Authentication method, device, electronic device and medium

Abstract

The disclosed embodiments provide an authentication method, device, electronic device and medium, and relate to the field of communication technology. The method includes: periodically determining a target user identification set, the target user identification set includes multiple target user identifications; for each target user identification, obtaining the first authentication information corresponding to the target user identification, and storing the first authentication information in a first preset storage unit; in the case of receiving an authentication request, determining the user identification to be authenticated carried by the authentication request, and determining whether there is a second authentication information corresponding to the user identification to be authenticated in the first preset storage unit; in the case of the second authentication information in the first preset storage unit, feeding back the second authentication information. The method improves the efficiency of user authentication, reduces the concurrency pressure of the HSS server, and improves the user experience.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an authentication method, device, electronic device and medium. Background Art

[0002] 5G messages use SMS messages as the entry point and realize industry message interaction by supporting short videos, high-definition pictures, long texts, and voice communications. It breaks the length limit of traditional SMS messages. At the same time, it has the characteristics of not needing to download APP and account login, making it more interactive, multimedia, and lightweight. 5G messages are pushed and downloaded faster, and the gateway speed can reach 500 messages per second, so it can support massive data interaction and transmission.

[0003] On the basis of traditional SMS, 5G messages enhance multimedia interaction and the ability to transmit massive data. In the process of user interaction, in order to ensure the security of users and user data, users need to initiate an authentication request after the first registration and after sending a certain amount of messages, and the user's home server (Home Subscriber Server, HSS) generates authentication data and entrusts the Serving Call Session Control Function (Serving Call Session Control Function, S-CSCF) to perform the user authentication operation. However, if a large number of users make authentication requests at the same time or if too many interactive messages are sent between users, frequent access to the HSS is required. At this time, due to the large amount of concurrency, on the one hand, it may cause great performance pressure on the HSS, which is easy to cause service downtime, and on the other hand, it may easily cause network congestion and network message delays. In addition, the process of HSS calculating and generating authentication information is a relatively time-consuming process, which leads to low authentication efficiency. Terminal users may need to wait for a long time, which will also increase the instability of the system and affect the actual user experience.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The embodiments of the present disclosure provide an authentication method, device, electronic device and computer-readable storage medium, which can improve the efficiency of the authentication process, reduce the concurrency pressure faced by the HSS server, improve the real-time and robustness of the system, and improve the user experience.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, an authentication method is provided, including: periodically determining a target user identifier set, the target user identifier set including multiple target user identifiers; for each of the target user identifiers, obtaining first authentication information corresponding to the target user identifier, and storing the first authentication information in a first preset storage unit; in the case of receiving an authentication request, determining a user identifier to be authenticated carried by the authentication request, and determining whether second authentication information corresponding to the user identifier to be authenticated exists in the first preset storage unit; in the case where the second authentication information exists in the first preset storage unit, feeding back the second authentication information.

[0008] In some embodiments of the present disclosure, the method further includes: when the second authentication information does not exist in the first preset storage unit, requesting the second authentication information from a user home server and feeding back the second authentication information.

[0009] In some embodiments of the present disclosure, the target user identification set is generated according to the following process: counting the number of user identifications to be authenticated carried by the received authentication requests within a statistical period; at the end of the statistical period, screening the user identifications to be authenticated according to the number of the user identifications to be authenticated, and using the screened user identifications to be authenticated as target user identifications; generating a target user identification set based on the target user identifications.

[0010] In some embodiments of the present disclosure, counting the number of user identifiers to be authenticated carried by the received authentication and certification requests within a statistical period includes: when an authentication and certification request is received, determining the user identifier to be authenticated carried by the authentication and certification request; determining whether the user identifier to be authenticated exists in a second preset storage unit; if so, updating the number of user identifiers to be authenticated in the second preset storage unit; if not, writing the user identifier to be authenticated into the second preset storage unit and recording the number of user identifiers to be authenticated; repeating the above process until the statistical period ends.

[0011] In some embodiments of the present disclosure, at the end of the statistical period, the user identifiers to be authenticated are screened according to the number of the user identifiers to be authenticated, and the screened user identifiers to be authenticated are used as target user identifiers, including: at the end of the statistical period, determining the number of each user identifier to be authenticated in the second preset storage unit; sorting the user identifiers to be authenticated in order from large to small according to the number, and using the first M user identifiers to be authenticated as the target user identifiers.

[0012] In some embodiments of the present disclosure, the user identifiers to be authenticated are sorted in order from large to small according to the number, and the first M user identifiers to be authenticated are used as the target user identifiers, including: determining that there are N types of user identifiers to be authenticated in the second preset storage unit; when N is greater than a preset threshold M, sorting the N types of user identifiers to be authenticated in order from large to small according to the number, and using the first M user identifiers to be authenticated as the target user identifier; when N is less than or equal to M, using the N types of user identifiers to be authenticated as the target user identifier.

[0013] In some embodiments of the present disclosure, the second preset storage unit is provided with a first user identification set and a second user identification set;

[0014] The counting of the number of user identifiers to be authenticated carried by the received authentication request within the statistical period includes: determining the priority of the user corresponding to the user identifier to be authenticated; when it is determined that the priority of the user is the first priority, writing the user identifier to be authenticated into the first user identifier set; when it is determined that the priority of the user is the second priority, determining whether the user identifier to be authenticated is included in the second user identifier set; if so, updating the number of user identifiers to be authenticated in the second user identifier set; if not, writing the user identifier to be authenticated into the second user identifier set and recording the number of user identifiers to be authenticated;

[0015] The determining of the target user identification set includes: if it is determined that there is an available first user identification set, using the available first user identification set as the target user identification set; if it is determined that there is no available first user identification set, using the available second user identification set as the target user identification set.

[0016] In some embodiments of the present disclosure, the method further includes: configuring a third user identification set; and when it is determined that there is no available second user identification set, using the third user identification set as the target user identification set.

[0017] In some embodiments of the present disclosure, the method further includes: acquiring a historical first user identification set and / or a historical second user identification set; and updating the third user identification set according to the historical first user identification set and / or the historical second user identification set.

[0018] According to another aspect of the present disclosure, an authentication device is provided, including: a determination module, used to periodically determine a target user identifier set, wherein the target user identifier set includes multiple target user identifiers; an acquisition module, used to acquire, for each of the target user identifiers, first authentication information corresponding to the target user identifier, and store the authentication information in a first preset storage unit; a judgment module, used to, when receiving an authentication request, determine the user identifier to be authenticated carried by the authentication request, and determine whether there is second authentication information corresponding to the user identifier to be authenticated in the first preset storage unit; and a feedback module, used to feedback the second authentication information when the second authentication information exists in the first preset storage unit.

[0019] In some embodiments of the present disclosure, the acquisition module is further used to: request the second authentication information from the user home server and feed back the second authentication information when the second authentication information does not exist in the first preset storage unit.

[0020] In some embodiments of the present disclosure, the device also includes a generating module, which is used to: count the number of user identifiers to be authenticated carried by the received authentication requests within a statistical period; at the end of the statistical period, filter the user identifiers to be authenticated according to the number of user identifiers to be authenticated, and use the filtered user identifiers to be authenticated as target user identifiers; and generate a target user identifier set based on the target user identifiers.

[0021] In some embodiments of the present disclosure, the generation module is also used to: when receiving an authentication request, determine the user identifier to be authenticated carried by the authentication request; determine whether the user identifier to be authenticated exists in a second preset storage unit; if so, update the number of user identifiers to be authenticated in the second preset storage unit; if not, write the user identifier to be authenticated into the second preset storage unit and record the number of user identifiers to be authenticated; repeat the above process until the statistical period ends.

[0022] In some embodiments of the present disclosure, the generation module is also used to: determine the number of each user identifier to be authenticated in the second preset storage unit at the end of the statistical period; sort the user identifiers to be authenticated in order from large to small according to the number, and use the first M user identifiers to be authenticated as the target user identifiers.

[0023] In some embodiments of the present disclosure, the generation module is also used to: determine that there are N types of user identifiers to be authenticated in the second preset storage unit; when N is greater than a preset threshold M, sort the N types of user identifiers to be authenticated in order from large to small, and use the first M user identifiers to be authenticated as the target user identifiers; when N is less than or equal to M, use the N types of user identifiers to be authenticated as the target user identifiers.

[0024] In some embodiments of the present disclosure, a first user identification set and a second user identification set are provided in the second preset storage unit; the generating module is further used to: determine the priority of the user corresponding to the user identification to be authenticated; if it is determined that the priority of the user is the first priority, write the user identification to be authenticated into the first user identification set; if it is determined that the priority of the user is the second priority, determine whether the user identification to be authenticated is included in the second user identification set; if so, update the number of the user identification to be authenticated in the second user identification set; if not, write the user identification to be authenticated into the second user identification set, and record the number of the user identification to be authenticated;

[0025] The determination module is further configured to: when it is determined that there is an available first user identification set, use the available first user identification set as a target user identification set; when it is determined that there is no available first user identification set, use the available second user identification set as a target user identification set.

[0026] In some embodiments of the present disclosure, the apparatus further includes a configuration module, configured to: configure a third user identification set;

[0027] The determination module is further configured to use the third user identification set as the target user identification set when it is determined that the second user identification set is not available.

[0028] In some embodiments of the present disclosure, the device also includes an updating module, which is used to: obtain a historical first user identification set and / or a historical second user identification set; and update the third user identification set based on the historical first user identification set and / or the historical second user identification set.

[0029] According to another aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; and a storage device configured to store one or more programs, so that when the one or more programs are executed by the one or more processors, the one or more processors implement the methods described in the above embodiments.

[0030] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described in the above embodiments is implemented.

[0031] The authentication method provided by the embodiment of the present disclosure determines a target user identification set including multiple target user identifications, and then obtains the first authentication information corresponding to each target user identification in the target user identification set, thereby constructing a processing flow for independently and parallelly obtaining authentication information without relying on a physical terminal, thereby solving the problem of low real-time performance, limited efficiency and performance caused by serially obtaining authentication information in related technologies. The authentication method provided by the embodiment of the present disclosure determines the user identification to be authenticated carried by the authentication request when receiving an authentication request, and determines whether there is a second authentication information corresponding to the user identification to be authenticated in the first preset storage unit; when the second authentication information exists in the first preset storage unit, the first authentication information is directly fed back, thereby saving the step of requesting authentication information from the HSS server, improving the efficiency of the authentication process, reducing the concurrency pressure faced by the HSS server, improving the real-time performance and robustness of the system, and improving the user experience.

[0032] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0034] Figure 1 The flowchart of authentication in the related technology is shown;

[0035] Figure 2 A flow chart of an authentication method according to an embodiment of the present disclosure is shown;

[0036] Figure 3 The following schematically shows a timing diagram of an authentication method according to an embodiment of the present disclosure;

[0037] Figure 4 A sub-flow chart of an authentication method according to another embodiment of the present disclosure is shown;

[0038] Figure 5 A sub-flow chart of an authentication method according to another embodiment of the present disclosure is shown;

[0039] Figure 6 A sub-flow chart of the authentication method of the embodiment of the present disclosure is shown;

[0040] Figure 7 A schematic diagram showing the structure of an authentication device according to an embodiment of the present disclosure is shown;

[0041] Figure 8 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0042] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0043] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0044] In order to make the technical solution of the present disclosure clearer, the 5G message service authentication process is described below.

[0045] 5G messaging services belong to the IMS (IP Multimedia Subsystem) service category, such as Figure 1 As shown in the figure, the main process of authentication includes:

[0046] (1) The user terminal UE initiates a registration request or an authentication request to the Proxy Call Session Control Function (P-CSCF);

[0047] (2) The P-CSCF network element routes the registration request or authentication request to the Interrogatin Call Session Control Function (I-CSCF) according to the Request-URI carried in the registration request or authentication request. The I-CSCF network element obtains the S-CSCF information that can serve the user from the Home Subscriber Server (HSS) and forwards the registration request or authentication request to the S-CSCF network element.

[0048] (3) Since the user is not currently registered in the S-CSCF network element, it is necessary to set RegistrationFlag(pending) to the HSS to indicate that registration is in progress. The S-CSCF uses the user's IMSI as a keyword to request authentication information from the HSS, such as the authentication five-element vector, including RAND, AUTH, XRES, CK, and IK.

[0049] (4) The S-CSCF network element stores all authentication information and sends the authentication information to the I-CSCF network element through a response message (e.g., 401 message) of the Session Initialization Protocol (SIP), which then forwards the authentication information to the P-CSCF network element.

[0050] (5) After receiving the response message of the session initiation protocol, the P-CSCF network element forwards the authentication information to the UE.

[0051] For the above process, if a large number of users make authentication requests at the same time or if too many interactive messages are sent between users, the HSS needs to be accessed frequently. At this time, due to the large concurrency, on the one hand, it may cause great performance pressure on the HSS, which may easily cause service downtime, and on the other hand, it may easily cause network congestion and network message delays. In addition, the process of HSS calculating and generating authentication information is a relatively time-consuming process, which leads to low authentication efficiency. End users may need to wait for a long time, which will also increase the instability of the system and affect the actual user experience.

[0052] For the above problem, the related technology is to take out a set of authentication vectors for use after an actual terminal user initiates a registration authentication request and receives a specified number of authentication information, and store the remaining authentication vectors in the S-CSCF cache for subsequent use. However, the related technology only requests and caches the authentication information required by the terminal user from the HSS after an actual terminal user initiates the authentication process. The entire processing flow is a serial process and is limited by the current actual terminal user, resulting in a relatively low efficiency in obtaining authentication information. The problem of long terminal user authentication time under large concurrency still exists.

[0053] To solve this technical problem, the embodiment of the present disclosure provides an authentication method, optimizes the authentication information request process, adds an independent and parallel processing strategy for authentication information that is independent of the physical terminal, greatly improves the request efficiency of authentication information and the authentication efficiency of terminal users, effectively reduces the performance pressure of the HSS server, and improves the stability and robustness of the system under large traffic.

[0054] Figure 2 and Figure 3 FIG. 1 is a flow chart showing an authentication method according to an embodiment of the present disclosure. Figure 2 and Figure 3 As shown, the method may include:

[0055] Step S201: periodically determine a target user identification set, where the target user identification set includes multiple target user identifications.

[0056] Step S202: for each target user identifier, based on the user home server, obtaining the authentication information corresponding to the target user identifier, and storing the authentication information in a first preset storage unit.

[0057] Among them, the target user identification set can be generated in real time according to a preset policy. The target user corresponding to the target user identification in the target user identification set has the need for authentication and certification. Therefore, the authentication and certification information required by the target user can be obtained in advance and stored in the first preset storage unit, so that when the authentication and certification request of the target user is received, the corresponding authentication and certification information can be directly obtained from the first preset storage unit quickly, saving the step of requesting the authentication and certification information from the HSS server, saving time, improving the efficiency of authentication and certification, and reducing the concurrency pressure of the HSS server when a large number of users are performing authentication and certification at the same time.

[0058] The user identifier may be an International Mobile Subscriber Identity (IMSI). The International Mobile Subscriber Identity is an identification code used to distinguish different users in a cellular network and is not repeated in all cellular networks. In an optional embodiment, the user identifier may also be a mobile phone number. The authentication information may include an authentication five-element vector, including RAND, AUTH, XRES, CK, and IK. The first preset storage unit may be a cache of an S-CSCF network element, or may be another cache unit or storage unit, which is not limited in the present disclosure.

[0059] Steps S201-S202 may be executed periodically, and the execution period may be flexibly set according to the application scenario, which is not limited in the present disclosure.

[0060] Step S203: when receiving an authentication request, determining the user identifier to be authenticated carried in the authentication request, and determining whether there is second authentication information corresponding to the user identifier to be authenticated in the first preset storage unit.

[0061] Step S204: if the second authentication information exists in the first preset storage unit, the second authentication information is fed back.

[0062] Step S205: When the second authentication information does not exist in the first preset storage unit, request the second authentication information from the user home server and feed back the second authentication information.

[0063] The authentication method provided by the embodiment of the present disclosure determines a target user identification set including multiple target user identifications, and then obtains the first authentication information corresponding to each target user identification in the target user identification set, thereby constructing an independent parallel processing flow for obtaining authentication information that does not rely on the physical terminal, thereby solving the problem of low real-time performance, limited efficiency and performance caused by serially obtaining authentication information in the related technology. The authentication method provided by the embodiment of the present disclosure determines the user identification to be authenticated carried by the authentication request when receiving the authentication request, and determines whether there is a second authentication information corresponding to the user identification to be authenticated in the first preset storage unit; when the second authentication information exists in the first preset storage unit, the second authentication information is directly fed back, thereby improving the efficiency of the authentication process, reducing the concurrency pressure faced by the HSS server, improving the real-time and robustness of the system, and improving the user experience. When the second authentication information does not exist in the first preset storage unit, the second authentication information is requested from the HSS server to ensure that the user can obtain the required authentication information in a timely manner.

[0064] In some embodiments of the present disclosure, the authentication method may be executed by an S-CSCF network element as an execution entity.

[0065] In some embodiments of the present disclosure, Figure 4 As shown, the target user identification set can be generated according to the following process:

[0066] Step S401: Counting the number of user identifiers to be authenticated carried in the received authentication requests within a statistical period;

[0067] Step S402: at the end of the statistical period, the user identifiers to be authenticated are screened according to the number of the user identifiers to be authenticated, and the screened user identifiers to be authenticated are used as target user identifiers;

[0068] Step S403: Generate a target user identifier set according to the target user identifier.

[0069] The number of user identifiers counted (i.e., the number of authentication requests received) can indicate the frequency of user 5G message interaction and the degree of user demand for authentication information. The more user identifiers counted, the higher the frequency of 5G message interaction and the higher the demand for authentication information. Therefore, the target user identifiers can be screened according to the number of user identifiers counted to generate a target user identifier set.

[0070] In the embodiment of the present disclosure, the target user identifier can be determined according to the number of user identifiers, that is, the user's demand for authentication information can be determined according to the user's 5G message interaction frequency, thereby determining the target user, realizing on-demand control of the frequency of asynchronous acquisition of terminal user authentication information, and improving the utilization rate of the first authentication information in the first preset storage unit, thereby achieving further optimization of the authentication efficiency and better reducing the concurrency pressure of the user's belonging server.

[0071] In some embodiments of the present disclosure, Figure 5 As shown, the process of counting the number of user identifiers to be authenticated carried by the received authentication request in step S401 within the statistical period includes:

[0072] Step S501: upon receiving an authentication request, determining a user identifier to be authenticated carried in the authentication request.

[0073] Step S502: Determine whether the user identification to be authenticated exists in the second preset storage unit.

[0074] Step S503: If so, update the number of the to-be-authenticated user identifiers in the second preset storage unit.

[0075] Step S504: If not, the user identification to be authenticated is written into the second preset storage unit, and the number of the user identification to be authenticated is recorded.

[0076] Step S505: Determine whether the statistical period has ended; if so, execute step S506; if not, execute step S501.

[0077] Step S506: When the statistical period ends, based on the number of the user identifiers to be authenticated, the user identifiers to be authenticated stored in the second preset storage unit are screened, and the screened user identifiers to be authenticated are used as the target user identifiers to generate the target user identifier set.

[0078] The authentication request in this embodiment can be any one of the received authentication requests, and the authentication request can be the authentication request described in step S203 above. The second preset storage unit is used to store the received user identifiers to be authenticated and record the number of each user identifier to be authenticated. At the end of the statistical period, the number of each user identifier to be authenticated is calculated, the user identifiers to be authenticated stored in the second preset storage unit are screened, and the screened user identifiers to be authenticated are used as target user identifiers, thereby generating a target user identifier set.

[0079] In some embodiments of the present disclosure, step S506 may include: at the end of the statistical period, determining the number of each user identifier to be authenticated in the second preset storage unit; sorting the user identifiers to be authenticated in order from large to small according to the number, and taking the first M user identifiers to be authenticated as the target user identifiers, where M is a positive integer.

[0080] In some other embodiments of the present disclosure, step S506 may include:

[0081] Determine that there are N types of user identifiers to be authenticated in the second preset storage unit, where N is a positive integer;

[0082] When N is greater than a preset threshold value M, determine the number of each user identifier to be authenticated, sort the N user identifiers to be authenticated in descending order of the number, and use the first M user identifiers to be authenticated as the target user identifiers;

[0083] When N is less than or equal to M, the N types of user identifiers to be authenticated are used as the target user identifiers.

[0084] Among them, the preset threshold M can be flexibly set according to scene requirements, and the present disclosure does not limit it here.

[0085] In some embodiments of the present disclosure, steps S401 to 406 may be executed periodically, and the execution period may be flexibly set according to scenario requirements, which is not limited in the present disclosure.

[0086] In some embodiments of the present disclosure, while counting the user identifiers to be authenticated, the users corresponding to the user identifiers to be authenticated can be prioritized according to the user attributes, and the user identifiers to be authenticated corresponding to the users with high requirements for authentication information can be classified into a high priority set, so that the authentication information required by the users with high requirements for authentication information can be preferentially stored in the first preset storage unit. In other optional embodiments, VIP users and ordinary users can also be determined according to user attributes, and the user identifiers to be authenticated corresponding to the VIP users can be classified into a high priority set.

[0087] As a specific example, a first user identification set and a second user identification set may be set in the second preset storage unit, the first user identification set is used to store the user identifications to be authenticated corresponding to users with high authentication information requirements or the user identifications to be authenticated corresponding to VIP users, and the second user identification set is used to store the user identifications to be authenticated corresponding to other users. The process of counting the number of user identifications to be authenticated carried by the received authentication requests within the statistical period may include:

[0088] Determining the priority of the user corresponding to the user identifier to be authenticated;

[0089] When it is determined that the priority of the user is the first priority, writing the to-be-authenticated user identifier into the first user identifier set;

[0090] When it is determined that the priority of the user is the second priority, determine whether the second user identification set includes the user identification to be authenticated; if so, update the number of the user identification to be authenticated in the second user identification set; if not, write the user identification to be authenticated into the second user identification set, and record the number of the user identification to be authenticated.

[0091] The first priority is higher than the second priority. The number of user identifiers to be authenticated may be recorded in the first user identifier set, or the number of user identifiers to be authenticated may not be recorded.

[0092] In the case where the first user identification set and the second user identification set are set in the second preset storage unit, the process of determining the target user identification set in step S201 may include:

[0093] In a case where it is determined that there is an available first user identification set, taking the available first user identification set as a target user identification set;

[0094] When it is determined that there is no available first user identification set, the available second user identification set is used as a target user identification set.

[0095] In this embodiment, the first user identification set and the second user identification set are obtained through periodic statistics, and therefore, the available first user identification set and the available second user identification set refer to sets that have not been consumed after the statistical period ends.

[0096] The authentication method of the embodiment of the present invention, on the one hand, determines a target user identity set including multiple target user identities, and then obtains the first authentication information corresponding to each target user identity in the target user identity set. When an authentication request is received, the user identity to be authenticated carried by the authentication request is determined, and whether there is a second authentication information corresponding to the user identity to be authenticated in the first preset storage unit; when the second authentication information exists in the first preset storage unit, the technical scheme of directly feeding back the first authentication information is constructed, and an independent parallel processing flow for obtaining authentication information that does not rely on the physical terminal is constructed, thereby improving the efficiency of the authentication process, reducing the concurrency pressure faced by the HSS server, improving the real-time and robustness of the system, and improving the user experience; on the other hand, the target user identity is determined according to the number of user identities to be authenticated, that is, the size of the user's demand for authentication information is determined according to the user's 5G message interaction frequency, thereby determining the target user, realizing on-demand control of the frequency of asynchronous acquisition of terminal user authentication information, and improving the utilization rate of the first authentication information in the first preset storage unit, thereby further optimizing the efficiency of authentication and better reducing the concurrency pressure of the user's home server.

[0097] Figure 6 FIG. 2 is a flow chart showing an authentication method according to another embodiment of the present disclosure. Figure 6 As shown, the method includes:

[0098] Step S601: configuring a third user identification set;

[0099] Step S602: when it is determined that there is an available first user identification set, taking the available first user identification set as a target user identification set;

[0100] Step S603: when it is determined that there is no available first user identification set, taking the available second user identification set as the target user identification set.

[0101] Step S604: when it is determined that there is no available second user identification set, use the third user identification set as the target user identification set.

[0102] Step S605: for each target user identifier, based on the user home server, obtaining the authentication information corresponding to the target user identifier, and storing the authentication information in a first preset storage unit;

[0103] Step S606: upon receiving an authentication request, determining the user identifier to be authenticated carried in the authentication request, and determining whether there is first authentication information corresponding to the user identifier to be authenticated in the first preset storage unit;

[0104] Step S607: if the first authentication information exists in the first preset storage unit, the first authentication information is fed back.

[0105] Among them, in the embodiment of the present disclosure, a third user identification set is pre-set, and in the absence of an available first user identification set and a second user identification set, authentication information corresponding to the user identification in the third user identification set is pre-stored. As an example, the third user identification set can record the user identification of a user who has signed up for a 5G messaging service.

[0106] In some embodiments of the present disclosure, the method further includes:

[0107] Acquire a historical first user identification set and / or a historical second user identification set;

[0108] The third user identification set is updated according to the historical first user identification set and / or the historical second user identification set.

[0109] In this embodiment, the user identifier configured in the third user identifier set may be deleted, and then the user identifier to be authenticated in the historical first user identifier set may be written into the third user identifier set, or a larger number of user identifiers to be authenticated in the historical second user identifier set may be written into the third user identifier set (for example, a number of user identifiers to be authenticated in the historical second user identifier set greater than a preset threshold value K may be written into the third user identifier set), or both the user identifier to be authenticated in the historical first user identifier set and the larger number of user identifiers to be authenticated in the historical second user identifier set may be written into the third user identifier set.

[0110] Figure 7 The structural diagram of the authentication device 700 of the embodiment of the present disclosure is schematically shown. Figure 7 As shown, the authentication device 700 includes:

[0111] A determination module 701 is used to periodically determine a target user identification set, where the target user identification set includes multiple target user identifications;

[0112] The acquisition module 702 is used to acquire, for each target user identifier, first authentication information corresponding to the target user identifier, and store the authentication information in a first preset storage unit;

[0113] The judgment module 703 is used to determine the user identifier to be authenticated carried in the authentication request when receiving the authentication request, and determine whether the second authentication information corresponding to the user identifier to be authenticated exists in the first preset storage unit;

[0114] The feedback module 704 is configured to feed back the second authentication information if the second authentication information exists in the first preset storage unit.

[0115] The authentication device provided by the embodiment of the present disclosure determines a target user identification set including multiple target user identifications, and then obtains the first authentication information corresponding to each target user identification in the target user identification set, thereby constructing an independent parallel processing flow for obtaining authentication information that does not rely on the physical terminal, thereby solving the problem of low real-time performance, limited efficiency and performance caused by serially obtaining authentication information in related technologies. The authentication method provided by the embodiment of the present disclosure determines the user identification to be authenticated carried by the authentication request when receiving the authentication request, and determines whether there is a second authentication information corresponding to the user identification to be authenticated in the first preset storage unit; when the second authentication information exists in the first preset storage unit, the first authentication information is directly fed back, thereby improving the efficiency of the authentication process, reducing the concurrency pressure faced by the HSS server, improving the real-time and robustness of the system, and improving the user experience.

[0116] In some embodiments of the present disclosure, the acquisition module is further used to: when the first authentication information does not exist in the first preset storage unit, based on the user home server, acquire the first authentication information and feed back the first authentication information.

[0117] In some embodiments of the present disclosure, the acquisition module is further used to: request the second authentication information from the user home server and feed back the second authentication information when the second authentication information does not exist in the first preset storage unit.

[0118] In some embodiments of the present disclosure, the device also includes a generating module, which is used to: count the number of user identifiers to be authenticated carried by the received authentication requests within a statistical period; at the end of the statistical period, filter the user identifiers to be authenticated according to the number of user identifiers to be authenticated, and use the filtered user identifiers to be authenticated as target user identifiers; and generate a target user identifier set based on the target user identifiers.

[0119] In some embodiments of the present disclosure, the generation module is also used to: when receiving an authentication request, determine the user identifier to be authenticated carried by the authentication request; determine whether the user identifier to be authenticated exists in a second preset storage unit; if so, update the number of user identifiers to be authenticated in the second preset storage unit; if not, write the user identifier to be authenticated into the second preset storage unit and record the number of user identifiers to be authenticated; repeat the above process until the statistical period ends.

[0120] In some embodiments of the present disclosure, the generation module is also used to: determine the number of each user identifier to be authenticated in the second preset storage unit at the end of the statistical period; sort the user identifiers to be authenticated in order from large to small according to the number, and use the first M user identifiers to be authenticated as the target user identifiers.

[0121] In some embodiments of the present disclosure, the generation module is also used to: determine that there are N types of user identifiers to be authenticated in the second preset storage unit; when N is greater than a preset threshold M, sort the N types of user identifiers to be authenticated in order from large to small, and use the first M user identifiers to be authenticated as the target user identifiers; when N is less than or equal to M, use the N types of user identifiers to be authenticated as the target user identifiers.

[0122] In some embodiments of the present disclosure, a first user identification set and a second user identification set are provided in the second preset storage unit; the generating module is further used to: determine the priority of the user corresponding to the user identification to be authenticated; if it is determined that the priority of the user is the first priority, write the user identification to be authenticated into the first user identification set; if it is determined that the priority of the user is the second priority, determine whether the user identification to be authenticated is included in the second user identification set; if so, update the number of the user identification to be authenticated in the second user identification set; if not, write the user identification to be authenticated into the second user identification set, and record the number of the user identification to be authenticated;

[0123] The determination module is further configured to: when it is determined that there is an available first user identification set, use the available first user identification set as a target user identification set; when it is determined that there is no available first user identification set, use the available second user identification set as a target user identification set.

[0124] In some embodiments of the present disclosure, the apparatus further includes a configuration module, configured to: configure a third user identification set;

[0125] The determination module is further configured to use the third user identification set as the target user identification set when it is determined that the second user identification set is not available.

[0126] In some embodiments of the present disclosure, the device also includes an updating module, which is used to: obtain a historical first user identification set and / or a historical second user identification set; and update the third user identification set based on the historical first user identification set and / or the historical second user identification set.

[0127] The above device can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0128] Figure 8 The structure block diagram of an electronic device in the embodiment of the present disclosure is shown. Figure 8 An electronic device 800 according to this embodiment of the present invention will be described. Figure 8 The electronic device 800 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0129] like Figure 8 As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include, but are not limited to: the at least one processing unit 810, the at least one storage unit 820, a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810), and a display unit 840.

[0130] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 executes the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0131] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 821 and / or a cache memory unit 822 , and may further include a read-only memory unit (ROM) 823 .

[0132] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 825, such program modules 825 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0133] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0134] The electronic device 800 may also communicate with one or more external devices 870 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 860. As shown, the network adapter 880 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0135] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0136] The program product for implementing the above method according to the embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0137] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0138] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0139] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0140] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0141] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0142] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0143] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0144] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

[0145] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An authentication method, characterized in that: include: Periodically determining a target user identification set, wherein the target user identification set includes a plurality of target user identifications; For each of the target user identifiers, obtaining first authentication information corresponding to the target user identifier, and storing the first authentication information in a first preset storage unit; In the case of receiving an authentication request, determining the user identifier to be authenticated carried in the authentication request, and determining whether second authentication information corresponding to the user identifier to be authenticated exists in the first preset storage unit; In a case where the second authentication information exists in the first preset storage unit, the second authentication information is fed back.

2. The method according to claim 1, characterized in that The method further comprises: In the case that the second authentication information does not exist in the first preset storage unit, the second authentication information is requested from the user home server, and the second authentication information is fed back.

3. The method according to claim 1, characterized in that The target user identification set is generated according to the following process: Counting the number of user identifiers to be authenticated carried in the received authentication requests within the statistical period; At the end of the statistical period, the user identifiers to be authenticated are screened according to the number of the user identifiers to be authenticated, and the screened user identifiers to be authenticated are used as target user identifiers; A target user identification set is generated according to the target user identification.

4. The method according to claim 3, characterized in that The counting of the number of user identifiers to be authenticated carried in the received authentication requests within the statistical period includes: Upon receiving an authentication request, determining the user identifier to be authenticated carried in the authentication request; Determining whether the user identifier to be authenticated exists in the second preset storage unit; If so, updating the number of the to-be-authenticated user identifiers in the second preset storage unit; If not, writing the user identification to be authenticated into the second preset storage unit and recording the number of the user identification to be authenticated; The above process is repeated until the statistical period ends.

5. The method according to claim 3, characterized in that: At the end of the statistical period, screening the user identifiers to be authenticated according to the number of the user identifiers to be authenticated, and using the screened user identifiers to be authenticated as target user identifiers, comprises: At the end of the statistical period, determining the number of each type of user identification to be authenticated in the second preset storage unit; The user identifiers to be authenticated are sorted in descending order of the number, and the first M user identifiers to be authenticated are used as the target user identifiers.

6. The method according to claim 5, characterized in that The step of sorting the user identifiers to be authenticated in descending order of the number, and taking the first M user identifiers to be authenticated as the target user identifiers, includes: Determining that there are a total of N types of user identifiers to be authenticated in the second preset storage unit; In the case where N is greater than a preset threshold value M, sorting the N types of user identifiers to be authenticated in descending order of the number, and taking the first M user identifiers to be authenticated as the target user identifiers; When N is less than or equal to M, the N types of user identifiers to be authenticated are used as the target user identifiers.

7. The method according to claim 4, characterized in that The second preset storage unit is provided with a first user identification set and a second user identification set; The counting of the number of user identifiers to be authenticated carried in the received authentication requests within the statistical period includes: Determining the priority of the user corresponding to the user identifier to be authenticated; When it is determined that the priority of the user is the first priority, writing the to-be-authenticated user identifier into the first user identifier set; In the case where it is determined that the priority of the user is the second priority, determining whether the second user identification set includes the user identification to be authenticated; if so, updating the number of the user identification to be authenticated in the second user identification set; if not, writing the user identification to be authenticated into the second user identification set, and recording the number of the user identification to be authenticated; The step of determining a target user identification set includes: In a case where it is determined that there is an available first user identification set, taking the available first user identification set as a target user identification set; When it is determined that there is no available first user identification set, the available second user identification set is used as a target user identification set.

8. The method according to claim 7, characterized in that The method further comprises: Configure a third user identification set; When it is determined that there is no available second user identification set, the third user identification set is used as the target user identification set.

9. The method according to claim 8, characterized in that The method further comprises: Acquire a historical first user identification set and / or a historical second user identification set; The third user identification set is updated according to the historical first user identification set and / or the historical second user identification set.

10. An authentication device, characterized in that: include: A determination module, used to periodically determine a target user identification set, wherein the target user identification set includes a plurality of target user identifications; An acquisition module, configured to acquire, for each target user identifier, first authentication information corresponding to the target user identifier, and store the authentication information in a first preset storage unit; A judgment module, configured to, upon receiving an authentication request, determine the user identifier to be authenticated carried in the authentication request, and determine whether second authentication information corresponding to the user identifier to be authenticated exists in the first preset storage unit; A feedback module is used to feed back the second authentication information when the second authentication information exists in the first preset storage unit.

11. An electronic device, characterized in that: include: one or more processors; A storage device configured to store one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images