A security protection method and device and electronic equipment

Abstract

A security protection method and device and electronic equipment, the method comprising: a network side device receiving a registration request sent by a terminal device, determining a first key, generating a feature key based on a random number and a root key, and generating a second key based on the feature key and the first key, performing a preset function operation on the second key and a ciphertext value to calculate a first verification tag corresponding to the registration request, and determining a user identifier corresponding to the registration request in response to the initial verification tag being consistent with the first verification tag. Through the above method, the feature key is generated based on the root key and the random number of the terminal device, and the second key is determined based on the feature key, and the first verification tag is calculated for registration authentication, ensuring that a network attacker cannot determine the SUPI based on the response of the terminal device or the network side device, and improving the security of the network registration between the terminal device and the network side device.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a security protection method, device and electronic device. Background Technology

[0002] In order to achieve normal communication, user-end devices need to register with the main network. The specific process of network registration is as follows:

[0003] The architectural connection diagram between the user terminal device and the network side device is shown below. Figure 1 As shown, in Figure 1 During initial registration, the user terminal device needs to encrypt the user identifier (Subscription Permanent Identifier, abbreviated as SUPI) into a user concealed identifier (Subscription Concealed Identifier, abbreviated as SUCI) and send an initial registration request to the network-side device to the Access and Mobility Management Function (AMF). The AMF will then forward the SUCI to the Authentication Server Function (AUSF) and the Unified Data Management (UDM) for authentication.

[0004] Furthermore, the UDM decrypts the SUCI, obtains the SUPI from the SUCI, and then performs two-way authentication with the user terminal equipment based on the SUPI. After successful authentication, the AUSF returns the SUPI to the AMF. The AMF generates a 5G Globally Unique Temporary Identifier (5G-GUTI) based on the SUPI, saves the mapping relationship, and notifies the UE that registration is complete.

[0005] In 5G systems, the Elliptic Curve Integrated Encryption Scheme (ECIES) is typically used to encrypt SUPI into SUCI, making it impossible for network attackers to obtain SUPI.

[0006] In practice, network attackers use multiple different SUPIs to detect the responses of user devices and network devices. When a user device replies with a message indicating successful authentication, the attacker can determine that the SUPI is valid based on this message. At the same time, the attacker can use this message to find the associated user device, thereby identifying the user device as the target terminal and tracking it.

[0007] To prevent network attackers from obtaining the SUCI of the user-side device, the user-side device and the network-side device each derive the same encryption key K1 and integrity key K2. K1 is used to encrypt the SUPI and K2 is used to generate a MAC tag. While obtaining the network public key, network attackers can use their private key in combination with the network public key to encrypt and deduce the SUPI. They can then send this private key along with a fake SUCI to the network side and judge whether the fake SUPI is correct based on the network side's response, thereby achieving the goal of cracking the real SUPI. This results in low security for the SUPI of the user-side device. Summary of the Invention

[0008] This application provides a security protection method and apparatus that, by determining a feature key, a second key, and a first verification tag for registration authentication, ensures that network attackers cannot determine the SUPI based on the response of the terminal device or the network-side device, thereby improving the security of network access registration between the terminal device and the network-side device.

[0009] Firstly, this application provides a security protection method, the method comprising:

[0010] The network-side device receives a registration request sent by the terminal device, wherein the registration request includes a random number corresponding to the user identifier of the terminal device, a ciphertext value, and an initial verification tag;

[0011] A first key is determined, a feature key is generated based on the random number and the root key, and a second key is generated based on the feature key and the first key;

[0012] Based on the second key and the ciphertext value, a preset function operation is performed to calculate the first verification tag corresponding to the registration request;

[0013] In response to the initial verification tag being consistent with the first verification tag, the user identifier corresponding to the registration request is determined.

[0014] In one possible design, determining the first key includes:

[0015] The network private key and the terminal public key of the terminal device are determined.

[0016] The network private key and the terminal public key are combined according to a preset algorithm to generate a shared key;

[0017] Based on the shared key, a key derivation is performed to determine the first key.

[0018] In one possible design, generating the feature key based on the random number and the root key includes:

[0019] The root key and the random number are input into a preset key derivation function to obtain the output of the preset key derivation function;

[0020] The output result is used as the feature key.

[0021] In one possible design, after calculating the first verification tag corresponding to the registration request, the following is also included:

[0022] The registration request is not responded to because the initial verification tag is inconsistent with the first verification tag.

[0023] Secondly, this application also provides a terminal registration method, the method comprising:

[0024] Obtain the target root key, target random number, and target terminal public key corresponding to the end user;

[0025] Generate a target feature key based on the target root key and the target random number;

[0026] A target first key is determined, a target second key is generated based on the target first key and the target feature key, and a preset function operation is performed on the target ciphertext based on the target second key to determine the target verification tag, wherein the target ciphertext is ciphertext obtained by encrypting the user identification number of the terminal;

[0027] The target terminal public key, target ciphertext, target verification tag, and target random number are placed into the target registration request, and the target registration request is sent to the network-side device.

[0028] In one possible design, determining the target first key includes:

[0029] A first public key and a first private key are determined, wherein the first public key is the public key of the network-side device and the first private key is the private key of the terminal-side device;

[0030] The first public key and the first private key are combined according to a preset algorithm to determine the first shared key;

[0031] The target first key is determined by deriving the first shared key based on the preset derivation function.

[0032] Thirdly, this application provides a safety protection device, the device comprising:

[0033] The receiving module is used for the network-side device to receive a registration request sent by the terminal device, wherein the registration request includes a random number corresponding to the user identifier of the terminal device, a ciphertext value, and an initial verification tag;

[0034] The determining module is used to determine a first key, generate a feature key based on the random number and the root key, and generate a second key based on the feature key and the first key;

[0035] The calculation module is used to perform a preset function operation based on the second key and the ciphertext value to calculate the first verification tag corresponding to the registration request;

[0036] A response module is used to determine the user identifier corresponding to the registration request in response to the initial verification tag being consistent with the first verification tag.

[0037] In one possible design, the determining module is specifically used to determine the network private key and the terminal public key of the terminal device, combine the network private key and the terminal public key according to a preset algorithm to generate a shared key, and perform key derivation based on the shared key to determine a first key.

[0038] In one possible design, the determining module is further configured to input the root key and the random number into a preset key derivation function, obtain the output result of the preset key derivation function, and use the output result as the feature key.

[0039] In one possible design, the response module is specifically configured to not respond to the registration request if the initial verification tag is inconsistent with the first verification tag.

[0040] Fourthly, this application provides a terminal registration device, the device comprising:

[0041] The acquisition module is used to obtain the target root key, target random number, and target terminal public key corresponding to the terminal user.

[0042] The generation module is used to generate a target feature key based on the target root key and the target random number;

[0043] The tag module is used to determine a target first key, generate a target second key based on the target first key and the target feature key, and perform a preset function operation on the target ciphertext based on the target second key to determine a target verification tag, wherein the target ciphertext is ciphertext obtained by encrypting the user identification number of the terminal;

[0044] The sending module is used to put the target terminal public key, target ciphertext, target verification tag and target random number into the target registration request, and send the target registration request to the network side device.

[0045] In one possible design, the tag module is specifically used to determine a first public key and a first private key, combine the first public key and the first private key according to a preset algorithm to determine a first shared key, and derive the first shared key based on a preset derivation function to determine a target first key.

[0046] Fifthly, this application provides an electronic device, comprising:

[0047] Memory, used to store computer programs;

[0048] When a processor executes a computer program stored in the memory, it implements the above-described security protection method steps.

[0049] Sixthly, this application provides an electronic device, comprising:

[0050] Memory, used to store computer programs;

[0051] When the processor executes the computer program stored in the memory, it implements the steps of the terminal registration method described above.

[0052] Seventhly, a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned security protection method.

[0053] Eighthly, a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the terminal registration method described above.

[0054] For details on each of the above aspects from the first to the eighth, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect. These details will not be repeated here. Attached Figure Description

[0055] Figure 1A schematic diagram illustrating the architectural connection between the user terminal device and the network side device provided in this application;

[0056] Figure 2 A flowchart of the steps of a security protection method provided in this application;

[0057] Figure 3 A flowchart of the steps of a terminal registration method provided in this application;

[0058] Figure 4 A structural schematic diagram of a safety protection device provided in this application;

[0059] Figure 5 A schematic diagram of the structure of a terminal registration device provided in this application;

[0060] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operational methods in the method embodiments can also be applied to the device embodiments or system embodiments. It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A connected to B can represent: A and B directly connected, and A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for distinguishing the purpose of description and should not be construed as indicating or implying relative importance or order.

[0062] In previous technologies, terminal devices sent registration requests to network devices to achieve normal communication. Typically, elliptic curve integration encryption was used to encrypt the terminal device's SUPI into SUCI, and the SUCI was sent to the network device. However, network attackers could obtain the network public key, and then use the private key in combination with the network public key to encrypt and deduce the SUPI. They could then send this private key along with a fake SUCI to the network side and judge whether the fake SUPI was correct based on the network side's response, thereby cracking the real SUPI. This resulted in low security for the user device's SUPI.

[0063] To address the aforementioned problems, this application provides a security protection method to prevent brute-force attacks on SUPI, avoiding network attackers from using ECIES to forge SUCI and send it to network-side devices, thereby cracking the real SUPI and resulting in low security for the user's SUPI. The methods and apparatus described in this application are based on the same technical concept. Since the principles by which the methods and apparatus solve the problems are similar, embodiments of the apparatus and methods can be referred to interchangeably, and repeated details will not be repeated.

[0064] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0065] Example 1:

[0066] Reference Figure 2 This application provides a security protection method that can prevent network attackers from cracking the real SUPI of the terminal device, thereby improving the security of the terminal device. The implementation process of this method is as follows:

[0067] Step S21: The network-side device receives the registration request sent by the terminal device.

[0068] Before accessing the network, the terminal device will access the network based on a registration request. The network device will receive the registration request sent by the terminal device. The registration request contains a random number corresponding to the user identifier of the terminal device, a ciphertext value, and an initial verification tag. The terminal device can be a smartphone, and the user identifier can be the smartphone's SUPI.

[0069] Step S22: Determine the first key, generate a feature key based on the random number and the root key, and generate a second key based on the feature key and the first key.

[0070] After receiving the registration request from the terminal device, the network-side device needs to determine the network private key and the terminal public key corresponding to the terminal device. It then uses a preset algorithm to combine the network private key and the terminal public key to generate a shared key. The shared key is then used to derive a key, resulting in a decryption key and a first key. This decryption key is used to decrypt SUCI into SUPI. The preset algorithm can be an elliptic curve asymmetric algorithm. Since asymmetric algorithms are well-known in the art, they will not be described in detail here.

[0071] Furthermore, the key derivation method can be the key derivation algorithm in the 3GPP protocol. Since the key derivation algorithm is a well-known technology in the art, it will not be described in detail here.

[0072] To ensure the security of the terminal device, the random number and the root key are input into a preset key derivation function and combined to obtain the output result. The output result is used as the feature key. Then, based on the key derivation algorithm, the first key and the feature key are combined to generate the second key.

[0073] By using the above method, a feature key is generated based on the root key and a random number, and a second key is generated based on the first key and the feature key. This avoids network attackers from using public-key cryptography to brute-force SUPI, thereby improving the security of the link information between the terminal device and the network device.

[0074] Step S23: Perform a preset function operation based on the second key and the ciphertext value to calculate the first verification tag corresponding to the registration request.

[0075] To prevent network attackers from deducing SUPI using public-key cryptography, the network-side device needs to verify the registration request sent by the terminal device. The network-side device will perform a hash function (Message Authentication Codes, abbreviated as MAC) operation based on the second key and the ciphertext value in the registration request sent by the terminal device, and use the result of the operation as the first verification tag.

[0076] By using the above method, after deriving the second key from the feature key, the first verification tag is generated, avoiding the generation of the first verification tag based on the shared key. This makes it impossible for network attackers to deduce SUPI based on the public key mechanism, which is beneficial for network-side devices to verify the registration request of terminal devices based on the first verification tag.

[0077] Step S24: In response to the initial verification tag matching the first verification tag, determine the user identifier corresponding to the registration request.

[0078] After obtaining the first verification tag, the network-side device needs to confirm whether the initial verification tag in the registration request is consistent with the first verification tag. If the initial verification tag is consistent with the first verification tag, the decryption key is used to decrypt the ciphertext corresponding to the registration request to obtain the user identifier, which is the same as the user identifier in the registration request. If the initial verification tag is inconsistent with the first verification tag, the network-side device determines that the verification fails.

[0079] For example, the first key can be the MAC key stored in ECIES, the second key can be the second MAC key, and the initial verification tag can be MAC-Xtag.

[0080] Based on the method described above, a feature key containing the root key is determined, and a second key is determined and a first verification tag is generated. This prevents network attackers from inferring the SUPI based on the terminal device or network-side device. By comparing the initial verification tag with the first verification tag, the verification accuracy of the network-side device is improved, thereby enhancing the security of the terminal device's network registration.

[0081] Example 2:

[0082] Reference Figure 3 This application provides a terminal registration method, which can improve the security of terminal devices during the process of accessing network-side devices. The implementation process of this method is as follows:

[0083] Before a terminal device can access the network-side equipment, it needs to send a registration request. The specific process for generating the registration request is as follows:

[0084] Step S31: Obtain the target root key, target random number, and target terminal public key corresponding to the terminal user.

[0085] The terminal device needs to first read the target root key, the target random number generated by the random number generator, and the target terminal public key from the global user card.

[0086] Step S32: Generate the target feature key based on the target root key and the target random number.

[0087] The target root key and the target random number are combined based on the key derivation algorithm to generate the target feature key.

[0088] Step S33: Determine the target first key, generate the target second key based on the target first key and the target feature key, and perform a preset function operation on the target ciphertext based on the target second key to determine the target verification tag, wherein the target ciphertext is the ciphertext obtained by encrypting the user identification number of the terminal.

[0089] The terminal needs to determine a first public key and a first private key. The first public key is the public key of the network-side device, and the first private key is the private key of the terminal. Then, based on a preset algorithm, the first private key and the first public key are combined to determine the first shared key corresponding to the terminal device and the network-side device. The first shared key is then derived by a preset derivation function to obtain an encryption key and a target first key. The encryption key is used to encrypt the terminal data.

[0090] After determining the first key, the target first key and the target feature key need to be combined based on the key derivation algorithm to generate the target second key. Then, based on the target second key, a preset function operation is performed on the target ciphertext to generate the target verification tag. This preset function operation can be a MAC operation. The target ciphertext is the ciphertext obtained by encrypting the user identification number of the terminal, such as the MSIN ciphertext obtained by encrypting the Mobile Subscriber Identification Number (MSIN) in SUPI.

[0091] By using the above method, target verification tags with anti-counterfeiting functions are identified, making it impossible for network attackers to infer SUPI based on the terminal device's response, thereby improving the security of terminal device network registration.

[0092] Step S34: Place the target terminal public key, target ciphertext, target verification tag and target random number into the target registration request, and send the target registration request to the network side device.

[0093] Based on the above description, the terminal device puts the target terminal public key, target ciphertext, target verification tag and target random number into the target registration request, and then sends the target registration request to the network side device, thereby realizing the network access registration of the terminal device.

[0094] It should be noted that the target registration request includes SUCI, which includes: SUPI type, network-side device identifier, routing identifier, network-side device public key identifier, etc., which will not be listed here.

[0095] As described above, the terminal device generates the target feature key, the target second key, and the target verification tag, ensuring the uniqueness of the target feature key. This prevents network attackers from inferring the SUPI based on the terminal device's response, thereby improving the security of the terminal device's network registration.

[0096] Based on the same inventive concept, this application also provides a safety protection device, which implements the function of a safety protection method, as described above. Figure 4 The device includes:

[0097] The receiving module 401 is used for the network-side device to receive a registration request sent by the terminal device, wherein the registration request includes a random number corresponding to the user identifier of the terminal device, a ciphertext value, and an initial verification tag.

[0098] The determining module 402 is used to determine a first key, generate a feature key based on the random number and the root key, and generate a second key based on the feature key and the first key;

[0099] The calculation module 403 is used to perform a preset function operation based on the second key and the ciphertext value to calculate the first verification tag corresponding to the registration request;

[0100] The response module 404 is used to determine the user identifier corresponding to the registration request in response to the initial verification tag being consistent with the first verification tag.

[0101] In one possible design, the determining module 402 is specifically used to determine the network private key and the terminal public key of the terminal device, combine the network private key and the terminal public key according to a preset algorithm to generate a shared key, and perform key derivation based on the shared key to determine a first key.

[0102] In one possible design, the determining module 402 is further configured to input the root key and the random number into a preset key derivation function, obtain the output result of the preset key derivation function, and use the output result as the feature key.

[0103] In one possible design, the response module 404 is specifically configured to not respond to the registration request in response to the inconsistency between the initial verification tag and the first verification tag.

[0104] Based on the same inventive concept, this application also provides a terminal registration device, which implements the function of a terminal registration method, as described above. Figure 5 The device includes:

[0105] The module 501 is used to obtain the target root key, target random number and target terminal public key corresponding to the terminal user;

[0106] Generation module 502 is used to generate a target feature key based on the target root key and the target random number;

[0107] The tag module 503 is used to determine a target first key, generate a target second key based on the target first key and the target feature key, and perform a preset function operation on the target ciphertext based on the target second key to determine a target verification tag, wherein the target ciphertext is ciphertext obtained by encrypting the user identification number of the terminal;

[0108] The sending module 504 is used to put the target terminal public key, target ciphertext, target verification tag and target random number into the target registration request, and send the target registration request to the network side device.

[0109] In one possible design, the tag module 503 is specifically used to determine a first public key and a first private key, combine the first public key and the first private key according to a preset algorithm to determine a first shared key, and derive the first shared key based on a preset derivation function to determine a target first key.

[0110] Based on the same inventive concept, this application also provides an electronic device that can realize the functions of the aforementioned security protection device and terminal registration device. (Refer to...) Figure 6 The electronic device includes:

[0111] At least one processor 601 and a memory 602 connected to at least one processor 601. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 The example shown is the connection between processor 601 and memory 602 via bus 600. Bus 600 is... Figure 6 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 600 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 6 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller; there is no restriction on the name.

[0112] In this embodiment, memory 602 stores instructions executable by at least one processor 601. By executing the instructions stored in memory 602, at least one processor 601 can perform a security protection method described above. Processor 601 can implement... Figure 4 as well as Figure 5 The functions of each module in the device shown.

[0113] The processor 601 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 602 and calling data stored in memory 602, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0114] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0115] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of a security protection method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0116] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0117] By designing and programming the processor 601, the code corresponding to the security protection method and the terminal registration method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute them during operation. Figure 2A security protection step of the embodiment shown and Figure 3 The illustrated embodiment presents a terminal registration step. How to design and program the processor 601 is a technique well-known to those skilled in the art and will not be described further here.

[0118] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a security protection method and a terminal registration method described above.

[0119] In some possible implementations, various aspects of the security protection method and terminal registration method provided by this application can also be implemented in the form of a program product, which includes program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps of the security protection method and terminal registration method according to the various exemplary embodiments of this application described above.

[0120] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0121] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0122] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0123] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0124] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A security method, characterized by, include: The network-side device receives a registration request sent by the terminal device, wherein the registration request includes a random number corresponding to the user identifier of the terminal device, a ciphertext value, and an initial verification tag; The network private key and the terminal public key of the terminal device are determined. The network private key and the terminal public key are combined according to a preset algorithm to generate a shared key; Based on the shared key, a first key is determined; a feature key is generated based on the random number and the root key; and a second key is generated based on the feature key and the first key. Based on the second key and the ciphertext value, a preset function operation is performed to calculate the first verification tag corresponding to the registration request; In response to the initial verification tag being consistent with the first verification tag, the user identifier corresponding to the registration request is determined.

2. The method of claim 1, wherein, The generation of the feature key based on the random number and the root key includes: The root key and the random number are input into a preset key derivation function to obtain the output of the preset key derivation function; The output result is used as the feature key.

3. The method of claim 1, wherein, After calculating the first verification tag corresponding to the registration request, the method further includes: The registration request is not responded to because the initial verification tag is inconsistent with the first verification tag.

4. A terminal registration method characterized by comprising: include: Obtain the target root key, target random number, and target terminal public key corresponding to the end user; Generate a target feature key based on the target root key and the target random number; A first public key and a first private key are determined, wherein the first public key is the public key of the network-side device and the first private key is the private key of the terminal-side device; The first public key and the first private key are combined according to a preset algorithm to determine the first shared key; The first shared key is derived based on a preset derivation function to determine a target first key. A target second key is generated based on the target first key and the target feature key. A target verification tag is determined by performing a preset function operation on the target ciphertext based on the target second key. The target ciphertext is ciphertext obtained by encrypting the user identification number of the terminal. The target terminal public key, target ciphertext, target verification tag, and target random number are placed into the target registration request, and the target registration request is sent to the network-side device.

5. A safety guard comprising: include: The receiving module is used for the network-side device to receive a registration request sent by the terminal device, wherein the registration request includes a random number corresponding to the user identifier of the terminal device, a ciphertext value, and an initial verification tag; The determination module is used to determine the network private key and the terminal public key of the terminal device; The network private key and the terminal public key are combined according to a preset algorithm to generate a shared key; Based on the shared key, a first key is determined; a feature key is generated based on the random number and the root key; and a second key is generated based on the feature key and the first key. The calculation module is used to perform a preset function operation based on the second key and the ciphertext value to calculate the first verification tag corresponding to the registration request; A response module is used to determine the user identifier corresponding to the registration request in response to the initial verification tag being consistent with the first verification tag.

6. A terminal registration apparatus characterized by comprising: include: The acquisition module is used to obtain the target root key, target random number, and target terminal public key corresponding to the terminal user. The generation module is used to generate a target feature key based on the target root key and the target random number; The tag module is used to determine the first public key and the first private key, wherein the first public key is the public key of the network-side device and the first private key is the private key of the terminal-side device; The first public key and the first private key are combined according to a preset algorithm to determine the first shared key; The first shared key is derived based on a preset derivation function to determine a target first key. A target second key is generated based on the target first key and the target feature key. A target verification tag is determined by performing a preset function operation on the target ciphertext based on the target second key. The target ciphertext is ciphertext obtained by encrypting the user identification number of the terminal. The sending module is used to put the target terminal public key, target ciphertext, target verification tag and target random number into the target registration request, and send the target registration request to the network side device.

7. An electronic device, comprising: include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the steps of the method according to any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-4.

Images