WO2023115913A1 - Authentication method and system, and electronic device and computer-readable storage medium - Google Patents

Abstract

Provided in the present disclosure are an authentication method and system, and an electronic device and a computer-readable storage medium. The authentication method comprises: a target access control network element receiving a registration request, which is sent by a target device; the target access control network element determining, according to the registration request, a target user identifier corresponding to the target device, and a target access mode in which the target device accesses a network system; the target access control network element requesting from a target blockchain a target authentication server address, which corresponds to the target access mode, and a target subscription database address, which corresponds to the target user identifier; and according to the target authentication server address, the target access control network element sending to a target authentication server an authentication request carrying the target subscription database address, so that the target authentication server accesses the target subscription database according to the target subscription database address to obtain target subscription data corresponding to the target device, so as to authenticate the target device according to the target subscription data.

Description

Authentication method, system, electronic device and computer-readable storage medium

Cross References to Related Applications

This application is based on the application with CN application number 202111559465.7 and the application date is December 20, 2021, and claims its priority. The disclosure content of this CN application is hereby incorporated into this application as a whole.

technical field

The present disclosure relates to the technical field of communication, and in particular to an authentication method, system, electronic equipment and computer-readable storage medium.

Background technique

In order to ensure that the terminal accessing the network system is normal and safe, the network system usually needs to authenticate the terminal when the terminal accesses. The addressing of Authentication Server Function (AUSF) and Unified Data Management (UDM) in the terminal authentication process of the relevant network is realized based on the service discovery process or static configuration, which needs to be based on the user number segment to address. With the enrichment of mobile services, there are more and more types of access terminals in the existing network. In addition, the future 6G network will realize the ubiquitous connection of air-space-ground integration, mobile operator equipment and satellite operator equipment, etc. The future mobile network will be composed of operators' equipment. Considering the cost of base station construction, there may be only one operator's base station node in the same area. Therefore, a more flexible addressing method is required in the user identity authentication process.

Contents of the invention

The purpose of the present disclosure is to provide an authentication method, system, electronic equipment and computer-readable storage medium.

Other features and advantages of the present disclosure will become apparent from the following detailed description, or in part, be learned by practice of the present disclosure.

According to one aspect of the present disclosure, an authentication method is provided, including: a target access control network element receives a registration request sent by a target device; the target access control network element determines the target User identification, and the target access method for the target device to access the network system; the target access control network element requests the target block chain for the target authentication server address corresponding to the target access method and the target authentication server address corresponding to the target device The address of the target signing database corresponding to the user identification, at least one authentication server address and at least one signing database address are stored in the target block chain, the at least one authentication server includes the target authentication server, and the at least one signing database address includes the target signing database address Address; the target access control network element sends an authentication request carrying the address of the target subscription database to the target authentication server according to the address of the target authentication server, so that the target authentication server accesses the target subscription database according to the address of the target subscription database Obtain target signing data corresponding to the target device, so as to authenticate the target device according to the target signing data.

In some embodiments, the target access control network element requests the target blockchain for the address of the target authentication server corresponding to the target access method and the address of the target subscription database corresponding to the target user identifier, including: The target access control network element sends the target user ID of the target device, the target security token, and the target access mode to the target block chain; the target access control network element receives the target block The address of the target authentication server corresponding to the target access mode and the address of the target subscription database corresponding to the target user identifier returned by the chain.

In some embodiments, the sending by the target access control network element to the target blockchain of the target user ID of the target device, the target security token, and the target access method includes: the target access control The network element sends the target user identifier of the target device, the target security token, and the target access method to the target blockchain through the target blockchain network element.

In some embodiments, the registration request carries a target security token of the target device, and the target security token is generated by a target random number issued by the target operation platform; wherein, the target access control network element Requesting the target authentication server address corresponding to the target access method and the target subscription database address corresponding to the target user identification from the target block chain, including: the target access control network element sends the target block chain Send the target user ID of the target device, the target security token, and the target access method; the target blockchain determines the target authority credential corresponding to the target device according to the target user ID, the The target authority certificate is generated according to the target random number issued by the target operation platform to the target device; if the target blockchain determines that the target authority certificate matches the target security token, then it is determined that the The address of the target authentication server corresponding to the target access method, and the address of the target subscription database corresponding to the target user ID; The target subscription database address corresponding to the target user identifier is returned to the target access control network element.

In some embodiments, the target access control network element sends the target user ID of the target device, the target security token, and the target access method to the target block chain, including: the target The access control network element sends an authentication request carrying the target user ID of the target device, the target security token, and the target access mode to the target blockchain network element; The authentication request sends the target user ID of the target device, the target security token, and the target access method to the target block chain, so as to request the target block chain to match the target access method The corresponding target authentication server address and the target subscription database address corresponding to the target user identifier.

In some embodiments, the target access control network element requests the target blockchain for the address of the target authentication server corresponding to the target access method and the address of the target subscription database corresponding to the target user identifier, including: The target access control network element requests the target block chain for the address of the target authentication server corresponding to the target access method, the address of the target subscription database corresponding to the target user identifier, and the address corresponding to the contract data of the target device target key; wherein, the target access control network element sends an authentication request carrying the address of the target subscription database to the target authentication server according to the address of the target authentication server, so that the target authentication server The address accessing the target subscription database to obtain the target subscription data corresponding to the target device includes: the target access control network element sending an authentication request carrying the address of the target subscription database and the target key to the target authentication The target authentication server corresponding to the server address, so that the target authentication server accesses the target contract database according to the target contract database address to obtain the target contract data corresponding to the target device through the target key.

In some embodiments, before the target access control network element receives the registration request sent by the target device, it further includes: the target operation platform stores the target user identifier and target subscription data corresponding to the target device in the target subscription database, and The target user identification and the target contract database address are stored in the target block chain.

In some embodiments, before the target access control network element receives the registration request sent by the target device, it further includes: the target operation platform signs a card for the target device; The target signing data corresponding to the target device is encrypted to obtain the target signing ciphertext; the target operation platform sends the target user identification corresponding to the target device and the target signing ciphertext to the target signing database for storage; the The target operation platform is to receive the target subscription database address and the target user identifier returned by the target subscription database; the target operation platform sends the target user identifier, the target subscription database address and the target key to the The target block chain, so that the target block chain associates and stores the target user identifier, the target subscription database address, and the target key.

In some embodiments, the method further includes: the target operation platform generates a target random number for the target device; the target operation platform generates a target permission credential according to the target random number; The target authority credential is sent to the target blockchain, so that the target blockchain associates and stores the target authority credential with the target user identifier.

In some embodiments, before the target access control network element receives the registration request sent by the target device, the method includes: the target operation platform acquires multiple access modes, the multiple access modes include the target access method; the target operation platform obtains multiple authentication server addresses of multiple authentication servers, and the multiple authentication server addresses include the address of the target authentication server; To determine the corresponding authentication server address respectively.

According to another aspect of the present disclosure, an authentication device is provided, which is set in a target access control network element, and includes: a receiving module configured to receive a registration request sent by a target device; a determining module configured to The registration request determines the target user identifier corresponding to the target device and the target access method for the target device to access the network system; the request module is configured to request the target block chain for the target corresponding to the target access method An authentication server address and a target subscription database address corresponding to the target user identifier; a sending module configured to send an authentication request carrying the target subscription database address to the target authentication server according to the target authentication server address, so that the target The authentication server accesses the target contract database according to the address of the target contract database to obtain target contract data corresponding to the target device, so as to authenticate the target device according to the target contract data.

According to another aspect of the present disclosure, an authentication system is provided, including: a target block chain, at least one authentication server address and at least one contract database address are stored in the target block chain, and the at least one authentication server includes The target authentication server, wherein the at least one subscription database address includes the target subscription database address; the target access control network element is configured to: receive a registration request sent by the target device; determine the target user identifier of the target device according to the registration request , and the target access method for the target device to access the network system; request the target authentication server address corresponding to the target access method and the target subscription database address corresponding to the target user identification from the target block chain; The address of the target authentication server sends an authentication request carrying the address of the target subscription database to the target authentication server, so that the target authentication server accesses the target subscription database according to the address of the target subscription database to obtain the target contract data corresponding to the target device , so as to authenticate the target device according to the target signing data.

In some embodiments, it also includes: a target operation platform configured to store the target user identifier and target subscription data corresponding to the target device in the target subscription database, and store the target user identifier and the target subscription database address in the target blockchain.

According to yet another aspect of the present disclosure, an electronic device is proposed, the electronic device includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the electronic The device executes the authentication method described in any one of the above electronic devices.

According to yet another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the authentication method described in any one of the above is implemented.

According to still another aspect of the present disclosure, a computer program is proposed, including: instructions, which when executed by a processor cause the processor to execute the aforementioned authentication method.

It is to be understood that both the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description serve to explain the principles of the disclosure. Apparently, the drawings in the following description are only some embodiments of the present disclosure, and those skilled in the art can obtain other drawings according to these drawings without creative efforts.

Fig. 1 shows an authentication method according to related technologies.

Fig. 2 is a flowchart of an authentication method according to some exemplary embodiments.

Fig. 3 shows an authentication system according to some exemplary embodiments.

Fig. 4 is a sequence diagram of an authentication method according to some exemplary embodiments.

Fig. 5 is a sequence diagram of an authentication method according to some exemplary embodiments.

FIG. 6 shows a schematic structural diagram of an electronic device suitable for implementing an embodiment of the present disclosure.

Fig. 7 is a schematic structural diagram of an authentication device according to some embodiments of the present disclosure.

Detailed ways

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The same reference numerals denote the same or similar parts in the drawings, and thus their repeated descriptions will be omitted.

The features, structures, or characteristics described in this disclosure may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided in order to give a thorough understanding of embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other instances, well-known methods, apparatus, implementations, or operations have not been shown or described in detail to avoid obscuring aspects of the present disclosure.

The drawings are only schematic illustrations of the present disclosure, and the same reference numerals in the drawings denote the same or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different network and/or processor means and/or microcontroller means.

The flow charts shown in the drawings are just exemplary illustrations, not necessarily including all contents and steps, and not necessarily executing in the order described. For example, some steps can be decomposed, and some steps can be combined or partly combined, so the actual execution sequence may be changed according to the actual situation.

In this specification, the terms "a", "an", "the", "" and "at least one" are used to indicate the presence of one or more elements/components/etc.; the terms "comprising", "including" and "having " is used in an open, inclusive sense and means that there may be additional elements/components/etc. in addition to the listed elements/components/etc.; the terms "first", "second" and "Third" and so on are used only as marks, not as restrictions on the number of their objects.

In order to be able to understand the above purpose, features and advantages of the present disclosure more clearly, the present disclosure will be further described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, where there is no conflict, the embodiments and Features in the embodiments can be combined with each other.

It should be noted in advance that the naming in this disclosure (such as target access control network element, blockchain network element, etc.) is named based on functional characteristics. protection scope of the present disclosure.

The authentication process in the current mobile network system is shown in Figure 1:

1. The user terminal UE sends a NAS message (a 5G message) to the AMF (Authentication Management Function, authentication management function), including SUCI (Subscription Concealed Identifier, subscription hidden identifier) or 5G-GUTI (5G Globally Unique Temporary UE Identity, 5G globally unique identifier) for registration.

2. AMF sends an authentication request to AUSF (Authentication server function, authentication service function), including SUCI/SUPI (Subscription Permanent Identifier, user permanent identifier) and service network name.

3. AUSF sends an authentication request to UDM (Unified Data Management, unified data management function), including SUCI/SUPI and service network name.

4. The UDM analyzes the SUCI to obtain the SUPI, determines the authentication method, and performs authentication processing.

AUSF and UDM are addressed by AMF based on user identification (that is, user's number prefix or number segment) during authentication.

For the current 5G identity authentication, the routing addressing of UDM/AUSF can only be realized through the user number segment, which lacks flexibility and scalability.

The disclosure provides an authentication method, device, electronic equipment, and computer-readable storage medium. When a target device sends a registration request, it can dynamically match the target device according to the target device's target access method and target user ID. The corresponding target authentication server address and the target subscription database address, so as to authenticate the target device through the target authentication server corresponding to the target authentication server address and the target subscription database address corresponding to the target subscription database address. Through the above authentication method, different authentication servers can be dynamically adapted for devices with different access modes, and the subscription database can be adapted without relying on the user number segment.

Before the mobile network authenticates the device, the target operating platform can be allowed to sign a card for the target device through the following methods.

The target operation platform signs a card for the target device; the target operation platform encrypts the target contract data corresponding to the target device through the target key to obtain the target contract ciphertext; The document is sent to the target contract database for storage; the target operation platform receives the target contract database address and the target user ID returned by the target contract database; the target operation platform sends the target user ID, target contract database address and target key to the target block chain , so that the target blockchain can associate and store the target user ID, target signing database address and target key.

Wherein, different operators may correspond to different operating platforms, and this disclosure limits this step.

In this embodiment, the data storage is carried out through the block chain. On the basis of ensuring data transparency and fairness, the data transfer process is also traceable; at the same time, the target contract data is encrypted using the target key, which makes the data safe, reliable and reliable on the one hand. On the other hand, in the authentication process, it can be guaranteed that only the device corresponding to the target signing data can hold the target key to decrypt the target ciphertext, thus ensuring the security in the authentication process.

In addition, the target operation platform will also generate a target random number for the target device, and then generate a target authority certificate according to the target random number, and finally send the target authority certificate to the target blockchain, so that the target blockchain can associate the target authority certificate with the target user ID for associative storage.

Furthermore, the target operation platform will also obtain multiple access methods, the multiple access methods include the target access method; the target operation platform can obtain multiple authentication server addresses of multiple authentication servers, and the multiple authentication server addresses include the target Authentication server address; the target operation platform can determine the corresponding authentication server address for each access method according to the authentication method of each authentication server.

In some embodiments, after the target operating platform determines the corresponding authentication server address for each access method, it will store each authentication server address and its corresponding access method in the target blockchain.

Among them, the multiple access methods may include space-based access (such as satellite), ground-based access (such as base station), and space-based access (such as airplane, drone, hot air balloon, etc.), which is not limited in the present disclosure .

In the present disclosure, different authentication servers may be set for different access modes using different authentication technologies, and of course the same authentication server may be set for different access modes, which is not limited in the present disclosure. In short, each access mode has an authentication server corresponding to it.

Through the above method, at least one authentication server address and at least one contract database address can be stored in the target block chain, wherein at least one authentication server includes the target authentication server, at least one contract database address includes the target contract database address, each authentication server Corresponding to at least one access method (that is, an authentication server address can be matched through the access method), each subscription database corresponds to at least one user ID (that is, a subscription database can store subscription data corresponding to multiple user IDs, A subscription database address can be matched through the user ID).

Fig. 2 is a flowchart showing an authentication method according to an exemplary embodiment.

Referring to FIG. 2 , the authentication method provided by the embodiment of the present disclosure may include the following steps.

Step S202, the target access control network element receives the registration request sent by the target device.

In some embodiments, the target device may send a registration request to the target access control network element in the target mobile network when accessing the target mobile network for the first time.

The target access control network element may be any device in the target mobile network system, for example, it may be an AMF network element in the 5G network, and the disclosure does not limit this.

The target device may be any electronic device that needs to communicate, such as a mobile phone, a computer, and a notebook, and this disclosure does not limit it.

In step S204, the target access control network element determines the target user ID corresponding to the target device and the target access method for the target device to access the network system according to the registration request.

In some embodiments, the above-mentioned target access method may be any access method such as space-based access, ground-based access, space-based access, fixed network access, etc., which is not limited in the present disclosure.

Step S206, the target access control network element requests the target blockchain for the target authentication server address corresponding to the target access mode and the target subscription database address corresponding to the target user ID.

In some embodiments, the target access control network element can request the corresponding authentication server address from the target blockchain according to the target access mode, and can request the corresponding subscription database address from the target blockchain according to the target user identifier.

The target blockchain can determine the target authentication server address corresponding to the target access method in at least one authentication server address according to the pre-stored association between the access method and the authentication server address, and can determine the target authentication server address corresponding to the target access method according to the pre-stored user identification and the subscription database. For the address association, determine the target subscription database address corresponding to the target user identifier in at least one subscription database, and return the target authentication server address and the target subscription database address to the target access control network element.

In some embodiments, the registration request sent by the target device may also carry a target security token of the target device, and the target security token is generated by a target random number issued by the target operation platform. Then, when the target access control network element requests the target blockchain for the target authentication server address and the target subscription database address corresponding to the target access mode, the target access control network element sends the target user identification of the target device to the target blockchain , the target security token, and the target access method; the target blockchain determines the target authority certificate corresponding to the target device according to the target user ID, and the target authority certificate is generated according to the target random number issued by the target operation platform to the target device; if If the target blockchain determines that the target authority certificate matches the target security token, then it determines the address of the target authentication server corresponding to the target access method, and the address of the target signing database corresponding to the target user ID; the target blockchain will match the target access method The address of the target authentication server corresponding to the mode and the address of the target subscription database corresponding to the target user ID are returned to the target access control network element.

The above process compares the target security token with the target authority certificate, which can ensure the security of the entire authentication process and avoid illegal data acquisition.

In some other embodiments, the target access control network element sending the target user identification of the target device, the target security token, and the target access method to the target blockchain may include the target access control network element sending the target blockchain network element Send an authentication request carrying the target user ID, target security token, and target access mode; the target blockchain network element sends the target user ID, target security token, and target access mode to the target blockchain according to the authentication request, so as to The target block chain requests the address of the target authentication server corresponding to the target access method and the address of the target signing database corresponding to the target user identification.

Wherein, the target blockchain network element may be a certain node in the target blockchain. The target blockchain network element may be located in the target network, for example, it may be the target access control network element, and of course it may also be a device independent of the target access control network element, which is not limited in the present disclosure.

Step S208, the target access control network element sends an authentication request carrying the address of the target subscription database to the target authentication server according to the address of the target authentication server, so that the target authentication server accesses the target subscription database according to the address of the target subscription database to obtain the target subscription data corresponding to the target device , so as to authenticate the target device according to the target signing data.

In some embodiments, the target access control network element may request the target authentication server corresponding to the target authentication server address to access the target subscription database corresponding to the target subscription database address, so as to obtain the subscription data corresponding to the target device, so as to perform authentication processing on the target device .

In some embodiments, the target access control network element requests the target authentication server address corresponding to the target access mode and the target subscription database address corresponding to the target user identifier from the target block chain, including: the target access control network element requests The target block chain requests the address of the target authentication server corresponding to the target access method, the address of the target subscription database corresponding to the target user ID, and the target key corresponding to the contract data of the target device;

Then, the target access control network element sends an authentication request carrying the target subscription database address to the target authentication server according to the target authentication server address, so that the target authentication server accesses the target subscription database according to the target subscription database address to obtain the target subscription data corresponding to the target device. Including: the target access control network element sends the authentication request, the target signing database address and the target key to the target authentication server corresponding to the target authentication server address, so that the target authentication server accesses the target signing database according to the target signing database address to pass the target key The target signing data corresponding to the target device is obtained.

The above process can encrypt and decrypt the target contract data through the target key, which improves the security of data transmission and avoids illegal acquisition of data.

The technical solution provided by this embodiment introduces blockchain technology, and records the address of the authentication server and the address of the signing database on the blockchain; the terminal passes the security token to the blockchain through the network element of the blockchain, and the blockchain determines After the security token and the authority certificate are consistent, the contract database and authentication server address and key are returned; when the access control network element sends the authentication request to the blockchain, it carries the access type and user ID, and the blockchain responds according to different access types Different authentication servers return different subscription database addresses according to different user IDs. For different access methods, different operators may provide services, so there may be different authentication servers, and for different user identities, services may be provided by different subscription databases, so there may be different subscription databases. If services are provided by the same operator, different authentication servers may be used for different access technologies, and the subscription databases may be unified or different.

This method solves the routing and addressing problem of identity authentication when providing services across operators, and supports flexible selection of independent subscription databases and authentication servers according to access types, providing a solid foundation for future (such as 6G) heterogeneous network integration. A solution.

As shown in Figure 3, the authentication system corresponding to the authentication method provided by this disclosure may include network devices, authentication servers, contract databases and other devices of each operator, and these devices can interact through the blockchain network to achieve decentralization distributed deployment.

There are blockchain network elements that interact with the blockchain in the network equipment, and the operator's operation platform compares the corresponding relationship between the target user ID and the contract database address, the corresponding relationship between the access method and the authentication server, and the user ID and key. The association relationship of the network is recorded in the blockchain, and the network element of the blockchain obtains the address of the authentication server corresponding to the access mode of the device, the address of the contract database corresponding to the user ID, and other information from the blockchain, and completes the identification through this method. Addressing flow during authentication.

In some embodiments, the operator's operating platform can open a card for the user, encrypt the user subscription data corresponding to the user card, store the target user identifier and the encrypted user subscription data in the subscription database and return the storage location; the operator The platform selects different authentication servers according to different access methods and returns the address of the authentication server corresponding to the access methods. The operating platform records the returned information and the decryption key on the blockchain. The operation platform generates a random number and sends it to the terminal, and generates a permission certificate based on the random number and sends it to the blockchain, which stores it locally.

In some embodiments, the addressing process of the authentication server and subscription database is done through the blockchain. The terminal device generates a security token according to the random number, and sends the registration request and the security token to the access control network element. The access control network element judges the access mode of the terminal and sends an authentication request to the blockchain network element. The blockchain network element queries the blockchain for the data required for authentication, and at the same time sends it a security token. After the blockchain confirms that the security token is consistent with the authority certificate, it returns the signing database and authentication server address and key to the blockchain network element. The blockchain network element passes it to the access control network element, and the access control network element addresses according to the address of the authentication server, sends an authentication request, and carries the address and key of the contract database. The authentication server addresses according to the received address of the signing database, and sends the authentication request and the decryption key of the signing data to the signing database. The terminal and the network complete the authentication process and return the authentication result to the terminal.

The authentication method corresponding to the system shown in FIG. 3 can be specifically described through the sequence diagrams shown in FIG. 4 and FIG. 5 .

First, the process of writing relevant data into the blockchain can be shown in Figure 4:

1. The operator's operating platform opens a card for the user, encrypts the user contract data corresponding to the user card, and stores the target user ID and the encrypted user contract data in the contract database.

2. The subscription database returns the storage location of the subscription data corresponding to the target user identifier to the operation platform.

3. The operation platform selects different authentication servers according to different access methods, and the operation platform associates the access methods with the corresponding authentication servers.

4. The authentication server returns the address of the authentication server corresponding to the access mode.

Note: The order of steps 1, 2 and steps 3, 4 is not limited, and steps 3, 4 can be performed before 1, 2 or at the same time.

5. The operating platform records the returned information and the decryption key on the blockchain.

Note: The address of the authentication server, the address of the signing database, and the decryption key can be stored on the blockchain as a whole or stored separately on the blockchain.

6. The operation platform provides the relevant information of the user card to the terminal. The user card is the unique identity of the mobile user in the network. When the terminal accesses the network, it provides the user ID, performs calculations based on the authentication parameters (such as key K) and algorithms stored in the card, and provides an authentication response.

Note: There are two ways to write through USIM (Universal Subscriber Identity Module, Global Subscriber Identity Card) card and OTA data. The USIM writing method allows the mobile device to obtain the SUCI generated by the USIM through the ME-UICC (ME: mobile device, UICC: Universal Integrated Circuit Card, Universal Integrated Circuit Card) machine card interface GET IDENTITY command; OTA (Over The Air, over the air download Technology) Data writing refers to the synchronization of card authentication configuration data with the card authentication system through OTA data SMS.

7. The operation platform generates the first random number and sends it to the terminal.

8. The operation platform generates an authorization certificate according to the first random number.

Note: The permission certificate can be generated by hashing the random number, or by hashing the user ID and the random number together.

9. The operation platform sends the authority certificate to the blockchain.

10. The blockchain stores the authority certificate locally, and then updates its own storage information.

Secondly, the addressing process of the authentication server and the signing database can be completed through the block chain as shown in Figure 5:

1. The terminal device generates a security token according to the first random number.

2. The terminal device sends the registration request and the security token to the access control network element.

3. The access control network element judges the access mode of the terminal, which can be satellite access, fixed network access, mobile access, etc.

4. The access control network element sends an identity authentication request to the blockchain network element, including the terminal user ID, access method and security token.

5. The blockchain network element queries the blockchain for the data required for identity authentication, and at the same time sends it a security token.

6. The blockchain determines whether the security token is the same as the locally stored authority certificate, and then returns the address of the signing database according to the target user ID of the target device, and returns the address of the authentication server according to the access type.

Note: Different access types such as satellite, fixed network, and cellular network may be provided by different operators, so there may be different authentication servers and subscription databases. In addition, the same operator may adopt different authentication technologies for different access methods, and different authentication servers may complete the authentication. The subscription databases may be unified or different. This method supports all implementation methods.

7. After the blockchain confirms that the security token and the authority certificate are consistent, it returns the signing database and authentication server address and key to the blockchain network element.

8. The blockchain network element sends the signing database, authentication server address and key to the access control network element.

9. The access control network element finds the corresponding authentication server according to the address of the authentication server, sends an authentication request, and carries the address and key of the contract database.

10. The authentication server performs addressing according to the received signing database address.

11. After finding the contract database corresponding to the user, send the authentication request and the decryption key of the contract data to the contract database.

12. The signing database decrypts the encrypted data according to the received key.

13. The terminal and the network complete the authentication and authorization process, such as the EAP-AKA' authentication (an authentication method) process used in 5G or the 5G AKA authentication (an authentication method) process.

14. Return the authentication result to the terminal to complete the authentication process.

Note: This method is applicable to 5G/6G networks. An embodiment in 5G networks is that AMF is the access control network element, AUSF is the authentication server, and UDM is the subscription database.

The technical solution provided by this embodiment uses block chain technology to solve the addressing problem of the attribution authentication server and the contract database, which greatly improves the reliability and flexibility of data sharing between operators.

For multiple access scenarios, the technical solution provided in this embodiment can select different authentication servers according to different access types, and the subscription databases can be unified or different, and different implementation modes are supported.

The present disclosure also provides an authentication system, which may include a target block chain, at least one authentication server address and at least one contract database address are stored in the target block chain, at least one authentication server includes the target authentication server, at least one The subscription database address includes the target subscription database address; the authentication system also includes a target access control network element, which is used to receive the registration request sent by the target device; determine the target user ID of the target device and the target device access network system according to the registration request Access method; request to the target block chain the address of the target authentication server corresponding to the target access method and the address of the target signing database corresponding to the target user ID; send an authentication certificate carrying the address of the target signing database to the target authentication server according to the address of the target authentication server Request, so that the target authentication server accesses the target contract database according to the address of the target contract database to obtain the target contract data corresponding to the target device, so as to authenticate the target device according to the target contract data.

In some embodiments, the registration request carries the target security token of the target device, and the target security token is generated by the target random number issued by the target operation platform; The address of the target authentication server corresponding to the access method and the address of the target subscription database corresponding to the target user ID, including:

The target access control network element sends the target user ID of the target device, the target security token and the target access method to the target blockchain;

The target blockchain determines the target authority certificate corresponding to the target device according to the target user identification, and the target authority certificate is generated according to the target random number issued by the target operation platform to the target device;

If the target block chain determines that the target authority credential matches the target security token, then determine the target authentication server address corresponding to the target access method, and the target signing database address corresponding to the target user ID;

In some embodiments, the target access control network element sending the target user identification of the target device, the target security token, and the target access method to the target block chain includes: the target access control network element sends the target block chain network element An authentication request carrying the target user ID, target security token, and target access mode; the target blockchain network element sends the target user ID, target security token, and target access mode to the target blockchain according to the authentication request, to send the target user ID, target security token, and target access mode to the target The block chain requests the target authentication server address corresponding to the target access mode and the target signing database address corresponding to the target user identification.

In some embodiments, the request from the target access control network element to the target block chain for the address of the target authentication server corresponding to the target access method and the address of the target subscription database corresponding to the target user identifier includes: the target access control network element sends the target The block chain requests the address of the target authentication server corresponding to the target access method, the address of the target subscription database corresponding to the target user ID, and the target key corresponding to the contract data of the target device; wherein, the target access control network element according to the target The authentication server address sends an authentication request carrying the target subscription database address to the target authentication server, so that the target authentication server accesses the target subscription database according to the target subscription database address to obtain the target subscription data corresponding to the target device, including: the target access control network element will authenticate The request, the address of the target signing database and the target key are sent to the target authentication server corresponding to the address of the target authentication server, so that the target authentication server accesses the target signing database according to the address of the target signing database to obtain the target signing data corresponding to the target device through the target key.

In some embodiments, before the target access control network element receives the registration request sent by the target device, the method includes: the target operation platform signs a card for the target device; The signing data is encrypted to obtain the target signing ciphertext; the target operation platform sends the target user identification corresponding to the target device and the target signing ciphertext to the target signing database for storage; the target operating platform receives the target signing database address and Target user identification; the target operation platform sends the target user identification, target contract database address and target key to the target block chain, so that the target block chain can associate and store the target user identification, target contract database address and target key.

In some embodiments, the target operation platform is also used to generate a target random number for the target device; the target operation platform generates a target authority certificate according to the target random number; the target operation platform sends the target authority certificate to the target block chain, so that the target The blockchain associates and stores the target authority credentials with the target user ID.

In some embodiments, before the target access control network element receives the registration request sent by the target device, it further includes: the target operation platform obtains multiple access methods, and the multiple access methods include the target access method; the target operation platform obtains The multiple authentication server addresses of the multiple authentication servers, the multiple authentication server addresses include the address of the target authentication server; the target operation platform determines the corresponding target authentication server address for each access mode according to the authentication mode of each authentication server.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that includes one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block in the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a A combination of dedicated hardware and computer instructions.

In addition, the above-mentioned drawings are only schematic illustrations of processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not imply or limit the chronological order of these processes. In addition, it is also easy to understand that these processes may be executed synchronously or asynchronously in multiple modules, for example.

FIG. 6 shows a schematic structural diagram of an electronic device suitable for implementing an embodiment of the present disclosure. It should be noted that the electronic device 600 shown in FIG. 6 is only an example, and should not limit the functions and application scope of the embodiments of the present disclosure.

As shown in FIG. 6 , an electronic device 600 includes a central processing unit (CPU) 601, which can operate according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage section 608 into a random access memory (RAM) 603 Instead, various appropriate actions and processes are performed. In the RAM 603, various programs and data necessary for the operation of the electronic device 600 are also stored. The CPU 601, ROM 602, and RAM 603 are connected to each other through a bus 604. An input/output (I/O) interface 605 is also connected to the bus 604 .

The following components are connected to the I/O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 608 including a hard disk, etc. and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I/O interface 605 as needed. A removable medium 611 such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc. is mounted on the drive 610 as necessary so that a computer program read therefrom is installed into the storage section 608 as necessary.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable storage medium, where the computer program includes program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via communication portion 609 and/or installed from removable media 611 . When this computer program is executed by a central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are performed.

It should be noted that the computer-readable storage medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. A computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, in which computer-readable program codes are carried. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can be sent, propagated, or transported for use by or in conjunction with an instruction execution system, apparatus, or device program of. Program code embodied on a computer readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wires, optical cables, RF, etc., or any suitable combination of the foregoing.

As another aspect, the present application also provides a computer-readable storage medium, which may be included in the device described in the above-mentioned embodiments; or exist independently without being assembled into the device middle. The above-mentioned computer-readable storage medium carries one or more programs, and when the above-mentioned one or more programs are executed by one of the devices, enabling the device to implement functions includes: the target access control network element receives the registration request sent by the target device;

The target access control network element determines the target user identifier corresponding to the target device and the target access method for the target device to access the network system according to the registration request; the target access control network element sends a message to the target area The block chain requests the target authentication server address corresponding to the target access method and the target subscription database address corresponding to the target user identifier; the target access control network element sends the target authentication server address to the target authentication server according to the target authentication server address an authentication request carrying the address of the target subscription database, so that the target authentication server accesses the target subscription database according to the address of the target subscription database to obtain the target contract data corresponding to the target device, so that the The target device is authenticated.

According to an aspect of the present application there is provided a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the methods provided in various optional implementation manners of the foregoing embodiments.

According to an aspect of the present disclosure, an authentication device is also provided. Fig. 7 is a schematic structural diagram of an authentication device according to some embodiments of the present disclosure. The authentication device in the embodiment of the present disclosure is set in the target access control network element. As shown in FIG. 7 , the authentication device 700 includes: a receiving module 710 , a determining module 720 , a requesting module 730 , and a sending module 740 .

The receiving module 710 is configured to receive the registration request sent by the target device.

The determining module 720 is configured to determine a target user identifier corresponding to the target device and a target access method for the target device to access the network system according to the registration request.

The requesting module 730 is configured to request from the target blockchain the address of the target authentication server corresponding to the target access method and the address of the target subscription database corresponding to the target user ID.

The sending module 740 is configured to send an authentication request carrying a target subscription database address to the target authentication server according to the target authentication server address, so that the target authentication server accesses the target subscription database according to the target subscription database address to obtain target subscription data corresponding to the target device, thereby The target device is authenticated based on the target signing data.

The authentication device in the embodiment of the present disclosure can dynamically adapt different authentication servers for devices with different access modes, and can adapt the subscription database without relying on the user number segment.

Through the description of the above implementations, those skilled in the art can easily understand that the example implementations described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions of the embodiments of the present disclosure can be embodied in the form of software products, which can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.), including several instruction It is used to make a computing device (which may be a personal computer, a server, a mobile terminal, or a smart device, etc.) execute the method according to the embodiment of the present disclosure, such as the steps shown in FIG. 3 .

Other embodiments of the disclosure will be readily apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. The present disclosure is intended to cover any modification, use or adaptation of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or conventional technical means in the technical field for which the present disclosure does not apply . The specification and examples are to be considered exemplary only, with the true scope and spirit of the disclosure indicated by the appended claims.

It should be understood that the present disclosure is not limited to the detailed structures, drawing methods or implementation methods shown herein, but on the contrary, the present disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims .

Claims (16)

1. An authentication method comprising:

   The target access control network element receives the registration request sent by the target device;

   The target access control network element determines a target user identifier corresponding to the target device and a target access method for the target device to access the network system according to the registration request;

   The target access control network element requests the target block chain for the address of the target authentication server corresponding to the target access method and the address of the target subscription database corresponding to the target user ID, and the target block chain stores at least one an authentication server address and at least one subscription database address, the at least one authentication server includes a target authentication server, and the at least one subscription database address includes a target subscription database address;

   The target access control network element sends an authentication request carrying the target subscription database address to the target authentication server according to the target authentication server address, so that the target authentication server accesses the target subscription database according to the target subscription database address to obtain target signing data corresponding to the target device, so as to authenticate the target device according to the target signing data.
2. The authentication method according to claim 1, wherein the target access control network element requests the target blockchain for the address of the target authentication server corresponding to the target access mode and the target subscription corresponding to the target user ID Database address, including:

   The target access control network element sends the target user ID of the target device, the target security token, and the target access method to the target blockchain;

   The target access control network element receives the target authentication server address corresponding to the target access mode and the target subscription database address corresponding to the target user identifier returned by the target blockchain.
3. The authentication method according to claim 2, wherein the sending of the target user ID of the target device, the target security token, and the target access method by the target access control network element to the target block chain includes:

   The target access control network element sends the target user ID of the target device, the target security token, and the target access mode to the target blockchain through the target blockchain network element.
4. The authentication method according to claim 1, wherein the registration request carries a target security token of the target device, and the target security token is generated by a target random number issued by the target operation platform; wherein, the The target access control network element requests the target blockchain for the address of the target authentication server corresponding to the target access mode and the address of the target subscription database corresponding to the target user ID, including:

   The target access control network element sends the target user ID of the target device, the target security token, and the target access method to the target blockchain;

   The target block chain determines the target authority certificate corresponding to the target device according to the target user identifier, and the target authority certificate is generated according to the target random number issued by the target operation platform to the target device;

   If the target block chain determines that the target authority credential matches the target security token, then determine the target authentication server address corresponding to the target access method and the target signing database corresponding to the target user ID address;

   The target blockchain returns the target authentication server address corresponding to the target access method and the target subscription database address corresponding to the target user identifier to the target access control network element.
5. The authentication method according to claim 4, wherein the target access control network element sends the target user ID of the target device, the target security token, and the target access method to the target block chain ,include:

   The target access control network element sends an authentication request carrying the target user ID, the target security token, and the target access mode to the target blockchain network element;

   The network element of the target block chain sends the target user ID, the target security token, and the target access method to the target block chain according to the authentication request, so as to request the target block chain A target authentication server address corresponding to the target access mode and a target subscription database address corresponding to the target user identifier.
6. The authentication method according to claim 1, wherein the target access control network element requests the target blockchain for the address of the target authentication server corresponding to the target access mode and the target subscription corresponding to the target user ID Database address, including:

   The target access control network element requests the target blockchain for the address of the target authentication server corresponding to the target access method, the address of the target subscription database corresponding to the target user identifier, and the contract data with the target device the corresponding target key;

   Wherein, the target access control network element sends an authentication request carrying the target subscription database address to the target authentication server according to the target authentication server address, so that the target authentication server accesses the target subscription database according to the target subscription database address Obtaining the target signing data corresponding to the target device, including:

   The target access control network element sends an authentication request carrying the target subscription database address and the target key to the target authentication server corresponding to the target authentication server address, so that the target authentication server The database address accesses the target subscription database to obtain the target contract data corresponding to the target device through the target key.
7. According to the authentication method according to claim 1, before the target access control network element receives the registration request sent by the target device, it further includes:

   The target operation platform stores the target user identifier and target contract data corresponding to the target device in the target contract database, and stores the target user identifier and target contract database address in the target block chain.
8. According to the authentication method according to claim 1, before the target access control network element receives the registration request sent by the target device, it further includes:

   The target operation platform signs a contract for the target device;

   The target operation platform encrypts the target signing data corresponding to the target device through the target key to obtain the target signing ciphertext;

   The target operation platform sends the target user identification corresponding to the target device and the target signing ciphertext to the target signing database for storage;

   The target operation platform receives the target contract database address and the target user identifier returned by the target contract database;

   The target operation platform sends the target user ID, the target signing database address, and the target key to the target blockchain, so that the target blockchain can transfer the target user ID, the target The contract database address and the target key are stored in association.
9. The authentication method according to claim 8, further comprising:

   The target operating platform generates a target random number for the target device;

   The target operating platform generates a target authority certificate according to the target random number;

   The target operation platform sends the target authority certificate to the target blockchain, so that the target blockchain associates and stores the target authority certificate and the target user identifier.
10. According to the authentication method according to claim 1, before the target access control network element receives the registration request sent by the target device, it further includes:

    The target operation platform acquires multiple access methods, where the multiple access methods include the target access method;

    The target operation platform obtains multiple authentication server addresses of multiple authentication servers, and the multiple authentication server addresses include the target authentication server address;

    The target operation platform determines corresponding target authentication server addresses for each access mode according to the authentication mode of each authentication server.
11. An authentication device, set in a target access control network element, comprising:

    A receiving module configured to receive a registration request sent by the target device;

    A determination module configured to determine a target user identifier corresponding to the target device and a target access method for the target device to access the network system according to the registration request;

    The request module is configured to request from the target block chain the address of the target authentication server corresponding to the target access method and the address of the target subscription database corresponding to the target user identifier;

    A sending module configured to send an authentication request carrying the address of the target subscription database to the target authentication server according to the address of the target authentication server, so that the target authentication server accesses the target subscription database according to the address of the target subscription database to obtain the Target signing data corresponding to the target device, so as to authenticate the target device according to the target signing data.
12. An authentication system comprising:

    Target block chain, at least one authentication server address and at least one contract database address are stored in the target block chain, the at least one authentication server includes the target authentication server, and the at least one contract database address includes the target contract database address; and

    The target access control network element is configured as:

    Receive the registration request sent by the target device;

    determining a target user identifier of the target device and a target access method for the target device to access the network system according to the registration request;

    Requesting the target authentication server address corresponding to the target access mode and the target subscription database address corresponding to the target user identification from the target block chain;

    Send an authentication request carrying the address of the target subscription database to the target authentication server according to the address of the target authentication server, so that the target authentication server accesses the target subscription database according to the address of the target subscription database to obtain the target subscription corresponding to the target device data, so as to authenticate the target device according to the target signing data.
13. The authentication system according to claim 12, further comprising:

    The target operation platform is configured to store the target user identifier and target contract data corresponding to the target device in the target contract database, and store the target user identifier and target contract database address in the target block chain.
14. An electronic device, characterized in that it comprises:

    memory;

    and a processor coupled to the memory;

    The electronic device is configured to execute the authentication method according to any one of claims 1-10 based on the instructions stored in the memory.
15. A computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the authentication method according to any one of claims 1-10 is implemented.
16. A computer program comprising:

    Instructions which, when executed by a processor, cause the processor to perform the authentication method according to any one of claims 1-10.

Images