WO2023116784A1

WO2023116784A1 - Base station access control method, base station, blockchain system, and storage medium

Info

Publication number: WO2023116784A1
Application number: PCT/CN2022/140789
Authority: WO
Inventors: 侯芳; 范璟玮
Original assignee: 中兴通讯股份有限公司
Priority date: 2021-12-22
Filing date: 2022-12-21
Publication date: 2023-06-29
Also published as: CN116347443A

Abstract

The present application discloses a base station access control method, an electronic device, and a computer-readable storage medium. The base station access control method is applied to a base station and comprises: sending first authentication request information to a blockchain system, the first authentication request information carrying an identity certificate of the base station (S100); obtaining first identity certificate issuing information sent by the blockchain system, the first identity certificate issuing information being generated by the blockchain system according to the identity certificate under the condition of confirming storage of the identity certificate on the basis of the first authentication request information (S200); and accessing a gateway according to the first identity certificate issuing information (S300).

Description

Base station access control method, base station, blockchain system, and storage medium

Cross References to Related Applications

This application is based on a Chinese patent application with application number 202111578563.5 and a filing date of December 22, 2021, and claims the priority of this Chinese patent application. The entire content of this Chinese patent application is hereby incorporated by reference into this application.

technical field

The present application relates to the field of communication technology, and in particular to a base station access control method, a base station, a blockchain system, and a computer-readable storage medium.

Background technique

In daily life, the access network and core network of 4G/5G communication adopt the X.509 certificate mode based on the public key infrastructure (Public Key Infrastructure, PKI) to perform access authentication of equipment, network elements, and functional modules. Among them, the certificate authority (Certificate Authority, CA), as the manager of the certificate and as a centralized model, acts as a third-party trusted organization. However, with the Internet of Things (IOT) composed of objects The massive growth of incoming devices and zero-trust requirements for encrypted transmission of HyperText Transfer Protocol (HTTP) and Domain Name System (Domain Name System, DNS) lead to high security risks in the design of CA-based PKI. Correct and efficient certificate management.

Contents of the invention

Embodiments of the present application provide a base station access control method, electronic equipment, and a computer-readable storage medium.

In the first aspect, the embodiment of the present application provides a base station access control method, which is applied to a base station, and the method includes: sending first authentication request information to the blockchain system, the first authentication request information carrying the base station's Identity certificate; obtain the first identity certificate issuance information sent by the block chain system, and the first identity certificate issuance information is confirmed by the block chain system based on the first authentication request information to store the identity certificate In the case of , generate according to the identity certificate; issue information access gateway according to the first identity certificate.

In a second aspect, the embodiment of the present application provides a base station access control method, which is applied to a blockchain system. The method includes: receiving first authentication request information sent by the base station, the first authentication request information carrying the The identity certificate of the base station; in the case of confirming the storage of the identity certificate based on the first authentication request information, generating first identity certificate issuance information according to the identity certificate; sending the information for accessing the gateway to the base station Issuing information of the first identity certificate.

In a third aspect, an embodiment of the present application provides a base station, including: a memory, a processor, and a computer program stored in the memory and operable on the processor, and the processor implements the first aspect when executing the computer program. The base station access control method.

In a fourth aspect, an embodiment of the present application provides a blockchain system, including: a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, it implements the following: The base station access control method described in the second aspect.

In the fifth aspect, the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to make the computer execute the first aspect or the second aspect. The base station access control method.

Additional features and advantages of the application will be set forth in the description which follows, and, in part, will be obvious from the description, or may be learned by practice of the application. The objectives and other advantages of the application will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the technical solution of the present application, and constitute a part of the specification, and are used together with the embodiments of the present application to explain the technical solution of the present application, and do not constitute a limitation to the technical solution of the present application.

FIG. 1 is a schematic diagram of a system architecture for performing a base station access control method provided by an embodiment of the present application;

Fig. 2 is a schematic diagram of a system framework of a base station access control method provided by an embodiment;

FIG. 3 is a flowchart of a base station access control method provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of a traditional CA registration review method;

Fig. 5 is a schematic diagram of a model of an identity certificate provided by an embodiment of the present application;

Fig. 6 is a specific method flowchart of step S300 in Fig. 3;

FIG. 7 is a flowchart of a base station access control method provided by an embodiment of the present application;

FIG. 8 is a flowchart of a base station access control method provided by an embodiment of the present application;

FIG. 9 is a flowchart of a base station access control method provided by an embodiment of the present application;

FIG. 10 is a flowchart of a base station access control method provided in another embodiment of the present application;

FIG. 11 is a flowchart of a base station access control method provided in another embodiment of the present application;

FIG. 12 is a flowchart of a base station access control method provided in another embodiment of the present application;

FIG. 13 is a flowchart of a base station access control method provided in another embodiment of the present application;

Fig. 14 is a schematic diagram of a system framework of a base station access gateway provided in a specific example of the present application;

FIG. 15 is a flowchart of a base station access control method provided in another embodiment of the present application;

Fig. 16 is a schematic diagram of a system framework for network management user authorization provided by a specific example of the present application;

FIG. 17 is a flowchart of a base station access control method provided in another embodiment of the present application;

Fig. 18 is a schematic diagram of a system framework for network management user authentication provided by a specific example of the present application;

FIG. 19 is a flowchart of a base station access control method provided in another embodiment of the present application;

Fig. 20 is a schematic diagram of an architecture for verifying a server certificate according to a TLSA record provided by a specific example.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, not to limit the present application.

It should be noted that in the description of the embodiments of the present application, the terms "first", "second", etc. Implying relative importance or implicitly specifying the quantity of indicated technical features or implicitly indicating the sequence relationship of indicated technical features. "At least one" means one or more, and "plurality" means two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three kinds of relationships, for example, A and/or B, which may indicate the existence of A alone, the existence of A and B at the same time, or the existence of B alone. Among them, A and B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. Although the functional modules are divided in the schematic diagram of the device, and the logical order is shown in the flowchart, in some cases, the modules shown or described in the device may be divided or executed in an order different from that in the flowchart. A step of.

In addition, the technical features involved in the various embodiments of the present application described below may be combined with each other as long as they do not constitute a conflict with each other.

Embodiments of the present application provide a base station access control method, electronic equipment, and a computer-readable storage medium. Since the first authentication request information sent by the base station itself carries the relevant identity certificate, when the blockchain system obtains the first authentication request sent by the base station When there is an authentication request information, the identity certificate of the base station can be obtained at the same time, so that when the stored identity certificate is confirmed based on the first authentication request information, the blockchain system generates the first identity certificate issuance information and sends it to the base station to inform The identity certificate of the base station has been incorporated into the blockchain system for management, and then the base station will issue information to access the gateway according to the first identity, realize base station access control, and improve the effectiveness and correctness of certificate management.

The embodiments of the present application will be further described below in conjunction with the accompanying drawings.

As shown in FIG. 1 , FIG. 1 is a schematic diagram of a system architecture for performing a base station access control method provided by an embodiment of the present application.

It can be seen from the figure that the blockchain network 100 is mainly composed of a base station 200 and a blockchain system 300, and the blockchain network 100 includes a blockchain system 300 and a base station 200, wherein the base station 200 is divided into a base station identity client management terminal and a base station identity Management server, the blockchain system 300 includes a blockchain certificate system and a blockchain identity system, the blockchain identity system mainly stores the identity certificates of the base station 200 and other devices, so that the base station 200 or other devices can request the identity certificates, In order to access the gateway, the blockchain certificate system is used for the base station 200 or the network management device to perform authorization authentication, which is convenient for the base station 200 or the network management device to perform identity certificate authentication.

This blockchain network 100 mainly solves the security threat to 5G base station equipment. At present, the security threat of 5G mainly has four aspects: one is the security threat to the hardware, software and network infrastructure that constitute the base station; two. The third is the security threat to the transmission network security and information of N2 (RAN->AMF) and N3 (RAN->UPF) connected to the 5G core network; The fourth is the security threat to the management plane connecting the base station to the network management.

From the perspective of the base station security boundary, in addition to the identity authentication of the base station access Security Gateway (SEG), there are two important key elements, network management user access control and DNS request authentication. Layer security protocol DANE (DNS-based Authentication of Named Entities, DNSSEC-based secure transport layer protocol) and blockchain-based identity authentication management.

As shown in FIG. 2 , FIG. 2 is a schematic diagram of a system framework of a base station access control method provided by an embodiment.

In the system framework of the base station access control method, the user certificate management system based on blockchain and the certificate issuance technology based on DNS Security Extensions (Domain Name System Security Extensions, DNSSEC) are combined. The management subsystem, the base station implements the issuance, renewal and authentication of user certificates. At the same time, if the authorized serial number of the network management device or login identity is introduced into the user certificate, for example, a hash summary is implemented for the user name and password, the double authentication of the user key and the user device can be realized, which further improves the security, and through this area The blockchain certificate management system, if more other edge devices are connected in the future, it can unify the types of user certificates and reduce the management complexity of the server.

On the other hand, considering the fact that the server usually publishes the service address through the domain name, by using DANE technology, its certificate can be associated with the TLSA record and published on the DNS system, and the client can use the DNSSEC mechanism to verify the identity of the server. It reduces the cost of issuing server certificates and simplifies the client verification process, so as to realize safe and reliable two-way identity authentication that does not depend on CA.

Compared with the x509 certificate of the traditional CA used by the base station, if the authorization list is added, such as network management users or devices, the attacker must obtain the user's private key and authorized user information at the same time to impersonate the identity.

In an embodiment, in order to illustrate the security mechanism of the DNS more clearly, a specific description is given below.

No matter which device wants to access the Internet, DNS service must be provided, but DNS was not designed with a lot of security in mind, and it cannot verify the authenticity of the response by itself, and the source IP address of the DNS response packet is easy to counterfeit or forge.

DNSSEC is currently a widely used DNS security enhancement solution officially released. It can effectively prevent DNS cache pollution. It uses digital signatures based on public key encryption. Its certificates and private keys are generated and self-signed on its own server. This is different from HTTPS, which does not require a root certificate issuer. During authentication, the domain name recursive resolver starts from the root domain name server and resolves layer by layer to verify the integrity of the domain's public key, ensuring that the public key of each level of domain is Credible; instead of cryptographically signing the DNS query and response itself, the data owner uses the private key to sign the DNS data itself, thereby enhancing the strength of DNS verification, that is, verifying the source of DNS data and protecting the integrity of the data .

DANE is a security protocol that only works when DNSSEC is activated. It publishes digital certificates through DNS services to ensure that whether it is a certificate issued by a CA or a self-signed certificate, it is ultimately the desired certificate. ; It is an instance verification based on DNS names, and a TLSA record is used to prove that a certificate is trustworthy, and it also solves the problem that DNSSEC cannot protect access privacy.

It allows the release of Transport Layer Security (TLS) keys for applications such as mail transmission in the zone, and it allows certificates to be bound to DNS names. , public key infrastructure for X.509 certificates) model provides additional assurance and enables domain holders to claim certificates for themselves without reference to third-party certificate authorities, while protecting servers, certificate authorities, and users The chain of trust between HTTPS goes beyond the standard HTTPS protocol.

A traditional DNS server asserts its right to represent a domain by presenting a PKIX digital certificate (RFC 5280). During access verification, the client, such as the DNS proxy in the base station, evaluates the certificate to determine whether it is a trusted DNS server. The method of evaluation is mainly to see whether the required domain name is included in the certificate, and whether the certificate is issued by a trusted trust anchor (eg: trusted CA). There is a problem, the current browser or operating system will use a large number of default trust anchors, so that the trust anchor has a wide range of permissions, and manually deleting the trust anchor is also more troublesome, resulting in insecurity, DANE has done some limited work on the trust anchor Range usage restrictions.

In an embodiment, in order to solve the above constraint problem, the TLSA record is described in detail below.

DANE defines a DNS resource record type TLSA for describing the claims that a certificate is associated with a domain. Each TLSA record has three basic fields, when a client wants to connect to a certain domain, he can find these TLSA records and apply the constraints when verifying the server's certificate. When used DANE allows browsers to inspect TLSA records for the public thumbprint of certificates marked as secure by the user. This could be an intermediate certificate of the CA that issued the certificate on the server, or it could be the thumbprint of the certificate itself. With the help of generators (such as opessl, online website Generate TLSA Record, etc.), TLSA records can be easily created.

Among them, the TLSA record elements are as follows:

Usage: what type of statement this record makes;

For example: 3PKIX-EE: service certificate constraints, specifying the exact Transport Layer Security (TLS) certificate that should be used for a domain name;

selector/match: how the TLS certificate chain should match this record (e.g. by exact match, by public key, or by SHA-1 digest);

For example: 0:Cert:Use the entire certificate

Match Type:

For example: 2:SHA-512:SHA-512 hash

Example: The actual data that the associated TLS certificate chain should match _443._tcp.zte.com

Finally got: 3 0 2 XXXXXXXXXX

The certificate based on the DNSSEC system is similar to the identity certificate authentication of the traditional base station, and both have their own trust chain. The difference is that DNS trust chain resolution is iterative, and the certificates are issued by the domain servers at all levels, not the CA. issued. For the base station, if there is no blockchain-based certificate system, the base station needs to maintain the life cycle management of the two certificates at the same time. Using the blockchain system, these certificates and management can be pushed to the chain. The result returned by the identity authentication blockchain can be matched with TLSA.

As shown in FIG. 3 , FIG. 3 is a flowchart of a base station access control method provided by an embodiment of the present application, which is applied to a base station. The base station access control method includes but is not limited to steps S100 to S300 .

Step S100: Send first authentication request information to the blockchain system, where the first authentication request information carries the identity certificate of the base station.

In an embodiment, the base station sends the first authentication request information to the blockchain system, wherein the first authentication request information carries the content of the certificate of the base station and related identity information, so that the blockchain system can verify the first authentication request information.

It can be understood that when sending the first authentication request information to the blockchain system, the first authentication request information is sent by the base station identity management client and sent to the verification node in the blockchain system, wherein the verification node can be a digital certificate Registration authority (Registration Authority, RA) or CA, which is not specifically limited in this embodiment.

Step S200: Obtain the first identity certificate issuance information sent by the blockchain system. The first identity certificate issuance information is generated by the blockchain system based on the identity certificate under the condition that the storage identity certificate is confirmed based on the first authentication request information.

In one embodiment, after the block chain system receives the first authentication request information, it judges whether the corresponding identity certificate has been saved according to the identity certificate carried in the first authentication request information, and after confirming that the block chain system has stored the information corresponding to the first authentication request information. In the case of the identity certificate corresponding to the authentication request information, the first identity certificate issuance information corresponding to the first authentication request information is generated according to the identity certificate, thereby improving the accuracy of the certificate configuration and facilitating the subsequent access of the base station according to the first identity certificate issuance information gateway.

It can be understood that when the blockchain system judges the first authentication request information, the judgment method is the same as the traditional CA registration review method, and the following is the traditional CA registration review method.

In order to illustrate the traditional CA registration review method more clearly, a specific description is given below.

As shown in FIG. 4, FIG. 4 is a schematic diagram of a traditional CA registration review method.

5G mainly includes three parts: access network, bearer network, and core network. For the access network, there is currently a set of methods in use for the access identity authentication of the base station, which depends on the issuance and configuration of the CA. The identity certificate The configuration workload is relatively large. When configuring and using certificates, communication manufacturers need to first apply for a certificate from the operator's CA organization. After the CA organization issues the certificate, it needs to configure or install the issued certificate into the base station of the target device. Certificates implement device authentication.

Since it is necessary to configure different private keys and certificates for each device, it is difficult to implement batch operations, which will lead to low construction efficiency and difficulty in certificate life cycle management. There is also a security risk of private key leakage due to manual operations. The embodiment of this application describes The release mechanism of the system can improve efficiency through decentralization, and at the same time eliminate CA single point of failure.

At the same time, 5G is based on different business scenarios. Slicing enables operators to create customized private networks based on the needs of vertical industries. End-to-end network services may require slices of multiple operators in multiple countries to be interconnected to jointly provide seamless services. Cross-country and cross-service 5G services. Security protection is required between slices, and secure channels need to be guaranteed by digital certificates. Different operators have different CAs, and mutual trust must be established between CAs in order to perform slicing services normally. At this time, it is also easy to realize multi-CA mutual trust by adopting a blockchain-based identity authentication system deployed in an alliance manner.

With the help of blockchain and smart contracts, the cost of building, maintaining, and operating CA systems in 5G can be reduced;

The registration mechanism of the base station certificate described in 3GPP 33.310 is as follows:

The base station is pre-provided by the equipment manufacturer with a public-private key pair generated at the factory, and pre-installed with a digital certificate signed by the equipment supplier, the operator's Registration Authorization (RA)/Certificate Authorization (CA) server pre-installs the equipment manufacturer's root certificate, the core network SEG Carrier root certificate is pre-installed.

Step S300: Issuing information to access the gateway according to the first identity certificate.

In one embodiment, first, the base station sends the first authentication request information to the block chain system, and after the block chain system receives the first authentication request information, after confirming that the block chain system stores the information corresponding to the first authentication request information In the case of an identity certificate, generate the first identity certificate issuance information corresponding to the first authentication request information according to the identity certificate, and finally, access the gateway according to the first identity certificate issuance information obtained in step S200, so as to improve the accuracy of the access certificate. sex.

As shown in FIG. 5, FIG. 5 is a schematic diagram of an identity certificate model provided by an embodiment.

In Figure 5, the base station access control certificate model shows that the base station only needs one access control certificate to complete external identity authentication, DNS domain authority definition, and network management privileged user control through the inventive unit. In addition to the above functions, the certificate can Simultaneously provide more extended information to meet other scenarios that require verification or control in the future.

In one embodiment, the identity certificate contains information such as base station name, base station unique identifier, version number, certificate public key, certificate validity period, and serial number, and also contains network management user authorization list, DNS domain authorization information or other extended information, etc. , by designing the form of identity certificates in the blockchain system, multiple certificates can be integrated into one, and at the same time, extended information can be introduced into the identity certificate that has passed the authentication request information, and the management user authorization outside the base station can be introduced into blockchain-based identity authentication system to ensure the accuracy of the identity certificate, improve the security of the identity certificate, and expand the information without restriction, and can add or remove operations at any time according to authorization requests or certification requests, so it has the ability to update certificates.

As shown in FIG. 6, FIG. 6 is a flow chart of the method of step S300 in FIG. 3, and the step S300 includes but not limited to steps S310 to S340.

Step S310: Generate an identity authentication access request carrying the first identity certificate issuance information according to the first identity certificate issuance information.

Step S320: Send an identity authentication access request to the gateway.

Step S330: Receive the access verification result sent by the gateway according to the identity authentication access request. The access verification result is obtained by the blockchain system by verifying the identity of the base station according to the verification request from the gateway, and sent to the gateway. The verification request is sent by the gateway Generated based on an identity authentication access request.

In one embodiment, the identity management client of the base station sends an identity authentication access request to the gateway, and the gateway sends a verification request to the blockchain system, wherein the verification request is generated by the gateway according to the identity authentication access request, and the blockchain system is verified. After obtaining the access verification result, the access verification result is sent to the gateway, and the gateway then sends the verification result to the base station identity management client to realize multiple verifications of the access certificate and improve the security of certificate access.

Step S340: access the gateway according to the access verification result.

It can be understood that the base station identity management client accesses the gateway according to the access verification result returned by the blockchain system, wherein the gateway is SEG.

As shown in FIG. 7 , FIG. 7 is a flowchart of a base station access control method provided by an embodiment of the present application. The base station access control method includes but is not limited to steps S2100 to S2200 .

Step S2100: Send an authorization processing request corresponding to the on-site device to the blockchain system.

In one embodiment, the identity management client of the base station sends an authorization processing request corresponding to the on-site equipment to the verification node in the blockchain system, wherein the authorization processing request carries the identity certificate corresponding to the on-site equipment, which is convenient for the management node to verify the on-site equipment. Validate and improve the security of the certificate.

In an embodiment, the authorization processing request may be an authorization request of the on-site device, or a de-authorization request of the on-site device, so as to realize the diversity of operations on the on-site device and improve the efficiency of authorization processing requests on the on-site device.

It can be understood that the in-station device may be a management device or a management user inside the base station, which is not specifically limited in this embodiment.

Step S2200: Receive the second identity certificate issuance information sent by the blockchain system. The second identity certificate issuance information is obtained by the blockchain system according to the authorization processing request to update the identity certificate and based on the updated identity certificate.

In one embodiment, after receiving the authorization processing request, the block chain system updates the identity certificate according to the authorization processing request, obtains the second identity certificate issuance information according to the updated identity certificate, and the identity management client of the base station receives the information issued by the block The issuance information of the second identity certificate sent by the chain system realizes the update of the identity certificate and facilitates the management of the identity certificate.

In one embodiment, referring to the model diagram of the identity certificate shown in Figure 5, after the block chain system receives the authorization processing request, the identity certificate is updated according to the authorization processing request, and the network management user authorization list in the identity certificate is updated. .

It can be understood that step S2100 may be performed before step S300, or may be performed after step S300, which is not specifically limited in this embodiment of the present application.

As shown in FIG. 8 , FIG. 8 is a flowchart of a base station access control method provided by an embodiment of the present application. The base station access control method includes but is not limited to steps S400 to S600 .

Step S400: Send the second authentication request information to the blockchain system, the second authentication request information is generated by the base station according to the user identity authorization request from the authorization end, and the user identity authorization request carries the user identity information of the authorization end.

In one embodiment, the base station identity client receives the user identity authorization request from the authorization end, and processes the user identity authorization request, so that the blockchain system can read the user identity authorization request, and the user identity authorization request carries the identity authorization information of the authorization end. The user identity information corresponding to the user, according to the user identity information, the base station sends the second authentication request information to the blockchain system, so that the blockchain system can make an authorization judgment on the authorization terminal according to the second authentication request information.

It should be noted that the second authentication request information is obtained by concatenating the client identity information and the unique identifier of the base station.

It can be understood that the identity certificate of the base station can authorize access to the network management device or other devices and identities that access the base station, and the authorized access of the network management device or other devices must be performed after the identity management client of the base station completes the uploading of the identity certificate.

It should be noted that the authorized end user in this embodiment can be a network management device or a network management user, etc., and in this application is an OAM-agent (Operation Administration and Maintenance agent, operation management and maintenance agent).

Step S500: Receive the target authorization code sent by the blockchain system according to the second authentication request information. The target authorization code is determined by the blockchain system according to the user identity information in the second authentication request information. , generated according to the second authentication request information.

In one embodiment, after the second authentication request information is processed by the blockchain system, a target authorization code is obtained, wherein the target authorization code confirms that the authorization terminal is not registered according to the user identity information in the second authentication request information, Generated according to the second authentication request information, if the registration of the authorization terminal is confirmed according to the user identity information in the second authentication request information, the second authentication request information will be discarded, which facilitates the integration of various certificates, authentication process, and life cycle management.

Step S600: Send the target authorization code to the authorization end.

In an embodiment, the base station identity management client inputs the target authorization code obtained through step S500 into the device to be authorized, and completes the device authorization process.

As shown in FIG. 9, FIG. 9 is a flowchart of a base station access control method provided by an embodiment of the present application. The base station access control method includes but is not limited to steps S2300 to S2600.

Step S2300: Receive user authentication request information sent by the network management system. The user authentication request information is generated by the network management system upon receiving an access request from a network management user.

In one embodiment, the base station identity management server receives user authentication request information sent by the network manager, wherein the user authentication request information is generated by the network manager upon receiving an access request from a network manager user, and the access request of the network manager user is the user identity The query request is convenient for the identity management server of the base station and the authentication of the network management user by the blockchain system, and improves the accuracy of user access.

It should be noted that the access request of the network management user in this application is a professional network element management system (Element Management System, EMS) login user.

Step S2400: Send a query certificate request to the blockchain system, and the query certificate request is generated by the base station according to the user authentication request information.

In one embodiment, when the network management user requests access and sends an access request to the network management, user authentication request information is generated. After receiving the access request, the base station identity management server generates a query certificate request, which is convenient for the blockchain system to query Certificate request for query.

Step S2500: Obtain the identity certificate fed back by the blockchain system according to the query certificate request.

In one embodiment, according to the user authentication request information obtained in step S2300, a query certificate request is sent to the blockchain system, and the identity certificate returned by the blockchain system is obtained after the query of the blockchain system is completed, so as to facilitate subsequent base station identity management services The terminal reads the corresponding authorization code according to the identity certificate.

Step S2600: According to the difference between the verification authorization code from the network management and the target authorization code obtained from the identity certificate, send the verification result information for the network management user to the network management, wherein the verification authorization code corresponds to the network management user.

In one embodiment, the base station identity management server reads the target authorization code of the corresponding network management user in the identity certificate obtained in step S2500, and at the same time requests the network management for the verification authorization code of the network management user. If the network management user has an authorization code, Then send it back to the base station identity management server. The base station identity management server performs hash calculation on the verification authorization code and compares it with the target authorization code obtained from the blockchain query. When the verification authorization code is the same as the target authorization, it returns to the network management The verification is successful; if the network management user does not have a verification authorization code corresponding to the target authorization code in the network management, an empty string is returned to the network management, and the identity management server of the base station queries without authorization, and returns a verification failure, realizing multiple authentication of the network management user, reducing The management complexity of the base station identity management server.

As shown in FIG. 10 , FIG. 10 is a flowchart of a base station access control method provided by an embodiment of the present application. The base station access control method includes but is not limited to steps S700 to S900 .

Step S700: Obtain DNS certificate information from the blockchain system.

In one embodiment, the base station identity management client first sends a DNS proxy query request for DNS certificate information, and then after the DNS proxy returns the DNS certificate information to the base station identity management client, the base station identity management client and the DNS proxy act as a client as a whole Send the request DNS server certificate information to the blockchain system, and then receive the DNS server certificate information returned by the blockchain system, so that the identity management client of the base station can compare the certificate information with the TLSA record.

Step S800: Obtain the TLSA record associated with the DNS certificate information from the DNS.

In one embodiment, the base station identity management client requests DNS for the TLSA record associated with the DNS certificate information, and then the DNS returns the TLSA record to the base station management client according to the DNS certificate information, so that the base station identity management client can information for comparison.

It can be understood that the DANE protocol is used in DNS, and DANE defines a DNS resource record type TLSA, which is used to describe the statement associated with the certificate and the domain. Each TLSA record has three basic fields. When the base station wants to connect to When accessing a certain domain, you can use the TLSA record and apply the constraint when verifying the server's certificate to strengthen the control of the access domain.

Step S900: Verify the DNS certificate information according to the TLSA record.

In one embodiment, by using TLSA records to verify DNS certificate information, the strength of DNS verification is enhanced, that is, the source of DNS data is verified and the integrity of data is protected.

As shown in Fig. 11, Fig. 11 is a flowchart of a base station access control method provided by another embodiment of the present application, which is applied to a blockchain system. The base station access control method includes but is not limited to steps S1000 to S3000.

Step S1000: Receive first authentication request information sent by the base station, where the first authentication request information carries the identity certificate of the base station.

Step S2000: When the stored identity certificate is confirmed based on the first authentication request information, generate first identity certificate issuance information according to the identity certificate.

In one embodiment, the blockchain system judges whether the corresponding identity certificate has been saved according to the identity certificate carried by the first authentication request information, and if it is confirmed that the blockchain system stores the identity certificate corresponding to the first authentication request information , generating first identity certificate issuance information corresponding to the first authentication request information according to the identity certificate, thereby improving the accuracy of certificate configuration, and facilitating subsequent access to the gateway according to the first identity certificate issuance information.

It can be understood that when the blockchain system judges the first authentication request information, the judgment method is the same as the traditional CA registration review method, which is a common technical means for those skilled in the art, and will not be repeated here.

Step S3000: Send the first identity certificate issuance information for the access gateway to the base station.

In an embodiment, sending the first identity certificate issuance information to the identity management client of the base station facilitates the identity management client of the base station to access the gateway.

As shown in FIG. 12 , FIG. 12 is a flowchart of a base station access control method provided by another embodiment of the present application. The base station access control method includes but is not limited to steps S3100 to S3400 .

Step S3100: Receive the authorization processing request corresponding to the in-station equipment sent by the base station.

In one embodiment, the identity management client of the base station sends an authorization processing request corresponding to the equipment in the station to the blockchain system, wherein the authorization processing request carries the identity certificate corresponding to the equipment in the station, which is convenient for the management node to verify the equipment in the station, and improves Certificate security.

Step S3200: update the identity certificate according to the authorization processing request.

In one embodiment, the blockchain system obtains the authorization code of the on-site device or user according to the authorization processing request, judges the authorization code and the identity certificate, and performs an uplink operation on the authenticated identity certificate corresponding to the authorization code. The result of the chain operation updates the identity certificate to improve the efficiency of certificate configuration.

Step S3300: Generate second identity certificate issuance information according to the updated identity certificate.

Step S3400: Send the second identity certificate issuance information to the base station.

In one embodiment, the blockchain system generates the second identity certificate issuance information according to the updated identity certificate, and sends the identity certificate corresponding to the second identity certificate issuance information to the base station identity management client, so as to realize the unified life cycle management mode .

As shown in FIG. 13 , FIG. 13 is a flowchart of a base station access control method provided by another embodiment of the present application. The base station access control method includes but is not limited to steps S3500 to S3700 .

Step S3500: Receive the verification request sent by the gateway. The verification request is generated by the gateway according to the identity authentication access request from the base station, and the identity authentication access request carries the first identity certificate issuance information.

Step S3600: Verify the identity of the base station according to the verification request, and obtain the access verification result.

In one embodiment, according to the verification request sent by the gateway and the first identity certificate issuance information, the identity and device that sent the verification request are obtained, and the device and identity that send the identity authentication access request are verified to obtain the access verification result, which is convenient The base station accesses the gateway according to the access verification result.

It can be understood that the access verification result is that the blockchain system confirms the identity certificate of the base station according to the information issued by the first identity certificate, so as to find the corresponding base station.

Step S3700: Send the access verification result to the gateway, so that the base station accesses the gateway according to the access verification result.

In an embodiment, the access verification result obtained according to step S3600 is sent to the gateway, so that the base station can access the gateway according to the access verification result, and complete the process of authenticating the identity of the base station.

In an embodiment, in order to illustrate the identity authentication process of the base station access gateway more clearly, a specific example is given below for illustration.

As shown in FIG. 14 , FIG. 14 is a schematic diagram of a system framework of a base station access gateway provided in a specific example.

Example one:

The base station comes with a digital certificate when it leaves the factory, that is, the identity certificate, and the private key corresponding to the identity certificate is stored locally in the base station, and then the base station identity management client sends the certificate content and related identity information as the request content to the verification node on the chain (operator RA/CA), enter the state of waiting for the identity certificate to be issued; the verification node on the chain judges whether to save the user's identity certificate based on the information provided by the user after receiving the request. The identity certificate is added to the blockchain system through a consensus mechanism.

As shown in FIG. 15 , FIG. 15 is a flowchart of a base station access control method provided by another embodiment of the present application. The base station access control method includes but is not limited to steps S4000 to S6000 .

Step S4000: Receive the second authentication request information sent by the base station. The second authentication request information is generated by the base station according to the user identity authorization request from the authorizer, and the user identity authorization request carries the user identity information of the authorizer.

In one embodiment, the block chain system receives the second authentication request information, wherein the second authentication request information is generated according to the user identity authorization request from the authorization end, and the second authentication request information includes the authorization end user ID carried by the user identity authorization request. Identity information, which is convenient for the blockchain system to judge the authorization end based on the user identity information of the authorization end.

Step S5000: When it is confirmed according to the user identity information in the second authentication request information that the authorizing terminal is not registered, generate a target authorization code according to the second authentication request information.

In one embodiment, when it is confirmed that the authorized end is not registered according to the user identity information in the second authentication request information, the blockchain system splices a randomly generated serial number and the time when the second authentication request information is issued into a target authorization code, Then send the original text of the target authorization code back to the authorizing device, and store the hash value of the target authorization code in the authorized device list in the blockchain system. The authorized device list is used to store the hash value of the authorization code of the authorized device , to solve the problem of network management user authorization flooding at the authorization end, and improve the accuracy of network management user authorization.

It is understandable that a large number of identity certificates are stored in the blockchain system, including base station identity certificates, device identity certificates, or network management user identity certificates. The identity certificates carry the authorization code of the device or network management user, and the authorization code is written into the base station certificate The authorization list constitutes an authorized device list, wherein the authorized device list is a common technology for those skilled in the art, and will not be described in detail here.

It should be noted that, when it is confirmed according to the user identity information in the second authentication request information that the authorization terminal has been registered, the blockchain system discards the second authentication request information.

Step S6000: Send the target authorization code to the authorization end through the base station.

In one embodiment, when it is determined that the authorizing end is not registered, the base station identity management client sends the target authorization code to the authorizing end, wherein the authorizing end is the end that sends the user identity authorization request to implement the authorization operation on the authorizing end, Improve the reliability of the blockchain system.

In an embodiment, in order to illustrate the network management user authorization process more clearly, a specific example is given below for illustration.

As shown in FIG. 16 , FIG. 16 is a schematic diagram of a system framework for network management user authorization provided by a specific example.

Example two:

The identity certificate of the base station can authorize access to network management equipment, other equipment or identities accessing the base station. When authorizing, the initial base station identity management client completes the work of uploading the identity certificate to the block according to the authorized user information of the network management OAM-agent. The chain system sends an authorization request, and the blockchain system concatenates a randomly generated serial number and the time when the request is issued into a string, then sends the original text of the string back to the requesting device, and stores the hash value of the string into the block list of authorized devices in the chain certificate. Finally, the base station inputs the obtained character string into the device to be authorized, that is, the network management OAM-agent, and completes the device authorization process. The network management system can also query which users have been authorized and whether the authorization has expired.

As shown in FIG. 17 , FIG. 17 is a flowchart of a base station access control method provided by another embodiment of the present application. The base station access control method includes but is not limited to steps S3800 to S3900 .

Step S3800: Receive the certificate query request sent by the base station. The certificate query request is generated by the base station according to the user authentication request information sent by the network management. The user authentication request information is generated by the network management upon receiving the access request from the network management user.

In one embodiment, the blockchain system receives the query certificate request sent by the base station identity management server, wherein, when the network management user requests access and sends an access request to the network management, user authentication request information is generated, and the base station identity management server After receiving the access request, a query certificate request is generated, and the blockchain system receives the query certificate request to improve the accuracy of the network management user's certificate authentication.

Step S3900: Send the identity certificate to the base station according to the query certificate request, so that the base station sends the verification result information for the network management user to the network management according to the difference between the verification authorization code from the network management and the target authorization code obtained from the identity certificate, wherein , verify that the authorization code corresponds to the network management user.

In one embodiment, after receiving the query certificate request in step S3800, the blockchain searches the stored certificates, and returns the identity certificate corresponding to the query certificate request to the base station identity management server according to the search results, so that the base station identity The management server verifies the network management user according to the identity certificate.

It is understandable that a large number of identity certificates are stored in the blockchain system, including base station identity certificates, device identity certificates, or network management user identity certificates, among which the identity certificates carry the authorization code of the device or network management user.

In an embodiment, in order to illustrate the network management user authentication process more clearly, a specific example is given below for illustration.

As shown in FIG. 18 , FIG. 18 is a schematic diagram of a system framework for network management user authentication provided by a specific example.

Example three:

After the OAM-agent receives the EMS login user request, it sends a user identity query request to the identity management server module of the base station, and the server applies to the blockchain system for the identity certificate query request of the base station, and the blockchain system returns the certificate after querying. The base station identity management server reads the authorization code value of the corresponding network management user in the certificate, and at the same time requests the user's authorization code from the OAM-agent. If the user has an authorization code, it will send it back to the server, and the server will hash the string After calculation, it is compared with the authorization code obtained from the blockchain system query, and if the same, the authentication success is returned; if the user does not have an authorization string in the OAM-agent, an empty string is returned, and the server query is not authorized, and the authentication failure result is returned .

As shown in FIG. 19 , FIG. 19 is a flowchart of a base station access control method provided by another embodiment of the present application. The base station access control method includes but is not limited to step S7000 .

Step S7000: Send the DNS certificate information to the base station, so that the base station verifies the DNS certificate information according to the TLSA record associated with the DNS certificate information obtained from the DNS.

In one embodiment, the blockchain system stores the DNS server certificate information sent by the DNS server, and the base station identity management client first sends the query DNS certificate information to the DNS proxy, and then sends the DNS server certificate information request to the blockchain system, Send the DNS certificate information to the base station identity management client according to the DNS server certificate request, so that the base station identity management client can verify the DNS certificate information through TLSA.

In an embodiment, in order to illustrate the process of TLSA record configuration and DNS authentication more clearly, a specific example is given below for illustration.

As shown in FIG. 20, FIG. 20 is a schematic diagram of an architecture for verifying a server certificate according to a TLSA record provided by a specific example.

Example four:

The base station identity management client sends a request for querying DNS certificate information to the DNS agent, and sends a request for TLSA records to DNS, and the DNS agent sends a request for DNS server certificate information to the blockchain system according to the received DNS certificate information request, and the blockchain system query is completed Afterwards, the DNS server certificate information is returned to the DNS agent, and the identity management client of the base station compares the TLSA record obtained according to the DNS with the returned DNS server certificate information, obtains the result, and completes the verification of the server certificate.

In addition, an embodiment of the present application further provides a base station, where the base station includes: a memory, a processor, and a computer program stored in the memory and operable on the processor.

The processor and memory can be connected by a bus or other means.

As a non-transitory computer-readable storage medium, memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may include memory located remotely from the processor, which remote memory may be connected to the processor through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The non-transitory software programs and instructions required to implement the base station access control method of the above-mentioned embodiment are stored in the memory, and when executed by the processor, the base station access control method in the above-mentioned embodiment is executed, for example, the above-described Method steps S100 to S300 in FIG. 3, method steps S310 to S340 in FIG. 6, method steps S2100 to S2200 in FIG. 7, method steps S400 and S600 in FIG. 8, method steps S2300 to S2600 in FIG. 9, Method steps S700 and S900 in FIG. 10 .

In addition, an embodiment of the present application also provides a blockchain system, which includes: a memory, a processor, and a computer program stored in the memory and operable on the processor.

The processor and memory can be connected by a bus or other means.

As a non-transitory computer-readable storage medium, memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may include memory located remotely from the processor, which remote memory may be connected to the processor via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The non-transitory software programs and instructions required to implement the base station access control method of the above-mentioned embodiment are stored in the memory, and when executed by the processor, the base station access control method in the above-mentioned embodiment is executed, for example, the above-described Method steps S1000 to S3000 in FIG. 11 , method steps S3100 to S3400 in FIG. 12 , method steps S3500 to S3700 in FIG. 13 , method steps S4000 to S6000 in FIG. 15 , method steps S3800 to S3900 in FIG. 17 , Method step S7000 in FIG. 19 .

In addition, an embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by a processor or a controller, for example, by the above-mentioned Execution by a processor in the device embodiment can cause the above processor to execute the base station access control method in the above embodiment, for example, execute the method steps S100 to S300 in FIG. 3 and the method step S310 in FIG. 6 described above To S340, method steps S2100 to S2200 in Fig. 7, method steps S400 and S600 in Fig. 8, method steps S2300 to S2600 in Fig. 9, method steps S700 and S900 in Fig. 10, method steps S1000 in Fig. 11 To S3000, method steps S3100 to S3400 in Figure 12, method steps S3500 to S3700 in Figure 13, method steps S4000 to S6000 in Figure 15, method steps S3800 to S3900 in Figure 17, method steps S7000 in Figure 19 .

The embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The embodiment of the present application includes: a base station access control method applied to a base station, including: sending first authentication request information to the blockchain system, the first authentication request information carrying the identity certificate of the base station; obtaining the information sent by the blockchain system Issuing information of the first identity certificate, the first identity certificate issuing information is generated by the blockchain system according to the identity certificate under the condition of confirming the storage of the identity certificate based on the first authentication request information; the issuing information of the first identity certificate is accessed to the gateway. According to the solution provided by the embodiment of this application, since the first authentication request information sent by the base station itself carries the relevant identity certificate, when the blockchain system obtains the first authentication request information sent by the base station, it can simultaneously obtain the identity certificate of the base station. Identity certificate, so that in the case of confirming the stored identity certificate based on the first authentication request information, the blockchain system generates the first identity certificate issuance information and sends it to the base station to inform the base station that its identity certificate has been included in the blockchain system for management , and then the base station issues information to access the gateway according to the first identity, so as to implement access control of the base station and improve the effectiveness and correctness of certificate management.

Those skilled in the art can understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware and an appropriate combination thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit . Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those of ordinary skill in the art, the term computer storage media includes both volatile and nonvolatile media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. permanent, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage devices, or can Any other medium used to store desired information and which can be accessed by a computer. Furthermore, as is well known to those of ordinary skill in the art, communication media typically embody computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

The above is a specific description of several implementations of the present application, but the present application is not limited to the above-mentioned embodiments, and those skilled in the art can also make various equivalent deformations or replacements without violating the sharing conditions of the essence of the present application. Equivalent modifications or replacements are all within the scope defined by the claims of the present application.

Claims

A base station access control method applied to a base station, the method comprising:

Sending first authentication request information to the block chain system, the first authentication request information carrying the identity certificate of the base station;

Obtain the first identity certificate issuance information sent by the blockchain system, and the first identity certificate issuance information is confirmed by the blockchain system based on the first authentication request information to store the identity certificate , generated according to the identity certificate;

The information access gateway is issued according to the first identity certificate.
The base station access control method according to claim 1, wherein the issuing information access gateway according to the first identity certificate includes:

generating an identity authentication access request carrying the first identity certificate issuance information according to the first identity certificate issuance information;

sending the identity authentication access request to the gateway;

receiving an access verification result sent by the gateway according to the identity authentication access request, the access verification result being obtained by the blockchain system verifying the identity of the base station according to the verification request from the gateway, And send to the gateway, the verification request is generated by the gateway according to the identity authentication access request;

Access to the gateway according to the access verification result.
The base station access control method according to claim 1, wherein the base station includes in-station equipment; after acquiring the first identity certificate issuance information sent by the blockchain system, further comprising:

sending an authorization processing request corresponding to the on-site device to the blockchain system;

receiving the second identity certificate issuance information sent by the blockchain system, the second identity certificate issuance information is updated by the blockchain system according to the authorization processing request, and based on the updated The above identity certificate is obtained.
The base station access control method according to claim 1, further comprising:

Sending second authentication request information to the blockchain system, the second authentication request information is generated by the base station according to the user identity authorization request from the authorization end, and the user identity authorization request carries the user identity information of the authorization end;

Receive the target authorization code sent by the blockchain system according to the second authentication request information, the target authorization code is sent by the blockchain system according to the user identity in the second authentication request information When the information confirms that the authorization terminal is not registered, it is generated according to the second authentication request information;

sending the target authorization code to the authorizing end.
The base station access control method according to claim 1, wherein, after acquiring the first identity certificate issuance information sent by the blockchain system, further comprising:

receiving user authentication request information sent by the network manager, where the user authentication request information is generated by the network manager upon receiving an access request from a network management user;

Sending a query certificate request to the blockchain system, the query certificate request is generated by the base station according to the user authentication request information;

Obtain the identity certificate fed back by the blockchain system according to the query certificate request;

According to the difference between the verification authorization code from the network manager and the target authorization code obtained from the identity certificate, send the verification result information for the network management user to the network manager, wherein the verification authorization code is the same as Corresponding to the network management user.
The base station access control method according to claim 1, further comprising:

Obtain DNS certificate information from the blockchain system;

Obtaining a TLSA record associated with the DNS certificate information from DNS;

Verifying the DNS certificate information according to the TLSA record.
A base station access control method applied to a blockchain system, the method comprising:

receiving first authentication request information sent by the base station, where the first authentication request information carries the identity certificate of the base station;

In the case of confirming the storage of the identity certificate based on the first authentication request information, generating first identity certificate issuance information according to the identity certificate;

Sending the first identity certificate issuance information for the access gateway to the base station.
The base station access control method according to claim 7, wherein the base station includes in-station equipment; after sending the first identity certificate issuance information for the access gateway to the base station, further comprising:

receiving an authorization processing request corresponding to the in-station equipment sent by the base station;

updating the identity certificate according to the authorization processing request;

generating second identity certificate issuance information according to the updated identity certificate;

Send the second identity certificate issuance information to the base station.
The base station access control method according to claim 7, wherein, after sending the first identity certificate issuance information for the access gateway to the base station, further comprising:

receiving a verification request sent by the gateway, the verification request being generated by the gateway according to the identity authentication access request from the base station, the identity authentication access request carrying the first identity certificate issuance information;

Verifying the identity of the base station according to the verification request, and obtaining an access verification result;

Sending the access verification result to the gateway, so that the base station accesses the gateway according to the access verification result.
The base station access control method according to claim 7, further comprising:

receiving the second authentication request information sent by the base station, the second authentication request information is generated by the base station according to the user identity authorization request from the authorization end, the user identity authorization request carries the user identity information of the authorization end;

When it is confirmed according to the user identity information in the second authentication request information that the authorization terminal is not registered, generate a target authorization code according to the second authentication request information;

Sending the target authorization code to the authorization end through the base station.
The base station access control method according to claim 7, wherein, after sending the first identity certificate issuance information for the access gateway to the base station, further comprising:

receiving the certificate query request sent by the base station, the certificate query request is generated by the base station according to the user authentication request information sent by the network management, and the user authentication request information is generated by the network management after receiving the access request of the network management user generated under the circumstances;

Send the identity certificate to the base station according to the query certificate request, so that the base station sends the identity certificate to the base station according to the difference between the verification authorization code from the network management and the target authorization code obtained from the identity certificate The network management sends verification result information for the network management user, wherein the verification authorization code corresponds to the network management user.
The base station access control method according to claim 7, further comprising:

Sending the DNS certificate information to the base station, so that the base station verifies the DNS certificate information according to the TLSA record associated with the DNS certificate information obtained from the DNS.
A base station, comprising: a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein, when the processor executes the computer program, the computer program described in any one of claims 1 to 6 is implemented. Base station access control method.
A blockchain system, comprising: a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein, when the processor executes the computer program, any one of claims 7 to 12 is implemented. The base station access control method described in the item.
A computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to make a computer execute the base station access control method according to any one of claims 1 to 12 .