WO2021253852A1 - 一种基于数据中心5g网络加密组播的权限认证方法与系统 - Google Patents

一种基于数据中心5g网络加密组播的权限认证方法与系统 Download PDF

Info

Publication number
WO2021253852A1
WO2021253852A1 PCT/CN2021/076837 CN2021076837W WO2021253852A1 WO 2021253852 A1 WO2021253852 A1 WO 2021253852A1 CN 2021076837 W CN2021076837 W CN 2021076837W WO 2021253852 A1 WO2021253852 A1 WO 2021253852A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
multicast
platform
data center
encrypted
Prior art date
Application number
PCT/CN2021/076837
Other languages
English (en)
French (fr)
Inventor
张鑫
王晓通
何万县
Original Assignee
苏州浪潮智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州浪潮智能科技有限公司 filed Critical 苏州浪潮智能科技有限公司
Priority to US17/796,015 priority Critical patent/US11659384B2/en
Publication of WO2021253852A1 publication Critical patent/WO2021253852A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys

Definitions

  • the present invention relates to the technical field of 5G network communication, in particular to a permission authentication method and system based on encrypted multicast of a data center 5G network.
  • 5G the fifth-generation mobile communication technology.
  • 5G has a theoretical maximum transmission speed of up to tens of Gb per second, which is hundreds of times faster than the 4G network transmission speed.
  • the download of an ultra-clear movie only requires 10 seconds.
  • 5G technology can be used for large-scale event scenes such as events, concerts, major events, etc. for 4K/8K, VR (Virtual Reality, virtual reality) live broadcast,
  • the 5G network brings users a more immersive and interactive experience.
  • the current permission authentication methods for network access are generally relatively simple, or traditionally rely on user names, passwords and randomly generated verification codes.
  • this kind of authority authentication method lacks the necessary security unified system, which is very dangerous and affects the secure access of 5G networks.
  • the current network authentication method is slow, and it is difficult to meet the high-speed needs of 5G networks.
  • the purpose of the present invention is to provide a permission authentication method and system based on data center 5G network encryption multicast, aiming to solve the problems of high security risk and slow speed in network permission authentication in the prior art, and to achieve a significant improvement in data center The speed and safety of platform intercommunication.
  • the present invention provides a permission authentication method based on encrypted multicast of a data center 5G network, the method includes the following operations:
  • the data center platform in the 5G network is configured with the network encryption multicast component, and the user name and password are configured;
  • the platform authentication access management server converts the platform user name and password into an information matrix, and verifies the user name and password by matching the information matrix;
  • the platforms discover each other through encrypted multicast messages, perform a handshake, and store the other party's IP address and service type locally;
  • the platforms are connected through mutual heartbeats, and the message is encrypted with the date for directed transmission. After each platform receives the message, it uses the local time to decrypt it;
  • the multicast message includes the IP address of the machine, the service type of the machine, the unique identifier of the machine, the cipher text and the MAC address.
  • the network encrypted multicast component has a unique identifier.
  • the verification of the platform authority specifically includes:
  • step D If yes, then the verification is passed, and go to step D, otherwise go to step B;
  • step B Check whether it hits the user IP whitelist, if yes, the verification is passed, and step D is executed, otherwise, step C is executed;
  • step C Verify the ciphertext, if the verification fails, an exception will be thrown, and if the verification is passed, proceed to step D;
  • the present invention also provides a permission authentication system based on data center 5G network encrypted multicast, the system includes:
  • the multicast component configuration module is used to configure the network encrypted multicast component on the data center platform in the 5G network, and configure the user name and password;
  • the user name and password verification module is used for platform authentication and access management server to convert the platform user name and password into an information matrix, and verify the user name and password through the matching information matrix;
  • the key configuration module is used to configure the key for network encrypted multicast, and encrypt the multicast message sent by the platform to the network;
  • the handshake module is used between platforms to discover each other through encrypted multicast messages, perform a handshake, and store the other party's IP address and service type locally;
  • the docking module is used for docking between platforms through mutual heartbeats after the handshake, encrypting the message with the date for directional transmission, and each platform will decrypt the message with the local time after receiving the message;
  • the authority verification module is used to verify the platform authority through multicast messages.
  • the multicast message includes the IP address of the machine, the service type of the machine, the unique identifier of the machine, the cipher text and the MAC address.
  • the network encrypted multicast component has a unique identifier.
  • the present invention also provides a permission authentication device based on the encrypted multicast of the 5G network of the data center, including:
  • Memory used to store computer programs
  • the processor is configured to execute the computer program to implement the authority authentication method based on the encrypted multicast of the 5G network of the data center.
  • the present invention also provides a readable storage medium for storing a computer program, wherein the computer program is executed by a processor to realize the authorization authentication method based on the data center 5G network encrypted multicast.
  • the present invention uses 5G encrypted network multicast to authenticate each platform of the data center and open up data, configure network encrypted multicast components on the data center platform, and send encrypted multicast messages to the network through the platform.
  • 5G encrypted network multicast to authenticate each platform of the data center and open up data, configure network encrypted multicast components on the data center platform, and send encrypted multicast messages to the network through the platform.
  • FIG. 1 is a flowchart of a permission authentication method based on encrypted multicast of a data center 5G network provided in an embodiment of the present invention
  • Fig. 2 is a block diagram of a rights authentication system based on encrypted multicast of a data center 5G network provided in an embodiment of the present invention.
  • the present invention discloses a permission authentication method based on encrypted multicast of a data center 5G network, the method includes the following operations:
  • the data center platform in the 5G network is configured with the network encryption multicast component, and the user name and password are configured;
  • the platform authentication access management server converts the platform user name and password into an information matrix, and verifies the user name and password by matching the information matrix;
  • the platforms discover each other through encrypted multicast messages, perform a handshake, and store the other party's IP address and service type locally;
  • the platforms are connected through mutual heartbeats, and the message is encrypted with the date for directed transmission. After each platform receives the message, it uses the local time to decrypt it;
  • Each platform needs to use a network encryption multicast component, which has a unique identifier, and the network encryption multicast component It is equipped with the highest authority of the administrator who logs in locally and a special encryption code.
  • the network multicast component sends a specific encrypted multicast to the entire network according to the configuration items.
  • the platform authentication access management server converts the entered user name and password into a user name information matrix and a password information matrix, and queries whether there is a match in the platform authentication access management server If both of the password information matrix and user name information matrix match successfully, the ciphertext configuration will be performed.
  • the multicast messages sent by the four platforms A, B, C, and D in the network to the network include the IP (Internet Protocol) address of the machine, the service type of the machine, the unique identifier of the machine, Cipher text and MAC address (Media Access Control Address).
  • ASCII American Standard Code for Information Interchang, American Standard Code for Information Interchang
  • the two platforms A and B compare the ciphertexts through encrypted multicast and find each other, the two platforms hold handshake and store the other's IP address and service type locally.
  • the two platforms need to exchange heartbeats to detect the existence of each other.
  • the entire message will be encrypted and sent by date.
  • Each platform After receiving the message, the local time is used for decryption, and the decryption failure is an abnormal message.
  • step D If yes, then the verification is passed, and go to step D, otherwise go to step B;
  • step B Check whether it hits the user IP whitelist, if yes, the verification is passed, and step D is executed, otherwise, step C is executed;
  • step C Verify the ciphertext, if the verification fails, an exception will be thrown, and if the verification is passed, proceed to step D;
  • the embodiment of the present invention uses 5G encrypted network multicast to perform authority authentication and data connection on each platform of the data center, configure a network encrypted multicast component on the data center platform, and send encrypted multicast messages to the network through the platform, and pass between the platforms.
  • the handshake and mutual heartbeats are completed to complete the docking, and the permissions are verified through multicast messages. This method can reduce the security risks of traditional permission authentication and greatly improve the speed and efficiency of intercommunication between various platforms in the data center.
  • the embodiment of the present invention also discloses a rights authentication system based on the encrypted multicast of the data center 5G network, and the system includes:
  • the multicast component configuration module is used to configure the network encrypted multicast component on the data center platform in the 5G network, and configure the user name and password;
  • the user name and password verification module is used for platform authentication and access management server to convert the platform user name and password into an information matrix, and verify the user name and password through the matching information matrix;
  • the key configuration module is used to configure the key for network encrypted multicast, and encrypt the multicast message sent by the platform to the network;
  • the handshake module is used between platforms to discover each other through encrypted multicast messages, perform handshake, and store the other party's IP address and service type locally;
  • the docking module is used for docking between platforms through mutual heartbeats after the handshake, encrypting the message with the date for directional transmission, and each platform will decrypt the message with the local time after receiving the message;
  • the authority verification module is used to verify the platform authority through multicast messages.
  • Each platform needs to use a network encryption multicast component, which has a unique identifier, and the network encryption multicast component It is equipped with the highest authority of the administrator who logs in locally and a special encryption code.
  • the network multicast component sends a specific encrypted multicast to the entire network according to the configuration items.
  • the platform authentication access management server converts the entered user name and password into a user name information matrix and a password information matrix, and queries whether there is a match in the platform authentication access management server If both of the password information matrix and user name information matrix match successfully, the ciphertext configuration will be performed.
  • the multicast messages sent by the four platforms A, B, C, and D in the network to the network include the IP address of the machine, the service type of the machine, the unique identifier of the machine, the cipher text, and the MAC address.
  • md5Key is the MD5 signature key specified by itself.
  • Set all the sent or received data as set M sort the parameters of non-empty parameter values in set M according to the ASCII code of the parameter name from small to large to get the string, and use the key-value pair format to concatenate the string data, in data Finally, the key is spliced and MD5 operation is performed on it to obtain the signature value.
  • the two platforms A and B compare the ciphertexts through encrypted multicast and find each other, the two platforms hold handshake and store the other's IP address and service type locally.
  • the two platforms need to exchange heartbeats to detect the existence of each other.
  • the entire message will be encrypted and sent by date.
  • Each platform After receiving the message, the local time is used for decryption, and the decryption failure is an abnormal message.
  • step D If yes, then the verification is passed, and go to step D, otherwise go to step B;
  • step B Check whether it hits the user IP whitelist, if yes, the verification is passed, and step D is executed, otherwise, step C is executed;
  • step C Verify the ciphertext, if the verification fails, an exception will be thrown, and if the verification is passed, proceed to step D;
  • the embodiment of the present invention also discloses a permission authentication device based on the encrypted multicast of the 5G network of the data center, including:
  • Memory used to store computer programs
  • the processor is configured to execute the computer program to implement the authority authentication method based on the encrypted multicast of the 5G network of the data center.
  • the embodiment of the present invention also discloses a readable storage medium for storing a computer program, wherein the computer program is executed by a processor to realize the authorization authentication method based on the data center 5G network encrypted multicast.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种基于数据中心5G网络加密组播的权限认证方法与系统及设备和介质，本发明通过5G加密网络组播对数据中心各平台进行权限认证以及数据打通，在数据中心平台配置网络加密组播组件，通过平台向网内发送加密的组播报文，通过平台之间的握手以及互发心跳，完成对接，通过组播报文对权限进行校验，通过该方式可降低传统权限认证存在的安全风险问题，并大幅度提升数据中心各平台互通速度以及效率。

Description

一种基于数据中心5G网络加密组播的权限认证方法与系统
本申请要求于2020年06月14日提交中国专利局、申请号为202010539423.6、发明名称为“一种基于数据中心5G网络加密组播的权限认证方法与系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及5G网络通信技术领域，特别是一种基于数据中心5G网络加密组播的权限认证方法与系统。
背景技术
5G，即第五代移动通信技术，5G作为下一代移动通信网络，其最高理论传输速度可达每秒数十Gb，比4G网络传输速度快数百倍，一部超清电影的下载仅需10秒。伴随着5G技术的发展，智能终端与数字生活走入寻常百姓家，5G技术可以用于大型活动场景如赛事、演唱会、重大活动等进行4K/8K、VR(Virtual Reality，虚拟现实)直播，通过5G网络带给用户更沉浸、交互的体验。
对于5G网络的速度而言，网络中权限认证的安全性也是至关重要的一个方面，当前网络接入的权限认证方式一般比较简单，还是传统的依靠用户名、密码和随机生成的验证码进行认证，但是这种权限认证方式缺少必要的安全统一系统，具有非常大的危险性，影响5G网络的安全接入。而且，目前的网络认证方式速度较慢，难以满足5G网络高速的需要。
发明内容
本发明的目的是提供一种基于数据中心5G网络加密组播的权限认证方法与系统，旨在解决现有技术中网络权限认证存在安全风险高且速度慢的问题，实现大幅度提升数据中心各平台互通速度以及安全性。
为达到上述技术目的，本发明提供了一种基于数据中心5G网络加密组播的权限认证方法，所述方法包括以下操作：
5G网内数据中心平台配置网络加密组播组件，并配置用户名和密码；
平台认证接入管理服务器将平台用户名和密码转换为信息矩阵，通过匹配信息矩阵对用户名和密码进行校验；
配置网络加密组播的密钥，对平台向网内发送的组播报文进行加密；
平台之间通过加密的组播报文发现对方，进行握手，并将对方的IP地址以及业务类型存入本地；
握手后平台之间通过互发心跳进行对接，将报文以日期加密进行定向发送，每个平台接收报文后用本地时间进行解密；
通过组播报文对平台权限进行校验。
优选地，所述组播报文包含本机的IP地址、本机的业务类型、本机的唯一标识、密文以及MAC地址。
优选地，所述网络加密组播组件具有唯一标识。
优选地，所述对平台权限进行校验具体为：
A.检查是否命中全局IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤B；
B.检查是否命中用户IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤C；
C.校验密文，如果校验不通过则抛出异常，如果校验通过则执行步骤D；
D.对用户请求所需的权限和用户所拥有的权限进行校验，不通过则抛出异常。
本发明还提供了一种基于数据中心5G网络加密组播的权限认证系统，所述系统包括：
组播组件配置模块，用于5G网内数据中心平台配置网络加密组播组件，并配置用户名和密码；
用户名密码校验模块，用于平台认证接入管理服务器将平台用户名和密码转换为信息矩阵，通过匹配信息矩阵对用户名和密码进行校验；
密钥配置模块，用于配置网络加密组播的密钥，对平台向网内发送的组播报文进行加密；
握手模块，用于平台之间通过加密的组播报文发现对方，进行握手， 并将对方的IP地址以及业务类型存入本地；
对接模块，用于握手后平台之间通过互发心跳进行对接，将报文以日期加密进行定向发送，每个平台接收报文后用本地时间进行解密；
权限校验模块，用于通过组播报文对平台权限进行校验。
优选地，所述组播报文包含本机的IP地址、本机的业务类型、本机的唯一标识、密文以及MAC地址。
优选地，所述网络加密组播组件具有唯一标识。
本发明还提供了一种基于数据中心5G网络加密组播的权限认证设备，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序，以实现所述的基于数据中心5G网络加密组播的权限认证方法。
本发明还提供了一种可读存储介质，用于保存计算机程序，其中，所述计算机程序被处理器执行时实现所述的基于数据中心5G网络加密组播的权限认证方法。
发明内容中提供的效果仅仅是实施例的效果，而不是发明所有的全部效果，上述技术方案中的一个技术方案具有如下优点或有益效果：
与现有技术相比，本发明通过5G加密网络组播对数据中心各平台进行权限认证以及数据打通，在数据中心平台配置网络加密组播组件，通过平台向网内发送加密的组播报文，通过平台之间的握手以及互发心跳，完成对接，通过组播报文对权限进行校验，通过该方式可降低传统权限认证存在的安全风险问题，并大幅度提升数据中心各平台互通速度以及效率。
附图说明
图1为本发明实施例中所提供的一种基于数据中心5G网络加密组播的权限认证方法流程图；
图2为本发明实施例中所提供的一种基于数据中心5G网络加密组播的权限认证系统框图。
具体实施方式
为了能清楚说明本方案的技术特点，下面通过具体实施方式，并结合其附图，对本发明进行详细阐述。下文的公开提供了许多不同的实施例或例子用来实现本发明的不同结构。为了简化本发明的公开，下文中对特定例子的部件和设置进行描述。此外，本发明可以在不同例子中重复参考数字和/或字母。这种重复是为了简化和清楚的目的，其本身不指示所讨论各种实施例和/或设置之间的关系。应当注意，在附图中所图示的部件不一定按比例绘制。本发明省略了对公知组件和处理技术及工艺的描述以避免不必要地限制本发明。
下面结合附图对本发明实施例所提供的一种基于数据中心5G网络加密组播的权限认证方法与系统进行详细说明。
如图1所示，本发明公开了一种基于数据中心5G网络加密组播的权限认证方法，所述方法包括以下操作：
5G网内数据中心平台配置网络加密组播组件，并配置用户名和密码；
平台认证接入管理服务器将平台用户名和密码转换为信息矩阵，通过匹配信息矩阵对用户名和密码进行校验；
配置网络加密组播的密钥，对平台向网内发送的组播报文进行加密；
平台之间通过加密的组播报文发现对方，进行握手，并将对方的IP地址以及业务类型存入本地；
握手后平台之间通过互发心跳进行对接，将报文以日期加密进行定向发送，每个平台接收报文后用本地时间进行解密；
通过组播报文对平台权限进行校验。
假定5G网内存在A、B、C、D四个平台，四个平台分别通过不同的网卡进行通信，每个平台需要搭配使用网络加密组播组件，该组件具有唯一标识，网络加密组播组件是配以本地登录的管理员最高权限和专用加密码，网络组播组件根据配置项向整个网内发送特定的加密组播。
用户首先在A平台配置自身的用户名和密码，平台认证接入管理服务器将输入的用户名和密码转换为用户名信息矩阵和密码信息矩阵，并在平台认证接入管理服务器中查询是否有与之匹配的密码信息矩阵和用户名信 息矩阵，如果两者均匹配成功，则进行密文配置。
校验用户名、密码通过后，配置网络加密组播的密钥，该密钥用于在自动寻找匹配平台过程中的报文加密，每个平台的密钥需保持一致。
网内的A、B、C、D四个平台向网内发送的组播报文包含本机的IP(Internet Protocol，网际互连协议)地址、本机的业务类型、本机的唯一标识、密文以及MAC地址(Media Access Control Address)。组播的加密方式采用MD5方式签名：data+"&key＝"+md5Key，其中md5Key为自身规定的MD5签名密钥。设所有发送或者接收到的数据为集M，将集合M内非空参数值的参数按照参数名ASCII(American Standard Code for Information Interchang，美国信息交换标准代码)码从小到大排序，得到字符串，使用键值对的格式拼接成字符串data，在data最后拼接上key并对其进行MD5运算，得到签名值。
当A、B两个平台通过加密的组播加以通过对密文的比较，发现对方，两个平台进行握手，将对方的IP地址以及业务类型存入本地。
在握手成功后，两个平台需要用互发心跳的方式检测对方的存在，此处继续使用加密网络组播的方式进行，对接完成后，将整个报文以日期加密进行定向发送，每个平台接收报文后均用本地时间进行解密，解密失败则为异常报文。
在网络组播权限认证过程中对于报文的详细校验如下：
A.检查是否命中全局IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤B；
B.检查是否命中用户IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤C；
C.校验密文，如果校验不通过则抛出异常，如果校验通过则执行步骤D；
D.对用户请求所需的权限和用户所拥有的权限进行校验，不通过则抛出异常。
本发明实施例通过5G加密网络组播对数据中心各平台进行权限认证以及数据打通，在数据中心平台配置网络加密组播组件，通过平台向网内发送加密的组播报文，通过平台之间的握手以及互发心跳，完成对接，通 过组播报文对权限进行校验，通过该方式可降低传统权限认证存在的安全风险问题，并大幅度提升数据中心各平台互通速度以及效率。
如图2所示，本发明实施例还公开了一种基于数据中心5G网络加密组播的权限认证系统，所述系统包括：
组播组件配置模块，用于5G网内数据中心平台配置网络加密组播组件，并配置用户名和密码；
用户名密码校验模块，用于平台认证接入管理服务器将平台用户名和密码转换为信息矩阵，通过匹配信息矩阵对用户名和密码进行校验；
密钥配置模块，用于配置网络加密组播的密钥，对平台向网内发送的组播报文进行加密；
握手模块，用于平台之间通过加密的组播报文发现对方，进行握手，并将对方的IP地址以及业务类型存入本地；
对接模块，用于握手后平台之间通过互发心跳进行对接，将报文以日期加密进行定向发送，每个平台接收报文后用本地时间进行解密；
权限校验模块，用于通过组播报文对平台权限进行校验。
假定5G网内存在A、B、C、D四个平台，四个平台分别通过不同的网卡进行通信，每个平台需要搭配使用网络加密组播组件，该组件具有唯一标识，网络加密组播组件是配以本地登录的管理员最高权限和专用加密码，网络组播组件根据配置项向整个网内发送特定的加密组播。
用户首先在A平台配置自身的用户名和密码，平台认证接入管理服务器将输入的用户名和密码转换为用户名信息矩阵和密码信息矩阵，并在平台认证接入管理服务器中查询是否有与之匹配的密码信息矩阵和用户名信息矩阵，如果两者均匹配成功，则进行密文配置。
校验用户名、密码通过后，配置网络加密组播的密钥，该密钥用于在自动寻找匹配平台过程中的报文加密，每个平台的密钥需保持一致。
网内的A、B、C、D四个平台向网内发送的组播报文包含本机的IP地址、本机的业务类型、本机的唯一标识、密文以及MAC地址。组播的加密方式采用MD5方式签名：data+"&key＝"+md5Key，其中md5Key为自身规定的MD5签名密钥。设所有发送或者接收到的数据为集M，将集合M内非空参数值的参数按照参数名ASCII码从小到大排序，得到字符串， 使用键值对的格式拼接成字符串data，在data最后拼接上key并对其进行MD5运算，得到签名值。
当A、B两个平台通过加密的组播加以通过对密文的比较，发现对方，两个平台进行握手，将对方的IP地址以及业务类型存入本地。
在握手成功后，两个平台需要用互发心跳的方式检测对方的存在，此处继续使用加密网络组播的方式进行，对接完成后，将整个报文以日期加密进行定向发送，每个平台接收报文后均用本地时间进行解密，解密失败则为异常报文。
在网络组播权限认证过程中对于报文的详细校验如下：
A.检查是否命中全局IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤B；
B.检查是否命中用户IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤C；
C.校验密文，如果校验不通过则抛出异常，如果校验通过则执行步骤D；
D.对用户请求所需的权限和用户所拥有的权限进行校验，不通过则抛出异常。
本发明实施例还公开了一种基于数据中心5G网络加密组播的权限认证设备，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序，以实现所述的基于数据中心5G网络加密组播的权限认证方法。
本发明实施例还公开了一种可读存储介质，用于保存计算机程序，其中，所述计算机程序被处理器执行时实现所述的基于数据中心5G网络加密组播的权限认证方法。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (9)

  1. 一种基于数据中心5G网络加密组播的权限认证方法，其特征在于，所述方法包括以下操作：
    5G网内数据中心平台配置网络加密组播组件，并配置用户名和密码；
    平台认证接入管理服务器将平台用户名和密码转换为信息矩阵，通过匹配信息矩阵对用户名和密码进行校验；
    配置网络加密组播的密钥，对平台向网内发送的组播报文进行加密；
    平台之间通过加密的组播报文发现对方，进行握手，并将对方的IP地址以及业务类型存入本地；
    握手后平台之间通过互发心跳进行对接，将报文以日期加密进行定向发送，每个平台接收报文后用本地时间进行解密；
    通过组播报文对平台权限进行校验。
  2. 根据权利要求1所述的一种基于数据中心5G网络加密组播的权限认证方法，其特征在于，所述组播报文包含本机的IP地址、本机的业务类型、本机的唯一标识、密文以及MAC地址。
  3. 根据权利要求1所述的一种基于数据中心5G网络加密组播的权限认证方法，其特征在于，所述网络加密组播组件具有唯一标识。
  4. 根据权利要求1所述的一种基于数据中心5G网络加密组播的权限认证方法，其特征在于，所述对平台权限进行校验具体为：
    A.检查是否命中全局IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤B；
    B.检查是否命中用户IP白名单，如果是则校验通过，并执行步骤D，否则执行步骤C；
    C.校验密文，如果校验不通过则抛出异常，如果校验通过则执行步骤D；
    D.对用户请求所需的权限和用户所拥有的权限进行校验，不通过则抛出异常。
  5. 一种基于数据中心5G网络加密组播的权限认证系统，其特征在于，所述系统包括：
    组播组件配置模块，用于5G网内数据中心平台配置网络加密组播组 件，并配置用户名和密码；
    用户名密码校验模块，用于平台认证接入管理服务器将平台用户名和密码转换为信息矩阵，通过匹配信息矩阵对用户名和密码进行校验；
    密钥配置模块，用于配置网络加密组播的密钥，对平台向网内发送的组播报文进行加密；
    握手模块，用于平台之间通过加密的组播报文发现对方，进行握手，并将对方的IP地址以及业务类型存入本地；
    对接模块，用于握手后平台之间通过互发心跳进行对接，将报文以日期加密进行定向发送，每个平台接收报文后用本地时间进行解密；
    权限校验模块，用于通过组播报文对平台权限进行校验。
  6. 根据权利要求5所述的一种基于数据中心5G网络加密组播的权限认证系统，其特征在于，所述组播报文包含本机的IP地址、本机的业务类型、本机的唯一标识、密文以及MAC地址。
  7. 根据权利要求5所述的一种基于数据中心5G网络加密组播的权限认证系统，其特征在于，所述网络加密组播组件具有唯一标识。
  8. 一种基于数据中心5G网络加密组播的权限认证设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序，以实现根据权利要求1-4任意一项所述的基于数据中心5G网络加密组播的权限认证方法。
  9. 一种可读存储介质，其特征在于，用于保存计算机程序，其中，所述计算机程序被处理器执行时实现根据权利要求1-4任意一项所述的基于数据中心5G网络加密组播的权限认证方法。
PCT/CN2021/076837 2020-06-14 2021-02-19 一种基于数据中心5g网络加密组播的权限认证方法与系统 WO2021253852A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/796,015 US11659384B2 (en) 2020-06-14 2021-02-19 Data center 5G network encrypted multicast-based authority authentication method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010539423.6 2020-06-14
CN202010539423.6A CN111818521B (zh) 2020-06-14 2020-06-14 一种基于数据中心5g网络加密组播的权限认证方法与系统

Publications (1)

Publication Number Publication Date
WO2021253852A1 true WO2021253852A1 (zh) 2021-12-23

Family

ID=72844965

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/076837 WO2021253852A1 (zh) 2020-06-14 2021-02-19 一种基于数据中心5g网络加密组播的权限认证方法与系统

Country Status (3)

Country Link
US (1) US11659384B2 (zh)
CN (1) CN111818521B (zh)
WO (1) WO2021253852A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111818521B (zh) 2020-06-14 2022-05-06 苏州浪潮智能科技有限公司 一种基于数据中心5g网络加密组播的权限认证方法与系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101355720A (zh) * 2007-07-26 2009-01-28 华为技术有限公司 实现广播/组播业务的网络承载架构、方法及适配器
US20130315389A1 (en) * 2010-12-08 2013-11-28 Lg Electronics Inc. Traffic encryption key management for machine to machine multicast group
US20140195801A1 (en) * 2007-07-19 2014-07-10 E.F. Johnson Company Method and system for encryption of messages in land mobile radio systems
CN107743097A (zh) * 2017-10-31 2018-02-27 刘昱 一种基于sdn网络的组播方法及装置
CN110169104A (zh) * 2017-01-05 2019-08-23 华为技术有限公司 具有组播和广播多媒体子系统能力的网络架构
CN110912941A (zh) * 2019-12-27 2020-03-24 北京四达时代软件技术股份有限公司 组播数据的传输处理方法及装置
CN111818521A (zh) * 2020-06-14 2020-10-23 苏州浪潮智能科技有限公司 一种基于数据中心5g网络加密组播的权限认证方法与系统

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10948476B2 (en) * 2000-12-26 2021-03-16 Troxler Electronic Laboratories, Inc. Methods, systems, and computer program products for locating and tracking objects
US8176186B2 (en) * 2002-10-30 2012-05-08 Riverbed Technology, Inc. Transaction accelerator for client-server communications systems
US8028329B2 (en) * 2005-06-13 2011-09-27 Iamsecureonline, Inc. Proxy authentication network
US10845399B2 (en) * 2007-04-03 2020-11-24 Electro Industries/Gaugetech System and method for performing data transfers in an intelligent electronic device
CN101610254B (zh) * 2009-06-23 2012-07-04 杭州华三通信技术有限公司 组播用户权限控制方法、组播认证服务器和接入设备
CN101692637B (zh) * 2009-09-23 2011-06-29 东南大学 一种组播密钥管理方法
CN102457347A (zh) * 2010-10-21 2012-05-16 上海交通大学 信号发送设备和方法及相应的信号接收设备和方法
KR102286388B1 (ko) * 2012-09-12 2021-08-04 아이이엑스 그룹, 인크. 전송 레이턴시 평준화 장치, 방법 및 시스템
US11277390B2 (en) * 2015-01-26 2022-03-15 Listat Ltd. Decentralized cybersecure privacy network for cloud communication, computing and global e-commerce
US20200348662A1 (en) * 2016-05-09 2020-11-05 Strong Force Iot Portfolio 2016, Llc Platform for facilitating development of intelligence in an industrial internet of things system
US10732621B2 (en) * 2016-05-09 2020-08-04 Strong Force Iot Portfolio 2016, Llc Methods and systems for process adaptation in an internet of things downstream oil and gas environment
US11327475B2 (en) * 2016-05-09 2022-05-10 Strong Force Iot Portfolio 2016, Llc Methods and systems for intelligent collection and analysis of vehicle data
US10164858B2 (en) * 2016-06-15 2018-12-25 Time Warner Cable Enterprises Llc Apparatus and methods for monitoring and diagnosing a wireless network
US11570098B2 (en) * 2016-07-05 2023-01-31 Six Impossible Things Before Breakfast Limited Systems, apparatuses and methods for cooperating routers
CN110087236B (zh) * 2018-01-25 2022-10-18 苹果公司 用于通过无线网络与匿名主机建立安全通信会话的协议
US11424923B2 (en) * 2019-02-26 2022-08-23 At&T Intellectual Property I, L.P. Mechanisms and apparatus for securing broadcast content distribution of time-sensitive data

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140195801A1 (en) * 2007-07-19 2014-07-10 E.F. Johnson Company Method and system for encryption of messages in land mobile radio systems
CN101355720A (zh) * 2007-07-26 2009-01-28 华为技术有限公司 实现广播/组播业务的网络承载架构、方法及适配器
US20130315389A1 (en) * 2010-12-08 2013-11-28 Lg Electronics Inc. Traffic encryption key management for machine to machine multicast group
CN110169104A (zh) * 2017-01-05 2019-08-23 华为技术有限公司 具有组播和广播多媒体子系统能力的网络架构
CN107743097A (zh) * 2017-10-31 2018-02-27 刘昱 一种基于sdn网络的组播方法及装置
CN110912941A (zh) * 2019-12-27 2020-03-24 北京四达时代软件技术股份有限公司 组播数据的传输处理方法及装置
CN111818521A (zh) * 2020-06-14 2020-10-23 苏州浪潮智能科技有限公司 一种基于数据中心5g网络加密组播的权限认证方法与系统

Also Published As

Publication number Publication date
US11659384B2 (en) 2023-05-23
US20230065801A1 (en) 2023-03-02
CN111818521B (zh) 2022-05-06
CN111818521A (zh) 2020-10-23

Similar Documents

Publication Publication Date Title
CN111294352B (zh) 云端与边缘节点之间的数据安全认证方法
US7370350B1 (en) Method and apparatus for re-authenticating computing devices
EP1959368B1 (en) Security link management in dynamic networks
US7039713B1 (en) System and method of user authentication for network communication through a policy agent
US8737624B2 (en) Secure email communication system
CN104168267B (zh) 一种接入sip安防视频监控系统的身份认证方法
CN108964885B (zh) 鉴权方法、装置、系统和存储介质
WO2012100677A1 (zh) 用于移动终端的身份管理方法及装置
CN113225352B (zh) 一种数据传输方法、装置、电子设备及存储介质
US11985113B2 (en) Computing system operational methods and apparatus
US9998287B2 (en) Secure authentication of remote equipment
WO2014015759A1 (zh) 一种终端身份验证和服务鉴权的方法、系统和终端
CN105141629A (zh) 一种基于WPA/WPA2 PSK多密码提升公用Wi-Fi网络安全性的方法
WO2022143498A1 (zh) 接入控制方法、装置、网络侧设备、终端及区块链节点
WO2021253852A1 (zh) 一种基于数据中心5g网络加密组播的权限认证方法与系统
CN111489462B (zh) 一种个人用蓝牙钥匙系统
CN111563980B (zh) 一种蓝牙锁钥匙生成与认证方法
US20120272303A1 (en) Method and device for enhancing security of user security model
WO2016026429A1 (zh) 无线网络配置、接入和访问方法、装置及设备
CN213938340U (zh) 5g应用接入认证网络架构
CN114386020A (zh) 基于量子安全的快速二次身份认证方法及系统
CN111489461B (zh) 一种集团用蓝牙钥匙系统
CN105871788A (zh) 一种登录服务器的密码生成方法及装置
US11979491B2 (en) Transmission of secure information in a content distribution network
TWI811178B (zh) 基於多方多因子動態強加密認證之資通安全方法與系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21824918

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21824918

Country of ref document: EP

Kind code of ref document: A1