Network roaming authentication method, device, electronic device and storage medium

Abstract

The embodiments of the present invention relate to the field of communications, and disclose a network roaming authentication method, device, electronic device, and storage medium. In the present invention, the method includes: receiving an authentication request for a terminal to access a first network under a first deployment mode; wherein the terminal is a registered user of the first network under a second deployment mode; obtaining the original authentication data of the terminal, and generating first authentication information based on the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the first network specification under the first deployment mode; and feeding back the first authentication information to the first network under the first deployment mode, so that the first network under the first deployment mode can authenticate the terminal. By directly performing network roaming authentication based on the first authentication information of the original authentication data of the terminal through the roaming intercommunication device, simple, accurate, and efficient network roaming authentication is achieved without any changes to the existing network equipment.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular to a network roaming authentication method, device, electronic equipment and storage medium. Background Art

[0002] The 3rd Generation Partnership Project (3GPP) introduced the fifth generation (5G) mobile communication network. Telecom operators' 5G network deployment is divided into two modes: non-standalone (NSA) and standalone (SA). As the 5G network deployment process continues to accelerate, telecom operators' networks using NSA deployment mode face roaming and interoperability issues with telecom operators' networks using SA deployment mode.

[0003] The inventors have discovered that there are at least the following problems in the related art: when a 5G user in NSA deployment mode roams to a 5G network in SA deployment mode, authentication and registration cannot be completed and the user can only use the 4G network but not the 5G network. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a network roaming authentication method, device, electronic device and storage medium, which can realize simple and efficient network roaming authentication without any changes to existing network devices.

[0005] To solve the above technical problems, an embodiment of the present invention provides a network roaming authentication method, including: receiving an authentication request for a terminal to access a first network under a first deployment mode; wherein the terminal is a registered user of the first network under a second deployment mode; obtaining original authentication data of the terminal, and generating first authentication information based on the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the specifications of the first network under the first deployment mode; and feeding back the first authentication information to the first network under the first deployment mode, so that the first network under the first deployment mode can authenticate the terminal.

[0006] An embodiment of the present invention also provides a roaming intercommunication device, including: a receiving module, used to receive an authentication request for a terminal to access a first network under a first deployment mode; wherein the terminal is a registered user of the first network under a second deployment mode; a conversion module, used to obtain original authentication data of the terminal, and generate first authentication information based on the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the specifications of the first network under the first deployment mode; a communication module, used to feedback the first authentication information to the first network under the first deployment mode, so that the first network under the first deployment mode can authenticate the terminal.

[0007] An embodiment of the present invention also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned network roaming authentication method.

[0008] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned network roaming authentication method is implemented.

[0009] Compared with the prior art, the embodiment of the present invention generates authentication information that complies with the first network specification under the first deployment mode based on the original authentication data of the terminal when receiving a request from a registered terminal of the first network under the second deployment mode to access the first network under the first deployment mode, and feeds it back to the first network under the first deployment mode so that the first network under the first deployment mode can authenticate the terminal. The roaming intercommunication device directly generates the authentication information of the first network under the first deployment mode based on the original authentication data of the terminal so that the first network under the first deployment mode can implement access authentication for the terminal, which simplifies the process of generating authentication information and network roaming authentication, and realizes network roaming authentication for the roaming terminal to access the first network under the first deployment mode in a simple, efficient and accurate manner without making any changes to the existing network equipment.

[0010] In addition, obtaining the original authentication data of the terminal includes: detecting whether the original authentication data of the terminal exists in a pre-created authentication database; wherein the authentication database includes the original authentication data of multiple terminals imported in advance; if the original authentication data of the terminal exists in the authentication database, obtaining the original authentication data of the terminal from the authentication database. By importing the original authentication data of multiple terminals in advance into the authentication database, when the original authentication data of the terminal exists in the authentication database, directly reading the locally stored original authentication data simplifies the acquisition of the original authentication data, thereby improving the efficiency of generating the first authentication information.

[0011] In addition, obtaining the original authentication data of the terminal also includes: if the original authentication data of the terminal does not exist in the authentication database, obtaining the original authentication data of the terminal from the operator's BOSS system. By obtaining the original authentication data of the terminal from the operator's BOSS system when the original authentication data of the terminal is not stored locally, the flexibility of obtaining the original authentication data and the success rate of generating the first authentication information are improved.

[0012] In addition, before obtaining the original authentication data of the terminal from the operator's BOSS system, it also includes: detecting whether the terminal is within the jurisdiction of the device; if the terminal is within the jurisdiction of the device, obtaining the original authentication data of the terminal from the operator's BOSS system; if the terminal is not within the jurisdiction of the device, directly feeding back the authentication failure to the first network under the first deployment mode. By pre-assigning a jurisdiction to the device, the roaming intercommunication device processes the access request of the terminal that does not pre-store the original authentication data according to the jurisdiction, thereby improving the processing speed and flexibility of the device for the terminal access request.

[0013] In addition, generating the first authentication information according to the original authentication data of the terminal includes: generating a home environment authentication vector according to the original authentication data of the terminal; generating a service environment authentication vector according to the home environment authentication vector; using the home environment authentication vector and the service environment authentication vector as the first authentication information; wherein the home environment authentication vector and the service environment authentication vector refer to authentication vectors that comply with the first network specification under the first deployment mode. By directly generating the authentication vector of the first network under the first deployment mode according to the original authentication data, the generation efficiency of the first authentication information is improved.

[0014] In addition, the first network includes a 5G network; the first deployment mode is an independent deployment mode, and the second deployment mode is a non-independent deployment mode. By applying the network roaming authentication method between 5G networks in different deployment modes, 5G network roaming is achieved without making any changes to existing network devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0016] Figure 1 This is a schematic diagram of a service-based 5G network architecture in the prior art 3GPP;

[0017] Figure 2 This is an illustration of the NSA5G deployment method under the 5G network architecture in the existing technology. Figure 1 ;

[0018] Figure 3 This is an illustration of the NSA5G deployment method under the 5G network architecture in the existing technology. Figure 2 ;

[0019] Figure 4 It is a schematic diagram of SA5G deployment method under 5G network architecture in the prior art;

[0020] Figure 5 is a flow chart of a network roaming authentication method according to a first embodiment of the present invention;

[0021] Figure 6 is a flow chart of a network roaming authentication method according to a second embodiment of the present invention;

[0022] Figure 7 This is a schematic diagram of the process of generating the first authentication information in the second embodiment of the present invention. Figure 1 ;

[0023] Figure 8 This is a schematic diagram of the process of generating the first authentication information in the second embodiment of the present invention. Figure 2 ;

[0024] Fig. 9 is a schematic diagram of the structure of a roaming interworking device according to a third embodiment of the present invention;

[0025] Fig.10 FIG. 4 is a schematic structural diagram of an electronic device according to a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0026] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0027] At present, 3GPP has proposed a 5G network architecture based on service-oriented interfaces, such as Figure 1 As shown, the 5G network architecture includes a visited public land mobile network (VPLMN) and a home public land mobile network (HPLMN).

[0028] Among them, the Access and Mobility Management Function (AMF) is responsible for user mobility management and connection management. The Session Management Function (SMF) supports the establishment, modification, and release of 3GPP and Non-3GPP sessions, and is responsible for the allocation and management of UE IP addresses; unified control policy implementation and termination. The Authentication Server Function (AUSF) provides unified authentication for 3GPP and Non-3GPP access. Unified User Management (UDM) provides user contract data management and mobility management functions.

[0029] Telecom operators' 5G network deployment is divided into two types: non-standalone (NSA) and standalone (SA). Figure 2 and Figure 3 As shown, SA deployment is as follows Figure 4 shown.

[0030] For operators who choose NSA deployment to carry out 5G business, telecom operators provide users with 5G high-speed data services through the 4G core network (i.e. evolved core network). The user's security authentication and subscription data are provided by the Home Location Register (HLR) or Home Subscriber Server (HSS) of the 4G core network.

[0031] For operators who choose SA deployment to carry out 5G business, 5G services are provided to users through the deployed 5G core network. The user's security authentication is provided by the AUSF device of the 5G core network, and the user's contract data is provided by the UDM device of the 5G core network.

[0032] As the deployment of 5G networks continues to accelerate, telecom operators using NSA deployment methods face roaming and interoperability issues with telecom operators using SA deployment methods.

[0033] Telecom operator users under SA deployment mode can roam and register normally on the 5G network deployed in NSA mode through dual-mode terminals with 5G capabilities. However, when telecom operator users under NSA deployment mode roam and register on the 5G network deployed in SA mode through dual-mode terminals with 5G capabilities, they cannot call the AUSF authentication service and UDM registration service through the Hypertext Transfer Protocol (HTTP) of the 5G network service interface. As a result, 5G network users under NSA deployment mode can only use 4G network but not 5G network when roaming to the 5G network deployed in SA mode.

[0034] The first embodiment of the present invention relates to a network roaming authentication method, including: receiving an authentication request for a terminal to access a first network under a first deployment mode; wherein the terminal is a registered user of the first network under a second deployment mode; obtaining original authentication data of the terminal, and generating first authentication information based on the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the specifications of the first network under the first deployment mode; and feeding back the first authentication information to the first network under the first deployment mode, so that the first network under the first deployment mode can authenticate the terminal. The authentication information of the first network under the first deployment mode is generated by a roaming intercommunication device, so that the first network under the first deployment mode can implement access authentication for the terminal. By directly generating the first authentication information based on the original authentication information, a simple, accurate, and high-line network roaming authentication for the terminal is achieved without any changes to the existing network equipment.

[0035] The network roaming authentication method in this embodiment can be used to perform network roaming authentication between networks of the same generation under different deployment modes, and can also be used to perform network roaming authentication between different generation networks of terminal devices that have opened different generation networks. This embodiment takes the application of network roaming authentication between 5G networks with different deployment modes as an example to illustrate.

[0036] The implementation details of the network roaming authentication method of this embodiment are specifically described below. The following content is only for the convenience of understanding the implementation details and is not necessary for implementing this solution.

[0037] The specific process of a network roaming authentication method in this embodiment is as follows: Figure 5 As shown, the specific steps include:

[0038] Step 501: Receive an authentication request for a terminal to access a first network in a first deployment mode.

[0039] Specifically, after the terminal initiates an authentication and registration request to the device responsible for user security management, mobility management, and connection management in the first network under the first deployment mode, the first network under the first deployment mode initiates a service request to the roaming interoperability device, and the roaming interoperability device receives the authentication request for the terminal to access the first network under the first deployment mode; wherein the terminal is a registered user of the first network under the second deployment mode.

[0040] In an example, the first network is a 5G network, the first deployment mode is an independent deployment SA mode, the second deployment mode is a non-independent deployment NSA mode, and the terminal is a registered user of the 5G network under the NSA deployment mode that uses the second network, that is, the 4G network to implement 5G services. Then, after receiving the service request of the registered terminal of the 5G network under the NSA deployment mode, the AMF in the 5G network under the SA deployment mode initiates an authentication request to the roaming interoperability device, and the roaming interoperability device receives the authentication request initiated by the AMF for the terminal to access the 5G network under the SA deployment mode.

[0041] In addition, the first network may also be a 2G, 3G, 4G or higher generation mobile communication network, and the first deployment method and the second deployment method may also be a deployment method of any generation of mobile communication networks with different deployment methods.

[0042] In addition, the terminal in this embodiment may be at least one of the following: an LTE / NR multi-mode multi-standby terminal, or an LTE / NR multi-mode single-standby terminal.

[0043] Step 502: Generate first authentication information according to original authentication data of the terminal.

[0044] Specifically, after receiving an authentication request for a terminal to access a first network under a first deployment mode, the roaming intercommunication device determines the terminal corresponding to the authentication request based on the received authentication request, then obtains the original authentication data of the terminal, and generates first authentication information based on the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the first network specifications under the first deployment mode.

[0045] In one example, after a roaming interoperability device receives an authentication request for an access terminal from a first network under a first deployment mode, the roaming interoperability device generates a home environment authentication vector based on original authentication data of the terminal; generates a service environment authentication vector based on the home environment authentication vector; and uses the home environment authentication vector and the service environment authentication vector as first authentication information; wherein the home environment authentication vector and the service environment authentication vector refer to authentication vectors that comply with the specifications of the first network under the first deployment mode.

[0046] When obtaining the original authentication data of the terminal, it can be detected whether the original authentication data of the terminal exists in a pre-created authentication database; the authentication database includes the original authentication data of multiple terminals imported in advance; if the original authentication data of the terminal exists in the authentication database, the original authentication data of the terminal is obtained from the authentication database.

[0047] For example, the original authentication data may include the user number IMSI, the authentication key Ki, etc. After the roaming interoperability device receives the service request of the 5G network under the SA deployment mode, it detects that the original authentication data of the terminal exists in the authentication database, and reads the user number IMSI and the authentication key Ki of the terminal from the authentication database. Then, in order to ensure the smooth comparison of the authentication vector, according to the requirements of the 3GPP protocol, the separation bit of the authentication and authentication management domain input parameter AMF is set to 1, and the expected symbol response XRES, encryption key CK, integrity key IK and anonymous key AK are calculated according to the standard derivation function defined in the 3GPP protocol, the authentication key Ki and the random number RAND calculated by the random hash algorithm; the parameter symbol authentication code Kausf specified in the 3GPP protocol is calculated according to Ki, RAND, sequence number SQN and AMF.

[0048] Then, the RAND calculated by the random hash algorithm is used as the random number RAND in the 5G home environment authentication vector (5G HE AV); the authentication token AUTN in the 5G HE AV is calculated according to the SQN and the key derivation function (SQN⊕AK||AMF||MAC); the extended expected symbol response XRES* in the 5G HE AV is calculated by the key derivation function KDF (KDF(CK||IK,S)) according to the parameters FC, service network name SN, XRES, IK, CK and RAND specified in the 3GPP protocol; and the Kausf in the 5G HE AV is calculated by the key derivation function (CK||IK,S) according to IK, CK, FC, SN, SQN and AK. Among them, the key derivation function used in the calculation is the derivation function specified in the 3GPP protocol, which will not be repeated here.

[0049] Then use the random number RAND and authentication token AUTN in 5G HE AV as RAND and AUTN in 5G service environment authentication vector (5GSE AV), and then calculate the extended hash expected symbol corresponding HXRES* in 5GSE AV through SHA-256 hash algorithm according to XRES* and RAND in 5G HE AV; calculate Kseaf in 5G SE AV through key derivation function according to service network name SN, FC and Kausf in 5G HE AV. Then use the obtained 5G SE AV and 5G HE AV as the first authentication information. By obtaining the original authentication data of the terminal pre-imported in the device, and generating the first authentication information according to the original authentication data stored locally, the first authentication information can be generated directly locally, without making any changes to the existing network equipment, and avoiding interaction with the existing network equipment as much as possible, thereby improving the generation efficiency of the first authentication information.

[0050] In another example, when generating the first security authentication information according to the original authentication data of the terminal, the roaming interworking device first generates an authentication vector quintuple according to the original authentication data of the terminal; and then generates a first authentication vector according to the authentication vector quintuple.

[0051] For example, according to the requirements of the 3GPP protocol, the roaming interworking device sets the separation bit of the authentication management domain AMF to 1, calculates and generates the authentication vector quintuple {random number (RAND, Random challenge), expected symbol response (XRES, Expected Response), integrity key (IK, Integrity Key), encryption key (CK, Cipher Key), authentication token (AUTN, Authentication Token)}, and then calculates and generates 5G HE AV based on the authentication vector quintuple, and then further calculates and generates 5G SE AV based on 5G HE AV, and carries 5G SE AV in the first authentication information to generate the first authentication information. The generation method of 5G HE AV and 5G SE AV is roughly similar to the generation method in the previous example, so it will not be repeated here.

[0052] In addition, when obtaining the original authentication data of the terminal, if the original authentication data of the terminal does not exist in the authentication database, the original authentication data of the terminal is obtained from the operator's BOSS system. When the original authentication data of the terminal is not pre-stored locally, the original authentication data of the terminal is obtained from the operator's BOSS system to generate the first authentication information, thereby improving the flexibility of generating the first authentication information during the terminal access process and the probability of accurately generating the first authentication information.

[0053] Step 503: Feedback first authentication information for the first network in the first deployment mode to authenticate the terminal.

[0054] Specifically, after the roaming intercommunication device generates the first authentication information according to the original authentication data of the terminal, it feeds back the first authentication information to the first network under the first deployment mode, so that the first network under the first deployment mode can authenticate the terminal. Then, the first network under the first deployment mode completes the registration of the terminal in the first network under the first deployment mode according to the acquired registration information of the terminal, thereby connecting the terminal to the first network under the first deployment mode, and realizing the authentication and registration of the terminal roaming to the first network under the first deployment mode.

[0055] Because those skilled in the art are familiar with the subsequent security authentication and registration processes, this embodiment no longer describes the subsequent security authentication process of AMF and the subsequent registration process of UDM.

[0056] Therefore, this embodiment provides a network roaming authentication method, in which a roaming intercommunication device receives an authentication request for a terminal to access a first network under a first deployment mode, generates first authentication information based on the original authentication data of the terminal, and then completes the authentication of the terminal to access the first network under the first deployment mode through interaction with the first network under the first deployment mode. The roaming intercommunication device directly generates the first authentication information based on the original authentication data of the terminal, which simplifies the process of generating the first authentication information and improves the efficiency of generating the first authentication information. Without making any changes to the existing network equipment, efficient network roaming authentication of the terminal is completed; by combining the method of generating the first authentication information with real-time import of the original authentication data of the terminal, the flexibility of generating the authentication information and the probability of successfully generating the authentication information are improved.

[0057] The second embodiment of the present invention relates to a network roaming authentication method. The second embodiment is substantially the same as the first embodiment. In this embodiment, when the original data of the terminal is not pre-stored locally, it is detected whether the terminal is within the jurisdiction of the present device. If the terminal is not within the jurisdiction of the present device, a message of authentication failure is directly fed back to the first network under the first deployment mode, and the first network under the first deployment mode re-initiates authentication requests to the remaining devices. If the terminal is within the jurisdiction of the present device, the original authentication data of the terminal is imported from the operator, thereby improving the flexibility, accuracy and generation efficiency of the first authentication information generation.

[0058] The specific process of a network roaming authentication method in this embodiment is as follows: Figure 6 As shown, the specific steps include:

[0059] Step 601: Receive an authentication request for a terminal to access a first network in a first deployment mode.

[0060] Step 601 of this embodiment is substantially the same as step 501 of the first embodiment, and will not be described in detail herein.

[0061] Step 602, detect whether the original authentication data of the terminal exists in the pre-created authentication database, if the original authentication data of the terminal exists in the authentication database, proceed to step 605, if the original authentication data of the terminal does not exist in the authentication database, proceed to step 603.

[0062] Specifically, after receiving the authentication request for the terminal to access the first network under the first deployment mode, the roaming intercommunication device detects whether the original authentication data of the terminal exists in a pre-created authentication database; wherein the authentication database includes the original authentication data of multiple terminals imported in advance; if the original authentication data of the terminal exists in the authentication database, the process proceeds to step 605 to generate the first authentication information according to the pre-stored original authentication data; if the original authentication data of the terminal does not exist in the authentication database, the process proceeds to step 603.

[0063] In addition, when creating an authentication database, you can pre-assign jurisdictions to each roaming interoperability device, and import the original authentication data of multiple terminals within the jurisdiction of the roaming interoperability device into the roaming interoperability device through a cutting tool, a batch import device, or an IT / operator BOSS system, or when receiving an authentication request, batch import the original authentication data of multiple terminals into the authentication database at a preset time interval. And after establishing the authentication database, you can also import the original authentication data of the newly added terminal in the jurisdiction of the device after receiving an authentication request from a terminal requesting access or reaching a preset time interval, so as to update the data in the preset database.

[0064] Step 603, detect whether the terminal is within the jurisdiction of this device. If the terminal is within the jurisdiction of this device, proceed to step 604; if the terminal is not within the jurisdiction of this device, proceed to step 606.

[0065] Specifically, after the roaming interoperability device is set up, the jurisdiction is set for the roaming interoperability device. When the original authentication data of the terminal is not included in the authentication database of the roaming interoperability device, first check whether the terminal is within the jurisdiction of this device. If the terminal is within the jurisdiction of this device, enter step 603 to obtain the original authentication data of the terminal from the operator's BOSS system; if the terminal is not within the jurisdiction of this device, enter step 606 to forward the terminal's authentication request to the target device; the target device is the device that governs the terminal.

[0066] Step 604: Acquire the original authentication data of the terminal from the operator's BOSS system.

[0067] Specifically, after detecting that the terminal is a managed terminal of a roaming intercommunication device, the original authentication data of the terminal is requested from the operator's BOSS system. Based on the data returned by the operator's BOSS system, the original authentication data of the terminal is obtained from the operator's BOSS system and stored in a pre-created authentication database.

[0068] Step 605: Generate first authentication information according to the original authentication data of the terminal.

[0069] Among them, when generating the first authentication information, if the roaming intercommunication device has pre-stored the original authentication data of the terminal locally, the original authentication information of the terminal is obtained from the authentication database, and the first authentication information is generated according to the original authentication data of the terminal; if the original authentication data of the terminal is not pre-stored, the original authentication data imported by the operator's BOSS system is received and stored, and the first authentication information is generated according to the original authentication data obtained from the operator's BOSS system.

[0070] In one example, the pre-created authentication database contains the original authentication data of the terminal, and the roaming interworking device generates the first authentication information according to the original authentication data pre-stored locally. The flow chart of generating the first authentication information is as follows: Figure 7 As shown, it includes: storing the original authentication data of users imported in batches for authentication in the roaming intercommunication device, and then after the AMF in the 5G network under the SA deployment mode receives the service request of the terminal UE, the AMF initiates an authentication service call to the IWF; the IWF obtains the original authentication data of the user locally, and directly generates 5G security authentication information based on the original authentication data obtained from the pre-stored database.

[0071] In another example, the pre-created authentication database does not contain the original authentication data of the terminal, and the terminal is within the jurisdiction of the device. The roaming interworking device generates the first authentication information according to the original authentication data imported by the operator's BOSS system. The flow chart of generating the first authentication information is as follows: Figure 8 As shown, it includes: after the AMF in the 5G network under the SA deployment mode receives the service request of the terminal, the AMF initiates an authentication service call to the IWF; the IWF notifies the operator's BOSS system to import the original authentication data of the terminal, and then receives the original authentication data imported by the operator's BOSS system and stores the original authentication data obtained from the operator's BOSS system in the authentication database, and then calls the original authentication data of the terminal and generates 5G security authentication information according to the original authentication data of the terminal.

[0072] Step 606: Feedback authentication failure to the first network in the first deployment mode.

[0073] Specifically, when the terminal does not belong to the management scope of the current roaming intercommunication device, the roaming intercommunication device directly feeds back the authentication failure to the first network in the first deployment mode. Then the first network in the first deployment mode re-initiates the authentication request to the remaining roaming intercommunication devices. By directly feeding back the authentication failure when the terminal does not belong to the jurisdiction, the processing speed of the device for the authentication request is improved.

[0074] Step 607: Feedback first authentication information for the first network in the first deployment mode to authenticate the terminal.

[0075] Step 607 of this embodiment is substantially the same as step 503 of the first embodiment, and will not be described in detail herein.

[0076] Therefore, this embodiment provides a network roaming authentication method, which improves the processing efficiency of each roaming interoperability device when the terminal performs network roaming authentication by pre-allocating jurisdictions for roaming interoperability devices; performs corresponding processing on authentication requests according to the jurisdictions of the terminal and the roaming interoperability device, and forwards authentication requests from terminals that are not within the jurisdiction to the target device for processing, further improving the efficiency and flexibility of generating the first authentication information, and thereby improving the quality of terminal network roaming authentication.

[0077] In addition, those skilled in the art can understand that the step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the protection scope of this patent.

[0078] A third embodiment of the present invention relates to a roaming interworking device, such as Fig. 9 As shown, including:

[0079] The receiving module 901 is used to receive an authentication request for a terminal to access a first network in a first deployment mode; wherein the terminal is a registered user of the first network in a second deployment mode;

[0080] The conversion module 902 is used to obtain the original authentication data of the terminal and generate first authentication information according to the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the first network specification under the first deployment mode;

[0081] The communication module 903 is used to feed back first authentication information to the first network in the first deployment mode, so that the first network in the first deployment mode can authenticate the terminal.

[0082] In one example, the roaming intercommunication device also includes: a storage module 904, used to store the original authentication data of multiple terminals that have been pre-imported; a detection module 905, used to determine whether the original authentication data of the terminal has been pre-imported; and the communication module 903 is also used to obtain the original authentication data of the terminal from the operator's BOSS system when it is detected that the original authentication data of the terminal has not been pre-imported.

[0083] In another example, the detection module 905 is also used to detect whether the terminal is within the jurisdiction of this device, and the communication module 903 is used to obtain the original authentication data of the terminal from the operator's BOSS system when the terminal is within the jurisdiction of this device; when the terminal is not within the jurisdiction of this device, directly feedback the authentication failure to the first network under the first deployment mode.

[0084] In another example, the conversion module 902 is used to generate a home environment authentication vector based on the original authentication data of the terminal; generate a service environment authentication vector based on the home environment authentication vector; and use the home environment authentication vector and the service environment authentication vector as the first authentication information; wherein the home environment authentication vector and the service environment authentication vector refer to authentication vectors that comply with the first network specification under the first deployment mode.

[0085] In another example, the first network includes a 5G network; the first deployment mode is an independent deployment mode, and the second deployment mode is a non-independent deployment mode.

[0086] It is not difficult to find that this embodiment is a device embodiment corresponding to the first embodiment, and this embodiment can be implemented in conjunction with the first embodiment. The relevant technical details mentioned in the first embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the first embodiment.

[0087] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other units in this embodiment.

[0088] A fourth embodiment of the present invention relates to an electronic device, such as Fig.10As shown, it includes at least one processor 1001; and a memory 1002 that is communicatively connected to the at least one processor 1001; wherein the memory 1002 stores instructions that can be executed by the at least one processor 1001, and the instructions are executed by the at least one processor 1001 so that the at least one processor 1001 can execute the above-mentioned network roaming authentication method.

[0089] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0090] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0091] A fifth embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0092] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0093] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and that in actual applications, various changes may be made in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A network roaming authentication method, characterized in that: include: Receiving an authentication request for a terminal to access a first network in a first deployment mode; wherein the terminal is a registered user of the first network in a second deployment mode; Obtaining original authentication data of the terminal, and generating first authentication information according to the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the first network specification under the first deployment mode; Wherein, the obtaining of the original authentication data of the terminal includes: Detecting whether the original authentication data of the terminal exists in a pre-created authentication database; wherein the authentication database includes the original authentication data of multiple terminals imported in advance; If the original authentication data of the terminal exists in the authentication database, obtaining the original authentication data of the terminal from the authentication database; The first authentication information is fed back to the first network in the first deployment mode, so that the first network in the first deployment mode can authenticate the terminal.

2. The network roaming authentication method according to claim 1, characterized in that: The obtaining of original authentication data of the terminal further includes: If the original authentication data of the terminal does not exist in the authentication database, the original authentication data of the terminal is obtained from the operator's BOSS system.

3. The network roaming authentication method according to claim 2, characterized in that: Before obtaining the original authentication data of the terminal from the operator's BOSS system, the method includes: Detecting whether the terminal is within the jurisdiction of the device; If the terminal is within the jurisdiction of the device, the original authentication data of the terminal is obtained from the operator's BOSS system; If the terminal is not within the jurisdiction of the present device, the authentication failure will be directly fed back to the first network under the first deployment mode.

4. The network roaming authentication method according to claim 1, characterized in that: The generating first authentication information according to the original authentication data of the terminal includes: generating a home context authentication vector according to the original authentication data of the terminal; generating a service environment authentication vector according to the home environment authentication vector; using the home environment authentication vector and the service environment authentication vector as the first authentication information; The home environment authentication vector and the service environment authentication vector refer to authentication vectors that comply with the first network specification under the first deployment mode.

5. The network roaming authentication method according to any one of claims 1 to 4, characterized in that: The first network includes a 5G network; The first deployment method is an independent deployment method, and the second deployment method is a non-independent deployment method.

6. A roaming intercommunication device, characterized in that: include: A receiving module, configured to receive an authentication request for a terminal to access a first network in a first deployment mode; wherein the terminal is a registered user of the first network in a second deployment mode; a conversion module, used to obtain the original authentication data of the terminal, and generate first authentication information according to the original authentication data of the terminal; wherein the first authentication information refers to authentication information that complies with the first network specification under the first deployment mode, and the conversion module is specifically used to detect whether the original authentication data of the terminal exists in a pre-created authentication database; wherein the authentication database includes the original authentication data of multiple terminals imported in advance; if the original authentication data of the terminal exists in the authentication database, the original authentication data of the terminal is obtained from the authentication database; The communication module is used to feed back the first authentication information to the first network in the first deployment mode, so that the first network in the first deployment mode can authenticate the terminal.

7. The roaming interworking device according to claim 6, characterized in that: Also includes: A storage module, used for storing the original authentication data of multiple terminals imported in advance; A detection module, used to detect whether the original authentication data of the terminal has been pre-imported; The communication module is also used to obtain the original authentication data of the terminal from the operator's BOSS system when it is detected that the original authentication data of the terminal has not been pre-imported.

8. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network roaming authentication method according to any one of claims 1 to 5.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network roaming authentication method according to any one of claims 1 to 5 is implemented.

Images