A 5G network-based XR terminal and server authorization and authentication method

Abstract

The present invention discloses an authorization and authentication method for XR terminals and servers based on 5G networks, including: 1. The cloud platform discloses public parameters and its own public key; 2. The edge node registers with the cloud platform; 3. The XR terminal registers with the cloud platform; 4. Three-party authentication of the XR terminal, cloud platform and edge node is realized based on hash summary value and XOR operation; 5. When the maximum message authentication delay time is exceeded, the cloud platform adopts CPK authentication method to authorize and authenticate the XR terminal; the authentication method proposed in the present invention adopts hash summary value and XOR operation to realize fast and lightweight authentication of XR terminals, reducing the computing pressure and bandwidth transmission pressure of XR terminals, and adopts CPK authentication method after the authentication fails when the maximum message delay time is exceeded, which has very obvious security advantages, realizes fast batch authorization of XR terminals due to delays caused by too much network data volume, and ensures the authorization stability of cloud platforms for XR terminals based on 5G edge network computing.

Description

Technical Field

[0001] The present invention belongs to the field of 5G network XR terminal authorization and authentication, and specifically refers to a 5G network-based XR terminal and server authorization and authentication method. Background Art

[0002] Currently, the combination of Extended Reality (XR) devices and cloud computing has brought users a richer and more immersive experience. Edge computing, as a key technology in this system, has further promoted the real-time and interactivity of XR applications. The security certification of cloud platforms, XR devices and edge computing is the basis for ensuring the safe operation of the entire system. With the development of technology and the deepening of application, security certification needs to constantly adapt to new security challenges and needs. Through comprehensive security strategies, technology deployment and personnel training, the system and users can be effectively protected from security threats.

[0003] Most identity authentication protocols for mobile edge computing scenarios under cloud platforms are based on relatively complex cryptography, such as bilinear pairing, which has high computational complexity and is not suitable for XR terminal devices with extremely high latency requirements and limited computing resources. At the same time, when the existing authorization and authentication schemes are faced with excessive network data volume, a large number of XR terminal device users are prone to authorization and authentication failures, and it is impossible to achieve rapid batch authorization of XR terminals due to delays caused by excessive network data volume. Summary of the Invention

[0004] In order to solve the problems that the more complex cryptographic construction in the above-mentioned existing technology is not suitable for XR terminal devices with extremely high latency requirements and limited computing resources, and that XR terminals cannot be quickly batch authorized due to large network data volume and delay, the present invention proposes an XR terminal and server authorization and authentication method based on 5G network to improve the above problems.

[0005] The specific application is as follows:

[0006] A 5G network-based XR terminal and server authorization and authentication method, the method comprising:

[0007] S101: System initialization: The cloud platform generates the system's public parameters, as well as its own public key pk and private key sk, and makes the public parameters and its own public key public;

[0008] S102: The edge node registers with the cloud platform. The edge node's own identity is EID. The cloud platform generates a random number x and concatenates x to obtain a digest value. The resulting digest value is used as the shared key KE between the edge node and the cloud platform and sent to the edge node. The cloud platform creates and updates the edge node information in the authentication list, which contains the identity, anonymity, and shared key.

[0009] S103: The XR terminal registers with the cloud platform. The XR terminal's own identity identifier is UID. The cloud platform generates a random number y and concatenates y to obtain a digest value. The resulting digest value is used as the shared key KT between the XR terminal and the cloud platform. The cloud platform creates and updates the XR terminal information in the authentication list, which includes the identity identifier, anonymity, and shared key.

[0010] S104: The XR terminal generates a random number r1, records the current timestamp T1, calculates the XOR of r1 and KT to obtain information f1, concatenates the UID, KT, r1, and T1 to calculate the digest value, and uses the digest value as the authentication parameter V1. The XR terminal sends the first data packet to the edge node;

[0011] S105: The edge node receives the first data packet, records the current timestamp T2, and determines whether |T2-T1|≤M satisfies the maximum message delay time. If not, the edge node performs maximum message delay time authorization authentication. If so, the edge node generates a random number r2 and sends the second data packet to the cloud platform.

[0012] S106: The cloud platform receives the second data packet, records the current timestamp T3, and determines whether |T3-T2|≤M is satisfied. If not, the maximum message delay time authorization authentication is performed; if so, the edge node and the XR terminal are authenticated. If the edge node authentication passes, the shared key of the edge node is updated to KET after the update. If the XR terminal authentication passes, the XR terminal authentication is completed. If the XR terminal authentication fails, the shared key of the XR terminal authentication is updated to AET after the update. Then, a random number r3 is generated, and the cloud platform sends a third data packet to the edge node.

[0013] S107: The edge node receives the third data packet, records the current timestamp T4, and determines whether |T4-T3|≤M is satisfied. If not, it performs maximum message delay time authorization authentication. If so, it generates a negotiated key KS between the XR terminal and the edge node, and then generates a random number r4. The edge node sends a fourth data packet to the XR terminal, where the fourth data packet includes N.

[0014] S108: The XR terminal receives the fourth data packet, records the current timestamp T5, and determines whether T5-T4≤M is satisfied. If not, the XR terminal performs maximum message delay time authorization authentication. If so, the XR terminal concatenates the UID and KT to calculate their digest value, and concatenates the obtained digest value with r4 and T4 to calculate their digest value. The digest value is used as the authentication parameter V-5, and V-5 is split. It is determined whether the negotiated secret key KST after the split is equal to N in the fourth data packet. If they are equal, the XR terminal completes the authentication of the edge node, generates a random number r5, and sends a fifth data packet to the edge node. The fifth data packet includes V6.

[0015] S109: The edge node receives the fifth data packet, records the current timestamp T6, and determines whether |T6-T5|≤M is satisfied. If not, it performs maximum message delay time authorization authentication; if so, it concatenates KS and T5 to calculate their digest value, and verifies whether the obtained digest value is equal to V6 in the fifth data packet. If they are equal, the XR terminal completes the authentication and authorizes the XR terminal.

[0016] Furthermore, the step S102 specifically includes the following:

[0017] S201: The edge node sends its own identity identifier EID to the cloud platform through a secure channel;

[0018] S202: The cloud platform generates a random number y, concatenates the EID and y to calculate the digest value, and uses the obtained digest value as the shared key KE between the edge node and the cloud platform. The EID, KE and y are concatenated to calculate the digest value, and the obtained digest value is used as the edge node pseudonym A. E , connect KE and A through a secure channel E Transmit to edge nodes;

[0019] S203: The edge node stores KE and A E , complete the registration.

[0020] Furthermore, the step S103 specifically includes the following:

[0021] Concatenate UID, KT and x to calculate their digest value, and the resulting digest value is used as the XR terminal pseudonym A T , connect KT and A through a secure channel T Transmit to XR terminal;

[0022] The step S104 specifically includes the following:

[0023] The obtained digest value is used as the authentication parameter V1, and the XR terminal sends the first data packet with the specific content (A T , f1, V1, T1);

[0024] The step S105 specifically includes the following:

[0025] S501: Concatenate EID, KE, r2 and T2 to calculate their digest value, and use the obtained digest value as the authentication parameter V2. XOR r2 with KE to obtain information f2, calculate the digest value of r2, and add the digest value to A. T XOR calculation to obtain information f3;

[0026] S502: The edge node sends a second data packet (A E , f1, f2, f3, V1, V2, T1, T2) to the cloud platform;

[0027] S503: KE and r2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated shared key KET. At the same time, EID, KET and r2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated edge node pseudonym AET.

[0028] Furthermore, the step S106 specifically includes the following:

[0029] S601: The cloud platform is based on A E Search the EID and KE in the authentication list, calculate the random number r′2 based on the XOR calculation of KE and f2, concatenate the IED, KE, r′2 and T2 to calculate the digest value, and use the obtained digest value as the authentication parameter V′2. Verify whether V′2 is equal to V2 in the second data packet. If the verification is successful, the edge node completes the authentication;

[0030] S602: If the verification fails, the cloud platform concatenates KE and r′2 to calculate their digest value, and the obtained digest value is used as the updated shared key KET. The digest value of r′2 is calculated and XORed with the digest value f3 to restore the pseudonym A′ T , according to the pseudonym, search for UID and KT in the authentication list, XOR KT with f1 to restore the random number r′1, concatenate UID, KT, r′1 and T1 to calculate their digest value, and use the obtained digest value as the authentication parameter V′1. Verify whether V′1 is equal to V1 in the second data packet. If the verification is successful, the XR terminal completes the authentication;

[0031] S603: If the verification fails, the cloud platform generates a random number r3, concatenates the UID and KT to calculate their digest value, and uses the resulting digest value as information f4. The UID, KET, r3, and T3 are concatenated to calculate their digest value, and the resulting digest value is used as the verification parameter V4. The digest value of f4 is calculated and XORed with V3, and the resulting value is then calculated again. The resulting digest value is used as the verification parameter V4. The XORed value of r3 and KET is calculated to obtain information f5. The digest value of r3 is calculated, and the resulting digest value is XORed with f4 to obtain information f6.

[0032] S604: The cloud platform sends the third data packet {V4, f5, f6, T3} to the edge node, and concatenates KT and r3 to calculate the digest value, which is used as the updated shared key. At the same time, UID, Concatenate with r3 to calculate its digest value, and the resulting digest value is used as the updated XR terminal pseudonym The UID, KET and r'2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated XR terminal pseudonym AET.

[0033] Furthermore, the step S107 specifically includes the following:

[0034] S701: XOR KET and f5 to restore the random number r'3, concatenate UID, KET, r'3 and T3 to calculate their digest value, and use the obtained digest value as the verification parameter V'3. XOR the r'3 digest value with f6 to obtain the message f'4. XOR the f'4 digest value with V'3 to calculate the digest value, and use the obtained digest value as the verification parameter V'4. Verify whether V'4 is equal to V4 in the third data packet. If the verification is successful, the edge node completes the authentication of the cloud platform.

[0035] S702: The edge node generates a random number r4, concatenates f'4, r4 and T4 to calculate its digest value, and uses the obtained digest value as the verification parameter V5. V5 is split into three pieces of information: KS, M, and N, where KS is the negotiated key between the XR terminal and the edge node, and M and N serve as the authentication credentials of the XR terminal to the edge node. The digest value of M is XORed with r'3 to obtain information f7, and the edge node sends the fourth data packet (N, r4, f7, T4) to the XR terminal.

[0036] Furthermore, the step S108 specifically includes the following:

[0037] S801: Concatenate UID and KT to calculate their digest value. The resulting digest value is concatenated with r4 and T4 to calculate the digest value. The resulting digest value is used as the verification parameter V-5. V-5 can be split into KST, N', and M', where KST is the negotiated key. Verify whether N' is equal to N in the fourth data packet. If the verification is successful, the XR terminal completes the authentication of the edge node.

[0038] S802: The XR terminal XORs the digest value of M' with f7 to restore the random number r ‘ 3 ’ , KT and r ‘ 3 ’ Calculate the digest value by splicing, and use the digest value as the update key The UID, Concatenate with r''3 to calculate its digest value, and use the obtained digest value as the updated pseudonym Concatenate KST and T5 to calculate their digest value, use the obtained digest value as the verification parameter V6, and send the fifth data packet {V6, T5} to the edge node.

[0039] Furthermore, the specific authorization and authentication process for exceeding the maximum message delay time includes the following:

[0040] L1: The cloud platform generates anonymous public and private keys for the XR terminal based on the CPK, where CPK is the standard cryptographic generation center of the combined public key system;

[0041] L2: CPK generates a signature certificate for the XR terminal based on the Schnorr signature method I u ={U pub , E u}, and pass the T in the certificate s Limit the authorized access time of XR terminal users, where E u The master private key for signing XR terminals, U pub The master public key for XR terminal signature, T s is the registration timestamp;

[0042] L3: Cloud platform will (CPK, upk, I u , T s ) is sent to the XR terminal and the public key parameters (U pub , T a , β a ), where T a The expiration date of the XR terminal certificate, β a is the valid expiration token of the XR terminal certificate, and upk is the XR terminal encryption private key;

[0043] L4: The cloud platform authorizes and authenticates the XR terminal, and then determines whether the XR terminal is successfully authorized and authenticated.

[0044] Furthermore, the step L1 specifically includes the following:

[0045] L101: Choose a prime number P and construct an elliptic curve E(a, b) over a finite field GF(P) of order P: y 2 =x 2 +ax+bmod P, where a, b, x, y∈GF(P);

[0046] L102: Select a base point G on E(a, b), whose order is a prime number n, and the CPK generates an m*q private key matrix X PR , by X PR Derived public key matrix Y PU ;

[0047] L103: Select one-way hash function H1: {0, 1} * →{0, 1} n , H2:

[0048] L104: Authorize and authenticate the UID of the XR terminal through the CPK.

[0049] H1(UID)=h1h2..h n ,

[0050] Calculate a binary sequence of fixed length n and split the sequence into x bits to get W1W2..w n , CPK calculates the XR terminal's identification private key i sk by multiple addition of n-order finite field, and calculates the XR terminal's identification public key IPK by multiple point addition on the elliptic curve E(a, b);

[0051] L105: CPK generates a public-private key pair (ssk i , SPK i ) composed of a split key sequence, where ssk i To split the private key, SPK i To split the public key, CPK is based on the registration timestamp T of the XR terminal s and UID generate segmentation parameter KP={UID||T s};

[0052] L106: Calculate w′1w′2...w′ by H1(KP)=h1h2..hn n , according to w′ n-1 , w′ n get

[0053] t=w′ n-1 *m+w′ n ,

[0054] Then the split key (ssk) of the XR terminal is obtained from the split key sequence. t , SPK t ), the split key sequence can be simultaneously distributed to N authorized XR terminal users whose authorization is timed out, and each authorized XR terminal user is assigned a split key (ssk t , SPK t );

[0055] L107: CPK calculates the XR terminal's public key PPP and private key upk based on the identification private key and the split key:

[0056]

[0057] L108: CPK distributes the public key PPP and private key upk to the XR terminal using the SSS algorithm;

[0058] Furthermore, the step L2 specifically includes the following:

[0059] L201: Randomly select a number Calculate U pub =U pri .G;

[0060] L202: Calculating E u =Upri +C pri H2(H uid ||PPP||T s )mod n, where H uid =H2(H uid ||PPP).

[0061] Furthermore, the step L4 specifically includes the following:

[0062] L401: Cloud platform verifies XR terminal registration timestamp T s The validity period is when the XR terminal registers the timestamp T s Less than the set XR terminal registration timestamp T s If the threshold is reached, it is determined to be valid and the process goes to step L402; otherwise, the authentication fails and the authentication is terminated;

[0063] L402: The cloud platform uses its own key sk and the XR terminal's public key PPP to calculate the intermediate variable P * =sk PPP ;

[0064] L403: Cloud Platform Computing β * =H2(T a ||P * ), and determine whether β a =β * If they are equal, it means that the identity authentication is successful and the XR terminal authentication is passed. If they are not equal, it means that the XR terminal authentication has failed.

[0065] The beneficial effects of the 5G network-based XR terminal and server authorization and authentication method of the present invention are as follows:

[0066] The present invention generates the public parameters of the system, as well as its own public key pk and private key sk, through the cloud platform, and makes the public parameters and its own public key public. The edge node registers with the cloud platform, and the edge node's own identity is EID. The cloud platform generates a random number x, and splices x to obtain a digest value. The digest value is used as the shared key KE between the edge node and the cloud platform and sent to the edge node. The cloud platform creates and updates the edge node information in the authentication list. The list contains identity, anonymity and shared keys. The XR terminal registers with the cloud platform, and the cloud platform creates and updates the XR terminal information in the authentication list. The XR terminal, the cloud platform and the edge node are connected by sending 5 The data packet is authorized and authenticated based on the hash summary value and the XOR operation. When the maximum message delay time is exceeded during the authentication, the cloud platform uses the CPK authentication method to perform batch authorization authentication on the XR terminal. The authentication method proposed in the present invention uses the hash summary value and the XOR operation to realize fast and lightweight authentication of the XR terminal, reducing the computing pressure and bandwidth transmission pressure of the XR terminal, and adopts the CPK authentication method after the authentication fails due to the maximum message delay time. The security has a very obvious advantage, and the XR terminal can be quickly authorized in batches due to the delay of too much network data, ensuring the authorization stability of the cloud platform for XR terminals based on 5G edge network computing, and realizing a balanced authorization method. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 This is a flow chart of a method for authorization and authentication of an XR terminal and a server based on a 5G network according to the present invention;

[0068] Figure 2 This is a time comparison chart of authorization and authentication under different algorithms of the present invention;

[0069] Figure 3 This is a comparison chart of the total authorization and authentication time delay for different numbers of users on different platforms of the present invention. DETAILED DESCRIPTION

[0070] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0071] Example 1

[0072] First, the technical terms involved in the embodiments of the present application are explained.

[0073] (1) XR terminals

[0074] XR devices are hardware devices that can provide extended reality (XR) experiences. XR is a general term that includes various forms of reality, including virtual reality (VR), augmented reality (AR), and mixed reality (MR). The choice of XR device depends on the application scenario, user experience requirements, and budget. As technology develops, these devices are becoming more and more advanced, providing a more natural and immersive interactive experience.

[0075] (2) Edge nodes

[0076] Edge nodes are a core component of edge computing. They represent a revolution in network architecture, pushing computing power, data storage, and processing from centralized data centers to the edge of the network, close to data sources and users. In extended reality (XR) applications, edge nodes can handle rendering and interaction logic, providing a low-latency immersive experience for XR devices.

[0077] (3) Cloud Platform

[0078] The combination of cloud platforms and XR (extended reality) terminals brings users a richer and higher-quality immersive experience. The cloud platform provides powerful computing power to handle complex graphics rendering and data processing tasks, providing high-quality visual content for XR terminals. Through cloud rendering, XR terminals can get rid of their dependence on high-performance hardware, reducing costs and complexity. The cloud platform can store a large amount of XR content, including 3D models, scenes, and multimedia resources. By using the cloud platform's content distribution network (CDN), XR terminals can quickly load and access content, providing a smooth user experience. Real-time interaction between the cloud platform and XR terminals is crucial to providing a seamless experience. The cloud platform needs to ensure low-latency data processing and transmission. The cloud platform provides data encryption and secure storage to protect user data from unauthorized access. The cloud platform implements strict privacy protection measures to ensure the security of user information.

[0079] (3)CPK certification

[0080] CPK authentication refers to an identity authentication system based on Combined Public Key (CPK) technology. This system utilizes the CPK key architecture system to solve the problem of large-scale identification authentication, and has structural stability and strong flexibility and adaptability. The CPK authentication system provides a high level of security protection through leading security architecture and dynamic key management technology. The CPK authentication system also places special emphasis on the authorization capability of mobile terminals, and establishes a secure connection with mobile devices with unique serial numbers through dynamic key management technology, thereby achieving a secure level of encryption service, which can be completed even without a physical USB Key.

[0081] Figure 1 This is a flow chart of a 5G network-based XR terminal and server authorization and authentication method according to the present invention.

[0082] A method for authenticating an XR terminal and a server based on a 5G network, the method comprising:

[0083] S101: System initialization: The cloud platform generates the system's public parameters, as well as its own public key pk and private key sk, and makes the public parameters and its own public key public;

[0084] S102: The edge node registers with the cloud platform. The edge node's own identity is EID. The cloud platform generates a random number x and concatenates x to obtain a digest value. The resulting digest value is used as the shared key KE between the edge node and the cloud platform and sent to the edge node. The cloud platform creates and updates the edge node information in the authentication list, which contains the identity, anonymity, and shared key.

[0085] S103: The XR terminal registers with the cloud platform. The XR terminal's own identity identifier is UID. The cloud platform generates a random number y and concatenates y to obtain a digest value. The resulting digest value is used as the shared key KT between the XR terminal and the cloud platform. The cloud platform creates and updates the XR terminal information in the authentication list, which includes the identity identifier, anonymity, and shared key.

[0086] S104: The XR terminal generates a random number r1, records the current timestamp T1, calculates the XOR of r1 and KT to obtain information f1, concatenates the UID, KT, r1, and T1 to calculate the digest value, and uses the digest value as the authentication parameter V1. The XR terminal sends the first data packet to the edge node;

[0087] S105: The edge node receives the first data packet, records the current timestamp T2, and determines whether |T2-T1|≤M satisfies the maximum message delay time. If not, the edge node performs maximum message delay time authorization authentication. If so, the edge node generates a random number r2 and sends the second data packet to the cloud platform.

[0088] S106: The cloud platform receives the second data packet, records the current timestamp T3, and determines whether |T3-T2|≤M is satisfied. If not, the maximum message delay time authorization authentication is performed; if so, the edge node and the XR terminal are authenticated. If the edge node authentication passes, the shared key of the edge node is updated to KET after the update. If the XR terminal authentication passes, the XR terminal authentication is completed. If the XR terminal authentication fails, the shared key of the XR terminal authentication is updated to AET after the update. Then, a random number r3 is generated, and the cloud platform sends a third data packet to the edge node.

[0089] S107: The edge node receives the third data packet, records the current timestamp T4, and determines whether |T4-T3|≤M is satisfied. If not, it performs maximum message delay time authorization authentication. If so, it generates a negotiated key KS between the XR terminal and the edge node, and then generates a random number r4. The edge node sends a fourth data packet to the XR terminal, where the fourth data packet includes N.

[0090] S108: The XR terminal receives the fourth data packet, records the current timestamp T5, and determines whether |T5-T4|≤M is satisfied. If not, the XR terminal performs maximum message delay time authorization authentication. If so, the XR terminal concatenates the UID and KT to calculate their digest value, and concatenates the obtained digest value with r4 and T4 to calculate their digest value. The digest value is used as the authentication parameter V-5, and V-5 is split. It is determined whether the negotiated secret key KST after the split is equal to N in the fourth data packet. If they are equal, the XR terminal completes the authentication of the edge node, generates a random number r5, and sends a fifth data packet to the edge node. The fifth data packet includes V6.

[0091] S109: The edge node receives the fifth data packet, records the current timestamp T6, and determines whether |T6-T5|≤M is satisfied. If not, it performs maximum message delay time authorization authentication; if so, it concatenates KS and T5 to calculate their digest value, and verifies whether the obtained digest value is equal to V6 in the fifth data packet. If they are equal, the XR terminal completes the authentication and authorizes the XR terminal.

[0092] Example 2: This example is based on the above example, and step S102 specifically includes the following:

[0093] S201: The edge node sends its own identity identifier EID to the cloud platform through a secure channel;

[0094] S202: The cloud platform generates a random number y, concatenates the EID and y to calculate the digest value, and uses the obtained digest value as the shared key KE between the edge node and the cloud platform. The EID, KE and y are concatenated to calculate the digest value, and the obtained digest value is used as the edge node pseudonym A. E , connect KE and A through a secure channel E Transmit to edge nodes;

[0095] S203: The edge node stores KE and A E , complete the registration.

[0096] Furthermore, the step S103 specifically includes the following:

[0097] Concatenate UID, KT and x to calculate their digest value, and the resulting digest value is used as the XR terminal pseudonym A T , connect KT and A through a secure channel T Transmit to XR terminal;

[0098] The step S104 specifically includes the following:

[0099] The obtained digest value is used as the authentication parameter V1, and the XR terminal sends the first data packet with the specific content (A T , f1, V1, T1);

[0100] The step S105 specifically includes the following:

[0101] S501: Concatenate EID, KE, r2 and T2 to calculate their digest value, and use the obtained digest value as the authentication parameter V2. XOR r2 with KE to obtain information f2, calculate the digest value of r2, and add the digest value to A. T XOR calculation to obtain information f3;

[0102] S502: The edge node sends a second data packet (A E , f1, f2, f3, V1, V2, T1, T2) to the cloud platform;

[0103] S503: KE and r2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated shared key KET. At the same time, EID, KET and r2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated edge node pseudonym AET.

[0104] Example 3: This example is based on the above example, and step S106 specifically includes the following:

[0105] S601: The cloud platform searches for EID and KE in the authentication list based on AE, restores the random number r′2 based on the XOR calculation of KE and f2, concatenates IED, KE, r′2 and T2 to calculate their digest value, and uses the obtained digest value as the authentication parameter V′2. It verifies whether V′2 is equal to V2 in the second data packet. If the verification is successful, the edge node completes the authentication;

[0106] S602: If the verification fails, the cloud platform concatenates KE and r′2 to calculate their digest value, and the obtained digest value is used as the updated shared key KET. The digest value of r′2 is calculated and XORed with the digest value f3 to restore the pseudonym A′ T , according to the pseudonym, search for UID and KT in the authentication list, XOR KT with f1 to restore the random number r′1, concatenate UID, KT, r′1 and T1 to calculate their digest value, and use the obtained digest value as the authentication parameter V′1. Verify whether V′1 is equal to V1 in the second data packet. If the verification is successful, the XR terminal completes the authentication;

[0107] S603: If the verification fails, the cloud platform generates a random number r3, concatenates the UID and KT to calculate their digest value, and uses the resulting digest value as information f4. The UID, KET, r3, and T3 are concatenated to calculate their digest value, and the resulting digest value is used as the verification parameter V4. The digest value of f4 is calculated and XORed with V3, and the resulting value is then calculated again. The resulting digest value is used as the verification parameter V4. The XORed value of r3 and KET is calculated to obtain information f5. The digest value of r3 is calculated, and the resulting digest value is XORed with f4 to obtain information f6.

[0108] S604: The cloud platform sends the third data packet {V4, f5, f6, T3} to the edge node, and concatenates KT and r3 to calculate the digest value, which is used as the updated shared key. At the same time, UID, Concatenate with r3 to calculate its digest value, and the resulting digest value is used as the updated XR terminal pseudonym The UID, KET and r′2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated XR terminal pseudonym AET.

[0109] Furthermore, the step S107 specifically includes the following:

[0110] S701: XOR KET with f5 to restore the random number r'3, concatenate UID, KET, r'3, and T3 to calculate their digest value, and use the obtained digest value as the verification parameter V'3. XOR the digest value of r'3 with f6 to obtain the message f'4. XOR the digest value of f'4 with the value obtained by V'3 to calculate the digest value, and use the obtained digest value as the verification parameter V'4. Verify whether V'4 is equal to V4 in the third data packet. If the verification is successful, the edge node completes the authentication of the cloud platform.

[0111] S702: The edge node generates a random number r4, concatenates f′4, r4 and T4 to calculate its digest value, and uses the obtained digest value as the verification parameter V5. V5 is split into three pieces of information: KS, M, and N, where KS is the negotiated key between the XR terminal and the edge node, and M and N serve as the authentication credentials of the XR terminal to the edge node. The digest value of M is XORed with r′3 to obtain information f7, and the edge node sends the fourth data packet (N, r4, f7, T4) to the XR terminal.

[0112] Furthermore, the step S108 specifically includes the following:

[0113] S801: Concatenate UID and KT to calculate their digest value, concatenate the obtained digest value with r4 and T4 to calculate the digest value, and use the obtained digest value as the verification parameter V-5. V-5 can be split into KST, N', and M', where KST is the negotiated key. Verify whether N' is equal to N in the fourth data packet. If the verification is successful, the XR terminal completes the authentication of the edge node.

[0114] S802: The XR terminal XORs the digest value of M′ with f7 to restore the random number r'3, concatenates KT and r'3 to calculate the digest value, and uses the obtained digest value as the updated key The UID, Concatenate with r''3 to calculate its digest value, and use the obtained digest value as the updated pseudonym Concatenate KST and T5 to calculate their digest value, use the obtained digest value as the verification parameter V6, and send the fifth data packet {V6, T5} to the edge node.

[0115] Example 4: This example is based on the above example. The specific authorization and authentication process for exceeding the maximum message delay time includes the following:

[0116] L1: The cloud platform generates anonymous public and private keys for the XR terminal based on the CPK, where CPK is the standard cryptographic generation center of the combined public key system;

[0117] L2: CPK generates a signature certificate for the XR terminal based on the Schnorr signature method I u ={U pub , E u}, and pass the T in the certificate s Limit the authorized access time of XR terminal users, where E u The master private key for signing XR terminals, U pub The master public key for XR terminal signature, T s is the registration timestamp;

[0118] L3: Cloud platform will (CPK, upk, I u , Ts ) is sent to the XR terminal and the public key parameters (U pub , T a , β a ), where T a The expiration date of the XR terminal certificate, β a is the valid expiration token of the XR terminal certificate, and upk is the XR terminal encryption private key;

[0119] L4: The cloud platform authorizes and authenticates the XR terminal, and then determines whether the XR terminal is successfully authorized and authenticated.

[0120] It should be noted that this example demonstrates the performance of the CPK mechanism through algorithm execution and network simulation. All experiments were completed in an Ubuntu 16.04 system environment with 2GB of memory and a quad-core CPU, and the program design was completed using the Type A elliptic curve in the GMP library and the PBC library.

[0121] Furthermore, the step L1 specifically includes the following:

[0122] L101: Choose a prime number P and construct an elliptic curve over a finite field GF(P) of order P

[0123] E(a, b):y 2 =x 2 +ax+b mod P, where a, b, x, y∈GF(P);

[0124] L102: Select a base point G on E(a, b), whose order is a prime number n, and the CPK generates an m*q private key matrix X PR , by X PR Derived public key matrix Y PU ;

[0125] L103: Select one-way hash function H1: {0, 1} * →{0, 1} n , H2:

[0126] L104: Authorize and authenticate the UID of the XR terminal through the CPK.

[0127] H1(UID)=h1h2..h n ,

[0128] Calculate a binary sequence of fixed length n and split the sequence into x bits to get W1W2..w n , CPK calculates the XR terminal's identification private key isk by multiple addition of n-order finite field, and calculates the XR terminal's identification public key IPK by multiple point addition on the elliptic curve E(a, b);

[0129] L105: CPK generates a public-private key pair (ssk i , SPK i ) composed of a split key sequence, where ssk i To split the private key, SPK i To split the public key, CPK is based on the registration timestamp T of the XR terminal s and UID generate segmentation parameter KP={UID||T s};

[0130] L106: Calculate w′1w′2...w′ by H1(KP)=h1h2..hn n , according to w′ n-1 , w′ n get

[0131] t=w′ n-1 *m+w′ n ,

[0132] Then the split key (ssk) of the XR terminal is obtained from the split key sequence. t , SPK t ), the split key sequence can be simultaneously distributed to N authorized XR terminal users whose authorization is timed out, and each authorized XR terminal user is assigned a split key (ssk t , SPK t );

[0133] L107: CPK calculates the XR terminal's public key PPP and private key upk based on the identification private key and the split key:

[0134]

[0135] L108: CPK distributes the public key PPP and private key upk to the XR terminal using the SSS algorithm;

[0136] Furthermore, the step L2 specifically includes the following:

[0137] L201: Randomly select a number Calculate U pub =U pri .G;

[0138] L202: Calculating E u =U pri +C pri H2(H uid ||PPP||T s )modn, where H uid =H2(H uid ||PPP).

[0139] Furthermore, the step L4 specifically includes the following:

[0140] L401: Cloud platform verifies XR terminal registration timestamp T s The validity period is when the XR terminal registers the timestamp T s Less than the set XR terminal registration timestamp T s If the threshold is reached, it is determined to be valid and the process goes to step L402; otherwise, the authentication fails and the authentication is terminated;

[0141] L402: The cloud platform uses its own key sk and the XR terminal's public key PPP to calculate the intermediate variable P * =sk PPP ;

[0142] L403: Cloud Platform Computing β * =H2(T a ||P * ), and determine whether β a =β * If they are equal, it means that the identity authentication is successful and the XR terminal authentication is passed. If they are not equal, it means that the XR terminal authentication has failed.

[0143] Example 5: On a computer with an Intel Core i7-8250 U 1.60GHz 1.80GHz processor, the operations involved in each protocol were tested 1000 times and the average value was calculated. The test results are as follows: Figure 2 As shown, the hash function is tested with the SHA-256 algorithm, and its time consumption is T H Indicates that the bilinear mapping takes time T Ge Indicates that the elliptic curve point is multiplied by T pm It indicates that the authentication and authorization speed based on hash summary value and XOR operation is much faster. Figure 3The total delay of authorization and authentication in three modes with different numbers of users is shown in this paper. The total delay of authorization is the lowest. It should be noted that the time overhead of CPK calculating the TypeA elliptic curve increases with the increase of k and m. In particular, when k is larger, the increase of m has a greater impact on the computational overhead. Although the computational overhead of the TypeA elliptic curve is large, it can be completed in an offline state. In addition, the SSS key distribution algorithm solves the scalability problem. Therefore, CPK can choose a moderately sized k to reduce the computational overhead. When CPK calculates the key for the XR terminal user, the SSS algorithm can be used to generate the corresponding private key and public key for the XR terminal user. The computational overhead is about 0.36ms, which significantly speeds up the authorization speed and exceeds the maximum message delay time. The specific authorization authentication can be performed offline based on CPK. A USB certificate can be inserted for authorization authentication, which is not limited to authorization authentication in a network environment.

[0144] The beneficial effects of the 5G network-based XR terminal and server authorization and authentication method of the present invention are as follows:

[0145] The present invention generates the public parameters of the system, as well as its own public key pk and private key sk, through the cloud platform, and makes the public parameters and its own public key public. The edge node registers with the cloud platform, and the edge node's own identity is EID. The cloud platform generates a random number x, and splices x to obtain a digest value. The digest value is used as the shared key KE between the edge node and the cloud platform and sent to the edge node. The cloud platform creates and updates the edge node information in the authentication list. The list contains identity, anonymity and shared keys. The XR terminal registers with the cloud platform, and the cloud platform creates and updates the XR terminal information in the authentication list. The XR terminal, the cloud platform and the edge node are connected by sending 5 The data packet is authorized and authenticated based on the hash summary value and the XOR operation. When the maximum message delay time is exceeded during the authentication, the cloud platform uses the CPK authentication method to perform batch authorization authentication on the XR terminal. The authentication method proposed in the present invention uses the hash summary value and the XOR operation to realize fast and lightweight authentication of the XR terminal, reducing the computing pressure and bandwidth transmission pressure of the XR terminal, and adopts the CPK authentication method after the authentication fails due to the maximum message delay time. The security has a very obvious advantage, and the XR terminal can be quickly authorized in batches due to the delay of too much network data, ensuring the authorization stability of the cloud platform for XR terminals based on 5G edge network computing, and realizing a balanced authorization method.

[0146] The present invention and its embodiments are described above. This description is not restrictive. What is shown in the accompanying drawings is only one of the embodiments of the present invention, and the actual content is not limited to this. In short, if ordinary technicians in this field are inspired by it and do not depart from the purpose of the invention, they can creatively design structural methods and embodiments similar to the technical solution, which should all fall within the scope of protection of the present invention.

Claims

1. A 5G network-based XR terminal and server authorization and authentication method, characterized in that: The steps include: S101: System initialization: The cloud platform generates the system's public parameters, as well as its own public key pk and private key sk, and makes the public parameters and its own public key public; S102: The edge node registers with the cloud platform. The edge node's own identity is EID. The cloud platform generates a random number x and concatenates x to obtain a digest value. The resulting digest value is used as the shared key KE between the edge node and the cloud platform and sent to the edge node. The cloud platform creates and updates the edge node information in the authentication list, which contains the identity, anonymity, and shared key. S103: The XR terminal registers with the cloud platform. The XR terminal's own identity identifier is UID. The cloud platform generates a random number y and concatenates y to obtain a digest value. The resulting digest value is used as the shared key KT between the XR terminal and the cloud platform. The cloud platform creates and updates the XR terminal information in the authentication list, which includes the identity identifier, anonymity, and shared key. S104: The XR terminal generates a random number r1, records the current timestamp T1, calculates the XOR of r1 and KT to obtain information f1, concatenates the UID, KT, r1, and T1 to calculate the digest value, and uses the digest value as the authentication parameter V1. The XR terminal sends the first data packet to the edge node; S105: The edge node receives the first data packet, records the current timestamp T2, and determines whether |T2-T1|≤M satisfies the maximum message delay time. If not, the edge node performs maximum message delay time authorization authentication. If so, the edge node generates a random number r2 and sends the second data packet to the cloud platform. S106: The cloud platform receives the second data packet, records the current timestamp T3, and determines whether |T3-T2|≤M is satisfied. If not, the maximum message delay time authorization authentication is performed; if so, the edge node and the XR terminal are authenticated. If the edge node authentication passes, the shared key of the edge node is updated to KET after the update. If the XR terminal authentication passes, the XR terminal authentication is completed. If the XR terminal authentication fails, the shared key of the XR terminal authentication is updated to AET after the update. Then, a random number r3 is generated, and the cloud platform sends a third data packet to the edge node. S107: The edge node receives the third data packet, records the current timestamp T4, and determines whether |T4-T3|≤M is satisfied. If not, it performs maximum message delay time authorization authentication. If so, it generates a negotiated key KS between the XR terminal and the edge node, and then generates a random number r4. The edge node sends a fourth data packet to the XR terminal, the fourth data packet including data N. S108: The XR terminal receives the fourth data packet, records the current timestamp T5, and determines whether |T5-T4|≤M. If not, performs maximum message delay time authorization authentication; If the conditions are met, the UID and KT are concatenated to calculate their digest value, and the resulting digest value is concatenated with r4 and T4 to calculate their digest value. The digest value is used as the authentication parameter V-5, and V-5 is split to determine whether the negotiated secret key KST after the split is equal to N in the fourth data packet. If they are equal, the XR terminal completes the authentication of the edge node, generates a random number r5, and sends a fifth data packet to the edge node. The fifth data packet includes data V6. S109: The edge node receives the fifth data packet, records the current timestamp T6, and determines whether |T6-T5|≤M is satisfied. If not, it performs maximum message delay time authorization authentication; if so, it concatenates KS and T5 to calculate their digest value, and verifies whether the obtained digest value is equal to V6 in the fifth data packet. If they are equal, the XR terminal completes the authentication and authorizes the XR terminal.

2. The method for authorization and authentication of an XR terminal and a server based on a 5G network according to claim 1, wherein: The step S102 specifically includes the following: S201: The edge node sends its own identity identifier EID to the cloud platform through a secure channel; S202: The cloud platform generates a random number y, concatenates the EID and y to calculate the digest value, and uses the obtained digest value as the shared key KE between the edge node and the cloud platform. The EID, KE and y are concatenated to calculate the digest value, and the obtained digest value is used as the edge node pseudonym. , connect KE with Transmit to edge nodes; S203: The edge node stores KE and , complete the registration.

3. The method for authorization and authentication of an XR terminal and a server based on a 5G network according to claim 2, wherein: The step S103 specifically includes the following: Concatenate UID, KT and x to calculate their digest value, and use the resulting digest value as the XR terminal pseudonym. , connect KT with Transmit to XR terminal; The step S104 specifically includes the following: The obtained digest value is used as the authentication parameter V1, and the XR terminal sends the first data packet with the following content: ,f1,V1,T1); The step S105 specifically includes the following: S501: Concatenate EID, KE, r2 and T2 to calculate their digest value, and use the obtained digest value as the authentication parameter V2. XOR r2 with KE to obtain information f2, calculate the digest value of r2, and add the digest value to the authentication parameter V2. XOR calculation to obtain information f3; S502: The edge node sends a second data packet ( , f1, f2, f3, V1, V2, T1, T2) to the cloud platform; S503: KE and r2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated shared key KET. At the same time, EID, KET and r2 are concatenated to calculate their digest value, and the obtained digest value is used as the updated edge node pseudonym AET.

4. The method for authorization and authentication of an XR terminal and a server based on a 5G network according to claim 3, wherein: The step S106 specifically includes the following: S601: The cloud platform is based on Find EID and KE in the authentication list, and restore the random number based on the XOR calculation of KE and f2 , convert EID, KE, Concatenate with T2 to calculate its digest value, and use the obtained digest value as the authentication parameter ,verify Is it equal to V2 in the second data packet? If the verification is successful, the edge node completes the authentication; S602: If the verification fails, the cloud platform will The digest value is calculated by splicing, and the obtained digest value is used as the updated shared key KET. The digest value of f3 is XORed to restore the pseudonym , according to the pseudonym, search UID and KT in the authentication list, and calculate the random number by XORing KT with f1 , UID, KT, Concatenate with T1 to calculate its digest value, and the resulting digest value is used as the authentication parameter ,verify Is it equal to V1 in the second data packet? If the verification is successful, the XR terminal completes the authentication; S603: If the verification fails, the cloud platform generates a random number r3, concatenates the UID and KT to calculate their digest value, and uses the resulting digest value as information f4. The UID, KET, r3, and T3 are concatenated to calculate their digest value, and the resulting digest value is used as the verification parameter V4. The digest value of f4 is calculated and XORed with V3. The resulting value is then calculated again. The resulting digest value is used as the verification parameter V4. The XOR of r3 and KET is calculated to obtain information f5. The digest of r3 is calculated and XORed with f4 to obtain information f6. S604: The cloud platform sends the third data packet {V4, f5, f6, T3} to the edge node, and concatenates KT and r3 to calculate the digest value, which is used as the updated shared key. , and at the same time, UID, and The digest value is calculated by splicing, and the obtained digest value is used as the updated XR terminal pseudonym , UID, KET and The digest values ​​are calculated by concatenation, and the obtained digest value is used as the updated XR terminal pseudonym AET.

5. The method for authorization and authentication of an XR terminal and a server based on a 5G network according to claim 4, characterized in that: The step S107 specifically includes the following: S701: XOR KET with f5 to restore the random number , UID, KET, Combined with T3 to calculate its digest value, the obtained digest value is used as the verification parameter ,Will The digest value is XORed with f6 to get the message ,Will Summary value and The value obtained by XOR calculation is then used to calculate the digest value, and the obtained digest value is used as the verification parameter ,verify Is it equal to V4 in the third data packet? If the verification is successful, the edge node completes the authentication of the cloud platform; S702: The edge node generates a random number r4, , r4 and T4 are spliced ​​together to calculate their digest value, and the obtained digest value is used as the verification parameter V5. V5 is split into three pieces of information: KS, M, and N. KS is the negotiated key between the XR terminal and the edge node, and M and N are the authentication credentials of the XR terminal to the edge node. The digest value of M is compared with The XOR calculation obtains information f7, and the edge node sends the fourth data packet (N, r4, f7, T4) to the XR terminal.

6. The method for authorization and authentication of an XR terminal and a server based on a 5G network according to claim 5, wherein: The step S108 specifically includes the following: S801: Concatenate UID and KT to calculate their digest value, concatenate the obtained digest value with r4 and T4 to calculate the digest value, and use the obtained digest value as the verification parameter V-5. V-5 can be split into KST, 、 , where KST is the negotiated key, verification Is it equal to N in the fourth data packet? If the verification is successful, the XR terminal completes the authentication of the edge node; S802: XR terminals will The summary value is XORed with f7 to restore the random number , KT and Calculate the digest value by splicing, and use the digest value as the update key , UID, and Calculate the digest value by splicing, and use the digest value as the updated pseudonym , concatenate KST and T5 to calculate their digest value, use the obtained digest value as the verification parameter V6, and send the fifth data packet {V6, T5} to the edge node.

7. The method for authorization and authentication of an XR terminal and a server based on a 5G network according to claim 6, wherein: The specific authorization and authentication process for the maximum message delay time includes the following steps: L1: The cloud platform generates anonymous public and private keys for the XR terminal based on the CPK, where CPK is the standard cryptographic generation center of the combined public key system; L2: CPK generates a signature certificate for the XR terminal based on the Schnorr signature method = and passed the certificate Limit the authorized access time of XR terminal users, including: Sign the master private key for the XR terminal. Sign the master public key for the XR terminal. is the registration timestamp; L3: Cloud platform will (CPK, upk, , ) is sent to the XR terminal and the public key parameters are made public ,in The expiration date of the XR terminal certificate. is the valid expiration token of the XR terminal certificate, and upk is the XR terminal encryption private key; L4: The cloud platform authorizes and authenticates the XR terminal, and then determines whether the XR terminal is successfully authorized and authenticated.

Images