Authentication method, device, electronic device and computer-readable storage medium

Abstract

The present disclosure provides an authentication method, device, electronic device and computer-readable storage medium. The authentication method includes: responding to a session establishment request from a target object to a target data network; obtaining a trusted user list of the target data network from a data management function module, wherein the trusted user list is used to confirm whether the object accessing the target data network is trustworthy; authenticating the target object according to the trusted user list, so that the target object can have a session with the target data network after the authentication is passed. The embodiment of the present disclosure can simply and efficiently authenticate the session establishment request of the target object.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an authentication method and device, an electronic device, and a computer-readable storage medium. Background Art

[0002] In the current communication environment, when electronic devices communicate, they usually need to access a data network through a communication network to implement a communication session with the data network.

[0003] When an electronic device requests to access a data network for a session, it is usually necessary to authenticate the session request of the electronic device to ensure the communication security of the data network.

[0004] However, in the prior art, the authentication of the session request of the electronic device is time-consuming and inefficient, which increases the response delay of the session request of the electronic device.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure. Summary of the invention

[0006] The purpose of the present disclosure is to provide an authentication method, an apparatus, an electronic device and a computer-readable storage medium, which can simplify the authentication process and improve the authentication speed while completing the authentication of the target object.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] The embodiment of the present disclosure provides an authentication method, comprising: responding to a session establishment request of a target object for a target data network; obtaining a trusted user list of the target data network from a data management function module, wherein the trusted user list is used to confirm whether the object accessing the target data network is trustworthy; and authenticating the target object according to the trusted user list so that the target object can conduct a session with the target data network after the authentication is passed.

[0009] In some embodiments, authenticating the target object according to the trusted user list includes: sending an authentication request to the target data network according to the session establishment request, the authentication request carrying the trusted user list; the target data network determining that the trustworthiness of the target object in the trusted user list is trustworthy; the target data network no longer performs information authentication on the target object, and returns an authentication success response to the target object so that the target object can conduct a session with the target data network.

[0010] In some embodiments, the method further includes: the target data network determines that the trustworthiness of the target object in the trusted user list is untrustworthy; the target data network performs information authentication on the target object according to the authentication request to determine whether the target object is a trusted user, so as to control the session between the target object and the target data network according to the authentication result of the target data network on the target object.

[0011] In some embodiments, authenticating the target object according to the trusted user list includes: determining that the trustworthiness of the target object in the trusted user list is trustworthy; sending a notification message of successful authentication of the target object to the target data network; and sending an authentication success response to the target object so that the target object can conduct a conversation with the target data network.

[0012] In some embodiments, the method further includes: determining whether the trustworthiness of the target object in the trusted user list is untrustworthy; sending an authentication request to the target data network so that the target data network performs information authentication on the target object according to the authentication request to determine whether the target object is a trusted user.

[0013] In some embodiments, the data management function module stores object information that has signed a contract with the target data network; before obtaining a list of trusted users of the target data network from the data management function module, the method further includes: generating an authentication information table based on the object information that has signed a contract with the target data network; setting the trust status corresponding to each object in the authentication information table to untrustworthy to generate the list of trusted users.

[0014] In some embodiments, the trusted user list includes the trustworthiness of preset objects; wherein the method further comprises: a network administrator updates the trustworthiness of the preset objects in the trusted user list to trusted through an application function module.

[0015] In some embodiments, the trusted user list includes the trust status of multiple objects, and the multiple objects include the target object; wherein, authenticating the target object according to the trusted user list includes: authenticating the target object according to the trusted user list to determine that the target object is a trusted user; sending confirmation information that the target object is a trusted user to the data management function module, so that the data management function module updates the trust status of the target object in the trusted user list to trusted according to the trusted user confirmation information.

[0016] The embodiment of the present disclosure provides an authentication device, including: a session establishment request acquisition module, a trusted user list acquisition module and an authentication module.

[0017] Among them, the session establishment request acquisition module is used to respond to the session establishment request of the target object for the target data network; the trusted user list acquisition module can be used to obtain the trusted user list of the target data network from the data management function module, and the trusted user list is used to confirm whether the object accessing the target data network is trustworthy; the authentication module can be used to authenticate the target object according to the trusted user list, so that the target object can conduct a session with the target data network after the authentication is passed.

[0018] An embodiment of the present disclosure proposes an electronic device, which includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement any of the authentication methods described above.

[0019] The embodiment of the present disclosure provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the authentication method as described in any one of the above items is implemented.

[0020] The embodiment of the present disclosure provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above-mentioned authentication method.

[0021] The authentication method, device, electronic device and computer-readable storage medium provided by the embodiments of the present disclosure authenticate the target object through the trusted user list in the data management function module, thereby improving the authentication efficiency and reducing the session request delay.

[0022] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0024] Figure 1A schematic diagram showing an exemplary system architecture that can be applied to an authentication method or an authentication device according to an embodiment of the present disclosure.

[0025] Figure 2 The figure is a flow chart of an authentication method according to an exemplary embodiment.

[0026] Figure 3 The invention is an authentication method according to an exemplary embodiment.

[0027] Figure 4 The figure is a flow chart of an authentication method according to an exemplary embodiment.

[0028] Figure 5 The figure is a flow chart of an authentication method according to an exemplary embodiment.

[0029] Figure 6 It is a timing diagram of an authentication method according to an exemplary embodiment.

[0030] Figure 7 The invention is a block diagram of an authentication device according to an exemplary embodiment.

[0031] Figure 8 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0033] The features, structures or characteristics described in the present disclosure may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0034] The accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some block diagrams shown in the accompanying drawings do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0035] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and steps, nor must they be executed in the order described. For example, some steps can be decomposed, and some steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0036] In this specification, the terms "a", "an", "the", "said" and "at least one" are used to indicate the presence of one or more elements / components / etc.; the terms "comprising", "including" and "having" are used to express an open-ended inclusion and mean that additional elements / components / etc. may exist in addition to the listed elements / components / etc.; the terms "first", "second" and "third" etc. are used only as labels and are not intended to limit the quantity of their objects.

[0037] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0038] Figure 1 A schematic diagram showing an exemplary system architecture that can be applied to an authentication method or an authentication device according to an embodiment of the present disclosure.

[0039] like Figure 1 As shown, the system architecture 100 may include terminal devices 101 , 102 , 103 , a communication network 104 and a data network server 105 .

[0040] The communication network 104 may be used to provide a communication link between the terminal devices 101 , 102 , 103 and the data network server 105 .

[0041] The communication network 104 can be a 5G (5th Generation Mobile Communication Technology) communication network, a 4G (4th Generation Mobile Communication Technology) communication network, a 3G (3rd Generation Mobile Communication Technology) communication network, a 2G (2nd Generation Mobile Communication Technology) communication network, and a future 6G (6th Generation Mobile Communication Technology) communication network, a 7G (7th Generation Mobile Communication Technology) communication network, etc., and the present disclosure does not impose any restrictions on this.

[0042] The communication network 104 may, for example, respond to a session establishment request from a target object to a target data network; the communication network 104 may, for example, obtain a trusted user list of the target data network from a data management function module, wherein the trusted user list is used to confirm whether the object accessing the target data network is trustworthy; the communication network 104 may, for example, authenticate the target object based on the trusted user list so that the target object can conduct a session with the target data network after authentication is passed.

[0043] The user can use the terminal devices 101, 102, 103 to send a session request to the data network server 105 through the communication network 104 to perform a session interaction with the data network server 105. The terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, wearable devices, virtual reality devices, smart homes, etc.

[0044] The data network server 105 may be a server that provides various services, such as a server that provides services for the communication network 104, or a server that provides services for third-party services, which is not limited in the present disclosure.

[0045] The server can be an independent physical server or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as basic cloud computing services such as big data and artificial intelligence platforms, etc. The present disclosure does not impose any restrictions on this.

[0046] It should be understood that Figure 1 The number of terminal devices, networks and servers in the figure is only for illustration. The data network server 105 may be a physical server or may be composed of multiple servers. According to actual needs, it may have any number of terminal devices, networks and servers.

[0047] Figure 2 1 is a flowchart of an authentication method according to an exemplary embodiment. The method provided in the embodiment of the present disclosure can be performed by any communication network with communication capabilities, such as a 5G communication network system. The present disclosure will be described by taking the 5G communication network system as an example, but the present disclosure does not limit this.

[0048] Among them, the 5G communication network may include 5G base station (gNB), access and mobility management function module (Access and Mobility Management Function, AMF), session management function module (Session Management function, SMF), unified data management function module (The Unified Data Management, UDM), user plane function module (The User plane function, UPF) and other functional modules.

[0049] Reference Figure 2 The authentication method provided by the embodiment of the present disclosure may include the following steps.

[0050] Step S202: responding to a session establishment request from a target object to a target data network.

[0051] The target data network (DN) may be an operator's service network, the Internet, or a third-party service network, etc., and this disclosure does not impose any restrictions on this.

[0052] Step S204: obtaining a trusted user list of the target data network from the data management function module, wherein the trusted user list is used to confirm whether the object accessing the target data network is trustworthy.

[0053] The data management function module may be a module for performing data management in a communication network, such as a function module for performing access authorization, user identification, network registration, movement, subscription, SMS management, etc.

[0054] Among them, the data management function module can be a unified data management function module UDM in the 5G communication network.

[0055] The present disclosure takes the UDM in the 5G communication system as an example to illustrate the data management function module, but the present disclosure is not limited to this.

[0056] In some embodiments, the data management module may store a list of GPSIs (Generic Public Subscription Identifiers) of registered users of various data networks. The same user may have different user identifiers in the GPSI lists of different data networks.

[0057] The GPSI list contains information about the objects of the contracted data network, and the user identifiers in the GPSI list are provided by the corresponding data network.

[0058] In some embodiments, a trusted user list may be set in the data management function module, and the trusted user list corresponds to a GPSI (Generic Public Subscription Identifier) ​​list.

[0059] The above-mentioned trusted user list can be generated according to the following method: an authentication information table can be generated according to the object information of the contracted target data network, and the authentication information table can include the user identification of each object in the target data network and the trustworthiness of the object; then the trustworthiness corresponding to each object in the authentication information table is set to untrustworthy to initially generate a trusted user list.

[0060] It should be noted that those skilled in the art can use different information to identify the trust status of an object as untrustworthy according to their needs. For example, the trust status can be set to "no", the trust status can be set to "untrustworthy", etc. This disclosure does not limit this.

[0061] It should be noted that whenever an object is updated in GPSI, the trusted user list will also be updated to generate the trust status of the object accordingly. However, when the object is updated, the initial trust status is set to untrustworthy.

[0062] In some embodiments, different data networks may correspond to one GPSI list, and different data networks may correspond to different GPSI lists. Therefore, the same data network may correspond to the same trusted user list, and different data networks may correspond to different trusted user lists.

[0063] Therefore, the data management function module may maintain multiple trusted user lists for different data networks.

[0064] Therefore, upon receiving a session establishment request for a target data network, multiple trusted user lists corresponding to the target data network may be determined from the data function module, and then a target trusted user list corresponding to the target data network may be determined from the multiple trusted user lists.

[0065] In addition, in 5G communication, users communicate in a virtual network group (5G LAN Virtual Network group, 5GLAN VN group), so the data management function module may maintain different trusted user lists for different virtual network groups.

[0066] For example, for a certain virtual network group VN, multiple trusted user lists may be maintained for it according to its corresponding relationship with multiple data networks, and the present disclosure does not impose any limitation on this.

[0067] If trusted user lists of multiple data networks are maintained for a certain virtual network group, then when responding to a session establishment request from a target object for a target data network, it is necessary to first determine the target virtual network group where the target object is located, and then determine it from the multiple trusted user lists corresponding to the target virtual network group.

[0068] It may be noted that the above-mentioned trustworthy user list includes the trustworthiness of preset objects.

[0069] When the trust status is initially set for the preset object, if the trust status corresponding to the preset object is untrustworthy, the network administrator may update the trust status of the preset object in the trusted user list to trustworthy through the application function module.

[0070] That is, the network administrator can maintain the trustworthiness of objects in the trusted user list.

[0071] Step S206: authenticating the target object according to the trusted user list, so that the target object can have a conversation with the target data network after the authentication is passed.

[0072] In some embodiments, when a target trusted user list of a target data network is obtained, an authentication process may be performed on a session establishment request of a target object according to the target trusted user list.

[0073] In some embodiments, when the target object is determined to be a trusted user after being authenticated according to a trusted user list, confirmation information that the target object is a trusted user can be sent to the data management function module so that the data management function module can update the trust status of the target object in the trusted user list to trusted according to the trusted user confirmation information.

[0074] Of course, if the trustworthiness of the target object in the trusted user list is already trustworthy, the information is kept unchanged.

[0075] The technical solution provided in this embodiment maintains a target trusted user list in the data management module, and authenticates the session establishment request of the target object through the trusted user list. Compared with directly initiating an authentication request to the target data network, the number of data interactions is reduced and the authentication speed is improved.

[0076] Figure 3 The invention is an authentication method according to an exemplary embodiment.

[0077] refer to Figure 3 , the above authentication method may include the following steps.

[0078] Step S302: responding to a session establishment request from a target object to a target data network.

[0079] Step S304: Obtain a list of trusted users of the target data network from the data management function module. The list of trusted users is used to confirm whether the object accessing the target data network is trustworthy.

[0080] Step S306: Send an authentication request to the target data network according to the session establishment request, wherein the authentication request carries the trusted user list.

[0081] Step S308: The target data network determines that the trustworthiness of the target object in the trustworthy user list is trustworthy.

[0082] In some embodiments, the trustworthy user list may record the trustworthiness of each user in the target data network, and the trustworthiness may be trustworthy or untrustworthy.

[0083] Step S310: the target data network no longer performs information authentication on the target object, and returns an authentication success response to the target object, so that the target object can conduct a session with the target data network.

[0084] In some embodiments, when the target data network determines that the target object is trustworthy based on the records in the target trusted user list, the target data network no longer performs authentication processing on the target object, and directly returns an authentication success response to the target object so that the target object and the target data network can continue the remaining session process.

[0085] Step S312: the target data network determines that the trustworthiness of the target object in the trustworthy user list is untrustworthy.

[0086] Step S314: the target data network performs information authentication on the target object according to the authentication request to determine whether the target object is a trustworthy user, so as to control the session between the target object and the target data network according to the authentication result of the target data network on the target object.

[0087] In some embodiments, the session establishment request sent by the target object may include identity verification information, region verification information, and any other verification information that can verify the access authority of the target object.

[0088] In some embodiments, when the target data network determines that the target object is untrustworthy based on the record in the target trusted user list, the target data network performs information authentication based on the verification information in the session establishment request carried in the authentication request to determine whether the target object has access authority.

[0089] In some embodiments, if the target data network determines that the target object does not have access authority according to the authentication request, a prompt request indicating that the authentication is unsuccessful is sent to the target object to deny the target object session access.

[0090] In some embodiments, if the target data network determines that the target object has the right to access according to the authentication request, an authentication success response is sent to the target object so that the target object can continue the session process with the target data network.

[0091] In addition, when the target data network determines that the target object has the right to access, it will also send confirmation information that the target object is a trusted user to the data management function module, so that the data management function module can update the trust status of the target object in the trusted user list to trusted according to the trusted user confirmation information, so that the next time the target object requests session access, there is no need to authenticate the target object's information, and the target object's session access can be directly allowed.

[0092] In the above embodiment, when the target data network determines that the target object is a trusted user according to the target trusted user list, it no longer authenticates the information of the target object, but directly authenticates the target object, thereby saving authentication time, reducing the authentication process, and improving the authentication efficiency. On the other hand, when the target data network determines that the target object is an untrustworthy user according to the target trusted user list, it will authenticate the information of the target object, and then reversely update the trustworthiness of the target object in the target trusted user list after the information authentication, so that the next time the target object is authenticated, there is no need to authenticate the information, and it is sufficient to directly judge the authentication success according to the target trusted user list, thereby greatly improving the authentication efficiency.

[0093] Figure 4 The figure is a flow chart of an authentication method according to an exemplary embodiment.

[0094] refer to Figure 4 , the above authentication method may include the following steps.

[0095] Step S402: responding to a session establishment request from a target object to a target data network.

[0096] Step S404: Acquire a trusted user list of the target data network from the data management function module, wherein the trusted user list is used to confirm whether the object accessing the target data network is trustworthy.

[0097] Step S406: Determine whether the trustworthiness of the target object in the trustworthy user list is trustworthy.

[0098] Step S408: Sending notification information of successful authentication of the target object to the target data network.

[0099] Step S410: Send an authentication success response to the target object so that the target object can conduct a session with the target data network.

[0100] Step S412: Determine whether the trustworthiness of the target object in the trustworthy user list is untrustworthy.

[0101] Step S414: sending an authentication request to the target data network, so that the target data network performs information authentication on the target object according to the authentication request to determine whether the target object is a trustworthy user.

[0102] In some embodiments, the target data network performs information authentication processing based on the verification information in the session establishment request carried in the authentication request to determine whether the target object has the authority to access.

[0103] In some embodiments, if the target data network determines that the target object does not have access authority according to the authentication request, a prompt request indicating that the authentication is unsuccessful is sent to the target object to deny the target object session access.

[0104] In some embodiments, if the target data network determines that the target object has the right to access according to the authentication request, an authentication success response is sent to the target object so that the target object can continue the session process with the target data network.

[0105] In addition, when the target data network determines that the target object has the right to access, it will also send confirmation information that the target object is a trusted user to the data management function module, so that the data management function module can update the trust status of the target object in the trusted user list to trusted according to the trusted user confirmation information, so that the next time the target object requests session access, there is no need to authenticate the target object's information, and the target object's session access can be directly allowed.

[0106] In the above embodiment, when the target object is judged to be a trusted user according to the target trusted user list, authentication is no longer initiated to the target data network, and the target object is directly authenticated, which saves authentication time, reduces the authentication process, and improves authentication efficiency; on the other hand, when the target object is judged to be an untrusted user according to the target trusted user list, an authentication request is initiated to the target data network, and the trusted information of the target object in the target trusted user list is reversely updated after the target data network authenticates the information of the target object, so that the next time the target object is authenticated, there is no need to authenticate the information again, and the authentication success judgment can be made directly according to the target trusted user list, which simplifies the process, reduces the session service delay, greatly improves the authentication efficiency, and enhances the session service experience.

[0107] Figure 5 The figure is a flow chart of an authentication method according to an exemplary embodiment.

[0108] The disclosed embodiment provides a 5G LAN VN group (5G virtual network group) secondary authentication method. This embodiment can simplify the secondary authentication process by adding and maintaining a trusted user list. The purpose of establishing a trusted user list is to simplify the secondary authentication process during the establishment of a PDU (Protocol Data Unit) session (a process of communication between a user terminal UE (User Equipment) and a data network DN), thereby reducing service latency and improving service experience.

[0109] The embodiment of the present disclosure will take the example of a 5G communication system responding to a user's session request to perform secondary authentication on a user as an example, but is not limited to this. Specifically, the following steps may be included:

[0110] Step S501, the session management function module SMF obtains information such as the contracted user information and the target trusted user list in the target data network from the data management function module UDM.

[0111] SMF obtains UE contract information and other information from UDM. At the same time, it will obtain the corresponding information of this UE in the trusted user list. The trusted user list corresponds to the GPSI list one by one, and one GPSI corresponds to a value in the trusted user list. This trusted user list, like other virtual network data, can be initially configured by the network administrator, or it can be dynamically configured and stored in the UDM by the UE that has passed the secondary authentication through AF (Application Function). The default value of the list is no.

[0112] Step S502: the session management function module SMF sends an authentication request to the target data network.

[0113] The session management function module SMF sends an authentication request. The session management function module SMF initiates an authentication / authorization request to DN-AAA (Authentication, Authorization and Accounting, a data network server). SMF selects UPF as needed, establishes a path between SMF and DN-AAA, and then SMF sends an authentication / authorization request to DN-AAA.

[0114] Step S503: The target data network determines that the target object in the trusted list is a trusted user.

[0115] If the target object is determined to be an untrustworthy user, step S504 is executed, and the target data network and the target object perform a DN authentication process through the session management function module SMF.

[0116] Step S505: The target data network provides an authentication success response.

[0117] DN-AAA provides an authentication response. If the value corresponding to the UE in the trusted user list is yes, DN-AAA provides authorization data to SMF; if the value is no, the original DN authentication process is followed. After the authentication is passed, DN-AAA provides authorization data to SMF. After that, the PDU session establishment process continues.

[0118] Step S506: the target value data network sends confirmation information that the target object is a trusted user to the data management function module, so that the data management function module maintains and updates the target trusted user list according to the trusted user confirmation information.

[0119] Step S507: The trusted user list may be maintained via the application function module AF.

[0120] The UE that has passed the secondary authentication can maintain a list of trusted users through the AF.

[0121] Compared with the existing process of performing a complete PDU session establishment process when each UE establishes a PDU session, this application can simplify the secondary authentication process, reduce service latency, and improve service experience while ensuring security.

[0122] Figure 6 It is a timing diagram of an authentication method according to an exemplary embodiment.

[0123] Initially configure the trusted user list parameters of UE in 5G LAN in UDM, the default value is No. The list can be initialized by the network administrator.

[0124] refer to Figure 6 , the above authentication method may include the following steps.

[0125] 2-1.PDU sends a session establishment request for the target terminal to AMF.

[0126] 2-2.AMF selects SMF.

[0127] 2-3.AMF calls the session service of the selected SMF to trigger session establishment.

[0128] 3.SMF obtains the session management contract data from UDM, including the value corresponding to the target terminal in the trusted user list.

[0129] 4.SMF selects UPF as needed, establishes a path between SMF and DN-AAA (data network authentication authorization accounting server), and the N4 (a type of session) session is established.

[0130] 5.SMF sends an authentication / authorization request to DN-AAA.

[0131] 6. If the value corresponding to the target terminal in the trusted user list is no, the DN-AAA and the target terminal perform the DN authentication process through the SMF. If the value corresponding to the UE in the trusted user list is yes, this process can be simplified.

[0132] 7. DN-AAA provides authorization information to SMF.

[0133] 8. The target terminal and DN-AAA continue the PDU session establishment process.

[0134] The disclosed embodiment maintains a trusted user list in the UDM, which corresponds to the GPSI list that indicates each UE in the 5G LAN, and its default value is no; the trusted user list is stored in the UDM, and the value corresponding to the UE in the list can be extracted when the SMF obtains the contract information from the UDM; the trusted user list can be initialized and configured by the network administrator, or dynamically configured by the AF; if the corresponding value in the trusted user list is yes, the UE can simplify the corresponding DN authentication process when performing secondary authentication. Otherwise, the general secondary authentication process is executed.

[0135] The technical solution provided in this embodiment maintains a target trusted user list in the data management module, and authenticates the session establishment request of the target object through the trusted user list. Compared with directly initiating an authentication request to the target data network, the number of data interactions is reduced and the authentication speed is improved.

[0136] Figure 7 is a block diagram of an authentication device according to an exemplary embodiment. Figure 7 The authentication device 700 provided in the embodiment of the present disclosure may include: a session establishment request acquisition module 701, a trusted user list acquisition module 702 and an authentication module 703.

[0137] Among them, the session establishment request acquisition module 701 can be used to respond to the session establishment request of the target object for the target data network; the trusted user list acquisition module 702 can be used to obtain the trusted user list of the target data network from the data management function module, and the trusted user list is used to confirm whether the object accessing the target data network is trustworthy; the authentication module 703 can be used to authenticate the target object according to the trusted user list, so that the target object can conduct a session with the target data network after the authentication is passed.

[0138] In some embodiments, the authentication module 703 may include: an authentication request sending submodule, a trustworthy determination submodule, and a non-authentication determination submodule.

[0139] Among them, the authentication request sending submodule can be used to send an authentication request to the target data network according to the session establishment request, and the authentication request carries the trusted user list; the trusted determination submodule can be used by the target data network to determine that the trustworthiness of the target object in the trusted user list is trustworthy; the non-authentication determination submodule can be used by the target data network to no longer perform information authentication on the target object, and return an authentication success response to the target object, so that the target object can conduct a session with the target data network.

[0140] In some embodiments, the authentication module 703 may further include: an untrustworthy determination submodule and an information authentication submodule.

[0141] Among them, the untrustworthy submodule can be used by the target data network to determine whether the trustworthiness of the target object in the trusted user list is untrustworthy; the information authentication submodule can be used by the target data network to perform information authentication on the target object according to the authentication request to determine whether the target object is a trusted user, so as to control the session between the target object and the target data network according to the authentication result of the target data network on the target object.

[0142] In some embodiments, the authentication module 703 may include: a user trustworthiness determination submodule, an authentication success notification submodule, and an authentication success response submodule.

[0143] Among them, the user trust determination submodule can be used to determine whether the target object in the trusted user list is trustworthy; the authentication success notification submodule can be used to send notification information of successful authentication of the target object to the target data network; the authentication success response submodule can be used to send an authentication success response to the target object so that the target object can conduct a conversation with the target data network.

[0144] In some embodiments, the authentication module 703 may further include: a user untrustworthy determination submodule and an authentication request sending submodule.

[0145] The user untrustworthy determination submodule can be used to determine whether the trustworthiness of the target object in the trusted user list is untrustworthy; the authentication request sending submodule can be used to send an authentication request to the target data network so that the target data network performs information authentication on the target object according to the authentication request to determine whether the target object is a trustworthy user.

[0146] In some embodiments, the data management function module stores information of objects subscribed to the target data network; the authentication device may further include: an authentication information table generation module and a trusted user list generation module.

[0147] Among them, the authentication information table generation module can be used to generate an authentication information table according to the object information of the target data network; the trusted user list generation module can be used to set the trust status corresponding to each object in the authentication information table to untrustworthy to generate the trusted user list.

[0148] In some embodiments, the trustworthy user list includes the trustworthiness of preset objects; wherein, the authentication device may further include: a trustworthiness setting module.

[0149] The trust status setting module can be used by a network administrator to update the trust status of the preset object in the trustworthy user list to trustworthy through an application function module.

[0150] In some embodiments, the trusted user list includes the trustworthiness of multiple objects, and the multiple objects include the target object; wherein the authentication module 703 may include: a trusted user determination submodule and a user confirmation information sending submodule.

[0151] Among them, the trusted user determination submodule can be used to authenticate the target object according to the trusted user list to determine that the target object is a trusted user; the user confirmation information sending submodule can be used to send confirmation information that the target object is a trusted user to the data management function module, so that the data management function module can update the trustworthiness of the target object in the trusted user list to trusted according to the trusted user confirmation information.

[0152] Since the functions of the device 700 have been described in detail in the corresponding method embodiments, the present disclosure will not elaborate on them here.

[0153] The modules and / or submodules involved in the embodiments described in the present application may be implemented by software or hardware. The modules and / or submodules described may also be arranged in a processor. The names of these modules and / or submodules do not, in certain cases, constitute limitations on the modules and / or submodules themselves.

[0154] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0155] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0156] Figure 8 The structure diagram of the electronic device suitable for implementing the embodiment of the present disclosure is shown. It should be noted that: Figure 8 The electronic device 800 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0157] like Figure 8 As shown, the electronic device 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 are also stored. The CPU 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0158] The following components are connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage section 808 as needed.

[0159] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 809, and / or installed from a removable medium 811. When the computer program is executed by a central processing unit (CPU) 801, the above-mentioned functions defined in the system of the present application are executed.

[0160] It should be noted that the computer-readable storage medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0161] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed by a device, the device can implement functions including: responding to a session establishment request of a target object for a target data network; obtaining a trusted user list of the target data network from a data management function module, the trusted user list is used to confirm whether the object accessing the target data network is trustworthy; authenticating the target object according to the trusted user list, so that the target object can have a session with the target data network after the authentication is passed.

[0162] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above-mentioned embodiments.

[0163] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for a computing device (which can be a personal computer, a server, a mobile terminal, or a smart device, etc.) to execute the method according to the embodiment of the present disclosure, for example Figure 2 , Figure 3 , Figure 4 ,or Figure 5 One or more of the steps shown.

[0164] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the disclosure disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not applied for by the present disclosure. The specification and examples are to be regarded as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0165] It should be understood that the present disclosure is not limited to the detailed structures, drawings or implementations shown herein, but rather the present disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. An authentication method, characterized in that: include: In response to a session establishment request from a target object for a target data network, the session establishment request includes verification information for verifying access rights of the target object; Acquire a target trusted user list of the target data network from a data management function module, wherein the target trusted user list is used to confirm whether an object accessing the target data network is trustworthy; Authenticating the target object according to the target trusted user list so that the target object can have a conversation with the target data network after the authentication is passed; The target object is authenticated according to the target trusted user list, including: Sending an authentication request to the target data network according to the session establishment request, wherein the authentication request carries the target trusted user list and the authentication request carries the verification information in the session establishment request; The target data network determines that the trustworthiness of the target object in the target trusted user list is trustworthy; the target data network no longer performs information authentication on the target object, and returns an authentication success response to the target object, so that the target object can have a conversation with the target data network; The target data network determines that the trustworthiness of the target object in the target trusted user list is untrustworthy; the target data network performs information authentication on the target object according to the verification information in the session establishment request carried in the authentication request to determine whether the target object is a trusted user, so as to control the session between the target object and the target data network according to the authentication result of the target data network on the target object.

2. The method according to claim 1, characterized in that: Authenticating the target object according to the target trusted user list includes: Determining that the trustworthiness of the target object in the target trusted user list is trustworthy; Sending a notification message of successful authentication of the target object to the target data network; An authentication success response is sent to the target object so that the target object can conduct a session with the target data network.

3. The method according to claim 2, characterized in that: The method further comprises: Determining that the trustworthiness of the target object in the target trusted user list is untrustworthy; An authentication request is sent to the target data network so that the target data network performs information authentication on the target object according to the authentication request to determine whether the target object is a trustworthy user.

4. The method according to claim 1, characterized in that: The data management function module stores information about objects that have signed up for the target data network; Before obtaining the target trusted user list of the target data network from the data management function module, the method further includes: Generate an authentication information table according to the object information of signing the target data network; The trust status corresponding to each object in the authentication information table is set to untrustworthy, so as to generate the target trusted user list.

5. The method according to claim 4, characterized in that: The target trusted user list includes the trustworthiness of preset objects; wherein the method further includes: The network administrator updates the trust status of the preset object in the target trustworthy user list to trustworthy through the application function module.

6. The method according to claim 1, characterized in that: The target trusted user list includes the trustworthiness of multiple objects, and the multiple objects include the target object; wherein authenticating the target object according to the target trusted user list includes: Authenticating the target object according to the target trusted user list to determine whether the target object is a trusted user; Sending the target object to the data management function module is a trustworthy user confirmation information, so that the data management function module updates the trustworthiness of the target object in the target trustworthy user list to trustworthy according to the trustworthy user confirmation information.

7. An authentication device, characterized in that: The device comprises: A session establishment request acquisition module, used to respond to a session establishment request from a target object to a target data network, wherein the session establishment request includes verification information for verifying the access authority of the target object; A target trusted user list acquisition module, used to acquire a target trusted user list of the target data network from the data management function module, wherein the target trusted user list is used to confirm whether the object accessing the target data network is trustworthy; An authentication module, used for authenticating the target object according to the target trusted user list, so that the target object can have a conversation with the target data network after the authentication is passed; The target object is authenticated according to the target trusted user list, including: Sending an authentication request to the target data network according to the session establishment request, wherein the authentication request carries the target trusted user list and the authentication request carries the verification information in the session establishment request; The target data network determines that the trustworthiness of the target object in the target trusted user list is trustworthy; the target data network no longer performs information authentication on the target object, and returns an authentication success response to the target object, so that the target object can have a conversation with the target data network; The target data network determines that the trustworthiness of the target object in the target trusted user list is untrustworthy; the target data network performs information authentication on the target object according to the verification information in the session establishment request carried in the authentication request to determine whether the target object is a trusted user, so as to control the session between the target object and the target data network according to the authentication result of the target data network on the target object.

8. An electronic device, characterized in that: include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the authentication method according to any one of claims 1 to 6 based on instructions stored in the memory.

9. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the authentication method according to any one of claims 1 to 6 is implemented.

Images