Security authentication method and device for terminal under open loop transmission, electronic equipment and medium
By using anchor nodes to perform initial authentication instead of the core network, the resource consumption and latency issues caused by multiple interactions between terminal devices in an open-loop network are resolved, achieving efficient security authentication and rapid service delivery.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2023-03-13
- Publication Date
- 2026-07-24
Smart Images
Figure CN116390088B_ABST
Abstract
Description
Technical Field
[0001] This application relates to communication processing technology, and in particular to a secure authentication method, apparatus, electronic device, and medium for a terminal under open-loop transmission. Background Technology
[0002] Compared to traditional closed-loop communication, proactive open-loop networks eliminate all direct control signaling interactions, thereby achieving extreme reduction in network latency and better supporting services in 5G and 6G vertical industries.
[0003] In order to better utilize active open-loop networks, security authentication processes such as identity verification and authorization are inevitably required when terminal devices connect to the network. However, existing solutions require multiple interactions between the terminal device, base station, and core network for this process. Furthermore, the device can only obtain the corresponding service after a series of security processes, including authentication and key negotiation, which consumes network resources. Summary of the Invention
[0004] This application provides a method, apparatus, electronic device, and medium for secure authentication of terminals under open-loop transmission. This solves the problem in related technologies where traditional terminal authentication processes are resource-intensive.
[0005] According to one aspect of the embodiments of this application, a secure authentication method for a terminal under open-loop transmission is provided, comprising:
[0006] The terminal device sends an initial authentication request to the anchor node, the initial authentication request including the terminal device ID and the authentication vector;
[0007] After the anchor node successfully authenticates the access request message, it sends an initial authentication response to the terminal device; and sends a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector.
[0008] After the terminal device receives the initial authentication response information, it sends service data to the anchor node; and after the core network authenticates the target authentication request, it sends a first notification message to the anchor node to inform the terminal device that it is allowed to access the network.
[0009] Optionally, in another embodiment based on the method described above in this application, before the terminal device sends the initial authentication request to the anchor node, the method further includes:
[0010] The terminal device sends an access request to the anchor node. The access request includes the terminal device's public key, the terminal device's preamble ID, and the access node ID. The access node is a node device associated with the anchor node and used to forward messages to the terminal device.
[0011] After receiving the access request, the anchor node sends a reply message to the terminal device. The reply message includes the anchor node's public key and the terminal preamble ID.
[0012] After the terminal device determines that the reply message points to itself based on the terminal preamble ID, it encrypts the initial authentication request using the anchor node public key and signs it using the terminal device's private key.
[0013] The terminal device sends the encrypted and signed initial authentication request to the anchor node.
[0014] Optionally, in another embodiment based on the method described above in this application, after the terminal device sends the encrypted and signed initial authentication request to the anchor node, the method further includes:
[0015] The anchor node verifies the signature of the initial authentication request using the public key of the terminal device;
[0016] After confirming that the signature is valid, the encrypted initial authentication request is decrypted using the private key of the anchor node to obtain the terminal device ID and authentication vector included in the initial authentication request.
[0017] The authentication vector includes a random number and an authentication token.
[0018] Optionally, in another embodiment based on the method described above in this application, after the anchor node sends the initial authentication response information to the terminal device, the method further includes:
[0019] The terminal device uses the public key of the anchor node to verify the signature of the initial authentication response information;
[0020] If the terminal device determines that the signature is valid, it decrypts the initial authentication response message using its private key and then sends the service data to the anchor node.
[0021] Optionally, in another embodiment based on the method described above in this application, after the terminal device sends service data to the anchor node, the method further includes:
[0022] The anchor node directly initiates service to the terminal device based on the service data;
[0023] or,
[0024] The anchor node detects whether it has received a first notification message from the core network that informs the terminal device that it is allowed to access the network;
[0025] If received, the service to the terminal device is initiated based on the service data;
[0026] If not received, the service for the terminal device will be started after the first notification message is confirmed to have been received.
[0027] Optionally, in another embodiment based on the method described above in this application, after the anchor node sends the target authentication request to the core network, the method further includes:
[0028] When the core network fails to authenticate the target authentication request, it sends a rejection message to the anchor node to inform the terminal device that it is not allowed to access the network.
[0029] Optionally, in another embodiment based on the method described above in this application, after the core network sends a rejection message to the anchor node to inform that the terminal device is not allowed to access the network, the method further includes:
[0030] The anchor node detects whether it has received service data sent by the terminal device;
[0031] If received, discard the service data and shut down the service to the terminal device; and send a second notification message to the terminal device to inform it of the re-authentication request.
[0032] According to another aspect of the embodiments of this application, a security authentication device for a terminal under open-loop transmission is provided, comprising:
[0033] The sending module is configured to send an initial authentication request from the terminal device to the anchor node, the initial authentication request including the terminal device ID and the authentication vector;
[0034] The authentication module is configured to send initial authentication response information to the terminal device after the anchor node authenticates the access request message; and to send a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector.
[0035] The notification module is configured to send service data to the anchor node after the terminal device receives the initial authentication response information; and to send a first notification message to the anchor node to inform the terminal device that it is allowed to access the network after the core network authenticates the target authentication request.
[0036] According to another aspect of the embodiments of this application, an electronic device is provided, comprising:
[0037] Memory, used to store executable instructions; and
[0038] A display is used to execute the executable instructions with the memory to complete the operation of any of the above-described open-loop transmission terminal security authentication methods.
[0039] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided for storing computer-readable instructions, which, when executed, perform the operation of any of the above-described open-loop transmission terminal security authentication methods.
[0040] In this application, the terminal device sends an initial authentication request to the anchor node, the initial authentication request including the terminal device ID and authentication vector; after the anchor node authenticates the access request message, it sends initial authentication response information to the terminal device; and sends a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector; after the terminal device receives the initial authentication response information, it sends service data to the anchor node; and after the core network authenticates the target authentication request, it sends a first notification message to the anchor node to inform it that the terminal device is allowed to access the network.
[0041] By applying the technical solution of this application, the anchor node can perform initial security authentication of the terminal device instead of the core network, followed by a simple secondary authentication by the core network. This saves processing resources from the core network. Furthermore, the terminal device's service can be started before the core network performs secondary authentication, reducing the terminal's service waiting time and compressing the latency from network device access to service availability while ensuring security authentication functionality.
[0042] The technical solution of this application will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0043] The accompanying drawings, which form part of this specification, illustrate embodiments of this application and, together with the description, serve to explain the principles of this application.
[0044] This application can be more clearly understood with reference to the accompanying drawings and the following detailed description, wherein:
[0045] Figure 1 This is a schematic diagram of a terminal security authentication method under open-loop transmission proposed in this application;
[0046] Figure 2 This is a flowchart illustrating a secure authentication method for a terminal under open-loop transmission proposed in this application.
[0047] Figure 3 This is a schematic diagram of an open-loop network architecture proposed in this application;
[0048] Figure 4 This is a schematic diagram illustrating the process of terminal device synchronizing with the network and exchanging public keys with the anchor node in a terminal security authentication method under open-loop transmission proposed in this application.
[0049] Figure 5 This is a schematic diagram of the electronic device proposed in this application;
[0050] Figure 6 This is a schematic diagram of the electronic device proposed in this application. Detailed Implementation
[0051] Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values of the components and steps set forth in these embodiments do not limit the scope of the present application.
[0052] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.
[0053] The following description of at least one exemplary embodiment is merely illustrative and is not intended to limit the scope of this application or its application or use.
[0054] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.
[0055] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.
[0056] Furthermore, the technical solutions of the various embodiments of this application can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by this application.
[0057] It should be noted that all directional indicators (such as up, down, left, right, front, back, etc.) in the embodiments of this application are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicator will also change accordingly.
[0058] The following is combined Figures 1-4This application describes a secure authentication method for a terminal in open-loop transmission according to exemplary embodiments thereof. It should be noted that the following application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way. Rather, the embodiments of this application can be applied to any applicable scenario.
[0059] This application also proposes a secure authentication method, apparatus, electronic device, and medium for terminals under open-loop transmission.
[0060] Figure 1 A schematic flowchart illustrating a secure authentication method for a terminal under open-loop transmission according to an embodiment of this application is shown. Figure 1 As shown, this method is applied to base station equipment and includes:
[0061] S101, the terminal device sends an initial authentication request to the anchor node. The initial authentication request includes the terminal device ID and the authentication vector.
[0062] S102, after the anchor node successfully authenticates the access request message, it sends an initial authentication response message to the terminal device; and sends a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector.
[0063] S103, after the terminal device receives the initial authentication response information, it sends service data to the anchor node; and after the core network authenticates the target authentication request, it sends a first notification message to the anchor node to inform the terminal device that it is allowed to access the network.
[0064] In related technologies, with the development of 5G and 6G and the emergence of new industrial applications, the demands on network communication performance will become even more stringent. In view of the network evolution trend indicated by URLLC and xURLLC, an active network based on open-loop transmission has been proposed to provide ultra-low latency and high reliability communication.
[0065] Compared to traditional closed-loop communication, proactive open-loop networks eliminate all direct control signaling interactions, thereby achieving extreme reduction in network latency and better supporting services in 5G and 6G vertical fields.
[0066] As can be seen from the above, since active open-loop networks need to compress the control links between the network terminal devices and the network to the extreme, the terminal devices inevitably need to undergo security authentication processes such as identity authentication and authorization during the network access process.
[0067] However, for the terminal network access authentication process in the existing technology, the existing security authentication process requires multiple interactions and feedback between the device, the base station, and the core network. The device can only obtain the corresponding service after a series of security processes such as authentication and key negotiation are completed, and there is a lack of specific consideration for extreme latency.
[0068] To address the aforementioned problems, this application proposes a secure authentication method for terminals under open-loop transmission. This method is applicable not only to secure access authentication of terminal devices in scenarios with extreme latency requirements, such as open-loop active networks, but also reduces the interaction and feedback between the terminal device and the core network during the authentication process. This allows some authentication processes to run concurrently with service processes, thereby reducing the latency from network access to service usage and providing services to the device as quickly as possible to meet the needs of extreme latency scenarios.
[0069] In one embodiment, the anchor node can be a device that manages a certain number of access nodes. For example, the anchor node can be a management base station or a management server, etc.
[0070] Furthermore, vertical industry applications relying on URLLC, such as autonomous driving and intelligent factories, place increasingly higher demands on reliability and latency. To adapt to the evolution of URLLC / enhanced URLLC standards and proactively consider extreme latency communication scenarios, an active network based on open-loop communication has been proposed. Open-loop active networks differ significantly from traditional closed-loop communication; they discard complex feedback mechanisms and control signaling between users and the network, greatly reducing transmission latency.
[0071] like Figure 3 As shown, the open-loop network in this embodiment of the application can be a wireless access part consisting of one or more access nodes (e.g., access base stations) APs and anchor nodes ANs that manage APs.
[0072] The anchor node (AN) has certain computing and storage capabilities to manage the access network and is directly connected to the core network. Each AN manages numerous access points (APs) within a certain range. When a user is within the network service range, multiple APs form a virtual cell around the user and use CoMP technology to collaboratively provide services.
[0073] Understandably, in the uplink of an open-loop network, every transmission from a single user to any access point (AP) uses open-loop communication, meaning no feedback acknowledgment is performed to minimize communication latency. By achieving spatial diversity reception through multipath transmission and appropriately utilizing multi-link integrated decoding technology, reliable transmission can be guaranteed.
[0074] In the downlink of an open-loop network, the AN allocates multiple APs and radio resources to users under the instructions of fog computing / edge computing. It then sends packets to the APs associated with the virtual cell via open-loop communication, and finally to the users. Furthermore, open-loop active networks, by combining anticipated mobility management techniques, user detection, and other technologies, make them a highly promising new type of URLLC network.
[0075] In addition, the authentication of terminal devices is a process of mutual identification between the network and the terminal device. Its security goal is to verify the identity of the device performing management and related activities on the network device or communication link.
[0076] Authentication serves two purposes: verifying identity and ensuring non-repudiation. At the protocol and algorithm level, 5G identity authentication employs a challenge-response mechanism. The authenticator sends a challenge—typically a random number—to the authenticated party. The authenticated party, using a shared long-term key K, calculates a response based on the information contained in the challenge and sends it back to the authenticator. (Only the party possessing the key can correctly calculate the response). 5G EPA-AKA utilizes this long-term key for two-way authentication between the terminal and the network, further leveraging the challenge-response mechanism.
[0077] Furthermore, the public key proposed in this application embodiment can be an IBC public key. IBC is an identity-based cryptographic system, which is an asymmetric public-key cryptosystem.
[0078] Understandably, each user in this system has a pair of associated public and private keys. The user's identity identifiers, such as device ID, IP address, and mobile phone number, are sent as the public key to the key generation center. The key generation center generates the corresponding user's private key using the SM9 algorithm, sends it to the relevant user, and the user keeps it. During authentication, both users exchange public keys, encrypt the message using the other party's public key, and sign it with their own private key before sending it. Upon receiving, the signature is verified using the other party's public key, and the message is decrypted using the user's own private key. In other words, the IBC cryptographic system standard is mainly represented by the IBE encryption / decryption algorithm set and the IBS signature algorithm set. Specifically, it includes:
[0079] ①Identification of cryptographic encryption and decryption systems
[0080] It consists of four parts: a system parameter generation (Setup) algorithm, a key generation (Extract) algorithm, an encryption (Encrypt) algorithm, and a decryption (Decrypt) algorithm. The steps are described below:
[0081] Setup: Given a security parameter k, output the system parameters params and the master key MasterKey. The system parameters params are public, while the master key MasterKey is known only to the key generation center.
[0082] Extract: Returns the private key PrivateKeyID using params, MasterKey, and ID. ID is a string of arbitrary length, used as the public key for encryption, and PrivateKeyID is the private key used for decryption.
[0083] Encrypt: Encrypts plaintext M using params and public key ID to obtain ciphertext C, C = Encrypt(params, M, ID).
[0084] Decrypt: Decrypts the ciphertext C using params and the private key PrivateKeyID to obtain the plaintext Decpyt(params,C,PrivateKeyID)=M.
[0085] ②Identifying the cryptographic signature verification system
[0086] It consists of four algorithms: a system parameter generation (Setup) algorithm, a key generation (Extract) algorithm, a signature (Significant) algorithm, and a verification (Verify) algorithm. The algorithm descriptions are as follows:
[0087] Setup and Extract are the same as ① in the cryptographic encryption and decryption mechanism, referring to Setup and Extract.
[0088] Significant: Input the message M to be signed, the system public parameters, and the user's private key PrivateKeyID to generate a signature (R,S).
[0089] Verify: Input signature (R,S), system public parameters, and user identity (ID), and output the verification result.
[0090] Furthermore, the integrity protection proposed in this application is a technical means to ensure data consistency and prevent data from being tampered with by unauthorized users. Integrity refers to the user's ability to verify the accuracy of transmitted or received data and to ensure it is not altered in any way. A common method utilizes Message Authentication Codes (MACs): an authentication mechanism used by both communicating entities. A MAC is formed by processing a specified message using a key and a message authentication algorithm (encryption, hashing, etc.). Due to the uniqueness of the key, the MAC value can not only verify message integrity but also authenticate the identity of the communicating entities.
[0091] Furthermore, this application incorporates herein... Figure 2 The plan will be explained in detail:
[0092] Step 1: The terminal device sends an access request to the anchor node.
[0093] The access request includes the terminal device's public key, the terminal device's preamble ID, and the access node ID.
[0094] In one approach, after the terminal device starts running, it receives basic system messages from the anchor node, including synchronization signals.
[0095] In one approach, during message transmission with the terminal device, the anchor node can forward basic system messages to the terminal through dedicated channels of all access nodes it manages. Additionally, when forwarding basic system messages, the access node needs to add its own ID to the message; this ID can be pre-negotiated and assigned with the anchor node.
[0096] In one approach, the access node can be a base station device that is communicatively connected to both the terminal device and the anchor node. That is, during the information transmission process between the anchor node and the terminal device, the access node can act as an intermediary.
[0097] Furthermore, the terminal device synchronizes downlink time and channel frequency based on the received basic system messages, and sends an access request message containing parameters such as the terminal's public key and terminal ID to the anchor node through the corresponding access node.
[0098] Optionally, the terminal device may also include the ID of the selected access node in the access request message.
[0099] Step 2: After receiving the access request, the anchor node sends a reply message to the terminal device.
[0100] The reply message includes the anchor node's public key and the terminal preamble ID.
[0101] In one approach, such as Figure 4 As shown, the anchor node needs to respond to the access request message and send the anchor node's public key and the terminal preamble ID back to the terminal device through the dedicated channel of the corresponding access node.
[0102] Step 3: The terminal device sends an encrypted initial authentication request to the anchor node.
[0103] In one approach, after receiving a reply message, the terminal device uses the preamble ID to determine whether the reply message belongs to it, and then adjusts its response based on the uplink adjustment amount in the reply message to achieve uplink synchronization. In this case, the anchor node and the terminal device know each other's public keys and retain a unique private key.
[0104] It should be noted that in this embodiment, the key between the terminal and the anchor node can be based on the IBC (Identifier-Based Cryptography) technology. The public key can be in the form of device ID + random number and sent to the key generation center. The key generation center uses the SM9 identifier cryptography algorithm to calculate and generate the corresponding IBC private key and then returns it to the corresponding terminal and anchor node.
[0105] Furthermore, the terminal device encrypts and signs the initial authentication request before sending it to the anchor node via a dedicated channel of the access node. The initial authentication request must include the encrypted terminal device ID (SUCI) and the authentication vector (AV).
[0106] Specifically, the initial authentication request can be encrypted using the anchor node's public key and signed using the terminal device's private key. In one approach, the authentication vector AV can include a random number RAND and an authentication token AUTN. AUTN is generated by the AV generation function using a long-term key K, the random number RAND, and the sequence number SQN as input parameters, where AUTN = SQN||…||MAC.
[0107] Step 4: The anchor node uses the terminal device's public key to verify the signature of the initial authentication request. After the anchor node confirms that the signature is valid, it uses the anchor node's private key to decrypt the encrypted initial authentication request to obtain the terminal device ID and authentication vector included in the initial authentication request.
[0108] The authentication vector includes a random number and an authentication token.
[0109] In one approach, after receiving the initial authentication request, the anchor node can verify the signature using the terminal device's public key. Once the signature is verified, it can decrypt the signature using the anchor node's private key to obtain the terminal device ID (SUCI) and the authentication vector (AV).
[0110] Step 5: After the anchor node successfully authenticates the access request message, it sends an initial authentication response to the terminal device; and the anchor node sends a target authentication request to the core network. Then proceed to steps 6a and 6b.
[0111] The target authentication request includes the terminal device ID and the authentication vector.
[0112] In one approach, after the anchor node successfully authenticates the access request message, the anchor node can send initial authentication response information to the terminal device through the access node's dedicated channel.
[0113] Optionally, the anchor node can encrypt the message using the terminal device's public key and sign it with the anchor node's private key. The message includes a generated random number RAND*, which can be used as a symmetric key for data encryption between the anchor node and the terminal device.
[0114] In another approach, the anchor node can also send a target authentication request message to the core network. This target authentication request message includes SUCI and AV.
[0115] Step 6a: After the core network successfully authenticates the target authentication request, a first notification message is sent to the anchor node to inform the terminal device that it is allowed to access the network.
[0116] Understandably, if the core network fails to authenticate the target's authentication request, it sends a rejection message to the anchor node to inform the terminal device that it is not allowed to access the network.
[0117] Step 6b: The terminal device uses the anchor node's public key to verify the signature of the initial authentication response information, and if the terminal device determines that the signature is valid, it sends the service data to the anchor node.
[0118] Understandably, after the core network receives the target authentication request (i.e., receives SUCI and AV), it can decrypt SUCI into SUPI. Then, using the long-term key K, AUTN, and RAND as input parameters, it calculates XMAC through a preset function and compares it with the MAC in AUTN.
[0119] If the consistency is successful, the core network can perform a series of operations such as billing on the terminal device and send an authentication response to the anchor node, thereby providing business services to the terminal.
[0120] If consistency fails, the core network sends a rejection message to the anchor node, which then discards the received service data transmitted by the terminal and interrupts the service.
[0121] In addition, the anchor node can also forward a second notification message to the terminal device through the access node, which informs it that it needs to re-authenticate, so as to notify the terminal device to re-authenticate.
[0122] Step 7: The anchor node starts the business service for the terminal device based on the business data.
[0123] Initiating service activation on terminal devices includes two scenarios:
[0124] First scenario:
[0125] Directly initiate business services for terminal devices.
[0126] The second scenario:
[0127] The anchor node detects whether it has received the first notification message from the core network, which informs the terminal device that it is allowed to access the network;
[0128] If received, initiate business services for the terminal device based on the business data;
[0129] If not received, the service to the terminal device will be initiated after the first notification message has been received.
[0130] In this application, the terminal device sends an initial authentication request to the anchor node, the initial authentication request including the terminal device ID and authentication vector; after the anchor node authenticates the access request message, it sends initial authentication response information to the terminal device; and sends a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector; after the terminal device receives the initial authentication response information, it sends service data to the anchor node; and after the core network authenticates the target authentication request, it sends a first notification message to the anchor node to inform it that the terminal device is allowed to access the network.
[0131] By applying the technical solution of this application, the anchor node can perform initial security authentication of the terminal device instead of the core network, followed by a simple secondary authentication by the core network. This saves processing resources from the core network. Furthermore, the terminal device's service can be started before the core network performs secondary authentication, reducing the terminal's service waiting time and compressing the latency from network device access to service availability while ensuring security authentication functionality.
[0132] Optionally, in another embodiment based on the method described above in this application, before the terminal device sends the initial authentication request to the anchor node, the method further includes:
[0133] The terminal device sends an access request to the anchor node. The access request includes the terminal device's public key, the terminal device's preamble ID, and the access node ID. The access node is a node device associated with the anchor node and used to forward messages to the terminal device.
[0134] After receiving the access request, the anchor node sends a reply message to the terminal device. The reply message includes the anchor node's public key and the terminal preamble ID.
[0135] After the terminal device determines that the reply message points to itself based on the terminal preamble ID, it encrypts the initial authentication request using the anchor node public key and signs it using the terminal device's private key.
[0136] The terminal device sends an encrypted and signed initial authentication request to the anchor node.
[0137] Optionally, in another embodiment based on the method described above in this application, after the terminal device sends the encrypted and signed initial authentication request to the anchor node, the method further includes:
[0138] The anchor node verifies the signature of the initial authentication request using the public key of the terminal device;
[0139] After confirming that the signature is valid, the encrypted initial authentication request is decrypted using the private key of the anchor node to obtain the terminal device ID and authentication vector included in the initial authentication request.
[0140] The authentication vector includes a random number and an authentication token.
[0141] Optionally, in another embodiment based on the method described above in this application, after the anchor node sends the initial authentication response information to the terminal device, the method further includes:
[0142] The terminal device uses the public key of the anchor node to verify the signature of the initial authentication response information;
[0143] If the terminal device determines that the signature is valid, it decrypts the initial authentication response message using its private key and then sends the service data to the anchor node.
[0144] Optionally, in another embodiment based on the method described above in this application, after the terminal device sends service data to the anchor node, the method further includes:
[0145] The anchor node directly initiates service to the terminal device based on the service data;
[0146] or,
[0147] The anchor node detects whether it has received a first notification message from the core network that informs the terminal device that it is allowed to access the network;
[0148] If received, the service to the terminal device is initiated based on the service data;
[0149] If not received, the service for the terminal device will be started after the first notification message is confirmed to have been received.
[0150] Optionally, in another embodiment based on the method described above in this application, after the anchor node sends the target authentication request to the core network, the method further includes:
[0151] When the core network fails to authenticate the target authentication request, it sends a rejection message to the anchor node to inform the terminal device that it is not allowed to access the network.
[0152] Optionally, in another embodiment based on the method described above in this application, after the core network sends a rejection message to the anchor node to inform that the terminal device is not allowed to access the network, the method further includes:
[0153] The anchor node detects whether it has received service data sent by the terminal device;
[0154] If received, discard the service data and shut down the service to the terminal device; and send a second notification message to the terminal device to inform it of the re-authentication request.
[0155] As can be seen from the above, the embodiments of this application adopt a segmented authentication method. On one hand, low-complexity incomplete authentication is performed through anchor nodes to filter out most non-network users, while simultaneously providing services to authenticated terminals in real time. On the other hand, a high-complexity complete authentication process is executed in parallel with the core network. This not only significantly reduces the initial service access latency but also enables trusted device access and secure data transmission, strengthening the security protection capabilities of terminal devices.
[0156] In this application, the terminal device sends an initial authentication request to the anchor node, the initial authentication request including the terminal device ID and authentication vector; after the anchor node authenticates the access request message, it sends initial authentication response information to the terminal device; and sends a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector; after the terminal device receives the initial authentication response information, it sends service data to the anchor node; and after the core network authenticates the target authentication request, it sends a first notification message to the anchor node to inform it that the terminal device is allowed to access the network.
[0157] By applying the technical solution of this application, the anchor node can perform initial security authentication of the terminal device instead of the core network, followed by a simple secondary authentication by the core network. This saves processing resources from the core network. Furthermore, the terminal device's service can be started before the core network performs secondary authentication, reducing the terminal's service waiting time and compressing the latency from network device access to service availability while ensuring security authentication functionality.
[0158] Optionally, in another embodiment of this application, such as Figure 5 As shown, this application also provides a security authentication device for a terminal under open-loop transmission. It includes:
[0159] The sending module 201 is configured to send an initial authentication request from the terminal device to the anchor node, wherein the initial authentication request includes the terminal device ID and the authentication vector.
[0160] Authentication module 202 is configured to send initial authentication response information to the terminal device after the anchor node authenticates the access request message; and to send a target authentication request to the core network, the target authentication request including the terminal device ID and authentication vector.
[0161] The notification module 203 is configured to send service data to the anchor node after the terminal device receives the initial authentication response information; and to send a first notification message to the anchor node to inform the terminal device that it is allowed to access the network after the core network authenticates the target authentication request.
[0162] By applying the technical solution of this application, the anchor node can perform initial security authentication of the terminal device instead of the core network, followed by a simple secondary authentication by the core network. This saves processing resources from the core network. Furthermore, the terminal device's service can be started before the core network performs secondary authentication, reducing the terminal's service waiting time and compressing the latency from network device access to service availability while ensuring security authentication functionality.
[0163] In another embodiment of this application, the authentication module 202 is configured as follows:
[0164] The terminal device sends an access request to the anchor node. The access request includes the terminal device's public key, the terminal device's preamble ID, and the access node ID. The access node is a node device associated with the anchor node and used to forward messages to the terminal device.
[0165] After receiving the access request, the anchor node sends a reply message to the terminal device. The reply message includes the anchor node's public key and the terminal preamble ID.
[0166] After the terminal device determines that the reply message points to itself based on the terminal preamble ID, it encrypts the initial authentication request using the anchor node public key and signs it using the terminal device's private key.
[0167] The terminal device sends an encrypted and signed initial authentication request to the anchor node.
[0168] In another embodiment of this application, the authentication module 202 is configured as follows:
[0169] The anchor node verifies the signature of the initial authentication request using the public key of the terminal device;
[0170] After confirming that the signature is valid, the encrypted initial authentication request is decrypted using the private key of the anchor node to obtain the terminal device ID and authentication vector included in the initial authentication request.
[0171] The authentication vector includes a random number and an authentication token.
[0172] In another embodiment of this application, the authentication module 202 is configured as follows:
[0173] The terminal device verifies the signature of the initial authentication response information using the public key of the anchor node;
[0174] If the terminal device determines that the signature is valid, it decrypts the initial authentication response message using its private key and then sends the service data to the anchor node.
[0175] In another embodiment of this application, the authentication module 202 is configured as follows:
[0176] The anchor node directly initiates service to the terminal device based on the service data;
[0177] or,
[0178] The anchor node detects whether it has received a first notification message from the core network that informs the terminal device that it is allowed to access the network;
[0179] If received, the service to the terminal device is initiated based on the service data;
[0180] If not received, the service for the terminal device will be started after the first notification message is confirmed to have been received.
[0181] In another embodiment of this application, the authentication module 202 is configured as follows:
[0182] When the core network fails to authenticate the target authentication request, it sends a rejection message to the anchor node to inform the terminal device that it is not allowed to access the network.
[0183] In another embodiment of this application, the authentication module 202 is configured as follows:
[0184] The anchor node detects whether it has received service data sent by the terminal device;
[0185] If received, discard the service data and shut down the service to the terminal device; and send a second notification message to the terminal device to inform it of the re-authentication request.
[0186] Figure 6 This is a logical structure block diagram of an electronic device according to an exemplary embodiment. For example, electronic device 300 may be an electronic device.
[0187] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions, such as a memory including instructions, is also provided. These instructions can be executed by an electronic device processor to complete the aforementioned secure authentication method for a terminal under open-loop transmission. The method includes: a terminal device sending an initial authentication request to an anchor node, the initial authentication request including the terminal device ID and an authentication vector; after the anchor node authenticates the access request message, sending initial authentication response information to the terminal device; and sending a target authentication request to the core network, the target authentication request including the terminal device ID and an authentication vector; after the terminal device receives the initial authentication response information, sending service data to the anchor node; and after the core network authenticates the target authentication request, sending a first notification message to the anchor node informing it that the terminal device is allowed to access the network.
[0188] Optionally, the above instructions can also be executed by the processor of the electronic device to complete other steps involved in the exemplary embodiments described above. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.
[0189] In an exemplary embodiment, an application / computer program product is also provided, including one or more instructions that can be executed by a processor of an electronic device to complete the aforementioned secure authentication method for a terminal under open-loop transmission. The method includes: a terminal device sending an initial authentication request to an anchor node, the initial authentication request including the terminal device ID and an authentication vector; after the anchor node authenticates the access request message, sending initial authentication response information to the terminal device; and sending a target authentication request to the core network, the target authentication request including the terminal device ID and an authentication vector; after the terminal device receives the initial authentication response information, sending service data to the anchor node; and after the core network authenticates the target authentication request, sending a first notification message to the anchor node to inform the terminal device that it is allowed to access the network.
[0190] Alternatively, the above instructions may also be executed by the processor of the electronic device to complete other steps involved in the above exemplary embodiments.
[0191] Figure 6 This is an example diagram of an electronic device 300. Those skilled in the art will understand that it is illustrative. Figure 6 This is merely an example of electronic device 300 and does not constitute a limitation on electronic device 300. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device 300 may also include input / output devices, network access devices, buses, etc.
[0192] The processor 302 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or processor 302 can be any conventional processor. Processor 302 is the control center of electronic device 300, connecting all parts of electronic device 300 via various interfaces and lines.
[0193] The memory 301 can be used to store computer-readable instructions 303. The processor 302 implements various functions of the electronic device 300 by running or executing the computer-readable instructions or modules stored in the memory 301 and calling the data stored in the memory 301. The memory 301 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 300, etc. In addition, the memory 301 may include a hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, read-only memory (ROM), random access memory (RAM), or other non-volatile / volatile storage devices.
[0194] If the modules integrated in the electronic device 300 are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by instructing related hardware through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when executed by a processor, the computer-readable instructions can implement the steps of the various method embodiments described above.
[0195] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0196] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A secure authentication method for a terminal under open-loop transmission, characterized in that, include: The terminal device sends an initial authentication request to the anchor node, the initial authentication request including the terminal device ID and the authentication vector; After the initial authentication request is successfully completed at the anchor node, an initial authentication response message is sent to the terminal device. In addition, a target authentication request is sent to the core network, the target authentication request including the terminal device ID and the authentication vector; After the terminal device receives the initial authentication response information, it sends service data to the anchor node; and after the core network authenticates the target authentication request, it sends a first notification message to the anchor node to inform the terminal device that it is allowed to access the network. Before the terminal device sends the initial authentication request to the anchor node, the following is also included: The initial authentication request is encrypted using the anchor node's public key and signed using the terminal device's private key; The terminal device sends the encrypted and signed initial authentication request to the anchor node.
2. The method as described in claim 1, characterized in that, Before the terminal device sends the initial authentication request to the anchor node, the following is also included: The terminal device sends an access request to the anchor node. The access request includes the terminal device's public key, the terminal device's preamble ID, and the access node ID. The access node is a node device associated with the anchor node and used to forward messages to the terminal device. After receiving the access request, the anchor node sends a reply message to the terminal device. The reply message includes the anchor node's public key and the terminal preamble ID. After the terminal device determines that the reply message points to itself based on the terminal preamble ID, it encrypts the initial authentication request using the anchor node public key and signs it using the terminal device's private key.
3. The method as described in claim 2, characterized in that, After the terminal device sends the encrypted and signed initial authentication request to the anchor node, the method further includes: The anchor node verifies the signature of the initial authentication request using the public key of the terminal device; After confirming that the signature is valid, the encrypted initial authentication request is decrypted using the private key of the anchor node to obtain the terminal device ID and authentication vector included in the initial authentication request. The authentication vector includes a random number and an authentication token.
4. The method as described in claim 1, characterized in that, After the anchor node sends the initial authentication response information to the terminal device, the method further includes: The terminal device verifies the signature of the initial authentication response information using the public key of the anchor node; If the terminal device determines that the signature is successful, it decrypts the initial authentication response information using its private key and then sends the service data to the anchor node.
5. The method as described in claim 4, characterized in that, After the terminal device sends service data to the anchor node, the method further includes: The anchor node directly initiates service to the terminal device based on the service data; or, The anchor node detects whether it has received a first notification message from the core network that informs the terminal device that it is allowed to access the network; If received, the service to the terminal device is initiated based on the service data; If not received, the service for the terminal device will be started after the first notification message is confirmed to have been received.
6. The method as described in claim 1, characterized in that, After the anchor node sends the target authentication request to the core network, the following is also included: When the core network fails to authenticate the target authentication request, it sends a rejection message to the anchor node to inform the terminal device that it is not allowed to access the network.
7. The method as described in claim 6, characterized in that, After the core network sends a rejection message to the anchor node to inform it that the terminal device is not allowed to access the network, the following steps are also included: The anchor node detects whether it has received service data sent by the terminal device; If received, discard the service data and shut down the service to the terminal device; and send a second notification message to the terminal device to inform it of the re-authentication request.
8. A security authentication device for a terminal under open-loop transmission, characterized in that, include: The sending module is configured to send an initial authentication request from the terminal device to the anchor node, the initial authentication request including the terminal device ID and the authentication vector; The authentication module is configured to send initial authentication response information to the terminal device after the initial authentication request is successfully made at the anchor node; In addition, a target authentication request is sent to the core network, the target authentication request including the terminal device ID and the authentication vector; The notification module is configured to send service data to the anchor node after the terminal device receives the initial authentication response information; and to send a first notification message to the anchor node to inform the terminal device that it is allowed to access the network after the core network authenticates the target authentication request. The device is also configured to: Before the terminal device sends the initial authentication request to the anchor node, the initial authentication request is encrypted using the anchor node's public key and signed using the terminal device's private key; The terminal device sends the encrypted and signed initial authentication request to the anchor node.
9. An electronic device, characterized in that, include: Memory, used to store executable instructions; as well as, A processor, configured to execute the executable instructions with the memory to perform the operation of the secure authentication method for the terminal under open-loop transmission as described in any one of claims 1-7.
10. A computer-readable storage medium for storing computer-readable instructions, characterized in that, When the instruction is executed, it performs the operation of the security authentication method for the terminal under open-loop transmission as described in any of claims 1-7.