Private network security authentication method, device and system

Abstract

The present application provides a private network security authentication method, device and system. The method includes: the SIM card sends the card information to the business system through the SMS gateway, the business system returns the user information to the SIM card, the first terminal sends an intranet application access request to the private network, the gateway device intercepts the intranet application access request, and redirects the identity authentication link to the first terminal; the first terminal obtains the user information of the SIM card and sends it to the business system through the gateway device. The business system authenticates the first terminal user based on the user information. It realizes the autonomous management of the user's access rights to the business system through the private network on the private network user side, and realizes the identity authentication control on the private network enterprise side.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a private network security authentication method, device and system. Background Art

[0002] At present, operators generally adopt the core network user plane function (UPF) sinking mode to build 5G private networks for industry users. This mode relies on the operator's core network and base stations, and terminal access is opened by the operator. However, for industry users, the completed 5G private network is equivalent to the enterprise intranet. Relying solely on the operator's one-time authentication in the 5G core network is not enough to meet the access security needs of industry users. In particular, for scenarios with high security levels for individual user access such as the party, government, military, public security, procuratorial, judicial, and financial sectors, relying solely on operators for security access management is far from meeting the needs of industry users.

[0003] The current 5G private network construction plan relies on the operator's core network and base stations. Terminal access is activated by the operator, and data contracts are configured on the operator side. For industry users, it is impossible to independently manage users' access rights to business systems through 5G private networks. Summary of the invention

[0004] The present application provides a private network security authentication method, device and system to realize autonomous management of user access rights to a business system through a private network. The technical solution of the present application is as follows:

[0005] In a first aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a SIM card and includes:

[0006] In response to triggering the card information reporting operation,

[0007] In response to triggering the card information reporting operation, sending a first data SMS to the business system through the SMS gateway, wherein the first data SMS includes the card information;

[0008] Receiving a second data SMS sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS; wherein the user information includes a mobile phone number;

[0009] A first instruction sent by a first terminal where the SIM card is located is received, and the user information is sent to the first terminal, wherein the first instruction instructs to obtain the user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

[0010] In some implementations, before responding to triggering the card information reporting operation, the step includes:

[0011] Registering with the first terminal to monitor network access events;

[0012] An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

[0013] In some implementations, the sending of a first data SMS to a service system through a SMS gateway, wherein the first data SMS includes card information, includes:

[0014] Read the card information and assemble the card information into a response data packet of the first data SMS;

[0015] The first data SMS is sent to the business system through the SMS gateway.

[0016] In some implementations, the receiving a second data SMS sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS, includes:

[0017] receiving a second data SMS sent by the business system and forwarded by the SMS gateway; wherein the second data SMS includes an application command message, and the application command message includes the user information;

[0018] Decrypting the second data SMS message to obtain SMS content in the application command message;

[0019] Parse the text message content, obtain and store the user information.

[0020] In some implementations, sending the user information to the first terminal includes:

[0021] Establishing a secure access channel with the first terminal;

[0022] Reading user information; and encrypting the user information to obtain a ciphertext of the user information;

[0023] The user information ciphertext is sent to the first terminal through the secure access channel.

[0024] In some implementations, the response data packet includes a card application major version number, a security parameter identifier definition, an application response data packet and a MAC, the application response data packet includes the card information, and the security parameter identifier includes an encryption identifier and an environment identifier.

[0025] In some implementations, storing the user information includes:

[0026] The user information is stored in the secure storage space of the SIM card.

[0027] In a second aspect, an embodiment of the present application provides a private network security authentication method, the method is applied to a first terminal, the first terminal includes a SIM card; the method includes:

[0028] Sending an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system;

[0029] Receive an identity authentication link redirected by a gateway device, and send a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain the user information, the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number;

[0030] Receive the user information sent by the SIM card, and send first information to the service system through the gateway device; wherein the first information includes user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

[0031] In some implementations, before the first terminal sends the intranet application access request to the private network, the process includes:

[0032] The first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

[0033] In some implementations, the method further includes:

[0034] Receive a network access event monitoring registration request sent by the SIM card.

[0035] In a third aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a gateway device and includes:

[0036] Intercepting an intranet application access request sent by the first terminal to the private network, and redirecting the identity authentication link to the first terminal; wherein the first terminal includes a subscriber identity module SIM card, and the intranet application access request indicates access to a business system;

[0037] Receive first information sent by the first terminal, and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, and the user information includes a mobile phone number. The first terminal requests the business system to perform identity authentication on the first terminal user based on the user information.

[0038] In a fourth aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a business system in a private network, including:

[0039] Receiving a first data SMS sent by the subscriber identity module SIM card through the SMS gateway, wherein the first data SMS includes card information;

[0040] Based on the first data SMS, obtain the mobile phone number and the card information corresponding to the SIM card, and record the binding relationship between the card information and the mobile phone number;

[0041] Sending a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number;

[0042] Receive first information sent by a first terminal where the SIM card is located through a gateway device, and perform identity authentication on a user of the first terminal based on user information in the first information.

[0043] In a fifth aspect, an embodiment of the present application provides a private network security authentication system, including a SIM card, a first terminal where the SIM card is located, a short message gateway, a gateway device, and a service system.

[0044] The SIM card is configured to execute the private network security authentication method according to the first aspect;

[0045] The first terminal where the SIM card is located is configured to execute the private network security authentication method described in the second aspect;

[0046] The gateway device is configured to execute the private network security authentication method according to the third aspect;

[0047] The business system is configured to execute the private network security authentication method described in the fourth aspect.

[0048] In a sixth aspect, an embodiment of the present application provides a private network security authentication device, the device being configured on a SIM card, comprising:

[0049] A card information reporting module, configured to send a first data SMS to a business system through an SMS gateway in response to triggering a card information reporting operation, wherein the first data SMS includes card information;

[0050] The card information reporting module is further used to receive a second data SMS sent by the business system through the SMS gateway, and based on the second data SMS, obtain and store user information; wherein the user information includes a mobile phone number;

[0051] The transceiver module is used to receive a first instruction sent by the first terminal where the SIM card is located, and send the user information to the first terminal, wherein the first instruction instructs to obtain the user information, and the first terminal requests the service system to perform identity authentication on the user of the first terminal based on the user information.

[0052] In some implementations, the card information reporting module is further used to:

[0053] Registering with the first terminal to monitor network access events;

[0054] An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

[0055] In some implementations, the card information reporting module is specifically used to:

[0056] Read the card information and assemble the card information into a response data packet of the first data SMS;

[0057] The first data SMS is sent to the business system through the SMS gateway.

[0058] In some implementations, the card information reporting module is specifically used to:

[0059] receiving a second data SMS sent by the business system and forwarded by the SMS gateway; wherein the second data SMS includes an application command message, and the application command message includes the user information;

[0060] Decrypting the second data SMS message to obtain SMS content in the application command message;

[0061] Parse the text message content, obtain and store the user information.

[0062] In some implementations, the transceiver module is specifically configured to:

[0063] Establishing a secure access channel with the first terminal;

[0064] Reading user information; and encrypting the user information to obtain a ciphertext of the user information;

[0065] The user information ciphertext is sent to the first terminal through the secure access channel.

[0066] In some implementations, the response data packet includes a card application major version number, a security parameter identifier definition, an application response data packet and a MAC, the application response data packet includes the card information, and the security parameter identifier includes an encryption identifier and an environment identifier.

[0067] In some implementations, the card information reporting module is specifically used to:

[0068] The user information is stored in the secure storage space of the SIM card.

[0069] In a seventh aspect, an embodiment of the present application provides a private network security authentication device, the device being configured in a first terminal, the first terminal including a SIM card, including:

[0070] A transceiver module, used for sending an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system;

[0071] The transceiver module is further used to receive an identity authentication link redirected by a gateway device, and send a first instruction to the customer identification module SIM card based on the identity authentication link, wherein the first instruction instructs to obtain the user information, the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number;

[0072] The transceiver module is also used to receive the user information sent by the SIM card, and send the first information to the service system through the gateway device; wherein the first information includes user information, and the first terminal requests the service system to authenticate the first terminal user based on the user information.

[0073] In some implementations, the transceiver module is further used to:

[0074] The first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

[0075] In some implementations, the transceiver module is further used to:

[0076] Receive a network access event monitoring registration request sent by the SIM card.

[0077] In an eighth aspect, an embodiment of the present application provides a private network security authentication device, the device being configured in a gateway device, including:

[0078] An access gateway module, used to intercept the intranet application access request sent by the first terminal to the private network, and redirect the identity authentication link to the first terminal; wherein the first terminal includes a customer identification module SIM card, and the intranet application access request indicates access to the business system;

[0079] A control center module is used to receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, and the user information includes a mobile phone number. The first terminal requests the business system to perform identity authentication on the first terminal user based on the user information.

[0080] In a ninth aspect, an embodiment of the present application provides a private network security authentication device, wherein the device is configured in a business system within the private network, including:

[0081] A transceiver module, used for receiving a first data SMS sent by the subscriber identity module SIM card through the SMS gateway, wherein the first data SMS includes card information;

[0082] A processing module, configured to obtain the mobile phone number and the card information corresponding to the SIM card based on the first data SMS, and record the binding relationship between the card information and the mobile phone number;

[0083] The transceiver module is further used to send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number;

[0084] The identity authentication module is used to receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the user of the first terminal based on the user information in the first information.

[0085] In the tenth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the private network security authentication method described in any one of the embodiments of the first to fourth aspects of the present application.

[0086] In the eleventh aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the private network security authentication method described in any one of the embodiments of the first to fourth aspects of the present application.

[0087] In the twelfth aspect, an embodiment of the present application provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the private network security authentication method described in any one of the embodiments of the first to fourth aspects of the present application.

[0088] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0089] The SIM card reports the card information to the business system in the private network, and the user information returned by the business system is stored in the SIM card. When the first terminal where the SIM card is located requests to access the business system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the user's access rights to the business system through the private network, and realize the identity authentication control on the private network enterprise side.

[0090] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application, and do not constitute an improper limitation on the present application.

[0092] Figure 1 The present invention is a flowchart of a private network security authentication method according to an exemplary embodiment.

[0093] Figure 2 The figure is a schematic diagram of the structure of a first data SMS according to an example.

[0094] Figure 3 is a schematic diagram of the structure of a response data packet according to an example.

[0095] Figure 4 It is a schematic diagram of the structure of a second data SMS according to an example.

[0096] Figure 5 It is a schematic diagram of the structure of an application command message according to an example.

[0097] Figure 6 The figure is a flow chart of a private network security authentication method according to another exemplary embodiment.

[0098] Figure 7 The figure is a flow chart of a private network security authentication method according to another exemplary embodiment.

[0099] Figure 8 The figure is a flow chart of a private network security authentication method according to another exemplary embodiment.

[0100] Fig. 9 The figure is a flow chart of a private network security authentication method according to another exemplary embodiment.

[0101] Fig.10 The present invention is a block diagram of a private network security authentication device according to an exemplary embodiment.

[0102] Fig.11 The figure is a block diagram of a private network security authentication device according to another exemplary embodiment.

[0103] Fig.12 The figure is a block diagram of a private network security authentication device according to another exemplary embodiment.

[0104] Fig.13 The figure is a block diagram of a private network security authentication device according to another exemplary embodiment.

[0105] Fig.14 The figure is a block diagram of a private network security authentication system according to another exemplary embodiment.

[0106] Fig.15 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0107] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0108] It should be noted that the terms "first", "second", etc. in this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the application described here can be implemented in an order other than those illustrated or described here. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0109] Since its official commercial use, 5G (5th Generation Mobile Communication Technology) networks have rapidly achieved popularization in the civilian stage. The construction of 5G private networks by operators led by China Mobile in the commercial field has also developed rapidly. With the help of the low latency, high bandwidth, and high capacity of private networks, it is highly in line with the needs of digital transformation. It is a comprehensive integration and improvement of OT (Operation Technology) + IT (Internet Technology) + CT (Communication Technology), which can quickly help traditional industries, vertical public security, rail transit, social departments, etc. to achieve digital transformation.

[0110] 5G private network is a local area network (LAN) that relies on 5G network slicing technology to create an exclusive network connection system for target customers and enterprises with unified connectivity, optimized service functions and guaranteed communication security in a specific area. As an exclusive service, the network's stability, serviceability and security are better guaranteed.

[0111] At present, operators generally adopt the core network user plane function (UPF) sinking mode to build 5G private networks for industry users. This mode relies on the operator's core network and base stations. The terminal access is opened by the operator, and the data contract is configured on the operator side. However, for industry users, the completed 5G private network is equivalent to the enterprise intranet. Only relying on the operator's one-time authentication in the 5G core network is not enough to meet the access security needs of industry users, especially in the high-security level access scenario for individual users. Only relying on the operator for security access management is far from meeting the needs of industry users, and it is impossible to independently manage the access rights of users to access the business system through the 5G private network.

[0112] In order to solve the above problems, the embodiments of the present application provide a private network security authentication method, device and system. By introducing SIM (Subscriber Identity Module) cards and gateway devices as infrastructure and IT support, the secure identity authentication of the 5G private network at the CT layer is realized, and the problems of the inability to authenticate and control the 5G private network enterprise side, the need for frequent logins for secondary user identity control authentication, and low security level are solved.

[0113] Figure 1 The flowchart of a private network security authentication method according to an embodiment of the present application. The method is applied to a private network security authentication system, which includes a SIM card, a first terminal where the SIM card is located, a short message gateway, a gateway device, and a service system in a private network, wherein the short message gateway and the gateway device are gateways of the private network. Figure 1 As shown, the private network security authentication method may include the following steps.

[0114] Step S101, in response to triggering a card information reporting operation, sending a first data SMS to a business system through an SMS gateway, wherein the first data SMS includes card information.

[0115] First of all, it should be noted that the SIM card in the embodiment of the present application is a smart card that supports the ISO / IEC 7816-4 specification and the 3GPP TS31.111 specification. Specifically, it supports APDU (Application Protocol Data Unit) instructions and supports the connection-oriented Bearer Independent Protocol BIP (Bearer Independent Protocol).

[0116] In some embodiments, the SIM card registers with the first terminal where the SIM card is located to monitor network access events; after monitoring the first terminal's first network access authentication passing event, a card information reporting operation is triggered.

[0117] Exemplarily, the SIM card registers a STATUS network access event monitor with the first terminal. When the first terminal passes the private network access authentication, the SIM card detects that the SIM card has successfully accessed the network for the first time, and automatically triggers a card information report, that is, triggers the SIM card to report the card information to the SMS gateway.

[0118] As an implementation manner, a card information reporting module of the SIM card registers with the first terminal where the SIM card is located to monitor the network access event.

[0119] As an implementation method, the SIM card reads the card information, assembles the card information into a response data packet of the first data SMS, and sends the first data SMS to the service system through the SMS gateway.

[0120] The SIM card sends a first data SMS to the SMS gateway. The first data SMS includes a response data packet. The response data packet includes card information. The SMS gateway transparently transmits the card information and the mobile phone number to the business system.

[0121] It should be noted that a data SMS is a digital identifier, which can be understood as an APDU instruction. When the SIM card sends the first data SMS to the business system through the SMS gateway, since the SIM card needs to send SMS to the SMS gateway through the mobile phone number, the gateway port of the SMS gateway can obtain the mobile phone number of the SIM card. That is, when the SIM card is connected to the network, it needs to access the mobile network through the mobile phone number. After receiving the first data SMS, the business system can obtain the mobile phone number corresponding to the SIM card. The mobile phone number is bound to the terminal user. Therefore, the business system can authenticate the terminal user based on the mobile phone number.

[0122] Optionally, the SIM card assembles card information such as the blank card serial number, ICCID (Integrate circuit card identity, i.e., SIM card number), IMSI (International Mobile Subscriber Identity), and SEID (Security Element Identifier) ​​in a response data packet and sends it to the SMS gateway as part of the first data SMS, and the first data SMS is an uplink SMS.

[0123] The SMS gateway receives the first data SMS, namely the card information reporting SMS, and transparently transmits the card information and the mobile phone number to the business system.

[0124] For example, Figure 2 The structure of the first data message is shown. Figure 3 The structure of the response data packet of the first data message is shown. The response data packet includes the card application main version number, security parameter identification definition, application response data packet and MAC (Media Access Control Address, also known as physical address), the application response data packet includes card information, and the security parameter identification includes encryption identification and environment identification.

[0125] Table 1: Uplink SMS response data packet field definition

[0126]

[0127] Table 2: Security parameter identification definitions

[0128]

[0129]

[0130] Step S102, the business system receives a first data SMS sent by a subscriber identity module SIM card through a SMS gateway, obtains the mobile phone number and card information corresponding to the SIM card based on the first data SMS, and records the binding relationship between the card information and the mobile phone number.

[0131] It can be understood that after receiving the first data SMS, the business system can obtain the mobile phone number corresponding to the SIM card, and the business system can bind the received card information with the mobile phone number, and record the binding relationship between the card information and the mobile phone number. In other words, since the empty card serial number, ICCID, IMSI, etc. in the card information are unique, the mobile phone number is bound to these unique card information one by one, and the card information is associated with the mobile phone number through the SIM card, and the SIM card serves as the identity of the terminal user.

[0132] Step S103: the service system sends a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes a mobile phone number.

[0133] It can be understood that the business system assembles the second data SMS carrying the mobile phone number and requests the SMS gateway to send the second data SMS to the SIM card. The SMS gateway sends the second data SMS to the SIM card corresponding to the mobile phone number, and the second data SMS is a downlink SMS.

[0134] In some embodiments, the second data SMS includes an application command message, and the application command message includes a mobile phone number.

[0135] For example, Figure 4 The structure of the second data message is shown. Figure 5 The structure of the application command message of the second data SMS is shown.

[0136] Table 3: Downlink SMS application data APP-DATA field definition

[0137] parameter Length (bytes) value illustrate Tags 1 0x2D Command Type length 1 XX Command length Phone number length 1 XX Maximum supported: 20 bytes Phone number 0－20 XX

[0138] Step S104: The SIM card receives a second data SMS sent by the service system through the SMS gateway, and obtains and stores user information based on the second data SMS.

[0139] As an implementation method, the SIM card receives a second data SMS sent by a service system forwarded by an SMS gateway; decrypts the second data SMS to obtain SMS content in an application command message; and parses the SMS content to obtain and store user information.

[0140] It can be understood that the SIM card receives the second data SMS sent by the business system forwarded by the SMS gateway, performs a message authentication code verification on the second data SMS, decrypts the second data SMS after the verification is passed, obtains the content of the second data SMS, parses the content, extracts user information such as the mobile phone number, and writes the user information into the storage.

[0141] Optionally, the SIM card stores the user information in a secure storage space of the SIM card.

[0142] Step S105: The first terminal sends an intranet application access request to the private network, wherein the intranet application access request indicates access to a business system.

[0143] It should be noted that the terminal corresponds to the private network. For example, when the business system belongs to the intranet application of the 5G private network, the first terminal is the 5G terminal.

[0144] In some embodiments, before the first terminal sends an intranet application access request to the private network, it also includes: the first terminal sends an access request to the private network, and the access request instructs the private network to verify the authority of the first terminal.

[0145] It can be understood that the terminal user accesses the private network through the first terminal, and the operator's core network implements one-time authentication of the private network by allocating a private network IP address. After the authentication is passed, the first terminal sends an intranet application access request to the private network, and the identity authentication verification of the terminal user is triggered when requesting to access the enterprise intranet application.

[0146] In some embodiments, the first terminal receives a registration request for monitoring network access events sent by the SIM card, so that after the SIM card monitors an event that the first terminal passes the first network access authentication for the private network, a card information reporting operation is triggered.

[0147] Step S106: The gateway device intercepts the intranet application access request sent by the first terminal to the private network, and redirects the identity authentication link to the first terminal.

[0148] It can be understood that the gateway device intercepts the private network traffic and initiates the redirection request. Optionally, the access gateway module of the gateway device intercepts the private network traffic and initiates the redirection request.

[0149] Exemplarily, the network traffic of the intranet application access request sent by the first terminal is mirrored to the access gateway module of the gateway device through the switch / router. The access gateway module receives the mirrored intranet application access request from the switch / router, sends a TCP RESET blocking packet to the switch / router, and redirects the identity authentication link (access gateway 8081 port URL) to the first terminal.

[0150] Step S107: The first terminal receives the identity authentication link redirected by the gateway device, and sends a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs obtaining user information.

[0151] It can be understood that when the first terminal sends an intranet application access request to the private network, the gateway device intercepts the intranet application access request sent by the first terminal to the private network and redirects the identity authentication link to the first terminal.

[0152] It can be understood that after receiving the identity authentication link, the first terminal obtains the user information ciphertext from the SIM card.

[0153] Optionally, the first instruction is an APDU instruction, that is, the first terminal sends an APDU instruction to the SIM card, and the APDU instruction instructs to obtain user information.

[0154] Step S108: The SIM card receives the first instruction sent by the first terminal, and sends the user information to the first terminal.

[0155] It can be understood that when a user accesses a private network through a first terminal and requests an enterprise intranet application, user identity verification will be triggered. The first terminal then sends a first instruction request to the SIM card configured therein to obtain user information previously stored in the SIM card.

[0156] As an implementation method, the SIM card establishes a secure access channel with the first terminal; reads the stored user information, encrypts the user information, and obtains the user information ciphertext; and sends the user information ciphertext to the first terminal through the secure access channel.

[0157] Optionally, after receiving the first instruction, the SIM card reads the user information stored in the secure storage space, encrypts the user information by using a preset key in the card, and obtains a ciphertext of the user information.

[0158] Optionally, the key is preset during the SIM card production process and is only shared with the business system to ensure data security.

[0159] Step S109: The first terminal receives the user information sent by the SIM card, and sends first information to the service system through the gateway device; wherein the first information includes the user information.

[0160] In this embodiment, the "information" in the first information may also be a name such as a message, a signaling, or an instruction.

[0161] It should be noted that the user information in the first information is ciphertext of the user information.

[0162] As an implementation method, the first terminal receives the user information ciphertext sent by the SIM card, splices the proxy identity authentication request including the user information ciphertext, accesses the gateway device through the access identity authentication link, and sends the proxy identity authentication request to the control center of the gateway device; wherein the proxy identity authentication request instructs the gateway device to transparently transmit the user information to the business system.

[0163] It can be understood that after the first terminal receives the user information ciphertext, it transparently transmits the user information ciphertext to the business system through the gateway device.

[0164] Step S110: The gateway device receives first information sent by the first terminal, and sends the first information to the service system.

[0165] As an implementation method, the gateway device receives a proxy identity authentication request sent by the first terminal and sends the user information to the business system; wherein the proxy identity authentication request instructs the gateway device to send the user information to the business system, and the proxy identity authentication request includes the first information.

[0166] In some embodiments, the control center of the gateway device receives the proxy identity authentication request sent by the first terminal through the identity authentication link, and transparently transmits the user information to the business system.

[0167] It should be noted that the first information includes ciphertext of user information.

[0168] As an implementation method, the control center receives the proxy authentication request and encapsulates the user information ciphertext into a general authentication interface protocol message; and sends the general authentication interface protocol message to the identity authentication platform of the business system of the enterprise intranet. Since the entire transmission process is encrypted, the secure transmission of user information is guaranteed.

[0169] Step S111: The service system receives first information sent by a first terminal where a SIM card is located through a gateway device, and performs identity authentication on a user of the first terminal based on user information in the first information.

[0170] That is, the business system receives the user information and performs identity authentication on the first terminal user based on the user information.

[0171] As an implementation method, the identity authentication platform of the business system parses the received universal authentication interface protocol message to obtain the user information ciphertext; decrypts it through the local private key to obtain the user information; compares the user information with the user information whitelist configured by the local administrator, and only allows access if the verification passes, that is, authorizes the first terminal user to access the business system.

[0172] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the user information returned by the business system is stored in the SIM card. When the first terminal where the SIM card is located requests to access the business system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the access rights of users to access the business system through the private network, and realize the identity authentication control on the private network enterprise side. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience. User information is encrypted at the hard medium layer of the SIM card, and encrypted text is transmitted throughout the process to achieve secure authentication. User identity information verification is performed through gateway device redirection, which can cover all terminals and is easy to promote.

[0173] Based on the above embodiments, Figure 6 FIG. 1 is a flow chart of a private network security authentication method according to an embodiment of the present application. The method is applied to a SIM card. Figure 6 As shown, the private network security authentication method may include the following steps.

[0174] Step S601, in response to triggering a card information reporting operation, sending a first data SMS to a business system through an SMS gateway, wherein the first data SMS includes card information.

[0175] Step S602, receiving a second data SMS sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS; wherein the user information includes a mobile phone number.

[0176] Step S603, receiving a first instruction sent by the first terminal where the SIM card is located, and sending user information to the first terminal, wherein the first instruction indicates obtaining user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

[0177] The user information is sent to the first terminal, so that the first terminal sends the user information to the business system through the gateway device to request the business system to perform identity authentication on the first terminal user.

[0178] It should be noted that, in the embodiments of the present application, the implementation process of step S601 to step S603 can be found in the present application. Figure 1 The description of the implementation process of the corresponding steps in the illustrated embodiment will not be repeated here.

[0179] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the user information returned by the business system is stored in the SIM card. When the first terminal where the SIM card is located requests to access the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the access rights of users to access the business system through the private network, and realize the identity authentication control on the private network enterprise side. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience. User information is encrypted at the hard medium layer of the SIM card, and encrypted text is transmitted throughout the process to achieve secure authentication.

[0180] Based on any of the above embodiments, Figure 7 is a flow chart of a private network security authentication method according to another embodiment of the present application. The method is applied to a first terminal, the first terminal including a SIM card; Figure 7 As shown, the private network security authentication method may include the following steps.

[0181] Step S701: Send an intranet application access request to a private network, wherein the intranet application access request indicates access to a business system.

[0182] The first terminal sends an intranet application access request to the private network, wherein the intranet application access request indicates access to a business system.

[0183] Step S702: receiving an identity authentication link redirected by a gateway device, and sending a first instruction to the SIM card based on the identity authentication link.

[0184] The first instruction instructs to obtain user information, where the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number.

[0185] Step S703, receiving user information sent by the SIM card, and sending first information to the service system through the gateway device; wherein the first information includes user information.

[0186] The first information is sent to the business system to request the business system to perform identity authentication on the first terminal user.

[0187] It should be noted that, in the embodiments of the present application, the implementation process of steps S701 to S703 can be found in the present application. Figure 1 The description of the implementation process of the corresponding steps in the illustrated embodiment will not be repeated here.

[0188] By implementing this embodiment, the card information is reported to the service system in the private network through the SIM card, and the user information returned by the service system is stored in the SIM card. When the first terminal where the SIM card is located requests to access the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored in the SIM card to the service system for identity authentication. The private network user side can autonomously manage the access rights of users to access the service system through the private network, and the identity authentication control on the private network enterprise side is realized.

[0189] Based on any of the above embodiments, Figure 8 is a flow chart of a private network security authentication method according to another embodiment of the present application. The method is applied to a gateway device; Figure 8 As shown, the private network security authentication method may include the following steps.

[0190] Step S801, intercepting an intranet application access request sent by a first terminal to a private network, and redirecting an identity authentication link to the first terminal; wherein the first terminal includes a SIM card, and the intranet application access request indicates access to a service system.

[0191] Step S802, receiving the first information sent by the first terminal, and sending the first information to the business system, wherein the first information includes user information, the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, the user information includes the mobile phone number, and the first terminal requests the business system to perform identity authentication on the first terminal user based on the user information.

[0192] It should be noted that, in the embodiments of the present application, the implementation process of step S801 to step S802 can be found in the present application. Figure 1 The description of the implementation process of the corresponding steps in the illustrated embodiment will not be repeated here.

[0193] By implementing this embodiment, when the first terminal where the SIM card is located requests to access the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information returned by the service system stored in the SIM card based on the card information reported by the SIM card to the service system for identity authentication. The private network user side can autonomously manage the access rights of users to access the service system through the private network, and the identity authentication control on the private network enterprise side is realized. By redirecting the user identity information through the gateway device, it can cover all terminals and is easy to promote.

[0194] Based on any of the above embodiments, Fig. 9 is a flow chart of a private network security authentication method according to another embodiment of the present application. The method is applied to a business system within a private network; Fig. 9 As shown, the private network security authentication method may include the following steps.

[0195] Step S901: receiving a first data SMS sent by a subscriber identity module SIM card via a SMS gateway, wherein the first data SMS includes card information.

[0196] Step S902: based on the first data SMS, obtain the mobile phone number and card information corresponding to the SIM card, and record the binding relationship between the card information and the mobile phone number.

[0197] Step S903: Send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes a mobile phone number.

[0198] Step S904: receiving first information sent by the first terminal where the SIM card is located through the gateway device, and performing identity authentication on the first terminal user based on the user information in the first information.

[0199] It should be noted that, in the embodiments of the present application, the implementation process of steps S901 to S904 can be found in the present application. Figure 1 The description of the implementation process of the corresponding steps in the illustrated embodiment will not be repeated here.

[0200] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the business system returns the user information to the SIM card. When the first terminal where the SIM card is located requests to access the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the access rights of users to access the business system through the private network, and the identity authentication control on the private network enterprise side is realized. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience.

[0201] Based on any of the above embodiments, Fig.10 1 is a block diagram of a private network security authentication device according to an exemplary embodiment, wherein the device is configured in a SIM card. Fig.10 The private network security authentication device may include: a card information reporting module 1001 and a transceiver module 1002.

[0202] Specifically, the card information reporting module 1001 is used to send a first data SMS to the business system through the SMS gateway in response to triggering the card information reporting operation, wherein the first data SMS includes the card information;

[0203] The card information reporting module is also used to receive a second data SMS sent by the business system through the SMS gateway, and obtain and store user information based on the second data SMS; wherein the user information includes a mobile phone number;

[0204] The transceiver module 1002 is used to receive a first instruction sent by the first terminal where the SIM card is located, and send user information to the first terminal, wherein the first instruction indicates to obtain user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

[0205] In some implementations, the card information reporting module 1001 is further used to:

[0206] Registering with the first terminal to monitor network access events;

[0207] An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

[0208] In some implementations, the card information reporting module 1001 is specifically used to:

[0209] Read the card information and assemble the card information into a response data packet of the first data SMS; send the first data SMS to the business system through the SMS gateway.

[0210] In some implementations, the card information reporting module 1001 is specifically used to:

[0211] Receive a second data SMS sent by a service system forwarded by a SMS gateway; wherein the second data SMS includes an application command message, and the application command message includes user information;

[0212] Decrypt the second data SMS message to obtain SMS content in the application command message;

[0213] Parse SMS content, obtain and store user information.

[0214] In some implementations, the transceiver module 1002 is specifically configured to:

[0215] Establishing a secure access channel with the first terminal;

[0216] Read user information; and encrypt the user information to obtain the ciphertext of the user information;

[0217] The user information ciphertext is sent to the first terminal through a secure access channel.

[0218] In some implementations, the response data packet includes the card application major version number, security parameter identifier definition, application response data packet and MAC, the application response data packet includes card information, and the security parameter identifier includes an encryption identifier and an environment identifier.

[0219] In some implementations, the card information reporting module 1001 is specifically used to:

[0220] Store user information in the secure storage space of the SIM card.

[0221] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0222] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the user information returned by the business system is stored in the SIM card. When the first terminal where the SIM card is located requests to access the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the access rights of users to access the business system through the private network, and realize the identity authentication control on the private network enterprise side. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience. User information is encrypted at the hard medium layer of the SIM card, and encrypted text is transmitted throughout the process to achieve secure authentication.

[0223] Based on any of the above embodiments, Fig.11 1 is a block diagram of a private network security authentication device according to an exemplary embodiment. The device is configured in a first terminal, and the first terminal includes a SIM card. Fig.11The private network security authentication device may include: a transceiver module 1101.

[0224] Specifically, the transceiver module 1101 is used to send an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system;

[0225] The transceiver module 1101 is further used to receive the identity authentication link redirected by the gateway device, and send a first instruction to the customer identification module SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, and the user information includes a mobile phone number;

[0226] The transceiver module 1101 is also used to receive user information sent by the SIM card and send first information to the service system through the gateway device; wherein the first information includes user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

[0227] In some implementations, the transceiver module 1101 is further configured to:

[0228] The first terminal sends an access request to the private network, and the access request instructs the private network to verify the authority of the first terminal.

[0229] In some implementations, the transceiver module 1101 is further configured to:

[0230] Receive the registration request for monitoring network access events sent by the SIM card.

[0231] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0232] By implementing this embodiment, the card information is reported to the service system in the private network through the SIM card, and the user information returned by the service system is stored in the SIM card. When the first terminal where the SIM card is located requests to access the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored in the SIM card to the service system for identity authentication. The private network user side can autonomously manage the access rights of users to access the service system through the private network, and the identity authentication control on the private network enterprise side is realized.

[0233] Based on any of the above embodiments, Fig.12 is a block diagram of a private network security authentication device according to another exemplary embodiment, the device is configured in a gateway device, and the first terminal includes a SIM card. Fig.12 The private network security authentication device may include: an access gateway module 1201 and a control center module 1202.

[0234] Specifically, the access gateway module 1201 is used to intercept the intranet application access request sent by the first terminal to the private network, and redirect the identity authentication link to the first terminal; wherein the first terminal includes a SIM card, and the intranet application access request indicates access to the service system;

[0235] The control center module 1202 is used to receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card. The user information includes a mobile phone number. The first terminal requests the business system to perform identity authentication on the user of the first terminal based on the user information.

[0236] The proxy identity authentication request instructs the gateway device to send user information to the business system. The user information is sent to the SIM card by the business system based on the card information reported by the SIM card. The user information includes the mobile phone number.

[0237] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0238] By implementing this embodiment, when the first terminal where the SIM card is located requests to access the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information returned by the service system stored in the SIM card based on the card information reported by the SIM card to the service system for identity authentication. The private network user side can autonomously manage the access rights of users to access the service system through the private network, and the identity authentication control on the private network enterprise side is realized. By redirecting the user identity information through the gateway device, it can cover all terminals and is easy to promote.

[0239] Based on any of the above embodiments, Fig.13 is a block diagram of a private network security authentication device according to another exemplary embodiment, the device is configured in a service system in a private network, and the first terminal includes a SIM card. Fig.13 The private network security authentication device may include: a transceiver module 1301, a processing module 1302 and an identity authentication module 1303.

[0240] Specifically, the transceiver module 1301 is used to receive a first data SMS sent by a subscriber identity module SIM card through a SMS gateway, wherein the first data SMS includes card information.

[0241] The processing module 1302 is used to obtain the mobile phone number and card information corresponding to the SIM card based on the first data SMS, and record the binding relationship between the card information and the mobile phone number.

[0242] The transceiver module 1301 is further configured to send a second data SMS to the SIM card via the SMS gateway, wherein the second data SMS includes user information, and the user information includes a mobile phone number.

[0243] The identity authentication module 1303 is used to receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

[0244] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0245] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the business system returns the user information to the SIM card. When the first terminal where the SIM card is located requests to access the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the access rights of users to access the business system through the private network, and the identity authentication control on the private network enterprise side is realized. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience.

[0246] Based on any of the above embodiments, Fig.14 is a block diagram of a private network security authentication system according to an exemplary embodiment. Fig.14 The private network security authentication system may include: a SIM card 1401, a first terminal 1402 where the SIM card is located, a short message gateway 1403, a gateway device 1404 and a business system 1405.

[0247] Specifically, the SIM card 1401 is configured to execute Figure 6 The private network security authentication method shown;

[0248] The first terminal 1402 where the SIM card is located is configured to execute Figure 7 The private network security authentication method shown;

[0249] Gateway device 1404 is configured to execute Figure 8 The private network security authentication method shown;

[0250] Business system 1405 is configured to execute Fig. 9 The private network security authentication method shown.

[0251] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the business system returns the user information to the SIM card. When the first terminal where the SIM card is located requests to access the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. The private network user side can independently manage the access rights of users to access the business system through the private network, and the identity authentication control on the private network enterprise side is realized. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience.

[0252] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0253] like Fig.15 , is a block diagram of an electronic device for implementing a method for private network security authentication according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0254] like Fig.15 As shown, the electronic device includes: one or more processors 1501, a memory 1502, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are interconnected using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In other embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.15 A processor 1501 is taken as an example.

[0255] The memory 1502 is a non-transitory computer-readable storage medium provided in the present application. The memory stores instructions executable by at least one processor to enable the at least one processor to perform the method for private network security authentication provided in the present application. The non-transitory computer-readable storage medium of the present application stores computer instructions, which are used to enable a computer to perform the method for private network security authentication provided in the present application.

[0256] The memory 1502 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as the program instructions / modules corresponding to the method for private network security authentication in the embodiment of the present application (for example, the attached Fig.12 The processor 1501 executes various functional applications and data processing of the server by running the non-transient software programs, instructions and modules stored in the memory 1502, that is, the method for private network security authentication in the above method embodiment is implemented.

[0257] The memory 1502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created according to the use of the electronic device with private network security authentication, etc. In addition, the memory 1502 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1502 may optionally include a memory remotely arranged relative to the processor 1501, and these remote memories may be connected to the electronic device with private network security authentication via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0258] The electronic device of the private network security authentication method may further include: an input device 1503 and an output device 1504. The processor 1501, the memory 1502, the input device 1503 and the output device 1504 may be connected via a bus or other means. Fig.15 The example of connecting through bus is taken in the following.

[0259] The input device 1503 can receive input digital or character information, and generate key signal input related to user settings and function control of the electronic device of the private network security authentication, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator rod, one or more mouse buttons, a trackball, a joystick and other input devices. The output device 1504 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The display device may include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display and a plasma display. In some embodiments, the display device may be a touch screen.

[0260] Various implementations of the systems and techniques described herein can be realized in digital electronic circuit systems, integrated circuit systems, dedicated ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0261] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for programmable processors and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or means (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0262] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0263] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0264] A computer system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises through computer programs running on the respective computers and having a client-server relationship to each other.

[0265] In an exemplary embodiment, a computer program product is also provided. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform the above method.

[0266] It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in a different order from the embodiments, or several steps can be performed simultaneously.

[0267] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only.

[0268] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A private network security authentication method, characterized in that: The method is applied to a subscriber identity module SIM card, comprising: In response to triggering the card information reporting operation, a first data SMS is sent to a service system in the private network through a SMS gateway of the private network, wherein the first data SMS includes card information, and the service system obtains the mobile phone number corresponding to the SIM card based on the first data SMS, and records the binding relationship between the mobile phone number and the card information; receiving a second data SMS sent by the business system through the SMS gateway, acquiring user information based on the second data SMS, and storing the user information in a secure storage space of the SIM card; wherein the user information includes a mobile phone number; A first instruction sent by a first terminal where the SIM card is located is received, and the user information is sent to the first terminal, wherein the first instruction instructs to obtain the user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

2. The method according to claim 1, characterized in that Before the response triggers the card information reporting operation, the method includes: Registering with the first terminal to monitor network access events; An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

3. The method according to claim 1, characterized in that The sending of the first data SMS to the service system in the private network through the SMS gateway of the private network includes: Read the card information and assemble the card information into a response data packet of the first data SMS; The first data SMS is sent to the business system through the SMS gateway.

4. The method according to claim 1, characterized in that: The receiving a second data SMS sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS, includes: receiving a second data SMS sent by the business system and forwarded by the SMS gateway; wherein the second data SMS includes an application command message, and the application command message includes the user information; Decrypting the second data SMS message to obtain SMS content in the application command message; Parse the text message content, obtain and store the user information.

5. The method according to claim 1, characterized in that The sending the user information to the first terminal includes: Establishing a secure access channel with the first terminal; Reading user information; and encrypting the user information to obtain a ciphertext of the user information; The user information ciphertext is sent to the first terminal through the secure access channel.

6. The method according to claim 3, characterized in that The response data packet includes the card application major version number, security parameter identification definition, application response data packet and MAC, the application response data packet includes the card information, and the security parameter identification includes an encryption identification and an environment identification.

7. A private network security authentication method, characterized in that: The method is applied to a first terminal, the first terminal includes a subscriber identity module SIM card, and the subscriber identity module SIM card is used to execute the method according to any one of claims 1 to 6; the method includes: Sending an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system; Receive an identity authentication link redirected by a gateway device, and send a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain the user information, the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number; Receive the user information sent by the SIM card, and send first information to the service system through the gateway device; wherein the first information includes user information, and the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information.

8. The method according to claim 7, characterized in that Before the first terminal sends an intranet application access request to the private network, the method includes: The first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

9. The method according to claim 7, characterized in that: The method further comprises: Receive a network access event monitoring registration request sent by the SIM card.

10. A private network security authentication method, characterized in that: The method is applied to a gateway device, comprising: Intercepting an intranet application access request sent by the first terminal to the private network, and redirecting the identity authentication link to the first terminal; wherein the first terminal includes a customer identification module SIM card, the intranet application access request indicates access to a service system, and the customer identification module SIM card is used to execute the method according to any one of claims 1 to 6; Receive first information sent by the first terminal, and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, and the user information includes a mobile phone number. The first terminal requests the business system to perform identity authentication on the first terminal user based on the user information.

11. A private network security authentication method, characterized in that: The method is applied to a business system in a private network, including: Receiving a first data SMS sent by the subscriber identity module SIM card through the SMS gateway, wherein the first data SMS includes card information, and the subscriber identity module SIM card is used to execute the method according to any one of claims 1 to 6; Based on the first data SMS, obtain the mobile phone number and the card information corresponding to the SIM card, and record the binding relationship between the card information and the mobile phone number; Sending a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number; Receive first information sent by a first terminal where the SIM card is located through a gateway device, and perform identity authentication on a user of the first terminal based on user information in the first information.

12. A private network security authentication system, characterized in that: It includes a customer identification module SIM card, a first terminal where the SIM card is located, a short message gateway, a gateway device and a business system, The SIM card is configured to execute the private network security authentication method according to any one of claims 1 to 6; The first terminal where the SIM card is located is configured to execute the private network security authentication method according to any one of claims 7 to 9; The gateway device is configured to execute the private network security authentication method according to claim 10; The business system is configured to execute the private network security authentication method as described in claim 11.

13. A private network security authentication device, characterized in that: The device is configured on a subscriber identification module SIM card and includes: A card information reporting module, configured to respond to triggering a card information reporting operation, and to send a first data SMS to a service system in the private network through a SMS gateway of the private network, wherein the first data SMS includes card information, and the service system obtains the mobile phone number corresponding to the SIM card based on the first data SMS, and records the binding relationship between the mobile phone number and the card information; The card information reporting module is further used to receive a second data SMS sent by the business system through the SMS gateway, obtain user information based on the second data SMS, and store the user information in the secure storage space of the SIM card; wherein the user information includes a mobile phone number; The transceiver module is used to receive a first instruction sent by the first terminal where the SIM card is located, and send the user information to the first terminal, wherein the first instruction indicates to obtain the user information, and the first terminal requests the service system to perform identity authentication on the user of the first terminal based on the user information.

14. A private network security authentication device, characterized in that: The device is configured in a first terminal, the first terminal includes a SIM card, and the SIM card is used to execute the method according to any one of claims 1 to 6, including: A transceiver module, used for sending an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system; The transceiver module is further used to receive an identity authentication link redirected by a gateway device, and send a first instruction to the customer identification module SIM card based on the identity authentication link, wherein the first instruction instructs to obtain the user information, the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number; The transceiver module is also used to receive the user information sent by the SIM card, and send the first information to the service system through the gateway device; wherein the first information includes user information, and the first terminal requests the service system to authenticate the first terminal user based on the user information.

15. A private network security authentication device, characterized in that: The device is configured in a gateway device and includes: An access gateway module, used to intercept the intranet application access request sent by the first terminal to the private network, and redirect the identity authentication link to the first terminal; wherein the first terminal includes a customer identification module SIM card, the intranet application access request indicates access to the service system, and the customer identification module SIM card is used to execute the method according to any one of claims 1 to 6; A control center module is used to receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, and the user information includes a mobile phone number. The first terminal requests the business system to perform identity authentication on the first terminal user based on the user information.

16. A private network security authentication device, characterized in that: The device is configured in a business system in a private network, including: A transceiver module, used for receiving a first data SMS sent by the subscriber identity module SIM card through the SMS gateway, wherein the first data SMS includes card information, and the subscriber identity module SIM card is used to execute the method according to any one of claims 1 to 6; A processing module, configured to obtain the mobile phone number and the card information corresponding to the SIM card based on the first data SMS, and record the binding relationship between the card information and the mobile phone number; The transceiver module is further used to send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number; The identity authentication module is used to receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the user of the first terminal based on the user information in the first information.

17. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the private network security authentication method described in any one of claims 1 to 11.

18. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable the computer to execute the private network security authentication method according to any one of claims 1 to 11.

Images