Edge node access processing method and apparatus, mobile terminal and edge node

Abstract

The application relates to an edge node access processing method and device, a mobile terminal and an edge node, wherein when a mobile terminal considers that edge node switching is needed, the terminal and an accessed edge node generate summary information based on a same preset summary method and exchange the summary information, and respectively send own certificate and the exchanged summary information to a second edge node; the second edge node processes the certificate of the mobile terminal and the certificate of the first edge node by using the preset summary method, and respectively performs consistency verification on the processing results; if the authentication is passed, it indicates that the mobile terminal and the first edge node trust each other; the second edge node is authenticated; after the authentication is passed, the second edge node synchronizes service data with the mobile terminal and the first edge node; after the service data synchronization is completed, the mobile terminal accesses the edge node for switching, and switches to the second edge node; through the association authentication, the security is improved.

Description

[0001] Note: This application is a divisional application filed in response to the parent application with application number "2022103582916", application date "2022-04-07", and invention title "Edge Node Access Processing Method, Mobile Terminal and Edge Node". Technical Field

[0002] This application relates to the field of mobile device edge node access switching control technology, and in particular to an edge node access processing method, device, mobile terminal and edge node. Background Technology

[0003] Mobile healthcare refers to the provision of medical services and information through the use of mobile communication technologies. To ensure low latency and high network reliability, mobile terminals typically connect to nearby edge computing nodes and obtain services through applications hosted on those nodes.

[0004] Currently, mobile terminals often use application-layer communication protocols such as HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) for security authentication when obtaining services from applications. This typically involves a one-to-one authentication process between the mobile terminal and the application on the edge node. Consequently, when a mobile terminal switches between different edge nodes during movement, two independent authentication processes are required. Since these two authentication processes are independent, it cannot guarantee that the switching process will not be compromised by man-in-the-middle attacks that could leak mobile terminal data and business data, resulting in low security and reliability. Summary of the Invention

[0005] Therefore, it is necessary to provide an edge node access processing method, device, mobile terminal, and edge node that improves the security of edge node access switching through associated authentication to address the above-mentioned technical problems.

[0006] In a first aspect, embodiments of this application provide an edge node access processing method applied to a second edge node, the method comprising:

[0007] When the mobile terminal needs to switch edge nodes, it receives the certificate and first digest information of the first edge node sent by the first edge node, and receives the certificate and second digest information of the mobile terminal sent by the mobile terminal.

[0008] The first digest information is formed by processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed by processing the certificate of the first edge node based on a preset digest method.

[0009] The certificates of the mobile terminal and the first edge node are processed using a preset digest method.

[0010] The consistency of the processing result of the certificate of the mobile terminal and the first digest information sent by the first edge node, and the consistency of the processing result of the certificate of the first edge node and the second digest information sent by the mobile terminal are compared respectively. If they are consistent, the mobile terminal and the first edge node are determined to be trusted nodes. The third digest information and the certificate of the second edge node are fed back to the trusted node. The third digest information is formed after processing the certificate of the second edge node based on the preset digest method.

[0011] If the second edge node is a trusted node of both the mobile terminal and the first edge node, then business data synchronization is performed.

[0012] After the business data synchronization is completed, the mobile terminal is accessed, and the access edge of the mobile terminal is switched from the first edge node to the second edge node.

[0013] Secondly, embodiments of this application also provide an edge node access processing method applied to a mobile terminal, the method comprising:

[0014] When a mobile terminal needs to switch edge nodes, it sends a first digest information to a first edge node and receives a second digest information sent by the first edge node. The first digest information is formed after processing the mobile terminal's certificate based on a preset digest method, and the second digest information is formed after processing the first edge node's certificate based on a preset digest method.

[0015] Send the mobile terminal's certificate and second digest information to the second edge node; the second edge node is the edge node to which the mobile terminal is to access.

[0016] Receive the third digest information and the certificate of the second edge node fed back by the second edge node; wherein, the third digest information is formed after processing the certificate of the second edge node based on a preset digest method;

[0017] The certificate of the second edge node is processed using a preset digest method;

[0018] If the second edge node is determined to be a trusted node of the mobile terminal based on the processing result of the certificate of the second edge node and the third digest information, then business data synchronization is performed, and the access edge is switched from the first edge node to the second edge node.

[0019] Thirdly, this application also provides an edge node access processing method, applied to a first edge node, the method comprising:

[0020] When the mobile terminal needs to switch edge nodes, it receives the first digest information sent by the mobile terminal and sends the second digest information to the mobile terminal; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on a preset digest method.

[0021] Send the certificate and first digest information of the first edge node to the second edge node;

[0022] Receive the third digest information and the certificate of the second edge node fed back by the second edge node; wherein, the third digest information is formed after processing the certificate of the second edge node based on a preset digest method;

[0023] The certificate of the second edge node is processed using a preset digest method;

[0024] If the second edge node is determined to be a trusted node of the first edge node based on the processing result of the certificate of the second edge node and the third digest information, then business data synchronization is performed, so that the mobile terminal can switch the access edge from the first edge node to the second edge node after the business data synchronization is completed.

[0025] Fourthly, embodiments of this application provide an edge node access processing device applied to a mobile terminal, the device comprising:

[0026] The terminal-side digest information interaction module is used to send first digest information to the first edge node and receive second digest information sent by the first edge node when the mobile terminal needs to switch edge nodes; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on a preset digest method.

[0027] The terminal-side first information sending module is used to send the mobile terminal's certificate and second digest information to the second edge node; the second edge node is the edge node to which the mobile terminal is to access.

[0028] The terminal-side first information receiving module is used to receive the third digest information fed back by the second edge node and the certificate of the second edge node; wherein, the third digest information is formed after processing the certificate of the second edge node based on a preset digest method;

[0029] The terminal-side first security verification module is used to process the certificate of the second edge node using a preset digest method;

[0030] The terminal-side switching execution module is used to perform business data synchronization and switch the access edge from the first edge node to the second edge node if the second edge node is determined to be a trusted node of the mobile terminal based on the processing result of the certificate of the second edge node and the third digest information.

[0031] Fifthly, embodiments of this application provide a mobile terminal, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the above-described edge node access processing method applied on the mobile terminal side.

[0032] Sixthly, embodiments of this application also provide a mobile terminal access edge switching system, including the aforementioned mobile terminal, a first edge node, and a second edge node;

[0033] The first edge node includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described edge node access processing method.

[0034] The second edge node includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned edge node access processing method.

[0035] In this edge node access processing method, when the mobile terminal deems an edge node switch necessary—for example, when the distance between the mobile terminal and the first edge node exceeds a threshold during movement—communication stability with the first edge node is considered to be under pressure. In this case, a directional communication connection needs to be established with a closer second edge node. When the mobile terminal needs to switch edge nodes, both the mobile terminal and the first edge node generate and exchange digest information based on the same preset digest method. Each then sends its own certificate and the previously exchanged digest information to the second edge node. The second edge node processes the certificates of both the mobile terminal and the first edge node using the preset digest method. Based on the processing result and the first and second digest information, it determines whether the mobile terminal and the first edge node are trusted nodes. If they are trusted, the second edge node sends back the generated third digest information and its own certificate for authentication. If both the mobile terminal and the first edge node authenticate the second edge node as a trusted node, the bidirectional authentication between the second edge node and the mobile terminal and the first edge node is successful. At this point, business data synchronization can be performed, and the access edge node switch can be initiated, allowing the second edge node to access the mobile terminal.

[0036] The process of the second edge node authenticating the mobile terminal and the first edge node as trusted nodes can be as follows: If the digest information obtained by the second edge node after processing the certificate of the mobile terminal using a preset digest method is consistent with the digest information received from the first edge node, it means that the mobile terminal is a terminal worthy of trust by the first edge node and has not been impersonated. Similarly, the digest information obtained by the second edge node after processing the certificate of the first edge node sent by the first edge node using a preset digest method is compared with the second digest information received from the mobile terminal. If they are consistent, it means that the first edge node is a node trusted by the mobile terminal. At this time, the second edge node confirms that the mobile terminal is a mobile terminal authenticated by the first edge node, and the first edge node is also a first edge node authenticated by the mobile terminal. It has not been impersonated and is safe and reliable. The second edge node can then perform authentication before business data synchronization. After authenticating that it is a trustworthy second edge node based on the information fed back by the second edge node, the second edge node can synchronize business data with the mobile terminal and the first edge node. When the business data synchronization is completed, the second edge node connects to the mobile terminal, and the mobile terminal disconnects from the first edge node, realizing the switching of access edge. By using associated authentication, data leakage can be avoided, thereby improving data security during the edge node switching process. Attached Figure Description

[0037] Figure 1 This is an application environment diagram of an edge node access processing method in one embodiment;

[0038] Figure 2 This is a flowchart illustrating the edge node access processing method executed on the second edge node side in one embodiment;

[0039] Figure 3 This is a flowchart illustrating the edge node access processing method executed on the second edge node side in another embodiment;

[0040] Figure 4 This is a schematic diagram of the message structure for a mobile terminal and a first edge node to send a message to a second edge node in one embodiment.

[0041] Figure 5 This is a schematic diagram of the message structure for a second edge node to send messages to a mobile terminal and a first edge node in one embodiment.

[0042] Figure 6 This is a flowchart illustrating an edge node access processing method executed on the mobile terminal side in one embodiment.

[0043] Figure 7 This is a flowchart illustrating the edge node access processing method executed on the mobile terminal side in another embodiment;

[0044] Figure 8This is a flowchart illustrating the edge node access processing method executed on the first edge node side in one embodiment;

[0045] Figure 9 This is a flowchart illustrating the edge node access processing method executed on the first edge node side in another embodiment;

[0046] Figure 10a This is a timing diagram of an edge node access processing method for a mobile terminal (terminal A in the figure), a first edge node (edge ​​node B in the figure), and a second edge node (edge ​​node C in the figure) in one embodiment.

[0047] Figure 10b for Figure 10a A timeline of the negotiation phase;

[0048] Figure 10c for Figure 10a Timing diagram of the switching phase;

[0049] Figure 11 This is a structural block diagram of an edge node access processing device applied on the second edge node side in one embodiment;

[0050] Figure 12 This is a structural block diagram of an edge node access processing device applied on the mobile terminal side in one embodiment;

[0051] Figure 13 This is a structural block diagram of an edge node access processing device applied to the first edge node side in one embodiment.

[0052] Figure 14 Here is an internal structure diagram of an edge node in one embodiment;

[0053] Figure 15 This is an internal structure diagram of a mobile terminal in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] It is understood that the terms "first," "second," etc., used in this application may be used to describe various elements, data, and other features, such as first message and second message, but their order is not limited by these terms. These terms are only used to distinguish one piece of data from another, such as the first message and second message described in the following embodiments, and are intended to distinguish the first message and the second message, but do not limit the order of their corresponding steps.

[0056] It should be understood that the terms "comprising / including" or "having," etc., specify the presence of the stated features, wholes, steps, operations, components, parts, or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof. Meanwhile, the term "and / or" as used in this specification includes any and all combinations of the associated listed items.

[0057] The edge node access processing method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, mobile terminal 102 communicates with the first edge node 104 via a network. As mobile terminal 102 moves, it gradually moves away from the first edge node 104 and closer to the second edge node 106. To ensure network stability, the accessed edge node needs to be switched from the first edge node 104 to the second edge node 106. Mobile terminal 102 can be, but is not limited to, various mobile medical devices, handheld medical devices, wearable medical devices, etc., that can move with the user or move autonomously. Portable wearable medical devices can be health monitoring watches, health monitoring bracelets, etc. Edge nodes 104 and 106 can be implemented as edge gateways, edge controllers, edge servers, etc.

[0058] In one embodiment, such as Figure 2 As shown, an edge node access processing method is provided, which is applied to... Figure 1 Taking the second edge node 106 as an example, the explanation includes the following steps:

[0059] SC20: When the mobile terminal needs to switch edge nodes, it receives the certificate and first digest information of the first edge node sent by the first edge node, and receives the certificate and second digest information of the mobile terminal sent by the mobile terminal; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on a preset digest method.

[0060] In this context, the need for a mobile terminal to switch edge nodes refers to a situation where the mobile terminal deems the communication stability with the first edge node under threat. To ensure the stability of the mobile terminal's network service during business processing, the mobile terminal deems it necessary to switch to another edge node. When a mobile terminal deems an edge node switch necessary, it first exchanges digest information generated by both the mobile terminal and the first edge node using the same preset digest method for subsequent association authentication. Subsequently, the second edge node receives the mobile terminal's certificate and the second digest information generated and sent to the mobile terminal by the first edge node. The second edge node also receives the first digest information sent to the first edge node by the mobile terminal, along with the first edge node's certificate. The first edge node refers to the edge node to which the mobile terminal has already connected; this connection means a directed connection has been established, and the mobile terminal hosts its applications on that edge node. Edge node switching refers to switching from directed communication with one edge node to directed communication with another edge node, and enabling switching between applications hosted on the edge nodes.

[0061] The preset digest method can be a digest method pre-agreed between the mobile terminal and the edge node, or it can be generated by one communication object and sent to other communication objects. For example, it can be generated by the mobile terminal and sent to the edge node it communicates with. The digest method is a method used to generate digest information for security verification. Digest information refers to information used for security authentication, obtained after processing based on the rules reflected by the digest method. For example, it can be digest information obtained by processing a certificate using the preset digest method, and can be used to verify whether the intermediate content has been tampered with.

[0062] SC40: A preset digest method is used to process the certificates of the mobile terminal and the first edge node respectively;

[0063] SC60: If, based on the processing result, the first digest information sent by the first edge node, and the second digest information sent by the mobile terminal, it is determined that both the mobile terminal and the first edge node are trusted nodes, then the third digest information and the certificate of the second edge node are fed back to the aforementioned trusted node. The third digest information is formed after processing the certificate of the second edge node based on a preset digest method.

[0064] The determination of whether a node is trusted can be achieved by comparing the processing result obtained after processing the mobile terminal's certificate using a preset digest method with the first digest information sent by the first edge node. If they match, it means that the mobile terminal is the same mobile terminal that originally interacted with the first edge node, that is, the mobile terminal is a mobile terminal trusted by the first edge node and has not been impersonated. At this time, the third digest information generated by the second edge node is fed back to the mobile terminal, which facilitates the mobile terminal to authenticate the security of its interaction object, the second edge node, and provides a security guarantee for subsequent business data synchronization.

[0065] Similar to the security authentication principle of the second edge node sending certificates and digest information to the mobile terminal, the second edge node can also process the certificate of the first edge node using a preset digest method and compare the processed digest information with the second digest information sent by the mobile terminal. If they match, it means that the first edge node interacting with the second edge node is the same first edge node that originally interacted with the mobile terminal, that is, the first edge node is the first edge node trusted by the mobile terminal. At this time, the third digest information and the certificate of the second edge node can be fed back to the first edge node, so that the first edge node can authenticate the security of the second edge node and provide security for subsequent business data synchronization.

[0066] SC80: If the second edge node is a trusted node of both the mobile terminal and the first edge node, then service data synchronization is performed. Service data synchronization may include the first edge node synchronizing edge node-side service data such as billing information to the second edge node, or the mobile terminal synchronizing terminal-side service data such as identity information to the second edge node.

[0067] SC90: After business data synchronization is complete, the mobile terminal is accessed, switching the mobile terminal's access edge from the first edge node to the second edge node. The access edge refers to establishing targeted communication with the edge node, hosting applications and conducting business on the new access edge, which is distinct from the communication process during the previous security authentication between the mobile terminal and the second edge node.

[0068] Specifically, when a mobile terminal deems an edge node switch necessary—for example, when the communication distance to the first edge node exceeds a preset value, and there are one or more second edge nodes within that preset distance available for connection—it is considered that an edge node switch is required. This preset value can be configured based on the application scenario's requirements for communication speed and stability. The mobile terminal and the first edge node can first generate digest information using the same preset digest method and exchange the generated digest information. The mobile terminal then sends the digest information received from the other party, along with its own certificate, to the second edge node. The second edge node, based on the processing results of the mobile terminal and the first edge node, as well as the previously received first and second digest information, determines whether the mobile terminal and the first edge node are trusted nodes. If trusted, it sends back the generated third digest information and its own certificate to the trusted node, allowing the trusted node to authenticate the trustworthiness of the second edge node, thus completing two-way authentication. When the second edge node, the mobile terminal, and the first edge node mutually authenticate as trusted communication objects, business data synchronization can be performed. Then, the second edge node connects to the mobile terminal, establishing directed communication, and the mobile terminal completes the edge node switch.

[0069] In one embodiment, the process of determining whether the mobile terminal and the first edge node are trusted nodes can be as follows: If the result of the second edge node processing the certificate received from one party using the same preset digest method is consistent with the digest information received from the other party, it indicates that the mobile terminal and the first edge node interacting with the second edge node are still the same mobile terminal and the first edge node that exchanged digest information. They trust each other and there is no situation where the communication object is impersonated. At this time, the second edge node sends its own certificate and third digest information back to the mobile terminal and the first edge node. When both parties complete the security authentication of the second edge node based on the content fed back by the second edge node, it indicates that the communication between the mobile terminal, the first edge node, and the second edge node is secure. At this time, the second edge node synchronizes the business data to prepare for accessing the mobile terminal. After the business data synchronization is completed, the second edge node accesses the mobile terminal and replaces the original first edge node to provide network services to the mobile terminal.

[0070] To further enhance communication security, in one embodiment, before processing the certificates of the mobile terminal and the first edge node using a preset digest method, the following step is included:

[0071] Perform certificate authentication on the mobile terminal;

[0072] After successful certificate authentication, the process executes steps to process the mobile terminal's certificate using a preset digest method. Certificate authentication confirms the mobile terminal's security, allowing for the processing of data such as certificates sent by the mobile terminal. This further enhances the security and reliability of the edge node handover process.

[0073] Similarly, for the first edge node, before the second edge node processes the data sent by it, it needs to authenticate the security of the first edge node to further improve the security of edge node access processing. Therefore, in one embodiment, before the step of processing the certificate of the mobile terminal and the certificate of the first edge node using a preset digest method, the following step is also included:

[0074] Perform certificate authentication on the certificate of the first edge node;

[0075] After the certificate authentication is successful, the step of processing the certificate of the first edge node using a preset digest method is executed.

[0076] Certificate authentication confirms that the first edge node is secure, and the data, including certificates, sent by the first edge node can be processed. This further improves the security and reliability of the edge node handover process.

[0077] To further enhance communication security, in one embodiment, before the steps of receiving the certificate and first digest information of the first edge node sent by the first edge node, and receiving the certificate and second digest information of the mobile terminal sent by the mobile terminal, the method further includes:

[0078] Receive authentication requests initiated by the mobile terminal and the first edge node;

[0079] In response to the authentication requests sent by the mobile terminal and the first edge node, the certificate of the second edge node is sent back to the mobile terminal and the first edge node respectively.

[0080] The mobile terminal's certificate and second digest information sent by the mobile terminal can be the result of the mobile terminal authenticating the certificate of the second edge node, and the feedback provided after successful certificate authentication. Similarly, the first edge node's certificate and first digest information sent by the first edge node can be the result of the first edge node authenticating the certificate of the second edge node, and the feedback provided after successful certificate authentication. In other words, before the mobile terminal and the first and second edge nodes exchange important information such as digest information, two-way certificate authentication can be performed.

[0081] After the mobile terminal and the first edge node negotiate and exchange first and second digest information, it indicates that both the mobile terminal and the first edge node believe the edge node handover is feasible. For the mobile terminal, it needs to establish directional communication with the edge node to be accessed. For the first edge node, it needs to synchronize service data with the second edge node so that the mobile terminal can continue its services normally after the edge handover. Therefore, the mobile terminal and the first edge node initiate an authentication request to the second edge node. The second edge node receives and responds to the authentication request, and sends its certificate back to both, allowing them to authenticate the second edge node's certificate. Only after successful authentication and recognizing the second edge node as a secure edge node does the first edge node send its own certificate and first digest information to the second edge node, and only then does the mobile terminal send its own certificate and second digest information to the second edge node.

[0082] In one embodiment, such as Figure 3 As shown, step SC20, which involves receiving the mobile terminal's certificate and second digest information sent by the mobile terminal, includes:

[0083] SC22: Receives the first message from the mobile terminal, such as... Figure 4 As shown, the first message includes a message generated based on the first ciphertext and the certificate of the mobile terminal. The first ciphertext is generated by the mobile terminal encrypting the second digest information and the preset digest method using the public key in the certificate of the second edge node.

[0084] To improve communication security and reliability, the mobile terminal's certificate and second digest information are transmitted in an encrypted manner. The second digest information and a preset digest method can be used to encrypt the second digest information using the public key in the second edge node's certificate to generate a first ciphertext. A first message is then generated based on the first ciphertext and the mobile terminal's certificate; for example, the first ciphertext can be appended to the mobile terminal's certificate to generate the first message. This first message is transmitted to the second edge node. Upon receiving the first message, the second edge node can decrypt it using a decryption method matching the encryption to obtain the mobile terminal's certificate and second digest information.

[0085] In one embodiment, such as Figure 3 As shown, step SC40, which processes the certificate of the mobile terminal and the certificate of the first edge node using a preset digest method, includes:

[0086] SC42: Decrypt the first ciphertext in the first message using the private key of the second edge node, and process the certificate of the mobile terminal using the preset digest method obtained by decrypting the first ciphertext.

[0087] If, based on the processing result, the first digest information sent by the first edge node, and the second digest information sent by the mobile terminal, the step SC60 of determining that both the mobile terminal and the first edge node are trusted nodes includes:

[0088] SC62: Compare the processing result of the mobile terminal's certificate with the first digest information obtained by decrypting the first ciphertext. If they match, the mobile terminal is certified as a node trusted by the second edge node.

[0089] By using the private key of the second edge node to decrypt the first ciphertext generated by the mobile terminal based on the public key of C, the impersonation of the mobile terminal or the second edge node is prevented. The certificate of the mobile terminal in the first message is processed based on the preset digest method obtained after decryption, and the processing result is compared with the first digest information obtained by decrypting the first ciphertext. If they match, it means that the message has not been tampered with and that no communication object has been impersonated or the transmitted message has been tampered with during the communication process.

[0090] In one embodiment, such as Figure 3 , Figure 5 As shown, step SC60, which sends the third digest information and the certificate of the second edge node back to the trusted node, includes:

[0091] SC64: Uses the public key in the mobile terminal's certificate to encrypt the third digest and second digest information to generate a second ciphertext;

[0092] SC66: Generate a second message based on the second ciphertext and the certificate of the second edge node, and send the second message back to the mobile terminal.

[0093] For example, the second edge node can encrypt the third digest and second digest information using the public key in the mobile terminal's certificate to generate a second ciphertext, and attach it to the second edge node's certificate to generate a second message to be sent back to the mobile terminal. Using data encryption for interaction improves information transmission security. Furthermore, it allows the mobile terminal to easily decrypt the second ciphertext using a private key paired with the public key in its certificate, preventing impersonation of the communication target. The mobile terminal can also use its own private key to decrypt the second ciphertext to obtain the second digest information, and compare it with the second digest information received from the first edge node. If they match, it indicates that no impersonation of the communication target occurred during the communication process. The mobile terminal can also process the received certificate from the second edge node using a preset digest method to obtain a digest information, and compare the processing result (i.e., the obtained digest information) with the third digest information received from the second edge node. If they match, it indicates that no content tampering occurred during the interaction between the second edge node and the mobile terminal.

[0094] In one embodiment, such as Figure 3 , Figure 4 As shown, step SC20, which involves receiving the certificate and first digest information of the first edge node sent by the first edge node, includes:

[0095] SC24: Receive a third message, which includes a message generated based on a third ciphertext and the certificate of the first edge node. The third ciphertext is generated by the first edge node encrypting the first digest information and a preset digest method using the public key in the certificate of the second edge node.

[0096] The second edge node obtains the certificate and first digest information of the first edge node by receiving a third message containing these contents. The third message can be a message generated by the first edge node encrypting the first digest information and a preset digest method using the public key from the certificate of the second edge node received from the second edge node, and then appending the ciphertext to the certificate of the first edge node. It should be noted that, in addition to the method of appending ciphertext to the certificate as exemplified here, the generation of each message (first message, second message, third message, and fourth message) in this embodiment can also be achieved in other ways. For example, the ciphertext and certificate can be combined with dynamic code according to compilation rules to form a message for transmission; these are not exhaustively listed here.

[0097] In one embodiment, such as Figure 3 As shown, step SC60, which processes the certificate of the mobile terminal and the certificate of the first edge node using a preset digest method, includes:

[0098] SC67: Use the private key of the second edge node to decrypt the third ciphertext in the third message, and use the preset digest method obtained by decrypting the third ciphertext to process the certificate of the first edge node in the third message.

[0099] Similar to the process described above where the second edge node decrypts messages sent from the mobile terminal, for the first edge node, the second edge node can use its private key to decrypt the third ciphertext in the third message. It then processes the certificate of the first edge node in the third message using a preset digest method. If the processing result matches the second digest information sent by the first edge node to the mobile terminal, it indicates that the message has not been tampered with, and the communication between the second and first edge nodes is secure and reliable. Furthermore, using paired private keys to decrypt ciphertext encrypted with the public key provides higher security compared to public key encryption / decryption, preventing man-in-the-middle attacks on the mobile terminal or the second edge node from being impersonated.

[0100] In one embodiment, such as Figure 3 , Figure 5As shown, step SC60, which sends the third digest information and the certificate of the second edge node back to the trusted node, further includes:

[0101] SC68: Use the public key in the certificate of the first edge node to encrypt the third digest information and the first digest information to generate the fourth ciphertext;

[0102] SC69: Generate a fourth message based on the fourth ciphertext and the certificate of the second edge node, and send the fourth message back to the first edge node.

[0103] The authentication process from the second edge node to the first edge node can be achieved by encrypting the third digest and the first digest information using the public key in the certificate received from the first edge node, generating a fourth ciphertext, and attaching the fourth ciphertext to the second edge node's certificate to generate a fourth message, which is then sent back to the first edge node. The first edge node can then use its private key to decrypt the fourth ciphertext in the fourth message to obtain the third digest and the first digest information. Based on the decryption result, the first edge node can compare the decrypted first digest information with the first digest information obtained from the mobile terminal. If they match, it indicates that there is no risk of man-in-the-middle attack during the bidirectional communication between the first and second edge nodes. Furthermore, the first edge node can use a preset digest method to process the second edge node's certificate in the fourth message to obtain a digest information, and compare this digest information with the third digest information. If they match, it indicates that no message tampering occurred during the message transmission from the second edge node to the first edge node, and the communication process is secure and reliable.

[0104] In one embodiment, such as Figure 3 As shown, the steps for business data synchronization in SC80 include:

[0105] SC82: Performs mobile terminal-side service data synchronization with the mobile terminal and edge node-side service data synchronization with the first edge node; or, performs edge node-side service data synchronization with the first edge node.

[0106] The edge node to be connected can be provided with information such as identity information by the mobile terminal, which is recorded as mobile terminal-side service data. To ensure the continuity of services on the mobile terminal before and after the edge connection handover, the second edge node must synchronize the information provided by the first edge node, such as billing information, which is recorded as edge node-side service data. Whether to perform mobile terminal-side service data synchronization depends on the scope of services performed by the mobile terminal.

[0107] In one embodiment, the step of sending the third digest information and the certificate of the second edge node back to the trusted node is further included:

[0108] A method for receiving a preset digest updated by a mobile terminal after determining that an edge node switch is required.

[0109] After determining that an edge node handover is necessary, the mobile terminal updates the preset digest method. Subsequent two-way authentication processes between the mobile terminal and the first and second edge nodes are based on this updated preset digest method for generating and verifying digest information. This avoids security issues caused by the preset digest method being deciphered.

[0110] The edge node access processing method provided in this application embodiment can be applied to 5G mobile medical scenarios.

[0111] The edge node access processing method provided in this application, by associating the authentication processes of the mobile terminal and the first edge node, can prevent man-in-the-middle attacks on the mobile terminal or edge node. Furthermore, it can simultaneously perform authentication between the mobile terminal and the second edge node, as well as between the first and second edge nodes, enabling synchronous two-way authentication. This shortens the overall edge node switching time and provides better service stability and security. In addition, the service data switching process is designed to synchronize service data between the mobile terminal and both the first and second edge nodes, further shortening the switching time, increasing system availability, and improving the user service experience.

[0112] This application also provides an edge node access processing method, applicable to, for example... Figure 1 The following explanation uses the mobile terminal 102 shown as an example. Figure 6 As shown, the method includes:

[0113] SA20: When the mobile terminal needs to switch edge nodes, it sends the first digest information to the first edge node and receives the second digest information sent by the first edge node; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on a preset digest method.

[0114] Regarding the mobile terminal, as described in the above embodiments, it can be a mobile medical device or other movable terminal. The definitions of terms such as "first edge node" can be found in the descriptions in the above embodiments and will not be repeated here. When the mobile terminal deems an edge node switch necessary, it negotiates a switch with the first edge node. After reaching an agreement, the mobile terminal processes its certificate using a preset digest method to obtain first digest information and sends it to the first edge node. The mobile terminal also receives second digest information generated by the first edge node. By exchanging digest information, the two parties establish an association, enabling the first edge node to carry information from the mobile terminal side when performing security authentication with the second edge node, and to carry information from the first edge node side when communicating with the second edge node. The second edge node can perform association authentication, verifying whether the second digest information received from the mobile terminal side is consistent with the result of the second edge node processing the first edge node's certificate using the preset digest method, and also verifying whether the first digest information received from the first edge node side is consistent with the result of the second edge node processing the mobile terminal's certificate using the preset digest method. If both are consistent, it indicates that the mobile terminal and the first edge node trust each other.

[0115] SA40: Sends the mobile terminal's certificate and second digest information to the second edge node; the second edge node is the edge node to which the mobile terminal is to connect. The mobile terminal sends its certificate and second digest information to the second edge node for association authentication. This allows the second edge node to process the certificate of the first edge node using a preset digest method and compare the processing result with the second digest information. If they match, it indicates that the first edge node is the same one that sent the second digest information to the mobile terminal at that time, meaning the first edge node is a trusted edge node of the mobile terminal.

[0116] SA60: Receives the third digest information and certificate of the second edge node from the second edge node. The third digest information is formed by processing the certificate of the second edge node based on a preset digest method. The second edge node can obtain the preset digest method by receiving it from the mobile terminal, or it can use a pre-stored preset digest method. The mobile terminal receives the third digest information and certificate from the second edge node to provide a basis for security authentication in subsequent communication between the second edge node and the mobile terminal. The information fed back by the second edge node may be after the second edge node authenticates the first edge node as a trusted edge node of the mobile terminal.

[0117] SA80: The certificate of the second edge node is processed using a preset digest method;

[0118] SA90: If the processing result of the second edge node's certificate and the third digest information determine that the second edge node is a node trusted by the mobile terminal, then service data synchronization is performed, and the access edge is switched from the first edge node to the second edge node. For example, the processing result is compared with the third digest information; if they match, the second edge node is authenticated as a node trusted by the mobile terminal. After receiving the third digest information and the certificate of the second edge node, the terminal can process the certificate of the second edge node using a preset digest method to obtain a digest information. This digest information is then compared with the third digest information received from the second edge node. If they match, it indicates that no message tampering has occurred during the communication between the second edge node and the mobile terminal. The second edge node is a trusted edge node of the mobile terminal, and service data synchronization and targeted communication connections between the mobile terminal and the second edge node can be performed.

[0119] After the business data synchronization is completed at the second edge node, the mobile terminal will switch the access edge from the first edge node to the second edge node, realizing the switching between applications hosted by the edge nodes. Based on the prior association authentication, it can prevent man-in-the-middle attacks on the mobile terminal or edge node and ensure security.

[0120] Specifically, on the mobile terminal side, on the one hand, it can send first digest information to the first edge node and send the mobile terminal's certificate and second digest information to the second edge node. When the second edge node authenticates the first edge node, it can determine whether the mobile terminal is a trusted terminal based on whether the first digest information obtained from the first edge node is consistent with the result of processing the mobile terminal's certificate using a preset digest method. This also allows the second edge node to determine whether the first edge node is a trusted edge node based on whether the second digest information obtained from the mobile terminal is consistent with the result of processing the first edge node's certificate using a preset digest method. Subsequently, the mobile terminal receives third digest information and the second edge node's certificate from the second edge node. Based on the same concept, it processes the second edge node's certificate using the preset digest method and compares the processed digest information with the third digest information. If they match, it indicates that the message was not tampered with during the message transmission from the second edge node to the mobile terminal, and the second edge node is trustworthy. At this point, the mobile terminal can synchronize business data with the second edge node, and after the second edge node completes the business data synchronization, it connects to the second edge node and then disconnects from the first edge node, thus achieving edge node switching.

[0121] In one embodiment, such as Figure 7 As shown, step SA60, which involves receiving the third digest information and the certificate of the second edge node, includes:

[0122] SA62: Receives the third digest information, the second digest information, and the certificate of the second edge node from the feedback of the second edge node.

[0123] The step SA80, which determines that the second edge node is a trusted node of the mobile terminal based on the processing result of the second edge node's certificate and the third digest information, includes:

[0124] SA82: Perform a first verification between the processing result of the certificate of the second edge node and the third digest information, and perform a second verification between the received second digest information and the stored second digest information;

[0125] SA84: If both the first and second verifications pass, the second edge node is certified as a node trusted by the mobile terminal.

[0126] In addition to the third digest information and the certificate of the second edge node, to further improve the reliability of security authentication, the second edge node can feed back the second digest information it receives from the mobile terminal. If the second digest information fed back by the second edge node is consistent with the second digest information received by the mobile terminal from the first edge node, and the result of processing the certificate of the second edge node using the preset digest method is consistent with the third digest information, it indicates that the two-way communication process between the second edge node and the mobile terminal is secure and reliable. Through dual content verification, the reliability of security authentication is improved.

[0127] In one embodiment, before step SA40 of sending the mobile terminal's certificate and second digest information to the second edge node, the method further includes:

[0128] The system sends an authentication request to the second edge node and receives the certificate of the second edge node in response to the authentication request sent by the mobile terminal. As described in the above embodiment, the mobile terminal may first initiate authentication with the first edge node, and after the second edge node can verify the certificate of the mobile terminal, it will then send its own certificate back to the mobile terminal.

[0129] The system performs certificate authentication on the received certificate from the second edge node. After successful authentication, it sends the mobile terminal's certificate and a second digest to the second edge node. The mobile terminal then performs certificate authentication on the second edge node's certificate. If successful, the second edge node is considered secure and reliable, completing one round-trip authentication. If not, after a simple certificate authentication, the mobile terminal sends its certificate and second digest to the second edge node. The second edge node processes the mobile terminal's certificate using a preset digest method and compares the processing result with the first digest received from the first edge node. If they match, the mobile terminal is trusted by the first edge node. The second edge node then processes the first edge node's certificate using the preset digest method and compares the processing result with the second digest received from the mobile terminal. If they match, the first edge node is trusted by the mobile terminal.

[0130] Based on the description of the embodiments on the second edge node side above, to further improve communication security, in one embodiment, such as Figure 7 As shown, step SA40, which sends the mobile terminal's certificate and second digest information to the second edge node, includes:

[0131] SA42: The first ciphertext is generated by encrypting the second digest information and the preset digest method using the public key in the certificate of the second edge node;

[0132] SA44: Generate a first message based on the first ciphertext and the mobile terminal's certificate, and send the first message to the second edge node.

[0133] Specifically, the second edge node can use its public key from its certificate to encrypt the second digest information and a preset digest method to generate a first ciphertext. This first ciphertext is then attached to the mobile terminal's certificate to generate a first message, which is sent to the second edge node. The second edge node can then decrypt the first ciphertext using its private key. If decryption is successful, it indicates that neither a man-in-the-middle attack on the mobile terminal nor the second edge node itself has been impersonated. Based on this, the second edge node can further process the mobile terminal's certificate using the preset digest method and compare the result with the first digest information received from the first edge node. If they match, it means the mobile terminal is trusted by the first edge node. This also allows the second edge node to verify whether the first edge node is trusted by the mobile terminal based on the received second digest information and the certificate it received from the first edge node. Using public and private key matching for encryption and decryption offers higher security compared to traditional methods that use public keys for communication transmission.

[0134] In one embodiment, step SA62, which receives the third digest information, the second digest information, and the certificate of the second edge node from the second edge node, includes:

[0135] The system receives a second message from the second edge node. This second message includes a message generated based on a second ciphertext and the certificate of the second edge node. For example, the second ciphertext can be attached to the certificate of the second edge node to generate the second message. The second ciphertext is generated by the second edge node encrypting the third digest information and the second digest information using the public key in the certificate of the mobile terminal.

[0136] The mobile terminal receives the second ciphertext generated by the second edge node encrypting the third digest information and the second digest information using the public key in the mobile terminal's certificate, as well as the certificate of the second edge node attached to the second ciphertext. The mobile terminal decrypts the second ciphertext based on its own private key. If the decryption is successful, it means that the man-in-the-middle did not impersonate the second edge node, and the mobile terminal was not impersonated.

[0137] Besides whether the interaction object has been impersonated, whether the corresponding communication content has been tampered with is also a crucial aspect of communication security authentication. Therefore, in one embodiment, the steps of performing a first verification by comparing the processing result with the third digest information and a second verification by comparing the received second digest information with the stored second digest information include:

[0138] The second ciphertext in the second message is decrypted using the mobile terminal's private key. A preset digest method obtained from decrypting the second ciphertext is used to process the certificate of the second edge node in the second message. The processing result is then compared with the third digest information obtained from decrypting the second ciphertext for a first verification. The second digest information obtained from decrypting the second ciphertext is then compared with the stored second digest information for a second verification. By first verifying the result of processing the second edge node's certificate using the preset digest method with the third digest information, and then comparing the decrypted second digest information with the second digest information received by the mobile terminal from the first edge node for a second verification, if both verifications pass, it indicates that the content has not been tampered with and the communication process is secure.

[0139] In one embodiment, such as Figure 7 As shown, step SA90, which involves synchronizing business data and switching the access edge from the first edge node to the second edge node, includes:

[0140] SA92: Synchronizes mobile terminal-side service data with the second edge node. In addition to the service data synchronization between the first and second edge nodes, the mobile terminal also participates in the service data synchronization process, further shortening the handover time, increasing system availability, and improving the user service experience.

[0141] SA94: After the service data synchronization is completed at the second edge node, the access edge will be switched from the first edge node to the second edge node.

[0142] After establishing a directional communication connection with the second edge node, the mobile terminal can disconnect from the first edge node.

[0143] To avoid data loss during edge node switching, in one embodiment, the method further includes the following steps:

[0144] Service is suspended when an authentication request is sent to the second edge node;

[0145] Furthermore, after the step of switching the access edge from the first edge node to the second edge node, the following steps are also included:

[0146] Resume services. By pausing and resuming services on the mobile terminal side, service data is ensured not to be lost during edge node handover, and more computing and storage space is provided for edge node access processing, accelerating the security authentication and edge access handover process.

[0147] To avoid security issues caused by the decryption of the preset digest method, in one embodiment, the method further includes the step of:

[0148] Once the mobile terminal determines that an edge node switch is required, the preset summary method is updated.

[0149] Before performing the steps of sending the first digest information to the first edge node and receiving the second digest information sent by the first edge node, the updated preset digest method is sent to the first edge node;

[0150] Before performing the step of receiving the third digest information and the certificate of the second edge node, the updated preset digest method is sent to the second edge node.

[0151] Each time an edge node switch occurs, the mobile terminal can generate a new preset digest method based on the switch negotiation with the first edge node, i.e., update the preset digest method. The updated preset digest method is then sent to the first edge node, which uses it to process its own certificate to obtain a second digest, which is then sent to the mobile terminal. Additionally, to achieve associated authentication, the mobile terminal sends the updated preset digest method to the second edge node. This allows the second edge node to process its own certificate using the same preset digest method to obtain a third digest. This also facilitates the second edge node's security authentication of whether the mobile terminal is a trusted terminal of the first edge node, and whether the first edge node is a trusted edge node of the mobile terminal.

[0152] Furthermore, embodiments of this application also provide an edge node access processing method, applicable to, for example... Figure 1 The following explanation uses the first edge node 104 as an example. Figure 8 As shown, the method includes:

[0153] SB20: When the mobile terminal needs to switch edge nodes, it receives the first digest information sent by the mobile terminal and sends the second digest information to the mobile terminal; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on the preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on the preset digest method.

[0154] For definitions of edge nodes, please refer to the descriptions in the other side method embodiments mentioned above, and will not be repeated here. The first edge node negotiates a handover with the mobile terminal. The first edge node and the mobile terminal generate digest information based on the same preset digest method and exchange the digest information. This facilitates the establishment of a connection between the two parties when sending information to the second edge node, as the digest information of the other party is included.

[0155] SB40: Send the certificate of the first edge node and the first digest information (digest information generated and sent to the first edge node by the mobile terminal) to the second edge node. This allows the second edge node to process the certificate of the first edge node based on a preset digest method and compare the processing result with the second digest information received from the mobile terminal. If they match, it indicates that the first edge node is a trusted edge node of the mobile terminal. After receiving the first digest information sent by the first edge node, the second edge node can compare the first digest information with the result of processing the certificate of the mobile terminal using the preset digest method. If they match, it indicates that the mobile terminal is a trusted terminal of the first edge node, thus achieving association authentication.

[0156] SB60: Receives the third digest information and certificate of the second edge node from the second edge node; wherein the third digest information is formed after processing the certificate of the second edge node based on a preset digest method. Optionally, after authenticating the mobile terminal as a terminal trusted by the first edge node, and after authenticating the first edge node as an edge node trusted by the mobile terminal, the second edge node may send back the third digest information and its own certificate for the first edge node to authenticate the second edge node.

[0157] SB80: The certificate of the second edge node is processed using a preset digest method;

[0158] SB90: If the second edge node is determined to be a trusted node of the first edge node based on the processing result of the second edge node and the third digest information, then business data synchronization is performed, so that the mobile terminal switches the access edge from the first edge node to the second edge node after the business data synchronization is completed.

[0159] The process of determining whether a second edge node is a trusted node of the first edge node based on the processing result of the second edge node and the third digest information can be as follows: compare the processing result with the third digest information. If they match, it means that the second edge node is a trusted node of the first edge node. The first edge node can synchronize business data with it, so that when the business data synchronization of the second edge node is completed, the mobile terminal can switch the access edge from the first edge node to the second edge node.

[0160] In one embodiment, after the mobile terminal connects to the second edge node, the first edge node can disconnect from the mobile terminal. The disconnection can be triggered by the mobile terminal notifying the first edge node after establishing directional communication with the second edge node.

[0161] In one embodiment, such as Figure 9 As shown, step SB60, which involves receiving the third digest information and the certificate of the second edge node, includes:

[0162] SB62: Receives the third digest information, the first digest information, and the certificate of the second edge node from the feedback of the second edge node.

[0163] Step SB90, which determines that the second edge node is a trusted node of the first edge node based on the processing result of the second edge node's certificate and the third digest information, includes:

[0164] SB92: Perform a third verification by comparing the processing result of the certificate of the second edge node with the third digest information, and perform a fourth verification by comparing the received first digest information with the stored first digest information;

[0165] SB94: If both the third and fourth authentications pass, the second edge node is authenticated as a trusted node of the first edge node. Service data synchronization between the first and second edge nodes is possible, allowing the mobile terminal to switch its access edge from the first to the second edge node once the service data synchronization is complete. This dual authentication further enhances communication security.

[0166] In one embodiment, the method further includes the following steps before step SB40: sending the certificate of the first edge node and the first digest information to the second edge node.

[0167] Send an authentication request to the second edge node and receive the certificate of the second edge node in response to the authentication request;

[0168] The certificate of the second edge node is verified, and after successful verification, the certificate of the first edge node and the first digest information are sent to the second edge node.

[0169] As described in the above embodiments, before sending its certificate and first digest information, the first edge node can first perform a two-way authentication with the second edge node. This is done by initiating an authentication request to the second edge node and then authenticating the certificate of the second edge node returned by the second edge node after the first edge node has successfully authenticated its certificate. If the authentication is successful, the first edge node sends its certificate and first digest information to the second edge node so that the second edge node can determine whether the mobile terminal and the first edge node are trusted nodes based on the received certificate and digest information.

[0170] In one embodiment, such as Figure 9 As shown, step SB40, which sends the certificate and first digest information of the first edge node to the second edge node, includes:

[0171] SB42: Use the public key in the certificate of the second edge node to encrypt the first digest information and the preset digest method to generate the third ciphertext;

[0172] SB44: Generate a third message based on the third ciphertext and the certificate of the first edge node, and send the third message back to the second edge node.

[0173] By using the public key in the certificate of the second edge node to encrypt the first digest information and the preset digest method, the second edge node can decrypt it based on its own private key. The combination of private key and public key encryption and decryption can improve the security of information transmission.

[0174] In one embodiment, step SB62, which involves receiving the third digest information, the first digest information, and the certificate of the second edge node from the second edge node, includes:

[0175] Receive a fourth message, which includes a message generated based on a fourth ciphertext and the certificate of the second edge node. The fourth ciphertext is generated by the second edge node encrypting the third digest information and the first digest information using the public key in the certificate of the first edge node.

[0176] The first edge node receives a fourth ciphertext generated by the second edge node using the public key in the first edge node's certificate to encrypt the third digest information and the first digest information. The first edge node then decrypts the fourth ciphertext using its own private key. This public-key plus private-key method can improve the security of data transmission and reduce the security risks caused by key leakage.

[0177] In one embodiment, step SB92, which involves performing a third verification by comparing the processing result of the certificate of the second edge node with the third digest information and a fourth verification by comparing the received first digest information with the stored first digest information, includes:

[0178] The private key of the first edge node is used to decrypt the fourth ciphertext in the fourth message. The preset digest method obtained by decrypting the fourth ciphertext is used to process the certificate of the second edge node. The processing result is compared with the third digest information for third verification, and the first digest information obtained by decrypting the fourth ciphertext is compared with the stored first digest information for fourth verification.

[0179] To improve the reliability of security authentication, the certificate of the second edge node is processed using a preset digest method obtained by decryption, and the processing result is verified with the third digest information. The first digest information obtained by decrypting the fourth ciphertext is also verified with the stored first digest information. If both verifications pass, it means that the second edge node is trustworthy, the bidirectional communication process between the first and second edge nodes is secure and reliable, and the first edge node can synchronize edge node-side business data with the second edge node.

[0180] In one embodiment, such as Figure 9 As shown, before the steps of receiving the first digest information sent by the mobile terminal and sending the second digest information to the mobile terminal, SB20 further includes:

[0181] SB10: A method for receiving a preset digest updated by a mobile terminal after determining that an edge node handover is required.

[0182] The implementation of the preset digest method update and the implementation of the preset digest method communication between the mobile terminal and the edge node can be found in the description in the above embodiments, and will not be repeated here.

[0183] To better illustrate the implementation of the edge node access method provided in this application embodiment, it is described here as follows: Figure 1 Taking the environment shown as an example, the following embodiments are illustrated. It should be emphasized that the embodiments listed here do not limit the actual protection scope of this application, but are intended to help those skilled in the art understand the implementation process of the edge node access processing method provided by this application:

[0184] The aforementioned edge node access processing method can be applied to multi-edge handover security authentication in 5G mobile healthcare scenarios, including, for example... Figure 1 The mobile terminal 102 shown in the diagram has a secure handover process between the first edge node 104 and the second edge node 106, wherein the security authentication process can be accelerated by means of hardware encryption chips integrated in each component.

[0185] The mobile terminal integrates a hardware encryption chip to realize information and functions related to security authentication between the first edge node and the second edge node, such as methods, certificates, encryption algorithms, processes, threat detection and protection. The chip itself is also hardened to provide a high level of hardware protection and faster security authentication speed.

[0186] Security authentication process as follows Figure 10a , Figure 10b and Figure 10c As shown in the diagram, the hardware encryption chip plays a role in the negotiation phase. Figure 10b ) and certification phase ( Figure 10c When the mobile terminal (terminal A in the diagram) moves away from the first edge node (edge ​​node B in the diagram) it is currently connected to to a certain extent, an edge node switch needs to be performed, and the negotiation phase begins.

[0187] The mobile terminal negotiates with the first edge node currently connected to the edge node. The negotiation process generates two digest messages: a second digest and a first digest, as well as a preset digest method. The preset digest method is dynamically generated by software during the negotiation process and is time-sensitive; it remains valid until the edge node handover is complete. The second digest is generated by the first edge node after processing its own certificate using the preset digest method. It is sent by the first edge node to the mobile terminal during the negotiation process and attached to the mobile terminal's certificate before being sent to the second edge node. The first digest is generated by the mobile terminal after processing its own certificate using the preset digest method. It is sent by the mobile terminal to the first edge node during the negotiation process and attached to the mobile terminal's certificate (e.g., the certificate of application A on the terminal side) before being sent to the second edge node (edge ​​node C in the diagram).

[0188] In addition, the negotiation process divides the business data that needs to be switched into two parts: information that can be provided by the mobile terminal, such as identity information, is recorded as mobile terminal-side business data; and information that must be provided by the first edge node, such as billing information, is recorded as edge node-side business data. After the current negotiation is completed, the authentication phase begins.

[0189] The mobile terminal and the first edge node simultaneously initiate authentication negotiation requests to the second edge node, and the second edge node sends its own certificate to both the mobile terminal and the first edge node.

[0190] For the mobile terminal, the certificate of the second edge node is verified. If the verification is successful, the second digest information and the preset digest method are encrypted using the public key in the second edge node's certificate, and then appended to the mobile terminal's own certificate before being sent to the second edge node. Similarly, for the first edge node, the certificate of the second edge node is verified. If the verification is successful, the first digest information and the preset digest method are encrypted using the public key in the second edge node's certificate, and then appended to the mobile terminal's own certificate before being sent to the second edge node.

[0191] After receiving the certificates from the mobile terminal and the first edge node, the second edge node first verifies the validity of the other parts of the certificate. If it passes, it extracts the encrypted second digest information, first digest information, and preset digest method, decrypts them using its own private key, applies the preset digest method again to the certificate part of the message sent by the mobile terminal and the first edge node, and compares the calculation result with the first digest information and the second digest information respectively. If they are the same, it means that the verification is successful.

[0192] After successful verification, the second edge node applies the received preset digest method to its own certificate and calculates and generates a third digest. For the mobile terminal, the second edge node encrypts the second and third digests using the public key in the mobile terminal's certificate and sends them to the mobile terminal for verification. Similarly, for the first edge node, the second edge node encrypts the first and third digests using the public key in the first edge node's certificate and sends them to the mobile terminal for verification.

[0193] For the mobile terminal, upon receiving an encrypted message from the second edge node, it decrypts the message using its private key to extract the second and third digest information. It then calculates the second edge node's certificate using a preset digest method, compares the calculation result with the third digest information, and simultaneously compares the decrypted second digest information with its local second digest information. If both comparisons are equal, the verification passes. Similarly, for the first edge node, upon receiving an encrypted message from the second edge node, it decrypts the message using its private key to extract the first and third digest information, calculates the second edge node's certificate using a preset digest method, compares the calculation result with the third digest information, and simultaneously compares the decrypted first digest information with its local first digest information. If both comparisons are equal, the verification passes.

[0194] During the authentication phase, if any certificate fails verification, the phase fails. In this case, the mobile terminal and the first edge node will restart the negotiation phase, which mainly involves negotiating and adopting different second digest information, first digest information, and preset digest methods. If the authentication phase is successfully completed, the handover phase begins.

[0195] Handover Phase: The mobile terminal synchronizes its terminal-side service data to the second edge node, and the first edge node synchronizes its edge node-side service data to the second edge node. After the service data synchronization is complete, the second edge node notifies the mobile terminal to redirect the connection to the second edge node, completing the terminal handover. After this handover is completed, the process enters the completion phase.

[0196] The mobile terminal notifies the first edge node that the entire handover process has ended and disconnects from the first edge node.

[0197] During the above process, the mobile terminal's services were affected during the negotiation phase and returned to normal upon completion of the handover phase.

[0198] It should be noted that the hardware encryption chip relied upon in the above security authentication process can guarantee the high security requirements in medical scenarios. However, in some application scenarios with lower security requirements, software can be used to replace the hardware encryption chip to reduce costs, that is, the above security authentication process can be completed using a purely software method.

[0199] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0200] Based on the same inventive concept, this application also provides an edge node access processing apparatus for implementing the edge node access processing method executed on the second edge node side as described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more edge node access processing apparatus embodiments provided below can be found in the above-described limitations regarding the execution of the edge node access processing method on the second edge node side, and will not be repeated here.

[0201] In one embodiment, such as Figure 11 As shown in the illustration, this application also provides an edge node access processing device, applied to a second edge node, the device comprising:

[0202] The access node-side information receiving module C20 is used to receive the certificate and first digest information of the first edge node sent by the first edge node when the mobile terminal needs to switch edge nodes, and to receive the certificate and second digest information of the mobile terminal sent by the mobile terminal.

[0203] The first digest information is formed by processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed by processing the certificate of the first edge node based on a preset digest method.

[0204] The terminal security verification and information feedback module C40 is used to process the certificate of the mobile terminal and the certificate of the first edge node respectively using a preset digest method;

[0205] The first edge node security verification and information feedback module C60 is used to feed back the third digest information and the certificate of the second edge node to the trusted node when it is determined that both the mobile terminal and the first edge node are trusted nodes based on the processing result, the first digest information sent by the first edge node and the second digest information sent by the mobile terminal. The third digest information is formed after processing the certificate of the second edge node based on a preset digest method.

[0206] The business data synchronization module C80 is used to synchronize business data when the second edge node is a mobile terminal and a trusted node of the first edge node.

[0207] The access terminal execution module C90 is used to access the mobile terminal after the business data synchronization is completed, so that the access edge of the mobile terminal is switched from the first edge node to the second edge node.

[0208] The edge node access processing device applied to the second edge node side provided in this application embodiment also includes other modules and units for performing other steps of the above-described edge node access processing method on the second edge node side and achieving corresponding beneficial effects, which will not be elaborated here.

[0209] Based on the same inventive concept, this application also provides an edge node access processing apparatus for implementing the edge node access processing method executed on the mobile terminal side as described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more edge node access processing apparatus embodiments provided below can be found in the above-described limitations regarding the execution of the edge node access processing method on the mobile terminal side, and will not be repeated here.

[0210] An edge node access processing device, applied to mobile terminals, such as... Figure 12 As shown, the device includes:

[0211] The terminal-side digest information interaction module A20 is used to send first digest information to the first edge node and receive second digest information sent by the first edge node when the mobile terminal needs to switch edge nodes; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on a preset digest method.

[0212] The terminal-side first information sending module A40 is used to send the mobile terminal's certificate and second digest information to the second edge node; the second edge node is the edge node to which the mobile terminal is to access.

[0213] The terminal-side first information receiving module A60 is used to receive the third digest information fed back by the second edge node and the certificate of the second edge node; wherein, the third digest information is formed after processing the certificate of the second edge node based on a preset digest method;

[0214] The terminal-side first security verification module A80 is used to process the certificate of the second edge node using a preset digest method;

[0215] The terminal-side switching execution module A90 is used to perform service data synchronization and switch the access edge from the first edge node to the second edge node when the second edge node is determined to be a trusted node of the mobile terminal based on the processing result of the certificate of the second edge node and the third digest information.

[0216] The edge node access processing device for mobile terminals provided in this application also includes other modules and units for performing other steps of the above-described edge node access processing method for mobile terminals and achieving corresponding beneficial effects, which will not be elaborated here.

[0217] Based on the same inventive concept, this application also provides an edge node access processing apparatus for implementing the edge node access processing method executed on the first edge node side as described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more edge node access processing apparatus embodiments provided below can be found in the above-described limitations regarding the execution of the edge node access processing method on the first edge node side, and will not be repeated here.

[0218] An edge node access processing device is applied to a first edge node, such as... Figure 13 As shown, the device includes:

[0219] The first edge node side digest information interaction module B20 is used to receive the first digest information sent by the mobile terminal and send the second digest information to the mobile terminal when the mobile terminal needs to switch edge nodes; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on a preset digest method.

[0220] The first information sending module B40 on the first edge node side is used to send the certificate of the first edge node and the first digest information to the second edge node;

[0221] The first information receiving module B60 on the first edge node side is used to receive the third digest information fed back by the second edge node and the certificate of the second edge node; wherein, the third digest information is formed after processing the certificate of the second edge node based on a preset digest method;

[0222] The first security verification module B80 on the first edge node side is used to process the certificate of the second edge node using a preset digest method;

[0223] The first edge node side service data synchronization module B90 is used to perform service data synchronization when the second edge node is determined to be a trusted node of the first edge node based on the processing result of the certificate of the second edge node and the third digest information, so that the mobile terminal can switch the access edge from the first edge node to the second edge node after the service data synchronization is completed.

[0224] The edge node access processing device applied to the first edge node side provided in this application embodiment also includes other modules and units for performing other steps of the above-described edge node access processing method on the first edge node side and achieving corresponding beneficial effects, which will not be elaborated here.

[0225] Each module in the aforementioned edge node access processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0226] In one embodiment, an edge node is provided, which may be a server, and its internal structure diagram may be as follows: Figure 14As shown, the edge node includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores data such as preset summary methods. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements an edge node access processing method.

[0227] This application embodiment also provides an edge node, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the edge node access processing method executed on the side of the second edge node and / or the first edge node.

[0228] In one embodiment, the processor is a hardware encryption chip. The hardware encryption chip ensures high security requirements in scenarios such as medical settings.

[0229] In one embodiment, a mobile terminal is provided, which may be a mobile medical device. The mobile terminal includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor of the mobile terminal provides computing and control capabilities. The memory of the mobile terminal includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface of the mobile terminal is used for wired or wireless communication with external terminals. When the computer program is executed by the processor, it implements an edge node access processing method applied on the mobile terminal side. The display screen of the mobile terminal may be a liquid crystal display, a touch screen, etc., and the input device of the mobile terminal may be a touch layer covering the display screen, or something similar. Figure 1 The buttons, trackball, or touchpad on the mobile terminal casing shown can also be external keyboards, touchpads, or mice.

[0230] Those skilled in the art will understand that Figure 15 The structure shown is merely a block diagram of a portion of the structure related to the solution of this application and does not constitute a limitation on the mobile terminal to which the solution of this application is applied. A specific mobile terminal may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0231] In one embodiment, a mobile terminal is provided, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of an edge node access processing method executed on the mobile terminal side.

[0232] In one embodiment, the processor used on the mobile terminal side is a hardware encryption chip. The hardware encryption chip ensures high security requirements in scenarios such as medical applications.

[0233] In one embodiment, the mobile terminal is a mobile medical device.

[0234] In one embodiment, a mobile terminal access edge switching system is also provided, including the aforementioned mobile terminal, a first edge node, and a second edge node;

[0235] The first edge node includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described edge node access processing method.

[0236] The second edge node includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned edge node access processing method.

[0237] When the mobile terminal is a mobile medical device, the aforementioned mobile terminal access edge switching system is an intelligent medical application system. During the process of the user moving the mobile medical device, the mobile medical device can switch edge nodes based on factors related to communication quality, such as the communication strength between itself and the connected edge nodes and the communication strength with other edge nodes, to ensure the reliability of the application running on the mobile medical device.

[0238] For example, when moving a mobile medical device from the emergency room to the operating room, it is necessary to maintain the stability of the application running on the mobile medical device. This process depends on the communication stability of the mobile medical device. This can be achieved by performing an access edge handover process to avoid accidents caused by communication interruptions during the movement of the medical device.

[0239] Those skilled in the art should understand that each edge node can be either a first edge node or a second edge node, depending on its communication with the mobile terminal.

[0240] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the edge node access processing method described above.

[0241] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the edge node access processing method described above.

[0242] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0243] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0244] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for edge node access processing, characterized in that, Applied to a second edge node, the method includes: When the mobile terminal needs to switch edge nodes, it receives the certificate and first digest information of the first edge node sent by the first edge node, and also receives the certificate and second digest information of the mobile terminal sent by the mobile terminal; the mobile terminal is used in a medical scenario. Wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on the preset digest method; The preset digest method is used to process the certificate of the mobile terminal and the certificate of the first edge node respectively; The consistency of the processing result of the certificate of the mobile terminal and the first digest information sent by the first edge node, and the consistency of the processing result of the certificate of the first edge node and the second digest information sent by the mobile terminal are compared respectively. If they are consistent, the mobile terminal and the first edge node are determined to be trusted nodes. The third digest information and the certificate of the second edge node are fed back to the trusted node. The third digest information is formed after processing the certificate of the second edge node based on the preset digest method. If the second edge node is a node trusted by both the mobile terminal and the first edge node, then business data synchronization is performed. After the business data synchronization is completed, the mobile terminal is accessed, and the access edge of the mobile terminal is switched from the first edge node to the second edge node.

2. The method according to claim 1, characterized in that, The mobile terminal's certificate and second digest information are obtained from the decrypted first message. The first message includes a message generated by the mobile terminal based on the first ciphertext and the mobile terminal's certificate. The first ciphertext is generated by the mobile terminal encrypting the second digest information and the preset digest method using the public key in the certificate of the second edge node. The step of processing the certificate of the mobile terminal and the certificate of the first edge node using the preset digest method includes: The first ciphertext in the first message is decrypted using the private key of the second edge node, and the certificate of the mobile terminal is processed using the preset digest method obtained by decrypting the first ciphertext. The step of comparing the consistency of the processing result of the mobile terminal's certificate with the first digest information sent by the first edge node, and the consistency of the processing result of the first edge node's certificate with the second digest information sent by the mobile terminal, and determining that the mobile terminal and the first edge node are both trusted nodes if they are consistent, includes: The processing result of the mobile terminal's certificate is compared with the first digest information obtained by decrypting the first ciphertext. If they match, the mobile terminal is certified as a node trusted by the second edge node.

3. The method according to claim 1, characterized in that, The certificate and first digest information of the first edge node are obtained from the decrypted third message, wherein the third message includes a message generated by the first edge node based on the third ciphertext and the certificate of the first edge node, and the third ciphertext is generated by the first edge node encrypting the first digest information and a preset digest method using the public key in the certificate of the second edge node; The step of processing the certificate of the mobile terminal and the certificate of the first edge node using the preset digest method includes: The private key of the second edge node is used to decrypt the third ciphertext in the third message, and the certificate of the first edge node in the third message is processed using the preset digest method obtained by decrypting the third ciphertext. The step of comparing the consistency of the processing result of the mobile terminal's certificate with the first digest information sent by the first edge node, and the consistency of the processing result of the first edge node's certificate with the second digest information sent by the mobile terminal, and determining that the mobile terminal and the first edge node are both trusted nodes if they are consistent, includes: The processing result of the certificate of the first edge node is compared with the second digest information obtained by decrypting the third ciphertext. If they match, the first edge node is certified as a node trusted by the second edge node.

4. A method for edge node access processing, characterized in that, The method is applied to a mobile terminal, wherein the mobile terminal is used in a medical setting; the method includes: When a mobile terminal needs to switch edge nodes, it sends a first digest information to a first edge node and receives a second digest information sent by the first edge node; wherein, the first digest information is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest information is formed after processing the certificate of the first edge node based on the preset digest method. The certificate of the mobile terminal and the second digest information are sent to the second edge node; the second edge node is the edge node to which the mobile terminal is to access. The system receives a third digest message and a certificate from the second edge node; wherein the third digest message is formed after processing the certificate of the second edge node based on the preset digest method. The certificate of the second edge node is processed using the preset digest method. If the second edge node is determined to be a trusted node of the mobile terminal based on the processing result of the certificate of the second edge node and the third digest information, then business data synchronization is performed, and the access edge is switched from the first edge node to the second edge node.

5. A method for edge node access processing, characterized in that, Applied to the first edge node, the method includes: When a mobile terminal needs to switch edge nodes, it receives a first digest message sent by the mobile terminal and sends a second digest message to the mobile terminal; wherein, the first digest message is formed after processing the certificate of the mobile terminal based on a preset digest method, and the second digest message is formed after processing the certificate of the first edge node based on the preset digest method; the mobile terminal is used in a medical scenario; Send the certificate of the first edge node and the first digest information to the second edge node; The system receives a third digest message and the certificate of the second edge node from the second edge node; wherein the third digest message is formed after processing the certificate of the second edge node based on the preset digest method. The certificate of the second edge node is processed using the preset digest method. If the second edge node is determined to be a trusted node of the first edge node based on the processing result of the certificate of the second edge node and the third digest information, then business data synchronization is performed, so that the mobile terminal switches the access edge from the first edge node to the second edge node after the business data synchronization is completed.

6. The method according to claim 5, characterized in that, The third digest information, the first digest information, and the certificate of the second edge node are obtained from the decrypted fourth message. The fourth message includes a message generated based on the fourth ciphertext and the certificate of the second edge node. The fourth ciphertext is generated by the second edge node encrypting the third digest information and the first digest information using the public key in the certificate of the first edge node.

7. The method according to claim 6, characterized in that, The steps of performing a third verification by comparing the processing result of the certificate of the second edge node with the third digest information, and performing a fourth verification by comparing the received first digest information with the stored first digest information, include: The private key of the first edge node is used to decrypt the fourth ciphertext in the fourth message. The certificate of the second edge node is processed using the preset digest method obtained by decrypting the fourth ciphertext. The processing result is then compared with the third digest information for third verification, and the first digest information obtained by decrypting the fourth ciphertext is compared with the stored first digest information for fourth verification.

8. A mobile terminal, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, The mobile terminal is applied in a medical setting, and when the processor executes the computer program, it implements the steps of the edge node access processing method according to any one of claims 5 to 7.

9. The mobile terminal according to claim 8, characterized in that, The mobile terminal is a mobile medical device.

10. The mobile terminal according to claim 8, characterized in that, The processor used on the mobile terminal side is a hardware encryption chip.

Images