Cross-multi-access edge computing system login method and device

Abstract

The present invention provides a cross-multi-access edge computing system login method and device, which relates to the field of communication technology, including: when a user terminal leaves the service range of a first multi-access edge computing system and enters the service range of a second multi-access edge computing system, the second multi-access edge computing system receives an access request sent by the user terminal; the second multi-access edge computing system sends an access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a suspension token corresponding to the user terminal to the second multi-access edge computing system according to the access token; the second multi-access edge computing system generates a new access token according to the suspension token, and sends the new access token to the user terminal, so that the user terminal performs subsequent resource service access according to the new access token.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for logging into a multi-access edge computing system. Background Art

[0002] Like traditional cloud computing, Multi-Access Edge Computing (MEC) technology, which performs partial caching and computing in multi-access edge networks, also faces huge security risks, especially since it is usually located in base stations or areas that are relatively vulnerable to physical attacks. Therefore, the application of MEC technology generally requires more stringent security policies. Also, because applications in MEC systems can be deployed by third parties, third-party application providers can easily access the environment and collect sensitive data of users, which brings greater security pressure. At the same time, users have mobility issues. If user terminals frequently switch between different MEC systems, they usually need to re-authenticate before a connection can be established. As a result, the above mobility issues will greatly increase service latency and reduce user experience.

[0003] Therefore, how to better implement multi-access edge computing system login has become an urgent problem to be solved in the industry. Summary of the invention

[0004] The present invention provides a method and device for logging in across a multi-access edge computing system, which is used to solve the problem in the prior art that user terminals frequently switch between different MEC systems. Usually, re-identity authentication is required to establish a connection. The above mobility problem will greatly increase service delay and reduce user experience.

[0005] The present invention provides a method for logging in to a multi-access edge computing system, comprising:

[0006] When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the second multi-access edge computing system receives the access request sent by the user terminal;

[0007] The second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system;

[0008] The second multi-access edge computing system generates a new access token according to the termination token, and sends the new access token to the user terminal so that the user terminal can perform subsequent resource service access according to the new access token.

[0009] According to a cross-multi-access edge computing system login method provided by the present invention, the second multi-access edge computing system generates a new access token according to the termination token, including:

[0010] The second multi-access edge computing system receives the termination token, and verifies the termination token and the identity information of the first multi-access edge computing system;

[0011] After the identity information of the suspension token and the first multi-access edge computing system is verified, the second multi-access edge computing system performs a session restoration operation according to the third-party application state in the suspension token;

[0012] The generating a new access token according to the state of the third-party application after the restoration operation.

[0013] According to a cross-multi-access edge computing system login method provided by the present invention, the second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, including:

[0014] The second multi-access edge computing system extracts an access token according to the access request and performs integrity verification on the access request;

[0015] After the integrity verification passes, the second multi-access edge computing system sends the access token and the identity information of the second multi-access edge computing system to the first multi-access edge computing system, so that the first multi-access edge computing system verifies the validity of the access token and the identity information of the second multi-access edge computing system;

[0016] After the validity verification is passed, the second multi-access edge computing system receives a termination token fed back by the first multi-access edge computing system.

[0017] According to a cross-multi-access edge computing system login method provided by the present invention, the access token is obtained after the two-way identity authentication between the user terminal and the first multi-access edge computing system is successful.

[0018] The present invention also provides a method for logging in to a multi-access edge computing system, comprising:

[0019] The user terminal accesses resource services from the first multi-access edge computing system through an access token;

[0020] When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token;

[0021] The user terminal obtains the new access token and performs subsequent resource service access according to the new access token.

[0022] According to a method for logging in to a multi-access edge computing system provided by the present invention, before the user terminal accesses a resource service from the first MEC through an access token, the method further includes:

[0023] When the user terminal is within the service range of the first multi-access edge computing system, the user terminal sends an access application request to the first multi-access edge computing system, so that the first multi-access edge computing system performs identity authentication with the user terminal according to the access application request;

[0024] When the first multi-access edge computing system completes identity authentication of the user terminal, the user terminal receives verification feedback information including identity information of the first multi-access edge computing system, and verifies the verification feedback information;

[0025] After the user terminal completes verification of the verification feedback information, an access token is generated, and the user terminal accesses resource services in the first multi-access edge computing system through the access token.

[0026] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for logging into a multi-access edge computing system as described above is implemented.

[0027] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for logging into a multi-access edge computing system as described in any one of the above.

[0028] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned methods for logging into a multi-access edge computing system.

[0029] The present invention provides a method and device for logging in across multi-access edge computing systems. When a user terminal enters the service range of a second multi-access edge computing system from the service range of a first multi-access edge computing system, a token-based user state transmission mechanism is used to achieve single-point sign-on across MEC systems, avoiding repeated registration processes for users, effectively reducing service delays, and effectively improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 One of the flow diagrams of the method for logging into a multi-access edge computing system provided in an embodiment of the present application;

[0032] Figure 2 The second flowchart of the method for logging into a multi-access edge computing system provided in an embodiment of the present application;

[0033] Figure 3 A schematic diagram of the registration process provided for an embodiment of the present application;

[0034] Figure 4 A flow chart of two-way identity authentication between a user terminal and an MEC server provided in an embodiment of the present application;

[0035] Figure 5 A flow chart for logging into a multi-access edge computing system provided in an embodiment of the present application;

[0036] Figure 6 One of the structural schematic diagrams of the cross-multi-access edge computing system login device provided in the embodiment of the present application;

[0037] Figure 7 The second structural diagram of the device for logging into a multi-access edge computing system provided in an embodiment of the present application;

[0038] Figure 8 An example physical structure diagram of an electronic device is provided. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] The login mechanism across multiple access edge computing systems includes the following entity information:

[0041] It mainly includes six types of entities, namely, Registration Center RC (Registration Center), Multi-Access Edge Platform Manager MEPM (Multi-Access Edge Platform Manager), MEC host, MEC server, third-party application, and user equipment UE (User Equipment);

[0042] Registration Center RC: It is a trusted third-party authority responsible for initializing the entire MEC system environment and registering MEC servers and users.

[0043] Multi-access edge platform manager MEPM: MEPM includes functions such as creation, termination, and authentication management of MEC applications;

[0044] MEC host: The MEC host is a physical entity that includes a multi-access edge platform, MEC applications, and virtualized infrastructure. It is mainly responsible for providing computing, storage, and network resources;

[0045] MEC server: The MEC server includes MEPM and MEC host, which is the overall summary of the core entities in the MEC system. The present invention relates to two MEC servers, namely a first multi-access edge computing system and a second multi-access edge computing system;

[0046] Third-party applications: Third-party service providers design applications based on business needs. Third-party applications request protected resources from the MEC system and provide application services to legitimate users.

[0047] User terminal UE: UE is a user-side mobile device. In order to meet its own different service requirements, the user terminal sends an access request to the MEC system through the UE.

[0048] Table 1 records the parameters and symbolic representations in the method for logging into a multi-access edge computing system provided in an embodiment of the present application.

[0049] Table 1

[0050]

[0051] Figure 1 One of the flow charts of the method for logging into a multi-access edge computing system provided in the embodiment of the present application is as follows: Figure 1 As shown, including:

[0052] Step 110: When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the second multi-access edge computing system receives an access request sent by the user terminal;

[0053] Specifically, the user terminal described in the embodiments of the present application may be a terminal device with communication functions, such as a smart phone or a laptop computer.

[0054] The first multi-access edge computing system and the second multi-access edge computing system described in the embodiments of the present application are both multi-access edge computing systems that provide cloud computing functions and IT service environments at the edge of the network, and each multi-access edge computing system has its corresponding service scope.

[0055] In an embodiment of the present application, when the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, it means that the user terminal can no longer continue to access resource services through the first multi-access edge computing system. At this time, the user terminal needs to enter the second multi-access edge computing system to access resources. At this time, in order to avoid multiple verifications, when the UE leaves the original network and requests to establish a connection with the new second multi-access edge computing system, it only needs to complete the token verification between the two MEC servers, thereby avoiding user re-authentication, thereby realizing single sign-on to the same third-party application in the second multi-access edge computing system.

[0056] Therefore, at this time, the user terminal will continue to use the access token used to access the first multi-access edge computing server to access the second multi-access edge computing system.

[0057] In an embodiment of the present application, the user terminal sends an access request to the second multi-access edge computing system through the original access token, and the second multi-access edge computing system receives the access request sent by the user terminal.

[0058] In some embodiments, the user terminal, the first multi-access edge computing system, and the second multi-access edge computing system described in the embodiments of the present application all need to be pre-registered in the RC system.

[0059] RC generates public and private key pairs for the user terminal and MEC server respectively, and de-identifies the identity information;

[0060] The user terminal registration process mainly performs the following operations:

[0061] The user terminal sends a registration request to the RC;

[0062] RC will include anonymous identity, timestamp and public / private key pair message <AID u ,T u ,(pk u ,sk u )}>Sent to the user through an encrypted channel;

[0063] The process mainly performs the following operations:

[0064] First, the user terminal generates a timestamp T u And key pair, that is, user private key sk u ∈Z * , user public key pk u =sk u ·P;

[0065] Choose a random number r u ∈Z * , connect to the real identity ID u , private key sk u With random number r u , and calculate the hash value h u =Hash1(ID u ||sk u ||r u );

[0066] De-identify the user terminal identity information and generate a new anonymous identity AID u =h u ·P;

[0067] After the user terminal receives the message from the encrypted channel and successfully verifies the timestamp, it saves the anonymous identifier AID u With the key pair (pk u ,sk u );

[0068] The registration process of the MEC server is consistent with the user end operation. RC will generate <AID m ,T m ,(pk m ,sk m )>Sent to the MEC server through an encrypted channel. After receiving the message, the MEC server verifies the timestamp and saves its own anonymous identifier AID m and key pair (pk m ,sk m ).

[0069] Step 120: the second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system;

[0070] Specifically, in an embodiment of the present application, when the user terminal leaves the scope of responsibility of the first multi-access edge computing system, the MEC server generates a termination token to record the status information of the user and the third-party application at the time of session termination. Therefore, when the user terminal leaves the service scope of the first multi-access edge computing system, the first multi-access edge computing system will generate a termination token to record the third-party application status of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system.

[0071] In an embodiment of the present application, the user terminal UE moves to the service range of the second multi-access edge computing system and wants to establish a connection with the same third-party application service in the first multi-access edge computing system, and still uses the previous access token to request resources;

[0072] To ensure the authenticity of the user terminal's identity and the integrity of the message, the MEPM module in the server in the second multi-access edge computing system (i.e., the second multi-access edge computing system) needs to verify the access token sent by the user terminal. During the verification process, the second multi-access edge computing system first sends the received access token to the first multi-access edge computing system to request a termination token.

[0073] The first multi-access edge computing system verifies the validity of the access token from the second multi-access edge computing system according to the information stored in the local database, and completes the identity authentication of the second multi-access edge computing system. After confirmation, the first multi-access edge computing system sends its own information and the termination token to the second multi-access edge computing system.

[0074] Step 130: The second multi-access edge computing system generates a new access token according to the termination token, and sends the new access token to the user terminal, so that the user terminal can perform subsequent resource service access according to the new access token.

[0075] Specifically, after receiving the information, the second multi-access edge computing system verifies the validity of the identity and token of the first multi-access edge computing system. After successful verification, the application currently deployed on the second multi-access edge computing system performs a session restoration operation according to the state information of the termination token;

[0076] The second multi-access edge computing system updates the user information, generates a new access token, and sends the new access token to the user;

[0077] After the user terminal receives the new access token from the second multi-access edge computing system, it verifies its validity. After successful verification, the user uses the new access token to make subsequent resource requests, thereby realizing single sign-on operations between different MEC systems. At the same time, the previous access token will be deleted and invalidated.

[0078] In an embodiment of the present application, when a user terminal enters the service scope of a second multi-access edge computing system from the service scope of a first multi-access edge computing system, a single sign-on across MEC systems is achieved through a token-based user state transmission mechanism, thereby avoiding repeated registration processes for users, effectively reducing service delays, and effectively improving user experience. In addition, two-way identity authentication is achieved between the user terminal and the MEC system, thereby ensuring user identity privacy and protecting the security of resource services within the MEC system.

[0079] Optionally, sending the access token in the access request to the first multi-access edge computing system by the second multi-access edge computing system includes:

[0080] The second multi-access edge computing system extracts an access token according to the access request and performs integrity verification on the access request;

[0081] After the integrity verification passes, the second multi-access edge computing system sends the access token and the identity information of the second multi-access edge computing system to the first multi-access edge computing system, so that the first multi-access edge computing system verifies the validity of the access token and the identity information of the second multi-access edge computing system;

[0082] After the validity verification is passed, the second multi-access edge computing system receives a termination token fed back by the first multi-access edge computing system.

[0083] Specifically, in the embodiment of the present application, when the user moves, the UE leaves the service range of the first multi-access edge computing system. If the user wants to access the same application service deployed on the second multi-access edge computing system, the user still uses the previous access token to make a resource request, and the request information is mg a ;

[0084] The second multi-access edge computing system receives the user's access request mg a Extract access token information and perform message integrity check;

[0085] After the MEPM of the second multi-access edge computing system completes the inspection, it sends a request to the first multi-access edge computing system based on the extracted information, that is, to apply for the use of the access token from the user in exchange for the termination token. The second multi-access edge computing system generates a request message <mg a ,h mt2 ,M authmt ,PID mt ,T mt ,δ mt The process is as follows:

[0086] Complete the registration process and calculate h mt1 =Hash1(ID mt ||sk mt ||r mt ) and AID mt =h mt1 P generates an anonymous identity AID mt ;

[0087] Request information about resources a , timestamp T mt and anonymous identity AID mt Perform calculation to obtain the verification hash value h of the request information mt2 =Hash2(mg a ||T mt ||AID mt );

[0088] Through R mt1 =Hash3(pk mt ||(h mt1 ·pk ms ))and The authentication information M is obtained by operation authmt ;

[0089] Then calculate the pseudonym identity Finally, the signature δ of the second multi-access edge computing system is calculated mt =M authmt +sk mt ·AID mt ;

[0090] The first multi-access edge computing system verifies the message received from the second multi-access edge computing system, that is, completes the identity authentication and access token validity verification for the second multi-access edge computing system, mainly involving the following operations:

[0091] First verify the timestamp T mt The validity is then determined by the timestamp T mt and pseudonym PID mtDecoding anonymous identities through XOR operations

[0092] According to anonymous Retrieve the corresponding access token from the database and perform calculations to obtain a hash value and received from the second multi-access edge computing system mt2 Compare, if Then confirm the validity of the token;

[0093] go through and After calculation, the pseudo signature of the second multi-access edge computing system is obtained. like The first multi-access edge computing system completes the identity authentication of the second multi-access edge computing system;

[0094] Afterwards, the first multi-access edge computing system signs the information containing the termination token and sends it to the second multi-access edge computing system. The information sent is <mg s ,h ms2 ,M authms ,PID ms ,T ms ,δ ms >, the process of the MEPM module of the first multi-access edge computing system generating the information is as follows:

[0095] Generate h through the registration process ms1 =Hash1(ID ms ||sk ms ||r ms )、AID ms =h ms1 P and timestamp T ms , and calculate the pseudonymous identity

[0096] For a message containing a termination token mg s , timestamp T ms , Anonymous Identity AID ms and h ms1 Perform hash operation to get h ms2 =Hash2(mg s ||T ms ||AID ms ||h ms1 );

[0097] By R ms1 =Hash3(pk ms ||(h ms1 ·pk mt ))、 and δms =M authms +sk ms ·AID ms The identity signature δ of the second multi-access edge computing system is obtained by calculation ms .

[0098] In the embodiment of the present application, a token-based user state transmission mechanism is used to achieve single sign-on across MEC systems, avoiding repeated registration processes for users and improving user experience.

[0099] Optionally, the second multi-access edge computing system generates a new access token according to the termination token, including:

[0100] The second multi-access edge computing system receives the termination token, and verifies the termination token and the identity information of the first multi-access edge computing system;

[0101] After the identity information of the suspension token and the first multi-access edge computing system is verified, the second multi-access edge computing system performs a session restoration operation according to the third-party application state in the suspension token;

[0102] The generating a new access token according to the state of the third-party application after the restoration operation.

[0103] Specifically, after receiving the message, the second multi-access edge computing system verifies the identity information of the first multi-access edge computing system and the message mg containing the termination token. s The main operation process is as follows:

[0104] First verify the timestamp T ms The validity is then determined by the timestamp T ms and pseudonym PID ms Resolving anonymous identities

[0105] calculate and The second multi-access edge computing system sends a message mg containing a termination token according to the first multi-access edge computing system. s Perform calculation to get hash value With the received h ms2 Compare, if Then confirm the validity of the token;

[0106] After calculation, the pseudo signature of the identity information of the first multi-access edge computing system is obtained like The second multi-access edge computing system completes the identity authentication of the first multi-access edge computing system, and the second multi-access edge computing system confirms that the received information is from the trusted first multi-access edge computing system;

[0107] Second multi-access edge computing system verification information mg s If successful, the application currently deployed on its own platform will perform session restoration operations based on the status information of the termination token;

[0108] The second multi-access edge computing system will update the user terminal information, and its MEPM will generate a new access token;

[0109] The second multi-access edge computing system will contain new access token information mg a 'Sent to the user terminal, the message sent is <mg a ',h mt2 ',M authmt ,PID mt ',T mt ',δ mt ′>, the message generation process is as follows:

[0110] First generate a timestamp T mt ', then the message mg containing the new access token a ', timestamp T mt ′、Anonymous identity AID mt and the hash value h mt1 Perform calculation to get h mt2 '=Hash2(mg a '||T mt '||AID mt ||h mt1 );

[0111] Computing Pseudonymous Identities

[0112] By R mt3 =Hash3(pk mt ||(h mt1 ·pk u ))、 and δ mt '=M authmt +sk mt ·AID mt The calculation of the identity signature δ of the second multi-access edge computing system is obtained mt ';

[0113] After receiving the message, the user terminal will verify the authenticity of the signature of the token and the identity information of the second multi-access edge computing system. The verification process is as follows:

[0114] First verify the timestamp T mt 'Effectiveness;

[0115] Then, by the timestamp T mt ′ and pseudonym PID mt 'Analyze the anonymous identity through XOR operation

[0116] calculate and Then the hash calculation is It is combined with the h received from the second multi-access edge computing system mt2 'Comparison, if Then confirm the validity of the token;

[0117] In passing The pseudo signature of the second multi-access edge computing system is obtained by calculation like The user terminal completes the identity authentication of the second multi-access edge computing system. At this point, the user terminal successfully receives the verified access token sent by the trusted second multi-access edge computing system;

[0118] After successful verification, the user terminal will use the newly generated access token for subsequent resource requests, and the previous access token will be deleted and invalidated. Therefore, in subsequent service access, the user terminal does not need to register and log in repeatedly, thereby realizing single sign-on operation across MEC systems.

[0119] In the embodiment of the present application, through two-way identity authentication between the user terminal and the MEC server, the user identity privacy is guaranteed and the security of resource services within the MEC system is protected.

[0120] Figure 2 The second flowchart of the method for logging into a multi-access edge computing system provided in the embodiment of the present application is as follows: Figure 2 As shown, including:

[0121] Step 210: The user terminal accesses resource services from the first multi-access edge computing system through an access token;

[0122] Specifically, in the embodiment of the present application, the user arrives within the range of the first multi-access edge computing system, and in order to obtain application services, sends an application access request to the first multi-access edge computing system, and the request information is sent to the MEC server through a secure channel;

[0123] After the first multi-access edge computing system receives the user's application access information, it is handed over to the MEPM module for further processing, thereby completing the user's identity information verification;

[0124] After confirming the identity of the user, the MEPM also sends a message containing its own information to the user terminal for the user terminal to verify the identity. At this point, the two-way authentication between the user terminal and the first multi-access edge computing system is completed;

[0125] To avoid repeated login operations, users who have completed two-way authentication with the first multi-access edge computing system subsequently use access tokens to access resource services. At the same time, the first multi-access edge computing system continuously detects user access to third-party applications to ensure the online status of the session.

[0126] When it detects that the session status of the user terminal is offline, it will save the third-party application status of the user terminal and generate a termination token.

[0127] Step 220: When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token;

[0128] In an embodiment of the present application, when the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, it means that the user terminal can no longer continue to access resource services through the first multi-access edge computing system. At this time, the user terminal needs to enter the second multi-access edge computing system to access resources. At this time, in order to avoid multiple verifications, when the UE leaves the original network and requests to establish a connection with the new second multi-access edge computing system, it only needs to complete the token verification between the two MEC servers, thereby avoiding user re-authentication, thereby realizing single sign-on to the same third-party application in the second multi-access edge computing system.

[0129] Therefore, at this time, the user terminal will continue to use the access token used to access the first multi-access edge computing server to access the second multi-access edge computing system.

[0130] In an embodiment of the present application, the user terminal sends an access request to the second multi-access edge computing system through the original access token, and the second multi-access edge computing system receives the access request sent by the user terminal.

[0131] In an embodiment of the present application, the user terminal UE moves to the service range of the second multi-access edge computing system and wants to establish a connection with the same third-party application service in the first multi-access edge computing system, and still uses the previous access token to request resources;

[0132] To ensure the authenticity of the user terminal's identity and the integrity of the message, the MEPM module in the server in the second multi-access edge computing system (i.e., the second multi-access edge computing system) needs to verify the access token sent by the user terminal. During the verification process, the second multi-access edge computing system first sends the received access token to the first multi-access edge computing system to request a termination token.

[0133] The first multi-access edge computing system verifies the validity of the access token from the second multi-access edge computing system according to the information stored in the local database, and completes the identity authentication of the second multi-access edge computing system. After confirmation, the first multi-access edge computing system sends its own information and the termination token to the second multi-access edge computing system.

[0134] Specifically, after receiving the information, the second multi-access edge computing system verifies the validity of the identity and token of the first multi-access edge computing system. After successful verification, the application currently deployed on the second multi-access edge computing system performs a session restoration operation according to the state information of the termination token;

[0135] The second multi-access edge computing system updates the user information, generates a new access token, and sends the new access token to the user.

[0136] Step 230: The user terminal obtains the new access token and performs subsequent resource service access according to the new access token.

[0137] After the user terminal receives the new access token from the second multi-access edge computing system, it verifies its validity. After successful verification, the user uses the new access token to make subsequent resource requests, thereby realizing single sign-on operations between different MEC systems. At the same time, the previous access token will be deleted and invalidated.

[0138] In an embodiment of the present application, when a user terminal enters the service scope of a second multi-access edge computing system from the service scope of a first multi-access edge computing system, a single sign-on across MEC systems is achieved through a token-based user state transmission mechanism, thereby avoiding repeated registration processes for users, effectively reducing service delays, and effectively improving user experience. In addition, two-way identity authentication is achieved between the user terminal and the MEC system, thereby ensuring user identity privacy and protecting the security of resource services within the MEC system.

[0139] Optionally, the second multi-access edge computing system generates a new access token according to the termination token, including:

[0140] The second multi-access edge computing system receives the termination token, and verifies the termination token and the identity information of the first multi-access edge computing system;

[0141] After the identity information of the suspension token and the first multi-access edge computing system is verified, the second multi-access edge computing system performs a session restoration operation according to the third-party application state in the suspension token;

[0142] The generating a new access token according to the state of the third-party application after the restoration operation.

[0143] Optionally, before the user terminal accesses the resource service from the first MEC through the access token, the method further includes:

[0144] When the user terminal is within the service range of the first multi-access edge computing system, the user terminal sends an access application request to the first multi-access edge computing system, so that the first multi-access edge computing system performs identity authentication with the user terminal according to the access application request;

[0145] When the first multi-access edge computing system completes identity authentication of the user terminal, the user terminal receives verification feedback information including identity information of the first multi-access edge computing system, and verifies the verification feedback information;

[0146] After the user terminal completes verification of the verification feedback information, an access token is generated, and the user terminal accesses resource services in the first multi-access edge computing system through the access token.

[0147] Specifically, in the embodiment of the present application, after the user terminal and the multi-access edge computing system perform two-way identity authentication,

[0148] This stage completes the two-way authentication process between the user terminal and the MEC server, mainly performing the following operations:

[0149] UE generates identity authentication information, user pseudonym, timestamp, and signature by calculation <M authu ,PID u ,T u ,δ u >, and then sent to the MEC server through a secure channel; the calculation process is as follows:

[0150] UE de-identifies the anonymous identity AID generated during the registration phase u 、Hash value h u With timestamp T u Connect and use Hash2() to calculate the new hash value h1=Hash2(T u||h u ||AID u );

[0151] Using h u 、own public key pk u 、MEC server public key pk m , the intermediate random value R is obtained through hash calculation u =Hash3(pk u ||(h u ·pk m ));

[0152] For the h generated during the registration phase u , the middle value R u and timestamp T u Perform XOR operation to generate authentication information

[0153] Anonymous Identity AID u With timestamp T u Perform XOR operation to generate dynamic pseudonyms

[0154] Authentication information M authu Perform XOR operation with hash value h1 to obtain the shared key

[0155] Utilizing AID u , own private key sk u and the shared key K u Calculate and get the UE signature δ u =K u +sk u ·AID u ;

[0156] After receiving the message, the MEC server will hand it over to MEPM for subsequent processing to verify the user's identity. The process of MEPM verifying user identity information is as follows:

[0157] First check the timestamp T u , if the threshold requirements are not met, it will be rejected directly;

[0158] After verification, the anonymous identity is resolved using XOR operation

[0159] By calculation And with the user's public key pk u Connect and perform hash operation to get a pseudo-random value

[0160] Using the generated pseudo-random value R u and the received timestamp Tu , identity information parameter M authu , calculated by XOR

[0161] calculate Afterwards, with M authu Perform XOR operation to obtain the shared key

[0162] Afterwards, the new user signature is obtained by calculation Compare it with the received signature. If The user's identity reliability is confirmed. At this point, the MEC server completes the user's identity authentication;

[0163] Afterwards, MEPM uses the same method to generate authentication information, pseudonymous identity, self-signature and timestamp, i.e. <M authm ,PID m ,δ m ,T m >, transmitted to the user through an encrypted channel; MEPM calculation <M authm ,PID m ,δ m ,T m >The information process is as follows:

[0164] Using the information saved during the registration phase, h2=Hash2(h m ||T m ||AID m ), R m =Hash3(pk m ||(h m ·pk u ))and Calculate and obtain the identity verification information M authm ;

[0165] Computing Pseudonymous Identities

[0166] go through and δ m =K m +sk m ·AID m The signature δ is obtained by operation m ;

[0167] After receiving the message from the MEC server, the user verifies the identity information of the MEC;

[0168] The verification steps are as follows:

[0169] First verify the timestamp T m The effectiveness of using its own private key sku Compared with the previously analyzed Obtain a pseudo-random value through hash calculation

[0170] Use the authentication information M authm calculate Get the shared key

[0171] Final use Get the MEPM pseudo signature If compared with the previously received δ m If they are consistent, the user confirms the identity of the MEC server. At this point, the two-way identity authentication between the user terminal and the MEC server is completed.

[0172] In the embodiment of the present application, through two-way identity authentication between the user terminal and the MEC server, the identity privacy of the user terminal is guaranteed, and the security of resource services in the MEC system is protected.

[0173] Figure 3 A schematic diagram of the registration process provided in the embodiment of the present application is shown in FIG. Figure 3 As shown, including:

[0174] Step 1: The user terminal sends a registration request to the RC (Registration Center);

[0175] Step 2: RC generates a timestamp and a key pair for the user terminal, de-identifies the user terminal identity information, and generates a new anonymous identity;

[0176] Step 3, RC sends the message including the anonymous identity, timestamp and public / private key pair to the user terminal through an encrypted channel;

[0177] Step 4: After receiving the message from the encrypted channel and successfully verifying the timestamp, the user terminal saves the anonymous identifier and the key pair.

[0178] Figure 4 A flow chart of two-way identity authentication between a user terminal and an MEC server provided in an embodiment of the present application is as follows: Figure 4 As shown, including:

[0179] Step 1: The user terminal sends the generated identity authentication information, user terminal pseudonym, timestamp, and signature to the MEC server through a secure channel;

[0180] Step 2: After receiving the message, the MEC sends it to the MEPM for subsequent processing. First, the timestamp is checked, the anonymous identity and other information are parsed, and the calculated signature is compared with the received signature. If they are consistent, the identity reliability of the user terminal is confirmed, that is, the identity authentication of the user terminal is completed;

[0181] Step 3: MEPM generates authentication information, pseudonymous identity, self-signature and timestamp using the same method as the user terminal, and transmits it to the user terminal through an encrypted channel;

[0182] Step 4: After receiving the message from the MEC server, the user terminal parses the anonymous identity of the MEC server, calculates the shared key, and finally compares the pseudo-signature obtained by the MEPM with the received signature. If they are consistent, the identity information of the MEC is confirmed. At this point, the two-way identity authentication between the user terminal and the MEC server is completed.

[0183] Figure 5 The cross-multi-access edge computing system login flow chart provided in the embodiment of the present application is as follows: Figure 5 As shown, including:

[0184] Step 1: To avoid repeated login operations, users who have completed two-way authentication with the source MEC will use access tokens to access resources. At the same time, the MEC system continuously detects user access to applications to ensure the online status of the session.

[0185] Step 2: When the user leaves the scope of the current MEC system, the source MEC generates a termination token to record the application status at the time of session termination;

[0186] Step 3: The UE moves to the service range of the target MEC. If it wants to access the same application service on the source MEC, it still uses the previous access token to request resources.

[0187] Step 4: To ensure the authenticity of the user identity and the integrity of the message, the target MEC needs to verify the access request sent by the user;

[0188] Step 5: After the MEPM completes the verification, the target MEC sends an access token to the source MEC in exchange for a termination token;

[0189] Step 6: The source MEC verifies the validity of the access token from the target MEC based on the information stored in the local database, and then verifies the identity information of the target MEC;

[0190] Step 7: The source MEC sends its own information and the termination token to the target MEC;

[0191] Step 8: After receiving the information, the target MEC verifies the validity of the source MEC's ​​identity and token;

[0192] Step 9: After successful verification, the application currently deployed on the target MEC will perform session restoration operations based on the status information of the termination token;

[0193] Step 10: The target MEC updates the user information, and the MEPM generates a new access token;

[0194] Step 11, MEPM signs the new access token and then sends the token to the user;

[0195] Step 12: After receiving the access token from the target MEC, the user verifies its validity;

[0196] Step 13: After successful verification, the user uses the new access token to make subsequent resource requests, thereby achieving single sign-on operations across MEC systems, and the previous access token is deleted and invalidated.

[0197] The following describes the cross-multi-access edge computing system login device provided by the present invention. The cross-multi-access edge computing system login device described below and the cross-multi-access edge computing system login method described above can be referenced to each other.

[0198] Figure 6 One of the structural diagrams of the cross-multi-access edge computing system login device provided in the embodiment of the present application is as follows Figure 6 As shown, it includes: a first receiving module 610, a first sending module 620 and a second sending module 630; wherein the first receiving module 610 is used for the second multi-access edge computing system to receive the access request sent by the user terminal when the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system; wherein the first sending module 620 is used for the second multi-access edge computing system to send the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system can feedback the termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service range of the first multi-access edge computing system; wherein the second sending module 630 is used for the second multi-access edge computing system to generate a new access token according to the termination token, and send the new access token to the user terminal, so that the user terminal can perform subsequent resource service access according to the new access token.

[0199] In an embodiment of the present application, when the user terminal enters the service range of the second multi-access edge computing system from the service range of the first multi-access edge computing system, a token-based user state transmission mechanism is used to achieve single sign-on across MEC systems, thereby avoiding repeated registration processes for users, effectively reducing service delays, and effectively improving user experience.

[0200] Figure 7The second structural diagram of the cross-multi-access edge computing system login device provided in the embodiment of the present application is as follows: Figure 7 As shown, including:

[0201] Among them, the first access module 710 is used for the user terminal to access resource services from the first multi-access edge computing system through an access token;

[0202] Among them, the request module 720 is used for, when the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains the termination token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the termination token;

[0203] The second access module 730 is used for the user terminal to obtain the new access token and perform subsequent resource service access according to the new access token.

[0204] In an embodiment of the present application, when the user terminal enters the service range of the second multi-access edge computing system from the service range of the first multi-access edge computing system, a token-based user state transmission mechanism is used to achieve single sign-on across MEC systems, thereby avoiding repeated registration processes for users, effectively reducing service delays, and effectively improving user experience.

[0205] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute a cross-multi-access edge computing system login method, the method comprising: when a user terminal leaves the service range of a first multi-access edge computing system and enters the service range of a second multi-access edge computing system, the second multi-access edge computing system receives an access request sent by the user terminal;

[0206] The second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system;

[0207] The second multi-access edge computing system generates a new access token according to the termination token, and sends the new access token to the user terminal so that the user terminal can perform subsequent resource service access according to the new access token.

[0208] Or include:

[0209] The user terminal accesses resource services from the first multi-access edge computing system through an access token;

[0210] When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token;

[0211] The user terminal obtains the new access token and performs subsequent resource service access according to the new access token.

[0212] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0213] On the other hand, the present invention also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the cross-multi-access edge computing system login method provided by the above methods, the method comprising: when a user terminal leaves the service range of a first multi-access edge computing system and enters the service range of a second multi-access edge computing system, the second multi-access edge computing system receives an access request sent by the user terminal;

[0214] The second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system;

[0215] The second multi-access edge computing system generates a new access token according to the termination token, and sends the new access token to the user terminal so that the user terminal can perform subsequent resource service access according to the new access token.

[0216] Or include:

[0217] The user terminal accesses resource services from the first multi-access edge computing system through an access token;

[0218] When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token;

[0219] The user terminal obtains the new access token and performs subsequent resource service access according to the new access token.

[0220] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the cross-multi-access edge computing system login method provided by the above methods, the method comprising: when a user terminal leaves the service range of a first multi-access edge computing system and enters the service range of a second multi-access edge computing system, the second multi-access edge computing system receives an access request sent by the user terminal;

[0221] The second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system;

[0222] The second multi-access edge computing system generates a new access token according to the termination token, and sends the new access token to the user terminal so that the user terminal can perform subsequent resource service access according to the new access token.

[0223] Or include:

[0224] The user terminal accesses resource services from the first multi-access edge computing system through an access token;

[0225] When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token;

[0226] The user terminal obtains the new access token and performs subsequent resource service access according to the new access token.

[0227] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0228] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0229] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for logging in to a multi-access edge computing system, characterized in that: include: When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the second multi-access edge computing system receives the access request sent by the user terminal; The second multi-access edge computing system sends the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system feeds back a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system; The second multi-access edge computing system generates a new access token according to the termination token, and sends the new access token to the user terminal so that the user terminal can perform subsequent resource service access according to the new access token.

2. The method for logging into a multi-access edge computing system according to claim 1, characterized in that: The second multi-access edge computing system generates a new access token according to the termination token, including: The second multi-access edge computing system receives the termination token, and verifies the termination token and the identity information of the first multi-access edge computing system; After the identity information of the suspension token and the first multi-access edge computing system is verified, the second multi-access edge computing system performs a session restoration operation according to the third-party application state in the suspension token; A new access token is generated according to the state of the third-party application after the restore operation.

3. The method for logging into a multi-access edge computing system according to claim 1, characterized in that: Sending, at the second multi-access edge computing system, an access token in the access request to the first multi-access edge computing system, includes: The second multi-access edge computing system extracts an access token according to the access request and performs integrity verification on the access request; After the integrity verification passes, the second multi-access edge computing system sends the access token and the identity information of the second multi-access edge computing system to the first multi-access edge computing system, so that the first multi-access edge computing system verifies the validity of the access token and the identity information of the second multi-access edge computing system; After the validity verification is passed, the second multi-access edge computing system receives a termination token fed back by the first multi-access edge computing system.

4. The method for logging into a multi-access edge computing system according to claim 1, characterized in that: The access token is obtained after successful bidirectional identity authentication between the user terminal and the first multi-access edge computing system.

5. A method for logging in to a multi-access edge computing system, characterized in that: include: The user terminal accesses resource services from the first multi-access edge computing system through an access token; When the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token; The user terminal obtains the new access token and performs subsequent resource service access according to the new access token.

6. The method for logging into a multi-access edge computing system according to claim 5, characterized in that: Before the user terminal accesses the resource service from the first multi-access edge computing system through the access token, the method further includes: When the user terminal is within the service range of the first multi-access edge computing system, the user terminal sends an application access request to the first multi-access edge computing system, so that the first multi-access edge computing system performs identity authentication with the user terminal according to the application access request; When the first multi-access edge computing system completes identity authentication of the user terminal, the user terminal receives verification feedback information including identity information of the first multi-access edge computing system, and verifies the verification feedback information; After the user terminal completes verification of the verification feedback information, an access token is generated, and the user terminal accesses resource services in the first multi-access edge computing system through the access token.

7. A device for logging into a multi-access edge computing system, characterized in that: include: A first receiving module, configured to, when a user terminal leaves a service range of the first multi-access edge computing system and enters a service range of a second multi-access edge computing system, the second multi-access edge computing system receiving an access request sent by the user terminal; A first sending module, configured for the second multi-access edge computing system to send the access token in the access request to the first multi-access edge computing system, so that the first multi-access edge computing system can feedback a termination token corresponding to the user terminal to the second multi-access edge computing system according to the access token, wherein the termination token is used to save the third-party application state of the user terminal when the user terminal leaves the service scope of the first multi-access edge computing system; The second sending module is used for the second multi-access edge computing system to generate a new access token according to the termination token, and send the new access token to the user terminal, so that the user terminal can perform subsequent resource service access according to the new access token.

8. A device for logging into a multi-access edge computing system, characterized in that: include: A first access module, configured for a user terminal to access resource services from a first multi-access edge computing system through an access token; a request module, configured to, when the user terminal leaves the service range of the first multi-access edge computing system and enters the service range of the second multi-access edge computing system, the user terminal makes a resource request to the second multi-access edge computing system according to the access token, so that the second multi-access edge computing system obtains a suspension token corresponding to the user terminal from the first multi-access edge computing system according to the access token, and generates a new access token according to the suspension token; The second access module is used for the user terminal to obtain the new access token and perform subsequent resource service access according to the new access token.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for logging into a multi-access edge computing system as described in any one of claims 1 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the method for logging into a multi-access edge computing system as described in any one of claims 1 to 6.

Images