WO2022116768A1 - 终端认证方法、装置和存储介质 - Google Patents

终端认证方法、装置和存储介质 Download PDF

Info

Publication number
WO2022116768A1
WO2022116768A1 PCT/CN2021/128423 CN2021128423W WO2022116768A1 WO 2022116768 A1 WO2022116768 A1 WO 2022116768A1 CN 2021128423 W CN2021128423 W CN 2021128423W WO 2022116768 A1 WO2022116768 A1 WO 2022116768A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
service
terminal
fusion
result
Prior art date
Application number
PCT/CN2021/128423
Other languages
English (en)
French (fr)
Inventor
黄铖斌
方燕萍
王锦华
薛伟佳
张欣
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Publication of WO2022116768A1 publication Critical patent/WO2022116768A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data

Definitions

  • the present disclosure relates to the technical field of network security, and in particular, to a terminal authentication method, device and storage medium.
  • the 5G core network will perform network layer identity authentication on the device.
  • SMF Session Management Function, session management function
  • UPF User Plane Function, user plane function
  • An object of the present disclosure is to improve service access efficiency.
  • a terminal authentication method including: AUSF (Authentication Server Function, authentication server function), according to a network layer identity authentication request from the terminal, to UDM (Unified Data Management, unified data management) ) query subscription status information; the UDM feeds back the user's service subscription information to the AUSF; the AUSF determines the result of the fusion authentication between the user's network layer and the service layer according to the service subscription information, and feeds back the network layer identity authentication result to the terminal, wherein the fusion authentication The result includes the identification of the service for which the fusion authentication has been completed; the AUSF synchronizes the result of the fusion authentication to the SMF, so that the SMF initiates and establishes a service channel of the corresponding service according to the result of the fusion authentication.
  • AUSF Authentication Server Function, authentication server function
  • the terminal authentication method further includes: the SMF receives a service request of the terminal; if it is determined that the corresponding service fusion authentication is passed according to the result of the fusion authentication, sending a service channel establishment instruction to the UPF; the UPF establishes a service channel for forwarding the terminal The business channel of the business flow corresponding to the business.
  • the terminal authentication method further includes: in the case that the SMF determines that the result of the fusion authentication does not include the identifier of the corresponding service, initiating service layer authentication for the service corresponding to the terminal.
  • the service subscription information includes a fusion authentication activation identifier; when the user activates the fusion authentication, the service subscription information further includes an identifier of the service for which the user activates the fusion authentication.
  • the AUSF determining the service authentication result according to the feedback information includes: the AUSF determines whether the user activates the converged authentication according to the converged authentication activation identifier; if it is determined that the user activates the converged authentication, determining according to the identifier of the service for which the user activates the converged authentication The identification of the service that has completed the authentication of the service layer, and the result of the fusion authentication is generated.
  • a terminal authentication system comprising: an AUSF configured to query a UDM for subscription status information according to a network layer identity authentication request from a terminal; and to determine a user's network according to service subscription information
  • the result of the fusion authentication between the layer and the service layer, and the network layer identity authentication result is fed back to the terminal.
  • the result of the fusion authentication includes the identification of the service that has completed the fusion authentication;
  • AUSF synchronizes the result of the fusion authentication to the SMF, so that the SMF can perform the fusion authentication according to the fusion authentication.
  • the result of the authentication is to initiate the establishment of a service channel corresponding to the service; the unified data management UDM is configured to feed back the user's service subscription information to the AUSF.
  • the terminal authentication system further includes: SMF, configured to receive a service request of the terminal; in the case that the corresponding service fusion authentication is determined to pass according to the result of fusion authentication, send a service channel establishment instruction to UPF; UPF, It is configured to establish a service channel for forwarding the service flow of the corresponding service of the terminal.
  • the SMF is further configured to initiate a service layer authentication of the corresponding service of the terminal in the case of determining that the result of the fusion authentication does not include the identifier of the corresponding service.
  • a terminal authentication system comprising: a memory; and a processor coupled to the memory, the processor being configured to perform any one of the above terminal authentications based on instructions stored in the memory method.
  • a computer-readable storage medium having computer program instructions stored thereon, and when the instructions are executed by a processor, implement the steps of any one of the above terminal authentication methods.
  • FIG. 1 is a flowchart of some embodiments of the disclosed terminal authentication method.
  • FIG. 2 is a flowchart of other embodiments of the terminal authentication method of the present disclosure.
  • FIG. 3 is a schematic diagram of some embodiments of the disclosed terminal authentication system.
  • FIG. 4 is a schematic diagram of other embodiments of the terminal authentication system of the present disclosure.
  • FIG. 5 is a schematic diagram of further embodiments of the terminal authentication system of the present disclosure.
  • FIG. 6 is a schematic diagram of further embodiments of the terminal authentication system of the present disclosure.
  • FIG. 1 The flowchart of some embodiments of the terminal authentication method of the present disclosure is shown in FIG. 1 .
  • the AUSF queries the UDM for subscription status information according to the network layer identity authentication request from the terminal.
  • the UDM pre-stores an identifier indicating whether the user to which the terminal belongs has activated convergent authentication. For a user who has activated the converged authentication function, the UDM also stores the service identifier of the converged authentication service activated by the user.
  • the UDM feeds back the service subscription information of the user to the AUSF.
  • the service subscription information includes a fusion authentication activation identifier; when the user activates the fusion authentication, the service subscription information further includes an identifier of the service for which the user activates the fusion authentication.
  • the UDM performs and feeds back information according to the network layer identity authentication operation in the related art.
  • the AUSF determines the result of the fusion authentication between the user's network layer and the service layer according to the service subscription information, and feeds back the network layer identity authentication result to the terminal, where the fusion authentication result includes the identifier of the service for which fusion authentication has been completed.
  • the network layer identity authentication result may be generated according to the network layer authentication process in the related art.
  • step 104 the AUSF synchronizes the result of the fusion authentication to the SMF, so that the SMF initiates the establishment of a service channel of the corresponding service for the user according to the result of the fusion authentication.
  • the identity authentication of the service layer can be synchronously completed when the identity authentication of the network layer is performed on the terminal, so that the secondary authentication of the terminal is not required in the subsequent service flow verification of the terminal, the authentication operation steps are reduced, and the service access is improved. efficiency.
  • FIG. 2 A flowchart of other embodiments of the terminal authentication method of the present disclosure is shown in FIG. 2 .
  • the AUSF receives a network layer identity authentication request from a terminal.
  • the AUSF queries the UDM for subscription status information.
  • the user can activate the converged authentication function in advance, and specify the service for which the converged authentication function is activated, so that the UDM can update the user's corresponding convergent authentication activation ID, and when the converged authentication function is activated, update the service ID of the converged service. .
  • step 203 the UDM feeds back the service subscription information of the user to the AUSF.
  • the service subscription information includes a fusion authentication activation identifier; when the user activates the fusion authentication, the service subscription information further includes an identifier of the service for which the user activates the fusion authentication.
  • step 204 the AUSF determines whether the user activates the converged authentication according to the converged authentication provisioning identifier. If it is determined that the user has activated the converged authentication, step 205 is executed; if it is determined that the user has not activated the converged authentication, the process of performing the network layer user identity authentication in the related art is executed.
  • the AUSF determines the identifier of the service for which the service layer authentication is completed according to the identifier of the service for which the user has opened the fusion authentication, and generates a result of the fusion authentication.
  • the AUSF feeds back the network layer identity authentication result to the terminal, and synchronizes the fusion authentication result to the SMF.
  • the terminal can initiate a service request according to the needs according to the network layer identity authentication result of the AUSF, based on the judgment logic in the related art.
  • the SMF receives the service request of the terminal.
  • the terminal may send the traffic flow to the corresponding UPF.
  • the UPF determines that the service channel corresponding to the service flow has not been established, it sends a service request to the SMF, and the service request may include a terminal identifier (user identifier) and a service identifier.
  • step 208 the SMF determines that the corresponding service fusion authentication is passed according to the result of the fusion authentication. If the authentication is passed, go to step 210; if the authentication is not passed, it means that according to the information stored in the UDM, the user has not activated the converged authentication, or the user has not activated the converged authentication for the service, and step 209 needs to be executed.
  • step 209 service layer authentication of the service corresponding to the terminal is initiated. In some embodiments, it can be performed based on the business layer authentication process in the related art.
  • step 210 a service channel establishment instruction is sent to the UPF.
  • step 211 the UPF establishes a service channel for forwarding the service flow of the corresponding service of the terminal.
  • the integrated authentication of the network layer and the service layer is completed through one authentication, which improves the authentication efficiency and simplifies the network information of service access. Make the process, reduce the network burden, and improve the efficiency of business access.
  • FIG. 3 A schematic diagram of some embodiments of the terminal authentication system of the present disclosure is shown in FIG. 3 .
  • the AUSF 301 can query the UDM for subscription status information according to the network layer identity authentication request from the terminal.
  • the UDM 302 can feed back the service subscription information of the user to the AUSF.
  • the AUSF 301 determines the result of the fusion authentication between the user's network layer and the service layer according to the service subscription information, and feeds back the network layer identity authentication result to the terminal, wherein the fusion authentication result includes the identification of the service that has completed fusion authentication.
  • the AUSF synchronizes the result of the fusion authentication to the SMF, so that the SMF initiates and establishes a service channel for the corresponding service according to the result of the fusion authentication.
  • the SMF can obtain the service-layer authentication result after the AUSF performs the network-layer authentication, so that after receiving the service request, there is no need to perform further service-layer authentication for the verified service, which simplifies the service authentication process and improves the Service access efficiency.
  • the terminal authentication system may further include an SMF 303, which can receive a service request from the terminal, and send a message to the UPF when it is determined that the fusion authentication of the corresponding service is passed according to the fusion authentication result. Service channel establishment command.
  • the SMF can also initiate service layer authentication for the service corresponding to the terminal in the case that it is determined that the result of the fusion authentication does not include the identifier of the corresponding service.
  • the UPF 304 can establish a service channel for forwarding the service flow of the corresponding service of the terminal according to the instruction of the SMF.
  • the SMF when a user initiates a service request for a service for the first time, the SMF can complete the authentication of the service layer based on the previous network layer authentication process without performing the authentication process, which improves the efficiency of the UPF in establishing the service channel.
  • FIG. 4 A schematic diagram of network operation of some embodiments of the terminal authentication system of the present disclosure is shown in FIG. 4 .
  • UE 401 initiates network layer authentication to AUSF 402 through the network layer authentication request in 1.
  • the AUSF 402 randomly queries the UDM 403 through 2, and the query information may include the user ID.
  • the UDM 403 stores the fusion authentication attribute (that is, identifying whether the user has activated the fusion authentication function) and the service of the fusion authentication function activated by the user.
  • the UDM 403 feeds back the information queried for the UE 402 to the AUSF 402 through 4.
  • AUSF 402 confirms the authentication result, sends the network authentication result to UE 401 through 6, and synchronizes the service authentication result to SMF 404 through 5.
  • the service flow reaches UPF 405 through 8.
  • the UPF 405 determines that a service channel has not been established for the service of the user, it will initiate a service request to the SMF 404.
  • the SMF 404 confirms that the authentication for the service has been completed in the above 5 through the operation in 7, and then feeds back to the UPF 405 to establish a service channel for the service flow, and completes the establishment of the channel with the DN (Data Network, data network) 406.
  • DN Data Network, data network
  • Such a system does not need to improve the terminal and service server.
  • the integrated authentication of the network layer and the service layer is completed through one authentication, which improves the authentication efficiency and simplifies the network signaling process for service access. , reduce network burden and improve service access efficiency.
  • the terminal authentication system includes a memory 501 and a processor 502.
  • the memory 501 may be a magnetic disk, a flash memory or any other non-volatile storage medium.
  • the memory is used to store the instructions in the corresponding embodiments of the terminal authentication method above.
  • the processor 502 is coupled to the memory 501 and may be implemented as one or more integrated circuits, such as a microprocessor or microcontroller.
  • the processor 502 is configured to execute the instructions stored in the memory, which can reduce authentication operation steps and improve service access efficiency.
  • the terminal authentication system 600 includes a memory 601 and a processor 602 .
  • Processor 602 is coupled to memory 601 through BUS bus 603 .
  • the terminal authentication system 600 can also be connected to an external storage device 605 through a storage interface 604 for recalling external data, and can also be connected to a network or another computer system (not shown) through a network interface 606 . It will not be described in detail here.
  • the data instructions are stored in the memory, and the above-mentioned instructions are processed by the processor, which can reduce the authentication operation steps and improve the service access efficiency.
  • a computer-readable storage medium stores computer program instructions thereon, and when the instructions are executed by a processor, implements the steps of the method in the corresponding embodiment of the terminal authentication method.
  • embodiments of the present disclosure may be provided as a method, apparatus, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein .
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flows of the flowcharts and/or the block or blocks of the block diagrams.
  • the methods and apparatus of the present disclosure may be implemented in many ways.
  • the methods and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware.
  • the above-described order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above unless specifically stated otherwise.
  • the present disclosure can also be implemented as programs recorded in a recording medium, the programs including machine-readable instructions for implementing methods according to the present disclosure.
  • the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

Abstract

本公开提出一种终端认证方法、装置和存储介质，涉及网络安全技术领域。本公开的一种终端认证方法，包括：认证服务器功能AUSF根据来自终端的网络层身份认证请求，向统一数据管理UDM查询订阅状态信息；UDM向AUSF反馈用户的业务订阅信息；AUSF根据业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向终端反馈网络层身份认证结果；AUSF将融合认证的结果同步至会话管理功能SMF，以便SMF根据融合认证的结果发起建立对应业务的业务通道。通过这样的方法，能够在对终端进行网络层身份认证时，同步完成业务层的身份认证，从而在后续终端业务流验证时无需对终端进行二次验证，减少认证操作步骤，提高了业务接入效率。

Description

终端认证方法、装置和存储介质
相关申请的交叉引用
本申请是以CN申请号为CN202011400675.7，申请日为2020年12月4日的申请为基础，并主张其优先权，该CN申请的公开内容在此作为整体引入本申请中。
技术领域
本公开涉及网络安全技术领域，特别是一种终端认证方法、装置和存储介质。
背景技术
在5G(5th generation mobile network，第五代移动通信技术)标准中，泛智能设备在接入5G网络时，5G核心网会对设备进行网络层身份认证。泛智能设备接入网络后，当发起业务流请求时，SMF(Session Management Function，会话管理功能)/UPF(User Plane Function，用户面功能)会强制要求设备发起业务层认证。当业务层认证完成后，用户能够得到对应业务的服务。
发明内容
本公开的一个目的在于提高业务接入效率。
根据本公开的一些实施例的一个方面，提出一种终端认证方法，包括：AUSF(Authentication Server Function，认证服务器功能)根据来自终端的网络层身份认证请求，向UDM(Unified Data Management，统一数据管理)查询订阅状态信息；UDM向AUSF反馈用户的业务订阅信息；AUSF根据业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向终端反馈网络层身份认证结果，其中，融合认证的结果中包括完成融合认证的业务的标识；AUSF将融合认证的结果同步至SMF，以便SMF根据融合认证的结果发起建立对应业务的业务通道。
在一些实施例中，终端认证方法还包括：SMF接收终端的业务请求；在根据融合认证的结果确定对应的业务融合认证通过的情况下，向UPF发送业务通道建立指令；UPF建立用于转发终端的对应业务的业务流的业务通道。
在一些实施例中，终端认证方法还包括：SMF在确定融合认证的结果中不包括对应业务的标识的情况下，发起对终端对应业务的业务层认证。
在一些实施例中，业务订阅信息包括融合认证开通标识；在用户开通融合认证的情况下，业务订阅信息还包括用户开通融合认证的业务的标识。
在一些实施例中，AUSF根据从反馈信息确定业务认证结果包括：AUSF根据融合认证开通标识确定用户是否开通融合认证；在确定用户开通融合认证的情况下，根据用户开通融合认证的业务的标识确定完成业务层认证的业务的标识，生成融合认证的结果。
根据本公开的一些实施例的一个方面，提出一种终端认证系统，包括：AUSF，被配置为根据来自终端的网络层身份认证请求，向UDM查询订阅状态信息；根据业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向终端反馈网络层身份认证结果，其中，融合认证的结果中包括完成融合认证的业务的标识；AUSF将融合认证的结果同步至SMF，以便SMF根据融合认证的结果为发起建立对应业务的业务通道；统一数据管理UDM，被配置为向AUSF反馈用户的业务订阅信息。
在一些实施例中，终端认证系统还包括：SMF，被配置为接收终端的业务请求；在根据融合认证的结果确定对应的业务融合认证通过的情况下，向UPF发送业务通道建立指令；UPF，被配置为建立用于转发终端的对应业务的业务流的业务通道。
在一些实施例中，SMF还被配置为在确定融合认证的结果中不包括对应业务的标识的情况下，发起对终端对应业务的业务层认证。
根据本公开的一些实施例的一个方面，提出一种终端认证系统，包括：存储器；以及耦接至存储器的处理器，处理器被配置为基于存储在存储器的指令执行上文中任意一种终端认证方法。
根据本公开的一些实施例的一个方面，提出一种计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现上文中任意一种终端认证方法的步骤。
附图说明
此处所说明的附图用来提供对本公开的进一步理解，构成本公开的一部分，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1为本公开的终端认证方法的一些实施例的流程图。
图2为本公开的终端认证方法的另一些实施例的流程图。
图3为本公开的终端认证系统的一些实施例的示意图。
图4为本公开的终端认证系统的另一些实施例的示意图。
图5为本公开的终端认证系统的又一些实施例的示意图。
图6为本公开的终端认证系统的再一些实施例的示意图。
具体实施方式
下面通过附图和实施例，对本公开的技术方案做进一步的详细描述。
本公开的终端认证方法的一些实施例的流程图如图1所示。
在步骤101中，AUSF根据来自终端的网络层身份认证请求，向UDM查询订阅状态信息。在一些实施例中，UDM预存有指示终端所属的用户是否开通了融合认证的标识。针对开通了融合认证功能的用户，UDM还存储有用户开通的融合认证业务的业务标识。
在步骤102中，UDM向AUSF反馈用户的业务订阅信息。在一些实施例中，业务订阅信息包括融合认证开通标识；在用户开通融合认证的情况下，业务订阅信息还包括用户开通融合认证的业务的标识。在一些实施例中，针对未开通融合认证功能的用户，UDM按照相关技术中网络层身份认证操作执行和反馈信息。
在步骤103中，AUSF根据业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向终端反馈网络层身份认证结果，融合认证的结果中包括完成融合认证的业务的标识。在一些实施例中，网络层身份认证结果可以按照相关技术中网络层认证流程生成。
在步骤104中，AUSF将融合认证的结果同步至SMF，以便SMF根据融合认证的结果为用户发起建立对应业务的业务通道。
通过这样的方法，能够在对终端进行网络层身份认证时，同步完成业务层的身份认证，从而在后续终端业务流验证时无需对终端进行二次验证，减少认证操作步骤，提高了业务接入效率。
本公开的终端认证方法的另一些实施例的流程图如图2所示。
在步骤201中，AUSF接收来自终端的网络层身份认证请求。
在步骤202中，AUSF向UDM查询订阅状态信息。在一些实施例中，用户可以预先开通融合认证功能，并指定开通融合认证功能的业务，以便UDM更新用户对应的融合认证开通标识，以及开通了融合认证功能时，更新开通融合功能的业务的标识。
在步骤203中，UDM向AUSF反馈用户的业务订阅信息。
在一些实施例中，业务订阅信息包括融合认证开通标识；在用户开通融合认证的情况下，业务订阅信息还包括用户开通融合认证的业务的标识。
在步骤204中，AUSF根据融合认证开通标识确定用户是否开通融合认证。若确定用户开通了融合认证，则执行步骤205；若确定用户未开通融合认证，则执行相关技术中执行网络层用户身份认证的流程。
在步骤205中，AUSF根据用户开通融合认证的业务的标识确定完成业务层认证的业务的标识，生成融合认证的结果。
在步骤206中，AUSF向终端反馈网络层身份认证结果，并将融合认证的结果同步至SMF。终端可以根据AUSF的网络层身份认证结果，基于相关技术中的判断逻辑、根据需求发起业务请求。
在步骤207中，当用户发起业务请求后，SMF接收终端的业务请求。在一些实施例中，终端可以向对应的UPF发送业务流。当UPF确定未建立对应业务流的业务通道的情况下，向SMF发送业务请求，业务请求中可以包括终端标识(用户标识)和业务标识。
在步骤208中，SMF根据融合认证的结果判断对应的业务融合认证通过。若认证通过，则执行步骤210；若未认证通过，即说明根据UDM中存储的信息，用户未开通融合认证，或用户对该业务未开通融合认证，需执行步骤209。
在步骤209中，发起对终端对应业务的业务层认证。在一些实施例中，可以基于相关技术中业务层认证流程执行。
在步骤210中，向UPF发送业务通道建立指令。
在步骤211中，UPF建立用于转发终端的对应业务的业务流的业务通道。
通过这样的方法，无需对终端、业务服务器进行改进，在终端、业务侧无感知的情况下，通过一次认证完成网络层、业务层的融合认证，提高认证效率，简化了业务接入的网络信令流程，降低网络负担，提高业务接入效率。
本公开的终端认证系统的一些实施例的示意图如图3所示。
AUSF 301能够根据来自终端的网络层身份认证请求，向UDM查询订阅状态信息。UDM 302能够向AUSF反馈用户的业务订阅信息。
AUSF 301根据业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向终端反馈网络层身份认证结果，其中，融合认证的结果中包括完成融合认证的业务 的标识。AUSF将融合认证的结果同步至SMF，以便SMF根据融合认证的结果为发起建立对应业务的业务通道。
这样的系统中，SMF能够在AUSF执行网络层认证后即获得业务层认证结果，从而在接收到业务请求后无需针对已验证通过的业务执行进一步的业务层认证，简化了业务认证流程，提高了业务接入效率。
在一些实施例中，如图3所述，终端认证系统还可以包括SMF 303，能够接收来自终端的业务请求，并在根据融合认证的结果确定对应业务的融合认证通过的情况下，向UPF发送业务通道建立指令。在一些实施例中，SMF还能够在确定融合认证的结果中不包括对应业务的标识的情况下，发起对终端对应业务的业务层认证。
UPF 304能够根据SMF的指令建立用于转发终端的对应业务的业务流的业务通道。
这样的系统中，当用户首次发起对某业务的业务请求时，SMF能够无需再执行认证过程，基于在先的网络层认证流程完成对业务层的认证，提高了UPF建立业务通道的效率。
本公开的终端认证系统的一些实施例的网络运行示意图如图4所示。
UE 401通过①中的网络层认证请求，向AUSF 402发起网络层认证。AUSF 402随机通过②向UDM 403查询，查询信息中可以包括用户标识。UDM 403中存储有融合认证属性(即标识用户是否开通了融合认证功能)以及用户开通的融合认证功能的业务。UDM 403通过④将针对该UE 402查询到的信息反馈给AUSF 402。AUSF 402确认认证结果，将网络认证结果通过⑥发送给UE 401，并将业务认证结果通过⑤同步给SMF 404。
后续当用户需要发起业务请求时，业务流通过⑧到达UPF 405。UPF 405在确定尚未对用户的该业务建立业务通道时，会将向SMF 404发起业务请求。
SMF 404通过⑦中的操作确认在上述⑤中已经对该业务完成了认证，进而向UPF 405反馈建立业务流的业务通道，完成与DN(Data Network，数据网络)406之间的通道建立。
这样的系统无需对终端、业务服务器进行改进，在终端、业务侧无感知的情况下，通过一次认证完成网络层、业务层的融合认证，提高认证效率，简化了业务接入的网络信令流程，降低网络负担，提高业务接入效率。
本公开终端认证系统的一个实施例的结构示意图如图5所示。终端认证系统包括 存储器501和处理器502。其中：存储器501可以是磁盘、闪存或其它任何非易失性存储介质。存储器用于存储上文中终端认证方法的对应实施例中的指令。处理器502耦接至存储器501，可以作为一个或多个集成电路来实施，例如微处理器或微控制器。该处理器502用于执行存储器中存储的指令，能够减少认证操作步骤，提高了业务接入效率。
在一个实施例中，还可以如图6所示，终端认证系统600包括存储器601和处理器602。处理器602通过BUS总线603耦合至存储器601。该终端认证系统600还可以通过存储接口604连接至外部存储装置605以便调用外部数据，还可以通过网络接口606连接至网络或者另外一台计算机系统(未标出)。此处不再进行详细介绍。
在该实施例中，通过存储器存储数据指令，再通过处理器处理上述指令，能够减少认证操作步骤，提高了业务接入效率。
在另一个实施例中，一种计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现终端认证方法对应实施例中的方法的步骤。本领域内的技术人员应明白，本公开的实施例可提供为方法、装置、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用非瞬时性存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本公开是参照根据本公开实施例的方法、设备(系统)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计 算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
至此，已经详细描述了本公开。为了避免遮蔽本公开的构思，没有描述本领域所公知的一些细节。本领域技术人员根据上面的描述，完全可以明白如何实施这里公开的技术方案。
可能以许多方式来实现本公开的方法以及装置。例如，可通过软件、硬件、固件或者软件、硬件、固件的任何组合来实现本公开的方法以及装置。用于所述方法的步骤的上述顺序仅是为了进行说明，本公开的方法的步骤不限于以上具体描述的顺序，除非以其它方式特别说明。此外，在一些实施例中，还可将本公开实施为记录在记录介质中的程序，这些程序包括用于实现根据本公开的方法的机器可读指令。因而，本公开还覆盖存储用于执行根据本公开的方法的程序的记录介质。
最后应当说明的是：以上实施例仅用以说明本公开的技术方案而非对其限制；尽管参照较佳实施例对本公开进行了详细的说明，所属领域的普通技术人员应当理解：依然可以对本公开的具体实施方式进行修改或者对部分技术特征进行等同替换；而不脱离本公开技术方案的精神，其均应涵盖在本公开请求保护的技术方案范围当中。

Claims (10)

  1. 一种终端认证方法，包括：
    认证服务器功能AUSF根据来自终端的网络层身份认证请求，向统一数据管理UDM查询订阅状态信息；
    所述UDM向所述AUSF反馈用户的业务订阅信息；
    所述AUSF根据所述业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向所述终端反馈网络层身份认证结果，其中，所述融合认证的结果中包括完成融合认证的业务的标识；
    所述AUSF将所述融合认证的结果同步至会话管理功能SMF，以便所述SMF根据所述融合认证的结果发起建立对应业务的业务通道。
  2. 根据权利要求1所述的终端认证方法，还包括：
    所述SMF接收终端的业务请求；
    在根据所述融合认证的结果确定对应的业务融合认证通过的情况下，向用户面功能UPF发送业务通道建立指令；
    所述UPF建立用于转发所述终端的对应业务的业务流的业务通道。
  3. 根据权利要求2所述的终端认证方法，还包括：
    所述SMF在确定所述融合认证的结果中不包括对应业务的标识的情况下，发起对终端对应业务的业务层认证。
  4. 根据权利要求1所述的终端认证方法，其中，
    所述业务订阅信息包括融合认证开通标识；
    在用户开通融合认证的情况下，所述业务订阅信息还包括用户开通融合认证的业务的标识。
  5. 根据权利要求4所述的终端认证方法，其中，所述AUSF根据从反馈信息确定业务认证结果包括：
    所述AUSF根据所述融合认证开通标识确定用户是否开通融合认证；
    在确定用户开通融合认证的情况下，根据用户开通融合认证的业务的标识确定完成业务层认证的业务的标识，生成融合认证的结果。
  6. 一种终端认证系统，包括：
    认证服务器功能AUSF，被配置为根据来自终端的网络层身份认证请求，向UDM查询订阅状态信息；根据所述业务订阅信息确定用户的网络层与业务层的融合认证的结果，并向所述终端反馈网络层身份认证结果，其中，所述融合认证的结果中包括完成融合认证的业务的标识；所述AUSF将所述融合认证的结果同步至会话管理功能SMF，以便所述SMF根据所述融合认证的结果为发起建立对应业务的业务通道；
    统一数据管理UDM，被配置为向所述AUSF反馈用户的业务订阅信息。
  7. 根据权利要求6所述的终端认证系统，还包括：
    SMF，被配置为接收终端的业务请求；在根据所述融合认证的结果确定对应的业务融合认证通过的情况下，向UPF发送业务通道建立指令；
    用户面功能UPF，被配置为建立用于转发所述终端的对应业务的业务流的业务通道。
  8. 根据权利要求7所述的终端认证系统，其中，
    所述SMF，还被配置为在确定所述融合认证的结果中不包括对应业务的标识的情况下，发起对终端对应业务的业务层认证。
  9. 一种终端认证系统，包括：
    存储器；以及
    耦接至所述存储器的处理器，所述处理器被配置为基于存储在所述存储器的指令执行如权利要求1至5任一项所述的方法。
  10. 一种计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现权利要求1至5任意一项所述的方法的步骤。
PCT/CN2021/128423 2020-12-04 2021-11-03 终端认证方法、装置和存储介质 WO2022116768A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011400675.7A CN114615665A (zh) 2020-12-04 2020-12-04 终端认证方法、装置和存储介质
CN202011400675.7 2020-12-04

Publications (1)

Publication Number Publication Date
WO2022116768A1 true WO2022116768A1 (zh) 2022-06-09

Family

ID=81853800

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/128423 WO2022116768A1 (zh) 2020-12-04 2021-11-03 终端认证方法、装置和存储介质

Country Status (2)

Country Link
CN (1) CN114615665A (zh)
WO (1) WO2022116768A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117255031A (zh) * 2023-11-17 2023-12-19 广东广宇科技发展有限公司 一种基于多重映射的网络通信认证方法

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200053083A1 (en) * 2018-08-13 2020-02-13 Lenovo (Singapore) Pte. Ltd. Network slice authentication
WO2020146211A1 (en) * 2019-01-11 2020-07-16 Idac Holdings, Inc. Methods and apparatuses for slice-specific authentication
WO2020151798A1 (en) * 2019-01-21 2020-07-30 Telefonaktiebolaget Lm Ericsson (Publ) Network slice authentication
US20200267554A1 (en) * 2019-02-15 2020-08-20 Qualcomm Incorporated Systems and Methods of Supporting Device Triggered Re-Authentication of Slice-Specific Secondary Authentication and Authorization
CN111615101A (zh) * 2020-05-26 2020-09-01 捷开通讯(深圳)有限公司 Ims注册方法、装置、存储介质及电子终端
CN111654862A (zh) * 2019-03-04 2020-09-11 华为技术有限公司 终端设备的注册方法及装置
EP3720152A1 (en) * 2019-04-01 2020-10-07 NTT DoCoMo, Inc. Communication network components and methods for initiating a slice-specific authentication and authorization
CN111818516A (zh) * 2019-04-12 2020-10-23 华为技术有限公司 认证方法、装置及设备

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200053083A1 (en) * 2018-08-13 2020-02-13 Lenovo (Singapore) Pte. Ltd. Network slice authentication
WO2020146211A1 (en) * 2019-01-11 2020-07-16 Idac Holdings, Inc. Methods and apparatuses for slice-specific authentication
WO2020151798A1 (en) * 2019-01-21 2020-07-30 Telefonaktiebolaget Lm Ericsson (Publ) Network slice authentication
US20200267554A1 (en) * 2019-02-15 2020-08-20 Qualcomm Incorporated Systems and Methods of Supporting Device Triggered Re-Authentication of Slice-Specific Secondary Authentication and Authorization
CN111654862A (zh) * 2019-03-04 2020-09-11 华为技术有限公司 终端设备的注册方法及装置
EP3720152A1 (en) * 2019-04-01 2020-10-07 NTT DoCoMo, Inc. Communication network components and methods for initiating a slice-specific authentication and authorization
CN111818516A (zh) * 2019-04-12 2020-10-23 华为技术有限公司 认证方法、装置及设备
CN111615101A (zh) * 2020-05-26 2020-09-01 捷开通讯(深圳)有限公司 Ims注册方法、装置、存储介质及电子终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Authentication method negotiation", 3GPP DRAFT; S3-194049, vol. SA WG3, 11 November 2019 (2019-11-11), Reno, US, pages 1 - 4, XP051824365 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117255031A (zh) * 2023-11-17 2023-12-19 广东广宇科技发展有限公司 一种基于多重映射的网络通信认证方法
CN117255031B (zh) * 2023-11-17 2024-02-09 广东广宇科技发展有限公司 一种基于多重映射的网络通信认证方法

Also Published As

Publication number Publication date
CN114615665A (zh) 2022-06-10

Similar Documents

Publication Publication Date Title
JP6769014B2 (ja) セキュリティ保護ネゴシエーション方法およびネットワークエレメント
CN107579827B (zh) 一种基于可信第三方和面部识别技术的电子文书签署方法
EP3609152A1 (en) Internet-of-things authentication system and internet-of-things authentication method
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
US20170161721A1 (en) Method and system for opening account based on euicc
WO2020253736A1 (zh) 一种认证方法、装置及系统
CN112822222B (zh) 登录验证方法、自动登录的验证方法、服务端及客户端
WO2018058982A1 (zh) 控制信息的推送方法、推送装置、智能路由器和服务器
WO2022068219A1 (zh) 虚拟专有拨号网络接入方法、网络侧系统、系统和存储介质
WO2018137713A1 (zh) 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
WO2017000476A1 (zh) 语音验证方法、装置以及系统
JP2007529763A (ja) ネットワークアプリケーションエンティティのためにユーザーの身元確認を得る方法
WO2022116768A1 (zh) 终端认证方法、装置和存储介质
WO2017206524A1 (zh) 电子设备控制方法、终端和控制系统
CN106488453A (zh) 一种portal认证的方法及系统
WO2016165505A1 (zh) 连接控制方法及装置
WO2022170994A1 (zh) Pc5根密钥处理方法、装置、ausf及远程终端
WO2013127190A1 (zh) 一种nas算法的传输方法及装置
CN109714769B (zh) 信息绑定方法、装置、设备及存储介质
CN112822674A (zh) 一种nas消息的解密方法和装置
WO2016138636A1 (zh) 一种节点入网方法、装置及系统
WO2010102483A1 (zh) 一种用户身份注册的方法和系统
CN114598555A (zh) 一种不同平台可切换的播报实现方法及系统
WO2013107402A1 (zh) 一种针对网元重启后释放资源的方法、装置和系统
US9760590B2 (en) Mobile sender controlled data access and data deletion method and system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21899802

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 22/09/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21899802

Country of ref document: EP

Kind code of ref document: A1