's user name and password, the group to which it belongs, the network resources that can be accessed, or the user's personal files and settings, etc. For example, each user corresponds to a user account on the core network side, and then the user account signs a contract with each business service provider, and the business service provider provides business services for the user account. User accounts can be used to subscribe to multiple services, such as signing a contract with a third-party application, and the third-party application provides payment for it; signing a contract with a mobile communication operator, and the mobile communication operator provides data traffic and billing for it Service etc.

The user ID can be a digital code assigned by the core network for each user account, or it can be a user-defined user name. The specific form is not limited. The user ID is used to distinguish unique user accounts, and the user ID can be used to match the corresponding User account for management.

The identification of the terminal device is used to distinguish different terminals. It can be the general public user identifier GPSI, the SIM card number of the terminal device, or a user-defined name, such as "xx phone", etc. To uniquely mark a terminal device, the specific form is not limited.

The user ID and user account can dynamically associate one or more user permanent identifier SUPI subscriptions, and the network side can activate, suspend or deactivate the association between the user account and SUPI. Users can subscribe to their own mobile payment service through this user account. If users want to use any terminal, they can change the user account information to notify the core network side to associate the specific terminal SUPI with the user account, and then the network side will The service subscribed by the user account is provided to the terminal corresponding to the SUPI; that is, the user can log in to his 3GPP user account through different terminals. After a series of authentications, the core network provides the exclusive service subscribed by the user account to the terminal, thereby To achieve the flexibility of user subscription service migration, that is, users can enjoy the same subscription service through different terminals without repeating subscriptions or performing "card replacement" operations, which brings great operational convenience to users.

At present, when users register or log in to third-party applications, there are third-party servers for authentication. In the future Internet of Everything scenario, each application will hold an independent account, which is not conducive to building a stable and unified network ecosystem environment. Therefore, network operators need to open the user account identification to external third parties, that is, users can use the user account identification to register when registering or logging in to third-party apps. How does the core network open the user identification verification function to third parties to provide third-party applications The result of user identification verification is an urgent problem to be solved.

Please refer to FIG. 3, which is a schematic diagram of an embodiment of a method for verifying a user identity in an embodiment of this application. As shown in FIG. 3, an embodiment of a method for verifying a user identity provided by the present application includes:

301. The UE sends a login request to the AF network element.

Among them, the login request is used to request the AF network element to log in to the user account and provide the user with the corresponding service in the user account.

When a user uses the 3GPP user ID to log in or register a third-party application, the 3GPP user ID can be provided to the third-party application through the application layer page; the 3GPP user ID is used to indicate the user account in the core network, and the user account is associated with a Or multiple terminal identifiers, the terminal identifier may be the SUPI of the terminal; the user account completes the service migration between different terminals by associating multiple terminal identifiers.

For example, before the UE initiates a login request to the AF network element, the user can bind the terminal ID corresponding to the UE and the 3GPP user ID to obtain the service service of the user ID.

302. The AF network element sends the user identification to the NEF network element.

Optionally, when the application function network element, that is, the AF network element, receives the login request, it can decide whether to perform user verification through the core network according to its own strategy, such as certain non-financial or low account security requirements Third-party applications may not need to initiate user verification to reduce the occupation of core network resources. When third-party applications have high security requirements, user verification can be initiated.

There are many ways for the AF network element to initiate the user authentication process. Optionally, the AF network element can send a user authentication request, the request includes a user ID, to instruct the core network to verify the user ID; the request may also include The user ID and the general public user identifier GPSI of the current terminal. GPSI is used to instruct the core network to obtain verification-related information through the current terminal.

303. The NEF network element sends a user verification request to the UAF network element.

For example, the NEF network element can forward the user verification request sent by the AF network element to the UAF network element; when the verification request also includes the GPSI of the current terminal, the NEF network element can query the UDM network element to obtain the SUPI corresponding to the GPSI , And forward it to the UAF network element.

It is understandable that the NEF network element may not send a user verification request to the UAF network element, but only needs to send the user ID, and this step is optional.

304. The UAF network element sends a query request to the UPMF network element.

For example, when the UAF network element receives the verification request forwarded by the NEF network element, it needs to perform identity verification on the user identity. Optionally, the UAF network element may first determine the authentication method, which may include the type of identity, the algorithm used in the authentication, etc., which are not specifically limited.

Optionally, the identity identifier corresponding to the user account is pre-stored in the UPMF network element. For example, when the user creates a 3GPP user account, the corresponding one or identity identifier is preset, and the types of multiple identities can also be There are many types, including face information, fingerprint information, iris information, or passwords, etc. The specifics are not limited, and these identities can all be used as identity verification credentials.

When the first network element, that is, the UAF network element, performs identity verification, it needs to query the first credential in the UPMF network element. Optionally, the query request includes the user ID. When the UPMF network element receives the user ID, it Find one or more first credentials corresponding to the user ID according to the user ID.

It is understandable that the UAF network element may not send a query request to the UPMF network element, but directly send the user ID to the UPMF network element, and the UPMF network element returns the first credential corresponding to the user ID. This step is an optional step.

305. The UPMF network element sends the first credential to the UAF network element.

The UPMF network element sends one or more first vouchers to the UAF network element.

306. The UAF network element determines the target terminal.

For example, the UAF network element may determine that the current terminal is the target terminal according to the terminal identifier sent by the NEF network element. For example, the terminal identifier may be SUPI sent by the NEF network element.

For example, step 306 and steps 304 and 305 are not in a sequential order. The UAF network element may first determine the target terminal and then send the query request to the UPMF network element, or it may first send the query request to the UPMF network element and then determine the target terminal. It can also be carried out at the same time, and the specifics are not limited.

307. The UAF network element sends a collection message to the AMF network element.

After the UAF network element determines the target terminal, it needs to collect the second credential entered by the user through the target terminal, where the second credential is of the same type as the first credential and is the identity credential entered by the user according to the instructions. Then the UAF network element performs verification according to the second certificate and the first certificate; the UAF network element can determine the AMF network element according to the received SUPI, and then complete the process of receiving the second certificate through the AMF network element. Optionally, UAF The network element sends a collection message to the AMF network element, and the collection message may include the SUPI of the target terminal.

308. The AMF network element sends a collection instruction to the UE.

After the AMF network element receives the SUPI of the target terminal, it sends a collection instruction to the target terminal according to the SUPI, which is used to instruct the user to input relevant information;

Exemplarily, when the UAF network element receives a verification request for a certain user identity, it searches the UPMF network element for the first credential corresponding to the terminal. For example, if the first credential is a preset fingerprint, the UAF network element obtains this credential, and then the UAF network element sends a collection message to the AMF network element corresponding to the terminal, and the AMF network element sends a collection instruction to the terminal according to the collection message for Instruct the terminal to send the second credential, that is, instruct the user to input a fingerprint, and then compare the input fingerprint with the original preset fingerprint to complete the verification process.

For example, the first credential can also be multiple. For example, the first credential is a preset fingerprint and a preset password. The UAF network element obtains these two credentials, and then sends a collection message to the AMF network element corresponding to the terminal. The element sends a collection instruction to the terminal according to the collection message, which is used to instruct the terminal to send multiple second vouchers. The user can input the fingerprint and password according to the instructions. The UAF network element compares the first vouchers corresponding to each other according to the received second vouchers. Compare with the second certificate respectively to complete the verification process.

309. The UE sends the second credential to the AMF network element.

For example, the user can input the second credential according to the instruction, and the UE forwards the second credential to the AMF network element. The second credential is the identity verification credential collected by the target terminal.

310. The AMF network element forwards the second credential to the UAF network element.

311. The UAF network element performs user authentication according to the first credential and the second credential.

For example, when the UAF network element receives the first credential and the second credential, it needs to compare according to the verification algorithm. If the first credential and the second credential are the same, the user authentication is successful; if the first credential and the second credential are the same If the second credential is different, it means that the user authentication has failed.

312. The UAF network element sends the verification result and/or evaluation report to the AF network element.

Exemplarily, when the user authentication is successful, the first network element, that is, the UAF network element, may send a first indication to the AF network element, the first indication is used to indicate that the user authentication is successful; when the user authentication fails, the first network element is the UAF The network element may send a second indication to the AF network element, where the second indication is used to indicate that the user authentication fails.

Optionally, the UAF network element can also evaluate the accuracy of the verification process. The UAF network element can collect information related to the user identification verification according to the instructions, such as the length of the secret key used for user verification, encryption algorithm, and The mechanism (such as SMS verification, fingerprint verification, faceID verification, blockchain verification...), etc., and then based on the above information, an evaluation report is given to indicate the reliability of the verification result. For example, the evaluation report may include an evaluation of the reliability of the verification type, the accuracy of the verification algorithm, the reliability of the source of the message, etc., and may also include a score on the credibility of the verification result, etc., to indicate the accuracy of the verification result.

Exemplarily, the first credential corresponding to a certain user account has preset fingerprints and iris information, and the UAF network element uses a fingerprint identification verification method in a certain verification process, so the credibility of the verification result is low. In a certain verification process, the verification method of iris verification is used, so that the credibility of the verification result is higher.

Exemplarily, the first credential corresponding to a certain user account has a preset fingerprint, and the verification algorithm used by the UAF network element in a certain verification process only needs to verify 70% of the area of the fingerprint. In this way, the verification The credibility of the result is low, and in another verification process, the verification algorithm used needs to verify 90% of the fingerprint area, so the credibility of the verification result is higher.

313. The AF network element provides services according to the verification result and/or the evaluation report.

When the UAF network element sends the verification result and/or the evaluation report to the AF network element, the AF network element can provide services according to its own strategy; for example, the AF network element sends a verification request for a certain user identity to the core network If the verification result obtained is that the verification is successful, the AF network element allows the account to log in to the third-party application. If the verification result is that the verification fails, the account is not allowed to log in; and if the verification result obtained by the AF network element is that the verification is successful, but If the verification result indicated by the evaluation report is not feasible, the AF network element may also not allow the account to log in to the third-party application.

In this embodiment, when a user ID on the core network side is used to log in to a third-party application, the core network verifies the user ID and sends the verification result to the third-party application. As a result, the user is determined to log in, so that the user ID can be used to log in to third-party applications without verification, and the security of the user account is ensured. At the same time, the user ID is verified on the core network side, and the verification result is opened to third-party applications. The third party can directly provide business services based on the verification result of the core network without requiring multiple third-party servers to perform separate accounts on their respective accounts. The verification simplifies the network structure, integrates network resources, and improves network performance.

Please refer to FIG. 4, which is a schematic diagram of another embodiment of a method for verifying a user identity in an embodiment of this application. As shown in FIG. 4, another embodiment of a method for verifying a user identity provided by the present application includes:

401. The UE initiates a login request to the AF network element.

Step 401 is similar to step 301 in the embodiment shown in FIG. 3 and will not be repeated here.

402. The AF network element sends the user identification and verification level to the NEF network element.

Optionally, when the AF network element initiates a user authentication process to the core network, it can send an authentication level to the core network to instruct the core network to determine the user authentication method according to the authentication level. Illustratively, the user initiates a login request through the UE At the time, the authentication level can be entered in the application layer interface, and the AF network element will send it to the NEF network element after receiving the user ID and the authentication level.

Optionally, the AF network element can also determine the verification level through its own strategy. For example, when the AF network element determines that the third-party network element is a financial application, it determines that the verification level is high, and sends the user identification and verification level. For NEF network elements, it is used to instruct the core network to use a more complex and accurate verification algorithm for verification. If the AF network element determines that the third-party network element is a video application, the verification level is determined to be low, which is used to indicate the core The network uses simpler verification algorithms for verification, so that verification strategies can be individually adjusted and network resources can be fully utilized.

403. The NEF network element sends verification information to the UPMF network element.

For example, the NEF network element may forward the user identification sent by the AF network element to the UPMF network element.

404. The UPMF network element sends verification information to the UAF network element.

For example, a 3GPP user identity can be bound to multiple terminals, and its mapping relationship with the terminal identity can be stored in the UPMF network element. When the UPMF network element receives the user identity sent by the NEF network element, it can be based on the user identity. Determine the corresponding terminal ID. For example, you can determine the SUPI of the terminal corresponding to the user ID, and then send verification information to the UAF network element to call the verification function of the UAF network element. The verification information can include the user ID and the user ID. The corresponding one or more SUPIs.

Optionally, the UPMF network element may not send one or more SUPIs corresponding to the user ID. After the UAF network element determines the verification policy, it sends the query information to the UPMF network element, and the UPMF network element sends the user ID corresponding to it. One or more SUPI.

405. The UAF network element determines a verification strategy according to the verification level.

When the UAF network element verifies the user identity, it needs to determine the verification strategy according to the received verification level. Optionally, the verification strategy may include verification types and verification algorithms. Verification types can include fingerprint verification, iris verification, voice verification, and so on. The verification algorithm may include different algorithms for each verification type, such as a small area fingerprint verification algorithm, an encryption algorithm for password verification, etc. The specific form is not limited.

Exemplarily, if the verification level is high, iris verification can be selected, and if the verification level is low, fingerprint verification can be selected, that is, the UAF network element can determine the first credential according to the verification level. Exemplarily, in terms of password verification, if the verification level is high, the first credential can be the full password, and if the verification level is low, the first credential can be the last few digits of the password; the UAF network element can be based on the verification level To determine different verification strategies to meet different needs.

406. The UAF network element determines the target terminal.

For example, the UAF network element may determine that the current terminal is the target terminal according to the terminal identifier sent by the UPMF network element, and the terminal identifier may be the SUPI sent by the UPMF network element.

For example, step 406 and step 405 are not sequential. The UAF network element may first determine the target terminal and then determine the verification strategy, or first determine the verification strategy, and then determine the target terminal, and may also be performed at the same time, and the specifics are not limited.

407. The UAF network element sends a collection message to the AMF network element.

For example, step 407 is similar to step 307 in the embodiment shown in FIG. 3, and will not be repeated here.

408. The AMF network element sends a collection instruction to the UE.

For example, step 408 is similar to step 308 in the embodiment shown in FIG. 3, and will not be repeated here.

409. The UE sends the second credential to the AMF network element.

For example, step 409 is similar to step 309 in the embodiment shown in FIG. 3, and will not be repeated here.

410. The AMF network element forwards the second credential to the UAF network element.

For example, step 410 is similar to step 307 in the embodiment shown in FIG. 3, and will not be repeated here.

411. The UAF network element performs user authentication according to the first credential and the second credential.

For example, step 411 is similar to step 311 in the embodiment shown in FIG. 3, and will not be repeated here.

412. The UAF network element sends a verification rating request to the NWDAF network element.

The NWDAF network element has a network data analysis function, which represents the network analysis logic function managed by the operator, and provides network analysis information for the core network. Therefore, it can interact with multiple network elements to obtain a variety of information in the verification process. In addition to the security assessment of the authentication mechanism and algorithm used in the authentication process, other information can be obtained, such as obtaining the current location information of the UE participating in the user authentication from the AMF network element, and obtaining the UE’s session from the SMF network element Business information, etc. To conduct a comprehensive security assessment for this verification; therefore, the UAF network element can instruct the NWDAF network element to conduct a security assessment.

413. The NWDAF network element determines the evaluation report.

The NWDAF network element determines the evaluation report based on a variety of information, and the evaluation report is used to indicate the credibility and security of this verification.

414. The NWDAF network element sends an evaluation report to the UAF network element.

For example, step 415 is similar to step 312 in the embodiment shown in FIG. 3, and will not be repeated here.

416. The AF network element provides services according to the verification result and/or the evaluation report.

For example, step 416 is similar to step 313 in the embodiment shown in FIG. 3, and will not be repeated here.

In the above-mentioned embodiments provided by the present application, the solutions of the communication methods provided by the embodiments of the present application are respectively introduced from the perspective of each network element itself and the interaction between each network element. It is understandable that each network element and device, such as the above-mentioned radio access network device, access and mobility management function network element, user equipment, data management function network element, and network slice selection function network element, in order to realize the above functions, Contains the corresponding hardware structure and/or software module to perform each function. Those skilled in the art should easily realize that in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

For example, when the aforementioned network elements implement corresponding functions through software modules. The network element device 500 may include a receiving module 501, an obtaining module 502, and a verification module 503, as shown in FIG. 5.

The receiving module 501 is configured to receive a user identification from an application function network element, where the user identification is used to indicate a user account, and the user account is associated with the identification of one or more terminal devices;

The obtaining module 502 is configured to obtain a first credential from a second network element according to the user identifier, and the first credential is used to verify the user account;

The acquiring module 502 is further configured to acquire the identification of the one or more terminal devices, and the identification of the terminal device is used to determine the target terminal;

The receiving module 501 is further configured to receive a second credential from the target terminal, where the second credential is an identity verification credential received by the target terminal;

The verification module 503 performs user verification according to the first credential and the second credential.

Wherein, the receiving module 501 executes step 303 and step 310 in the embodiment shown in FIG. 3 or the method described in step 404 and step 410 in the embodiment shown in FIG. 4, and the acquisition module 502 executes step 305 and step in the embodiment shown in FIG. 3 303 or the method described in step 404 of the embodiment shown in FIG. 4, and the verification module 503 executes the method described in step 311 of the embodiment shown in FIG. 3 or the method described in step 411 of the embodiment shown in FIG.

In another embodiment of the network element device 500 provided in the embodiment of the present application, the verification module 503 is specifically configured to: if the first credential and the second credential are the same, the verification module 503 sends the The application function network element sends a first instruction, and the first instruction is used to indicate that the user is successfully authenticated; if the first credential and the second credential are different, the verification module 503 sends to the application function network element The second indication, the second indication is used to indicate that the user authentication fails.

The verification module 503 executes the method described in step 312 in the embodiment shown in FIG. 3 or step 415 in the embodiment shown in FIG. 4.

In another embodiment of a network element device 500 provided in the embodiment of the present application, the obtaining module 502 is specifically configured to receive the terminal identifier from the application function network element; or, from the third network element Acquire the identity of the one or more terminal devices corresponding to the user identity, wherein the third network element stores a mapping relationship between the user identity and the identity of the one or more terminal devices.

Wherein, the acquiring module 502 executes the method described in step 303 of the embodiment shown in FIG. 3 or step 404 of the embodiment shown in FIG. 4.

In another embodiment of a network element device 500 provided in an embodiment of the present application, the network element device 500 further includes a sending module 504;

The sending module 504 is configured to send an evaluation report to the application function network element, the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification method of the user verification.

The sending module 502 executes the method described in step 312 of the embodiment shown in FIG. 3 or step 414 of the embodiment shown in FIG. 4.

In another embodiment of a network element device 500 provided in an embodiment of the present application, the sending module 504 is configured to send an evaluation request to a fourth network element, and the evaluation request is used to instruct the fourth functional network element to generate An evaluation report, where the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification method of the user verification;

The sending module 504 is further configured to send the evaluation report to the application function network element.

Wherein, the sending module 504 has the method described in step 412 and step 414 in the embodiment described in FIG. 4.

In another embodiment of a network element device 500 provided in an embodiment of the present application, the network element device 500 further includes a determining module 505;

The obtaining module 502 is also used to obtain the verification level sent by the application network element;

The determining module 505 is specifically configured to determine a verification strategy according to the verification level;

The determining module 505 is further configured to determine the type of the first credential according to the verification policy;

The verification module 503 is specifically configured to verify the first credential and the second credential according to the verification policy.

Wherein, the obtaining module 502 executes the method described in step 404 of the embodiment shown in FIG. 4, the determining module 505 executes the method described in step 405 of the embodiment shown in FIG. 4, and the verification module 503 executes the method described in FIG. 4 The method described in step 411 of the embodiment.

Please refer to FIG. 6, which is a schematic structural diagram of an application function network element 600 provided by an embodiment of the present application. As shown in FIG. 6, the application function network element 600 includes:

The sending module 601 is configured to send a user identification to a first network element, where the user identification is used to instruct the first network element to perform identity verification on a user account corresponding to the user identification, and the user account is associated with one or more Identification association of terminal equipment;

The receiving module 602 is configured to receive the verification result sent by the first network element;

The processing module 603 is configured to provide services according to the verification result.

Wherein, the sending module 601 performs the method described in step 302 in the embodiment shown in FIG. 3 and the method described in step 402 in the embodiment shown in FIG. 4, and the receiving module 602 performs step 312 in the embodiment shown in FIG. 4 In the method described in step 415 in the embodiment, the processing module 603 executes the method described in step 313 in the embodiment shown in FIG. 3 and step 416 in the embodiment shown in FIG. 4.

In another embodiment of an application function network element 600 provided in an embodiment of the present application, the sending module 601 is further configured to send the identification of the one or more terminal devices to the first network element;

The processing module 603 is specifically configured to provide a service to the terminal corresponding to the identifier of the terminal device according to the verification result.

The sending module 601 executes the method described in step 302 of the embodiment shown in FIG. 3, and the processing module 603 executes the method described in step 313 of the embodiment shown in FIG. 3 and the method described in step 416 of the embodiment shown in FIG. 4.

In another embodiment of an application function network element 600 provided in the embodiment of the present application, the receiving module 602 is further configured to receive an evaluation report sent by the first network element; the evaluation report is used to indicate the verification result. Credibility, the credibility is related to the verification method of the user verification;

The processing module 603 provides services according to the verification result and/or the evaluation report.

Wherein, the receiving module 601 performs the method described in step 312 in the embodiment shown in FIG. 3 and the method described in step 415 in the embodiment shown in FIG. 4, and the processing module 603 performs step 313 in the embodiment shown in FIG. 3 and in FIG. 4 The method described in step 416 of the embodiment.

In another embodiment of an application function network element 600 provided in the embodiment of the present application, the sending module 601 is further configured to send a verification level to the first network element, and the verification level is used to indicate the first network element. A network element determines a verification strategy according to the verification level.

Wherein, the sending module 601 executes step 402 in the embodiment described in FIG. 4.

Please refer to FIG. 7, which is a schematic structural diagram of another network element device provided by an embodiment of this application. The network element device 700 includes a processor 701, a memory 702, and a communication interface 703.

The processor 701, the memory 702, and the communication interface 703 are connected to each other through a bus; the bus may be a peripheral component interconnection standard (PCI) bus or an extended industry standard architecture (EISA) bus or the like. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 7, but it does not mean that there is only one bus or one type of bus.

The memory 702 may include a volatile memory (volatile memory), such as a random-access memory (random-access memory, RAM); the memory may also include a non-volatile memory (non-volatile memory), such as a flash memory (flash memory). ), a hard disk drive (HDD) or a solid-state drive (SSD); the storage 702 may also include a combination of the foregoing types of storage.

The processor 701 may be a central processing unit (CPU), a network processor (English: network processor, NP), or a combination of CPU and NP. The processor 702 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

The communication interface 703 may be a wired communication interface, a wireless communication interface, or a combination thereof, where the wired communication interface may be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a WLAN interface, a cellular network communication interface, or a combination thereof.

Optionally, the memory 702 may also be used to store program instructions. The processor 701 calls the program instructions stored in the memory 702 to execute steps 304, 306, 307, 311, and 311 in the method embodiment shown in FIG. 3 or FIG. 312 or one or more of steps 405, 406, 407, 411, 412, and 415, or alternative implementations thereof, enable the network element device 700 to implement the function of the network element device in the above method, specifically here No longer.

Please refer to FIG. 8, which is a schematic structural diagram of an application function network element provided by an embodiment of this application, including a processor 801, a memory 802, and a communication interface 803.

The memory 802 may be short-term storage or persistent storage. Furthermore, the central processing unit 801 may be configured to communicate with the memory 802, and execute a series of instruction operations in the memory 802 on the sending device.

In this embodiment, the central processing unit 801 can execute the operations performed by the application function network elements in the embodiments shown in FIG. 3 and FIG. 4, and details are not described herein again.

In this embodiment, the specific functional module division in the central processing unit 801 may be similar to the functional module division of the sending unit, the receiving unit, and the processing unit described in FIG. 6, and will not be repeated here.

An embodiment of the present application also provides a user identification verification system, including: the network element device shown in FIG. 5 or FIG. 7 and the application function network element shown in FIG. 6 or FIG. 8.

The embodiment of the present application also provides a chip or chip system. The chip or chip system includes at least one processor and a communication interface. The communication interface and the at least one processor are interconnected through a wire. One or more steps in the method embodiment shown in FIG. 3 or FIG. 4, or optional implementation manners thereof, are used to implement the function of the network element device in the foregoing method.

In a possible implementation, the chip or chip system described above further includes at least one memory, and instructions are stored in the at least one memory. The memory may be a storage unit inside the chip, for example, a register, a cache, etc., or a storage unit of the chip (for example, a read-only memory, a random access memory, etc.).

The embodiments of the present application also provide a chip or chip system. The chip or chip system includes at least one processor and a communication interface. The communication interface and the at least one processor are interconnected by wires, and the at least one processor is used to run computer programs or instructions, To perform the execution method of the application function network element described in any one of the possible implementation manners of the embodiments shown in FIG. 3 and FIG. 4;

The embodiment of the present application also provides a computer storage medium, and the computer storage medium stores computer program instructions for realizing the function of the network element device in the user identification verification method provided in the embodiment of the present application.

The embodiment of the present application also provides a computer storage medium, and the computer storage medium stores computer program instructions for implementing the application function network element in the user identification verification method provided in the embodiment of the present application.

The embodiment of the present application also provides a computer program product, the computer program product includes computer software instructions, the computer software instructions can be loaded by a processor to achieve the above-mentioned Figure 3 or Figure 4 in the method for verifying the user identity .

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part.

Those skilled in the art can clearly understand that, for the convenience and conciseness of the description, the specific working process of the above-described system, device, and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method can be implemented in other ways. For example, the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium. , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disks or optical disks and other media that can store program codes. .

Claims

A method for verifying user identity, characterized in that the method includes:

The first network element receives a user identifier from the application function network element, where the user identifier is used to indicate a user account, and the user account is associated with the identifiers of one or more terminal devices;

Obtaining, by the first network element, a first credential from a second network element according to the user identifier, and the first credential is used to verify the user account;

Acquiring, by the first network element, the identification of the one or more terminal devices, and the identification of the terminal device is used to determine a target terminal;

The first network element receives a second credential from the target terminal, where the second credential is an identity verification credential received by the target terminal;

The first network element performs user authentication according to the first credential and the second credential.
The method according to claim 1, wherein the first network element performs user authentication according to the first credential and the second credential, comprising:

If the first credential and the second credential are the same, the first network element sends a first instruction to the application function network element, where the first instruction is used to indicate that the user authentication is successful;

If the first credential and the second credential are different, the first network element sends a second instruction to the application function network element, where the second instruction is used to indicate that the user authentication fails.
The method according to any one of claims 1 to 2, wherein the acquiring, by the first network element, the identification of the one or more terminal devices comprises:

The first network element receives the terminal identifier from the application function network element; or,

The first network element obtains the identification of the one or more terminal devices corresponding to the user identification from the third network element, wherein the third network element stores the user identification and the one or The mapping relationship of the identities of multiple terminal devices.
The method according to any one of claims 1 to 3, wherein the method further comprises:

The first network element sends an evaluation report to the application function network element, where the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification mode of the user verification.
The method according to any one of claims 1 to 3, wherein the method further comprises:

The first network element sends an evaluation request to the fourth network element, the evaluation request is used to instruct the fourth functional network element to generate an evaluation report, the evaluation report is used to indicate the credibility of the verification result, and the evaluation request is used to indicate the credibility of the verification result. The reliability is related to the verification method of the user verification;

The first network element sends the evaluation report to the application function network element.
The method according to any one of claims 1 to 5, wherein before the first network element obtains the first credential corresponding to the user ID from the second network element according to the user ID, the method further include:

Acquiring, by the first network element, the verification level sent by the application network element;

The first network element determines a verification strategy according to the verification level;

Determining, by the first network element, the type of the first credential according to the verification policy;

The first network element to perform user authentication according to the first credential and the second credential includes:

The first network element verifies the first credential and the second credential according to the verification policy.
A method for verifying user identity, characterized in that the method includes:

The application function network element sends a user identification to the first network element, where the user identification is used to instruct the first network element to perform identity verification on the user account corresponding to the user identification, and the user account is associated with one or more terminal devices ’S identity association;

Receiving, by the application function network element, the verification result sent by the first network element;

The application function network element provides services according to the verification result.
The method according to claim 7, wherein before the application function network element receives the verification result sent by the first network element, the method further comprises:

Sending, by the application function network element, the identification of the one or more terminal devices to the first network element;

The application function network element providing services according to the verification result includes:

The application function network element provides a service to the terminal corresponding to the identifier of the terminal device according to the verification result.
The method according to any one of claims 7 to 8, wherein the method further comprises:

The application function network element receives the evaluation report sent by the first network element; the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification method of the user verification;

The application function network element providing services according to the verification result includes:

The application function network element provides services according to the verification result and/or the evaluation report.
The method according to any one of claims 7 to 9, wherein before the application function network element receives the verification result sent by the first network element, the method further comprises:

The application function network element sends a verification level to the first network element, where the verification level is used to instruct the first network element to determine a verification strategy according to the verification level.
A network element device, characterized in that, the network element device includes:

A receiving module, configured to receive a user identification from an application function network element, where the user identification is used to indicate a user account, and the user account is associated with the identification of one or more terminal devices;

An obtaining module, configured to obtain a first credential from a second network element according to the user identifier, and the first credential is used to verify the user account;

The acquiring module is further configured to acquire the identification of the one or more terminal devices, and the identification of the terminal device is used to determine the target terminal;

The receiving module is further configured to receive a second credential from the target terminal, where the second credential is an identity verification credential received by the target terminal;

The verification module performs user verification according to the first credential and the second credential.
The network element device according to claim 11, wherein the verification module is specifically configured to send the verification module to the application function network element if the first credential and the second credential are the same The first instruction, the first instruction is used to indicate that the user authentication is successful; if the first credential is different from the second credential, the verification module sends a second instruction to the application function network element, and the first credential The second indication is used to indicate that the user authentication has failed.
The network element device according to any one of claims 11 to 12, wherein the acquiring module is specifically configured to receive the terminal identifier from the application function network element; or, from the third network element Acquire the identity of the one or more terminal devices corresponding to the user identity, wherein the third network element stores a mapping relationship between the user identity and the identity of the one or more terminal devices.
The network element device according to any one of claims 11 to 13, wherein the network element device further comprises a sending module;

The sending module is configured to send an evaluation report to the application function network element, the evaluation report is used to indicate the credibility of the verification result, and the credibility is related to the verification method of the user verification.
The network element device according to any one of claims 11 to 13, wherein the network element device further comprises a sending module;

The sending module is configured to send an evaluation request to a fourth network element, the evaluation request is used to instruct the fourth functional network element to generate an evaluation report, the evaluation report is used to indicate the credibility of the verification result, and the The reliability is related to the verification method of the user verification;

The sending module is further configured to send the evaluation report to the application function network element.
The network element device according to any one of claims 11 to 15, wherein the network element device further comprises a determining module;

The obtaining module is also used to obtain the verification level sent by the application network element;

The determining module is specifically configured to determine a verification strategy according to the verification level;

The determining module is further configured to determine the type of the first credential according to the verification policy;

The verification module is specifically configured to verify the first credential and the second credential according to the verification policy.
An application function network element, characterized in that, the application function network element includes:

The sending module is configured to send a user identification to a first network element, where the user identification is used to instruct the first network element to perform identity verification on a user account corresponding to the user identification, and the user account is associated with one or more terminals Device identification association;

A receiving module, configured to receive the verification result sent by the first network element;

The processing module is used to provide services according to the verification result.
The application function network element according to claim 17, wherein the sending module is further configured to send the identification of the one or more terminal devices to the first network element;

The processing module is specifically configured to provide a service to the terminal corresponding to the identifier of the terminal device according to the verification result.
The application function network element according to any one of claims 17 to 18, wherein the receiving module is further configured to receive an evaluation report sent by the first network element; the evaluation report is used to indicate the verification result Credibility, the credibility is related to the verification method of the user verification;

The processing module provides services according to the verification result and/or the evaluation report.
The application function network element according to any one of claims 17 to 19, wherein the sending module is further configured to send a verification level to the first network element, and the verification level is used to indicate the first network element. A network element determines a verification strategy according to the verification level.
A network element device includes: at least one processor and a memory, the memory stores computer-executable instructions that can run on the processor, and when the computer-executable instructions are executed by the processor, the processor executes as described above The method described in any one of the possible implementations of claim 1 to claim 6.
An application function network element, comprising: at least one processor and a memory. The memory stores computer-executable instructions that can run on the processor. When the computer-executable instructions are executed by the processor, the processor executes The method described in any one of the possible implementations of claim 7 to claim 10.
A system for verifying a user identity, comprising: a network element device and an application function network element, the network element device being the network element device according to any one of claims 11 to 16, the application function network The element is an application function network element according to any one of claims 17 to 20.
A computer-readable storage medium storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor executes any one of the preceding claims 1 to 10 Methods.