Identity authentication method and device, related equipment and storage medium

Abstract

The application discloses an identity authentication method and device, a network device, an RFID tag and a storage medium. The method comprises the following steps: receiving a first registration request sent by a first RFID tag when the first RFID tag accesses a target network for the first time; the first registration request comprises a first identifier; performing identity authentication on the first RFID tag based on the first identifier to obtain a first authentication result; determining a first hash parameter and a second identifier in the case that the first authentication result represents that the first RFID tag passes the identity authentication; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag accesses the target network subsequently; and issuing the first hash parameter and the second identifier to the first RFID tag.

Description

Technical Field

[0001] This application relates to the field of wireless communication, and in particular to an authentication method, apparatus, related equipment, and storage medium. Background Technology

[0002] Radio Frequency Identification (RFID) technology, as a lightweight solution for connecting things, has been widely used in industry. However, due to its inherent design limitations, the application range of RFID technology is limited to the local area network. The effective communication distance between the reader and the RFID tag is only a dozen meters. It requires a handheld reader to read the RFID tag, which greatly limits the application scenarios and system efficiency of RFID.

[0003] In response to the aforementioned issues, the industry has proposed passive RFID systems based on cellular networks. Leveraging the strong communication capabilities of base stations, these systems extend the reading and writing distance of RFID tags to the hundreds of meters level, significantly expanding the application scenarios of RFID. However, within these passive RFID systems based on cellular networks, an effective solution for improving the security of RFID tag usage remains elusive. Summary of the Invention

[0004] To address the related technical issues, embodiments of this application provide an identity authentication method, apparatus, related devices, and storage medium.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides an identity authentication method applied to a network device, including:

[0007] The system receives a first registration request sent when a first RFID tag first accesses the target network; the first registration request includes a first identifier; the first identifier includes at least the tag chip manufacturer code (TCMC), tag antenna manufacturer code (TAMC), tag final package code (TFPC), tag type allocation code (TTAC), and check code (CD); the check code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final package code, and the tag type allocation code.

[0008] Based on the first identifier, the first RFID tag is authenticated to obtain a first authentication result;

[0009] If the first authentication result indicates that the first RFID tag has passed identity authentication, a first hash parameter and a second identifier are determined; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network;

[0010] Send the first hash parameter and the second identifier to the first RFID tag.

[0011] In the above scheme, the step of authenticating the first RFID tag based on the first identifier includes:

[0012] Determine whether the first identifier exists in the local first list, and obtain a first determination result; the first list contains the first identifier of multiple RFID tags;

[0013] If the first determination result indicates that the first identifier exists in the first list, the first RFID tag is determined to have passed identity authentication; if the first determination result indicates that the first identifier does not exist in the first list, the first RFID tag is determined to have failed identity authentication.

[0014] In the above scheme, determining the first hash parameter and the second identifier includes:

[0015] When the first RFID tag is determined to be valid, the first hash parameter and the second identifier are determined.

[0016] The method in the above scheme further includes:

[0017] The system receives a second registration request sent when the first RFID tag is not accessing the target network for the first time; the second registration request includes the second identifier and a first hash value; the first hash value is determined by the first RFID tag based on the first hash parameter;

[0018] Based on the second identifier and the first hash value, the first RFID tag is authenticated to obtain a second authentication result;

[0019] The second authentication result is sent to the first RFID tag.

[0020] In the above scheme, the step of authenticating the first RFID tag based on the second identifier and the first hash value includes:

[0021] Using a local second list, the second hash value corresponding to the second identifier is determined; the second list contains multiple associations between first identifiers, second identifiers, and second hash values; each second hash value is determined by the network device based on a corresponding first hash parameter.

[0022] Determine whether the first hash value and the second hash value are the same to obtain a second determination result;

[0023] If the second determination result indicates that the first hash value and the second hash value are the same, the first RFID tag is determined to have passed identity authentication; if the second determination result indicates that the first hash value and the second hash value are different, the first RFID tag is determined to have failed identity authentication.

[0024] The method in the above scheme further includes:

[0025] When the first RFID tag is determined to be valid, the first hash parameter is periodically updated, and the corresponding second hash value is updated in the second list using the updated first hash parameter;

[0026] When the second determination result indicates that the first hash value is different from the second hash value, when issuing the second authentication result to the first RFID tag, the first information is also issued to the first RFID tag; the first information indicates that the first hash value has expired; the first information is used to trigger the first RFID tag to send a first registration request to the network device.

[0027] In the above scheme, receiving the first registration request sent when the first RFID tag first accesses the target network includes:

[0028] The first registration request is received via Non-Access Stratum (NAS) signaling.

[0029] In the above scheme, sending the first hash parameter and the second identifier to the first RFID tag includes:

[0030] The first hash parameter and the second identifier are sent via NAS signaling.

[0031] This application also provides an identity authentication method applied to RFID tags, including:

[0032] Upon initial access to the target network, a first identifier is retrieved from the Electronic Product Code (EPC) storage area, and a first registration request is sent to the network side. The first registration request includes the first identifier. The first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result. The first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code. The verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code.

[0033] If the first authentication result indicates that the RFID tag has passed identity authentication, the first hash parameter and the second identifier sent by the network side are received; the first hash parameter and the second identifier are used for identity authentication when the RFID tag subsequently accesses the network.

[0034] The method in the above scheme further includes:

[0035] When accessing the target network for the first time, the second identifier and the first hash value are obtained from the EPC storage area, and a second registration request is sent to the network side; the second registration request includes the second identifier and the first hash value; the first hash value is determined by the RFID tag based on the first hash parameter;

[0036] The network receives a second authentication result from the network side; the second authentication result is obtained by the network side authenticating the RFID tag based on the second identifier and the first hash value.

[0037] The method in the above scheme further includes:

[0038] When receiving the second authentication result sent by the network side, the system also receives first information sent by the network side; the first information indicates that the first hash value has expired.

[0039] Triggered by the first information, a first registration request is sent to the network side.

[0040] In the above scheme, sending the first registration request to the network side includes:

[0041] The first registration request is sent via NAS signaling.

[0042] In the above scheme, receiving the second identifier and the first hash parameter sent by the network side includes:

[0043] The second identifier and the first hash parameter are received via NAS signaling.

[0044] This application also provides an identity authentication device, including:

[0045] The first receiving unit is configured to receive a first registration request sent when the first RFID tag first accesses the target network; the first registration request includes a first identifier; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0046] The first processing unit is configured to perform identity authentication on the first RFID tag based on the first identifier, and obtain a first authentication result;

[0047] The second processing unit is configured to determine a first hash parameter and a second identifier when the first authentication result indicates that the first RFID tag has passed identity authentication; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network;

[0048] The first transmitting unit is used to send the first hash parameter and the second identifier to the first RFID tag.

[0049] This application also provides an identity authentication device, including:

[0050] The second transmitting unit is configured to, when the RFID tag first accesses the target network, obtain a first identifier from the EPC storage area and send a first registration request to the network side; the first registration request includes the first identifier; the first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0051] The second receiving unit is configured to receive a first hash parameter and a second identifier sent by the network side when the first authentication result indicates that the RFID tag has passed identity authentication; the first hash parameter and the second identifier are used for identity authentication when the RFID tag subsequently accesses the network.

[0052] This application also provides a network device, including: a first communication interface and a first processor; wherein,

[0053] The first communication interface is used to receive a first registration request sent when the first RFID tag first accesses the target network; the first registration request includes a first identifier; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0054] The first processor is configured to perform identity authentication on the first RFID tag based on the first identifier to obtain a first authentication result; and, if the first authentication result indicates that the first RFID tag has passed identity authentication, determine a first hash parameter and a second identifier; the first hash parameter and the second identifier are used for identity authentication of the first RFID tag when it subsequently accesses the target network.

[0055] The first communication interface is also used to send the first hash parameter and the second identifier to the first RFID tag.

[0056] This application also provides an RFID tag, including: a second communication interface and a second processor; wherein,

[0057] The second communication interface is used for:

[0058] Upon initial access to the target network, a first identifier is obtained from the EPC storage area, and a first registration request is sent to the network side. The first registration request includes the first identifier. The first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result. The first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code. The verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code.

[0059] If the first authentication result indicates that the RFID tag has passed identity authentication, the first hash parameter and the second identifier sent by the network side are received; the first hash parameter and the second identifier are used for identity authentication when the RFID tag subsequently accesses the network.

[0060] This application also provides a network device, including: a first processor and a first memory for storing computer programs capable of running on the processor.

[0061] Wherein, when the first processor is used to run the computer program, it executes the steps of any of the methods described above on the network device side.

[0062] This application also provides an RFID tag, including: a second processor and a second memory for storing a computer program capable of running on the processor.

[0063] The second processor, when running the computer program, executes the steps of any of the methods described above for the RFID tag side.

[0064] This application embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the methods described above on the network device side, or implements the steps of any of the methods described above on the RFID tag side.

[0065] The identity authentication method, apparatus, related equipment, and storage medium provided in this application embodiment include: a network device receiving a first registration request sent when a first RFID tag first accesses a target network; the first registration request includes a first identifier; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code; based on the first identifier, the first RFID tag is authenticated to obtain a first authentication result; if the first authentication result indicates that the first RFID tag has passed identity authentication, a first hash parameter and a second identifier are determined; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network; and the first hash parameter and the second identifier are sent to the first RFID tag. The solution provided in this application embodiment involves the network side authenticating the RFID tag based on the identifier carried in the registration request when the RFID tag first accesses the cellular network (i.e., the target network mentioned above). After successful authentication, the network side assigns parameters (i.e., the first hash parameter and the second identifier) ​​to the RFID tag for subsequent authentication, so as to authenticate the RFID tag when it subsequently accesses the cellular network. In this way, by authenticating the RFID tag by the network side during both the first and subsequent access processes, the security of RFID tag use can be improved, and the management of RFID tags can be enhanced, that is, the manageability and controllability of RFID tags can be enhanced, thereby improving the reliability of the communication system. Attached Figure Description

[0066] Figure 1 This is a flowchart illustrating an identity authentication method according to an embodiment of this application;

[0067] Figure 2 This is a flowchart illustrating another identity authentication method according to an embodiment of this application;

[0068] Figure 3 This is a schematic diagram of an RFID tag management enhancement scheme based on a cellular network, as an application embodiment of this application.

[0069] Figure 4 This is a schematic diagram of the RFID tag management enhancement scheme based on cellular networks, as an application embodiment of this application.

[0070] Figure 5 This is a schematic diagram of the structure of an identity authentication device according to an embodiment of this application;

[0071] Figure 6 This is a schematic diagram of another identity authentication device according to an embodiment of this application;

[0072] Figure 7 This is a schematic diagram of the network device according to an embodiment of this application;

[0073] Figure 8 This is a schematic diagram of the structure of the RFID tag in an embodiment of this application;

[0074] Figure 9 This is a schematic diagram of the identity authentication system according to an embodiment of this application. Detailed Implementation

[0075] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0076] This application provides an identity authentication method applied to network devices, such as... Figure 1 As shown, the method includes:

[0077] Step 101: Receive the first registration request sent when the first RFID tag first accesses the target network; the first registration request includes a first identifier;

[0078] Here, the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0079] Step 102: Based on the first identifier, perform identity authentication on the first RFID tag to obtain the first authentication result;

[0080] Step 103: If the first authentication result indicates that the first RFID tag has passed identity authentication, determine the first hash parameter and the second identifier;

[0081] Here, the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network;

[0082] Step 104: Send the first hash parameter and the second identifier to the first RFID tag.

[0083] In practical applications, the type of the target network can be set according to requirements. For example, the target network can be a fifth-generation mobile communication technology (5G) network.

[0084] In practical applications, the network side of the target network may include network devices such as base stations and core networks. The specific network devices used for authentication of the first RFID tag can be configured according to requirements, and this embodiment does not limit this. It is understood that when the core network authenticates the first RFID tag, the base station needs to forward the information exchanged between the first RFID tag and the core network, such as the first registration request, the first hash parameter, and the second identifier. Furthermore, it should be noted that the base station integrates the traditional RFID tag reader function, enabling it to communicate with the RFID tag.

[0085] In practical applications, the first identifier can be assigned to the manufacturer of the first RFID tag by the operator of the target network during the tag production stage, and the manufacturer can store the first identifier in the storage area of ​​the first RFID tag; it can be understood that the first identifier is a unique application layer identifier assigned to the first RFID tag by the network side.

[0086] In practical applications, among the multiple storage areas of an RFID tag, the content stored in the EPC storage area can be read first by the RFID tag reader (i.e., base station). Therefore, in order to improve the efficiency of the first RFID tag registering to the target network, the first identifier can be stored in the EPC storage area of ​​the first RFID tag. When the first RFID tag first accesses the target network, it can read its own first identifier from the EPC storage area and send a first registration request carrying the first identifier to the network side so that the network side can authenticate the first RFID tag.

[0087] In practical applications, the specific format of the first identifier and the calculation method of the verification code can be set according to requirements. For example, the first identifier can be 48 bits, consisting of 14 digits, including a 3-digit (10-bit) tag chip manufacturer code, a 3-digit (10-bit) tag antenna manufacturer code, a 3-digit (10-bit) tag final packaging manufacturer code, a 3-digit (10-bit) tag type allocation code, and an 8-bit verification code; the verification code can be calculated from the first 12 digits (i.e., the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code) using the Luhn algorithm.

[0088] In step 101, in practical applications, the first RFID tag can send the first registration request to the network side via NAS signaling.

[0089] Based on this, in one embodiment, receiving the first registration request sent when the first RFID tag first accesses the target network may include:

[0090] The first registration request is received via NAS signaling.

[0091] In practical applications, the specific type of NAS signaling can be set according to requirements, and this application embodiment does not limit this.

[0092] In step 102, in practical applications, the network device can locally store the first identifiers of multiple RFID tags. When the first RFID tag needs to be authenticated, the network device can determine whether the first RFID tag has passed authentication by judging whether the first identifier of the first RFID tag exists locally.

[0093] Therefore, in one embodiment, the step of authenticating the first RFID tag based on the first identifier may include:

[0094] Determine whether the first identifier exists in the local first list, and obtain a first determination result; the first list contains the first identifier of multiple RFID tags;

[0095] If the first determination result indicates that the first identifier exists in the first list, the first RFID tag is determined to have passed identity authentication; if the first determination result indicates that the first identifier does not exist in the first list, the first RFID tag is determined to have failed identity authentication.

[0096] In practical applications, if the first authentication result indicates that the first RFID tag has failed identity authentication, the network device may reject the first registration request and send the first authentication result to the first RFID tag.

[0097] In step 103, in practical applications, when the core network authenticates the first RFID tag, the network device can request the first hash parameter and the second identifier from other network devices. For example, after receiving the first registration request, the base station can forward it to the Access and Mobility Management Function (AMF). The AMF then authenticates the first RFID tag based on the first identifier; that is, the AMF determines whether the first identifier exists in its local first list and obtains a first determination result. If the first determination result indicates that the first identifier exists in the first list, the AMF can determine that the first RFID tag has passed authentication and request the first hash parameter and the second identifier from the Authentication Service Function (AUSF) or the Unified Data Management Function (UDM), and receive the first hash parameter and the second identifier issued by the ASF or UDM.

[0098] In practical applications, the calculation methods for the first hash parameter and the second identifier can be set according to requirements. For example, AUSF or UDM can use a general hash algorithm to calculate the first hash parameter and use the first identifier in combination with a preset algorithm to calculate the second identifier.

[0099] In practical applications, when the manufacturer of the first RFID tag signs a contract with the operator of the target network, it will agree on the usage period of the RFID tag, that is, the validity period of the RFID tag; the network device can determine whether the first RFID tag is valid based on the contract information corresponding to the first RFID tag, and determine the first hash parameter and the second identifier if the first RFID tag is valid.

[0100] Based on this, in one embodiment, determining the first hash parameter and the second identifier may include:

[0101] When the first RFID tag is determined to be valid, the first hash parameter and the second identifier are determined.

[0102] Here, whether the first RFID tag is valid can be understood as whether the current usage period of the first RFID tag complies with the usage period stipulated in the corresponding contract information, that is, the compliance of the usage period of the first RFID tag.

[0103] In practical applications, when the first RFID tag is determined to be invalid, the network device can restrict the communication of the first RFID tag, i.e., reject the first registration request. For example, after the AMF requests the first hash parameter and second identifier of the first RFID tag from the AFS or UDM, the AFS or UDM can determine whether the first RFID tag is valid based on the subscription information corresponding to the first RFID tag. If the first RFID tag is determined to be valid, the AFS or UDM can determine and return the first hash parameter and the second identifier to the AMF. If the first RFID tag is determined to be invalid, the AFS or UDM can notify the AMF that the first RFID tag is invalid, so that the AMF rejects the first registration request to the first RFID tag through the base station.

[0104] For step 104, in one embodiment, sending the first hash parameter and the second identifier to the first RFID tag may include:

[0105] The first hash parameter and the second identifier are sent via NAS signaling.

[0106] Correspondingly, the first RFID tag can receive the second identifier and the first hash parameter via NAS signaling.

[0107] In practical applications, the network device can send a registration acceptance message carrying the first hash parameter and the second identifier to the first RFID tag via NAS signaling.

[0108] In practical applications, the specific type of NAS signaling can be set according to requirements, and this application embodiment does not limit this.

[0109] In practical applications, after receiving the second identifier and the first hash parameter, the first RFID tag can use the first hash parameter combined with a general hash algorithm to calculate a first hash value, and store the first hash value and the second identifier in the EPC storage area. Simultaneously, the network device can also use the first hash parameter combined with the same hash algorithm as the first RFID tag to calculate a second hash value, and store the first identifier, the second identifier, and the second hash value in association, i.e., store the association relationship between the first identifier, the second identifier, and the second hash value. Thus, when the first RFID tag subsequently accesses the target network, the network device can authenticate the first RFID tag based on the second identifier and the first hash value. Specifically, when the first RFID tag subsequently accesses the target network, i.e., when accessing the target network for the first time, it can read its own second identifier and first hash value from the EPC storage area and send a second registration request carrying the second identifier and the first hash value to the network side for authentication.

[0110] Based on this, in one embodiment, the method may further include:

[0111] The system receives a second registration request sent when the first RFID tag is not accessing the target network for the first time; the second registration request includes the second identifier and a first hash value; the first hash value is determined by the first RFID tag based on the first hash parameter;

[0112] Based on the second identifier and the first hash value, the first RFID tag is authenticated to obtain a second authentication result;

[0113] The second authentication result is sent to the first RFID tag.

[0114] Specifically, the network device can determine whether the first RFID tag has passed identity authentication by judging whether the first hash value and the second hash value are the same.

[0115] Therefore, in one embodiment, the authentication of the first RFID tag based on the second identifier and the first hash value may include:

[0116] Using a local second list, the second hash value corresponding to the second identifier is determined; the second list contains multiple associations between first identifiers, second identifiers, and second hash values; each second hash value is determined by the network device based on a corresponding first hash parameter.

[0117] Determine whether the first hash value and the second hash value are the same to obtain a second determination result;

[0118] If the second determination result indicates that the first hash value and the second hash value are the same, the first RFID tag is determined to have passed identity authentication; if the second determination result indicates that the first hash value and the second hash value are different, the first RFID tag is determined to have failed identity authentication.

[0119] In practical applications, if the second authentication result indicates that the first RFID tag has failed identity authentication, the network device may reject the second registration request.

[0120] In practical applications, to further improve the security of RFID tag usage, the network device can periodically update the first hash parameter and update the second hash value using the updated first hash parameter when the first RFID tag is determined to be valid. Thus, if the second judgment result indicates that the first hash value and the second hash value are different, it means that the second hash value has been updated, and the network device can instruct the first RFID tag to re-initiate the initial access process to avoid communication with the first RFID tag being eavesdropped.

[0121] Based on this, in one embodiment, the method may further include:

[0122] When the first RFID tag is determined to be valid, the first hash parameter is periodically updated, and the corresponding second hash value is updated in the second list using the updated first hash parameter;

[0123] When the second determination result indicates that the first hash value is different from the second hash value, when issuing the second authentication result to the first RFID tag, the first information is also issued to the first RFID tag; the first information indicates that the first hash value has expired; the first information is used to trigger the first RFID tag to send a first registration request to the network device.

[0124] In practical applications, the update period of the first hash parameter can be set according to requirements, and this application embodiment does not limit this.

[0125] In practical applications, after receiving the first information, the first RFID tag can restart the initial access authentication process under the trigger of the first information, that is, resend the first registration request to the network side.

[0126] In practical applications, the network device can periodically update the first hash parameter through other network devices. For example, the AUSF or UDM can determine whether the first RFID tag is valid based on the subscription information corresponding to the first RFID tag; when the first RFID tag is determined to be valid, the AUSF or UDM can update the first hash parameter and send the updated first hash parameter to the AMF; the AMF then uses the updated first hash parameter to update the corresponding second hash value in its local second list.

[0127] In practical applications, when the network device determines that the first RFID tag is invalid, it can also send the first information to the first RFID tag, and when the first RFID tag sends the first registration request again, it can reject the first registration request, thereby restricting the communication rights of the first RFID tag.

[0128] Accordingly, embodiments of this application also provide an identity authentication method applied to RFID tags, such as... Figure 2 As shown, the method includes:

[0129] Step 201: Upon first access to the target network, obtain the first identifier from the EPC storage area and send the first registration request to the network side;

[0130] Here, the first registration request includes the first identifier; the first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0131] Step 202: If the first authentication result indicates that the RFID tag has passed identity authentication, receive the first hash parameter and the second identifier sent by the network side;

[0132] Here, the first hash parameter and the second identifier are used for identity authentication when the RFID tag subsequently accesses the network.

[0133] In one embodiment, the method may further include:

[0134] When accessing the target network for the first time, the second identifier and the first hash value are obtained from the EPC storage area, and a second registration request is sent to the network side; the second registration request includes the second identifier and the first hash value; the first hash value is determined by the RFID tag based on the first hash parameter;

[0135] The network receives a second authentication result from the network side; the second authentication result is obtained by the network side authenticating the RFID tag based on the second identifier and the first hash value.

[0136] In one embodiment, the method may further include:

[0137] When receiving the second authentication result sent by the network side, the system also receives first information sent by the network side; the first information indicates that the first hash value has expired.

[0138] Triggered by the first information, a first registration request is sent to the network side.

[0139] In one embodiment, sending the first registration request to the network side may include:

[0140] The first registration request is sent via NAS signaling.

[0141] In one embodiment, receiving the second identifier and the first hash parameter sent by the network side may include:

[0142] The second identifier and the first hash parameter are received via NAS signaling.

[0143] It should be noted that the specific processing procedure for the RFID tags has been described in detail above and will not be repeated here.

[0144] The authentication method provided in this application embodiment includes: a network device receiving a first registration request sent when a first RFID tag first accesses a target network; the first registration request includes a first identifier; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code; based on the first identifier, the first RFID tag is authenticated to obtain a first authentication result; if the first authentication result indicates that the first RFID tag has passed authentication, a first hash parameter and a second identifier are determined; the first hash parameter and the second identifier are used for authentication of the first RFID tag when it subsequently accesses the target network; and the first hash parameter and the second identifier are sent to the first RFID tag. The solution provided in this application embodiment involves the network side authenticating the RFID tag based on the identifier carried in the registration request when the RFID tag first accesses the cellular network (i.e., the target network mentioned above). After successful authentication, the network side assigns parameters (i.e., the first hash parameter and the second identifier) ​​to the RFID tag for subsequent authentication, so as to authenticate the RFID tag when it subsequently accesses the cellular network. In this way, by authenticating the RFID tag by the network side during both the first and subsequent access processes, the security of RFID tag use can be improved, and the management of RFID tags can be enhanced, that is, the manageability and controllability of RFID tags can be enhanced, thereby improving the reliability of the communication system.

[0145] The present application will be further described in detail below with reference to application examples.

[0146] In this application embodiment, the first identifier is called the Communication Application Identifier (TNI, Tag NetworkIdentity); the tag chip manufacturer code is called TCMC; the tag antenna manufacturer code is called TAMC; the tag final packaging manufacturer code is called TFPC; the tag type allocation code is called TTAC; and the verification code is called CD.

[0147] This application example proposes an enhanced RFID tag management scheme based on cellular networks, such as... Figure 3 As shown, the scheme includes the following three important steps:

[0148] 1) TNI allocation

[0149] Specifically, during the RFID tag manufacturing process, operators assign a unique TNI (Trust Identity Provider) to each RFID tag as its identification information within the communication network, ensuring its uniqueness across the entire network. The TNI is used to identify each RFID tag in the cellular network, essentially functioning as the RFID tag's identity card within the communication network. RFID tag manufacturers then burn the TNI into the RFID tag's memory area for authentication when the RFID tag first connects to the network.

[0150] 2) Identity authentication of RFID tags when they first connect to the network

[0151] Specifically, when an RFID tag first accesses the network, the network side needs to authenticate the RFID tag and determine whether its TNI (Trust Identity Requirement) is valid (i.e., whether it is stored on the network side). Then, considering the lightweight nature of RFID tags, a common hash algorithm is used to implement subsequent access authentication. That is, the network side assigns hash parameters (i.e., the first hash parameters mentioned above) to RFID tags with valid TNIs and calculates the hash value of the tag (i.e., the second hash value mentioned above) based on the common hash algorithm, and associates and stores the hash value with the TNI. After receiving the hash parameters assigned by the network side, the RFID tag also calculates and stores the hash value (i.e., the first hash value mentioned above) based on the same hash algorithm as the network side. The hash value stored by the network side and the hash value stored by the RFID tag are used for subsequent access authentication, i.e., authentication when the RFID tag accesses the network for the first time.

[0152] 3) Identity authentication of RFID tags when they are not accessing the network for the first time

[0153] Specifically, when an RFID tag is not accessing the network for the first time, that is, when the RFID tag is in normal working condition, in order to ensure the security of communication between the RFID tag and the network side, the network side will periodically or triggerively authenticate the RFID tag based on the hash value reported by the RFID tag.

[0154] like Figure 4 As shown, the process of this application embodiment's RFID tag management enhancement scheme based on cellular networks specifically includes the following steps:

[0155] Step 400: RFID tag manufacturer configures (i.e. stores) TNI;

[0156] Step 401: The RFID Application Function (AF) sends tag inventory / read / write rules to the AMF; then proceed to step 402.

[0157] Step 402: The AMF sends a tag inventory / read / write command to the base station; then proceed to step 403.

[0158] Step 403: The base station performs tag inventory / read / write operations; then proceed to step 404;

[0159] Step 404: The network side performs access authentication on the RFID tag; then proceed to step 405;

[0160] Step 405: The base station sends an inventory / read / write command to the RFID tag; then proceed to step 406.

[0161] Step 406: The RFID tag sends the inventory / read / write results back to the AMF; then proceed to step 407;

[0162] Step 407: The AMF sends the inventory / read / write results back to the RFID AF.

[0163] Specifically, in step 400, the RFID tag manufacturer stores the TNI assigned by the operator into the memory area of ​​the RFID tag. The TNI is 48 bits long, consisting of 14 digits, and its structure is TCMC+TAMC+TFPC+TTAC+CD. TCMC consists of 3 digits (10 bits) and is used to identify the tag chip manufacturer's code; TAMC consists of 3 digits (10 bits) and is used to identify the tag antenna manufacturer's code; TFPC consists of 3 digits (10 bits) and is used to identify the final packaging manufacturer's code; TTAC consists of 3 digits (10 bits) and is a code that distinguishes the tag model. This code is assigned by a globally unified organization, and the first two digits of TTAC are the identifier of the assigning organization, which is the code of the authorized TNI code assigning organization; CD (8 bits) is calculated from the first 12 digits using the Luhn algorithm.

[0164] In practical applications, according to the data storage rules of RFID tags, RFID tags include four independent storage blocks: EPC storage area, Reserved storage area, Tag Identification Number (TID) storage area, and User storage area. Considering that the TID requires 48 bits of space and that the RFID reader can read the information stored in the EPC storage area first, in this application embodiment, the RFID tag manufacturer writes the TID into the EPC storage area of ​​the RFID tag.

[0165] In step 401, the tag inventory rules are used to count the quantity of RFID tags of a specific type, and the tag read / write rules are used to write specific content to or read specific content from a specific storage area of ​​an RFID tag. Additionally, the interaction between the core network element (AMF) and external functional modules (RFID AF) ​​needs to be achieved through the Network Exposure Function (NEF).

[0166] In step 402, after receiving the tag inventory / read / write rules sent by the RFID AF, the AMF generates tag inventory / read / write instructions (i.e., tag inventory / read / write commands) according to the tag inventory / read / write rules, and sends the tag inventory / read / write instructions to the RFID tag reader (i.e., base station) through the signaling channel.

[0167] In step 403, after receiving the scheduling instruction (i.e., the tag inventory / read / write command), the base station executes the corresponding tag inventory / read / write operation by sending instructions to the RFID tags.

[0168] In step 404, after receiving the instruction from the base station, the RFID tag will perform access authentication. At this time, the subsequent operations are distinguished based on whether the RFID tag is accessing the network for the first time: if the RFID tag is accessing the network for the first time, the first access authentication process is executed (i.e., steps 4041 to 4046, see the following description for the specific execution process); if the RFID tag is not accessing the network for the first time, the non-first access authentication process is executed (i.e., steps 4047 to 4049, see the following description for the specific execution process).

[0169] In step 405, after the network side completes the authentication of the RFID tag, the base station continues to perform the tag inventory / read / write operation and sends inventory / read / write commands to the RFID tag.

[0170] In this application embodiment, when performing the initial access authentication process, step 404 specifically includes the following steps:

[0171] Step 4041: The RFID tag sends a network registration request carrying the TNI to the AMF (i.e., the first registration request mentioned above); then proceed to step 4042;

[0172] Step 4042: The AMF verifies the TNI and requests the network identifier (network ID, i.e., the second identifier mentioned above) and hash parameter (i.e., the first hash parameter mentioned above) from the AUSF / UDM; then proceed to step 4043.

[0173] Step 4043: AUSF / UDM determines the contract information and issues the network ID and hash parameters; then proceed to step 4044.

[0174] Step 4044: AMF issues the network ID and hash parameters; then proceed to steps 4045 and 4046.

[0175] Step 4045: The RFID tag calculates the hash value (i.e., the first hash value mentioned above) by performing hash() (i.e., a general hash algorithm) based on the hash parameter, and stores the network ID and hash value in the EPC storage area;

[0176] Step 4046: AMF performs hash() based on the hash parameter to calculate the hash value (i.e., the second hash value mentioned above), and stores the hash value, network ID, and TNI together.

[0177] Specifically, in step 4041, the RFID tag sends a registration request carrying a TNI to the AMF via NAS signaling.

[0178] In step 4042, the AMF determines whether the RFID tag has a legitimate identity by checking whether a corresponding TNI exists locally. If the RFID tag has a legitimate TNI (i.e., a corresponding TNI exists locally), the AMF requests a network ID and hash parameters from the AUSF / UDM.

[0179] In step 4043, to ensure the secure management of RFID tags without unduly increasing their complexity, this application embodiment employs a common hash algorithm to ensure the tags' tamper-proof nature; that is, a common hash algorithm is used to generate hash parameters. Furthermore, since the TNI is a unique application layer identifier assigned to the RFID tag by the network side, the TNI can determine the RFID tag's unique identity within the network, i.e., the network ID (i.e., the network ID is pre-generated by the network side when assigning the TNI), thereby leveraging the ultra-high security of cellular communication networks to enhance the communication security of the RFID tags.

[0180] Furthermore, since RFID tag manufacturers are required to manage contract data for each type of tag when signing contracts with operators, AUSF / UDM manages RFID tags based on the corresponding contract information. Specifically, it determines whether the current usage period of the RFID tag is compliant (i.e., whether the RFID tag is valid) based on the usage period information included in the contract, and then determines whether to issue the network ID and hash parameters based on the compliance of the RFID tag's usage period. This allows it to restrict whether the RFID tag can communicate normally.

[0181] In this application embodiment, AUSF / UDM also periodically updates the hash parameters based on the contract information and sends them to the AMF; that is, the hash parameters are updated periodically as long as the usage period of the RFID tag is compliant. In this way, AUSF / UDM manages the RFID tags according to the contract information corresponding to the RFID tags. On the one hand, it enables the RFID tags to reapply for hash parameters after a certain usage period to avoid being eavesdropped on; on the other hand, it can determine whether to send hash parameters based on the contract information, thereby limiting the communication rights of the tags.

[0182] In step 4044, the AMF sends the network ID and hash parameters to the RFID tag via NAS signaling.

[0183] In practical applications, the execution order of steps 4045 and 4046 is not important. Step 4045 can be executed first and then step 4046, or step 4046 can be executed first and then step 4045; or steps 4045 and 4046 can be executed simultaneously.

[0184] In this application embodiment, when performing a non-first-time access authentication process, step 404 specifically includes the following steps:

[0185] Step 4047: The RFID tag sends a network registration request carrying the network ID and hash value to the AMF; then proceed to step 4048;

[0186] Step 4048: AMF verifies the network ID and hash value; then proceed to step 4049;

[0187] Step 4049: AMF sends a registration acceptance message to the RFID tag.

[0188] Specifically, in step 4047, the RFID tag sends a registration request carrying the network ID and hash value to the AMF via NAS signaling.

[0189] In step 4048, the AMF verifies the accuracy of the hash value reported by the RFID tag based on the network ID, that is, it determines whether the hash value reported by the RFID tag is consistent with the corresponding hash value locally. Since the local hash parameters of the AMF are updated periodically, the local hash value of the AMF is also updated periodically. Therefore, when the AMF finds that the hash value reported by the RFID tag has expired (that is, the hash value reported by the RFID tag is inconsistent with the corresponding hash value locally), it will trigger the RFID tag to start the first access authentication process and reapply for the network ID and hash parameters.

[0190] It should be noted that, due to the potentially high frequency of RFID tag reading and writing, to avoid impacting system communication efficiency, the non-first-time access authentication process does not need to be performed with every tag inventory (i.e., check-in) or read / write operation. A periodic authentication method can be adopted; for example, after an RFID tag first accesses the network, it can register with the AMF every 24 hours. In special circumstances, such as when the RFID AF instructs the RFID tag to perform identity authentication, the non-first-time access authentication process must be performed according to the RFID AF's instructions.

[0191] The solution provided in this application embodiment has the following advantages:

[0192] 1) It provides a complete identity authentication process for RFID tags when they first access the network and when they do not access the network for the first time. It can achieve comprehensive control over the entire process of RFID tags from generation to first access to the network and then to communication with the network side, thereby enhancing the manageability and controllability of RFID tags, and thus enhancing the operator's control over RFID applications in logistics, industrial production and manufacturing and other fields.

[0193] 2) It can improve the security of RFID tag use with a lightweight authentication mechanism. In other words, because the authentication method is simple and convenient, it will not cause too much redundancy in the RFID system. Therefore, it can ensure that the communication efficiency is not affected and improve the overall reliability of the system.

[0194] To implement the network device-side method of this application embodiment, this application embodiment also provides an identity authentication device, which is installed on the network device, such as... Figure 5 As shown, the device includes:

[0195] The first receiving unit 501 is configured to receive a first registration request sent when the first RFID tag first accesses the target network; the first registration request includes a first identifier; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0196] The first processing unit 502 is used to perform identity authentication on the first RFID tag based on the first identifier and obtain a first authentication result;

[0197] The second processing unit 503 is configured to determine a first hash parameter and a second identifier when the first authentication result indicates that the first RFID tag has passed identity authentication; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network;

[0198] The first transmitting unit 504 is used to send the first hash parameter and the second identifier to the first RFID tag.

[0199] In one embodiment, the first processing unit 502 is specifically used for:

[0200] Determine whether the first identifier exists in the local first list, and obtain a first determination result; the first list contains the first identifier of multiple RFID tags;

[0201] If the first determination result indicates that the first identifier exists in the first list, the first RFID tag is determined to have passed identity authentication; if the first determination result indicates that the first identifier does not exist in the first list, the first RFID tag is determined to have failed identity authentication.

[0202] In one embodiment, the second processing unit 503 is specifically used to determine the first hash parameter and the second identifier when it is determined that the first RFID tag is valid.

[0203] In one embodiment, the first receiving unit 501 is further configured to receive a second registration request sent when the first RFID tag is not accessing the target network for the first time; the second registration request includes the second identifier and a first hash value; the first hash value is determined by the first RFID tag based on the first hash parameter;

[0204] Correspondingly, the first processing unit 502 is further configured to perform identity authentication on the first RFID tag based on the second identifier and the first hash value, and obtain a second authentication result;

[0205] The first sending unit 504 is also used to send the second authentication result to the first RFID tag.

[0206] In one embodiment, the first processing unit 502 is further configured to:

[0207] Using a local second list, the second hash value corresponding to the second identifier is determined; the second list contains multiple associations between first identifiers, second identifiers, and second hash values; each second hash value is determined by the network device based on a corresponding first hash parameter.

[0208] Determine whether the first hash value and the second hash value are the same to obtain a second determination result;

[0209] If the second determination result indicates that the first hash value and the second hash value are the same, the first RFID tag is determined to have passed identity authentication; if the second determination result indicates that the first hash value and the second hash value are different, the first RFID tag is determined to have failed identity authentication.

[0210] In one embodiment, the second processing unit 503 is further configured to periodically update the first hash parameter when it is determined that the first RFID tag is valid, and update the corresponding second hash value in the second list using the updated first hash parameter;

[0211] Correspondingly, the first sending unit 504 is further configured to send first information to the first RFID tag when the second determination result indicates that the first hash value is different from the second hash value; the first information indicates that the first hash value has expired; the first information is used to trigger the first RFID tag to send a first registration request to the network device.

[0212] In one embodiment, the first receiving unit 501 is further configured to receive the first registration request via NAS signaling.

[0213] In one embodiment, the first sending unit 504 is further configured to send the first hash parameter and the second identifier via NAS signaling.

[0214] In practical applications, the first receiving unit 501 and the first sending unit 502 can be implemented by the communication interface in the identity authentication device; the first processing unit 502 and the second processing unit 503 can be implemented by the processor in the identity authentication device.

[0215] To implement the RFID tag-side method of this application embodiment, this application embodiment also provides an identity authentication device, which is disposed on the RFID tag, such as... Figure 6 As shown, the device includes:

[0216] The second sending unit 601 is configured to obtain a first identifier from the EPC storage area and send a first registration request to the network side when the RFID tag first accesses the target network; the first registration request includes the first identifier; the first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0217] The second receiving unit 602 is used to receive a first hash parameter and a second identifier sent by the network side when the first authentication result indicates that the RFID tag has passed identity authentication; the first hash parameter and the second identifier are used for identity authentication when the RFID tag subsequently accesses the network.

[0218] In one embodiment, the second sending unit 601 is further configured to, when the RFID tag is not accessing the target network for the first time, obtain the second identifier and the first hash value from the EPC storage area, and send a second registration request to the network side; the second registration request includes the second identifier and the first hash value; the first hash value is determined by the RFID tag based on the first hash parameter;

[0219] Correspondingly, the second receiving unit 602 is also used to receive the second authentication result sent by the network side; the second authentication result is obtained by the network side authenticating the RFID tag based on the second identifier and the first hash value.

[0220] In one embodiment, the second receiving unit 602 is further configured to receive first information sent by the network side when receiving the second authentication result sent by the network side; the first information indicates that the first hash value has expired.

[0221] Correspondingly, the second sending unit 601 is also configured to send a first registration request to the network side when triggered by the first information.

[0222] In one embodiment, the second sending unit 601 is further configured to send the first registration request via NAS signaling.

[0223] In one embodiment, the second receiving unit 602 is further configured to receive the second identifier and the first hash parameter via NAS signaling.

[0224] In practical applications, the second sending unit 601 and the second receiving unit 602 can be implemented by the communication interface in the identity authentication device.

[0225] It should be noted that the identity authentication device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the identity authentication device and the identity authentication method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0226] Based on the hardware implementation of the above program modules, and in order to implement the method on the network device side of the embodiments of this application, the embodiments of this application also provide a network device, such as... Figure 7 As shown, the network device 700 includes:

[0227] The first communication interface 701 is capable of exchanging information with RFID tags;

[0228] The first processor 702 is connected to the first communication interface 701 to enable information interaction with RFID tags. When running a computer program, it executes the methods provided by one or more technical solutions on the network device side. The computer program is stored in the first memory 703.

[0229] Specifically, the first communication interface 701 is used to receive a first registration request sent when the first RFID tag first accesses the target network; the first registration request includes a first identifier; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code;

[0230] The first processor 702 is configured to perform identity authentication on the first RFID tag based on the first identifier to obtain a first authentication result; and determine a first hash parameter and a second identifier if the first authentication result indicates that the first RFID tag has passed identity authentication; the first hash parameter and the second identifier are used for identity authentication of the first RFID tag when it subsequently accesses the target network.

[0231] The first communication interface 701 is also used to send the first hash parameter and the second identifier to the first RFID tag.

[0232] In one embodiment, the first processor 702 is further configured to:

[0233] Determine whether the first identifier exists in the local first list, and obtain a first determination result; the first list contains the first identifier of multiple RFID tags;

[0234] If the first determination result indicates that the first identifier exists in the first list, the first RFID tag is determined to have passed identity authentication; if the first determination result indicates that the first identifier does not exist in the first list, the first RFID tag is determined to have failed identity authentication.

[0235] In one embodiment, the first processor 702 is further configured to determine the first hash parameter and the second identifier when it is determined that the first RFID tag is valid.

[0236] In one embodiment, the first communication interface 701 is further configured to receive a second registration request sent when the first RFID tag is not accessing the target network for the first time; the second registration request includes the second identifier and a first hash value; the first hash value is determined by the first RFID tag based on the first hash parameter;

[0237] Correspondingly, the first processor 702 is further configured to perform identity authentication on the first RFID tag based on the second identifier and the first hash value, and obtain a second authentication result;

[0238] The first communication interface 701 is also used to send the second authentication result to the first RFID tag.

[0239] In one embodiment, the first processor 702 is further configured to:

[0240] Using a local second list, the second hash value corresponding to the second identifier is determined; the second list contains multiple associations between first identifiers, second identifiers, and second hash values; each second hash value is determined by the network device based on a corresponding first hash parameter.

[0241] Determine whether the first hash value and the second hash value are the same to obtain a second determination result;

[0242] If the second determination result indicates that the first hash value and the second hash value are the same, the first RFID tag is determined to have passed identity authentication; if the second determination result indicates that the first hash value and the second hash value are different, the first RFID tag is determined to have failed identity authentication.

[0243] In one embodiment, the first processor 702 is further configured to periodically update the first hash parameter when it determines that the first RFID tag is valid, and update the corresponding second hash value in the second list using the updated first hash parameter;

[0244] Correspondingly, the first communication interface 701 is also used to send first information to the first RFID tag when the second determination result indicates that the first hash value is different from the second hash value; the first information indicates that the first hash value has expired; the first information is used to trigger the first RFID tag to send a first registration request to the network device.

[0245] In one embodiment, the first communication interface 701 is further configured to receive the first registration request via NAS signaling.

[0246] In one embodiment, the first communication interface 701 is further configured to send the first hash parameter and the second identifier via NAS signaling.

[0247] It should be noted that the specific processing procedures of the first communication interface 701 and the first processor 702 can be understood by referring to the above method.

[0248] Of course, in practical applications, the various components in network device 700 are coupled together through bus system 704. It can be understood that bus system 704 is used to implement communication between these components. In addition to a data bus, bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 7 The general designated all buses as Bus System 704.

[0249] The first memory 703 in this embodiment is used to store various types of data to support the operation of the network device 700. Examples of such data include any computer program used to operate on the network device 700.

[0250] The methods disclosed in the embodiments of this application can be applied to the first processor 702, or implemented by the first processor 702. The first processor 702 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 702. The first processor 702 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 702 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 703. The first processor 702 reads the information in the first memory 703 and completes the steps of the aforementioned method in combination with its hardware.

[0251] In an exemplary embodiment, the network device 700 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0252] Based on the hardware implementation of the above program modules, and in order to implement the RFID tag-side method of this application embodiment, this application embodiment also provides an RFID tag, such as... Figure 8 As shown, the RFID tag 800 includes:

[0253] The second communication interface 801 is capable of exchanging information with the network side;

[0254] The second processor 802 is connected to the second communication interface 801 to enable information interaction with the network side. When running a computer program, it executes the methods provided by one or more technical solutions on the RFID tag side. The computer program is stored in the second memory 803.

[0255] Specifically, the second communication interface 801 is used for:

[0256] Upon initial access to the target network, a first identifier is obtained from the EPC storage area, and a first registration request is sent to the network side. The first registration request includes the first identifier. The first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result. The first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code. The verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code.

[0257] If the first authentication result indicates that the RFID tag has passed identity authentication, the first hash parameter and the second identifier sent by the network side are received; the first hash parameter and the second identifier are used for identity authentication when the RFID tag subsequently accesses the network.

[0258] In one embodiment, the second communication interface 801 is further configured to:

[0259] When accessing the target network for the first time, the second identifier and the first hash value are obtained from the EPC storage area, and a second registration request is sent to the network side; the second registration request includes the second identifier and the first hash value; the first hash value is determined by the RFID tag based on the first hash parameter;

[0260] The network receives a second authentication result from the network side; the second authentication result is obtained by the network side authenticating the RFID tag based on the second identifier and the first hash value.

[0261] In one embodiment, the second communication interface 801 is further configured to:

[0262] When receiving the second authentication result sent by the network side, the system also receives first information sent by the network side; the first information indicates that the first hash value has expired.

[0263] Triggered by the first information, a first registration request is sent to the network side.

[0264] In one embodiment, the second communication interface 801 is further configured to send the first registration request via NAS signaling.

[0265] In one embodiment, the second communication interface 801 is further configured to receive the second identifier and the first hash parameter via NAS signaling.

[0266] It should be noted that the specific processing procedure of the second communication interface 801 can be understood by referring to the above method.

[0267] Of course, in practical applications, the various components in the RFID tag 800 are coupled together through the bus system 804. It can be understood that the bus system 804 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 8 The general labeled all buses as Bus System 804.

[0268] The second memory 803 in this embodiment is used to store various types of data to support the operation of the RFID tag 800. Examples of such data include any computer program used to operate on the RFID tag 800.

[0269] The methods disclosed in the embodiments of this application can be applied to the second processor 802, or implemented by the second processor 802. The second processor 802 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the second processor 802. The second processor 802 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 802 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the second memory 803. The second processor 802 reads the information in the second memory 803 and completes the steps of the aforementioned method in combination with its hardware.

[0270] In an exemplary embodiment, the RFID tag 800 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0271] It is understood that the memories (first memory 703, second memory 803) in the embodiments of this application can be volatile memories or non-volatile memories, or both. Non-volatile memories can be read-only memories (ROM), programmable read-only memories (PROM), erasable programmable read-only memories (EPROM), electrically erasable programmable read-only memories (EEPROM), magnetic random access memories (FRAM), flash memories, magnetic surface memories, optical discs, or compact disc read-only memories (CD-ROM); magnetic surface memories can be disk storage or magnetic tape storage. Volatile memories can be random access memories (RAM), which are used as external caches. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0272] To implement the method provided in the embodiments of this application, the embodiments of this application also provide an identity authentication system, such as... Figure 9 As shown, the system includes: network device 901 and RFID tag 902.

[0273] It should be noted that the specific processing procedures of the network device 901 and the RFID tag 902 have been described in detail above and will not be repeated here.

[0274] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory 703 storing a computer program, which can be executed by a first processor 702 of a network device 700 to complete the steps described in the aforementioned network device-side method. Another example is a second memory 803 storing a computer program, which can be executed by a second processor 802 of an RFID tag 800 to complete the steps described in the aforementioned RFID tag-side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0275] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0276] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0277] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. An identity authentication method, characterized in that, Applied to network devices, including: A first registration request is received when a first RFID tag first accesses a target network; the first registration request includes a first identifier; the network device is a core network element; the target network is a cellular network; the first identifier is stored in the Electronic Product Code (EPC) storage area of ​​the first RFID tag; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code. Based on the first identifier, the first RFID tag is authenticated to obtain a first authentication result; If the first authentication result indicates that the first RFID tag has passed identity authentication, and the first RFID tag is determined to be valid based on the subscription information corresponding to the first RFID tag, then a first hash parameter and a second identifier are determined; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network; the second identifier is calculated by the network device using the first identifier in combination with a preset algorithm; Send the first hash parameter and the second identifier to the first RFID tag.

2. The method according to claim 1, characterized in that, The step of authenticating the first RFID tag based on the first identifier includes: Determine whether the first identifier exists in the local first list, and obtain a first determination result; the first list contains the first identifier of multiple RFID tags; If the first determination result indicates that the first identifier exists in the first list, the first RFID tag is determined to have passed identity authentication; if the first determination result indicates that the first identifier does not exist in the first list, the first RFID tag is determined to have failed identity authentication.

3. The method according to claim 1 or 2, characterized in that, The method further includes: The system receives a second registration request sent when the first RFID tag is not accessing the target network for the first time; the second registration request includes the second identifier and a first hash value; the first hash value is determined by the first RFID tag based on the first hash parameter; Based on the second identifier and the first hash value, the first RFID tag is authenticated to obtain a second authentication result; The second authentication result is sent to the first RFID tag.

4. The method according to claim 3, characterized in that, The authentication of the first RFID tag based on the second identifier and the first hash value includes: Using a local second list, the second hash value corresponding to the second identifier is determined; the second list contains multiple associations between first identifiers, second identifiers, and second hash values; each second hash value is determined by the network device based on a corresponding first hash parameter. Determine whether the first hash value and the second hash value are the same to obtain a second determination result; If the second determination result indicates that the first hash value and the second hash value are the same, the first RFID tag is determined to have passed identity authentication; if the second determination result indicates that the first hash value and the second hash value are different, the first RFID tag is determined to have failed identity authentication.

5. The method according to claim 4, characterized in that, The method further includes: When the first RFID tag is determined to be valid, the first hash parameter is periodically updated, and the corresponding second hash value is updated in the second list using the updated first hash parameter; When the second determination result indicates that the first hash value is different from the second hash value, when issuing the second authentication result to the first RFID tag, the first information is also issued to the first RFID tag; the first information indicates that the first hash value has expired; the first information is used to trigger the first RFID tag to send a first registration request to the network device.

6. The method according to claim 1 or 2, characterized in that, The receipt of the first registration request sent when the first RFID tag first accesses the target network includes: The first registration request is received via NAS signaling.

7. The method according to claim 1 or 2, characterized in that, Sending the first hash parameter and the second identifier to the first RFID tag includes: The first hash parameter and the second identifier are sent via NAS signaling.

8. An identity authentication method, characterized in that, Applications in RFID tags, including: Upon initial access to the target network, a first identifier is obtained from the Electronic Product Code (EPC) storage area, and a first registration request is sent to the network side. The first registration request includes the first identifier. The network side is a core network element. The target network is a cellular network. The first identifier is stored in the EPC storage area of ​​a first RFID tag. The first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result. The first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code. The verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code. When the first authentication result indicates that the RFID tag has passed identity authentication, and the RFID tag is determined to be valid by the network side based on the subscription information corresponding to the RFID tag, the network side receives the first hash parameter and the second identifier; the first hash parameter and the second identifier are used for identity authentication of the RFID tag when it subsequently accesses the network; the second identifier is calculated by the network device using the first identifier in combination with a preset algorithm.

9. The method according to claim 8, characterized in that, The method further includes: When accessing the target network for the first time, the second identifier and the first hash value are obtained from the EPC storage area, and a second registration request is sent to the network side; the second registration request includes the second identifier and the first hash value; the first hash value is determined by the RFID tag based on the first hash parameter; The network receives a second authentication result from the network side; the second authentication result is obtained by the network side authenticating the RFID tag based on the second identifier and the first hash value.

10. The method according to claim 9, characterized in that, The method further includes: When receiving the second authentication result sent by the network side, the system also receives the first information sent by the network side; the first information indicates that the first hash value has expired. Triggered by the first information, a first registration request is sent to the network side.

11. The method according to claim 8, characterized in that, Sending the first registration request to the network side includes: The first registration request is sent via NAS signaling.

12. The method according to claim 8, characterized in that, The receipt of the second identifier and the first hash parameter sent by the network side includes: The second identifier and the first hash parameter are received via NAS signaling.

13. An identity authentication device, characterized in that, Applied to network devices, including: A first receiving unit is configured to receive a first registration request sent when a first RFID tag first accesses a target network; the first registration request includes a first identifier; the network device is a core network element; the target network is a cellular network; the first identifier is stored in the Electronic Product Code (EPC) storage area of ​​the first RFID tag; the first identifier includes at least a tag chip manufacturer code, a tag antenna manufacturer code, a tag final packaging manufacturer code, a tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code. The first processing unit is configured to perform identity authentication on the first RFID tag based on the first identifier, and obtain a first authentication result; The second processing unit is configured to determine a first hash parameter and a second identifier when the first authentication result indicates that the first RFID tag has passed identity authentication and the first RFID tag is determined to be valid based on the subscription information corresponding to the first RFID tag; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network; the second identifier is calculated by the network device using the first identifier in combination with a preset algorithm; The first transmitting unit is used to send the first hash parameter and the second identifier to the first RFID tag.

14. An identity authentication device, characterized in that, include: The second transmitting unit is used to obtain the first identifier from the EPC storage area and send the first registration request to the network side when the RFID tag first accesses the target network; The first registration request includes the first identifier; the network side is a core network element; the target network is a cellular network; The first identifier is stored in the Electronic Product Code (EPC) storage area of ​​the first RFID tag; the first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code; The second receiving unit is configured to receive a first hash parameter and a second identifier sent by the network side when the first authentication result indicates that the RFID tag has passed identity authentication and the RFID tag is determined to be valid by the network side based on the subscription information corresponding to the RFID tag; the first hash parameter and the second identifier are used for identity authentication of the RFID tag when it subsequently accesses the network. The second identifier is calculated by the network device using the first identifier in combination with a preset algorithm.

15. A network device, characterized in that, include: A first communication interface and a first processor; wherein... The first communication interface is used to receive a first registration request sent when the first RFID tag first accesses the target network; the first registration request includes a first identifier; the network device is a core network element; the target network is a cellular network; the first identifier is stored in the Electronic Product Code (EPC) storage area of ​​the first RFID tag; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code; The first processor is configured to perform identity authentication on the first RFID tag based on the first identifier to obtain a first authentication result; if the first authentication result indicates that the first RFID tag has passed identity authentication and the first RFID tag is valid according to the subscription information corresponding to the first RFID tag, the processor determines a first hash parameter and a second identifier; the first hash parameter and the second identifier are used for identity authentication when the first RFID tag subsequently accesses the target network; the second identifier is calculated by the network device using the first identifier in combination with a preset algorithm. The first communication interface is also used to send the first hash parameter and the second identifier to the first RFID tag.

16. An RFID tag, characterized in that, include: A second communication interface and a second processor; wherein... The second communication interface is used for: Upon initial access to the target network, a first identifier is obtained from the EPC storage area, and a first registration request is sent to the network side; the first registration request includes the first identifier; the network side is a core network element; the target network is a cellular network; the first identifier is stored in the Electronic Product Code (EPC) storage area of ​​the first RFID tag; the first identifier is used by the network side to authenticate the RFID tag and obtain a first authentication result; the first identifier includes at least the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, the tag type allocation code, and a verification code; the verification code is obtained using the tag chip manufacturer code, the tag antenna manufacturer code, the tag final packaging manufacturer code, and the tag type allocation code; When the first authentication result indicates that the RFID tag has passed identity authentication, and the RFID tag is determined to be valid by the network side based on the subscription information corresponding to the RFID tag, the network side receives the first hash parameter and the second identifier; the first hash parameter and the second identifier are used for identity authentication of the RFID tag when it subsequently accesses the network; the second identifier is calculated by the network device using the first identifier in combination with a preset algorithm.

17. A network device, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 7.

18. An RFID tag, characterized in that, include: A second processor and a second memory for storing computer programs that can run on the processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method according to any one of claims 8 to 12.

19. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7, or the steps of the method according to any one of claims 8 to 12.

Images