Network connection information verification method, device, system and electronic equipment

Abstract

The application provides a network connection information verification method, device and system and electronic equipment, and relates to the technical field of cloud computing. The method comprises the following steps: if the application server detects that the network connection information in the network message sent by the terminal device through the cellular network changes, obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator server; and if the network connection information in the network message and the network connection information corresponding to the unique identifier match, determining that the network connection information in the network message is verified. In the embodiment, if the network connection information in the network message sent by the terminal device is detected to change, the network connection information in the network message is verified through the interaction between the application server and the operator server, and the interaction between the terminal device and the application server is not required, thereby saving the flow consumption of the terminal device.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method, apparatus and electronic device for verifying network connection information. Background Technology

[0002] QUIC (Quick User Datagram Protocol Internet Connections) is an experimental transport layer network protocol with low connection and transmission latency, providing usable service even under severe packet loss and network latency conditions. QUIC allows for the implementation of different congestion control algorithms at the application level without requiring operating system or kernel support. This provides greater flexibility for modification compared to the traditional TCP protocol, making it ideal for services where TCP optimization has reached a bottleneck.

[0003] The QUIC protocol supports connection migration, which refers to maintaining the existing connection even when network connection information such as Internet Protocol (IP) address or port number changes, avoiding the overhead of repeatedly establishing a connection. However, while connection migration brings convenience, it also poses security risks. To eliminate these risks, path verification technology is required. Cellular devices using the QUIC protocol frequently undergo path verification because their IP address and port number change frequently, resulting in significant bandwidth overhead. Summary of the Invention

[0004] This application provides a method, apparatus, system, and electronic device for verifying network connection information, in order to avoid the traffic overhead caused by path verification of cellular connection devices.

[0005] In a first aspect, embodiments of this application provide a method for verifying network connection information, applied to an application server, the method comprising:

[0006] If a change in network connection information is detected in a network packet sent by a terminal device through a cellular network, the network connection information corresponding to the unique identifier of the terminal device's service card is obtained from the operator's server.

[0007] If the network connection information in the network packet matches the network connection information corresponding to the unique identifier, then the network connection information in the network packet is verified successfully.

[0008] Secondly, embodiments of this application provide a network connection information verification device, applied to an application server, the device comprising:

[0009] The detection module is used to obtain the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server if it detects that the network connection information in the network packets sent by the terminal device through the cellular network has changed.

[0010] The verification module is used to determine that the network connection information in the network packet has been verified if the network connection information in the network packet matches the network connection information corresponding to the unique identifier.

[0011] Thirdly, embodiments of this application provide a network connection information verification system, including an IoT platform, an operator server, and IoT devices; the IoT platform and IoT devices establish a connection through the Fast User Datagram Network Connection Protocol (QUIC);

[0012] Internet of Things (IoT) devices are used to send network messages to an IoT platform via cellular networks.

[0013] The IoT platform is used to obtain the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server when it detects a change in the network connection information in the network packets sent by IoT devices through the cellular network; if the network connection information in the network packet matches the network connection information corresponding to the unique identifier, it is determined that the network connection information in the network packet has been verified.

[0014] The operator server is used to query the network connection information corresponding to the unique identifier of the service card of the terminal device carried in the query request sent by the IoT platform, and then send it to the IoT platform.

[0015] Fourthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described in any of the above-mentioned embodiments.

[0016] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the preceding claims.

[0017] Compared with the prior art, this application has the following advantages:

[0018] This application provides a method, apparatus, system, and electronic device for verifying network connection information. If an application server detects a change in the network connection information in a network packet sent by a terminal device via a cellular network, it obtains the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server. If the network connection information in the network packet matches the network connection information corresponding to the unique identifier, it is determined that the network connection information in the network packet has been verified. In this embodiment, if a change in the network connection information in a network packet sent by the terminal device is detected, the network connection information in the network packet is verified through interaction between the application server and the operator's server. This eliminates the need for interaction between the terminal device and the application server, saving the terminal device's bandwidth overhead.

[0019] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application, it can be implemented according to the contents of the specification. In order to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description

[0020] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments according to this application and should not be construed as limiting the scope of this application.

[0021] Figure 1 This is a schematic diagram of a reflection attack in related technologies;

[0022] Figure 2 This is a schematic diagram of the interaction process for path verification in related technologies;

[0023] Figure 3 A schematic diagram illustrating an application scenario of the network connection information verification method provided in this application;

[0024] Figure 4 This is a flowchart of a method for verifying network connection information according to an embodiment of this application;

[0025] Figure 5 This is a structural block diagram of a network connection information verification device according to an embodiment of this application; and

[0026] Figure 6 This is a block diagram of an electronic device used to implement embodiments of this application. Detailed Implementation

[0027] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the concept or scope of this application. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0028] To facilitate understanding of the technical solutions of the embodiments of this application, the relevant technologies of the embodiments of this application are described below. The following relevant technologies are optional solutions and can be combined with the technical solutions of the embodiments of this application in any way, and all of them fall within the protection scope of the embodiments of this application.

[0029] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0030] One of the security vulnerabilities associated with using the QUIC protocol for connection migration in cellular networks is reflection attacks. Reflection attacks, such as... Figure 1 As shown, a device with a real IP address of 5.6.7.8 (such as...) Figure 1 The Attacker shown would spoof its IP address as 1.2.3.4 and send messages to a server (such as...). Figure 1 The server shown (with its real IP address 10.0.0.8) sends a Domain Name System (DNS) request message (as shown in the image). The source IP address in the request message is 1.2.3.4, and the destination IP address is 10.0.0.8. This prompts the server to send a large number of response messages (as shown in the image) to the device with the IP address 1.2.3.4 (e.g., [device name]). Figure 1 The Victim shown in the image has a source IP of 10.0.0.8 and a destination IP of 1.2.3.4 in its reply message. The consequence of a reflection attack is that the attacked device receives a large number of messages without warning, causing denial-of-service (DoS) problems. Reflection attacks are often accompanied by amplification attacks, where sending small data packets induces the server to send a large number of reply messages.

[0031] In related technologies, IoT SIM card devices and IoT platforms avoid reflection attacks through path verification. The path verification interaction process is as follows: Figure 2As shown. An IoT SIM card device is a terminal device that uses an IoT SIM card. The IoT SIM card device sends network packets to the IoT platform, carrying the source IP address 1. If the source IP address 1 has not changed, no processing is required, such as... Figure 2 The None-Probing packet shown alleviates the pressure of reflection attacks by using path verification when the source IP1 of the IoT SIM card device changes to source IP2. The IoT platform sends a path verification challenge frame to the IoT SIM card device, such as... Figure 2 The PATH-CHALLENGE shown carries a token, and the IoT card device sends a response frame to the IoT platform, such as... Figure 2 The PATH-RESPONSE shown expects the other party to reply with the same token. Path verification can determine whether the changed source IP is secure. If the path verification passes and the source IP2 does not change again, no further action is needed, such as... Figure 2 The image shows a None-Probing packet. However, IoT SIM card devices are sensitive to bandwidth usage. Each path verification operation requires over 1200 bytes for both PATH_CHANLLENGE and PATH_RESPONSE, meaning each verification requires at least 2.4KB of data. Furthermore, IoT SIM card devices frequently move and pass through areas with poor signal, causing their IP addresses to change passively. This means path verification is triggered more frequently, resulting in higher bandwidth costs for IoT SIM card devices.

[0032] In view of this, embodiments of this application provide a method for verifying network connection information. Figure 3 This is a schematic diagram illustrating an application scenario of the network connection information verification method provided in this application embodiment. In this embodiment, the terminal device is a cellular connection device using the QUIC protocol in a cellular network, which may include a mobile terminal, such as a mobile phone or tablet computer, and may also include a device using an Internet of Things (IoT) card, i.e., an IoT card device. This example uses an IoT card device for description. In this embodiment, an IoT platform is used as the application server. Figure 3 As shown, the unique identifier of the IoT card in an IoT device, namely the Integrated Circuit Card Identity (ICCID), is XYZ. If the source IP1 remains unchanged, no processing is required. Figure 3The diagram shows a None-Probing packet. When the source IP1 of the IoT SIM card device changes to source IP2, the IoT platform sends a query request to the network operator to check if the IP address of the device with ICCID XYZ is IP2. The IoT platform determines whether IP2 has been verified based on the operator's response. If the verification is successful, the IoT platform continues to receive network packets sent by the IoT SIM card device. If the source IP2 does not change again, no further processing is required. Figure 3 The diagram shows a None-Probing packet. Since two devices with the same ICCID number cannot be online simultaneously, even if a maliciously counterfeited IoT card with the same ICCID, only one IoT card can be online at a time. A reflection attack requires both cards to be online simultaneously, thus eliminating the possibility of a reflection attack. In this embodiment, the source IP address in the network packet is verified through interaction between the IoT platform and the operator's server, achieving a similar effect to path verification without requiring interaction between the IoT card device and the IoT platform, saving the IoT card device's bandwidth overhead. Furthermore, the link between the IoT platform and the operator's server is typically a wired network, which has lower latency compared to wireless network communication between the IoT card device and the IoT platform in cellular scenarios. This significantly improves the user experience in latency-sensitive scenarios.

[0033] This application provides a method for verifying network connection information, such as... Figure 4 The diagram shows a flowchart of a network connection information verification method according to an embodiment of this application. The method is applied to an application server and includes:

[0034] Step S401: If it is detected that the network connection information in the network packet sent by the terminal device through the cellular network has changed, the network connection information corresponding to the unique identifier of the terminal device's service card is obtained from the operator's server.

[0035] Step S402: If the network connection information in the network packet matches the network connection information corresponding to the unique identifier, then the network connection information in the network packet is verified successfully.

[0036] In this embodiment, the application server can be a single server or a server cluster consisting of multiple servers. The terminal device can be a device that communicates with the server, and can include mobile terminals such as mobile phones and tablets, as well as devices using IoT cards, such as office equipment and home appliances. The application server can be a server for the mobile terminal's application or a server providing services to IoT devices. The service card can include the mobile terminal's Subscriber Identity Module (SIM) or an IoT card. The unique identifier of the service card includes: Integrated Circuit Card Identity (ICCID), International Mobile Subscriber Identity (IMSI), and Mobile Station Integrated Services Digital Network (MSISDN) identifier. In cellular networks, the MSISDN identifier is the phone number that identifies the device during a call or data session.

[0037] The network connection information can be the resources required for network communication allocated by the operator's server to the service card of the terminal device, such as at least one of IP address and port number. The IP address can include static IP addresses or dynamic IP addresses. A static IP address is an IP address that remains fixed after allocation, while a dynamic IP address is an IP address that changes with the location of the terminal device or other conditions.

[0038] For example, when a terminal device and an application server establish a connection for the first time, the terminal device's account opening file information is stored on the application server. This information includes the unique identifier of the terminal device's service card. After receiving a network packet from the terminal device, the application server parses the packet. The packet contains network connection information. If the source IP address changes between previous and subsequent network packets sent from the same terminal device or the same service card, the source IP address needs to be verified. The server retrieves the IP address corresponding to the unique identifier from the operator's server and compares it with the changed source IP address in the network packet. If they match, the verification is successful.

[0039] This application provides a method for verifying network connection information. If the application server detects a change in the network connection information in a network packet sent by a terminal device via a cellular network, it obtains the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server. If the network connection information in the network packet matches the network connection information corresponding to the unique identifier, the network connection information in the network packet is verified successfully. In this embodiment, if a change in the network connection information in a network packet sent by the terminal device is detected, the network connection information in the network packet is verified through interaction between the application server and the operator's server. This eliminates the need for interaction between the terminal device and the application server, saving the terminal device's bandwidth consumption.

[0040] In one implementation, before obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator server, the method further includes: obtaining the connection identifier between the terminal device and the application server established through QUIC; and querying the unique identifier of the service card of the terminal device based on the connection identifier.

[0041] When the application server and the terminal device establish a connection for the first time, the application server obtains the unique identifier of the terminal device's service card and associates it with the connection identifier. Specific methods of obtaining this identifier may include: the application server receiving the unique identifier of the service card sent by the terminal device; or the application server querying the unique identifier of the service card from the operator's server based on the terminal device's network connection information (e.g., IP address).

[0042] In one example, the service card is a SIM card, uniquely identified by its ICCID. When the terminal device and application server establish a connection for the first time, the terminal device reports its ICCID to the application server. Alternatively, for terminal devices that do not report their ICCID to the application server, the application server queries the carrier server for the ICCID of the terminal device's service card based on the IP address used during the initial connection. After the connection is established, the terminal device and application server configure a connection identifier (connection_ID) and associate the connection identifier with the ICCID.

[0043] After the terminal device establishes a connection with the application server via the QUIC protocol, as long as the connection remains open, the connection_ID remains unchanged. The ICCID of the SIM card can be queried based on the connection_ID. After detecting a change in the source IP address in the network packet corresponding to the same ICCID, the application server can query the IP address or port information corresponding to the ICCID from the operator's server based on the ICCID of the terminal device's SIM card.

[0044] In one implementation, before obtaining the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server, the method further includes: determining that the network connection information corresponding to the unique identifier is either a dynamic IP address or a port number.

[0045] Network connection information can be static or dynamic. Static network connection information can include a static IP address. Dynamic network connection information can include a dynamic IP address or port number. For example, the IP address of an Access Point Name (APN) directional card is a static IP address, which is fixedly assigned. When a terminal device using an APN directional card establishes a connection with the application server for the first time, it verifies the IP address. During subsequent message exchanges between the terminal device and the application server, if the source IP address in a network message received from the terminal device changes, the application server can look up the service card's unique identifier in the service card's account file and find that the corresponding IP address is a static IP address. Then, it can obtain the IP address corresponding to the service card's unique identifier from the operator's server and compare it with the source IP address in the network message. If they are not the same IP address, the source IP address verification in the network message fails. Alternatively, it may not need to query the operator's server, because the service card corresponds to a static IP address, which should remain unchanged. If a change in the source IP address is detected in the network message, the source IP address verification is directly considered to have failed.

[0046] If the IP address corresponding to the service card is found to be a dynamic IP address in the service card's account opening file based on the unique identifier of the terminal device, then the IP address corresponding to the unique identifier is retrieved from the operator's server and compared with the changed source IP address in the network packet. If they match, the verification passes. Since dynamic IP addresses are dynamically assigned to terminal devices by the operator's server, the IP address assigned by the operator's server also changes when the location or other conditions of the terminal device change. Therefore, if the changed source IP address in the network packet matches the new IP address assigned by the operator, it indicates that the source IP address is secure, and the verification passes.

[0047] In one implementation, obtaining network connection information corresponding to the unique identifier of the service card of the terminal device from the operator's server includes: sending a query request to the operator's server, the query request carrying the unique identifier; and receiving the network connection information corresponding to the unique identifier sent by the operator's server.

[0048] In this embodiment, the network connection information is an IP address. As the location of the terminal device changes, the IP address assigned to the terminal device by the operator server also changes. The operator server periodically sends the changed IP address to the application server. When the application server detects a change in the source IP address in the network packet, the changed source IP address may be an insecure IP address, or it may be the real IP address assigned to the terminal device by the operator server but not yet pushed to the application server. Therefore, the application server sends a query request to the operator server to retrieve the IP address assigned to the terminal device using a unique identifier. The application server verifies whether the changed source IP address in the network packet is the IP address assigned by the operator server by comparing it with the IP address returned by the operator server. If not, it is considered insecure.

[0049] In one implementation, the method further includes: if multiple network connection information corresponding to a unique identifier are received, and the network connection information in the network packet matches any one of the multiple network connection information, then it is determined that the network connection information in the network packet has been verified.

[0050] In practical applications, for multi-network converged service cards, such as tri-network cards (with built-in sub-cards from China Mobile, China Unicom, and China Telecom), one tri-network card corresponds to three different operator ICCIDs. In this case, the unique identifier of the service card is the unique identifier corresponding to each operator, and the three cards also correspond to three IP addresses. When the tri-network service card is working, it switches between the three operators (China Mobile, China Unicom, and China Telecom), but only one card is online at any given time, meaning only one IP address connects to the network. When any operator's card accesses the internet, the application server can send a query request to the operator's server of the currently online service card for IP address verification. Alternatively, it can send query requests to the servers of all three operators, receiving three IP addresses. If the source IP address in the network packet matches any of the three IP addresses, the verification is successful.

[0051] In one implementation, the method further includes: if the network connection information in the network packet does not match the network connection information corresponding to the unique identifier, then it is determined that the network connection information in the network packet fails verification, and the connection between the terminal device and the application server is disconnected.

[0052] In one example, if the source IP address in the network packet does not match the IP address returned by the ISP server, it indicates that the IP address is not assigned by the ISP server and may pose a security risk. In this case, the connection between the terminal device and the application server should be disconnected, or other processing methods can be used to avoid security issues.

[0053] In one implementation, before obtaining the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server, the method further includes: obtaining the number of verifications of the network connection information corresponding to the unique identifier within a preset time period, and determining that the number of verifications does not exceed a preset threshold; wherein, the number of verifications of the network connection information corresponding to the unique identifier includes: the number of times the same network connection information corresponding to the unique identifier is verified multiple times, or the number of times multiple network connection information corresponding to the unique identifier is verified.

[0054] In this embodiment, verification is performed only if the number of verification attempts does not exceed a threshold. Specifically, the application server only sends a query request to the carrier server if the number of times it sends such a request does not exceed a preset threshold. This deduplication method reduces the load on the carrier server. For example, if the same SIM card verifies the same IP address multiple times within one second, the application server will not send multiple query requests. Furthermore, malicious queries are filtered out; for instance, if the same SIM card verifies multiple different IP addresses within one second, this is considered a malicious query.

[0055] Corresponding to the application scenarios and methods provided in the embodiments of this application, the embodiments of this application also provide a network connection information verification device. For example... Figure 5 The diagram shown is a structural block diagram of a network connection information verification device according to an embodiment of this application. The device includes:

[0056] The detection module 501 is used to obtain the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server if it detects that the network connection information in the network packet sent by the terminal device through the cellular network has changed.

[0057] The verification module 502 is used to determine that the network connection information in the network packet has been verified if the network connection information in the network packet matches the network connection information corresponding to the unique identifier.

[0058] This application provides a network connection information verification device. If the application server detects a change in the network connection information in a network packet sent by a terminal device via a cellular network, it obtains the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server. If the network connection information in the network packet matches the network connection information corresponding to the unique identifier, the network connection information in the network packet is determined to have passed verification. In this embodiment, if a change in the network connection information in a network packet sent by the terminal device is detected, the network connection information in the network packet is verified through interaction between the application server and the operator's server. This eliminates the need for interaction between the terminal device and the application server, saving the terminal device's bandwidth consumption.

[0059] In one implementation, when the detection module 501 obtains the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator server, it is used to: send a query request to the operator server, the query request carrying the unique identifier; and receive the network connection information corresponding to the unique identifier sent by the operator server.

[0060] In one implementation, the verification module 502 is further configured to: if multiple network connection information corresponding to a unique identifier is received, and the network connection information in the network packet matches any one of the multiple network connection information, then determine that the network connection information in the network packet has been verified.

[0061] In one implementation, the verification module 502 is further configured to: if the network connection information in the network packet does not match the network connection information corresponding to the unique identifier, determine that the network connection information in the network packet fails verification, and disconnect the connection between the terminal device and the application server.

[0062] In one implementation, the detection module 501 is further configured to: obtain the number of verifications of the network connection information corresponding to the unique identifier within a preset time period before obtaining the network connection information corresponding to the unique identifier from the operator's server, and determine that the number of verifications does not exceed a preset threshold; wherein, the number of verifications of the network connection information corresponding to the unique identifier includes: the number of times the same network connection information corresponding to the unique identifier is verified multiple times, or the number of times multiple network connection information corresponding to the unique identifier is verified.

[0063] In one implementation, the verification module 502 is further configured to: determine, before obtaining the network connection information corresponding to the unique identifier of the terminal device's service card from the operator's server, whether the network connection information corresponding to the unique identifier is either a dynamic Internet Protocol address or a port number.

[0064] In one implementation, the detection module 501 is further configured to: obtain the connection identifier between the terminal device and the application server established through the Fast User Datagram Network Connection Protocol (QUIC) before obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator server; and query the unique identifier of the service card of the terminal device based on the connection identifier.

[0065] The functions of each module in each device in the embodiments of this application can be found in the corresponding description in the above method, and they have corresponding beneficial effects, which will not be repeated here.

[0066] In addition, this application provides a network connection information verification system, including an IoT platform, an operator server, and IoT devices; the IoT platform and IoT devices establish a connection through the Fast User Datagram Network Connection Protocol (QUIC).

[0067] Internet of Things (IoT) devices are used to send network messages to IoT platforms via cellular networks.

[0068] The IoT platform is used to obtain the network connection information corresponding to the unique identifier of the IoT device's service card from the operator's server when it detects a change in the network connection information in the network packets sent by the IoT device through the cellular network; if the network connection information in the network packet matches the network connection information corresponding to the unique identifier, it is determined that the network connection information in the network packet has been verified.

[0069] The operator server is used to query the network connection information corresponding to the unique identifier of the service card of the IoT device carried in the query request sent by the IoT platform, and then send it to the IoT platform.

[0070] The specific implementation process in the embodiments of this application can be found in the corresponding description in the above method, and has corresponding beneficial effects, which will not be repeated here.

[0071] Figure 6 This is a block diagram of an electronic device used to implement embodiments of this application. For example... Figure 6 As shown, the electronic device includes a memory 610 and a processor 620. The memory 610 stores a computer program that can run on the processor 620. When the processor 620 executes the computer program, it implements the methods described in the above embodiments. The number of memories 610 and processors 620 can be one or more.

[0072] The electronic device also includes:

[0073] The communication interface 630 is used to communicate with external devices and perform data exchange and transmission.

[0074] If the memory 610, processor 620, and communication interface 630 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0075] Optionally, in a specific implementation, if the memory 610, processor 620, and communication interface 630 are integrated on a single chip, then the memory 610, processor 620, and communication interface 630 can communicate with each other through an internal interface.

[0076] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method provided in this application.

[0077] This application also provides a chip including a processor for calling and executing instructions stored in a memory, causing a communication device with the chip installed to perform the method provided in this application.

[0078] This application also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in the application embodiment.

[0079] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting Advanced Reduced Instruction Set Machines (ARM) architecture.

[0080] Further, optionally, the aforementioned memory may include read-only memory and random access memory. The memory may be volatile memory or non-volatile memory, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available. Examples include Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0081] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0082] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0083] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0084] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0085] The logic and / or steps described in the flowchart or otherwise herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0086] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware, the program being stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiments.

[0087] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0088] The above description is merely an exemplary embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope described in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for verifying network connection information, characterized in that, The method is applied to an application server, and the method includes: If a change is detected in the network connection information in the network packets sent by the terminal device through the cellular network, the network connection information corresponding to the unique identifier of the service card of the terminal device is obtained from the operator's server. If the network connection information in the network packet matches the network connection information corresponding to the unique identifier, then the network connection information in the network packet is verified successfully.

2. The method according to claim 1, characterized in that, The step of obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator's server includes: Send a query request to the operator's server, the query request carrying the unique identifier; Receive network connection information corresponding to the unique identifier sent by the operator's server.

3. The method according to claim 1, characterized in that, Before obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator's server, the method further includes: The number of verifications of the network connection information corresponding to the unique identifier within a preset time period is obtained, and it is determined that the number of verifications does not exceed a preset threshold. The number of times the network connection information corresponding to the unique identifier is verified includes: the number of times the same network connection information corresponding to the unique identifier is verified multiple times, or the number of times multiple network connection information corresponding to the unique identifier is verified.

4. The method according to any one of claims 1-3, characterized in that, Before obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator's server, the method further includes: The network connection information corresponding to the unique identifier is determined to be either a dynamic Internet Protocol address or a port number.

5. The method according to any one of claims 1-3, characterized in that, Before obtaining the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator's server, the method further includes: Obtain the connection identifier between the terminal device and the application server established via the Fast User Datagram Network Connection Protocol (QUIC); Based on the connection identifier, query the unique identifier of the service card of the terminal device.

6. The method according to any one of claims 1-3, characterized in that, The method further includes: If multiple network connection information corresponding to the unique identifier is received, and the network connection information in the network packet matches any one of the multiple network connection information, then the network connection information in the network packet is determined to have passed verification.

7. The method according to any one of claims 1-3, characterized in that, The method further includes: If the network connection information in the network packet does not match the network connection information corresponding to the unique identifier, it is determined that the network connection information in the network packet fails verification, and the connection between the terminal device and the application server is disconnected.

8. A device for verifying network connection information, characterized in that, The device is used in an application server, and the device includes: The detection module is used to obtain the network connection information corresponding to the unique identifier of the service card of the terminal device from the operator server if it detects that the network connection information in the network packet sent by the terminal device through the cellular network has changed. The verification module is used to determine that the network connection information in the network packet has been verified if the network connection information in the network packet matches the network connection information corresponding to the unique identifier.

9. A network connection information verification system, characterized in that, The system includes: an Internet of Things (IoT) platform, an operator server, and IoT devices; the IoT platform and the IoT devices establish a connection via the Fast User Datagram Network Connection Protocol (QUIC). The IoT device is used to send network messages to the IoT platform via a cellular network; The IoT platform is configured to, upon detecting a change in the network connection information in a network packet sent by the IoT device via the cellular network, obtain the network connection information corresponding to the unique identifier of the IoT device's service card from the operator's server; if the network connection information in the network packet matches the network connection information corresponding to the unique identifier, then determine that the network connection information in the network packet has been verified. The operator server is used to query the network connection information corresponding to the unique identifier of the service card of the IoT device carried in the query request sent by the IoT platform, and send it to the IoT platform.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory, wherein the processor, when executing the computer program, implements the method of any one of claims 1-7.

11. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method of any one of claims 1-7.

Images