B5G / 6G Network Slice Authentication Method for Industrial Internet

Abstract

The present invention discloses a B5G / 6G network slice authentication method for the Industrial Internet, which mainly solves the problems of complex network slice authentication process and certificate management and high overhead in the prior art. Its implementation scheme is: a third-party key generation center uses a certificateless method to generate a signature private key based on the user device identity; the user device selects a suitable slice according to its own business needs; the user device initiates a connection request for the selected slice, and signs the request message based on the SM2 digital signature algorithm; the selected slice verifies the request of the user device, negotiates a session key with the user device, encrypts the successful verification response message with the session key, and sends it to the user device; the user device decrypts the response message to complete the authentication. The present invention does not require a certificate, improves the signing speed, simplifies the authentication process of the slice and user device, reduces communication and computing overhead, and can be used for B5G / 6G networks in the Industrial Internet.

Description

Technical Field

[0001] The present invention belongs to the field of computer security technology, and specifically relates to a B5G / 6G network slicing authentication method, which can be used in B5G / 6G networks in the Industrial Internet. Technical Background

[0002] In collaborative manufacturing applications on the Industrial Internet, different business scenarios and user devices have significantly different requirements for low latency, high connectivity, security, reliability, and network functionality. Building a new network for each business would incur significant costs, while using the same network would be difficult to meet. Therefore, to provide differentiated security services for different businesses and achieve flexible network deployment, existing technologies have proposed network slicing. Different slices can share physical network resources while remaining logically independent and isolated from each other, enabling flexible adaptation to different business scenarios. Furthermore, slice isolation allows each network slice to operate independently without interfering with other running network slices. While network slicing offers many advantages, it also raises security concerns. Therefore, research on slicing security service models in B5G / 6G network environments is particularly important. One of the slicing security services involves studying slice authentication and authorization mechanisms to prevent unauthorized access to slices. Without slice authentication and authorization mechanisms, operators may not be able to effectively meet the business needs of different industries and face potential security risks when interacting with third-party networks. Therefore, security authentication for network slicing is a hot topic of research.

[0003] In its research on enhanced network slicing security, 3GPP has proposed a secondary authentication mechanism for 5G slices. After the user and core network complete primary authentication, secondary authentication at the slice level is performed using the user ID and credentials. This secondary authentication architecture is based on the Extensible Authentication Protocol (EAP). When a user device joins the network, it initiates a registration request to the core network. The request message should indicate whether slice authentication authorization is required. Primary authentication is completed using the 5G-AKA or EAP-AKA authentication protocols. During primary authentication, the Unified Data Management Function (UDM) checks a flag for additional authentication to determine whether the user requires specific slice authentication. The Access Mobility Management Function (AMF) then triggers the secondary authentication process for the specific slice based on the request. However, this authentication method requires users to deploy a public key infrastructure (PKI) and apply for public key certificates. Certificate management is complex, and certificate issuance, revocation, verification, and storage require significant resources, limiting PKI's applicability in real-time environments.

[0004] A patent document with the application number CN201910998988 proposed an IoT security verification framework based on 5G network slicing and its service method. In order to ensure the anonymity, authenticity of users and the confidentiality of data, a connection is established between the user and the core network, and a suitable network slice is selected according to the type of access service to anonymously access the corresponding Internet of Things service. However, in this method, since the user needs to re - authenticate when switching different network slices, the authentication process is relatively complex, with large computational overhead. At the same time, since a large number of security network elements need to be interacted with during the authentication process, the transmission delay is relatively large.

[0005] In an article published by Yinghui Zhang et al. in the journal Computer Communications in 2021, a flexible and anonymous network slicing method FANS was proposed. It realizes mutual authentication between the user and the network slice based on the AKA protocol, protects user identity privacy by hiding the public key associated with the actual identity in the transmitted message, and realizes fine - grained network slice selection based on the one - to - many matching technology used in anonymous attribute - based encryption. However, since this method uses the public key blinding technology to realize user identity privacy protection, it will bring additional computational overhead on the user side.

[0006] Although the above - mentioned existing technologies have proposed reasonable solutions for slice security authentication, for the scenario of massive user device access in the industrial Internet, a lightweight network slice authentication method still needs to be further studied. Summary of the Invention

[0007] The purpose of the present invention is to propose a B5G / 6G network slice authentication method for the industrial Internet aiming at the deficiencies of the above - mentioned existing technologies, so as to realize fine - grained selection and lightweight authentication between user devices and network slices, reduce computational and communication overhead, reduce delay, and from the perspective of privacy protection, realize hiding the user device identity identifier and slice feature information.

[0008] To achieve the above purpose, the B5G / 6G network slice authentication method for the industrial Internet of the present invention includes the following steps:

[0009] (1) Generate a signature private key d based on the user device identity identifier ID u : uc

[0010] (1a) The third - party key generation center KGC selects public parameters, specifies a large prime number p, takes a base point G with order n on an elliptic curve in the finite field F p , randomly selects a number x in 1 < x < n, sets the system private key SK S = x, the system public key PK S = x * G, and generates a system public - private key pair (PKS , SK S = x);

[0011] (1b) The KGC randomly selects a number y where 1 < y u < n u , and calculates a point Y on the elliptic curve u = y u * G, and the hash value h u = H(ID u || Y u ), the signature private key d uc = y u + SK S * h u , and sends the three parameters d uc , Y u , T1 to the user equipment UE through a secure channel, where T1 is the current timestamp, and H() represents a one-way hash function;

[0012] (1c) After receiving the information from the third-party key generation center KGC, the user equipment UE first verifies the validity of T1:

[0013] If it is valid, then execute (1d);

[0014] If it is invalid, the user equipment UE does not accept the signature private key d uc ;

[0015] (1d) Verify whether d uc * G = Y u + h u * PK S holds:

[0016] If it holds, the user equipment UE accepts the signature private key d uc ;

[0017] Otherwise, the user equipment UE does not accept the signature private key d uc ;

[0018] (2) The user equipment UE selects an appropriate slice access according to its own service scenario requirements:

[0019] (2a) The physical network resources PNR are divided into l logically independent fine-grained network slices according to characteristics such as rate, throughput, bandwidth, latency, scalability, and security level. Each network slice is represented as the following feature vector:

[0020] S i F = {S i F1, S i F2,..., S i F t ,..., S iF T}

[0021] where \(i\in[1, l]\), \(S\) i F t represents the \(t\)-th eigenvalue of slice \(i\), and \(T\) is the number of slice features;

[0022] (2b) The user equipment UE constructs the requested slice feature vector according to its own service requirements, encrypts the eigenvalues of the feature vector with a random number, and initiates a slice selection request;

[0023] (2c) The access and mobility management function AMF encrypts the eigenvalues of each slice in the list according to the slice list set that the user equipment UE is allowed to access, and sends them to the user equipment UE;

[0024] (2d) After the user equipment UE receives the encrypted slice list set, it calculates the Euclidean distance between the encrypted slice list set and the requested slice feature vector, and selects the slice with the smallest Euclidean distance in the slice list set as the most suitable slice selected by the user equipment UE according to the service requirements;

[0025] (3) The user equipment UE initiates a connection authentication request for the selected slice, signs the request message \(M\) using the signature algorithm to generate the signature information \((r, s)\), and sends the five parameters \(Y\) u , \(r\), \(s\), \(M\), \(T2\) to the selected slice, where \(T2\) is the current timestamp;

[0026] (4) The slice responds to the request of the user equipment UE by verifying the signature algorithm:

[0027] (4a) After the slice receives the request message sent by the user equipment UE, it first verifies whether the timestamp \(T2\) is valid:

[0028] If it is valid, the slice verifies the signature information of the user equipment UE: if the verification is successful, execute (4b), otherwise, the authentication fails;

[0029] If it is invalid, the authentication fails;

[0030] (4b) The slice negotiates the session key \(K\) with the user equipment UE, encrypts the response message with the session key that has been verified successfully, and sends it to the user equipment UE;

[0031] (5) After the user equipment UE receives the response message from the slice, it decrypts the response message using the session key \(K\) negotiated between the two:

[0032] If the decryption is successful, the mutual authentication between the user equipment UE and the selected slice is successful;

[0033] Otherwise, the authentication fails.

[0034] Compared with the prior art, the present invention has the following advantages:

[0035] 1. The present invention generates a user signature private key in a certificate-free manner, without the need for certificate verification, effectively solving the problems of complex certificate management and the need to occupy a large amount of resources for certificate issuance, revocation, verification, and storage.

[0036] 2. The present invention uses a set of random numbers to encrypt the eigenvalues of the slices, and the original eigenvalues of the slices do not participate in the calculation, realizing the privacy protection of the slice feature information and effectively preventing third-party attackers from illegally obtaining the slice information.

[0037] 3. The present invention uses the SM2 digital signature algorithm to implement mutual authentication between the user equipment UE and the slice, with fast signature speed, small storage space, low overhead, and simple authentication process, making it more suitable for lightweight authentication of a large number of user equipment access in the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a scenario diagram of the existing industrial Internet;

[0039] Figure 2 is the implementation flowchart of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0040] Referring to Figure 1 , in the B5G / 6G security network slice scenario of the existing industrial Internet, the main participants include: user equipment UE and network slices. Among them, the user equipment UE is in industrial Internet collaborative manufacturing, including high-definition monitoring, mobile robots, drones, sensors, industrial instruments, and virtual reality devices. Different user equipment has its own service requirements, with different requirements for bandwidth, latency, and network functions; the network slice is a plurality of logically independent and mutually isolated virtual networks virtualized on a physical network, composed of several network functions and resources abstracted from the underlying resources, meeting the different service requirements of user equipment.

[0041] In this embodiment, based on the above-mentioned B5G / 6G security network slice for the industrial Internet, a third-party key generation center KGC and an access mobile management network element AMF are added. Among them, the third-party key generation center KGC is used to select public parameters, generate a system public-private key pair, and generate a signature private key for the user equipment; the access mobile management network element AMF is used to determine the network slices that each user equipment is allowed to access according to the information stored locally or the subscription information from the user equipment.

[0042] Referring to Figure 2 , the implementation steps of this embodiment are as follows:

[0043] Step 1: Generate a signature private key d based on the user equipment identity ID u ofuc 。

[0044] (1.1) The third - party key generation center KGC selects public parameters, specifies a large prime number p, selects a base point G of order n on an elliptic curve over the finite field F p , randomly selects a number x in 1 < x < n, sets the system private key SK S = x, and the system public key PK S = x * G, generating a system public - private key pair (PK S , SK S = x);

[0045] (1.2) The third - party key generation center KGC randomly selects a number y in 1 < y u < n u , and calculates a point Y u on the elliptic curve, a hash value h u , and a signature private key d uc :

[0046] Y u = y u * G

[0047] h u = H(ID u || Y u )

[0048] d uc = y u + SK S * h u

[0049] where H() represents a one - way hash function;

[0050] (1.3) The third - party key generation center KGC sends the three parameters d uc , Y u , and T1 to the user equipment UE through a secure channel, where T1 is the current timestamp;

[0051] (1.4) After receiving the information from the third - party key generation center KGC, the user equipment UE first checks the validity of T1:

[0052] (1.4.1) To resist replay attacks, the user equipment UE adds a timestamp to the message. The user equipment UE subtracts the received timestamp T1 from the current time to obtain a difference ΔT;

[0053] (1.4.2) Set a time threshold δ, and compare the difference ΔT with the time threshold δ:

[0054] If ΔT < δ, the timestamp T1 is valid, and (1.5) is executed;

[0055] Otherwise, the timestamp T1 is invalid, and the user equipment UE does not accept the signature private key d uc ;

[0056] (1.5) The user equipment UE verifies d uc *G = Y u +h u *PK S to check if it holds:

[0057] If it holds, the user equipment UE accepts the signature private key d uc ;

[0058] Otherwise, the user equipment UE does not accept the signature private key d uc ;

[0059] Step 2: The user equipment UE selects an appropriate slice to access according to its own service scenario requirements.

[0060] (2.1) Divide the physical network resources PNR into l logically independent fine-grained network slices according to these characteristics of rate, throughput, bandwidth, latency, scalability, and security level. Each network slice is represented as the following feature vector:

[0061] S i F = {S i F1, S i F2,..., S i F t ,..., S i F T}

[0062] where i ∈ [1, l], and S i F t represents the t-th eigenvalue of slice i, and T is the number of slice features;

[0063] (2.2) The user equipment UE constructs the requested slice feature vector Req according to its own service requirements:

[0064] (2.2.1) Classify the service requirements according to these characteristics of rate, throughput, bandwidth, latency, scalability, and security level;

[0065] (2.2.2) Map each characteristic of the service requirements to a slice eigenvalue, and construct the requested slice feature vector Req = {x1, x2,... x t ,... x T}, where x t represents the t-th eigenvalue of the requested slice, and T represents the number of eigenvalues of the slice;

[0066] (2.2.3) Set a group of random numbers C = (C1, C2,... C t,…C T ) and a randomly generated secret value f;

[0067] (2.2.4) For each eigenvalue x in the constructed request slice feature vector Req t , use each value C in the random number C t and the randomly generated secret value f for calculation to obtain the encrypted request slice feature vector Req':

[0068] Req' = {x ′ t = x t + f * C t , 1 ≤ t ≤ T};

[0069] (2.3) The access and mobility management function AMF parses the encrypted request slice feature vector Req' and the random number C, and checks the slice list set that the user equipment UE is allowed to access. This list set contains m slices, and each slice can be represented as a feature vector w j = (y1, y2,... y t ,... y T ), where y t represents the t-th eigenvalue, and T represents the number of eigenvalues of the slice;

[0070] (2.4) The access and mobility management function AMF encrypts each slice in the slice list set and calculates the encrypted slice feature vector w' j :

[0071] w' j = (b j1 , b j2 , b j3 )

[0072] where

[0073] (2.5) Combine the encrypted feature vectors w' of each slice in the slice list set j , to obtain the encrypted slice list set W = (w'1,... w' j ,... w' m ), where j ∈ [1, m];

[0074] (2.6) The access and mobility management function AMF sends the encrypted slice list set W to the user equipment UE;

[0075] (2.7) After the user equipment UE receives the encrypted slice list set W, calculate the Euclidean distance d j between each slice feature vector w' in W and the encrypted request slice feature vector Req j :

[0076]

[0077] Among them, E j = b j1 - f * b j2 ;

[0078] (2.8) The user equipment UE selects the slice with the smallest Euclidean distance dj 最 as the most suitable slice selected by the user equipment UE according to the service requirements.

[0079] Step three: The user equipment UE signs the request message M based on the SM2 digital signature algorithm and initiates a connection request for the selected slice.

[0080] (3.1) The user equipment UE calculates the digest value Z Y = H v (Len ‖ ID u ‖ a ‖ b ‖ G x ‖ G y ‖ Y x ‖ Y y ), where ID u is the user equipment identifier, Len represents the length bit value of ID u , Y x and Y y represent the coordinates of a point Y u on the elliptic curve, and H v () is a cryptographic hash function that generates a v-bit digest value;

[0081] (3.2) The user equipment UE calculates the cryptographic hash value e = H v (Z Y || M);

[0082] (3.3) The user equipment UE randomly selects a number a in 1 < a < n and calculates the elliptic curve point (x1, y1) = aG;

[0083] (3.4) The user equipment UE calculates the signature information (r, s):

[0084] r = (e + x1) mod n, s = ((1 + d uc ) -1 (a - r * d uc )) mod n,

[0085] where G is the base point on the elliptic curve, n is the order of the base point G, and d uc is the signature private key of the UE;

[0086] (3.5) The user equipment UE sends Y u, the five parameters r, s, M, T2 are sent to the selected slice, where T2 is the current timestamp.

[0087] Step 4: The slice verifies the request from the user device and negotiates a session key with the user device.

[0088] (4.1) After the slice receives the five parameters Y, r, s, M, T2 sent by the user device UE, it first verifies whether the timestamp T2 is valid. The verification step is the same as (1.4). If it is invalid, the authentication fails; otherwise, (4.2) is executed; u ,r,s,M,T2, first verify whether the timestamp T2 is valid. The verification step is the same as (1.4). If it is invalid, the authentication fails; otherwise, execute (4.2);

[0089] (4.2) The slice verifies the signature information of the user device UE:

[0090] (4.2.1) The slice checks whether 1 < r < n holds. If it does not hold, the verification fails; otherwise, (4.2.2) is executed;

[0091] (4.2.2) The slice checks whether 1 < s < n holds. If it does not hold, the verification fails; otherwise, (4.2.3) is executed;

[0092] (4.2.3) The slice calculates the cryptographic hash value e′ = H v (Z Y ||M);

[0093] (4.2.4) The slice calculates the hash value h′ u = H(ID u ||Y u );

[0094] (4.2.5) The slice calculates the elliptic curve point (x′1, y′1) = s * G + (r + s) * (Y u + h′ u * PK S );

[0095] (4.2.6) The slice checks whether (e′ + x′1) mod n = r holds. If it holds, the verification is successful; otherwise, the authentication fails.

[0096] (4.3) The slice negotiates the session key K with the user device UE:

[0097] (4.3.1) The user device UE and the slice generate exchange data:

[0098] The user device UE randomly selects a number r between 1 < r A < n, calculates the point R on the elliptic curve A , calculates the point R on the elliptic curve A = r A * G = (x A ,y A ), and sends this point RA Send it to the slice, where (x A , y A ) are the coordinate values of point R A ;

[0099] The slice randomly selects a number r where 1 < r B < n, and calculates the point R on the elliptic curve B = r B * G = (x B , y B ) and sends this point R B to the user equipment UE, where (x B , y B ) are the coordinate values of point R B ; B ;

[0100] (4.3.2) The user equipment UE and the slice calculate their respective session keys:

[0101] After the slice receives R sent by the user equipment UE A , it verifies whether R A satisfies the elliptic curve equation: If not, the key negotiation fails; otherwise, the slice extracts x A from R A and calculates the point V on the elliptic curve and its own session key K B :

[0102] V = (d B + r B * x B ) * (P A + x A * R A ) = (x V , y V ),

[0103] K B = KDF(x V || y V || Z A || Z B , L K ),

[0104] where Z A and Z B are digest values, L K is the set key length, (x V , y V ) are the coordinate values of point V, d B is the private key of the slice, and P A is the public key of the user equipment UE;

[0105] The user equipment UE receives R sent by the sliceB After that, verify R B to check if it satisfies the elliptic curve equation. If not, the key negotiation fails; otherwise, the user equipment UE extracts x B from R B , calculates the point U on the elliptic curve and its own session key K A :

[0106] U = (d A + r A * x A ) * (P B + x B * R B ) = (x U , y U )

[0107] K A = KDF(x U || y U || Z A || Z B , L K )

[0108] where (x U , y U ) are the coordinate values of point U, d A is the private key of the user equipment UE, and P B is the public key of the slice;

[0109] (4.3.3) Based on this slice and the user equipment UE, the session key is successfully calculated, and the session key K after successful negotiation between the two is obtained:

[0110] K = K A = K B ;

[0111] (4.4) The slice encrypts the successfully verified response message with the session key K and sends it to the user equipment UE.

[0112] Step Five: The user equipment UE decrypts the response message.

[0113] (5.1) After receiving the response message from the slice, the user equipment UE decrypts the response message using the session key K negotiated between the two;

[0114] (5.2) The user equipment UE determines whether the authentication with the selected slice is successful:

[0115] If the user equipment UE decrypts successfully, the authentication is successful;

[0116] Otherwise, the authentication fails.

[0117] The above description is only a specific example of the present invention and does not constitute any limitation to the present invention. Obviously, for professionals in the field, after understanding the content and principle of the present invention, various modifications and changes in form and details may be made without departing from the principle and structure of the present invention. However, these corrections and changes based on the idea of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A B5G / 6G network slice authentication method for industrial Internet of Things, comprising the following steps: (1) Generate a signature private key d based on the user device identity ID u : uc ​ (1a) The third-party key generation center KGC selects public parameters, specifies a large prime number p, takes a base point G of order n on an elliptic curve over the finite field F p , randomly selects a number x in 1 < x < n, sets the system private key SK S = x, and the system public key PK S = x * G, generating the system public-private key pair (PK S , SK S = x); (1b) The KGC randomly selects a number y where 1 < y u from within n u , and calculates a point Y on the elliptic curve u = y u * G, and the hash value h u = H(ID u || Y u ), the signature private key d uc = y u + SK S * h u , and sends the three parameters d uc , Y u , and T1 to the user equipment UE through a secure channel, where T1 is the current timestamp, and H() represents a one-way hash function; (1c) After the user equipment UE receives the information from the third-party key generation center KGC, it first verifies the validity of T1: If it is valid, then execute (1d); If it is invalid, the user equipment UE does not accept the signature private key d uc ; (1d) Verify d uc *G = Y u + h u *PK S Is it true that: If it holds, the user equipment UE accepts the signature private key d uc ; Otherwise, the user equipment UE does not accept the signature private key d uc ; (2) The user equipment UE selects a suitable slice access according to its own service scenario requirements: (2a) Divide the physical network resources PNR into l logically independent fine-grained network slices according to these characteristics such as rate, throughput, bandwidth, latency, scalability, and security level, and each network slice is represented as the following characteristic vector: S i F = {S i F1, S i F2, …, S i F t , …, S i F T}; where \(i\in[1, l]\), \(S\) i F t represents the \(t\)-th eigenvalue of slice \(i\), and \(T\) is the number of slice features; (2b) The user equipment UE constructs the requested slice characteristic vector according to its own service requirements, and encrypts the characteristic values of the characteristic vector with a random number, and initiates a slice selection request; (2c) The access and mobility management function AMF encrypts the characteristic values of each slice in the list according to the slice list set allowed to be accessed by the user equipment UE, and sends them to the user equipment UE; (2d) After the user equipment UE receives the encrypted slice list set, it calculates the Euclidean distance between the encrypted slice list set and the requested slice characteristic vector, and selects the slice with the smallest Euclidean distance in the slice list set as the most suitable slice selected by the user equipment UE according to the service requirements; (3) The user equipment UE initiates and selects a connection authentication request for a slice, signs the request information M using a signature algorithm to generate signature information (r, s), and sends Y u , the five parameters of r, s, M, and T2 to the selected slice, where T2 is the current timestamp; (4) The slice responds to the request of the user equipment UE through the verification signature algorithm: (4a) After the slice receives the request message sent by the user equipment UE, it first verifies whether the timestamp T2 is valid: If it is valid, then the slice verifies the signature information of the user equipment UE: if the verification is successful, execute (4b), otherwise, the authentication fails; If it is invalid, then the authentication fails; (4b) The slice negotiates a session key K with the user equipment UE, and encrypts the verification successful response message with the session key, and sends it to the user equipment UE; the slice negotiates a session key with the user equipment UE by using the SM2 key exchange protocol, and its implementation is as follows: (4b1) The user equipment UE and the slice generate exchange data: The user equipment UE randomly selects a number r in 1 < r A <n A , and calculates the point R on the elliptic curve A = r A * G = (x A , y A ), and sends this point R A to the slice, where (x A , y A ) are the coordinate values of the point R A ; Randomly select a slice 1 < r B a number r in <n B , calculate the point R on the elliptic curve B = r B * G = (x B , y B ), and send this point R B to the user equipment UE, where (x B , y B ) are the coordinate values of point R B ; (4b2) The user equipment UE and the slice calculate their respective session keys: The slice receives R sent by the user equipment UE A After that, verify R A Whether it satisfies the elliptic curve equation: If not, the key negotiation fails; Otherwise, the slice is taken from R A to extract x A , and calculate the point V on the elliptic curve and its own session key K B : V = (d B + r B * x B )(P A + x A * R A ) = (x V , y V ); K B = KDF(x V ||y V ||Z A ||Z B , L K ); Among them, Z A and Z B are the digest values, L K is the set key length, (x V , y V ) are the coordinate values of point V, d B is the private key of the slice, and P A is the public key of the user equipment UE; The user equipment UE receives R sent by the slice B After that, verify R B Whether it satisfies the elliptic curve equation. If not, the key negotiation fails; otherwise, the user equipment UE extracts x from R B Calculate the point U on the elliptic curve and its own session key K B : A ​ U = (d A + r A * x A )(P B + x B * R B ) = (x U , y U ); K A = KDF(x U || y U || Z A || Z B , L K ); where (x U , y U ) are the coordinate values of point U, d A is the private key of the user equipment UE, and P B is the public key of the slice; (4b3) According to the successful calculation of the session keys by this slice and the user equipment UE respectively, the session key K after successful negotiation between the two is obtained: K = K A = K B ; (5) After the user equipment UE receives the response message from the slice, it decrypts the response message by using the session key K negotiated between the two: If the decryption is successful, then the mutual authentication between the user equipment UE and the selected slice is successful; Otherwise, the authentication fails.

2. The method according to claim 1, wherein The verification of the validity of T1 in (1c) is implemented as follows: Set a time threshold δ, add a timestamp to the message to resist replay attacks, the user equipment UE uses the current time minus the received timestamp T1 to obtain a difference ΔT, and compares this difference ΔT with the time threshold δ: If ΔT < δ, then the timestamp T1 is valid; Otherwise, the timestamp T1 is invalid.

3. The method according to claim 1, characterized in that In (2b), the user equipment UE constructs the requested slice characteristic vector according to its own service requirements, and encrypts the characteristic values of the characteristic vector with a random number, and the implementation is as follows: (2b1) Classify the service requirements according to these characteristics such as rate, throughput, bandwidth, latency, scalability, and security level; (2b2) Map each feature of the service requirement to a slice feature value, and construct the slice feature vector of the request. Req = {x1, x2, … x t , … x T}, where x t represents the eigenvalue of the slice of the t-th request, and T represents the number of eigenvalues of the slice; (2b3) Set a set of random numbers C = (C1, C2, … C t , … C T ), and a randomly generated secret value f; For each eigenvalue x in the constructed request slice feature vector Req t , calculate using each value C in the random number C t and the randomly generated secret value f to obtain the encrypted request slice feature vector Req'. Req′ = {x′ t = x t + fC t , 1 ≤ t ≤ T}.

4. The method according to claim 1, wherein (3) In the process of using the signature algorithm to sign the request information M, the SM2 digital signature algorithm is adopted, and the implementation is as follows: (3a) Calculate the digest value Z Y = H v (Len ‖ ID u ‖ a ‖ b ‖ G x || G y || Y x || Y y ), where ID u is the user equipment identifier, Len represents the length bit value of ID u , Y x and Y y represent the coordinates of a point Y u on the elliptic curve, and H v () is a cryptographic hash function that generates a v-bit digest value; (3b) Calculate the password hash value e = H v (Z Y ||M); (3c) Randomly select a number a in 1 < a < n, and calculate the elliptic curve point (x1, y1) = aG; (3d) Calculate the signature information (r, s): r = (e + x1) mod n, s = ((1 + d uc )) -1 (a - r * d uc )) mod n, Among them, G is the base point on the elliptic curve, n is the order of the base point G, and d uc is the signature private key of the user equipment UE; (3e) The user equipment UE sends the signature information (r, s) to the slice.

Images