WO2022042417A1

WO2022042417A1 - Authentication method, apparatus and system

Info

Publication number: WO2022042417A1
Application number: PCT/CN2021/113523
Authority: WO
Inventors: 张艳平; 洪佳楠
Original assignee: 华为技术有限公司
Priority date: 2020-08-27
Filing date: 2021-08-19
Publication date: 2022-03-03
Also published as: CN114205072B; CN114205072A

Abstract

Provided are an authentication method, apparatus and system, which can simplify the configurations of a third-party application. The method comprises: a blockchain system receiving a first message from an application server, wherein the first message comprises a first identifier, and a parameter and/or message encrypted by a terminal device using a first key; the blockchain system determining the user context of the terminal device according to the first identifier; and according to the user context of the terminal device and the parameter and/or message encrypted by the terminal device using the first key, the blockchain system verifying the legitimacy of the terminal device for a third-party application corresponding to the application server. The present application is applicable to the technical field of communications.

Description

Authentication method, device and system

This application claims the priority of the Chinese patent application with the application number 202010880356.4 and the application name "Authentication Method, Device and System" filed with the State Intellectual Property Office on August 27, 2020, the entire contents of which are incorporated into this application by reference .

technical field

The present application relates to the field of communication technologies, and in particular, to an authentication method, device and system.

Background technique

In the prior art, based on the consideration of secure communication, when a terminal device accesses a mobile network, an authentication process needs to be performed once. After the terminal device is connected to the mobile network, if the terminal device needs to access a third-party application, an authentication process needs to be performed again. That is to say, if the terminal device can access third-party applications, the terminal device needs to support two authentication methods (one mobile network access authentication and one application access authentication). to access third-party apps. In order to simplify the implementation of terminal devices, an application-layer authentication and key management (AKMA) architecture is proposed. As shown in Figure 1, in the AKMA architecture, the AKMA authentication function (AKMA authentication function, AAuF) network element is between the authentication service function (Authentication Server Function) network element and the AKMA application function (AKMA application function, AApF) network element. The AApF network element searches for the AUSF network element through the AAuF network element. When the terminal device accesses the mobile network, after the authentication between the terminal device and the AUSF network element is successful, the AUSF network element and the terminal device negotiate to generate a key between the terminal device and the AUSF network element, and generate a key based on the key. Key used for secure communication between terminal equipment and AApF network elements. Furthermore, the AApF network element can obtain a key for secure communication between the terminal device and the AApF network element from the AUSF network element, and use the key when the terminal device accesses a third-party application. That is to say, the AKMA architecture reuses the result of authentication of the terminal device by the mobile network, and only needs to perform an authentication process when the terminal device accesses the mobile network to realize secure communication.

However, in the scenario where the user of the third-party application belongs to multiple operators and the application server needs to interact with the devices of multiple operators, for example, when multiple private networks form an alliance, the AApF network elements on the application side need to be configured with the Interfaces and interface addresses of AAuF NEs in different networks. In addition, when a private network joins or leaves the alliance, the AApF network element needs to add or delete the interface and interface address of the AAuF network element in the private network, which obviously increases the implementation complexity of third-party applications.

SUMMARY OF THE INVENTION

The embodiments of the present application provide an authentication method, device, and system, which can simplify the configuration of third-party applications.

To achieve the above object, the embodiments of the present application adopt the following technical solutions:

In a first aspect, an authentication method is provided, the method comprising: a blockchain system receiving a first message from an application server, where the first message includes a first identifier, and parameters encrypted by the terminal device using the first key and/or message; the blockchain system determines the user context of the terminal device according to the first identifier; the blockchain system determines the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key, as The third-party application corresponding to the application server verifies the legitimacy of the terminal device. On the one hand, in the embodiment of the present application, the blockchain system verifies the legality of the terminal device for the third-party application, so that when the terminal device accesses the third-party application is illegal, the access process can be terminated in time, so as to prevent the terminal device from accessing the third-party application. When it is legal, the resource consumption and signaling waste caused by continuing to execute the subsequent process (eg, continuing to provide a security key for the communication between the application server corresponding to the third-party application and the terminal device). On the other hand, compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. The domain authentication interface enables the application server to interact with the blockchain system through this interface, and perform safe operations through the blockchain system (such as verifying the legitimacy of terminal devices for third-party applications), which not only simplifies the configuration of third-party applications, but also The problem of negotiating one by one between the third-party application party and the operator and deploying network elements to plan routes is avoided, and the efficiency of the third-party application party is improved.

In a possible implementation manner, the user context of the terminal device includes the first key, and the blockchain system determines the user context of the terminal device according to the first identifier includes: the blockchain system determines the user context of the terminal device according to the first identifier. identification, to determine the first key.

In a possible implementation manner, the blockchain system verifies the third-party application corresponding to the application server for the third-party application of the terminal device according to the user context of the terminal device and the parameters or messages encrypted by the terminal device using the first key. The legality includes: the blockchain system uses the first key to decrypt the parameters and/or messages encrypted by the first key for the terminal device, and obtains the decrypted parameters and/or messages; when the decrypted parameters and/or messages are obtained; Conform to the preconfigured parameter format or value used by the terminal device and the blockchain system interactively, and/or the decrypted message conforms to the preconfigured message format used by the terminal device and the blockchain system interactively, block The chain system determines that the end device is legitimate. Based on this solution, the legitimacy verification of the terminal device can be realized.

In a possible implementation manner, the first identifier includes at least one of the global blockchain identifier of the terminal device or the key identifier KID corresponding to the second key, where the second key is the terminal device and the authentication service function The key generated after successful authentication between network elements.

In a possible implementation manner, the first key is derived from a second key, and the second key is a key generated after successful authentication between the terminal device and the authentication service function network element. Based on this solution, before obtaining the key for secure communication between the terminal device and the application server, the application server and the terminal device can communicate using the key derived from the mobile network, thus improving the service security of the terminal device.

In a possible implementation manner, the communication method provided by the embodiment of the present application further includes: after the blockchain system verifies that the terminal device is legal, the blockchain system obtains a third key, and the third key is used for The key for secure communication between the terminal device and the application server; the blockchain system sends the third key to the application server. That is to say, in the embodiment of the present application, the security parameters of the communication between the application server and the terminal device can be obtained through the blockchain system, so as to realize the secure communication between the terminal device and the application server. Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, It enables the application server to interact with the blockchain system through this interface, and performs safe operations through the blockchain system (such as obtaining the security parameters of the communication between the application server and the terminal device through the blockchain system), which not only simplifies the third-party application Configuration, and avoid the third-party application side and the operator to negotiate one by one, and deploy network elements to plan routes, improve the efficiency of the third-party application side.

In a possible implementation manner, the user context of the terminal device includes the first key; the blockchain system obtains the third key, including: the blockchain system generates a third key, wherein generating the third key The first key is included in the input parameters of the three-key. That is to say, in the embodiment of the present application, the security parameters of the communication between the application server and the terminal device can be obtained by the blockchain system, and the legality of the terminal device can be verified by the blockchain system for the third-party application corresponding to the application server.

In a possible implementation manner, acquiring the third key by the blockchain system includes: the blockchain system sends a second message to the authentication service function network element, where the second message includes the first identifier, the first identifier Used to determine the user context of the terminal device, the user context of the terminal device includes the first key or the second key, and the second key is generated after successful authentication between the terminal device and the authentication service function network element The blockchain system receives the third key from the authentication service function network element, wherein the input parameters for generating the third key include the first key or the second key. That is to say, in the embodiment of the present application, the blockchain system can verify the legitimacy of the terminal device for the third-party application corresponding to the application server, and obtain the security parameters of the communication between the application server and the terminal device through the blockchain system.

In a possible implementation manner, the input parameter for generating the third key further includes a second identifier and/or a decrypted parameter, wherein the second identifier is an application identifier of the third-party application, and the decrypted The latter parameter is a parameter obtained by decrypting the parameter encrypted by the terminal device using the first key using the first key. Based on this scheme, since the decrypted parameters can include, for example, a random number selected by the terminal device, and the random number is random, the third key generated based on the random number is also more flexible and is not easily attacked by attackers. Thus, the secure communication between the terminal device and the application server is further ensured.

In a possible implementation manner, before the blockchain system receives the first message from the application server, the authentication method provided in this embodiment of the present application further includes: the blockchain system receives a third message from the authentication service function network element message, the third message requests to store the first key, the first identifier and the address of the authentication service function network element in the user context of the terminal device; the blockchain system uses the first key, the first key, the An identity and the address of the authentication service function network element are stored in the user context of the terminal device. Compared with the existing AKMA solution in which the AApF network element of the application side needs to configure the interfaces and interface addresses of the AAuF network elements in different networks one by one, because in the embodiment of the present application, the authentication service function network element can send the data to the blockchain system. The information required by the application server to perform secure operations through the blockchain system (such as the first key, the first identifier, and the address of the authentication service function network element), so that subsequent application servers can perform secure operations through the blockchain system. . That is to say, in this embodiment of the present application, a unified cross-domain authentication interface can be provided by the blockchain system, so that the application server can interact with the blockchain system through this interface and perform secure operations through the blockchain system, thus not only simplifying the third party It also avoids the problem of one-by-one negotiation between the third-party application party and the operator, and the deployment of network elements to plan routes, which improves the efficiency of the third-party application party. In addition, in the embodiment of the present application, the blockchain system stores the address of the authentication service function network element in the user context of the terminal device, so that when the subsequent blockchain system interacts with the authentication service function network element, it can be directly accessed from the terminal. The address of the authentication service function network element is obtained from the user context of the device, which simplifies the processing logic of the blockchain system.

In a possible implementation manner, before the blockchain system receives the first message from the application server, the authentication method provided in this embodiment of the present application further includes: the blockchain system receives the third message from the authentication service function network element , the third message requests to store the first key and the first identifier in the user context of the terminal device; the blockchain system stores the first key and the first identifier in the user context of the terminal device middle. Compared with the existing AKMA solution in which the AApF network element of the application side needs to configure the interfaces and interface addresses of the AAuF network elements in different networks one by one, because in the embodiment of the present application, the authentication service function network element can send the data to the blockchain system. The information (such as the first key and the first identifier) required for the application server to perform secure operations through the blockchain system, so that subsequent application servers can perform secure operations through the blockchain system. That is to say, in this embodiment of the present application, a unified cross-domain authentication interface can be provided by the blockchain system, so that the application server can interact with the blockchain system through this interface and perform secure operations through the blockchain system, thus not only simplifying the third party It also avoids the problem of one-by-one negotiation between the third-party application party and the operator, and the deployment of network elements to plan routes, which improves the efficiency of the third-party application party.

In a second aspect, an authentication method is provided, the method includes: an authentication service function network element obtains indication information, the indication information indicates that a secure operation is performed through a blockchain system; and an authentication service function network element, according to the indication information, sends the The block chain system sends a third message, the third message includes first information, and is used to request that the first information be stored in the user context of the terminal device, wherein the first information is the application server through the block chain system. Information required for safe operation. Compared with the existing AKMA solution in which the AApF network element of the application side needs to configure the interfaces and interface addresses of the AAuF network elements in different networks one by one, because in the embodiment of the present application, the authentication service function network element can send the data to the blockchain system. The information required for the application server to perform safe operations through the blockchain system, so that subsequent application servers can perform safe operations through the blockchain system. That is to say, in this embodiment of the present application, a unified cross-domain authentication interface can be provided by the blockchain system, so that the application server can interact with the blockchain system through this interface and perform secure operations through the blockchain system, thus not only simplifying the third party It also avoids the problem of one-by-one negotiation between the third-party application party and the operator, and the deployment of network elements to plan routes, which improves the efficiency of the third-party application party.

In a possible implementation manner, the first information includes a first identifier and an address of the authentication service function network element, where the first identifier is used to determine the user context of the terminal device. In the embodiment of this application, the blockchain system stores the address of the authentication service function network element in the user context of the terminal device, so that when the subsequent blockchain system interacts with the authentication service function network element, the Obtaining the address of the authentication service function network element in the user context simplifies the processing logic of the blockchain system.

In a possible implementation manner, the first information includes the first identifier and the first key. Wherein, the first key is derived from a second key, and the second key is a key generated after successful authentication between the terminal device and the authentication service function network element.

In a possible implementation manner, the first information includes the first identifier, the first key, and the address of the authentication service function network element. In the embodiment of this application, the blockchain system stores the address of the authentication service function network element in the user context of the terminal device, so that when the subsequent blockchain system interacts with the authentication service function network element, the Obtaining the address of the authentication service function network element in the user context simplifies the processing logic of the blockchain system.

In a possible implementation manner, the first identifier includes at least one of a global blockchain identifier of the terminal device or a key identifier KID corresponding to the second key.

In a possible implementation manner, obtaining the indication information by the authentication service function network element includes: the authentication service function network element receiving the indication information from the terminal device; or, the authentication service function network element receiving the indication information from the unified data management network element of this indication.

In a possible implementation manner, after the authentication service function network element sends the third message to the blockchain system according to the indication information, the method further includes: the authentication service function network element receives data from the blockchain system The second message includes the first identifier; the authentication service function network element determines the user context of the terminal device according to the first identifier, and the user context of the terminal device includes the first key or the second key ; The first key is derived from the second key, and the second key is a key generated after the authentication between the terminal device and the authentication service function network element is successful; the authentication service function network element Generate a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein the input parameters for generating the third key include the first key or the second key key; the authentication service function network element sends the third key to the blockchain system. That is to say, in this embodiment of the present application, the authentication service function network element may generate the security parameter (eg, the third key) for communication between the application server and the terminal device. Furthermore, the application server can obtain the security parameters of the communication between the application server and the terminal device through the blockchain system.

In a possible implementation manner, the second message further includes a second identifier and/or a parameter encrypted by the terminal device using the first key, where the second identifier is the application identifier of the third-party application corresponding to the application server; Correspondingly, the input parameter for generating the third key also includes the second identifier and/or the decrypted parameter, wherein the decrypted parameter is to use the first key to use the first key for the terminal device. The parameters obtained after decrypting the parameters encrypted by the key. Based on this scheme, since the decrypted parameters can include, for example, a random number selected by the terminal device, and the random number is random, the third key generated based on the random number is also more flexible and is not easily attacked by attackers. Thus, the secure communication between the terminal device and the application server is further ensured.

In a possible implementation manner, the second message further includes parameters and/or messages encrypted by the terminal device using the first key; before the authentication service function network element generates the third key, the method further includes: The authentication service function network element verifies the validity of the terminal device for the third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key. Based on this solution, when it is illegal for the terminal device to access the third-party application, the access process can be terminated in time, so as to prevent the terminal device from accessing the third-party application illegally and continue to execute the subsequent process (such as continuing to access the application server and terminal corresponding to the third-party application). Communication between devices provides a security key) resource consumption and signaling waste.

In a possible implementation manner, the user context of the terminal device includes the first key; the authentication service function network element is based on the user context of the terminal device and the parameters or messages encrypted by the terminal device using the first key , verifying the legitimacy of the terminal device for the third-party application corresponding to the application server, including: using the first key for the authentication service function network element to decrypt the parameters and/or messages encrypted by the terminal device using the first key, and obtain decrypted When the decrypted parameter conforms to the pre-configured parameter format or value used by the terminal device and the authentication service function network element interactively, and/or the decrypted message conforms to the pre-configured parameter format or value for the terminal The message format used by the device and the authentication service function network element for interaction, and the authentication service function network element determines that the terminal device is legal. Based on this solution, the legal authentication of the terminal device can be realized.

In a possible implementation manner, performing the security operation through the blockchain system includes obtaining security parameters of the communication between the application server and the terminal device through the blockchain system.

In a possible implementation manner, performing the security operation through the blockchain system further includes verifying the legitimacy of the terminal device for a third-party application corresponding to the application server through the blockchain system.

In a third aspect, an authentication method is provided, the method includes: the blockchain system receives a first message from an application server, where the first message includes a first identifier; and the blockchain system determines a terminal device according to the first identifier The user context of the terminal device includes a first key; the blockchain system generates a third key, and the third key is a key used for the secure communication between the terminal device and the application server, wherein the generated The input parameter of the third key includes the first key. Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, The application server interacts with the blockchain system through this interface, and performs safe operations through the blockchain system (such as obtaining the security parameters of the communication between the application server and the terminal device through the blockchain system), which not only simplifies the first step The configuration of the third-party application also avoids the problem of negotiating one by one between the third-party application party and the operator, and deploying network elements to plan routes, which improves the efficiency of the third-party application party.

In a possible implementation manner, the first message further includes a second identifier and/or a parameter encrypted by the terminal device using the first key, where the second identifier is an application identifier of a third-party application corresponding to the application server; Correspondingly, the input parameter for generating the third key also includes the second identifier and/or the decrypted parameter, wherein the decrypted parameter is to use the first key to use the first key for the terminal device. The parameters obtained after decrypting the parameters encrypted by the key. Based on this scheme, since the decrypted parameters can include, for example, a random number selected by the terminal device, and the random number is random, the third key generated based on the random number is also more flexible and is not easily attacked by attackers. Thus, the secure communication between the terminal device and the application server is further ensured.

In a possible implementation manner, before the blockchain system receives the first message from the application server, the communication method provided by the embodiment of the present application further includes: the blockchain system receives the third message from the authentication service function network element , the third message requests to store the first key and the first identifier in the user context of the terminal device; the blockchain system stores the first key and the first identifier in the user context of the terminal device middle. Compared with the existing AKMA solution in which the AApF network element of the application side needs to configure the interfaces and interface addresses of the AAuF network elements in different networks one by one, because in the embodiment of the present application, the authentication service function network element can send the data to the blockchain system. The information (such as the first key and the first identifier) required for the application server to perform secure operations through the blockchain system, so that subsequent application servers can perform secure operations through the blockchain system. That is to say, in this embodiment of the present application, a unified cross-domain authentication interface can be provided by the blockchain system, so that the application server can interact with the blockchain system through this interface and perform secure operations through the blockchain system, thus not only simplifying the third party It also avoids the problem of one-by-one negotiation between the third-party application party and the operator, and the deployment of network elements to plan routes, which improves the efficiency of the third-party application party.

In a fourth aspect, an authentication method is provided, the method comprising: an authentication service function network element receiving a second message from a blockchain system, the second message including a first identifier; and an authentication service function network element according to the first identifier, Determine the user context of the terminal device. The user context of the terminal device includes the first key or the second key; the first key is derived from the second key, and the second key is used for the terminal device and the authentication service The key generated after the authentication between functional network elements is successful; the authentication service function network element generates a third key, and the third key is the key used for the secure communication between the terminal device and the application server, wherein the third key is generated. The key input parameter includes the first key or the second key. Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, The application server interacts with the blockchain system through this interface, and performs safe operations through the blockchain system (such as obtaining the security parameters of the communication between the application server and the terminal device through the blockchain system), which not only simplifies the first step The configuration of the third-party application also avoids the problem of negotiating one by one between the third-party application party and the operator, and deploying network elements to plan routes, which improves the efficiency of the third-party application party.

In a fifth aspect, a communication device is provided for implementing the above method. The communication device may be one or more blockchain devices in the blockchain system in the first aspect or the third aspect, or a device including the blockchain system; or, the communication device may be the second blockchain system described above The authentication service function network element in the aspect or the fourth aspect, or a device including the above authentication service function network element. The communication device includes corresponding modules, units, or means (means) for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above functions.

In a sixth aspect, a communication device is provided, comprising: a processor and a memory; the memory is used for storing computer instructions, and when the processor executes the instructions, the communication device executes the method described in any one of the above aspects. The communication device may be one or more blockchain devices in the blockchain system in the first aspect or the third aspect, or a device including the blockchain system; or, the communication device may be the second blockchain system described above The authentication service function network element in the aspect or the fourth aspect, or a device including the above authentication service function network element.

In a seventh aspect, a communication device is provided, comprising: a processor; the processor is configured to be coupled to a memory, and after reading an instruction in the memory, execute the method according to any one of the preceding aspects according to the instruction. The communication device may be one or more blockchain devices in the blockchain system in the first aspect or the third aspect, or a device including the blockchain system; or, the communication device may be the second blockchain system described above The authentication service function network element in the aspect or the fourth aspect, or a device including the above authentication service function network element.

In an eighth aspect, a communication device is provided, comprising: a processor and an interface circuit; the interface circuit is used to receive a computer program or instruction and transmit it to the processor; the processor is used to execute the computer program or instruction to enable the communication The apparatus performs a method as described in any of the above aspects. The communication device may be one or more blockchain devices in the blockchain system in the first aspect or the third aspect, or a device including the blockchain system; or, the communication device may be the second blockchain system described above The authentication service function network element in the aspect or the fourth aspect, or a device including the above authentication service function network element.

In a ninth aspect, a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium, when the computer-readable storage medium runs on a computer, the computer can execute the method described in any one of the above aspects.

In a tenth aspect, there is provided a computer program product comprising instructions which, when run on a computer, enable the computer to perform the method of any of the preceding aspects.

In an eleventh aspect, a communication apparatus is provided (for example, the communication apparatus may be a chip or a chip system), the communication apparatus includes a processor for implementing the functions involved in any of the above aspects. In a possible implementation manner, the communication device further includes a memory for storing necessary program instructions and data. When the communication device is a chip system, it may be constituted by a chip, or may include a chip and other discrete devices.

Wherein, for the technical effect brought by any possible implementation manner of the fifth aspect to the eleventh aspect, reference may be made to the technical effect brought by the different design manners in the above-mentioned first aspect to the fourth aspect, which will not be repeated here. .

A twelfth aspect provides a communication system, the communication system includes a blockchain system and an application server; the application server is configured to send a first message to the blockchain system, where the first message includes a first identifier and a terminal The parameters and/or messages encrypted by the device using the first key; the blockchain system is used to receive the first message from the application server, and after determining the user context of the terminal device according to the first identifier, according to the user context of the terminal device , and the parameters and/or messages encrypted by the terminal device using the first key to verify the legitimacy of the terminal device for a third-party application corresponding to the application server. For the technical effect of the twelfth aspect, reference may be made to the above-mentioned first aspect, which is not repeated here.

A thirteenth aspect provides a communication system, the communication system includes a blockchain system and an application server; the application server is configured to send a first message to the blockchain system, where the first message includes a first identifier; a block chain The chain system is used to receive the first message from the application server, and after determining the user context of the terminal device according to the first identifier, generate a third key, where the third key is used for the secure communication between the terminal device and the application server. . The user context of the terminal device includes the first key, and the input parameter for generating the third key includes the first key. For the technical effect of the thirteenth aspect, reference may be made to the third aspect, which is not repeated here.

In a fourteenth aspect, a communication system is provided, the communication system includes an authentication service function network element and a blockchain system; the authentication service function network element is used to obtain indication information indicating that security is performed through the blockchain system operate. The authentication service function network element is further configured to send a third message to the blockchain system according to the indication information, where the third message includes the first information and is used to request to store the first information in the user context of the terminal device, wherein, The first information is the information required by the application server to perform secure operations through the blockchain system. The blockchain system is used for receiving the third message from the authentication service function network element, and storing the first information in the user context of the terminal device. For the technical effect of the fourteenth aspect, reference may be made to the above-mentioned second aspect, which will not be repeated here.

Description of drawings

Figure 1 is a schematic diagram of the existing AKMA architecture;

FIG. 2 is a schematic structural diagram of a communication system provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of another communication system provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of the architecture of a 5G network provided by an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a communication device provided by an embodiment of the present application;

FIG. 6 is an interactive schematic diagram 1 of an authentication method provided by an embodiment of the present application;

FIG. 7 is a second interactive schematic diagram of an authentication method provided by an embodiment of the present application;

FIG. 8 is an interactive schematic diagram 3 of the authentication method provided by the embodiment of the present application;

FIG. 9 is a schematic flowchart 1 of an authentication method provided by an embodiment of the present application;

10 is a second schematic flowchart of an authentication method provided by an embodiment of the present application;

11 is a third schematic flowchart of an authentication method provided by an embodiment of the present application;

12 is a fourth schematic flowchart of an authentication method provided by an embodiment of the present application;

FIG. 13 is a schematic structural diagram of a communication apparatus provided by an embodiment of the present application.

detailed description

In order to facilitate understanding of the solutions of the embodiments of the present application, a brief introduction of related concepts is first given as follows:

First, blockchain technology

Blockchain technology, also known as distributed ledger technology, is an emerging technology in which several computing devices jointly participate in "bookkeeping" (ie, record transaction data) and jointly maintain a complete distributed database. Because blockchain technology has the characteristics of decentralization (that is, no central node), openness and transparency, each computing device can participate in database records, and data synchronization between computing devices can be performed quickly, blockchain technology has been used in Widely used in many fields.

At present, the blockchain can be divided into: public chain and alliance chain according to the deployment method. A public chain refers to a blockchain that can be read by any device in the world, or a blockchain in which any device can participate in the consensus verification process of transactions. Consortium chains, also known as consortium blockchains, refer to a consortium formed by participating members of a designated blockchain, and the business transaction information between members is recorded in the blockchain, which limits the scale of use and authority.

Second, the blockchain system

The blockchain system in the embodiments of the present application may also be referred to as a blockchain for short. The blockchain system includes one or more blockchain devices, such as blockchain security processing modules. Exemplarily, the blockchain security processing module in the embodiment of the present application may be, for example, a blockchain smart contract module, and the blockchain smart contract module is a smart contract module in the blockchain system that processes the security operations of users accessing third-party applications. , which is described here uniformly, and will not be repeated below.

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application. Wherein, in the description of this application, unless otherwise specified, "/" indicates that the objects associated before and after are an "or" relationship, for example, A/B can indicate A or B; in this application, "and/or" "It is only an association relationship that describes an associated object, which means that there can be three kinds of relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A exists , B can be singular or plural. Also, in the description of the present application, unless stated otherwise, "plurality" means two or more than two. "At least one item(s) below" or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one item (a) of a, b, or c may represent: a, b, c, ab, ac, bc, or abc, where a, b, and c may be single or multiple . In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items that have basically the same function and effect. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like are not necessarily different. Meanwhile, in the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as "exemplary" or "such as" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present the related concepts in a specific manner to facilitate understanding.

In addition, the network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute limitations on the technical solutions provided by the embodiments of the present application. With the evolution of the network architecture and the emergence of new service scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

As shown in FIG. 2 , a communication system 20 is provided in an embodiment of the present application. The communication system 20 includes a blockchain system 201 and an application server 202 . Wherein, the blockchain system 201 and the application server 202 may communicate directly or communicate through the forwarding of other devices, which is not specifically limited in this embodiment of the present application. Exemplarily, the application server 202 may interact with the blockchain system 201 through a newly added blockchain handling function (BCHF) network element in the current 5G communication system, which is not specifically described in this embodiment of the present application. limited. That is to say, the BCHF network element in the embodiment of the present application can be used as the one between the application server 202 and the blockchain system 201 when the application server 202 does not have the blockchain processing function (it can also be understood as not supporting blockchain-related operations). The intermediary agent interacts with the blockchain system 201 on behalf of the application server 202 . For example, the BCHF network element is responsible for publishing network processing information as transactions to the blockchain system, and at the same time publishing the blockchain system and network-related things to the network. Among them, the functions of BCHF network elements include but are not limited to: publishing transactions, recording blocks or executing one or more of smart contracts.

Of course, the BCHF network element in the embodiment of the present application can also act as an agent between the first network element and the blockchain system when other network elements do not have the blockchain processing function, and interact with the blockchain system on behalf of other network elements . For example, in the communication system 30 shown in FIG. 3, the BCHF network element can act as a proxy between the authentication service function network element 301 and the blockchain system 302 when the authentication service function network element 301 does not have the blockchain processing function, The interaction between the network element 301 representing the authentication service function and the blockchain system 302 is described in a unified manner here, and will not be repeated below.

In a possible implementation manner, in the communication system 20 shown in FIG. 2 , the application server 202 is configured to send a first message to the blockchain system 201, where the first message includes the first identifier and the first message used by the terminal device. A key to encrypt parameters and/or messages. The blockchain system 201 is used for receiving the first message from the application server 202, and after determining the user context of the terminal device according to the first identifier, according to the user context of the terminal device and the parameters encrypted by the terminal device using the first key and/or message to verify the legitimacy of the terminal device for the third-party application corresponding to the application server 202 . The specific implementation of the above solution will be described in detail in the subsequent method embodiments, which will not be repeated here. On the one hand, in the embodiment of the present application, the blockchain system verifies the legality of the terminal device for the third-party application, so that when the terminal device accesses the third-party application is illegal, the access process can be terminated in time, so as to prevent the terminal device from accessing the third-party application. When it is legal, the resource consumption and signaling waste caused by continuing to execute the subsequent process (eg, continuing to provide a security key for the communication between the application server corresponding to the third-party application and the terminal device). On the other hand, compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. The domain authentication interface enables the application server to interact with the blockchain system through this interface, and perform safe operations through the blockchain system (such as verifying the legitimacy of terminal devices for third-party applications), which not only simplifies the configuration of third-party applications, but also The problem of negotiating one by one between the third-party application party and the operator and deploying network elements to plan routes is avoided, and the efficiency of the third-party application party is improved.

In another possible implementation manner, in the communication system 20 shown in FIG. 2 , the application server 202 is configured to send a first message to the blockchain system 201 , where the first message includes the first identifier. The blockchain system 201 is used to receive the first message from the application server 202, and after determining the user context of the terminal device according to the first identifier, generate a third key, and the third key is used for the security of the terminal device and the application server. Communication key. The user context of the terminal device includes the first key, and the input parameter for generating the third key includes the first key. The specific implementation of the above solution will be described in detail in the subsequent method embodiments, which will not be repeated here. Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, Make the application server interact with the blockchain system through this interface, and perform safe operations through the blockchain system (such as verifying the legitimacy of the terminal device for third-party applications), so not only simplifies the configuration of third-party applications, but also avoids third-party applications. The application side negotiates with the operator one by one and deploys network elements to plan routes, which improves the efficiency of the third-party application side.

As shown in FIG. 3 , a communication system 30 is provided in an embodiment of the present application. The communication system 30 includes an authentication service function network element 301 and a blockchain system 302 . The authentication service function network element 301 and the blockchain system 302 may communicate directly or communicate through the forwarding of other devices, which is not specifically limited in this embodiment of the present application. Exemplarily, as described above, the authentication service function network element 301 may interact with the blockchain system 302 through the newly added BCHF network element in the current 5G communication system, which is not specifically limited in this embodiment of the present application.

Among them, the authentication service function network element 301 is used to obtain indication information, where the indication information indicates that the security operation is performed through the blockchain system. The authentication service function network element 301 is further configured to send a third message to the blockchain system 302 according to the indication information, where the third message includes the first information and is used to request that the first information be stored in the user context of the terminal device, Wherein, the first information is the information required by the application server to perform a secure operation through the blockchain system 302 . The blockchain system 302 is configured to receive the third message from the authentication service function network element 301, and store the first information in the user context of the terminal device. Wherein, in the embodiment of the present application, performing the security operation through the blockchain system 302 includes obtaining the security parameters of the communication between the application server and the terminal device through the blockchain system 302 . Optionally, performing the security operation through the blockchain system 302 includes verifying the legitimacy of the terminal device for a third-party application corresponding to the application server through the blockchain system 302 . Here, a unified description is provided, and details are not repeated below. The specific implementation of the above solution will be described in detail in the subsequent method embodiments, which will not be repeated here. Compared with the existing AKMA solution in which the AApF network element of the application side needs to configure the interfaces and interface addresses of the AAuF network elements in different networks one by one, because in the embodiment of the present application, the authentication service function network element can send the data to the blockchain system. The information required for the application server to perform safe operations through the blockchain system, so that subsequent application servers can perform safe operations through the blockchain system. That is to say, in this embodiment of the present application, a unified cross-domain authentication interface can be provided by the blockchain system, so that the application server can interact with the blockchain system through this interface and perform secure operations through the blockchain system, thus not only simplifying the third party It also avoids the problem of one-by-one negotiation between the third-party application party and the operator, and the deployment of network elements to plan routes, which improves the efficiency of the third-party application party.

It should be noted that the "third party" in the "third party application" in the embodiment of the present application is relative to the operator's transmission network, such as a mobile transmission network. In other words, the "third-party application" in this embodiment of the present application may be any current runnable application, which is uniformly described here, and will not be repeated below.

Optionally, the communication system 20 shown in FIG. 2 or the communication system 30 shown in FIG. 3 may be applied to the current 5G network or other future networks, which is not specifically limited in this embodiment of the present application.

Exemplarily, as shown in FIG. 4 , if the communication system 20 shown in FIG. 2 or the communication system 30 shown in FIG. 3 is applied to the current 5G network, the application server 202 in the communication system 20 shown in FIG. The corresponding network element or entity may be an application function (AF) network element in the 5G network architecture, and the network element or entity corresponding to the authentication service function network element in the communication system shown in FIG. 3 may be the 5G network architecture. The authentication server function (AUSF) network element in .

In addition, as shown in Figure 4, the current 5G network can also include access network equipment, access and mobility management function (core access and mobility management function, AMF) network elements, session management function (session management function, SMF) Network element, BCHF network element, user plane function (UPF) network element, network slice selection function (NSSF) network element, network exposure function (NEF) network element, network function Storage function (network exposure function Repository Function, NRF) network element, policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element, etc., which are not specifically limited in this embodiment of the present application .

As shown in Figure 4, the terminal device accesses the 5G network through the access network device, the terminal device communicates with the AMF network element through the N1 interface (N1 for short); the access network device communicates with the AMF network element through the N2 interface (N2 for short) Communication; the access network equipment communicates with the UPF network element through the N3 interface (N3 for short), the SMF network element communicates with the UPF network element through the N4, and the UPF network element accesses the data network through the N6 interface (N6 for short). In addition, control plane networks such as AUSF network elements, AMF network elements, SMF network elements, NSSF network elements, NEF network elements, NRF network elements, PCF network elements, UDM network elements, AF network elements, or BCHF network elements shown in Figure 4 Elements can also use service interfaces to interact. For example, the service interface provided by the AUSF network element can be Nausf; the service interface provided by the AMF network element can be Namf; the service interface provided by the SMF network element can be Nsmf; the service interface provided by the NSSF network element It can be Nnssf; the service interface provided by the NEF network element can be Nnef; the service interface provided by the NRF network element can be Nnrf; the service interface provided by the PCF network element can be Npcf; the service provided by the UDM network element externally The service interface can be Nudm; the service interface provided by the AF network element can be Naf, and the service interface provided by the BCHF network element can be Nbchf. For related descriptions, please refer to the 5G system architecture diagram in the 23501 standard, which will not be repeated here. In addition, exemplarily, as shown in FIG. 4, when the AUSF network element, the AF network element, the UDM network element, the UDR network element, the AMF network element, the SMF network element or the NEF network element does not have the blockchain processing function, it can be The interaction between the BCHF network element and the blockchain system is described here in a unified manner, and will not be repeated below.

Optionally, the BCHF network element in the embodiment of the present application may be an independent function module, which is independently deployed independently of the 5G network element, or may be a distributed function module and a 5G network element deployed in one, which is not implemented in this embodiment of the present application. Specific restrictions.

Optionally, the blockchain system, the application server, or the authentication service function network element in the embodiment of the present application may also be referred to as a communication device or a communication device, which may be a general-purpose device or a special-purpose device. This is not specifically limited.

Optionally, the relevant functions of the blockchain system, the application server, or the authentication service function network element in the embodiment of the present application may be implemented by one device, or may be implemented jointly by multiple devices, or may be implemented by one device in one device. or multiple functional modules, which is not specifically limited in this embodiment of the present application. It is to be understood that the above-mentioned functions can be either network elements in hardware devices, or software functions running on dedicated hardware, or a combination of hardware and software, or instantiated on a platform (eg, a cloud platform). Virtualization capabilities.

For example, the relevant functions of the blockchain system, the application server, or the authentication service function network element in the embodiment of the present application may be implemented by the communication device 500 in FIG. 5 . FIG. 5 is a schematic structural diagram of a communication device 500 according to an embodiment of the present application. The communication device 500 includes one or more processors 501, a communication line 502, and at least one communication interface (in FIG. 5, the communication interface 504 and one processor 501 are used as an example for illustration), optional may also include memory 503 .

The processor 501 can be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors for controlling the execution of the programs of the present application. integrated circuit.

Communication line 502 may include a path for connecting the various components.

The communication interface 504 can be a transceiver module for communicating with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (wireless local area networks, WLAN) and the like. For example, the transceiver module may be a device such as a transceiver or a transceiver. Optionally, the communication interface 504 may also be a transceiver circuit located in the processor 501 to implement signal input and signal output of the processor.

The memory 503 may be a device having a storage function. For example, it may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of storage devices that can store information and instructions The dynamic storage device can also be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage ( including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being stored by a computer any other medium taken, but not limited to this. The memory may exist independently and be connected to the processor through communication line 502 . The memory can also be integrated with the processor.

The memory 503 is used for storing computer-executed instructions for executing the solution of the present application, and the execution is controlled by the processor 501 . The processor 501 is configured to execute the computer-executed instructions stored in the memory 503, thereby implementing the authentication method provided in the embodiment of the present application.

Or, optionally, in this embodiment of the present application, the processor 501 may also perform processing-related functions in the authentication methods provided in the following embodiments of the present application, and the communication interface 504 is responsible for communicating with other devices or communication networks. The embodiment does not specifically limit this.

Optionally, the computer-executed instructions in the embodiment of the present application may also be referred to as application code, which is not specifically limited in the embodiment of the present application.

In a specific implementation, as an embodiment, the processor 501 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 5 .

In a specific implementation, as an embodiment, the communication device 500 may include multiple processors, such as the processor 501 and the processor 508 in FIG. 5 . Each of these processors can be a single-core processor or a multi-core processor. The processor here may include, but is not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller (MCU), or artificial intelligence Processors and other types of computing devices that run software, each computing device may include one or more cores for executing software instructions to perform operations or processing.

In a specific implementation, as an embodiment, the communication device 500 may further include an output device 505 and an input device 506 . The output device 505 is in communication with the processor 501 and can display information in a variety of ways. For example, the output device 505 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait. Input device 506 is in communication with processor 501 and can receive user input in a variety of ways. For example, the input device 506 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.

The above-mentioned communication device 500 may also be sometimes referred to as a communication device, which may be a general-purpose device or a dedicated device. For example, the communication device 500 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, the above-mentioned terminal device, the above-mentioned network device, or a 5 devices of similar structure. This embodiment of the present application does not limit the type of the communication device 500 .

The authentication method provided by the embodiments of the present application will be exemplarily described below with reference to the accompanying drawings.

It should be noted that the names of messages between network elements or the names of parameters in the messages in the following embodiments of the present application are just an example, and other names may also be used in specific implementations, which are not specified in the embodiments of the present application. limited.

Taking the communication system shown in FIG. 2 or FIG. 3 applied to the 5G network shown in FIG. 4 as an example, as shown in FIG. 6 , an authentication method provided by an embodiment of the present application includes the following steps:

S601. The terminal device sends a registration request (registration request) to the AMF network element. Correspondingly, the AMF network element receives the registration request from the terminal device. Wherein, the registration request is used for the terminal device to register with the mobile network. For the relevant parameters in the registration request, reference may be made to the prior art, which will not be repeated here.

Optionally, the registration request in this embodiment of the present application may further include indication information 1 . The instruction information 1 indicates that the security operation is performed through the blockchain system. In the embodiment of the present application, performing the security operation through the blockchain system includes obtaining, through the blockchain system, security parameters (such as security keys) for communication between the AF network element corresponding to the third-party application and the terminal device. Optionally, in this embodiment of the present application, performing the security operation through the blockchain system also includes verifying the legitimacy of the terminal device for a third-party application through the blockchain system, which is described here uniformly and will not be repeated below.

In a possible implementation manner, in this embodiment of the present application, the value of a certain cell may indicate that a secure operation needs to be performed through the blockchain system. For example, when the value of a certain cell is "1", it can indicate that the security operation needs to be carried out through the blockchain system; or, when the value of a certain cell is "0", it can indicate that the blockchain system needs to be carried out. for safe operation.

In another possible implementation manner, in this embodiment of the present application, whether a certain information element exists may indicate that a secure operation needs to be performed through the blockchain system. For example, when a certain cell exists, it can represent the need for a secure operation through the blockchain system.

S602. The AMF network element sends an authentication request (authentication request) to the AUSF network element. Correspondingly, the AUSF network element receives the authentication request from the AMF network element.

In this embodiment of the present application, when the registration request in step S601 includes indication information 1, the authentication request in step S602 also includes indication information 1, which is described here uniformly and will not be repeated below.

S603. The AUSF network element sends an authentication get request (authentication get request) to the UDM network element. Correspondingly, the UDM network element receives the authentication acquisition request from the AUSF network element. Wherein, the authentication acquisition request is used to request to acquire authentication data of the terminal device.

S604, the UDM network element sends an authentication get response (authentication get response) to the AUSF network element. Correspondingly, the UDM network element receives the authentication acquisition response from the AUSF network element. The authentication acquisition response includes authentication data of the terminal device.

Optionally, in this embodiment of the present application, the authentication acquisition response may include the above-mentioned indication information 1 . The instruction information 1 indicates that the security operation is performed through the blockchain system. The implementation of the indication information 1 may refer to step S601, which will not be repeated here.

That is to say, in the embodiment of the present application, the indication information 1 obtained by the AUSF network element may be sent by the terminal device through the AMF network element, or may be sent by the UDM network element, which is not specifically limited in the embodiment of the present application.

S605, the AUSF network element and the terminal device perform mutual authentication, and negotiate to generate a key between the terminal device and the AUSF network element (in the embodiment of this application, the key between the terminal device and the AUSF network element is denoted as Kausf); and , the AUSF network element assigns the key identifier (KID) corresponding to Kausf to the terminal device

Optionally, in this embodiment of the present application, in the process of mutual authentication between the AUSF network element and the terminal device, the terminal device and the AUSF network element may also derive a key according to Kausf (in this embodiment of the present application, a key derived from Kausf will be used. The key is denoted as Kchain). Exemplarily, the manner of deriving the key according to Kausf may include, for example: generating Kchain according to Kausf and the global blockchain identifier of the terminal device. Among them, in the embodiment of the present application, the global blockchain identifier of the terminal device is used to uniquely identify the terminal device in the blockchain system, which may be sent by the UDM network element to the AUSF network element, or may be sent by the AMF network element to the AUSF network element, which is not specifically limited in this embodiment of the present application. Exemplarily, the global blockchain identifier of the terminal device may be, for example, the identifier allocated by the blockchain system to the terminal device, or may be a generic public subscription identifier (GPSI) or a subscription permanent identifier (subscription permanent identifier). , SUPI). When it needs to be explained, the subsequent steps in this embodiment of the present application are described by taking the communication between the AF network element and the terminal device using the key derived in the mobile network as an example for description. Since the AF network element and the terminal device can communicate using the key derived in the mobile network before obtaining the key for secure communication between the terminal device and the AF network element, the service security of the terminal device is improved.

Based on the above steps S601-S605, the terminal device may register with the mobile network. Further, the authentication method provided by the embodiment of the present application may further include the following step S606:

S606, the AUSF network element is registered in the blockchain system.

In the embodiment of this application, the AUSF network element registers the first identifier and Kchain in the blockchain system. The first identifier is used to locate the user context of the terminal device. For example, the first identifier may be at least one of a global blockchain identifier or a KID of the terminal device, which is described here uniformly and will not be repeated below.

In this embodiment of the present application, the AUSF network element may be registered in the blockchain system according to the indication information 1.

It should be noted that, in this embodiment of the present application, the process of registering the first identifier and Kchain by the AUSF network element in the blockchain system can be understood as the blockchain security where the AUSF network element stores the first identifier and Kchain in the blockchain system. The processes in the processing module are uniformly described here, and will not be repeated below. For the relevant description of the blockchain security processing module, reference may be made to the preamble of the specific implementation manner, which will not be repeated here.

It should be noted that, for security reasons, in the embodiment of this application, when the AUSF network element registers the Kchain in the blockchain system, the AUSF network element needs to encrypt the Kchain and send the encrypted Kchain to the blockchain system, and then the blockchain The blockchain security processing module of the system stores the encrypted Kchain. In a possible implementation manner, the manner in which the AUSF network element encrypts the Kchain may, for example, include: the AUSF network element encrypts the Kchain using the public key allocated by the blockchain system to the blockchain security processing module. Further, when the Kchain needs to be used in the future, the blockchain security processing module uses the private key corresponding to the public key allocated by the blockchain system to the blockchain security processing module to decrypt the encrypted Kchain to obtain the Kchain. No longer. Of course, the Kchain can also be encrypted and the encrypted Kchain can be decrypted in other ways, which are not specifically limited in the embodiment of the present application.

It should be noted that, in the embodiment of the present application, the AUSF network element may directly interact with the blockchain system, and may also interact with the blockchain system through the BCHF network element, which is not specifically limited in the embodiment of the present application. Among them, when the AUSF network element interacts with the blockchain system through the BCHF network element, the BCHF network element can register the address of the BCHF network element with the blockchain system, so that the subsequent blockchain system can be based on the BCHF network element address. Interact with the BCHF network element, which is not specifically limited in this embodiment of the present application. In addition, it should be noted that, in the embodiment of the present application, when the BCHF network element interacts with the blockchain system, it may also be forwarded by the NEF network element, which is not specifically limited in the embodiment of the present application. The above description is also applicable to the embodiments shown in the subsequent FIG. 7 and FIG. 8 , and is described in a unified manner here, and will not be repeated below.

Based on step S606, the AUSF network element can be registered with the blockchain system. Further, the authentication method provided by the embodiment of the present application also includes a process of performing a secure operation through a blockchain system, including the following steps:

S607. The terminal device sends a login request to the AF network element. Correspondingly, the AF network element receives the login request from the terminal device. The login request is used for requesting to log in to the third-party application corresponding to the AF network element.

In this embodiment of the present application, the login request includes the first identifier. Optionally, the login request may further include parameters and/or messages encrypted using Kchain. Among them, in the embodiment of the present application, the parameters and/or messages encrypted by Kchain can mean: there are parameters encrypted by Kchain alone, messages encrypted by Kchain are present alone, and parameters and messages encrypted by Kchain exist simultaneously. A unified description is provided here, and the description is applicable to all the embodiments of the present application, and details are not repeated below.

In the embodiment of the present application, the encrypted parameter may be, for example, a random number selected by the terminal device, a first identifier, or a value agreed between the terminal device and the blockchain system, which is not specifically limited in the embodiment of the present application. The encrypted message may be, for example, a registration message. For the related description of the first identifier, reference may be made to the foregoing step S606, which is not repeated here.

S608, the AF network element sends a verification request (validate request) 1 to the blockchain system. Correspondingly, the blockchain system receives the verification request 1 from the AF network element.

In this embodiment of the present application, the verification request 1 includes the first identifier in step S607. Optionally, the verification request 1 may further include parameters and/or messages encrypted using Kchain in step S607.

Optionally, the verification request 1 may further include an application identifier (APP ID) of a third-party application. The application identifier may be included in the message body of the verification request 1, may also be included in the message header of the verification request 1, and may also be expressed in the form of a digital signature of the APP, which is not specifically limited in this embodiment of the present application.

Optionally, in the embodiment of the present application, when the verification request 1 includes the first identifier in step S607 and the parameters and/or messages encrypted by Kchain, the authentication method provided by the embodiment of the present application further includes the following step S609:

S609. The blockchain system verifies the legitimacy of the terminal device for a third-party application.

Wherein, in this embodiment of the present application, the blockchain system may determine the user context of the terminal device according to the first identifier. Furthermore, the blockchain system can verify the legitimacy of the terminal device for third-party applications based on the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key.

Optionally, in the embodiment of the present application, the blockchain system determining the user context of the terminal device according to the first identifier includes: the blockchain system determining the Kchain stored in the blockchain system according to the first identifier. In a possible implementation manner, the blockchain system can determine the user context of the terminal device stored in the blockchain system according to the first identifier and the corresponding relationship between the first identifier and the user context of the terminal device, and further blockchain The system can determine the Kchain in the user context of the terminal device (that is, the Kchain stored by the AUSF network element in the blockchain system). Exemplarily, determining the Kchain in the user context of the terminal device by the blockchain system may include, for example: the blockchain system may determine the Kchain according to the correspondence between the first identifier in the user context of the terminal device and the Kchain.

In the embodiment of this application, the blockchain system verifies the legitimacy of the terminal device for third-party applications according to Kchain and the parameters and/or messages encrypted by the terminal device using the first key, including: the blockchain system can use Kchain to decrypt Parameters and/or messages encrypted with Kchain sent by end devices. In the case where the terminal device sends parameters encrypted with Kchain but does not send messages encrypted with Kchain, if the decrypted parameters conform to the parameter format or value preconfigured by the blockchain system for the interaction between the terminal device and the blockchain system, or If the decrypted parameters conform to the parameters agreed by the terminal device and the blockchain system, the terminal device is considered legal. In the case where the terminal device sends a message encrypted with Kchain and does not send parameters encrypted with Kchain, if the format of the decrypted message conforms to the message format preconfigured by the blockchain system for the interaction between the terminal device and the blockchain system, it is considered that The end device is legal. When the terminal device sends a message encrypted with Kchain and sends parameters encrypted with Kchain, if the format of the decrypted message conforms to the message format preconfigured by the blockchain system for the interaction between the terminal device and the blockchain system; and the decryption If the latter parameters conform to the parameter format or value used by the terminal device preconfigured by the blockchain system and the blockchain system interact, or if the decrypted parameters conform to the parameters agreed upon between the terminal device and the blockchain system, the terminal device is considered legal.

Exemplarily, taking the APP ID as the agreed parameter between the terminal device and the blockchain system as an example, after the blockchain system decrypts the Kchain-encrypted parameter sent by the terminal device, it determines whether the decrypted parameter is the same as the APP sent by the AF network element. If the IDs are consistent, the terminal device is considered legal; if they are inconsistent, the terminal device is considered illegal. Among them, in a possible implementation manner, the terminal device can obtain the APP ID through a domain name system (domain name system, DNS) query. Of course, the terminal device can also obtain the APP ID through other methods, which is not specifically described in this embodiment of the application. limited.

Further, in the embodiment of the present application, after the blockchain system receives the verification request 1 from the AF network element, it needs to provide a security key for the communication between the AF network element corresponding to the third-party application and the terminal device, including the following steps:

S610, the blockchain system generates a key for secure communication between the terminal device and the AF network element according to Kchain (in this embodiment of the present application, the key for the secure communication between the terminal device and the AF network element is denoted as Kapp).

Wherein, in this embodiment of the present application, the blockchain system may determine the corresponding user context according to the first identifier. The user context includes the Kchain stored by the AUSF network element in the blockchain system.

Optionally, if the above step S609 is performed in this embodiment of the present application, after the blockchain system verifies that the terminal device is legal, the blockchain system generates Kapp according to Kchain. Otherwise, if the blockchain system verifies that the terminal device is illegal, the process of accessing the third-party application by the terminal device can be terminated. Based on this solution, the access process can be terminated in time when the terminal device is illegal to access the third-party application, which avoids the block chain system still generating Kapp and delivering the Kapp to the AF network element when the terminal device is illegal to access the third-party application. resource consumption and signaling waste.

Optionally, in the embodiment of the present application, when the verification request 1 includes the APP ID, the blockchain system may also use the APP ID as one of the input parameters for generating Kapp, which is not specifically limited in the embodiment of the present application.

Optionally, in the embodiment of the present application, the blockchain system may also use the first identifier as one of the input parameters for generating Kapp, which is not specifically limited in the embodiment of the present application.

Optionally, in this embodiment of the present application, when the terminal device sends parameters encrypted by Kchain, the blockchain system may also use the decrypted parameter as one of the input parameters for generating Kapp, which is not the case in this embodiment of the present application. Make specific restrictions. Since the decrypted parameters can include, for example, a random number selected by the terminal device, and the random number is random, the Kapp generated based on the random number is also more flexible and is not easily attacked by attackers, thereby further ensuring that the terminal device can communicate with Secure communication between AF network elements.

S611, the blockchain system sends a validation response (validate response) 1 to the AF network element. Correspondingly, the AF network element receives the verification response 1 from the blockchain system.

Wherein, the verification response 1 includes the above Kapp. Optionally, the verification response 1 may further include the validity period of the Kapp. When the validity period of the Kapp expires, the terminal device and the AF network element can initiate the Kapp renegotiation process, so that the AF network element obtains the Kapp through the blockchain system again.

Optionally, in this embodiment of the present application, when the verification request 1 includes parameters and/or messages encrypted using Kchain, the verification response 1 may also include parameters and/or messages decrypted using Kchain. The parameters and/or messages are used for subsequent verification of network security, which is not specifically limited in this embodiment of the present application.

S612. The AF network element sends a login response to the terminal device. Correspondingly, the terminal device receives the login response from the AF network element.

In this embodiment of the present application, when the login request includes a message encrypted using Kchain, such as a registration request, the login response may include a registration acceptance message obtained according to the registration request decrypted using Kchain. Optionally, when the verification response 1 includes the validity period of the Kapp, the registration acceptance message may include the validity period of the Kapp.

Optionally, in this embodiment of the present application, when the login request includes parameters encrypted using Kchain, the login response may include parameters decrypted using Kchain. After receiving the login response, the terminal device can read the parameters decrypted by Kchain included in the login response, and compare the parameters decrypted by Kchain included in the login response with the parameters that have not been decrypted before the terminal device sends the login request to the AF network element. The encrypted parameters are compared, and if the two are consistent, it is considered that the terminal device has passed the verification on the network side (that is, the terminal device confirms the network security).

Optionally, in this embodiment of the present application, the message or parameter in the login response may be encrypted using Kapp, so as to ensure secure communication between the terminal device and the AF network element.

In this embodiment of the present application, after the terminal device receives the login response, it can encrypt key information by using the locally generated Kapp in the subsequent information exchange process with the AF network element. Among them, the way in which the terminal device generates Kapp is the same as the way in which the blockchain system generates Kapp, and will not be repeated here. In addition, it should be noted that, if the above-mentioned step S609 is not executed in this embodiment of the present application (that is, the blockchain system does not use Kchain to verify the legitimacy of the terminal device for a third-party application), the legitimacy of the terminal device can also be verified through subsequent procedures. . For example, since Kapp is derived from Kchain, if the terminal device is legal, the terminal device can obtain the correct Kchain, and the Kapp generated by the terminal device is the same as the Kapp obtained by the AF network element. Secure communication will succeed. Conversely, if the terminal device is illegal, the terminal device cannot obtain the correct Kchain, and the Kapp generated by the terminal device is different from the Kapp obtained by the AF network element. The subsequent secure communication between the terminal device and the AF network element using Kapp will fail. The interests of legitimate terminal equipment are protected.

Optionally, in this embodiment of the present application, when the login response does not include the parameters decrypted using Kchain, since both the subsequent terminal device and the AF network element can use Kapp to encrypt the information, the terminal device can also pass the subsequent message interactive verification. Whether the network side is legal is not specifically limited in this embodiment of the present application.

Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, Make the AF network element interact with the blockchain system through this interface, and perform safe operations through the blockchain system, such as providing security keys for the communication between the AF network element corresponding to the third-party application and the terminal device, and verifying the third-party application. The legitimacy of terminal equipment, etc., not only simplifies the configuration of third-party applications, but also avoids the problem of negotiating one-by-one between third-party applications and operators, and deploying network elements to plan routes, improving the efficiency of third-party applications.

Wherein, the actions of the AUSF network element, the AF network element or the blockchain system in the above steps S601 to S612 can be performed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the AUSF network element, AF network element, or blockchain system, and this embodiment does not impose any restrictions on this.

Optionally, taking the communication system shown in FIG. 2 or FIG. 3 applied to the 5G network shown in FIG. 4 as an example, as shown in FIG. 7 , an authentication method is provided in this embodiment of the present application, and the method includes the following: step:

S701-S705 are the same as steps S601-S605 in the embodiment shown in FIG. 6 , and the related description can refer to the embodiment shown in FIG. 6 , and details are not repeated here.

Based on the above steps S701-S705, the terminal device may register with the mobile network. Further, the authentication method provided in the embodiment of the present application may further include the following step S706:

S706, the AUSF network element is registered in the blockchain system.

In a possible implementation manner, in the embodiment of the present application, when the AUSF network element is registered in the blockchain system, the first identifier and the Kchain can be registered.

In another possible implementation manner, in the case where the AUSF network element can obtain the Kchain, in this embodiment of the present application, when the AUSF network element is registered in the blockchain system, the address, the first identifier and the Kchain of the AUSF network element can be registered. . It should be noted that, in this embodiment of the present application, the process of registering the first identifier and Kchain by the AUSF network element in the blockchain system can be understood as the blockchain security where the AUSF network element stores the first identifier and Kchain in the blockchain system. The process in the processing module; the process of the AUSF network element registering the AUSF network element's address, first identifier and Kchain in the blockchain system can be understood as the AUSF network element storing the AUSF network element's address, first identifier and Kchain in the block chain. The process in the blockchain security processing module of the chain system is uniformly described here, and will not be repeated below.

It should be noted that, for security reasons, in the embodiment of this application, when the AUSF network element registers the Kchain in the blockchain system, the AUSF network element needs to encrypt the Kchain and send the encrypted Kchain to the blockchain system, and then the blockchain The blockchain security processing module of the system stores the encrypted Kchain. For related implementation, reference may be made to step S606 in the embodiment shown in FIG. 6 , and details are not described herein again.

Based on step S706, the AUSF network element can be registered with the blockchain system. Further, the authentication method provided by the embodiment of the present application also includes a process of performing a secure operation through a blockchain system, including the following steps:

S707, the terminal device sends a login request to the AF network element. Correspondingly, the AF network element receives the login request from the terminal device. The login request is used for requesting to log in to the third-party application corresponding to the AF network element.

In this embodiment of the present application, the login request includes the first identifier, parameters and/or messages encrypted using Kchain. The encrypted parameter may be, for example, a random number selected by the terminal device, a first identifier, or a value agreed between the terminal device and the blockchain system, which is not specifically limited in this embodiment of the present application. The encrypted message may be, for example, a registration message. For the related description of the first identifier, reference may be made to step S606 in the embodiment shown in FIG. 6 , and details are not repeated here.

S708, the AF network element sends a verification request (validate request) 1 to the blockchain system. Correspondingly, the blockchain system receives the verification request 1 from the AF network element.

In this embodiment of the present application, the verification request 1 includes the first identifier in step S607, and parameters and/or messages encrypted using Kchain.

S709. The blockchain system verifies the legitimacy of the terminal device for a third-party application.

The specific implementation of step S709 may refer to step S609 in the embodiment shown in FIG. 6 , which will not be repeated here.

S710. After the blockchain system verifies that the terminal device is legal, the blockchain system sends a verification request 2 to the AUSF network element. Correspondingly, the AUSF network element receives the verification request 2 from the blockchain system.

Wherein, the verification request 2 includes the first identifier. Optionally, the verification request 2 may further include an application identifier (APP ID) of a third-party application. Optionally, the verification request 2 may further include parameters and/or messages encrypted using Kchain and sent by the terminal device, which are not specifically limited in this embodiment of the present application.

In a possible implementation manner, in the embodiment of this application, if the AUSF network element has registered the address of the AUSF network element in the blockchain system, the blockchain system can send the verification request 2 to the AUSF network element according to the first The identity determines the corresponding user context. The user context includes the address of the AUSF network element registered in the blockchain system by the AUSF network element. Furthermore, the blockchain system can determine the corresponding AUSF network element according to the address of the AUSF network element.

In another possible implementation manner, in the embodiment of the present application, if the AUSF network element does not register the address of the AUSF network element in the blockchain system, the login request and the verification request 1 in the embodiment of the present application may also include the service The network ID of the end device. Furthermore, before the blockchain system sends the verification request 2 to the AUSF network element, the AUSF network element serving the terminal device may be determined according to the network identifier, which is not specifically limited in this embodiment of the present application. Exemplarily, the network identifier in the embodiment of the present application may be, for example, a public land mobile network (public land mobile network, PLMN), or a domain name (such as CMCC.com), which is not specifically limited in the embodiment of the present application. In addition, it should be noted that the network identifier in the embodiment of the present application may be an independent information element, or may be information included in other information elements, which is not specifically limited in the embodiment of the present application.

It should be noted that, in the embodiment of the present application, the blockchain system may directly interact with the AUSF network element, or may interact with the AUSF network element through the BCHF network element, which is not specifically limited in the embodiment of the present application. The above two implementation manners are both illustratively described by taking the blockchain system addressing AUSF network elements as an example. Of course, if the blockchain system interacts with the AUSF network element through the BCHF network element, the blockchain system can also address the BCHF network element in a similar manner, which will not be repeated in this embodiment of the present application.

S711. The AUSF network element generates a key used for the secure communication between the terminal device and the AF network element according to Kchain or Kausf (the key used for the secure communication between the terminal device and the AF network element in the embodiment of this application is denoted as Kapp).

Wherein, in this embodiment of the present application, the blockchain system may determine the corresponding user context according to the first identifier. The user context includes the Kchain or Kausf generated by the AUSF network element.

Optionally, in the embodiment of the present application, when the verification request 1 includes the APP ID, the AUSF network element may also use the APP ID as one of the input parameters for generating Kapp, which is not specifically limited in the embodiment of the present application.

Optionally, in the embodiment of the present application, the AUSF network element may also use the first identifier as one of the input parameters for generating Kapp, which is not specifically limited in the embodiment of the present application.

Optionally, in this embodiment of the present application, in the case where the terminal device sends parameters encrypted using Kchain, the AUSF network element may also use the decrypted parameter as one of the input parameters for generating Kapp, which is not done in this embodiment of the present application. Specific restrictions. Since the decrypted parameters can include, for example, a random number selected by the terminal device, and the random number is random, the Kapp generated based on the random number is also more flexible and is not easily attacked by attackers, thereby further ensuring that the terminal device can communicate with Secure communication between AF network elements.

S712, the AUSF network element sends a verification response 2 to the blockchain system. Correspondingly, the blockchain system receives the verification response 2 from the AUSF network element. Wherein, the verification response 2 includes Kapp. Optionally, the verification response 2 may further include the validity period of the Kapp. When the validity period of the Kapp expires, the terminal device and the AF network element can initiate the Kapp renegotiation process, so that the AF network element obtains the Kapp through the blockchain system again.

Optionally, in this embodiment of the present application, when the verification request 2 includes parameters and/or messages encrypted using Kchain, the verification response 2 may also include parameters and/or messages decrypted using Kchain, and the verification response 2 may include parameters and/or messages decrypted using Kchain. The parameters and/or messages are used for subsequent verification of network security, which is not specifically limited in this embodiment of the present application.

S713, the blockchain system sends a verification response 1 to the AF network element. Correspondingly, the AF network element receives the verification response 1 from the blockchain system. The verification response 1 includes the parameters in the verification response 2 in step S712, such as Kapp, the validity period of the Kapp (optional), and parameters and/or messages decrypted using Kchain (optional).

Of course, in the embodiment of the present application, if the verification request 2 does not include parameters and/or messages encrypted using Kchain, the verification response 1 may also include parameters and/or messages decrypted using Kchain. The parameters and/or messages are used for subsequent verification of network security, which is not specifically limited in this embodiment of the present application.

S714. The AF network element sends a login response to the terminal device. Correspondingly, the terminal device receives the login response from the AF network element.

For the specific implementation of step S714, reference may be made to step S612 in the embodiment shown in FIG. 6 , which will not be repeated here.

Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, Make the AF network element interact with the blockchain system through this interface, and perform safe operations through the blockchain system, such as providing security keys for the communication between the AF network element corresponding to the third-party application and the terminal device, and verifying the third-party application. The legitimacy of terminal equipment, etc., not only simplifies the configuration of third-party applications, but also avoids the problem of negotiating one-by-one between third-party applications and operators, and deploying network elements to plan routes, improving the efficiency of third-party applications. In addition, in the embodiment of the present application, the blockchain system verifies the legality of the terminal device for the third-party application, so that when the terminal device accesses the third-party application is illegal, the access process can be terminated in time, so as to prevent the terminal device from accessing the third-party application illegally. When the AUSF network element still generates Kapp and sends the Kapp to the AF network element through the blockchain system, the resource consumption and signaling waste caused by it.

The actions of the AUSF network element, the AF network element or the blockchain system in the above steps S701 to S714 may be performed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the AUSF network element, AF network element, or blockchain system, and this embodiment does not impose any restrictions on this.

Optionally, taking the communication system shown in FIG. 2 or FIG. 3 applied to the 5G network shown in FIG. 4 as an example, as shown in FIG. 8 , an authentication method is provided in this embodiment of the application, and the method includes the following: step:

S801-S805 are the same as steps S601-S605 in the embodiment shown in FIG. 6 , and the related description may refer to the embodiment shown in FIG. 6 , which will not be repeated here.

Based on the above steps S801-S805, the terminal device may register with the mobile network. Further, optionally, the authentication method provided in this embodiment of the present application may further include the following step S806:

S806, the AUSF network element is registered in the blockchain system.

In the embodiment of the present application, the AUSF network element registers the first identifier and the address of the AUSF network element in the blockchain system. For the description of the first identifier, reference may be made to step S606 in the embodiment shown in FIG. 6 , and details are not repeated here.

It should be noted that, in the embodiment of this application, the process of registering the first identifier and the address of the AUSF network element in the blockchain system by the AUSF network element can be understood as the AUSF network element storing the first identifier and the address of the AUSF network element in the area. The process in the blockchain security processing module of the blockchain system is described here in a unified manner, and will not be repeated below.

Based on step S806, the AUSF network element can be registered with the blockchain system. Further, the authentication method provided by the embodiment of the present application also includes a process of performing a secure operation through a blockchain system, including the following steps:

S807-S808 are the same as steps S607-S608 in the embodiment shown in FIG. 6 , and the related description can refer to the embodiment shown in FIG. 6 , and details are not repeated here.

S809, the blockchain system sends a verification request 2 to the AUSF network element. Correspondingly, the AUSF network element receives the verification request 2 from the blockchain system. Wherein, the verification request 2 includes the parameters in the verification request 1 in step S808, such as the first identifier, and parameters and/or messages encrypted by Kchain (optional).

Optionally, the verification request 2 may further include an application identifier (APP ID) of a third-party application.

In the embodiment of the present application, if the above step S806 is executed, that is, the AUSF network element registers the address of the AUSF network element in the blockchain system, the blockchain system can determine the corresponding AUSF network element according to the first identifier before sending the verification request 2 to the AUSF network element. user context. The user context includes the address of the AUSF network element registered in the blockchain system by the AUSF network element. Furthermore, the blockchain system can determine the corresponding AUSF network element according to the address of the AUSF network element.

In the embodiment of the present application, if the above step S806 is not performed, at this time, the login request and the verification request 1 in the embodiment of the present application may further include the network identifier of the service terminal device. Furthermore, before the blockchain system sends the verification request 2 to the AUSF network element, the AUSF network element serving the terminal device may be determined according to the network identifier. For related description, reference may be made to step S710 in the embodiment shown in FIG. 7 , and details are not repeated here.

S810: The AUSF network element generates a key for secure communication between the terminal device and the AF network element according to Kchain or Kausf (the key for secure communication between the terminal device and the AF network element in the embodiment of the present application is denoted as Kapp).

Optionally, in this embodiment of the present application, when the terminal device sends parameters and/or messages encrypted with Kchain, and the verification request 2 includes parameters and/or messages encrypted with Kchain, the AUSF network element may also be the first The third-party application verifies the legitimacy of the terminal device. After the AUSF network element verifies that the terminal device is legal, the AUSF network element generates a Kapp according to Kchain or Kausf. If the AUSF network element verifies that the terminal device is illegal, the process of the terminal device accessing the third-party application can be terminated. . Based on this solution, the access process can be terminated in time when the terminal device is illegal to access the third-party application, so that when the terminal device is illegal to access the third-party application, the AUSF network element still generates Kapp and downloads it to the AF network element through the blockchain system. Resource consumption and signaling waste caused by sending Kapps.

In this embodiment of the present application, the manner in which the AUSF network element verifies the legitimacy of the terminal device for the third-party application may be, for example, the AUSF network element may determine the user context of the terminal device according to the first identifier. Further, the AUSF network element can verify the legitimacy of the terminal device for the third-party application according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key.

Optionally, in this embodiment of the present application, the AUSF network element determining the user context of the terminal device according to the first identifier includes: the AUSF network element determining the Kchain stored in the AUSF network element according to the first identifier. In a possible implementation manner, the AUSF network element may determine the user context of the terminal equipment stored in the AUSF network element according to the first identifier and the corresponding relationship between the first identifier and the user context of the terminal equipment, and further AUSF network elements may determine Kchain in the user context of the end device. Exemplarily, the AUSF network element determining the Kchain in the user context of the terminal device may include, for example: the AUSF network element may determine the Kchain according to the correspondence between the first identifier in the user context of the terminal device and the Kchain.

In the embodiment of this application, the AUSF network element verifies the legitimacy of the terminal device for the third-party application according to Kchain and the parameters and/or messages encrypted by the terminal device using the first key, including: the AUSF network element can use the Kchain to decrypt the terminal device. Sent parameters and/or messages encrypted with Kchain. Wherein, when the terminal device sends parameters encrypted by Kchain but does not send messages encrypted by Kchain, if the decrypted parameters conform to the preconfigured parameter format or value used by the terminal device and the AUSF network element for interaction, or the decrypted If the parameters conform to the parameters agreed by the terminal device and the AUSF network element, the terminal device is considered legal. When the terminal device sends a message encrypted by Kchain but does not send parameters encrypted by Kchain, if the format of the decrypted message conforms to the preconfigured message format used by the terminal device and the AUSF network element for interaction, the terminal device is considered legitimate. When the terminal device sends a message encrypted by Kchain and sends parameters encrypted by Kchain, if the decrypted message format conforms to the preconfigured message format used by the terminal device and the AUSF network element interactively; and the decrypted parameters conform to the preconfigured message format. If the configured parameter format or value used by the terminal device and the AUSF network element for interaction, or if the decrypted parameters conform to the parameters agreed by the terminal device and the AUSF network element, the terminal device is considered legal.

Exemplarily, taking the parameter agreed between the terminal device and the AUSF network element as the APP ID as an example, after the AUSF network element decrypts the Kchain-encrypted parameters sent by the terminal device, it is determined whether the decrypted parameters are consistent with the APP ID sent by the AF network element. , if they are consistent, the terminal device is considered legal, if not, the terminal device is considered illegal. Among them, in a possible implementation manner, the terminal device may obtain the APP ID through DNS query. Of course, the terminal device may also obtain the APP ID through other methods, which is not specifically limited in this embodiment of the present application.

S811-S813 are the same as steps S712-S714 in the embodiment shown in FIG. 7 , and the related description can refer to the embodiment shown in FIG. 7 , and details are not repeated here.

It should be noted that, if the AUSF network element does not verify the legality of the terminal device for the third-party application in the embodiment of the present application, the legality of the terminal device may also be verified through subsequent procedures. For example, since Kapp is derived from Kchain, if the terminal device is legal, the terminal device can obtain the correct Kchain, and the Kapp generated by the terminal device is the same as the Kapp obtained by the AF network element. Secure communication will succeed. Conversely, if the terminal device is illegal, the terminal device cannot obtain the correct Kchain, and the Kapp generated by the terminal device is different from the Kapp obtained by the AF network element. The subsequent secure communication between the terminal device and the AF network element using Kapp will fail. The interests of legitimate terminal equipment are protected.

Wherein, the actions of the AUSF network element, the AF network element or the blockchain system in the above steps S801 to S813 can be performed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the AUSF network element, AF network element, or blockchain system, and this embodiment does not impose any restrictions on this.

As shown in FIG. 9 , an authentication method provided by an embodiment of the present application includes the following steps:

S901. The blockchain system receives a first message from an application server, where the first message includes a first identifier, and parameters and/or messages encrypted by the terminal device using the first key.

Exemplarily, the application server in the embodiment of the present application may be, for example, the AF network element in the embodiment shown in FIG. 6 or FIG. 7 , and the blockchain system in the embodiment of the present application may be, for example, the one shown in FIG. 6 or FIG. 7 . The blockchain system in the embodiment shown.

Exemplarily, the first message in the embodiment of the present application may be, for example, the verification request 1 in step S608 in the embodiment shown in FIG. 6 ; or, the first message in the embodiment of the present application may be, for example, the one shown in FIG. 7 . In the embodiment of the verification request 2 in step S708.

S902, the blockchain system determines the user context of the terminal device according to the first identifier.

S903, the blockchain system verifies the legitimacy of the terminal device for a third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key.

Exemplarily, for the specific implementation of steps S902-S903, reference may be made to step S609 in the embodiment shown in FIG. 6 or step S709 in the embodiment shown in FIG. 7 , and details are not repeated here.

On the one hand, in the embodiment of the present application, the blockchain system verifies the legality of the terminal device for the third-party application, so that when the terminal device accesses the third-party application is illegal, the access process can be terminated in time, so as to prevent the terminal device from accessing the third-party application. When it is legal, the resource consumption and signaling waste caused by continuing to execute the subsequent process (such as continuing to provide a security key for the communication between the application server corresponding to the third-party application and the terminal device). On the other hand, compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. The domain authentication interface allows the application server to interact with the blockchain system through this interface, and perform safe operations through the blockchain system (such as verifying the legitimacy of terminal devices for third-party applications), so not only simplifies the configuration of third-party applications, but also The problem of negotiating one by one between the third-party application party and the operator and deploying network elements to plan routes is avoided, and the efficiency of the third-party application party is improved.

The actions of the blockchain system in the above steps S901 to S903 may be executed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the blockchain system to execute. This does not impose any restrictions.

As shown in FIG. 10 , an authentication method provided by an embodiment of the present application includes the following steps:

S1001. The blockchain system receives a first message from an application server, where the first message includes a first identifier.

Exemplarily, the application server in the embodiment of the present application may be, for example, the AF network element in the embodiment shown in FIG. 6 , and the blockchain system in the embodiment of the present application may be, for example, the network element in the embodiment shown in FIG. blockchain system.

Exemplarily, the first message in this embodiment of the present application may be, for example, the verification request 1 in step S608 in the embodiment shown in FIG. 6 .

S1002. The blockchain system determines a user context of the terminal device according to the first identifier, where the user context of the terminal device includes the first key.

Exemplarily, the first key in this embodiment of the present application may be, for example, Kchain in the embodiment shown in FIG. 6 .

S1003. The blockchain system generates a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein the input parameters for generating the third key include the first key.

Exemplarily, the third key in this embodiment of the present application may be, for example, Kapp in the embodiment shown in FIG. 6 .

For the specific implementation of steps S1002-S1003, reference may be made to step S610 in the embodiment shown in FIG. 6, and details are not described herein again.

Compared with the existing AKMA solution, the application side AApF network elements need to configure the interfaces and interface addresses with the AAuF network elements in different networks one by one. Because the embodiment of the present application can provide a unified cross-domain authentication interface by the blockchain system, The application server interacts with the blockchain system through this interface, and performs safe operations through the blockchain system (such as obtaining the security parameters of the communication between the application server and the terminal device through the blockchain system), which not only simplifies the first step The configuration of the third-party application also avoids the problem of negotiating one by one between the third-party application party and the operator, and deploying network elements to plan routes, which improves the efficiency of the third-party application party.

The actions of the blockchain system in the above steps S1001 to S1003 may be executed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the blockchain system to execute. This does not impose any restrictions.

As shown in FIG. 11 , an authentication method provided by an embodiment of the present application includes the following steps:

S1101. The authentication service function network element obtains instruction information, where the instruction information indicates that a secure operation is performed through a blockchain system.

Exemplarily, the authentication service function network element in the embodiment of the present application may be, for example, the AUSF network element in the embodiments shown in FIG. 6 to FIG. 8 , and the blockchain system in the embodiment of the present application may be, for example, FIG. 6 to The blockchain system in the embodiment shown in FIG. 8 .

Exemplarily, in this embodiment of the present application, reference may be made to the description of step S604 in the embodiment shown in FIG. 6 for the manner in which the authentication service function network element obtains the indication information, which will not be repeated here.

S1102. The authentication service function network element sends a third message to the blockchain system according to the indication information, where the third message includes first information and is used to request to store the first information in the user context of the terminal device, wherein the first The information is the information required by the application server to perform secure operations through the blockchain system.

Exemplarily, the application server in the embodiment of the present application may be, for example, the AF network element in the embodiments shown in FIG. 6 to FIG. 8 .

Exemplarily, the third message in this embodiment of the present application may be, for example, a message sent by the AUSF network element to the blockchain system when the AUSF network element registers with the blockchain system in step S606 of the embodiment shown in FIG. 6 . Correspondingly, the first information may be the first identifier and Kchain registered by the AUSF network element in the blockchain system in step S606 of the embodiment shown in FIG. 6 .

Or, for example, the third message in this embodiment of the present application may be, for example, a message sent by the AUSF network element to the blockchain system when the AUSF network element registers with the blockchain system in step S706 of the embodiment shown in FIG. 7 . Correspondingly, the first information may be the first identifier and Kchain registered by the AUSF network element in the blockchain system in step S706 of the embodiment shown in FIG. 7 , or the first information may be step S706 of the embodiment shown in FIG. 7 . The first identifier of the AUSF network element registered in the blockchain system, the Kchain and the address of the AUSF network element.

Or, for example, the third message in this embodiment of the present application may be, for example, a message sent by the AUSF network element to the blockchain system when the AUSF network element registers with the blockchain system in step S806 of the embodiment shown in FIG. 8 . Correspondingly, the first information may be the first identifier of the AUSF network element registered in the blockchain system in step S806 of the embodiment shown in FIG. 8 and the address of the AUSF network element.

The specific implementation of step S1102 may refer to step S606 in the embodiment shown in FIG. 6 or step S706 in the embodiment shown in FIG. 7 or step S806 in the embodiment shown in FIG. 8 , and details are not repeated here.

Compared with the existing AKMA solution in which the AApF network element of the application side needs to configure the interfaces and interface addresses of the AAuF network elements in different networks one by one, because in the embodiment of the present application, the authentication service function network element can send the data to the blockchain system. The information required for the application server to perform safe operations through the blockchain system, so that subsequent application servers can perform safe operations through the blockchain system. That is to say, in this embodiment of the present application, a unified cross-domain authentication interface can be provided by the blockchain system, so that the application server can interact with the blockchain system through this interface, and perform safe operations through the blockchain system, which not only simplifies the third party It also avoids the problem of negotiating one by one between the third-party application party and the operator, and deploying network elements to plan routes, which improves the efficiency of the third-party application party.

The actions of the authentication service function network element in the above steps S1101 to S1102 may be executed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the authentication service function network element to execute. The example does not impose any restrictions on this.

As shown in FIG. 12 , an authentication method provided by an embodiment of the present application includes the following steps:

S1201. The authentication service function network element receives a second message from the blockchain system, where the second message includes the first identifier.

Exemplarily, the authentication service function network element in the embodiment of the present application may be, for example, the AUSF network element in the embodiment shown in FIG. 7 or FIG. 8 , and the blockchain system in the embodiment of the present application may be, for example, FIG. 7 or The blockchain system in the embodiment shown in FIG. 8 .

Exemplarily, the second message in the embodiment of the present application may be, for example, the verification request 2 in step S710 in the embodiment shown in FIG. 7 ; or, the second message in the embodiment of the present application may be, for example, as shown in FIG. 8 . In the embodiment of the verification request 2 in step S809.

S1202. The authentication service function network element determines the user context of the terminal device according to the first identifier, where the user context of the terminal device includes the first key or the second key; the first key is derived from the second key, The second key is a key generated after successful authentication between the terminal device and the authentication service function network element.

Exemplarily, the first key in the embodiment of the present application may be, for example, Kchain in the embodiment shown in FIG. 7 or FIG. 8 , and the second key may be, for example, the Kchain in the embodiment shown in FIG. 7 or FIG. 8 . Kausf.

S1203. The authentication service function network element generates a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein the input parameters for generating the third key include the first key or the third key. Second key.

Exemplarily, the application server in the embodiment of the present application may be, for example, the AF network element in the embodiment shown in FIG. 7 or FIG. 8 .

Exemplarily, the first key in this embodiment of the present application may be, for example, Kapp in the embodiment shown in FIG. 7 or FIG. 8 .

Exemplarily, for the specific implementation of steps S1202-S1203, reference may be made to step S711 in the embodiment shown in FIG. 7 or step S810 in the embodiment shown in FIG. 8, and details are not repeated here.

S1204, the authentication service function network element sends the third key to the blockchain system.

Exemplarily, for the specific implementation of step S1204, reference may be made to step S712 in the embodiment shown in FIG. 7 or step S811 in the embodiment shown in FIG. 8 , and details are not repeated here.

The actions of the authentication service function network element in the above steps S1201 to S1204 may be executed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 503 to instruct the authentication service function network element to execute. The example does not impose any restrictions on this.

It can be understood that, in the embodiments shown in FIGS. 6 to 12 , the methods and/or steps implemented by the blockchain system may also be implemented by components that can be used in the blockchain system (for example, one of the blockchain systems). or multiple blockchain devices); implemented by the authentication service function network element (the AUSF network element in the embodiment shown in FIG. 6 to FIG. 8 , or the authentication service in the embodiment shown in FIG. 11 to FIG. 12 ) The methods and/or steps implemented by the functional network element) may also be implemented by a component (for example, a chip or a circuit) that can be used to authenticate the service functional network element.

The foregoing mainly introduces the solutions provided by the embodiments of the present application from the perspective of interaction between various network elements. Correspondingly, an embodiment of the present application further provides a communication device, and the communication device may be one or more blockchain devices in the blockchain system in the above method embodiments, or a device including the above blockchain system, or It is a component that can be used in the above-mentioned blockchain device; or, the communication device can be an authentication service function network element in the above method embodiment, or a device including the above-mentioned authentication service function network element, or can be used for the authentication service function network element. components. It can be understood that, in order to realize the above-mentioned functions, the communication apparatus includes corresponding hardware structures and/or software modules for executing each function. Those skilled in the art should easily realize that the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

FIG. 13 shows a schematic structural diagram of a communication device 130 . The communication device 130 includes a transceiver module 1301 and a processing module 1302 . The transceiver module 1301 may also be referred to as a transceiver unit to implement a transceiver function, for example, a transceiver circuit, a transceiver, a transceiver or a communication interface.

Taking the communication device 130 as one or more blockchain devices in the blockchain system in the above method embodiments or a chip or other components provided in the blockchain device as an example, in a possible implementation manner:

The transceiver module 1301 is configured to receive a first message from an application server, where the first message includes a first identifier, and parameters and/or messages encrypted by the terminal device using the first key. The processing module 1302 is configured to determine the user context of the terminal device according to the first identifier. The processing module 1302 is further configured to verify the legitimacy of the terminal device for a third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key.

Optionally, the user context of the terminal device includes the first key, and the processing module 1302, configured to determine the user context of the terminal device according to the first identifier includes: determining the first key according to the first identifier.

Optionally, the processing module 1302 is configured to verify the legitimacy of the terminal device for the third-party application corresponding to the application server according to the user context of the terminal device and the parameters or messages encrypted by the terminal device using the first key, including: Use the first key to decrypt the parameters and/or messages encrypted by the terminal device using the first key, and obtain the decrypted parameters and/or messages; when the decrypted parameters meet the pre-configured interaction between the terminal device and the blockchain system The parameter format or value used, and/or the decrypted message conforms to the pre-configured message format used by the terminal device and the blockchain system for interaction, and the terminal device is determined to be legal.

Optionally, the first identifier includes at least one of the global blockchain identifier of the terminal device or the key identifier KID corresponding to the second key, and the second key is the authentication between the terminal device and the authentication service function network element. The key generated after success.

Optionally, the first key is derived from the second key, and the second key is a key generated after successful authentication between the terminal device and the authentication service function network element.

Optionally, the processing module 1302 is further configured to obtain a third key after verifying that the terminal device is legal, where the third key is a key used for secure communication between the terminal device and the application server. The transceiver module 1301 is further configured to send the third key to the application server.

Optionally, the user context of the terminal device includes the first key; the processing module 1302, configured to obtain the third key, includes: being used to generate the third key, wherein the input parameters for generating the third key include: first key.

Optionally, the processing module 1302, configured to obtain the third key, includes: sending a second message to the authentication service function network element through the transceiver module 1301, where the second message includes a first identifier, and the first identifier is used to determine the terminal The user context of the device, the user context of the terminal device includes the first key or the second key, and the second key is the key generated after the authentication between the terminal device and the authentication service function network element is successful; 1301 Receive a third key from an authentication service function network element, wherein the input parameter for generating the third key includes the first key or the second key.

Optionally, the input parameters for generating the third key also include the second identifier and/or the decrypted parameter, wherein the second identifier is the application identifier of the third-party application, and the decrypted parameter is to use the first key pair. The parameters obtained by the terminal device after decrypting the parameters encrypted by the first key.

Optionally, the transceiver module 1301 is further configured to, before receiving the first message from the application server, receive a third message from the authentication service function network element, the third message requests the first key, the first identifier and the authentication service. The addresses of the functional network elements are stored in the user context of the terminal device. The processing module 1302 is further configured to store the first key, the first identifier and the address of the authentication service function network element in the user context of the terminal device.

Optionally, the transceiver module 1301 is further configured to, before receiving the first message from the application server, receive a third message from the authentication service function network element, and the third message requests to store the first key and the first identifier in the terminal. In the user context of the device; the processing module 1302 is further configured to store the first key and the first identifier in the user context of the terminal device.

Taking the communication device 130 as one or more blockchain devices in the blockchain system in the above method embodiments or a chip or other components provided in the blockchain device as an example, in another possible implementation manner :

The transceiver module 1301 is configured to receive a first message from an application server, where the first message includes a first identifier. The processing module 1302 is configured to determine the user context of the terminal device according to the first identifier, where the user context of the terminal device includes the first key. The processing module 1302 is further configured to generate a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein the input parameters for generating the third key include the first key.

Optionally, the first message further includes a second identifier and/or a parameter encrypted by the terminal device using the first key, and the second identifier is the application identifier of the third-party application corresponding to the application server; correspondingly, the third key is generated. The input parameters also include the second identifier and/or the decrypted parameters, wherein the decrypted parameters are parameters obtained by decrypting the parameters encrypted by the terminal device with the first key using the first key.

Optionally, the transceiver module 1301 is further configured to, before receiving the first message from the application server, receive a third message from the authentication service function network element, and the third message requests to store the first key and the first identifier in the terminal. in the user context of the device. The processing module 1302 is further configured to store the first key and the first identifier in the user context of the terminal device.

Taking the communication device 130 as an authentication service function network element in the above method embodiments or a chip or other component provided in the authentication service function network element as an example, in a possible implementation manner:

The processing module 1302 is configured to obtain instruction information, the instruction information indicates that a secure operation is performed through the blockchain system. The transceiver module 1301 is configured to send a third message to the blockchain system according to the indication information, where the third message includes first information and is used to request to store the first information in the user context of the terminal device, wherein the first information is Information required by the application server to operate securely through the blockchain system.

Optionally, the first information includes a first identifier and an address of an authentication service function network element; or, the first information includes a first identifier and a first key; or, the first information includes a first identifier, a first key, and a first key. The address of the authentication service function network element; wherein the first identifier is used to determine the user context of the terminal device, the first key is derived from the second key, and the second key is the difference between the terminal device and the authentication service function network element The key generated after the authentication is successful.

Optionally, the first identifier includes at least one of a global blockchain identifier of the terminal device or a key identifier KID corresponding to the second key.

Optionally, the processing module 1302, configured to obtain the indication information, includes: for receiving the indication information from the terminal device through the transceiver module 1301; or for receiving the indication information from the unified data management network element through the transceiver module 1301.

Optionally, the transceiver module 1301 is further configured to receive a second message from the blockchain system after sending the third message to the blockchain system, where the second message includes the first identifier. The processing module 1302 is further configured to determine the user context of the terminal device according to the first identifier, where the user context of the terminal device includes the first key or the second key; the first key is derived from the second key, The second key is a key generated after successful authentication between the terminal device and the authentication service function network element. The processing module 1302 is further configured to generate a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein the input parameters for generating the third key include the first key or the second key key. The transceiver module 1301 is further configured to send a third key to the blockchain system.

Optionally, the second message further includes a second identifier and/or a parameter encrypted by the terminal device using the first key, and the second identifier is the application identifier of the third-party application corresponding to the application server; correspondingly, the third key is generated. The input parameters also include the second identifier and/or the decrypted parameters, wherein the decrypted parameters are parameters obtained by decrypting the parameters encrypted by the terminal device with the first key using the first key.

Optionally, the second message further includes parameters and/or messages encrypted by the terminal device using the first key. The processing module 1302 is further configured to verify the legality of the terminal device for the third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key before generating the third key .

Optionally, the user context of the terminal device includes the first key; the processing module 1302 is used for the third party corresponding to the application server according to the user context of the terminal device and the parameters or messages encrypted by the terminal device using the first key. The application verifies that the terminal device is legal, including: using the first key to decrypt the parameters and/or messages encrypted by the terminal device using the first key, and obtaining the decrypted parameters and/or messages; The configured parameter format or value used by the terminal device and the authentication service function network element, and/or the decrypted message conforms to the preconfigured message format used by the terminal device and the authentication service function network element, to determine that the terminal device is legal.

Optionally, performing the security operation through the blockchain system includes obtaining security parameters for communication between the application server and the terminal device through the blockchain system.

Optionally, performing the security operation through the blockchain system further includes verifying the legitimacy of the terminal device for a third-party application corresponding to the application server through the blockchain system.

Taking the communication device 130 as the authentication service function network element in the above method embodiment or a chip or other component provided in the authentication service function network element as an example, in another possible implementation manner:

The transceiver module 1301 is configured to receive a second message from the blockchain system, where the second message includes the first identifier. The processing module 1302 is configured to determine the user context of the terminal device according to the first identifier, where the user context of the terminal device includes the first key or the second key; the first key is derived from the second key, and the first key is derived from the second key. The second key is a key generated after successful authentication between the terminal device and the authentication service function network element. The processing module 1302 is further configured to generate a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein the input parameters for generating the third key include the first key or the second key key. The transceiver module 1301 is further configured to send a third key to the blockchain system.

Wherein, all relevant contents of the steps involved in the above method embodiments can be cited in the functional descriptions of the corresponding functional modules, which will not be repeated here.

In this embodiment, the communication apparatus 130 is presented in the form of dividing each functional module in an integrated manner. "Module" herein may refer to a specific ASIC, circuit, processor and memory executing one or more software or firmware programs, integrated logic circuit, and/or other device that may provide the functions described above. In a simple embodiment, those skilled in the art can imagine that the communication apparatus 130 may take the form of the communication device 500 shown in FIG. 5 .

For example, the processor 501 in the communication device 500 shown in FIG. 5 may invoke the computer execution instructions stored in the memory 503 to cause the communication device 500 to execute the authentication method in the above method embodiment.

Specifically, the functions/implementation process of the transceiver module 1301 and the processing module 1302 in FIG. 13 can be implemented by the processor 501 in the communication device 500 shown in FIG. 5 calling the computer execution instructions stored in the memory 503 . Alternatively, the function/implementation process of the processing module 1302 in FIG. 13 can be implemented by the processor 501 in the communication device 500 shown in FIG. 5 calling the computer execution instructions stored in the memory 503, and the function of the transceiver module 1301 in FIG. 13 can be implemented. The implementation process may be implemented through the communication interface 504 in the communication device 500 shown in FIG. 5 .

Since the communication device 130 provided in this embodiment can execute the above authentication method, the technical effect obtained by the communication device 130 can refer to the above method embodiment, which is not repeated here.

It should be noted that, one or more of the above modules or units may be implemented by software, hardware or a combination of both. When any of the above modules or units are implemented in software, the software exists in the form of computer program instructions and is stored in the memory, and the processor can be used to execute the program instructions and implement the above method flow. The processor can be built into a SoC (system on chip) or an ASIC, or it can be an independent semiconductor chip. In addition to the core for executing software instructions for operation or processing, the internal processing of the processor may further include necessary hardware accelerators, such as field programmable gate array (FPGA), PLD (Programmable Logic Device) , or a logic circuit that implements dedicated logic operations.

When the above modules or units are implemented in hardware, the hardware can be CPU, microprocessor, digital signal processing (DSP) chip, microcontroller unit (MCU), artificial intelligence processor, ASIC, Any or any combination of SoCs, FPGAs, PLDs, dedicated digital circuits, hardware accelerators, or non-integrated discrete devices that may or may not run the necessary software to perform the above method flows.

Optionally, an embodiment of the present application further provides a communication apparatus (for example, the communication apparatus may be a chip or a chip system), where the communication apparatus includes a processor for implementing the method in any of the foregoing method embodiments. In a possible implementation, the communication device further includes a memory. The memory is used to store necessary program instructions and data, and the processor can call the program code stored in the memory to instruct the communication apparatus to execute the method in any of the above method embodiments. Of course, the memory may also not be in the communication device. When the communication device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices, which is not specifically limited in this embodiment of the present application.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or data storage devices including one or more servers, data centers, etc. that can be integrated with the medium. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Although the application is described herein in conjunction with the various embodiments, those skilled in the art will understand and understand from a review of the drawings, the disclosure, and the appended claims in practicing the claimed application. Other variations of the disclosed embodiments are implemented. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that these measures cannot be combined to advantage.

Although the application has been described in conjunction with specific features and embodiments thereof, it will be apparent that various modifications and combinations can be made therein without departing from the spirit and scope of the application. Accordingly, this specification and drawings are merely exemplary illustrations of the application as defined by the appended claims, and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of this application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

An authentication method, characterized in that the method comprises:

The blockchain system receives a first message from the application server, where the first message includes a first identifier and parameters and/or messages encrypted by the terminal device using the first key;

The blockchain system determines the user context of the terminal device according to the first identifier;

The blockchain system verifies the legality of the terminal device for the third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key. sex.
The method according to claim 1, wherein the user context of the terminal device includes the first key, and the blockchain system determines the user context of the terminal device according to the first identifier include:

The blockchain system determines the first key according to the first identifier.
The method according to claim 2, wherein the blockchain system corresponds to the application server according to the user context of the terminal device and the parameters or messages encrypted by the terminal device using the first key. third-party applications to verify the legitimacy of the terminal device, including:

The blockchain system uses the first key to decrypt the parameters and/or messages encrypted by the terminal device using the first key to obtain the decrypted parameters and/or messages;

When the decrypted parameter conforms to the pre-configured parameter format or value used for interaction between the terminal device and the blockchain system, and/or the decrypted message conforms to the pre-configured terminal device and the The message format used interactively by the blockchain system that determines that the terminal device is legitimate.
The method according to any one of claims 1-3, wherein the first identifier includes at least one of a global blockchain identifier of the terminal device or a key identifier KID corresponding to the second key, The second key is a key generated after successful authentication between the terminal device and the authentication service function network element.
The method according to any one of claims 1-4, wherein the first key is derived from a second key, and the second key is the terminal device and the authentication service function network The key generated after successful authentication between elements.
The method according to any one of claims 1-5, further comprising:

After the blockchain system verifies that the terminal device is legal, the blockchain system obtains a third key, where the third key is a key used for secure communication between the terminal device and the application server ;

The blockchain system sends the third key to the application server.
The method according to claim 6, wherein the user context of the terminal device includes the first key; and the blockchain system obtains the third key, comprising:

The blockchain system generates the third key, wherein the input parameters for generating the third key include the first key.
The method according to claim 6, wherein obtaining the third key by the blockchain system comprises:

The blockchain system sends a second message to the authentication service function network element, where the second message includes the first identifier, where the first identifier is used to determine the user context of the terminal device, and the user context of the terminal device. The user context includes the first key or the second key, and the second key is a key generated after successful authentication between the terminal device and the authentication service function network element;

The blockchain system receives the third key from the authentication service function network element, wherein the input parameter for generating the third key includes the first key or the second key.
The method according to claim 7 or 8, wherein the input parameters for generating the third key further include a second identifier and/or a decrypted parameter, wherein the second identifier is the the application identifier of the third-party application, and the decrypted parameter is a parameter obtained by using the first key to decrypt the parameter encrypted by the terminal device using the first key.
The method according to claim 8, wherein before the blockchain system receives the first message from the application server, the method further comprises:

The blockchain system receives a third message from the authentication service function network element, the third message requests to store the first key, the first identifier and the address of the authentication service function network element in the in the user context of the terminal device;

The blockchain system stores the first key, the first identifier and the address of the authentication service function network element in the user context of the terminal device.
The method according to any one of claims 1-10, wherein before the blockchain system receives the first message from the application server, the method further comprises:

the blockchain system receives a third message from the authentication service function network element, the third message requests to store the first key and the first identification in the user context of the terminal device;

The blockchain system stores the first key and the first identification in the user context of the terminal device.
An authentication method, characterized in that the method comprises:

The authentication service function network element obtains the instruction information, the instruction information indicates that the security operation is performed through the blockchain system;

The authentication service function network element sends a third message to the blockchain system according to the indication information, where the third message includes first information and is used to request a user who stores the first information in the terminal device In the context, the first information is the information required by the application server to perform a secure operation through the blockchain system.
The method according to claim 12, wherein the first information comprises a first identifier and an address of the authentication service function network element; or,

The first information includes the first identifier and the first key; or,

The first information includes the first identifier, the first key and the address of the authentication service function network element; wherein,

The first identifier is used to determine the user context of the terminal device, the first key is derived from a second key, and the second key is the relationship between the terminal device and the authentication service function network element. The key generated after the authentication is successful.
The method according to claim 13, wherein the first identifier comprises at least one of a global blockchain identifier of the terminal device or a key identifier KID corresponding to the second key.
The method according to any one of claims 12 to 14, wherein the acquisition of the indication information by the authentication service function network element comprises:

The authentication service function network element receives the indication information from the terminal device; or,

The authentication service function network element receives the indication information from the unified data management network element.
The method according to any one of claims 12-15, wherein after the authentication service function network element sends a third message to the blockchain system according to the indication information, the method further comprises: :

The authentication service function network element receives a second message from the blockchain system, where the second message includes the first identifier;

The authentication service function network element determines the user context of the terminal device according to the first identifier, and the user context of the terminal device includes the first key or the second key; Derived from the second key, the second key is a key generated after successful authentication between the terminal device and the authentication service function network element;

The authentication service function network element generates a third key, where the third key is a key used for the secure communication between the terminal device and the application server, wherein the input parameter for generating the third key is including the first key or the second key;

The authentication service function network element sends the third key to the blockchain system.
The method according to claim 16, wherein the second message further includes a second identifier and/or a parameter encrypted by the terminal device using the first key, and the second identifier corresponds to the application server the application ID of the third-party application;

Correspondingly, the input parameter for generating the third key further includes the second identifier and/or the decrypted parameter, wherein the decrypted parameter is the The parameters obtained by the terminal device after decrypting the parameters encrypted by the first key.
The method according to claim 16 or 17, wherein the second message further includes parameters and/or messages encrypted by the terminal device using the first key; Before the third key, the method further includes:

The authentication service function network element verifies that the terminal device is legal for a third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key .
The method according to claim 18, wherein the user context of the terminal device includes the first key; the authentication service function network element is based on the user context of the terminal device and the terminal device Using the parameters or messages encrypted by the first key to verify the validity of the terminal device for the third-party application corresponding to the application server, including:

The authentication service function network element uses the first key to decrypt the parameters and/or messages encrypted by the terminal device using the first key to obtain the decrypted parameters and/or messages;

When the decrypted parameter conforms to the pre-configured parameter format or value used by the terminal device and the authentication service function network element for interaction, and/or the decrypted message conforms to the pre-configured terminal device and the The message format used by the authentication service function network element for interaction, and the authentication service function network element determines that the terminal device is legal.
The method according to any one of claims 12 to 19, characterized in that, performing the secure operation through the blockchain system comprises obtaining, through the blockchain system, the information of the communication between the application server and the terminal device. security parameters.
The method according to claim 20, wherein the performing the security operation through the blockchain system further comprises verifying the legitimacy of the terminal device for a third-party application corresponding to the application server through the blockchain system .
A communication device, characterized in that the communication device comprises: a processing module and a transceiver module;

The transceiver module is configured to receive a first message from an application server, where the first message includes a first identifier and parameters and/or messages encrypted by the terminal device using the first key;

the processing module, configured to determine the user context of the terminal device according to the first identifier;

The processing module is further configured to authenticate the terminal device for a third-party application corresponding to the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key legitimacy.
The communication apparatus according to claim 22, wherein the user context of the terminal device includes the first key, and the processing module is configured to determine the user context of the terminal device according to the first identifier. The user context includes: determining the first key according to the first identifier.
The communication apparatus according to claim 23, wherein the processing module is configured to, according to the user context of the terminal device and the parameters or messages encrypted by the terminal device using the first key, provide the application for the application Verifying the legitimacy of the terminal device by a third-party application corresponding to the server includes: decrypting the parameters and/or messages encrypted by the terminal device using the first key using the first key, and obtaining the decrypted parameter and/or message; when the decrypted parameter conforms to the pre-configured parameter format or value used by the terminal device and the blockchain system for interaction, and/or the decrypted message conforms to the pre-configured terminal The message format used in the interaction between the device and the blockchain system determines that the terminal device is legal.
The communication device according to any one of claims 22-24, wherein the first identifier includes at least one of a global blockchain identifier of the terminal device or a key identifier KID corresponding to the second key , the second key is a key generated after successful authentication between the terminal device and the authentication service function network element.
The communication device according to any one of claims 22-25, wherein the first key is derived from a second key, and the second key is the terminal device and the authentication service function The key generated after successful authentication between network elements.
The communication device according to any one of claims 22 to 26, wherein the processing module is further configured to obtain a third key after the communication device verifies that the terminal device is legal, the third key is used for a key for secure communication between the terminal device and the application server;

The transceiver module is further configured to send the third key to the application server.
The communication apparatus according to claim 27, wherein the user context of the terminal device includes the first key; the processing module, configured to acquire the third key, comprises: generating the first key A third key, wherein the input parameter for generating the third key includes the first key.
The communication device according to claim 27, wherein the processing module, configured to obtain the third key, comprises: sending a second message to an authentication service function network element through the transceiver module, the first The second message includes the first identifier, where the first identifier is used to determine the user context of the terminal device, the user context of the terminal device includes the first key or the second key, the second key The key is the key generated after the authentication between the terminal device and the authentication service function network element is successful; the third key is received from the authentication service function network element through the transceiver module, wherein the generation of the The input parameter of the third key includes the first key or the second key.
The communication device according to claim 28 or 29, wherein the input parameter for generating the third key further includes a second identifier and/or a decrypted parameter, wherein the second identifier is The application identifier of the third-party application, and the decrypted parameter is a parameter obtained by using the first key to decrypt the parameter encrypted by the terminal device using the first key.
The communication device according to claim 29, wherein the transceiver module is further configured to receive a third message from an authentication service function network element before receiving the first message from the application server, the third message requesting to store the first key, the first identifier and the address of the authentication service function network element in the user context of the terminal device;

The processing module is further configured to store the first key, the first identifier and the address of the authentication service function network element in the user context of the terminal device.
The communication device according to any one of claims 22-31, wherein the transceiver module is further configured to receive a third message from an authentication service function network element before receiving the first message from the application server, the third message requests to store the first key and the first identification in the user context of the terminal device;

The processing module is further configured to store the first key and the first identifier in the user context of the terminal device.
An authentication service function network element, characterized in that the authentication service function network element comprises: a processing module and a transceiver module;

The processing module is used to obtain instruction information, the instruction information indicates that the security operation is performed through the blockchain system;

The transceiver module is configured to send a third message to the blockchain system according to the indication information, where the third message includes first information and is used to request a user who stores the first information in the terminal device In the context, the first information is the information required by the application server to perform a secure operation through the blockchain system.
The authentication service function network element according to claim 33, wherein the first information comprises a first identifier and an address of the authentication service function network element; or,

The first information includes the first identifier and the first key; or,

The first information includes the first identifier, the first key and the address of the authentication service function network element; wherein,

The first identifier is used to determine the user context of the terminal device, the first key is derived from a second key, and the second key is the relationship between the terminal device and the authentication service function network element. The key generated after the authentication is successful.
The authentication service function network element according to claim 34, wherein the first identifier comprises at least one of a global blockchain identifier of the terminal device or a key identifier KID corresponding to the second key .
The authentication service function network element according to any one of claims 33-35, wherein the processing module, configured to acquire the indication information, comprises: being configured to receive all the information from the terminal device through the transceiver module. the indication information; or, for receiving the indication information from the unified data management network element through the transceiver module.
The authentication service function network element according to any one of claims 33-36, wherein the transceiver module is further configured to receive a message from the block chain after sending the third message to the block chain system a second message of the chain system, the second message includes the first identifier;

The processing module is further configured to determine the user context of the terminal device according to the first identifier, where the user context of the terminal device includes a first key or a second key; the first key is Derived from the second key, the second key is a key generated after successful authentication between the terminal device and the authentication service function network element;

The processing module is further configured to generate a third key, where the third key is a key used for secure communication between the terminal device and the application server, wherein an input parameter for generating the third key including the first key or the second key;

The transceiver module is further configured to send the third key to the blockchain system.
The authentication service function network element according to claim 37, wherein the second message further includes a second identifier and/or a parameter encrypted by the terminal device using the first key, and the second identifier is the the application identifier of the third-party application corresponding to the application server;

Correspondingly, the input parameter for generating the third key further includes the second identifier and/or the decrypted parameter, wherein the decrypted parameter is the The parameters obtained by the terminal device after decrypting the parameters encrypted by the first key.
The authentication service function network element according to claim 37 or 38, wherein the second message further includes parameters and/or messages encrypted by the terminal device using the first key;

The processing module is further configured to, before generating the third key, provide the application server according to the user context of the terminal device and the parameters and/or messages encrypted by the terminal device using the first key The corresponding third-party application verifies that the terminal device is legal.
The authentication service function network element according to claim 39, wherein the user context of the terminal device includes the first key; the processing module is configured to, according to the user context of the terminal device, and The terminal device uses the parameters or messages encrypted by the first key to verify the validity of the terminal device for a third-party application corresponding to the application server, including: using the first key to use the first key for the terminal device. Decrypt the parameters and/or messages encrypted with a key to obtain the decrypted parameters and/or messages; when the decrypted parameters conform to the pre-configured parameters used by the terminal device and the authentication service function network element interactively The format or value, and/or the decrypted message conforms to the pre-configured message format used by the terminal device and the authentication service function network element for interaction, and it is determined that the terminal device is legitimate.
The authentication service function network element according to any one of claims 33-40, wherein the performing the security operation through the blockchain system comprises obtaining the application server and the terminal device through the blockchain system Security parameters for communication between them.
The authentication service function network element according to claim 41, wherein the performing the security operation through the blockchain system further comprises verifying the terminal for a third-party application corresponding to the application server through the blockchain system Legality of the device.
A communication system, characterized in that the communication system includes an application server and a blockchain system;

the application server, configured to send a first message to the blockchain system, where the first message includes a first identifier and parameters and/or messages encrypted by the terminal device using the first key;

The blockchain system is configured to receive the first message from the application server, and determine the user context of the terminal device according to the first identifier, and then determine the user context of the terminal device and the terminal device according to the user context of the terminal device. Use the parameters and/or messages encrypted with the first key to verify the legitimacy of the terminal device for a third-party application corresponding to the application server.
A communication system, characterized in that the communication system includes a blockchain system and an authentication service function network element;

The authentication service function network element is used to obtain instruction information, and the instruction information indicates that a secure operation is performed through the blockchain system;

The authentication service function network element is further configured to send a third message to the blockchain system according to the indication information, where the third message includes first information and is used to request that the first information be stored in the blockchain system. In the user context of the terminal device, the first information is the information required by the application server to perform a secure operation through the blockchain system;

The blockchain system is configured to receive the third message from the authentication service function network element, and store the first information in the user context of the terminal device.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores an instruction, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1-11 , or, performing the method of any one of claims 12-21.
A computer program product comprising instructions, which, when run on a computer, causes the computer to perform the method of any one of claims 1-11, or, to perform any of the claims 12-21 one of the methods described.