Communication authentication method and apparatus, communication device, and storage medium

Abstract

The application relates to a communication authentication method and device, a communication device and a storage medium, and relates to the technical field of mobile communication. The method comprises the following steps: if a UE locally inquires about subscription identification information of a general booting architecture (GBA) service, determining a target user identification card of the GBA service from multiple user identification cards according to the inquired subscription identification information, and acquiring user private identification (IMPI) information of the target user identification card; and then sending a GBA authentication request carrying the IMPI information to a binding support function (BSF) network element; wherein the GBA authentication request is used for instructing the BSF network element to perform GBA authentication. By inquiring about the subscription identification information of the GBA service stored locally in the UE, the target user identification card currently needing to perform GBA authentication can be determined from the multiple user identification cards, so that the IMPI information of the target user identification card is sent to the BSF network element, thereby realizing GBA authentication in the case that the UE uses multiple user identification cards.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mobile communication technology, in particular to a communication authentication method and device, a communication device and a storage medium. BACKGROUND

[0002] The GBA (General Bootstrapping Architecture) service is a lightweight security infrastructure based on a mobile communication network defined by the 3GPP (3rd Generation Partnership Project), which can provide unified security authentication services for mobile application layer services.

[0003] The 3GPP TS 33.220 specifies the GBA function technical standard of the mobile terminal in a single user card scenario. When the application client and the server negotiate to use the GBA mode for authentication, the client directly obtains the IMPI (IM Private Identity) parameter and other information from the SIM card (Subscriber Identity Module), and sends a GBA authentication request to the BSF (Binding Support Function) network element. The BSF network element forwards it to the HSS (Home Subscriber Server), and the HSS generates an authentication vector and continues the subsequent authentication process.

[0004] However, when the user mobile terminal uses a dual-SIM card service, neither the client nor the server has the user card number and other related information about the user's subscription to the GBA service of the operator. In this way, when the client initiates a GBA authentication request to the BSF network element, it cannot determine which SIM card slot to obtain the IMPI identifier information from, and there may be a problem that the obtained IMPI identifier information is inconsistent with the IMPI identifier information in the GBA parameter set configured in the HSS of the user's subscription to the GBA service, thereby causing the GBA authentication to fail. SUMMARY

[0005] Therefore, it is necessary to provide a communication authentication method, device, communication device and storage medium capable of performing GBA authentication on a dual-card terminal to solve the above technical problems.

[0006] In a first aspect, the present application provides a communication authentication method applied to a user equipment (UE), comprising:

[0007] If the subscription identification information of the GBA service is queried locally, the target subscriber identity card of the GBA service is determined from the multiple subscriber identity cards of the UE according to the queried subscription identification information, and the IMPI information of the target subscriber identity card is acquired.

[0008] The GBA authentication request carrying the IMPI information is sent to a binding support function (BSF) network element, wherein the GBA authentication request is used to instruct the BSF network element to perform GBA authentication.

[0009] In one embodiment, if the subscription identification information of the GBA service is queried locally, the method further comprises, before the target subscriber identity card of the GBA service is determined from the multiple subscriber identity cards of the UE according to the queried subscription identification information:

[0010] In the process of performing the VoLTE registration procedure based on the certain subscriber identity card of the multiple subscriber identity cards of the UE, the subscription identification information sent by the network side when the certain subscriber identity card is determined to have subscribed to the GBA service is received.

[0011] The subscription identification information and the subscription correspondence of the certain subscriber identity card are stored locally.

[0012] In one embodiment, the subscription identification information sent by the network side when the certain subscriber identity card is determined to have subscribed to the GBA service is received, comprising:

[0013] The subscription identification information sent by the serving call session control function (S-CSCF) through a 200 OK message is received, wherein the subscription identification information sent by the S-CSCF is sent to the S-CSCF by the home subscriber server (HSS) when the certain subscriber identity card is determined to have subscribed to the GBA service.

[0014] In one embodiment, the target subscriber identity card of the GBA service is determined from the multiple subscriber identity cards of the UE according to the queried subscription identification information, comprising:

[0015] The subscription correspondence stored locally is queried according to the queried subscription identification information, and the target subscriber identity card is determined according to the query result.

[0016] In one embodiment, the target subscriber identity card is determined according to the query result, comprising:

[0017] If there is one subscription identification information, the queried subscriber identity card corresponding to the one subscription identification information is taken as the target subscriber identity card.

[0018] If multiple contract identification information exists, the user identification card in mobile connection status among the multiple user identification cards corresponding to the multiple contract identification information will be used as the target user identification card.

[0019] Secondly, this application provides a communication authentication method applied to S-CSCF, including:

[0020] During the VoLTE registration process of one of the multiple user identification cards based on the UE, subscription identification information is sent to the UE;

[0021] The subscription identifier information is sent after it is determined that a user identification card has subscribed to GBA services. The subscription identifier information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0022] In one embodiment, before sending subscription identification information to the UE, the method further includes:

[0023] Send a contract data acquisition request to HSS carrying IMPI information of a certain user identification card;

[0024] Receive subscription data carrying subscription identification information sent by HSS when it is determined from IMPI information that a user identification card has subscribed to GBA services.

[0025] Thirdly, this application provides a communication authentication method applied to HSS, including:

[0026] During the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, a subscription data acquisition request carrying the IMPI information of the user identification card is received from the S-CSCF.

[0027] Based on the IMPI information, a user identification card that has subscribed to GBA services is identified. Based on the subscription data acquisition request, subscription data carrying subscription identification information is sent to the S-CSCF, so that the S-CSCF sends subscription identification information to the UE. The subscription identification information is used to instruct the UE to identify the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card, so as to send a GBA authentication request carrying IMPI information to the BSF network element.

[0028] Fourthly, this application also provides a communication authentication device, which includes:

[0029] The processing module is used to query the subscription identifier information of the General Bootstrap Architecture (GBA) service locally, determine the target user identification card that has subscribed to the GBA service from multiple user identification cards of the UE based on the queried subscription identifier information, and obtain the user private identifier (IMPI) information of the target user identification card.

[0030] The sending module is used to send a GBA authentication request carrying IMPI information to the BSF network element that is bound to the supported functions; wherein, the GBA authentication request is used to instruct the BSF network element to perform GBA authentication.

[0031] Fifthly, this application also provides another communication authentication device, which includes:

[0032] The sending module is used to send subscription identification information to the UE during the VoLTE registration process of one of the multiple UE-based UE SIM cards.

[0033] The subscription identifier information is sent after it is determined that a user identification card has subscribed to GBA services. The subscription identifier information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0034] Sixthly, this application also provides another communication authentication device, which includes:

[0035] The receiving module is used to receive a subscription data acquisition request sent by the S-CSCF carrying the IMPI information of a certain user identification card during the VoLTE registration process of a certain user identification card among multiple user identification cards based on the UE.

[0036] The sending module is used to determine a user identification card that has subscribed to GBA services based on the IMPI information, and send subscription data carrying subscription identification information to the S-CSCF according to the subscription data acquisition request, so that the S-CSCF sends subscription identification information to the UE; wherein, the subscription identification information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from the multiple user identification cards of the UE during the execution of the GBA authentication process, and obtain the IMPI information of the target user identification card, so as to send a GBA authentication request carrying IMPI information to the BSF network element.

[0037] In a seventh aspect, this application also provides a communication device, comprising: a transmitter, a receiver, a processor, and a memory, wherein the memory stores a computer program; and the processor executes the computer program to implement the steps of the method of any one of the first to third aspects described above.

[0038] Eighthly, this application also provides a computer-readable storage medium. This computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the method described in any one of the first to third aspects.

[0039] Ninthly, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the method of any one of the first to third aspects described above.

[0040] In the aforementioned communication authentication method, apparatus, communication equipment, and storage medium, if the UE finds the subscription identifier information of the General Bootstrap Architecture (GBA) service locally, it determines the target UE that has subscribed to the GBA service from multiple UEs based on the found subscription identifier information and obtains the target UE's User Private Identifier (IMPI) information; then, it sends a GBA authentication request carrying the IPI information to the Binding Support Function (BSF) network element; wherein the GBA authentication request is used to instruct the BSF network element to perform GBA authentication. This application, by querying the GBA service subscription identifier information stored locally by the UE, can determine the target UE that needs to be authenticated from multiple UEs, and then send the target UE's IPI information to the BSF network element, thereby enabling GBA authentication when the UE uses multiple UEs. Attached Figure Description

[0041] Figure 1 This is a diagram illustrating an application scenario of the communication authentication method in one embodiment;

[0042] Figure 2 This is a flowchart illustrating a communication authentication method in one embodiment;

[0043] Figure 3 This is a schematic diagram of the process of receiving contract identifier information in one embodiment;

[0044] Figure 4 This is a flowchart illustrating the communication authentication method in another embodiment;

[0045] Figure 5 This is a flowchart illustrating the communication authentication method in yet another embodiment;

[0046] Figure 6 This is a schematic diagram of the VoLTE service registration process in one embodiment;

[0047] Figure 7 This is a schematic diagram of the GBA authentication process in one embodiment;

[0048] Figure 8This is a structural block diagram of a communication authentication device in one embodiment;

[0049] Figure 9 This is a structural block diagram of a communication authentication device in another embodiment;

[0050] Figure 10 This is a structural block diagram of another communication authentication device in one embodiment;

[0051] Figure 11 This is a structural block diagram of another communication authentication device in one embodiment. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0053] The communication authentication method provided in this application embodiment can be applied to, for example... Figure 1 In the application scenario shown, the BSF network element acts as the anchor point in the entire GBA architecture. It obtains the authentication vector from the HSS / UDM to verify the UE and uses the AKA (Authentication and Key Agreement) mechanism to generate a shared key with the HSS / UDM. The NAF (Network Application Function) server guides the application through GBA authentication and obtains the shared key from the BSF network element to generate a secure communication session key between the application client and the NAF server. The HSS generates the AKA authentication vector and authenticates the UE and USIM (Universal Subscriber Identity Module). The UE is used to install the application client, and the USIM is used to generate the shared key and the application's external key.

[0054] In one embodiment, such as Figure 2 As shown, a communication authentication method is provided, applied to a user equipment (UE), comprising the following steps:

[0055] S201. If the subscription identifier information of the General Bootstrap Architecture (GBA) service is found locally, the target user identification card that has subscribed to the GBA service is determined from the multiple user identification cards of the UE based on the subscribed identifier information, and the user private identifier (IMPI) information of the target user identification card is obtained.

[0056] When the client and application server negotiate to use GBA service for authentication, the UE, as the client, queries whether there is a GBA service subscription identifier information locally.

[0057] Among them, UE can be a user equipment that uses multiple SIM cards; the subscription identification information for GBA services can be related information such as indicator identifiers.

[0058] Specifically, the subscription identifier information for GBA services is used to identify that among the multiple user identification cards used by the UE, there is a user identification card that has subscribed to GBA services, that is, the UE has subscribed to GBA services; the subscription identifier information for GBA services can be sent to the UE during the execution of the UE's VoLTE registration process.

[0059] If the pre-stored subscription identifier information of the GBA service is found locally, the corresponding user identification card for the subscribed GBA service is determined based on the found subscription identifier information, and that card is used as the target user identification card.

[0060] The subscription identification information can be represented by "0" or "1" to indicate whether a GBA service has been subscribed. It's understood that there is a one-to-one correspondence between the subscription identification information and the user identification card.

[0061] Furthermore, a command to obtain GBA parameters is sent to the target user identification card slot to obtain the GBA parameters of the target user identification card, such as IMPI information.

[0062] S202, send a GBA authentication request carrying IMPI information to the BSF network element that supports the binding function.

[0063] Among them, the IMPI information is the IMPI information of the target user identification card, and the GBA authentication request is used to instruct the BSF network element to perform GBA authentication.

[0064] For example, the BSF network element obtains the GBA authentication vector from the HSS to perform the GBA two-way authentication process for the UE.

[0065] In the above scheme, if the UE finds the subscription identifier information for the General Bootstrap Architecture (GBA) service locally, it determines the target UE that has subscribed to the GBA service from multiple UEs based on the found subscription identifier information and obtains the target UE's User Private Identifier (IMPI) information. Then, it sends a GBA authentication request carrying the IPI information to the BSF (Binding Support Function) network element. The GBA authentication request instructs the BSF network element to perform GBA authentication. By querying the GBA service subscription identifier information stored locally on the UE, the target UE that needs GBA authentication can be determined from multiple UEs, and the IPI information of the target UE is sent to the BSF network element, thus enabling GBA authentication even when the UE uses multiple UEs.

[0066] As an optional implementation method in this embodiment, the contract correspondence relationship stored locally can be queried based on the queried contract identifier information, and the target user identification card can be determined based on the query results.

[0067] The contract correspondence refers to the correspondence between contract identification information, MSISDN number, and card slot information.

[0068] Based on the retrieved subscription identifier information, the corresponding MSISDN number of the user identification card and the card slot information of the user identification card are determined. Then, based on the MSISDN number and card slot information of the user identification card, the user identification card that has signed up for the GBA service can be identified and used as the target user identification card.

[0069] The MSISDN number is the telephone number, and the card slot information can be represented as "card slot 1" and "card slot 2" to distinguish the card slot information of different user identification cards. The correspondence between the subscription identification information, the MSISDN number, and the card slot information is unique.

[0070] Understandably, based on the pre-stored subscription correspondence, it is possible to determine the target user identification card that has subscribed to GBA services among UEs using multiple user identification cards, thereby obtaining the IMPI information of the target user identification card, effectively avoiding the situation where GBA authentication fails due to inconsistent IMPI information.

[0071] Optionally, if there is a single contract identifier, the user identification card corresponding to that contract identifier will be used as the target user identification card; if there are multiple contract identifiers, the user identification card in mobile connection status among the multiple user identification cards corresponding to each of the multiple contract identifiers will be used as the target user identification card.

[0072] For example, if both user identification cards (SIM cards) used by the UE are subscribed to GBA services, the subscription identification information for both GBA services will be retrieved locally. In this case, the SIM card in mobile connection state, i.e., the SIM card currently in use, will be selected as the target SIM card.

[0073] This effectively avoids the situation where, during GBA authentication, the existence of multiple GBA service subscription identifiers makes it impossible to determine which GBA service's user identification card's IMPI information to obtain, thus affecting GBA authentication.

[0074] In order to retrieve the subscription identifier information of the GBA service locally and thus determine which user identification card's IMPI information to obtain, based on the above embodiments, in one embodiment, the subscription identifier information of the GBA service can be received during the VoLTE registration process, thereby refining the above communication authentication method. For example... Figure 3 As shown, the specific steps may include:

[0075] S301, during the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, the network side receives subscription identification information sent when it determines that the user identification card has subscribed to GBA services.

[0076] During the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, specifically, when the UE and S-CSCF complete the two-way authentication in the VoLTE registration process of a user identification card, the UE will receive the subscription identifier information sent by the network side.

[0077] The network side includes HSS, S-CSCF, and P-CSCF. When HSS determines that a user identification card has subscribed to GBA services, it sends subscription identification information to S-CSCF, which then sends subscription identification information to P-CSCF. Finally, P-CSCF sends the subscription identification information to UE.

[0078] For example, after two-way authentication is successful in the VoLTE registration process of a user identification card, the S-CSCF sends a SAR message to the HSS to request the download of the UE's subscription data; correspondingly, the HSS checks that a user identification card has subscribed to GBA services, and then sends an SAA message carrying subscription identification information to the S-CSCF based on the SAR message.

[0079] In an optional embodiment, the UE may receive subscription identification information sent by the Service Call Session Control Function (S-CSCF) via a 200 OK message.

[0080] It is understandable that the subscription identification information sent by the S-CSCF is sent to the S-CSCF by the Home Subscriber Server (HSS) when it determines that a user identification card has subscribed to GBA services. The S-CSCF then sends a 200 OK message carrying the subscription identification information to the P-CSCF, and the P-CSCF sends a 200 OK message carrying the subscription identification information to the UE. Specifically, this subscription identification information can be carried in the P-Associated-URI header field.

[0081] S302, store the contract identification information and the contract correspondence of a user identification card locally.

[0082] Establish a mapping relationship between the subscription identifier information, MSISDN number and card slot information of a certain user identification card, thereby forming a subscription correspondence relationship of a certain user identification card, and store the subscription identifier information and the subscription correspondence relationship of a certain user identification card locally.

[0083] In this way, when performing GBA service authentication on the client, the target user identification card in the UE using multiple user identification cards can be determined based on the subscription correspondence pre-stored locally, thereby obtaining the IMPI information of the target user identification card, effectively avoiding the situation where GBA authentication fails due to inconsistent IMPI information.

[0084] In one embodiment, such as Figure 4 As shown, a communication authentication method is provided, applied to S-CSCF, including the following steps:

[0085] S401, During the VoLTE registration process of one of the multiple user identification cards based on the UE, subscription identification information is sent to the UE.

[0086] During the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, specifically, after the UE and S-CSCF complete the two-way authentication in the VoLTE registration process of a user identification card, the S-CSCF sends subscription identification information to the P-CSCF, and further, the P-CSCF sends the subscription identification information to the UE.

[0087] It should be noted that the subscription identification information sent by S-CSCF is sent by HSS to S-CSCF when it determines that a user identification card has subscribed to GBA services.

[0088] In an optional embodiment, in order to obtain subscription identification information from the HSS and then send the subscription identification information to the UE, a subscription data acquisition request can be actively sent to the HSS during the VoLTE registration process to obtain subscription data carrying subscription identification information.

[0089] For example, a request to acquire subscription data carrying IMPI information of a user identification card is sent to the HSS, and then the subscription data carrying subscription identification information is received by the HSS when it is determined from the IMPI information that the user identification card has been subscribed to GBA services.

[0090] The subscription data acquisition request can be a SAR message, used to request the download of the UE's subscription data; the subscription data can be sent via a SAA message. The IMPI information of a specific user identification card carried in the subscription data acquisition request is used by the HSS to check whether the user identification card has subscribed to GBA services.

[0091] Optionally, the S-CSCF and P-CSCF send subscription identification information via a 200 OK message, such as by including the subscription identification information in the P-Associated-URI header field.

[0092] In this embodiment, the subscription identifier information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0093] The above scheme involves sending subscription identifier information to the UE during the VoLTE registration process of a specific UE among multiple UE SIM cards. This allows the UE to determine the target UE with a subscribed GBA service based on the subscription identifier information during the GBA authentication process, and to obtain the target UE's IMPI information. The UE then sends a GBA authentication request carrying the IMPI information to the BSF network element. By sending the subscription identifier information to the UE during the VoLTE registration process of a specific UE SIM card, and storing it locally, the scheme avoids the situation where the UE cannot determine which UE SIM card's IMPI information to obtain during GBA authentication, thus preventing any issues that could affect GBA authentication.

[0094] In one embodiment, such as Figure 5 As shown, a communication authentication method is provided, applied to HSS, including the following steps:

[0095] S501, during the VoLTE registration process of a certain user identification card among multiple user identification cards based on the UE, a subscription data acquisition request carrying the IMPI information of the certain user identification card is received from the S-CSCF.

[0096] During the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, specifically, after the UE and S-CSCF have completed the two-way authentication in the VoLTE registration process of the user identification card, the UE receives a subscription data acquisition request sent by the S-CSCF carrying the IMPI information of the user identification card.

[0097] The subscription data acquisition request can be a SAR message, used to request the download of the UE's subscription data.

[0098] S502: Based on the IMPI information, determine a user identification card that has subscribed to GBA services, and based on the subscription data acquisition request, send subscription data carrying subscription identification information to the S-CSCF, so that the S-CSCF sends subscription identification information to the UE.

[0099] Based on the IMPI information of a user identification card carried in the subscription data acquisition request, check whether the user identification card has subscribed to GBA services. If it has not subscribed to GBA services, perform the normal VoLTE registration process; if it has subscribed to GBA services, send subscription data carrying subscription identification information to the S-CSCF according to the subscription data acquisition request, so that the S-CSCF can send subscription identification information to the UE.

[0100] Specifically, the contract data can be sent via SAA messages.

[0101] The S-CSCF sends subscription identification information to the UE, either by sending the subscription identification information to the P-CSCF, which then sends the subscription identification information to the UE. Optionally, the S-CSCF and P-CSCF send the subscription identification information via a 200 OK message, such as by including the subscription identification information in the P-Associated-URI header field.

[0102] In this embodiment, the subscription identifier information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0103] The above scheme, during the VoLTE registration process of a user identification card (UIC) among multiple UICs based on the UE, receives a subscription data retrieval request from the S-CSCF carrying the IMPI information of that UIC. Further, based on the IMPI information, it identifies the UIC that has subscribed to GBA services and, according to the subscription data retrieval request, sends subscription data carrying subscription identifier information to the S-CSCF, enabling the S-CSCF to send the subscription identifier information to the UE. By sending the subscription identifier information to the UE during the VoLTE registration process of a UIC among multiple UICs based on the UE, and allowing the UE to store it locally, the scheme avoids the situation where, during GBA authentication, it is impossible to determine which UIC's IMPI information to retrieve, thus affecting GBA authentication.

[0104] In one embodiment, such as Figure 6 The VoLTE service registration flowchart shown below, and Figure 7 The GBA authentication flowchart shown provides an optional example of a communication authentication method. The specific process is as follows:

[0105] VoLTE service registration process:

[0106] The first step involves interaction between the UE, P-CSCF, S-CSCF, and HSS to achieve two-way authentication in the VoLTE registration process.

[0107] Specifically, the UE sends a REGISTER message to the P-CSCF, which forwards the REGISTER message to the S-CSCF. The S-CSCF then sends a MAR message to the HSS. Based on the MAR message, the HSS sends a MAA message to the S-CSCF, which in turn sends a 401 message to the P-CSCF. The P-CSCF then forwards the 401 message to the UE. The UE then authenticates with the network. If the network authentication is successful, the UE sends a REGISTER message to the P-CSCF, which forwards the REGISTER message to the S-CSCF. The S-CSCF then authenticates with the UE.

[0108] In the second step, after completing the two-way authentication in the VoLTE registration process, the S-CSCF sends a SAR message carrying the IMPI information of the user identification card to the HSS to request the download of the UE's subscription data.

[0109] The third step involves HSS checking whether the user identification card corresponding to the VoLTE registration process has signed up for GBA services based on the subscription identifier information.

[0110] The fourth step is to send an SAA message carrying the subscription identification information to the S-CSCF if the user identification card has been subscribed to the GBA service.

[0111] In the fifth step, the S-CSCF sends the subscription identifier information to the P-CSCF via a 200 OK message.

[0112] In the sixth step, the P-CSCF sends the subscription identifier information to the UE via a 200 OK message.

[0113] The seventh step involves the UE storing the mapping relationship between the subscriber identification card's subscription identifier information, MSISDN, and card slot information locally.

[0114] GBA authentication process:

[0115] The first step is for the UE to query whether there is a subscription identifier for the GBA service locally.

[0116] The second step is to query the card slot information corresponding to the subscription identifier information if there is a subscription identifier information for GBA services.

[0117] The third step is to send a command to the interface of the user identification card corresponding to the card slot information in order to obtain the IMPI information of the user identification card.

[0118] The fourth step is for the UE to send a GBA authentication request carrying the IMPI information of the user identification card to the BSF network element.

[0119] The fifth step is for the BSF network element to obtain the GBA authentication vector from the HSS.

[0120] The sixth step involves the UE and BSF network elements completing GBA two-way authentication based on the GBA authentication vector.

[0121] The specific process of the above steps can be found in the description of the above method embodiments. The implementation principle and technical effect are similar, and will not be repeated here.

[0122] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0123] Based on the same inventive concept, this application also provides a communication authentication device for implementing the communication authentication method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more communication authentication device embodiments provided below can be found in the limitations of the communication authentication method described above, and will not be repeated here.

[0124] In one embodiment, such as Figure 8 As shown, a communication authentication device 1 is provided, comprising: a processing module 10 and a sending module 20, wherein:

[0125] The processing module 10 is used to query the subscription identifier information of the General Bootstrap Architecture (GBA) service locally, determine the target user identification card that has subscribed to the GBA service from multiple user identification cards of the UE based on the queried subscription identifier information, and obtain the user private identifier (IMPI) information of the target user identification card.

[0126] The sending module 20 is used to send a GBA authentication request carrying IMPI information to the BSF network element that is bound to the support function.

[0127] The GBA authentication request is used to instruct BSF network elements to perform GBA authentication.

[0128] In one embodiment, in Figure 8 On the basis of, such as Figure 9 As shown, the communication authentication device 1 may further include:

[0129] The receiving module 30 is used to receive subscription identification information sent by the network side when determining that a certain user identification card has subscribed to GBA services during the VoLTE registration process of a certain user identification card among multiple user identification cards based on the UE.

[0130] Storage module 40 is used to store the contract identification information and the contract correspondence of a user identification card locally.

[0131] In one embodiment, the receiving module 30 is specifically used for:

[0132] The subscription identification information sent by the Service Call Session Control Function (S-CSCF) via a 200 OK message is received.

[0133] The subscription identification information sent by S-CSCF is sent to S-CSCF by the Home Subscriber Server (HSS) when it determines that a user identification card has subscribed to GBA services.

[0134] In one embodiment, the processing module 10 is specifically used for:

[0135] Based on the retrieved contract identifier information, query the locally stored contract correspondence and determine the target user identification card based on the query results.

[0136] Specifically, if there is a single contract identifier, the user identification card corresponding to that contract identifier will be used as the target user identification card; if there are multiple contract identifiers, the user identification card in mobile connection status among the multiple user identification cards corresponding to each of the multiple contract identifiers will be used as the target user identification card.

[0137] In one embodiment, such as Figure 10 As shown, a communication authentication device 2 is provided, comprising: a sending module 10, wherein:

[0138] The sending module 10 is used to send subscription identification information to the UE during the VoLTE registration process of a user identification card among multiple user identification cards based on the UE.

[0139] The subscription identifier information is sent after it is determined that a user identification card has subscribed to GBA services. The subscription identifier information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0140] In one embodiment, the communication authentication device 2 may further include:

[0141] The request sending module is used to send a contract data acquisition request carrying IMPI information of a user identification card to the HSS.

[0142] The module is used to receive subscription data carrying subscription identification information sent by HSS when it is determined from IMPI information that a user identification card has subscribed to GBA services.

[0143] In one embodiment, such as Figure 11 As shown, a communication authentication device 3 is provided, comprising: a receiving module 10 and a transmitting module 20, wherein:

[0144] The receiving module 10 is used to receive a subscription data acquisition request sent by the S-CSCF carrying the IMPI information of a certain user identification card during the VoLTE registration process of a certain user identification card among multiple user identification cards based on the UE.

[0145] The sending module 20 is used to determine a user identification card that has subscribed to GBA services based on the IMPI information, and send subscription data carrying subscription identification information to the S-CSCF according to the subscription data acquisition request, so that the S-CSCF sends subscription identification information to the UE.

[0146] The subscription identifier information is used to instruct the UE to identify the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0147] Each module in the aforementioned communication authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0148] In one embodiment, a communication device is provided, comprising a transmitter, a receiver, a processor, and a memory, the memory storing a computer program. The processor of the communication device provides computing and control capabilities, and when executing the computer program, it implements the steps described in the above method embodiments. The memory of the communication device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the communication device is used for communication with external terminals via a network connection.

[0149] In one embodiment, a communication device is provided, including a transmitter, a receiver, a processor, and a memory. The memory stores a computer program. The processor executes the computer program to query the subscription identifier information of a General Bootstrap Architecture (GBA) service locally, and based on the queried subscription identifier information, determines the target user identification card that has subscribed to the GBA service from multiple user identification cards of the UE, and obtains the user private identifier (IMPI) information of the target user identification card. The transmitter is used to send a GBA authentication request carrying the IMPI information to a Binding Support Function (BSF) network element. The GBA authentication request is used to instruct the BSF network element to perform GBA authentication.

[0150] In one embodiment, a communication device is provided, including a transmitter, a receiver, a processor, and a memory, the memory storing a computer program; the transmitter is used to send subscription identification information to the UE during the VoLTE registration process of a certain user identification card among multiple user identification cards of the UE; wherein, the subscription identification information is sent after determining that a certain user identification card has subscribed to GBA services, and the subscription identification information is used to instruct the UE, during the execution of the GBA authentication process, to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE, and to obtain the IMPI information of the target user identification card, so as to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0151] In one embodiment, a communication device is provided, including a transmitter, a receiver, a processor, and a memory, the memory storing a computer program; the receiver is configured to receive a subscription data acquisition request carrying IMPI information of a certain user identification card sent by an S-CSCF during the VoLTE registration process of a user identification card among multiple user identification cards of a UE; the transmitter is configured to determine a user identification card that has subscribed to GBA services based on the IMPI information, and send subscription data carrying subscription identification information to the S-CSCF according to the subscription data acquisition request, so that the S-CSCF sends subscription identification information to the UE; wherein, the subscription identification information is used to instruct the UE, during the execution of the GBA authentication process, to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE, and obtain the IMPI information of the target user identification card, so as to send a GBA authentication request carrying the IMPI information to the BSF network element.

[0152] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the communication authentication method described above.

[0153] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the communication authentication method described above.

[0154] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0155] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0156] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A communication authentication method applied to a user equipment (UE), characterized in that, include: If the subscription identifier information of the General Bootstrap Architecture (GBA) service is found locally, the target user identification card that has subscribed to the GBA service is determined from the multiple user identification cards of the UE based on the found subscription identifier information, and the user private identifier (IMPI) information of the target user identification card is obtained. Send a GBA authentication request carrying the IMPI information to the BSF network element that supports binding functions; wherein the GBA authentication request is used to instruct the BSF network element to perform GBA authentication.

2. The method according to claim 1, characterized in that, If the subscription identifier information for the General Bootstrap Architecture (GBA) service is found locally, before determining the target user identification card that has subscribed to the GBA service from among the multiple user identification cards of the UE based on the found subscription identifier information, the method further includes: During the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, the user identification card receives subscription identification information sent by the network side when it determines that the user identification card has subscribed to GBA services. The contract identification information and the contract correspondence between the user identification card are stored locally.

3. The method according to claim 2, characterized in that, The subscription identification information sent by the receiving network side when determining that a certain user identification card has subscribed to GBA services includes: The Service Call Session Control Function (S-CSCF) receives subscription identification information via a 200 OK message; wherein, the subscription identification information sent by the S-CSCF is sent to the S-CSCF by the Home Subscriber Server (HSS) when it determines that a certain user identification card has subscribed to GBA services.

4. The method according to claim 2, characterized in that, The step of determining the target user identification card that has subscribed to the GBA service from multiple user identification cards of the UE based on the queried subscription identifier information includes: Based on the retrieved contract identifier information, query the locally stored contract correspondence and determine the target user identification card based on the query results.

5. The method according to claim 4, characterized in that, The step of determining the target user identification card based on the query results includes: If a contract identifier exists, the user identification card corresponding to the contract identifier will be used as the target user identification card. If multiple contract identification information exists, the user identification card in mobile connection state among the multiple user identification cards corresponding to the multiple contract identification information will be used as the target user identification card.

6. A communication authentication method applied to S-CSCF, characterized in that, include: During the VoLTE registration process of one of the multiple user identification cards based on the UE, subscription identification information is sent to the UE; The subscription identification information is sent after it is determined that a certain user identification card has subscribed to GBA services. The subscription identification information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

7. The method according to claim 6, characterized in that, Before sending the subscription identifier information to the UE, the method further includes: Send a subscription data acquisition request carrying the IMPI information of the user identification card to the HSS; The system receives subscription data carrying subscription identification information sent by the HSS when it determines, based on the IMPI information, that a certain user identification card has subscribed to GBA services.

8. A communication authentication method applied to HSS, characterized in that, include: During the VoLTE registration process of a user identification card among multiple user identification cards based on the UE, a subscription data acquisition request carrying the IMPI information of the user identification card is received from the S-CSCF. Based on the IMPI information, a user identification card that has subscribed to GBA services is identified, and based on the subscription data acquisition request, subscription data carrying subscription identification information is sent to the S-CSCF, so that the S-CSCF sends the subscription identification information to the UE; wherein, the subscription identification information is used to instruct the UE, during the execution of the GBA authentication process, to identify the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE, and to obtain the IMPI information of the target user identification card, so as to send a GBA authentication request carrying the IMPI information to the BSF network element.

9. A communication authentication device, characterized in that, include: The processing module is used to query the subscription identifier information of the General Bootstrap Architecture (GBA) service locally, determine the target user identification card that has subscribed to the GBA service from multiple user identification cards of the UE based on the queried subscription identifier information, and obtain the user private identifier (IMPI) information of the target user identification card. The sending module is used to send a GBA authentication request carrying the IMPI information to the BSF network element that is bound to the support function; wherein the GBA authentication request is used to instruct the BSF network element to perform GBA authentication.

10. A communication authentication device, characterized in that, include: The sending module is used to send subscription identification information to the UE during the VoLTE registration process of one of the multiple user identification cards based on the UE. The subscription identification information is sent after it is determined that a certain user identification card has subscribed to GBA services. The subscription identification information is used to instruct the UE to determine the target user identification card that has subscribed to GBA services from among the multiple user identification cards of the UE during the execution of the GBA authentication process, and to obtain the IMPI information of the target user identification card in order to send a GBA authentication request carrying the IMPI information to the BSF network element.

11. A communication authentication device, characterized in that, include: The receiving module is used to receive a subscription data acquisition request sent by the S-CSCF carrying the IMPI information of a certain user identification card during the VoLTE registration process of a certain user identification card among multiple user identification cards based on the UE. The sending module is configured to determine the subscriber identification card that has subscribed to GBA services based on the IMPI information, and send subscription data carrying subscription identification information to the S-CSCF according to the subscription data acquisition request, so that the S-CSCF sends the subscription identification information to the UE; wherein, the subscription identification information is used to instruct the UE to determine the target subscriber identification card that has subscribed to GBA services from multiple subscriber identification cards of the UE during the execution of the GBA authentication process, and obtain the IMPI information of the target subscriber identification card, so as to send a GBA authentication request carrying the IMPI information to the BSF network element.

12. A communication device, characterized in that, include: A transmitter, a receiver, a processor, and a memory, the memory storing a computer program; the processor, when executing the computer program, implements the steps of the method according to any one of claims 1 to 8.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images