A user trusted access system and method for 5G edge computing nodes

Abstract

The present invention provides a user trusted access system and method for 5G edge computing nodes. The system includes: a user terminal UE, a target container, a UPF, a UDM, a host machine and an MEC controller. The UE is a resource requester of the target container, and requests trusted evidence from the target container for trusted verification. The trusted evidence of the target container is provided by the TPM of its host machine and the vTPM in the target container; the UPF is a communication agent for remote attestation, and performs trusted verification on the UE and the target container respectively; the UDM is a trusted verification node of the UE, and issues a certificate to the UE and verifies the trusted evidence; the MEC controller is a trusted verification node of the container, and issues an AIK certificate to the TPM of the target container and the host machine and verifies the trusted evidence. Based on the system, a remote attestation method is used to perform bidirectional trusted authentication on the UE and the container runtime environment, which not only ensures the trusted identity of the UE's access container, but also ensures the trusted operating environment of the accessing parties.

Description

Technical Field

[0001] The present invention relates to the field of network information security technologies, and in particular to a user trusted access system and method for 5G edge computing nodes. Background Art

[0002] Mobile Edge Computing (MEC) is a key technology in 5G networks. Its basic idea is to migrate cloud computing service capabilities from the mobile core network to the edge of the mobile access network to achieve flexible use of computing and storage resources. With the development of 5G, the demand for low-latency mobility applications is increasing. MEC technology enables localized and close-range deployment of services, greatly reducing service latency, thereby effectively improving users' service experience.

[0003] With the continuous development and widespread application of cloud computing technology, virtualization technology has become increasingly important. Container technology has been favored by more and more users due to its advantages such as low resource usage and low susceptibility to environmental factors. Therefore, containers have also been widely used in MEC. However, since MEC is deployed on the edge side, the environment where the container is located is not safe. How to ensure the two-way trust between users and containers in an untrusted environment is an urgent problem to be solved.

[0004] TCG defines trusted computing as: if an entity always behaves in the expected way and ultimately achieves the expected goal, then the entity is trusted. The definition of proof in the TCG specification is a reporting mechanism, where the proving party reports the identity of its platform and the software and hardware configuration information to the challenging party. After the challenging party successfully verifies, it believes that the identity information and report provided by the proving party are correct and reliable.

[0005] At present, there are mainly the following solutions to ensure that user terminals can reliably access edge computing nodes:

[0006] (1) The primary authentication of the built-in SIM card of the 5G user equipment (UE) to access the 5G network ensures the legality of the UE's identity when accessing the 5G network, but cannot guarantee the security of the UE's internal operating environment, that is, cannot guarantee trusted UE access;

[0007] (2) Set up an edge IoT agent and use encryption strategies to encrypt the information exchange between the access device and the agent; perform fault analysis on the access device. This method only determines whether the access device is faulty, which only guarantees the reliability of the device but cannot prove its trustworthiness.

[0008] (3) Set up an access edge agent and an IoT management platform, and share files between them using a shared directory; use the access edge agent to verify the trustworthiness of the access device; instantiate the container image of the APP on the edge computing node, and authenticate the instantiated edge computing APP through the management platform. This method can only verify the identity of the container, but cannot guarantee the trustworthiness of its operating environment. Summary of the invention

[0009] Therefore, in order to solve the defects of the prior art, the present invention provides a user trusted access system and method for 5G edge computing nodes, which adopts a remote attestation method to realize two-way trusted authentication of UE and container runtime environment, thereby ensuring the trustworthiness of the identity of the UE's access container and the trustworthiness of the operating environment of both access parties.

[0010] In a first aspect, the user trusted access system for 5G edge computing nodes provided by the present invention includes: a user terminal UE, a target container, a user plane function network element UPF, a unified data management function network element UDM, a host machine and a MEC controller, wherein:

[0011] The UE is the resource requester of the target container. It verifies the trustworthiness of the target container by requesting trusted evidence from the target container. The trusted evidence of the target container is provided by the trusted platform module trusted computing module TPM of the host where the target container is located and the virtual trusted computing module vTPM in the target container.

[0012] UPF is the communication agent for remote attestation. After receiving the remote attestation request sent by the UE, it jointly verifies whether the UE is trustworthy with UDM, where UDM is the trusted verification node of the UE and is used to issue authentication key certificates and verify trusted evidence for the UE. After the UE trust verification passes, UPF jointly verifies whether the target container is trustworthy with the MEC controller, where the MEC controller is the trusted verification node of the target container and is used to issue AIK certificates and verify trusted evidence for the target container and the host's TPM.

[0013] After both the UE and the target container pass the trusted verification, the UPF allows the UE to establish communication with the target container.

[0014] In one embodiment, before the UE initiates a remote attestation request to the UPF, the UE, the target container, the MEC controller, and the UDM perform security initialization, including:

[0015] The UE has a built-in TPM module. The UDM issues the TPM AIK key AIK1 to the UE when the UE is registered. When the UE is initialized, the measured PCR value is sent to the UDM reference value library to provide a measurement reference value for verifying whether the UE is trustworthy.

[0016] The host's TPM obtains the identity proof key AIK2 from the MEC controller. The host is initialized and started, and the measured PCR value is sent to the benchmark value library of the MEC controller. In addition, the container is initialized, and the host's TPM issues a virtual identity proof key certificate CvAIK1 for the vTPM instance on the target container. The key is vAIK1. When the target container is started, the vTPM is used for measurement, and the measured vPCR value is sent to the virtual benchmark value library in the host to provide a measurement benchmark value for verifying whether the target container is trustworthy.

[0017] In a second aspect, the present invention further provides a user trusted access method for a 5G edge computing node, based on the user trusted access system for a 5G edge computing node described in the first aspect, comprising:

[0018] UE initiates a remote attestation request to UPF. After receiving the remote attestation request, UPF jointly verifies whether the UE is trustworthy with UDM.

[0019] If the UE trust verification passes, UPF and MEC controller verify whether the target container is trustworthy;

[0020] When both the UE and the target container pass the trusted verification, the UPF allows the UE to establish communication with the target container.

[0021] In one embodiment, before the step of the UE initiating a remote certification request to the UPF, it also includes: securely initializing the UE, the target container, the MEC controller and the UDM, and the process includes:

[0022] When the UE is initialized and started, the measured PCR value is sent to the UDM reference value library;

[0023] When the host is initialized and started, the measured PCR value is sent to the reference value library of the MEC controller;

[0024] When the container is initialized, the host's TPM issues a virtual identity authentication key certificate CvAIK1 for the vTPM instance on the target container. The key is vAIK1. When the target container is started, the vTPM is used for measurement, and the measured vPCR value is sent to the virtual reference value library in the host.

[0025] In one embodiment, after receiving the remote attestation request, the UPF jointly with the UDM verifies whether the UE is trustworthy, including:

[0026] After receiving the remote attestation request, UPF initiates a UE trusted evidence verification request to UDM;

[0027] UDM verifies the UE's trustworthy evidence and returns the UE trustworthy verification result response to UPF.

[0028] In one embodiment, the process of the UPF jointly verifying whether the target container is trustworthy with the MEC controller includes:

[0029] UPF initiates a container trusted evidence acquisition request to the target container;

[0030] After receiving the container trusted evidence acquisition request, the target container generates a container trusted evidence response and sends it to the UPF;

[0031] After receiving the container trusted evidence response, the UPF sends a container trusted evidence verification request to the MEC controller;

[0032] The MEC controller receives the container trust evidence verification request, jointly verifies the container trust evidence and container trustworthiness with the host, and returns the container verification response result to the UPF.

[0033] In one embodiment, the process of the UE initiating a remote attestation request to the UPF includes:

[0034] After the UE generates the random number nonce1, it initiates a remote attestation request to the UPF. The remote attestation request includes: target container ID, random number nonce1, UE_ID, and UE's trusted evidence. The UE's trusted evidence includes: the trusted measurement value PCR1 in the UE's TPM, the TPM's ID, and the signature S1 of PCR1 using the key AIK1.

[0035] In one embodiment, after receiving the remote attestation request, the UPF initiates a process of requesting UE trusted evidence verification to the UDM, including:

[0036] After receiving the remote attestation request, UPF generates a random number nonce2 and initiates a UE trusted evidence verification request challenge to UDM. The UE trusted evidence verification request includes: random number nonce2, UE_ID, and the trusted evidence of the UE.

[0037] In one embodiment, the process in which the UDM verifies the UE's trustworthy evidence and returns a UE trustworthy verification result response to the UPF includes:

[0038] UDM records nonce2 in the UE's trusted evidence verification request and verifies the UE's trusted evidence;

[0039] UDM first verifies the signature S1 to confirm whether the UE's identity information is valid;

[0040] After the UDM signature verification is completed, the PCR1 value is compared with the stored PCR reference value of the UE's TPM. If they are consistent, the UE is determined to be trustworthy;

[0041] After determining that the UE is trustworthy, the UDM returns a UE trustworthy verification response including the UE trustworthy verification result to the UPF;

[0042] UE trusted verification response includes: random number nonce2', UE_ID, UE trusted verification result Success / Failure;

[0043] UPF receives the UE trusted verification response and determines whether the session is valid by verifying whether the random number nonce2' is the same as nonce2. If they are the same, the session is valid;

[0044] If the session is valid, UPF reads the UE trusted verification result as Success, the UE trusted verification passes, and the verification continues;

[0045] If the trusted verification result is Failure, UPF disconnects from the UE;

[0046] If the trusted verification result is Success, UPF generates a random number nonce3 and initiates a container trusted evidence acquisition request to the target container. The container trusted evidence acquisition request includes the target container ID and the random number nonce3.

[0047] In one embodiment, after receiving the container trusted evidence acquisition request, the target container generates a container trusted evidence response and sends it to the UPF, including:

[0048] The container trusted evidence response includes the random number nonce3' and the trusted evidence of the target container. The trusted evidence includes the trusted measurement value PCR2 of the TPM of the MEC host and the signature S2 of PCR2 using AIK2; the trusted measurement value vPCR1 of the vTPM instance in the target container and the signature S3 of vPCR1 using the key vAIK1.

[0049] In one embodiment, after receiving the container trusted evidence response, the UPF sends a container trusted evidence verification request to the MEC controller, including:

[0050] After receiving the container's trusted evidence response, UPF determines whether the session is valid by verifying whether the random number nonce3' is the same as nonce3;

[0051] If valid, UPF generates a random number nonce4 and sends a container trusted evidence verification request challenge to the MEC controller. The container trusted evidence verification request includes the random number nonce4, container ID and container trusted evidence.

[0052] In one embodiment, the MEC controller receives a container trust evidence verification request, and jointly verifies the container trust evidence and the container trustworthiness with the host, including:

[0053] The MEC controller receives the container trusted evidence verification request and verifies the signature S2;

[0054] The MEC controller finds the corresponding host machine through the container ID. After verification, the MEC controller compares the PCR2 value with the stored PCR reference value of the host machine to determine whether the host machine is trustworthy;

[0055] If the host is trustworthy, the MEC controller sends a container trust verification challenge to the host;

[0056] The container trust verification request includes the container ID and container trust evidence;

[0057] The host receives the container trusted verification request sent by the MEC controller;

[0058] The host verifies signature S3. If signature S3 is verified successfully, the host compares vPCR1 with the vPCR reference value stored in the virtual reference library in the host, and returns the container trusted verification result Success / Failure to the MEC controller.

[0059] In one embodiment, the MEC controller returns a container trusted evidence verification response result to the UPF, including: a random number nonce4', a container ID, a container trusted evidence verification result, and a container trusted verification result. If both verification results are Success, the UPF determines that both the UE and the container are trustworthy, and allows the UE to establish communication with the target container.

[0060] The technical solution of the present invention has the following advantages:

[0061] 1. The user trusted access system for 5G edge computing nodes provided by the embodiment of the present invention includes: a user terminal UE, a target container, a user plane function network element UPF, a unified data management function network element UDM, a host machine and an MEC controller. The UPF remote attestation agent is used to implement trusted verification of the container, and the two-way trusted authentication of the UE and the container runtime environment ensures that the identity of the UE accessing the container is trusted, and the operating environment of both access parties is trusted.

[0062] 2. The user trusted access method for 5G edge computing nodes provided by the embodiment of the present invention implements the verification of the trusted terminal UE equipped with TPM through UDM, reduces the resource burden of the remote attestation agent, and finally realizes the two-way remote attestation of UE and container. The method provided by the embodiment of the present invention uses a remote attestation method to realize the two-way trusted authentication of UE and container runtime environment on the basis of the main authentication of 5G network, which not only ensures the trustworthiness of the identity of the UE accessing the container, but also ensures the trustworthiness of the operating environment of both parties. The communication is established through the user plane function network element UPF network element node control. In the application of 5G industrial Internet environment, when massive terminals access MEC edge computing nodes, the trusted access of user terminals and the effective control of communication channels can be realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0064] Figure 1 It is a structural diagram of an example of a user trusted access system for 5G edge computing nodes proposed in an embodiment of the present invention;

[0065] Figure 2 It is a flowchart of an example of a user trusted access method for a 5G edge computing node proposed in an embodiment of the present invention;

[0066] Figure 3 is a schematic diagram of a process for verifying a user terminal UE in an embodiment of the present invention;

[0067] Figure 4 Schematic diagram of the process of verifying the target container in an embodiment of the present invention. DETAILED DESCRIPTION

[0068] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] Example 1

[0070] Figure 1It is a block diagram of a user trusted access system for 5G edge computing nodes proposed according to an embodiment of the present invention, including: a user terminal UE, a target container, a user plane function network element UPF, a unified data management function network element UDM, a host machine and an MEC controller, wherein: the UE is a resource requester of the target container, and performs trusted verification on the target container by requesting trusted evidence from the target container, and the trusted evidence of the target container is provided by the trusted platform module TPM of the host machine where the target container is located and the virtual trusted computing module vTPM in the target container; the UPF is a communication agent for remote attestation, and after receiving the remote attestation request sent by the UE, it jointly verifies whether the UE is trusted with the UDM, wherein the UDM is a trusted verification node of the UE, and is used to issue an authentication key certificate and verify trusted evidence for the UE; after the UE trusted verification passes, the UPF jointly verifies whether the target container is trusted with the MEC controller, wherein the MEC controller is a trusted verification node of the target container, and is used to issue an AIK certificate and verify trusted evidence for the target container and the TPM of the host machine;

[0071] After both the UE and the target container pass the trusted verification, the UPF allows the UE to establish communication with the target container.

[0072] Based on the user trusted access system for 5G edge computing nodes provided by the embodiment of the present invention, a remote attestation agent is used to implement trusted verification of the container, and the UDM is used to implement verification of the trusted terminal UE equipped with a physical TPM, thereby reducing the resource burden of the remote attestation agent, and ultimately achieving two-way trusted authentication of the UE and the container runtime environment, thereby ensuring both the trusted identity of the UE's access container and the trusted operating environment of both access parties.

[0073] It should be noted that in actual applications, there is at least one target container. Figure 1 Two are used as examples, but are not limited thereto.

[0074] The Trusted Platform Module (TPM) in the embodiment of the present invention is a chip implanted inside a computer to provide a trusted root for the computer, which can provide functions such as identity authentication, trusted measurement, and secure storage. Inside the TPM, there is a Platform Configuration Register (PCR) used to record the system operating status. Its value can only be changed through an extension operation, which is irreversible. By extending the PCR, an infinitely long column of measurement values ​​can be recorded. This series of measurement value sequences reflects the changes in the system state. If a measurement value in this extended sequence is changed, the subsequent measurement sequences will be affected. The platform status information can be placed in a measurement log file outside the TPM in the form of a log. The summary of the measurement log information is recorded in the PCR through extension for later verification of the measurement log, thereby confirming whether the system is trustworthy.

[0075] The virtual trusted computing module vTPM (Virtual Trusted Platform Module) module is a software-based representation of the physical trusted platform module, providing hardware-based security-related functions such as random number generation, certification, key generation, etc. The vTPM module is included with the container image. After being added to the virtual machine, the vTPM enables the host operating system to create and store private keys. These keys are not disclosed to the host operating system itself, so the attack surface of the virtual machine is reduced. Usually, for a host operating system whose security is compromised, the security of its keys will also be compromised, but enabling TPM can greatly reduce this risk, and only the host operating system can use these keys for encryption or signing. A vPCR is provided in the vTPM of an embodiment of the present invention to provide an isolatable metric storage space for the container in the MEC node.

[0076] In an embodiment of the present invention, before the UE initiates a remote attestation request to the UPF, the UE, the target container, the MEC controller and the UDM are securely initialized to provide a measurement reference value for subsequent trusted verification. Specifically, the UE has a built-in TPM module, and the UDM issues the TPM's AIK key AIK1 to the UE when it is registered. When it is initialized and started, the measured PCR value is sent to the UDM's reference value library to provide a measurement reference value for verifying whether the UE is trustworthy; the host's TPM obtains the identity certification key AIK2 from the MEC controller, and the host is initialized and started, and the measured PCR value is sent to the MEC controller's reference value library, and the container is initialized, and the host's TPM issues a virtual identity certification key certificate CvAIK1 for the vTPM instance on the target container, and the key is vAIK1. When the target container is started, the vTPM is used for measurement, and the measured vPCR value is sent to the virtual reference value library in the host to provide a measurement reference value for verifying whether the target container is trustworthy.

[0077] The embodiment of the present invention sets vPCR in the vTPM of the container, provides an isolable measurement value storage space for the container in the MEC node, stores the vPCR reference value in the host machine, and reduces the performance loss of the container.

[0078] Example 2

[0079] Based on the user trusted access system for 5G edge computing nodes described in Example 1, the embodiment of the present invention provides a user trusted access method for 5G edge computing nodes. After the user terminal completes the 5G primary authentication, when requesting resource access from the edge computing node, the remote attestation agent is set to initiate trusted evidence verification requests to the 5G terminal and the container respectively. The user terminal can access the container only after the trusted evidence is verified by the trusted verification node. Figure 2 As shown, including:

[0080] Step S1: The UE initiates a remote attestation request to the UPF. After receiving the remote attestation request, the UPF jointly verifies whether the UE is trustworthy with the UDM.

[0081] In an embodiment of the present invention, the process of verifying whether the UE is trustworthy is as follows: after receiving the remote certification request, the UPF initiates a UE trusted evidence verification request to the UDM; the UDM verifies the UE's trusted evidence and returns the UE trusted verification result response to the UPF; if the UE's trusted verification fails, the UPF terminates the process.

[0082] Step S2: If the UE's trust verification passes, the UPF jointly verifies with the MEC controller whether the target container is trustworthy.

[0083] In an embodiment of the present invention, the process of verifying whether the target container is trustworthy is as follows: UPF initiates a container trustworthy evidence acquisition request to the target container; after the target container receives the container trustworthy evidence acquisition request, it generates a container trustworthy evidence response and sends it to UPF; after receiving the container trustworthy evidence response, UPF sends a container trustworthy evidence verification request to the MEC controller; the MEC controller receives the container trustworthy evidence verification request, verifies the container trustworthy evidence, and returns a container trustworthy verification result response; if the target's trustworthy verification fails, UPF terminates the process.

[0084] Step S3: When both the UE and the target container pass the trusted verification, the UPF allows the UE to establish communication with the target container.

[0085] The embodiment of the present invention implements verification of a trusted terminal UE equipped with a TPM through UDM, reduces the resource burden of the remote certification agent, and ultimately implements two-way remote certification of the UE and the container, which not only ensures the trustworthiness of the identity of the UE accessing the container, but also ensures the trustworthiness of the operating environment of both accessing parties, and establishes communication through the user plane function network element UPF control.

[0086] In actual applications, before the UE initiates a remote attestation request to the UPF, it is necessary to perform security initialization on the UE, the target container, the MEC controller, and the UDM. Specifically, the UE in the embodiment of the present invention has a built-in TPM module. When the UE is registered, the UDM issues the TPM module AIK certificate CAIK1, and the key is AIK1; when the UE is initialized, the measured PCR value is sent to the UDM's reference value library; the host's TPM module obtains the identity authentication key certificate CAIK2 from the MEC controller, and the key is AIK2; when the host is initialized, the measured PCR value is sent to the MEC controller's reference value library; when the container is initialized, the MEC host's TPM issues a virtual identity authentication key (Virtual Attestation Identity Key, vAIK) certificate CvAIK1 for the vTPM instance on the container, and the key is vAIK1. When the container is started, the vTPM is used for measurement, and the measured vPCR value is sent to the virtual reference value library in the host. The measurement reference value for subsequent trusted verification is obtained through the above-mentioned security initialization process.

[0087] In a specific embodiment, the process of verifying whether the UE is trustworthy is:

[0088] Step S21: UE generates a random number nonce1 and initiates a remote attestation request to UPF. The remote attestation request includes the target container ID, the random number nonce1, UE_ID, and the UE's trusted evidence, where the UE's trusted evidence includes the trusted measurement value PCR1 in the UE's TPM, the ID of the TPM, and the signature S1 of PCR1 using the key AIK1. This process corresponds to Figure 3 ① in the.

[0089] Step S22: After receiving the remote attestation request, UPF generates a random number nonce2 and initiates a UE trusted evidence verification request challenge to UDM; the UE trusted evidence verification request includes the random number nonce2, UE_ID, and the above-mentioned UE trusted evidence. This process corresponds to Figure 3 ② in the.

[0090] Step S23: UDM records nonce2 in the UE's trusted evidence verification request and verifies the UE's trusted evidence; UDM first verifies signature S1 to confirm whether the UE's identity information is valid; after the UDM verifies the signature, it compares the PCR1 value with the stored PCR reference value of the UE's TPM. If they are consistent, the UE can be judged to be credible. This process corresponds to Figure 3 ③ in the.

[0091] Step S24: UDM returns a UE trusted verification response including the UE trusted verification result to UPF; the UE trusted verification response includes the random number nonce2', UE_ID, and the UE trusted verification result Success / Failure; UPF receives the UE trusted verification response, and determines whether the session is valid by verifying whether the random number nonce2' is the same as nonce2. If they are the same, it is valid; if the session is valid, UPF reads the UE trusted verification result. If it is Success, the UE trusted verification passes and continues to verify; if it is Failure, the user plane function network element UPF disconnects from the UE. This process corresponds to Figure 3 ④ in the.

[0092] In a specific embodiment, the process of verifying whether the target container is trustworthy is as follows:

[0093] Step S31: UPF reads the UE trusted verification result as Success, UPF generates a random number nonce3, and initiates a container trusted evidence acquisition request to the target container; the container trusted evidence acquisition request includes the target container ID and the random number nonce3. This process corresponds to Figure 4 ① in the.

[0094] Step S32: After receiving the container trusted evidence acquisition request, the target container generates a container trusted evidence response and sends it to the UPF; the container trusted evidence response includes the random number nonce3' and the trusted evidence of the target container, the trusted evidence includes the trusted measurement value PCR2 of the TPM of the MEC host, and the signature S2 of PCR2 using AIK2; the trusted measurement value vPCR1 of the vTPM instance in the target container, and the signature S3 of vPCR1 using the key vAIK1. This process corresponds to Figure 4 ② in the.

[0095] Step S33: After receiving the container trusted evidence response, UPF determines whether the session is valid by verifying whether the random number nonce3' is the same as nonce3; if valid, UPF generates a random number nonce4 and sends a container trusted evidence verification request challenge to the MEC controller; the container trusted evidence verification request includes the random number nonce4, the container ID and the container trusted evidence. This process corresponds to Figure 4 ③ in the.

[0096] Step S34: The MEC controller receives the container trusted evidence verification request and first verifies the signature S2; the MEC controller can find the corresponding host through the container ID; after the verification, the MEC controller compares the PCR2 value with the stored PCR reference value of the host to determine whether the host is trustworthy; if the host is trustworthy, the MEC controller issues a container trusted verification request challenge to the host; the container trusted verification request includes the container ID and the container trusted evidence, and this process corresponds to Figure 4 ④ in the.

[0097] Step S35: The host receives the container trusted verification request issued by the MEC controller; since the host has issued CvAIK1 for the vTPM instance, the host can verify the signature S3; if the signature S3 is verified, the host compares vPCR1 with the vPCR reference value stored in the virtual reference library in the host, and returns the container trusted verification result Success / Failure to the MEC controller. This process corresponds to Figure 4 ⑤ in the.

[0098] Step S36: The MEC controller returns a container trust evidence verification response to the UPF, including the random number nonce4', the container ID, and the container trust evidence verification result Success / Failure; when both the container trust verification result and the container trust evidence verification result are Success, it is determined that both the UE and the container are trustworthy, and the UPF allows the UE to establish communication with the target container. This process corresponds to Figure 4 ⑥ in the.

[0099] The user trusted access method for 5G edge computing nodes provided by the embodiment of the present invention implements verification of the trusted terminal UE equipped with TPM through UDM, reduces the resource burden of the remote attestation agent, and finally realizes the two-way remote attestation of the UE and the container. The method provided by the embodiment of the present invention uses a remote attestation method to realize two-way trusted authentication of the UE and the container runtime environment on the basis of the main authentication of the 5G network, which not only ensures the trustworthiness of the identity of the UE accessing the container, but also ensures the trustworthiness of the operating environment of both accessing parties. The communication is established through the user plane function network element UPF network element node control. In the application of the 5G industrial Internet environment, when massive terminals access the MEC edge computing node, the trusted access of the user terminal and the effective control of the communication channel can be realized.

[0100] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. A user trusted access system for 5G edge computing nodes, characterized in that: include: User terminal UE, target container, user plane function network element UPF, unified data management function network element UDM, host machine and MEC controller, including: The UE is the resource requester of the target container. It verifies the trustworthiness of the target container by requesting trusted evidence from the target container. The trusted evidence of the target container is provided by the trusted platform module TPM of the host where the target container is located and the virtual trusted computing module vTPM in the target container. UPF is the communication agent for remote attestation. After receiving the remote attestation request sent by the UE, it jointly verifies whether the UE is trustworthy with UDM, where UDM is the trusted verification node of the UE and is used to issue authentication key certificates and verify trusted evidence for the UE. After the UE trust verification passes, UPF jointly verifies whether the target container is trustworthy with the MEC controller, where the MEC controller is the trusted verification node of the target container and is used to issue AIK certificates and verify trusted evidence for the target container and the host's TPM. After both the UE and the target container pass the trusted verification, the UPF allows the UE to establish communication with the target container; Before the UE initiates a remote attestation request to the UPF, the UE, the target container, the MEC controller and the UDM perform security initialization, including: The UE has a built-in TPM module. The UDM issues the TPM AIK key AIK1 to the UE when the UE is registered. When the UE is initialized, the measured PCR value is sent to the UDM reference value library to provide a measurement reference value for verifying whether the UE is trustworthy. The host's TPM obtains the identity authentication key AIK2 from the MEC controller. The host is initialized and started, and the measured PCR value is sent to the benchmark value library of the MEC controller. In addition, the container is initialized, and the host's TPM issues a virtual identity authentication key certificate CvAIK1 for the vTPM instance on the target container. The key is vAIK1. When the target container is started, the vTPM is used for measurement, and the measured vPCR value is sent to the virtual benchmark value library in the host to provide a measurement benchmark value for verifying whether the target container is trustworthy.

2. A user trusted access method for 5G edge computing nodes, based on the user trusted access system for 5G edge computing nodes according to claim 1, characterized in that: include: UE initiates a remote attestation request to UPF. After receiving the remote attestation request, UPF jointly verifies whether the UE is trustworthy with UDM. If the UE trust verification passes, UPF and MEC controller verify whether the target container is trustworthy; When both the UE and the target container pass the trusted verification, the UPF allows the UE to establish communication with the target container.

3. The user trusted access method for 5G edge computing nodes according to claim 2, characterized in that: Before the step of the UE initiating a remote certification request to the UPF, it also includes: securely initializing the UE, the target container, the MEC controller and the UDM, and the process includes: When the UE is initialized and started, the measured PCR value is sent to the UDM reference value library; When the host is initialized and started, the measured PCR value is sent to the reference value library of the MEC controller; When the container is initialized, the host's TPM issues a virtual identity authentication key certificate CvAIK1 for the vTPM instance on the target container. The key is vAIK1. When the target container is started, the vTPM is used for measurement, and the measured vPCR value is sent to the virtual reference value library in the host.

4. The user trusted access method for 5G edge computing nodes according to claim 2, characterized in that: After receiving the remote attestation request, the UPF jointly with the UDM verifies whether the UE is trustworthy, including: After receiving the remote attestation request, UPF initiates a UE trusted evidence verification request to UDM; UDM verifies the UE's trustworthy evidence and returns the UE trustworthy verification result response to UPF.

5. The user trusted access method for 5G edge computing nodes according to claim 4 is characterized in that: The process of the UPF jointly verifying whether the target container is trustworthy with the MEC controller includes: UPF initiates a container trusted evidence acquisition request to the target container; After receiving the container trusted evidence acquisition request, the target container generates a container trusted evidence response and sends it to the UPF; After receiving the container trusted evidence response, the UPF sends a container trusted evidence verification request to the MEC controller; The MEC controller receives the container trust evidence verification request, jointly verifies the container trust evidence and container trustworthiness with the host, and returns the container verification response result to the UPF.

6. The user trusted access method for 5G edge computing nodes according to claim 5, characterized in that: The process of UE initiating a remote attestation request to UPF includes: After the UE generates the random number nonce1, it initiates a remote attestation request to the UPF. The remote attestation request includes: target container ID, random number nonce1, UE_ID, and UE's trusted evidence. The UE's trusted evidence includes: the trusted measurement value PCR1 in the UE's TPM, the TPM's ID, and the signature S1 of PCR1 using the key AIK1.

7. The user trusted access method for 5G edge computing nodes according to claim 6, characterized in that: After receiving the remote attestation request, the UPF initiates the process of requesting UE trusted evidence verification to the UDM, including: After receiving the remote attestation request, UPF generates a random number nonce2 and initiates a UE trusted evidence verification request challenge to UDM. The UE trusted evidence verification request includes: random number nonce2, UE_ID, and the trusted evidence of the UE.

8. The user trusted access method for 5G edge computing nodes according to claim 7, characterized in that: The process in which the UDM verifies the UE's trustworthy evidence and returns a UE trustworthy verification result response to the UPF includes: UDM records nonce2 in the UE's trusted evidence verification request and verifies the UE's trusted evidence; UDM first verifies the signature S1 to confirm whether the UE's identity information is valid; After the UDM signature verification is completed, the PCR1 value is compared with the stored PCR reference value of the UE's TPM. If they are consistent, the UE is determined to be trustworthy; After determining that the UE is trustworthy, the UDM returns a UE trustworthy verification response including the UE trustworthy verification result to the UPF; UE trusted verification response includes: random number nonce2', UE_ID, UE trusted verification result Success / Failure; UPF receives the UE trusted verification response and determines whether the session is valid by verifying whether the random number nonce2' is the same as nonce2. If they are the same, the session is valid; If the session is valid, UPF reads the UE trusted verification result as Success, the UE trusted verification passes, and the verification continues; If the trusted verification result is Failure, UPF disconnects from the UE; If the trusted verification result is Success, UPF generates a random number nonce3 and initiates a container trusted evidence acquisition request to the target container. The container trusted evidence acquisition request includes the target container ID and the random number nonce3.

9. The user trusted access method for 5G edge computing nodes according to claim 8, characterized in that: After receiving the container trusted evidence acquisition request, the target container generates a container trusted evidence response and sends it to the UPF, including: The container trusted evidence response includes the random number nonce3' and the trusted evidence of the target container. The trusted evidence includes the trusted measurement value PCR2 of the TPM of the MEC host and the signature S2 of PCR2 using AIK2; the trusted measurement value vPCR1 of the vTPM instance in the target container and the signature S3 of vPCR1 using the key vAIK1.

10. The user trusted access method for 5G edge computing nodes according to claim 9, characterized in that: After receiving the container trusted evidence response, the UPF sends a container trusted evidence verification request to the MEC controller, including: After receiving the container's trusted evidence response, UPF determines whether the session is valid by verifying whether the random number nonce3' is the same as nonce3; If valid, UPF generates a random number nonce4 and sends a container trusted evidence verification request challenge to the MEC controller. The container trusted evidence verification request includes the random number nonce4, container ID and container trusted evidence.

11. The user trusted access method for 5G edge computing nodes according to claim 10, characterized in that: The MEC controller receives a container trust evidence verification request and jointly verifies the container trust evidence and the container trustworthiness with the host, including: The MEC controller receives the container trusted evidence verification request and verifies the signature S2; The MEC controller finds the corresponding host machine through the container ID. After verification, the MEC controller compares the PCR2 value with the stored PCR reference value of the host machine to determine whether the host machine is trustworthy; If the host is trustworthy, the MEC controller sends a container trust verification challenge to the host; The container trust verification request includes the container ID and container trust evidence; The host receives the container trusted verification request sent by the MEC controller; The host verifies signature S3. If signature S3 is verified successfully, the host compares vPCR1 with the vPCR reference value stored in the virtual reference library in the host, and returns the container trusted verification result Success / Failure to the MEC controller.

12. The user trusted access method for 5G edge computing nodes according to claim 11, characterized in that: The MEC controller returns the container trusted evidence verification response result to the UPF, including: random number nonce4', container ID, container trusted evidence verification result and container trusted verification result. If both verification results are Success, the UPF determines that both the UE and the container are trustworthy, and allows the UE to establish communication with the target container.

Images