Network access registration method and device and related equipment

Abstract

The invention provides a network access registration method and device and related equipment, and relates to the technical field of communication. The method comprises the steps that a network access registration request is sent to a home network, the network access registration request carries a user hidden identification code, and the user hidden identification code comprises a protection scheme identifier, a home network public key identifier and protection scheme output; the protection scheme output comprises an elliptic curve cryptographic algorithm public key of the user, a post-quantum ciphertext, a user identification code ciphertext and a message authentication code; and receiving a network access registration response returned by the home network. Through the technical means, the problem that the user network access registration safety cannot be guaranteed due to the fact that the quantum algorithm affects the user network access registration in the prior art is solved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a network registration method, apparatus, and related equipment. Background Art

[0002] The development of quantum computing hardware and algorithms poses a significant threat to information encrypted using traditional cryptographic algorithms, especially in network registration scenarios. If network registration is vulnerable, all subsequent communications will be insecure. Preventing the impact of quantum algorithms on user network registration and ensuring its security is a current research hotspot. Summary of the Invention

[0003] The present disclosure provides a network registration method, device, electronic device and computer-readable storage medium, which at least to a certain extent improve user security.

[0004] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0005] According to one aspect of the present disclosure, a network registration method is provided, which is applied to a user side and includes: sending a network registration request to a home network, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, the protection scheme output including the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and a message authentication code; and receiving a network registration response returned by the home network.

[0006] In one embodiment of the present disclosure, before sending the network registration request to the home network, the method further includes: when it is determined that the protection scheme adopted for generating the user hidden identification code is a hybrid protection scheme, determining the protection scheme identifier to be a hybrid protection scheme identifier; when it is determined that the protection scheme adopted for generating the user hidden identification code is a post-quantum protection scheme, determining the protection scheme identifier to be a post-quantum protection scheme identifier; when it is determined that the protection scheme adopted for generating the user hidden identification code is an elliptic curve protection scheme, determining the protection scheme identifier to be an elliptic curve protection scheme identifier; and composing the user hidden identification code based on the protection scheme identifier, the home network public key identifier, and the protection scheme output.

[0007] In one embodiment of the present disclosure, after determining that the protection scheme adopted for generating the user hidden identification code is a hybrid protection scheme, the method further includes: calculating a first key based on the user's elliptic curve cryptography algorithm private key and the elliptic curve cryptography algorithm public key of the home network; encrypting a randomly generated second key using the post-quantum cryptography algorithm public key of the home network to obtain a post-quantum ciphertext; calculating a shared key based on the first key and the second key; encrypting the user identification code using the shared key to obtain a user identification code ciphertext, and generating a message authentication code for the user identification code.

[0008] In one embodiment of the present disclosure, after determining that the protection scheme adopted for generating the user hidden identification code is a post-quantum protection scheme, the method further includes: encrypting a randomly generated second key using the post-quantum cryptographic algorithm public key of the home network to obtain a post-quantum ciphertext; encrypting the user identification code using the second key to obtain a user identification code ciphertext, and generating a message authentication code for the user identification code.

[0009] In one embodiment of the present disclosure, the method also includes: obtaining encryption-related information, wherein the encryption-related information includes user attribute information, business scenarios, post-quantum cryptographic algorithm support, and network environment; determining the security level of network registration based on the encryption-related information; and determining a protection plan based on the security level.

[0010] In one embodiment of the present disclosure, a protection scheme is determined according to the security level, including: when the security level is level one protection, determining the protection scheme to be a hybrid protection scheme; when the security level is level two protection, determining the protection scheme to be a post-quantum protection scheme; when the security level is level three protection, determining the protection scheme to be an elliptic curve protection scheme; when the security level is level four protection, determining not to adopt a protection scheme.

[0011] According to another aspect of the present disclosure, a network registration method is provided, which is applied to a home network side, and includes: receiving a network registration request from a user, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and message authentication code; completing the user's network registration based on the user hidden identification code, and returning a network registration response to the user.

[0012] In one embodiment of the present disclosure, completing the user's network registration based on the user's hidden identification code includes: when the protection scheme identifier is a hybrid protection scheme identifier, using the hybrid protection scheme to decrypt the user's hidden identification code to obtain the user identification code; when the protection scheme identifier is a post-quantum protection scheme identifier, using the post-quantum protection scheme to decrypt the user's hidden identification code to obtain the user identification code; when the protection scheme identifier is an elliptic curve protection scheme identifier, using the elliptic curve protection scheme to decrypt the user's hidden identification code to obtain the user identification code; completing the user's network registration based on the user identification code.

[0013] In one embodiment of the present disclosure, when the protection scheme identifier is a hybrid protection scheme identifier, the hybrid protection scheme is used to decrypt the user's hidden identification code to obtain a user identification code, including: querying the elliptic curve cryptography algorithm private key and the post-quantum cryptography algorithm private key of the home network according to the home network public key identifier; calculating a first key based on the user's elliptic curve cryptography algorithm public key and the elliptic curve cryptography algorithm private key of the home network; using the post-quantum cryptography algorithm private key of the home network to decrypt the post-quantum ciphertext to obtain a second key; calculating a shared key based on the first key and the second key, and using the shared key to decrypt the user identification code ciphertext to obtain the user identification code.

[0014] In one embodiment of the present disclosure, when the protection scheme identifier is a post-quantum protection scheme identifier, the post-quantum protection scheme is used to decrypt the user's hidden identification code to obtain the user identification code, including: querying the home network's post-quantum cryptographic algorithm private key based on the home network's public key identifier; using the home network's post-quantum cryptographic algorithm private key to decrypt the post-quantum ciphertext to obtain a second key; and using the second key to decrypt the user identification code ciphertext to obtain the user identification code.

[0015] In one embodiment of the present disclosure, completing the user's network registration based on the user identification code includes: verifying whether the user identification code is complete based on the message authentication code; if the verification is successful, completing the user's network registration based on the user identification code; if the verification is unsuccessful, determining that the user's network registration has failed.

[0016] According to another aspect of the present disclosure, a network registration device is provided, which is applied to a user side and includes: a sending module, configured to send a network registration request to a home network, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext and a message authentication code; and a first receiving module, configured to receive a network registration response returned by the home network.

[0017] According to another aspect of the present disclosure, a network registration device is provided, which is applied to a home network side and includes: a second receiving module, configured to receive a network registration request from a user, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext and message authentication code; a registration module, configured to complete the user's network registration based on the user hidden identification code and return a network registration response to the user.

[0018] According to another aspect of the present disclosure, an electronic device is provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above-mentioned network registration methods by executing the executable instructions.

[0019] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned network registration methods is implemented.

[0020] In the embodiments of the present disclosure, by carrying post-quantum ciphertext and user identification code ciphertext in the network registration request, the problem in the prior art that quantum algorithms affect user network registration, resulting in the lack of security guarantee for user network registration, is solved, thereby ensuring the security of network registration at the quantum level.

[0021] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0023] Figure 1 A schematic diagram showing the system architecture of the network registration method in an embodiment of the present disclosure.

[0024] Figure 2 A flow chart of a network registration method in one embodiment of the present disclosure is shown.

[0025] Figure 3 A flowchart of a hybrid protection scheme encryption method in one embodiment of the present disclosure is shown.

[0026] Figure 4 A flowchart of a post-quantum protection scheme encryption method in one embodiment of the present disclosure is shown.

[0027] Figure 5 A flowchart of another network registration method in an embodiment of the present disclosure is shown.

[0028] Figure 6 A flowchart of another hybrid protection scheme encryption method in an embodiment of the present disclosure is shown.

[0029] Figure 7 A flowchart of another post-quantum protection scheme encryption method in one embodiment of the present disclosure is shown.

[0030] Figure 8 A schematic diagram of a network registration device in an embodiment of the present disclosure is shown.

[0031] Figure 9 A schematic diagram showing another network registration device in an embodiment of the present disclosure is shown.

[0032] Figure 10 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0034] In addition, the accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0035] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0036] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0037] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0038] It should be pointed out that, in the absence of conflict, the embodiments of the present disclosure and the technical features therein may be combined with each other.

[0039] For ease of understanding, several terms involved in this disclosure are explained below: Subscription Concealed Identifier (SUCI): A one-time user identifier, also known as a subscription concealed identifier, that contains the plan output and additional non-concealed information required for home network routing and protection plan usage.

[0040] The Subscription Permanent Identifier (SUPI) corresponds to the user's hidden identification code. After encrypting the important information in the SUPI (such as the user identification code), it can be used as the user's hidden identification code.

[0041] Mobile Subscriber Identification Number (MSIN): Used to identify a unique user under a PLMN (Public Land Mobile Network). Together with the Mobile Country Code (MCC) and Mobile Network Code (MNC), it constitutes the SUPI.

[0042] Unified Data Management (UDM): Responsible for the management of user identification, contract data, authentication data, and user service network element registration.

[0043] Elliptic Curve Integrated Encryption Scheme (ECIES): is a public key encryption scheme based on Elliptic Curve Cryptography (ECC).

[0044] Post-Quantum cryptography (PQC): It is a new generation of cryptographic algorithms that can resist quantum computing attacks on existing cryptographic algorithms and ensure the security of cryptographic algorithms in quantum environments.

[0045] A Message Authentication Code (MAC) is a short data block used to verify the integrity and authenticity of a message. It is generated by combining a message and a key. Using the same key, the recipient can verify that the message has not been tampered with. A MAC is a crucial tool for ensuring data integrity and authentication in information security.

[0046] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0047] Figure 1 A schematic diagram showing the system structure of a network registration method in an embodiment of the present disclosure is provided. The system can apply the network registration method or network registration device in various embodiments of the present disclosure.

[0048] like Figure 1 As shown, the system architecture may include a user 101 and a home network 102. The user 101 may be an electronic device used by the user, including but not limited to a mobile phone, a computer, and a tablet, and the home network refers to the network to which the user is connected by default.

[0049] Figure 2 A flowchart of a network registration method according to an embodiment of the present disclosure is shown, which is applied to the user side. Figure 2 As shown, the following steps are included: S201: Send a network registration request to the home network, where the network registration request carries a hidden user identification code. The hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output. The protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and a message authentication code. S202: Receive a network registration response returned by the home network.

[0050] The user hidden identification code consists of the user permanent identification type, primary network identification, routing indication identification, protection scheme identification, home network public key identification and protection scheme output. The user permanent identification type is used to mark the type of SUPI, the primary network identification is used to distinguish different networks, the routing indication identification is used to indicate the transmission path of the incoming network registration request in the network, the protection scheme identification is used to distinguish the protection scheme used for encryption, and the home network public key identification is used to distinguish the public key of the home network used by the user (the home network has multiple pairs of public and private keys).

[0051] According to the technical solution provided by the embodiments of the present disclosure, a network registration request is sent to the home network, wherein the network registration request carries a hidden user identification code, which includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, wherein the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and a message authentication code; and a network registration response is received from the home network. This technical solution solves the problem in the prior art that quantum algorithms affect user network registration, resulting in a lack of security for user network registration, thereby ensuring network registration security at the quantum level.

[0052] In one embodiment of the present disclosure, when it is determined that the protection scheme adopted for generating the user hidden identification code is a hybrid protection scheme, the protection scheme identifier is determined to be a hybrid protection scheme identifier; when it is determined that the protection scheme adopted for generating the user hidden identification code is a post-quantum protection scheme, the protection scheme identifier is determined to be a post-quantum protection scheme identifier; when it is determined that the protection scheme adopted for generating the user hidden identification code is an elliptic curve protection scheme, the protection scheme identifier is determined to be an elliptic curve protection scheme identifier; the user hidden identification code is composed based on the protection scheme identifier, the home network public key identifier and the protection scheme output.

[0053] The embodiment of the present disclosure distinguishes different protection schemes through protection scheme identification, and subsequently uses the corresponding protection scheme for encryption and decryption to meet the needs in different situations.

[0054] Figure 3 A flowchart of a hybrid protection scheme encryption method according to an embodiment of the present disclosure is shown, which is applied to the user side. Figure 3 Shown, including: S301, calculating a first key based on the user's elliptic curve cryptography algorithm private key and the home network's elliptic curve cryptography algorithm public key; S302, encrypting the randomly generated second key using the post-quantum cryptographic algorithm public key of the home network to obtain a post-quantum ciphertext; S303, calculating a shared key based on the first key and the second key; S304: Encrypt the user identification code using the shared key to obtain a ciphertext of the user identification code, and generate a message authentication code for the user identification code.

[0055] The hybrid protection scheme uses two encryption methods, ECIES and PQC. First, a first key is calculated using elliptic curve cryptography based on the user's elliptic curve cryptography private key and the home network's elliptic curve cryptography public key. A second key is randomly generated and encrypted using the home network's post-quantum cryptography public key to produce a post-quantum ciphertext. The first and second keys are XORed to produce a shared key. The shared key is used to encrypt the user identification code to produce a user identification code ciphertext. A message authentication code is generated for the user identification code. The disclosed embodiments encrypt information using the hybrid protection scheme, providing dual protection for network registration.

[0056] Figure 4 A flowchart of a post-quantum protection scheme encryption method in one embodiment of the present disclosure is shown, which is applied to the user side. Figure 4 Shown, including: S401, encrypting a randomly generated second key using a post-quantum cryptographic algorithm public key of the home network to obtain a post-quantum ciphertext; S402: Encrypt the user identification code using the second key to obtain a ciphertext of the user identification code, and generate a message authentication code for the user identification code.

[0057] The post-quantum protection scheme uses PQC encryption. The second key is encrypted using the home network's post-quantum cryptography algorithm public key to produce post-quantum ciphertext, and the user identification code is then encrypted using the second key to produce user identification code ciphertext. The disclosed embodiments encrypt information using the post-quantum protection scheme, ensuring communication security at the quantum level.

[0058] In one embodiment of the present disclosure, when it is determined that the protection scheme adopted for generating a user hidden identification code is an elliptic curve protection scheme, a first key is calculated based on the user's elliptic curve cryptographic algorithm private key and the elliptic curve cryptographic algorithm public key of the home network; the user identification code is encrypted using the first key to obtain a user identification code ciphertext, and a message authentication code is generated for the user identification code.

[0059] The elliptic curve protection scheme uses ECIES encryption. The disclosed embodiment encrypts information through the elliptic curve protection scheme, improving efficiency under low communication security requirements.

[0060] In one embodiment of the present disclosure, encryption-related information is obtained, wherein the encryption-related information includes user attribute information, business scenarios, post-quantum cryptographic algorithm support, and network environment; the security level of network registration is determined based on the encryption-related information; and a protection plan is determined based on the security level.

[0061] Attribute information includes the user's occupation, gender, and age. The business scenario refers to the business that the user selects to register when registering on the network. The support for post-quantum cryptographic algorithms includes support and non-support. The network environment refers to the current status of the network when the user registers on the network. The higher the confidentiality level in the attribute information, the higher the security level; the higher the security requirements of the business scenario, the higher the security level; the support for post-quantum cryptographic algorithms is support, and the security level is level one protection or level one protection; the better the network environment, the higher the security level. The embodiment of the present disclosure determines the corresponding security level according to the situation, and then selects a protection scheme, providing multiple options for encryption and decryption to meet the needs of different situations.

[0062] In one embodiment of the present disclosure, a protection scheme is determined according to the security level, including: when the security level is level one protection, determining the protection scheme to be a hybrid protection scheme; when the security level is level two protection, determining the protection scheme to be a post-quantum protection scheme; when the security level is level three protection, determining the protection scheme to be an elliptic curve protection scheme; when the security level is level four protection, determining not to adopt a protection scheme.

[0063] Figure 5 A flowchart of another network registration method according to an embodiment of the present disclosure is shown, which is applied to the home network side. Figure 5 As shown, the following steps are included: S501: Receive a network registration request from a user, where the network registration request carries a hidden user identification code. The hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output. The protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and a message authentication code. S502: Complete the user's network registration based on the user's hidden identification code, and return a network registration response to the user.

[0064] A UDM unit may also be provided in the home network, and the above method may be executed by the UDM unit.

[0065] According to the technical solution provided by the embodiments of the present disclosure, a user's network registration request is received, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and message authentication code; the user's network registration is completed based on the hidden user identification code, and a network registration response is returned to the user. Through the above technical means, the problem in the prior art that quantum algorithms affect user network registration, resulting in a lack of security for user network registration, is solved, thereby ensuring network registration security at the quantum level.

[0066] In one embodiment of the present disclosure, completing the user's network registration based on the user's hidden identification code includes: when the protection scheme identifier is a hybrid protection scheme identifier, using the hybrid protection scheme to decrypt the user's hidden identification code to obtain the user identification code; when the protection scheme identifier is a post-quantum protection scheme identifier, using the post-quantum protection scheme to decrypt the user's hidden identification code to obtain the user identification code; when the protection scheme identifier is an elliptic curve protection scheme identifier, using the elliptic curve protection scheme to decrypt the user's hidden identification code to obtain the user identification code; completing the user's network registration based on the user identification code.

[0067] The embodiment of the present disclosure distinguishes different protection schemes through protection scheme identification, and subsequently uses the corresponding protection scheme for encryption and decryption to meet the needs in different situations.

[0068] Figure 6 A flowchart showing another hybrid protection scheme encryption method in one embodiment of the present disclosure is shown, which is applied to the home network side. Figure 6 Shown, including: S601, querying the elliptic curve cryptography algorithm private key and the post-quantum cryptography algorithm private key of the home network according to the home network public key identifier; S602, calculating a first key based on the user's elliptic curve cryptography algorithm public key and the home network's elliptic curve cryptography algorithm private key; S603, decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network to obtain a second key; S604: Calculate a shared key based on the first key and the second key, and use the shared key to decrypt the user identification code ciphertext to obtain the user identification code.

[0069] First, a first key is calculated using elliptic curve cryptography based on the user's elliptic curve cryptography public key and the home network's elliptic curve cryptography private key. The home network's post-quantum cryptography private key is used to decrypt the post-quantum ciphertext to obtain a second key. The first and second keys are XORed together to obtain a shared key, which is then used to decrypt the user identification code ciphertext to obtain the user identification code. This disclosed embodiment encrypts information using a hybrid protection scheme, providing dual security for network registration.

[0070] In one embodiment of the present disclosure, completing a user's network registration based on a hidden user identification code includes: using a primary network identifier and a user identification code to form a user's permanent identification code, where the primary network identifier includes a mobile country code and a mobile network code; and completing the user's network registration based on the user's permanent identification code.

[0071] Figure 7 A flowchart of another post-quantum protection scheme encryption method in one embodiment of the present disclosure is shown, which is applied to the home network side, such as Figure 7Shown, including: S701, querying the post-quantum cryptography algorithm private key of the home network according to the home network public key identifier; S702, decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network to obtain a second key; S703: Decrypt the user identification code ciphertext using the second key to obtain the user identification code.

[0072] The post-quantum ciphertext is decrypted using the home network's post-quantum cryptographic algorithm private key to obtain a second key. The user identification code ciphertext is decrypted using the second key to obtain the user identification code. This disclosed embodiment encrypts information using a post-quantum protection scheme, ensuring communication security at the quantum level.

[0073] In one embodiment of the present disclosure, when the protection scheme used to generate the hidden user identification code is determined to be an elliptic curve protection scheme, a first key is calculated based on the user's elliptic curve cryptography public key and the home network's elliptic curve cryptography private key. The first key is then used to decrypt the ciphertext of the user identification code to obtain the user identification code. This embodiment of the present disclosure utilizes an elliptic curve protection scheme to encrypt information, thereby improving efficiency while maintaining low communication security requirements.

[0074] In one embodiment of the present disclosure, completing the user's network registration based on the user identification code includes: verifying whether the user identification code is complete based on the message authentication code; if the verification is successful, completing the user's network registration based on the user identification code; if the verification is unsuccessful, determining that the user's network registration has failed.

[0075] In the embodiment of the present disclosure, when the message authentication code verification fails, it is directly determined that the user's network registration has failed, thereby improving the efficiency of network registration.

[0076] Based on the same inventive concept, the present disclosure also provides a network registration device, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0077] Figure 8 A schematic diagram of a network registration device according to an embodiment of the present disclosure is shown, which is applied to the home network side. Figure 8 As shown, the network registration device may include: The sending module 801 is configured to send a network registration request to the home network, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and message authentication code; The first receiving module 802 is configured to receive a network access registration response returned by the home network.

[0078] According to the technical scheme provided by the embodiments of the present disclosure, the network access registration request is sent to the home network, wherein the network access registration request carries a user hidden identifier, the user hidden identifier includes a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output includes an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identifier ciphertext and a message authentication code; and the network access registration response returned by the home network is received. Through the above technical means, the problem that the quantum algorithm affects the network access registration of the user and causes the network access registration security of the user to be not guaranteed in the prior art is solved, and the network access registration security is guaranteed at the quantum level.

[0079] In an optional embodiment, the sending module 801 is further configured to: when it is determined that the protection scheme adopted for generating the user hidden identifier is a hybrid protection scheme, determine that the protection scheme identifier is a hybrid protection scheme identifier; when it is determined that the protection scheme adopted for generating the user hidden identifier is a post-quantum protection scheme, determine that the protection scheme identifier is a post-quantum protection scheme identifier; and when it is determined that the protection scheme adopted for generating the user hidden identifier is an elliptic curve protection scheme, determine that the protection scheme identifier is an elliptic curve protection scheme identifier; and compose the user hidden identifier based on the protection scheme identifier, the home network public key identifier and the protection scheme output.

[0080] In some embodiments, the sending module 801 is further configured to: calculate a first key based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network; encrypt a second key randomly generated by using a post-quantum cryptography public key of the home network to obtain a post-quantum ciphertext; calculate a shared key based on the first key and the second key; encrypt the user identifier by using the shared key to obtain a user identifier ciphertext, and generate a message authentication code for the user identifier.

[0081] In some embodiments, the sending module 801 is further configured to: encrypt a second key randomly generated by using a post-quantum cryptography public key of the home network to obtain a post-quantum ciphertext; encrypt the user identifier by using the second key to obtain a user identifier ciphertext, and generate a message authentication code for the user identifier.

[0082] In some embodiments, the sending module 801 is further configured to: when it is determined that the protection scheme adopted for generating the user hidden identifier is an elliptic curve protection scheme, calculate a first key based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network; encrypt the user identifier by using the first key to obtain a user identifier ciphertext, and generate a message authentication code for the user identifier.

[0083] In some embodiments, the sending module 801 is further configured to obtain encryption-related information, wherein the encryption-related information includes the user's attribute information, business scenarios, post-quantum cryptographic algorithm support, and network environment; determine the security level of network registration based on the encryption-related information; and determine a protection plan based on the security level.

[0084] In some embodiments, the sending module 801 is further configured to, when the security level is level one protection, determine that the protection scheme is a hybrid protection scheme; when the security level is level two protection, determine that the protection scheme is a post-quantum protection scheme; when the security level is level three protection, determine that the protection scheme is an elliptic curve protection scheme; when the security level is level four protection, determine that no protection scheme is adopted.

[0085] Figure 9 A schematic diagram showing another network registration device according to an embodiment of the present disclosure is shown, which is applied to the home network side. Figure 9 As shown, the network registration device may include: The second receiving module 901 is configured to receive a network registration request from a user, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and message authentication code; The registration module 902 is configured to complete the user's network registration based on the user's hidden identification code and return a network registration response to the user.

[0086] According to the technical solution provided by the embodiments of the present disclosure, a user's network registration request is received, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and message authentication code; the user's network registration is completed based on the hidden user identification code, and a network registration response is returned to the user. Through the above technical means, the problem in the prior art that quantum algorithms affect user network registration, resulting in a lack of security for user network registration, is solved, thereby ensuring network registration security at the quantum level.

[0087] In some embodiments, the second receiving module 901 is further configured to, when the protection scheme identifier is a hybrid protection scheme identifier, use the hybrid protection scheme to decrypt the user's hidden identification code to obtain a user identification code; when the protection scheme identifier is a post-quantum protection scheme identifier, use the post-quantum protection scheme to decrypt the user's hidden identification code to obtain a user identification code; when the protection scheme identifier is an elliptic curve protection scheme identifier, use the elliptic curve protection scheme to decrypt the user's hidden identification code to obtain a user identification code; and complete the user's network registration based on the user identification code.

[0088] In some embodiments, the second receiving module 901 is further configured to query the elliptic curve cryptography algorithm private key and the post-quantum cryptography algorithm private key of the home network based on the home network public key identifier; calculate the first key based on the user's elliptic curve cryptography algorithm public key and the elliptic curve cryptography algorithm private key of the home network; use the post-quantum cryptography algorithm private key of the home network to decrypt the post-quantum ciphertext to obtain the second key; calculate the shared key based on the first key and the second key, and use the shared key to decrypt the user identification code ciphertext to obtain the user identification code.

[0089] In some embodiments, the second receiving module 901 is further configured to use the primary network identifier and the user identification code to form a user permanent identification code, where the primary network identifier includes a mobile country code and a mobile network code; and complete the user's network registration based on the user permanent identification code.

[0090] In some embodiments, the second receiving module 901 is further configured to query the post-quantum cryptography algorithm private key of the home network based on the home network public key identifier; use the post-quantum cryptography algorithm private key of the home network to decrypt the post-quantum ciphertext to obtain the second key; and use the second key to decrypt the user identification code ciphertext to obtain the user identification code.

[0091] In some embodiments, the second receiving module 901 is also configured to, when it is determined that the protection scheme used to generate the user hidden identification code is an elliptic curve protection scheme, calculate a first key based on the user's elliptic curve cryptographic algorithm public key and the elliptic curve cryptographic algorithm private key of the belonging network, and use the first key to decrypt the user identification code ciphertext to obtain the user identification code.

[0092] In some embodiments, the second receiving module 901 is further configured to verify whether the user identification code is complete based on the message authentication code; if the verification is successful, the user's network registration is completed based on the user identification code; if the verification fails, it is determined that the user's network registration has failed.

[0093] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods, or program products. Therefore, various aspects of the present disclosure may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as "circuits," "modules," or "systems."

[0094] Refer to the following Figure 10 1000 according to this embodiment of the present disclosure will be described. Figure 10 The electronic device 1000 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0095] like Figure 10 As shown, electronic device 1000 is implemented as a general-purpose computing device. Components of electronic device 1000 may include, but are not limited to, the aforementioned at least one processing unit 1010, the aforementioned at least one storage unit 1020, and a bus 1030 connecting various system components (including storage unit 1020 and processing unit 1010).

[0096] The storage unit stores program code, which can be executed by the processing unit 1010, causing the processing unit 1010 to perform the steps described in the "Exemplary Method" section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 1010 can perform the following steps of the aforementioned method embodiment: sending a network registration request to the home network, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, wherein the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and a message authentication code; and receiving a network registration response returned by the home network. The processing unit 1010 can also perform the following steps of the aforementioned method embodiment: receiving a user's network registration request, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, wherein the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and a message authentication code; completing the user's network registration based on the user hidden identification code, and returning a network registration response to the user.

[0097] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 10201 and / or a cache memory unit 10202 , and may further include a read-only memory unit (ROM) 10203 .

[0098] The storage unit 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0099] Bus 1030 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0100] Electronic device 1000 may also communicate with one or more external devices 1040 (e.g., a keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1000, and / or any device that enables electronic device 1000 to communicate with one or more other computing devices (e.g., a router, modem, etc.). This communication may occur via input / output (I / O) interface 1050. Furthermore, electronic device 1000 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via network adapter 1060. As shown, network adapter 1060 communicates with other modules of electronic device 1000 via bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with electronic device 1000, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0101] Through the description of the above embodiments, it will be readily understood by those skilled in the art that the example embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes several instructions for enabling a computing device (such as a personal computer, server, terminal device, or network device) to execute the methods according to the embodiments of the present disclosure.

[0102] In the disclosed exemplary embodiments, a computer-readable storage medium is also provided. The computer-readable storage medium may be a readable signal medium or a readable storage medium.

[0103] In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps of various exemplary implementations of the present disclosure described in the above "Specific Implementation Methods" section of this specification.

[0104] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0105] In the present disclosure, a computer readable storage medium can include a data signal transporting or broadcasting computer readable program code embodied in the carrier wave. Such computer readable program code can be transmitted or broadcasted as a carrier wave. Although specific dependencies are mentioned above, such division is not mandatory. Indeed, features and functions of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functions of one module or unit described above can be further divided into multiple modules or units.

[0106] Optionally, program code embodied on a computer readable storage medium can be transmitted by any data transmission techniques, including but not limited to wireless, wire line, optical cable, RF, etc., or any suitable combination of the above.

[0107] In practice, the functions of the disclosed embodiments can be implemented using one or more programmable computers or devices configured to perform particular tasks or implement particular abstract data types. Additionally, the disclosed embodiments can be implemented using a plurality of separate computers or devices to perform the described functions collectively or per individual computer or device. Alternatively, the disclosed embodiments can be implemented using a computer network or other data transfer mechanism or system. In some embodiments, the disclosed embodiments can be implemented using a combination of computer devices, a computer network, or other data transfer mechanisms or systems. In some embodiments, the disclosed embodiments can be implemented using a combination of computer devices, a computer network, or other data transfer mechanisms or systems.

[0108] The computer program product or computer program of the present disclosure includes computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the network registration method provided in any of the various optional manners in the embodiments of the present disclosure.

[0109] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory. Indeed, features and functions of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functions of one module or unit described above can be further divided into multiple modules or units.

[0110] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0111] Through the description of the above embodiments, it will be readily understood by those skilled in the art that the example embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes several instructions for enabling a computing device (such as a personal computer, server, mobile terminal, or network device) to execute the methods according to the embodiments of the present disclosure.

[0112] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope of the present disclosure being indicated by the appended claims.

Claims

1. A network registration method, applied to the user side, characterized in that: include: Sending a network registration request to the home network, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes the user's elliptic curve cryptography algorithm public key, post-quantum ciphertext, user identification code ciphertext, and message authentication code; Receive a network registration response returned by the home network.

2. The method according to claim 1, characterized in that Before sending the network registration request to the home network, the method further includes: When it is determined that the protection scheme adopted for generating the user hidden identification code is a hybrid protection scheme, determining that the protection scheme identifier is a hybrid protection scheme identifier; When it is determined that the protection scheme adopted to generate the user hidden identification code is a post-quantum protection scheme, determining that the protection scheme identifier is a post-quantum protection scheme identifier; When it is determined that the protection scheme adopted to generate the user hidden identification code is an elliptic curve protection scheme, the protection scheme identifier is determined to be an elliptic curve protection scheme identifier; A user hidden identification code is composed based on the protection scheme identifier, the home network public key identifier and the protection scheme output.

3. The method according to claim 2, characterized in that After determining that the protection scheme adopted for generating the hidden user identification code is a hybrid protection scheme, the method further includes: Calculating a first key based on the user's elliptic curve cryptography algorithm private key and the home network's elliptic curve cryptography algorithm public key; Encrypting the randomly generated second key using the post-quantum cryptographic algorithm public key of the home network to obtain a post-quantum ciphertext; Calculating a shared key based on the first key and the second key; The user identification code is encrypted using the shared key to obtain a user identification code ciphertext, and the message authentication code is generated for the user identification code.

4. The method according to claim 2, characterized in that After determining that the protection scheme adopted for generating the hidden user identification code is a post-quantum protection scheme, the method further includes: Encrypting the randomly generated second key using the post-quantum cryptographic algorithm public key of the home network to obtain the post-quantum ciphertext; The user identification code is encrypted using the second key to obtain the user identification code ciphertext, and the message authentication code is generated for the user identification code.

5. The method according to claim 2, characterized in that The method further comprises: Obtaining encryption-related information, wherein the encryption-related information includes attribute information of the user, business scenario, support status of post-quantum cryptographic algorithms, and network environment; Determining the security level of network registration based on the encryption-related information; The protection scheme is determined according to the security level.

6. The method according to claim 5, characterized in that Determining the protection scheme according to the security level includes: When the security level is level one protection, determining that the protection scheme is the hybrid protection scheme; When the security level is level 2 protection, determining that the protection scheme is the post-quantum protection scheme; When the security level is level three protection, determining that the protection scheme is the elliptic curve protection scheme; When the security level is level 4 protection, it is determined not to adopt the protection scheme.

7. A network registration method, applied to the home network side, characterized in that: include: Receive a network registration request from a user, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography algorithm public key of the user, a post-quantum ciphertext, a user identification code ciphertext, and a message authentication code; The network registration of the user is completed based on the hidden identification code of the user, and a network registration response is returned to the user.

8. The method according to claim 7, characterized in that Completing the network registration of the user based on the hidden identification code of the user includes: When the protection scheme identifier is a hybrid protection scheme identifier, the hybrid protection scheme is used to decrypt the user hidden identification code to obtain the user identification code; When the protection scheme identifier is a post-quantum protection scheme identifier, the user hidden identification code is decrypted using the post-quantum protection scheme to obtain the user identification code; When the protection scheme identifier is an elliptic curve protection scheme identifier, the user hidden identification code is decrypted using the elliptic curve protection scheme to obtain the user identification code; The user's network registration is completed based on the user identification code.

9. The method according to claim 8, characterized in that When the protection scheme identifier is a hybrid protection scheme identifier, the hybrid protection scheme is used to decrypt the hidden user identification code to obtain the user identification code, including: querying the elliptic curve cryptography algorithm private key and the post-quantum cryptography algorithm private key of the home network according to the home network public key identifier; Calculating a first key based on the user's elliptic curve cryptography algorithm public key and the home network's elliptic curve cryptography algorithm private key; Decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network to obtain a second key; A shared key is calculated based on the first key and the second key, and the user identification code ciphertext is decrypted using the shared key to obtain the user identification code.

10. The method according to claim 9, characterized in that When the protection scheme identifier is a post-quantum protection scheme identifier, decrypting the user hidden identification code using the post-quantum protection scheme to obtain the user identification code includes: querying the home network's post-quantum cryptography algorithm private key according to the home network's public key identifier; Decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network to obtain the second key; The user identification code ciphertext is decrypted using the second key to obtain the user identification code.

11. The method according to claim 9, characterized in that Completing the network registration of the user based on the user identification code includes: Verifying whether the user identification code is complete based on the message authentication code; If the verification is successful, the user's network registration is completed based on the user identification code; If the verification fails, it is determined that the user's network registration has failed.

12. A network registration device, applied to the user side, characterized in that: include: a sending module configured to send a network registration request to a home network, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography algorithm public key of the user, a post-quantum ciphertext, a user identification code ciphertext, and a message authentication code; The first receiving module is configured to receive a network registration response returned by the home network.

13. A network registration device, applied to the home network side, characterized in that: include: a second receiving module configured to receive a network registration request from a user, wherein the network registration request carries a hidden user identification code, the hidden user identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography algorithm public key of the user, a post-quantum ciphertext, a user identification code ciphertext, and a message authentication code; The registration module is configured to complete the network registration of the user based on the user hidden identification code and return a network registration response to the user.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network registration method according to any one of claims 1 to 6 and 7 to 11 is implemented.

Images