Authentication method and system of terminal equipment

Abstract

The invention discloses an authentication method and system for terminal equipment. The method comprises the following steps: core network equipment receives an attachment request message sent by terminal equipment; in response to an attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device; the terminal equipment is used for determining the random number and a first random number corresponding to the first chip identifier; an authentication response message corresponding to the authentication request message and sent by the terminal device is received, and the authentication response message at least comprises the first random number; determining a first chip identifier corresponding to the first random number, and searching the first chip identifier in a chip identifier set; and if the first chip identifier is found in the chip identifier set, determining that the terminal equipment is successfully attached. The technical problem that the identification information of the non-ground network chip has a security risk of being intercepted due to the fact that the identification information of the non-ground network chip is directly transmitted by a wireless air interface is solved.

Description

Technical Field

[0001] The present application relates to the field of satellite communications, and in particular, to an authentication method and system for terminal equipment. Background Art

[0002] In the process of non-terrestrial network (NTN) terminal equipment accessing the core network, the control of terminal equipment based on the chip identification (CPID) of the NTN chip is an important and even the only means for satellite operators to regulate the legal behavior of NTN terminals and protect limited satellite resources.

[0003] However, in the related NTN-based CPID reporting method, there is a security risk that the chip CPID is directly transmitted over the wireless air interface, which may lead to the CPID being intercepted.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a terminal device authentication method and system to at least solve the technical problem that the identification information of the non-terrestrial network chip is subject to the security risk of being intercepted due to the direct transmission of the identification information of the non-terrestrial network chip through the wireless air interface.

[0006] According to one aspect of an embodiment of the present application, a method for authenticating a terminal device is provided, comprising: a core network device receiving an attachment request message sent by a terminal device; in response to the attachment request message sent by the terminal device, the core network device sending an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and a non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message at least includes: a random number; the terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; receiving an authentication response message sent by the terminal device corresponding to the authentication request message, wherein the authentication response message at least includes: the first random number; determining a first chip identifier corresponding to the first random number, and searching for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0007] Optionally, if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully, including: sending a non-access layer-based security mode command message to the terminal device; receiving a security mode completion message sent by the terminal device in response to the security mode command message; sending an attachment acceptance message to the terminal device, and receiving an attachment completion message sent by the terminal device in response to the attachment acceptance message, to determine that the terminal device is attached successfully.

[0008] Optionally, if the first chip identifier is not found in the chip identifier set, an attachment rejection message is sent to the terminal device to determine that the terminal device attachment fails.

[0009] Optionally, the first random number is a mandatory element in the authentication response message, and the first random number is a length-value LV type.

[0010] Optionally, the first random number is an optional information element in the authentication response message, and the first random number is a tag-length-value TLV type, wherein the length of the first random number in the authentication response message is determined by a preset algorithm, the preset algorithm is used to determine the first random number corresponding to the random number and the first chip identifier and determine the first chip identifier corresponding to the first random number, and the information element identifier of the first random number is a first preset character.

[0011] According to another aspect of the embodiment of the present application, there is also provided an authentication method for a terminal device, comprising: a core network device receiving an attachment request message sent by a terminal device; in response to the attachment request message sent by the terminal device, the core network device sending an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; receiving an authentication response message corresponding to the authentication request message sent by the terminal device, and sending a non-access layer-based security mode command message to the terminal device, wherein the terminal device is used to respond to the security mode command message for security configuration, and when the security configuration is completed, determine the random number and a second random number corresponding to the first chip identifier; receiving a security mode completion message sent by the terminal device in response to the security mode command message, wherein the security mode completion message includes at least: a second random number; determining the first chip identifier corresponding to the second random number, and searching for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, determining that the terminal device is attached successfully.

[0012] Optionally, if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully, including: if the first chip identifier is found in the chip identifier set, an attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

[0013] Optionally, if the first chip identifier is not found in the chip identifier set, an attachment rejection message is sent to the terminal device to determine that the terminal device attachment fails.

[0014] Optionally, the second random number is a mandatory element in the security mode completion message, and the second random number is a length-value LV type.

[0015] Optionally, the second random number is an optional information element in the security mode completion message, and the second random number is a tag-length-value TLV type, wherein the length of the second random number in the security mode completion message is determined by a preset algorithm, the preset algorithm is used to determine the second random number corresponding to the random number and the first chip identifier and to determine the first chip identifier corresponding to the second random number, and the information element identifier of the second random number is a second preset character, wherein the second preset character does not include one of the following: 23, 66 and 79.

[0016] According to another aspect of the embodiment of the present application, there is also provided an authentication method for a terminal device, comprising: a core network device receiving an attachment request message sent by a terminal device; in response to the attachment request message sent by the terminal device, the core network device sending an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier; a non-access layer-based security mode command message is sent to the terminal device, and a security mode completion message sent by the terminal device in response to the security mode command message is received; the core network device sends a random allocation command message to the terminal device, wherein the random allocation command message at least includes: a random number; the terminal device is used to determine a third random number corresponding to the random number and the first chip identifier; receiving a random allocation completion message sent by the terminal device in response to the machine allocation command message, wherein the random allocation completion message at least includes: a third random number; determining the first chip identifier corresponding to the third random number, and searching for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0017] Optionally, if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully, including: if the first chip identifier is found in the chip identifier set, an attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

[0018] Optionally, if the first chip identifier is not found in the chip identifier set, an attachment rejection message is sent to the terminal device to determine that the terminal device attachment fails.

[0019] According to another aspect of the embodiment of the present application, there is also provided an authentication system for a terminal device, comprising: a core network device and a terminal device communicatively connected to the core network device, wherein the core network device is used to receive an attachment request message sent by the terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message at least includes: a random number; the terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; the core network device is used to receive an authentication response message sent by the terminal device corresponding to the authentication request message, wherein the authentication response message at least includes: a first random number; the core network device is used to determine a first chip identifier corresponding to the first random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0020] According to another aspect of the embodiment of the present application, there is also provided an authentication system for a terminal device, comprising: a core network device and a terminal device communicatively connected to the core network device, wherein the core network device is used to receive an attachment request message sent by the terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; the core network device is used to receive an authentication response message corresponding to the authentication request message sent by the terminal device, and send a non-access layer-based security mode command message to the terminal device; the terminal device is used to respond to the security mode command message to perform security configuration, and when the security configuration is completed, determine the random number and a second random number corresponding to the first chip identifier; the core network device is used to receive a security mode completion message sent by the terminal device in response to the security mode command message, wherein the security mode completion message includes at least: a second random number; the core network device is used to determine the first chip identifier corresponding to the second random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0021] According to another aspect of the embodiment of the present application, there is also provided an authentication system for a terminal device, comprising: a core network device and a terminal device communicatively connected to the core network device, wherein the core network device is used to receive an attachment request message sent by the terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier; the core network device is used to send a non-access layer-based security mode command message to the terminal device, and receive a security mode completion message sent by the terminal device in response to the security mode command message; send a random allocation command message to the terminal device, wherein the random allocation command message at least includes: a random number; the terminal device is used to determine a third random number corresponding to the random number and the first chip identifier; the core network device is used to receive a random allocation completion message sent by the terminal device in response to the machine allocation command message, wherein the random allocation completion message at least includes: a third random number; the core network device is used to determine the first chip identifier corresponding to the third random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0022] According to another aspect of the embodiments of the present application, a non-volatile storage medium is further provided, the storage medium including a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above authentication method for the terminal device.

[0023] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory and a processor, the processor being used to run a program stored in the memory, wherein the above authentication method for the terminal device is executed when the program is run.

[0024] According to another aspect of the embodiments of the present application, a computer program is further provided, wherein when the computer program is executed by a processor, the above authentication method for a terminal device is implemented.

[0025] According to another aspect of the embodiments of the present application, a computer program product is also provided, the computer program product comprising a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above authentication method for a terminal device is implemented.

[0026] In an embodiment of the present application, a core network device is used to receive an attachment request message sent by a terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identification set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identification, and the authentication request message at least includes: a random number; the terminal device is used to determine the first random number corresponding to the random number and the first chip identification; an authentication response message corresponding to the authentication request message sent by the terminal device is received, wherein the authentication response message at least includes: a first random number; determine the first chip identification corresponding to the first random number, and search for the first chip identification in the chip identification set; if the first chip identification is found in the chip identification set, determine that the terminal device is successfully attached, thereby achieving the purpose of not directly transmitting the identification information of the non-terrestrial network chip over the wireless air interface, thereby achieving the technical effect of reducing the security risk of the identification information of the non-terrestrial network chip being intercepted, and further solving the technical problem of the security risk of the identification information of the non-terrestrial network chip being intercepted due to the direct transmission of the identification information of the non-terrestrial network chip over the wireless air interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0028] Figure 1 is a flow chart of an authentication method for a terminal device according to an embodiment of the present application;

[0029] Figure 2 is a schematic diagram of signaling interaction of an authentication method for a terminal device according to an embodiment of the present application;

[0030] Figure 3 is a flow chart of another terminal device authentication method according to an embodiment of the present application;

[0031] Figure 4 is a schematic diagram of signaling interaction of another authentication method for a terminal device according to an embodiment of the present application;

[0032] Figure 5 is a flow chart of another terminal device authentication method according to an embodiment of the present application;

[0033] Figure 6 is a schematic diagram of signaling interaction of another authentication method for a terminal device according to an embodiment of the present application;

[0034] Figure 7 It is a hardware structure block diagram of a computer terminal according to a terminal device authentication method of an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] According to an embodiment of the present application, a method embodiment of an authentication method for a terminal device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] Figure 1 is a flow chart of a terminal device authentication method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0039] Step S101: The core network device receives an attachment request message sent by a terminal device.

[0040] Terminal equipment includes: NTN terminal equipment, in which each terminal baseband chip supporting NTN function will have a unique CPID identification, CPID consists of 15 4-bit BCD codes, each BCD code is represented by 0 to 9, a total of 60 bits, that is, 7.5 bytes. Bytes 1 to 2 are used to indicate the manufacturer code; bytes 3 to 4 are used to indicate the module code, in which 01 represents conventional narrowband, 02 represents reduced speed narrowband, 03 represents broadband, and 04 represents the Internet of Things; bytes 5 to 6 are used to indicate the chip production year; bytes 7 to 8 are used to indicate the chip production month; bytes 9 to 15 are sorted by the manufacturer.

[0041] Step S102, in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; the terminal device is used to determine the first random number corresponding to the random number and the first chip identifier.

[0042] Step S103: receiving an authentication response message corresponding to the authentication request message sent by the terminal device, wherein the authentication response message at least includes: a first random number.

[0043] Step S104: determine a first chip identifier corresponding to the first random number, and search for the first chip identifier in a chip identifier set.

[0044] Step S105: If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0045] Specifically, the NTN terminal device initiates a registration process and sends an Attach Request (i.e., an attachment request message) to the core network to request access to the NTN network. In response to the Attach Request sent by the terminal device, the core network device sends an Authentication Request (i.e., an authentication request message) to the terminal device, wherein the authentication request message at least includes: a random number RAND, which is used for security calculations in subsequent authentication processes. The core network device stores a preset legal CPID set (chip identifier set), which includes the CPIDs of all legal NTN chips. The non-terrestrial network chip of the NTN terminal device includes a preset first CPID (i.e., a first chip identifier) ​​as the unique identifier of the terminal device. After receiving the Authentication Request from the core network, the terminal device uses RAND and the preset first CPID to calculate the first random number RSLT k through an encryption and decryption algorithm, which is the mapping result of CPID and RAND. In the Authentication Response message, the terminal device carries RSLT k and reports it to the core network instead of directly transmitting the first CPID. After receiving the Authentication Response from the terminal device, the core network device uses the same RAND and RSLT k to reversely calculate CPIDx through an encryption and decryption algorithm. The core network searches for CPID x in the preset legal CPID set to confirm whether it is legal. If CPID x is successfully searched, the authentication is successful, and the core network device can continue the subsequent NAS layer security mode command process with the terminal device. If CPID x fails to be searched, the authentication fails, and the core network device can reject the terminal device's attachment request.

[0046] The solution proposed in this embodiment not only avoids the security risks caused by directly transmitting CPID over the air interface, but also enhances the NTN network's authentication mechanism for the legitimacy of terminal devices by using random numbers in the authentication process. In this way, the NTN core network can identify legitimate terminal devices more safely and efficiently, thereby effectively protecting limited satellite resources and regulating terminal behavior to meet the control needs of operators.

[0047] Figure 2 is a schematic diagram of signaling interaction of an authentication method for a terminal device according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0048] Step S201, distribute the legal CPID to the NTN chip, and preset the legal CPID set in the core network server, including CPID (1 to n).

[0049] Step S202: a legal CPID k is built into each NTN chip, which can be stored in a read-only memory or fixed in the software code.

[0050] Step S203: The terminal initiates a registration process and sends an Attach Request to the core network.

[0051] Step S204: The core network initiates an authentication request and sends an Authentication Request to the terminal, carrying an authentication random number RAND.

[0052] In step S205, in addition to completing the authentication operation, the terminal chip uses RAND and the built-in CPID k as inputs and uses algorithm X to calculate the mapping result RSLT k. When algorithm X is selected, it is required that algorithm X can infer another input parameter CPID k from RAND, one of the input parameters, and the calculation result RSLT k.

[0053] It should be noted that algorithm X is a certain encryption and decryption algorithm, which is not limited or specified in this embodiment.

[0054] Step S206: The terminal initiates an authentication response and sends an Authentication Response to the core network, carrying the mapping result RSLT k.

[0055] In step S207, the core network uses RAND and RSLT k as inputs, and uses the same algorithm X as the terminal chip to reversely calculate CPID x, and searches for CPID x in the legal CPID set. There are two results: (1) If the core network successfully searches for CPID x, CPID authentication succeeds, and steps S208 to S211 are executed; (2) If the core network fails to search for CPID x, CPID authentication fails, and step S212 is executed.

[0056] Step S208: The core network sends a NAS layer Security Mode Command to the terminal.

[0057] Step S209: The terminal responds to the NAS layer SMC and sends Security Mode Complete to the core network.

[0058] Step S210: The core network sends an Attach Accept to the terminal.

[0059] Step S211, the terminal sends Attach Complete to the core network, indicating that the terminal is attached successfully.

[0060] Step S212: The core network sends an Attach Reject to the terminal, indicating that the terminal fails to attach.

[0061] Combine the following Figure 1 and Figure 2 , an exemplary illustration and explanation of the authentication method of the terminal device is given.

[0062] According to some optional embodiments of the present application, if the first chip identifier is found in the chip identifier set and it is determined that the terminal device is attached successfully, it can be achieved by the following method: sending a non-access layer-based security mode command message to the terminal device; receiving a security mode completion message sent by the terminal device in response to the security mode command message; sending an attachment acceptance message to the terminal device, and receiving an attachment completion message sent by the terminal device in response to the attachment acceptance message, to determine that the terminal device is attached successfully.

[0063] That is, after completing the authentication process, the NTN terminal chip uses the authentication random number (RAND) and the built-in chip identifier (CPID) for additional calculations to generate a mapping result (RSLT k). This result is then reported to the NTN core network in the NAS layer Security Mode Complete (SMC) message. The core network uses the same algorithm and RAND to infer the CPID and verify it in the legal CPID set to determine the legitimacy of the terminal.

[0064] Preferably, if the first chip identifier is not found in the chip identifier set, an attachment rejection message is sent to the terminal device to determine that the terminal device attachment fails.

[0065] According to some other optional embodiments of the present application, the first random number is a mandatory element in the authentication response message, and the first random number is a length-value LV type.

[0066] Among them, "L" stands for the length field, which is used to specify the length of the subsequent value field; "V" stands for the value field, which is used to store the actual data. This format type is usually used to transmit variable-length data. Therefore, for parameters such as the first random number, the LV type can flexibly adapt to the length requirements of different random numbers while ensuring the accuracy of data transmission.

[0067] Setting the first random number as a mandatory information element in the authentication response message means that each authentication response must include this parameter. If the first random number is mandatory, the network can ensure that there is enough information to complete the verification process each time, thereby enhancing the reliability and security of the authentication.

[0068] On the other hand, the first random number is an optional information element in the authentication response message, and the first random number is a tag-length-value TLV type, wherein the length of the first random number in the authentication response message is determined by a preset algorithm, the preset algorithm is used to determine the first random number corresponding to the random number and the first chip identifier and determine the first chip identifier corresponding to the first random number, and the information element identifier of the first random number is a first preset character.

[0069] Specifically, the Authentication response message is extended so that the first random number RSLT is carried as an optional information element in TLV format. The specific modifications are as follows: 1. Information Element Identifier (IEI): Use the first preset character (for example, the number "11") to distinguish it from other information elements. 2. Type: TLV to provide more flexible message carrying capabilities. 3. Presence: Optional (O), which means that the terminal can selectively send this information element based on specific security requirements or system configuration. 4. Format and length: The Length field is determined by a preset algorithm to ensure that sufficient information can be correctly inferred.

[0070] It is worth explaining that this embodiment extends the Authentication response message to support carrying the first random number. In the first aspect, a mandatory information element is added, set to LV type, and the following modifications are made based on 3GPP 24.301-i50:

[0071]

[0072] It should be noted that the length of the CPID RSLT field depends on a specific algorithm X in the implementation. After the algorithm X is selected, the length or length range of the CPID RSLT field can be determined.

[0073] Secondly, a new optional information element is added, set to TLV type, and the following modifications are made based on 3GPP 24.301-i50:

[0074]

[0075]

[0076] It should be noted that since the AUTHENTICATION RESPONSE message in the current standard protocol does not have optional information elements, the IEI of the CPID RSLT can be selected at will. Here, 10 is taken as an example. After selection, the terminal and the core network can maintain consistency when enhancing the encoding and decoding functions.

[0077] In the 3GPP standard protocol, each type of NAS (Non-Access Stratum) message has its own specific set of information elements (IE), which define the data types and formats that can be carried in the message. In the AUTHENTICATION RESPONSE message, according to the current standard, it only contains a series of mandatory information elements (such as the Protocol discriminator, Security header type, Authentication response message type, Authentication response parameter, etc. mentioned above), and does not contain any optional information elements. IEI (Information Element Identifier) ​​is an identifier of an information element, which is used to represent a specific information element. In the definition of the standard protocol, each IEI has its specific meaning, which is used to indicate the specific data type carried by the information element. For example, an information element with an IEI of 23 usually represents IMEISV, which is a combination of the international mobile equipment identity code and the software version. When an optional information element CPID RSLT (i.e., the mapping result of CPID) is added to the AUTHENTICATION RESPONSE message, since there is no reserved optional position in the current message format, an IEI needs to be selected for this new information element. Since there is no specific definition for unused IEI values ​​in the standard protocol, one of these unused IEI values ​​can be selected as the identifier of CPID RSLT. Here, 10 is selected as an example, that is, IEI = 10, which is used to represent the mapping result information element of CPID. This selection is arbitrary, as long as both the terminal and the core network recognize and use the same IEI value. After selecting the IEI, both parties must also be consistent when enhancing the encoding and decoding functions, that is, the terminal uses IEI = 10 to encode CPID RSLT when sending messages, and the core network should also identify IEI = 10 when receiving messages to decode the information of CPID RSLT. In summary, the selection of IEI is not limited to a specific value, but once selected, it needs to be strictly followed in the enhanced functions of the terminal and the core network to ensure the correct transmission and decoding of the message, thereby achieving secure transmission and legal authentication of the CPID mapping result. This enhancement not only conforms to the framework of the existing standard protocol, but also can efficiently and flexibly expand the protocol function and meet new security requirements by using undefined IEI.

[0078] Figure 3 is a flow chart of another terminal device authentication method according to an embodiment of the present application. Figure 3 As shown, the method comprises the following steps:

[0079] Step S301: The core network device receives an attachment request message sent by a terminal device.

[0080] Step S302, in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number.

[0081] Step S303, receiving an authentication response message corresponding to the authentication request message sent by the terminal device, and sending a non-access layer-based security mode command message to the terminal device, wherein the terminal device is used to respond to the security mode command message to perform security configuration, and when the security configuration is completed, determine the random number and the second random number corresponding to the first chip identifier.

[0082] Step S304: receiving a security mode completion message sent by the terminal device in response to the security mode command message, wherein the security mode completion message includes at least: a second random number.

[0083] Step S305: determine the first chip identifier corresponding to the second random number, and search for the first chip identifier in the chip identifier set.

[0084] Step S306: If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0085] Specifically, when the NTN terminal device attempts to access the network, it sends an Attach Request message to the core network device, which is the start of the registration process. As part of the registration process, the core network device responds to the received Attach Request and sends an Authentication Request message to the terminal device, which contains at least a random number (RAND). After receiving the authentication request, the terminal device uses RAND and its internally preset first chip identifier (i.e., CPID) to perform some encryption or calculation operations to generate a new random number, which is called the second random number (RSLT k).

[0086] The core network device continues the process and sends a Security Mode Command (security mode command based on non-access layer) message to the terminal device, prompting the terminal device to perform security configuration. Subsequently, after the terminal device completes the security mode configuration, it will send a Security Mode Complete (security mode completion) message to the core network device, which contains at least the second random number RSLT k. Since the message is encrypted in the new security context, the security of the transmission is further improved.

[0087] After receiving the security mode completion message, the core network device uses the second random number RSLT k and the previously sent RAND to reversely calculate or decrypt to restore the first chip identifier (CPID k). Then, the core network device searches for CPID k in its preset legal chip identifier set to verify the legitimacy of the terminal device.

[0088] If the first chip identifier is found in the chip identifier set, the core network device determines that the terminal device is attached successfully, and sends an Attach Accept message to the terminal device, and the terminal device then sends an Attach Complete message to confirm the successful attachment. If the first chip identifier is not found in the chip identifier set, the core network device determines that the terminal device fails to attach, and sends an Attach Reject message to the terminal device to prevent access by illegal terminals.

[0089] By using the second random number RSLT k instead of directly transmitting CPID, the exposure of CPID in air interface transmission is effectively prevented, reducing security risks. Indirect authentication of CPID is introduced in the security mode command process to ensure that the transmission and authentication process of CPID is under encryption protection, improving the security strength of the entire authentication process. Without changing the basic framework of the existing NTN network registration and security process, the authentication process of the chip identification is enhanced, which is conducive to rapid deployment and implementation.

[0090] Figure 4 FIG. 4 is a schematic diagram of signaling interaction of another authentication method for a terminal device according to an embodiment of the present application. Figure 4 As shown, the method comprises the following steps:

[0091] Step S401, distribute the legal CPID to the NTN chip, and preset the legal CPID set in the core network server, including CPID (1 to n).

[0092] Step S402: a legal CPID k is built into each NTN chip, which can be stored in a read-only memory or fixed in the software code.

[0093] Step S403: The terminal initiates a registration process and sends an Attach Request to the core network.

[0094] Step S404: The core network initiates an authentication request and sends an Authentication Request to the terminal, carrying an authentication random number RAND.

[0095] Step S405: The terminal initiates an authentication response and sends an Authentication Response to the core network, and the terminal continues to store the random number RAND.

[0096] Step S406: The core network sends a NAS layer Security Mode Command to the terminal.

[0097] In step S407, in addition to completing the security mode operation, the terminal chip uses RAND and the built-in CPID k as inputs and uses algorithm X to calculate the mapping result RSLT k. When algorithm X is selected, algorithm X is required to be able to infer another input parameter CPID k from RAND, one of the input parameters, and the calculation result RSLT k.

[0098] It should be noted that algorithm X is a certain encryption and decryption algorithm, which is not limited or specified in this embodiment.

[0099] Step S408: The terminal responds to the NAS layer SMC and sends a Security Mode Complete message carrying RSLTk to the core network.

[0100] In step S409, the core network uses RAND and RSLT k as inputs, and uses the same algorithm X as the terminal chip to reversely calculate CPID x, and searches for CPID x in the legal CPID set. There are two results: (1) If the core network successfully searches for CPID x, CPID authentication succeeds, and steps S410 to S411 are executed; (2) If the core network fails to search for CPID x, CPID authentication fails, and step S412 is executed.

[0101] Step S410: The core network sends an Attach Accept to the terminal.

[0102] Step S411, the terminal sends Attach Complete to the core network, indicating that the terminal is attached successfully.

[0103] Step S412: The core network sends an Attach Reject to the terminal, indicating that the terminal fails to attach.

[0104] Combine the following Figure 3 and Figure 4 , an exemplary illustration and explanation of the authentication method of the terminal device is given.

[0105] In some optional embodiments, if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully. This can be achieved by the following method: if the first chip identifier is found in the chip identifier set, an attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

[0106] Preferably, if the first chip identifier is not found in the chip identifier set, an attachment rejection message is sent to the terminal device to determine that the terminal device attachment fails.

[0107] According to some preferred embodiments of the present application, the second random number is a mandatory element in the security mode completion message, and the second random number is a length-value LV type.

[0108] On the other hand, the second random number is an optional information element in the security mode completion message, and the second random number is a tag-length-value TLV type, wherein the length of the second random number in the security mode completion message is determined by a preset algorithm, and the preset algorithm is used to determine the second random number corresponding to the random number and the first chip identifier and to determine the first chip identifier corresponding to the second random number, and the information element identifier of the second random number is a second preset character, wherein the second preset character does not include one of the following: 23, 66 and 79.

[0109] It is worth explaining that this embodiment extends the Security Mode Complete message to support carrying a second random number. First, a mandatory information element is added, set to LV type, and the following modifications are made based on 3GPP 24.301-i50:

[0110]

[0111]

[0112] It should be noted that the length of the CPID RSLT field depends on a specific algorithm X in the implementation. After the algorithm X is selected, the length or length range of the CPID RSLT field can be determined.

[0113] Second, add an optional cell, set it to TLV type, and make the following modifications based on 3GPP 24.301-i50:

[0114]

[0115] It should be noted that since the SECURITY MODE COMPLETE message in the current standard protocol has three optional information elements, the IEI of CPID RSLT can select a valid value other than 23 / 79 / 66. Here, 10 is taken as an example. After selection, the terminal and the core network can maintain consistency when enhancing the encoding and decoding functions.

[0116] Figure 5 is a flow chart of another terminal device authentication method according to an embodiment of the present application. Figure 5 As shown, the method comprises the following steps:

[0117] Step S501: The core network device receives an attachment request message sent by a terminal device.

[0118] Step S502, in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier.

[0119] Step S503: Send a non-access layer-based security mode command message to the terminal device, and receive a security mode completion message sent by the terminal device in response to the security mode command message.

[0120] Step S504: The core network device sends a random allocation command message to the terminal device, wherein the random allocation command message includes at least: a random number; and a third random number used by the terminal device to determine the random number and corresponding to the first chip identifier.

[0121] Step S505: receiving a random allocation completion message sent by the terminal device in response to the machine allocation command message, wherein the random allocation completion message at least includes: a third random number.

[0122] Step S506: determine the first chip identifier corresponding to the third random number, and search for the first chip identifier in the chip identifier set.

[0123] Step S507: If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0124] Specifically, the core network device monitors the communication from the terminal device and receives the initial attachment request (Attach Request) message sent by it. The core network device initiates the authentication process to the terminal device through an authentication request message (Authentication Request), which carries an authentication random number (RAND).

[0125] After the terminal device successfully passes the authentication, the core network device sends a Security Mode Command message to establish encrypted NAS layer communication. The terminal device responds to the Security Mode Command and sends a Security Mode Complete message to confirm the establishment of NAS layer security.

[0126] As a measure to enhance security, the core network device sends a newly defined random allocation command (RandAllocation Command) message to the terminal device, which includes at least one random number (RAND2) as input. After receiving RAND2, the terminal device combines its built-in first chip identifier (CPID k) and a certain encryption algorithm (algorithm X) to calculate a new third random number (RSLT k).

[0127] After the terminal device calculates RSLT k, it sends a random allocation complete (Rand AllocationComplete) message to the core network device, which contains at least RSLT k as its content. After receiving RSLT k, the core network device uses the same algorithm X and RAND2 as input to calculate the corresponding CPID x. The core network searches for CPID x in the preset chip identification set to verify its legitimacy.

[0128] If CPID x exists in the chip identifier set, the core network device confirms that the chip identifier of the terminal device is legal, sends an Attach Accept message, and completes the attachment process. If no matching CPID x is found, the core network device sends an Attach Reject message to prevent the attachment of illegal terminals.

[0129] In summary, by calculating and transmitting the third random number RSLT k, the direct exposure of the CPID identifier is avoided, reducing the risk of CPID being intercepted. The introduction of RAND2 and the calculation of RSLT k increases the difficulty of illegally intercepting and cracking CPID. RSLTk is transmitted through an encrypted NAS layer message after the security mode is established, further enhancing communication security.

[0130] Figure 6 FIG. 4 is a schematic diagram of signaling interaction of another authentication method for a terminal device according to an embodiment of the present application. Figure 6 As shown, the method comprises the following steps:

[0131] Step S601, distribute the legal CPID to the NTN chip, and preset the legal CPID set in the core network server, including CPID (1 to n).

[0132] Step S602: a legal CPID k is built into each NTN chip, which can be stored in a read-only memory or fixed in the software code.

[0133] Step S603: The terminal initiates a registration process and sends an Attach Request to the core network.

[0134] Step S604: The core network initiates an authentication request and sends an Authentication Request to the terminal, carrying an authentication random number RAND.

[0135] Step S605: The terminal initiates an authentication response and sends an Authentication Response to the core network, and the terminal continues to store the random number RAND.

[0136] Step S606: The core network sends a NAS layer Security Mode Command to the terminal.

[0137] Step S607: The terminal responds to the NAS layer SMC and sends Security Mode Complete to the core network.

[0138] Step S608: The core network sends a Rand Allocation Command to the terminal, carrying a random number RAND.

[0139] Step S609, the terminal chip uses RAND and built-in CPID k as inputs and uses algorithm X to calculate the mapping result RSLT k. When algorithm X is selected, it is required that algorithm X can infer another input parameter CPID k from RAND, one of the input parameters, and the calculation result RSLT k.

[0140] It should be noted that algorithm X is a certain encryption and decryption algorithm, which is not limited or specified in this embodiment.

[0141] Step S610: The terminal sends a Rand Allocation Complete message carrying RSLT k to the core network.

[0142] In step S611, the core network uses RAND and RSLT k as inputs, and uses the same algorithm X as the terminal chip to reversely calculate CPID x, and searches for CPID x in the legal CPID set. There are two results: (1) If the core network successfully searches for CPID x, CPID authentication succeeds, and steps S612 to S613 are executed; (2) If the core network fails to search for CPID x, CPID authentication fails, and step S614 is executed.

[0143] Step S612: The core network sends an Attach Accept to the terminal.

[0144] Step S613: The terminal sends an Attach Complete message to the core network, indicating that the terminal has attached successfully.

[0145] Step S614: the core network sends an Attach Reject to the terminal, indicating that the terminal fails to attach.

[0146] Combine the following Figure 5 and Figure 6 , an exemplary illustration and explanation of the authentication method of the terminal device is given.

[0147] As some optional embodiments of the present application, if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully. This can be achieved by the following method: if the first chip identifier is found in the chip identifier set, an attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

[0148] Preferably, if the first chip identifier is not found in the chip identifier set, an attachment rejection message is sent to the terminal device to determine that the terminal device attachment fails.

[0149] It should be noted that the newly added Rand Allocation Command and Rand Allocation Complete messages can refer to the newly added definition of NAS layer air interface messages in 3GPP 24.301-i50. This embodiment does not make additional format requirements, but the terminal and the core network need to be consistent when enhancing the encoding and decoding functions.

[0150] An embodiment of the present application also provides an authentication system for a terminal device, comprising: a core network device and a terminal device communicatively connected to the core network device, wherein the core network device is used to receive an attachment request message sent by the terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message at least includes: a random number; the terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; the core network device is used to receive an authentication response message sent by the terminal device corresponding to the authentication request message, wherein the authentication response message at least includes: a first random number; the core network device is used to determine a first chip identifier corresponding to the first random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0151] Specifically, the NTN terminal device initiates a registration process and sends an Attach Request (i.e., an attachment request message) to the core network to request access to the NTN network. In response to the Attach Request sent by the terminal device, the core network device sends an Authentication Request (i.e., an authentication request message) to the terminal device, wherein the authentication request message at least includes: a random number RAND, which is used for security calculations in subsequent authentication processes. The core network device stores a preset legal CPID set (chip identifier set), which includes the CPIDs of all legal NTN chips. The non-terrestrial network chip of the NTN terminal device includes a preset first CPID (i.e., a first chip identifier) ​​as the unique identifier of the terminal device. After receiving the Authentication Request from the core network, the terminal device uses RAND and the preset first CPID to calculate the first random number RSLT k through an encryption and decryption algorithm, which is the mapping result of CPID and RAND. In the Authentication Response message, the terminal device carries RSLT k and reports it to the core network instead of directly transmitting the first CPID. After receiving the Authentication Response from the terminal device, the core network device uses the same RAND and RSLT k to reversely calculate CPIDx through an encryption and decryption algorithm. The core network searches for CPID x in the preset legal CPID set to confirm whether it is legal. If CPID x is successfully searched, the authentication is successful, and the core network device can continue the subsequent NAS layer security mode command process with the terminal device. If CPID x fails to be searched, the authentication fails, and the core network device can reject the terminal device's attachment request.

[0152] The preferred implementation of the above embodiment can be found in Figure 1 and Figure 2 The relevant description of the illustrated embodiment will not be repeated here.

[0153] The embodiment of the present application also provides an authentication system for a terminal device, a core network device, and a terminal device communicatively connected to the core network device, wherein the core network device is used to receive an attachment request message sent by the terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; the core network device is used to receive an authentication response message corresponding to the authentication request message sent by the terminal device, and send a non-access layer-based security mode command message to the terminal device; the terminal device is used to respond to the security mode command message to perform security configuration, and when the security configuration is completed, determine the random number and a second random number corresponding to the first chip identifier; the core network device is used to receive a security mode completion message sent by the terminal device in response to the security mode command message, wherein the security mode completion message includes at least: a second random number; the core network device is used to determine the first chip identifier corresponding to the second random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0154] Specifically, when the NTN terminal device attempts to access the network, it sends an Attach Request message to the core network device, which is the start of the registration process. As part of the registration process, the core network device responds to the received Attach Request and sends an Authentication Request message to the terminal device, which contains at least a random number (RAND). After receiving the authentication request, the terminal device uses RAND and its internally preset first chip identifier (i.e., CPID) to perform some encryption or calculation operations to generate a new random number, which is called the second random number (RSLT k).

[0155] The core network device continues the process and sends a Security Mode Command (security mode command based on non-access layer) message to the terminal device, prompting the terminal device to perform security configuration. Subsequently, after the terminal device completes the security mode configuration, it will send a Security Mode Complete (security mode completion) message to the core network device, which contains at least the second random number RSLT k. Since the message is encrypted in the new security context, the security of the transmission is further improved.

[0156] After receiving the security mode completion message, the core network device uses the second random number RSLT k and the previously sent RAND to reversely calculate or decrypt to restore the first chip identifier (CPID k). Then, the core network device searches for CPID k in its preset legal chip identifier set to verify the legitimacy of the terminal device.

[0157] If the first chip identifier is found in the chip identifier set, the core network device determines that the terminal device is attached successfully, and sends an Attach Accept message to the terminal device, and the terminal device then sends an Attach Complete message to confirm the successful attachment. If the first chip identifier is not found in the chip identifier set, the core network device determines that the terminal device fails to attach, and sends an Attach Reject message to the terminal device to prevent access by illegal terminals.

[0158] By using the second random number RSLT k instead of directly transmitting CPID, the exposure of CPID in air interface transmission is effectively prevented, reducing security risks. Indirect authentication of CPID is introduced in the security mode command process to ensure that the transmission and authentication process of CPID is under encryption protection, improving the security strength of the entire authentication process. Without changing the basic framework of the existing NTN network registration and security process, the authentication process of the chip identification is enhanced, which is conducive to rapid deployment and implementation.

[0159] The preferred implementation of the above embodiment can be found in Figure 3 and Figure 4 The relevant description of the illustrated embodiment will not be repeated here.

[0160] The embodiment of the present application also provides an authentication system for a terminal device, comprising: a core network device and a terminal device communicatively connected to the core network device, wherein the core network device is used to receive an attachment request message sent by the terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier; the core network device is used to send a non-access layer-based security mode command message to the terminal device, and receive a security mode completion message sent by the terminal device in response to the security mode command message; send a random allocation command message to the terminal device, wherein the random allocation command message at least includes: a random number; the terminal device is used to determine a third random number corresponding to the random number and the first chip identifier; the core network device is used to receive a random allocation completion message sent by the terminal device in response to the machine allocation command message, wherein the random allocation completion message at least includes: a third random number; the core network device is used to determine the first chip identifier corresponding to the third random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0161] Specifically, the core network device monitors the communication from the terminal device and receives the initial attachment request (Attach Request) message sent by it. The core network device initiates the authentication process to the terminal device through an authentication request message (Authentication Request), which carries an authentication random number (RAND).

[0162] After the terminal device successfully passes the authentication, the core network device sends a Security Mode Command message to establish encrypted NAS layer communication. The terminal device responds to the Security Mode Command and sends a Security Mode Complete message to confirm the establishment of NAS layer security.

[0163] As a measure to enhance security, the core network device sends a newly defined random allocation command (RandAllocation Command) message to the terminal device, which includes at least one random number (RAND2) as input. After receiving RAND2, the terminal device combines its built-in first chip identifier (CPID k) and a certain encryption algorithm (algorithm X) to calculate a new third random number (RSLT k).

[0164] After the terminal device calculates RSLT k, it sends a random allocation complete (Rand AllocationComplete) message to the core network device, which contains at least RSLT k as its content. After receiving RSLT k, the core network device uses the same algorithm X and RAND2 as input to calculate the corresponding CPID x. The core network searches for CPID x in the preset chip identification set to verify its legitimacy.

[0165] If CPID x exists in the chip identifier set, the core network device confirms that the chip identifier of the terminal device is legal, sends an Attach Accept message, and completes the attachment process. If no matching CPID x is found, the core network device sends an Attach Reject message to prevent the attachment of illegal terminals.

[0166] In summary, by calculating and transmitting the third random number RSLT k, the direct exposure of the CPID identifier is avoided, reducing the risk of CPID being intercepted. The introduction of RAND2 and the calculation of RSLT k increases the difficulty of illegally intercepting and cracking CPID. RSLTk is transmitted through an encrypted NAS layer message after the security mode is established, further enhancing communication security.

[0167] The preferred implementation of the above embodiment can be found in Figure 5 and Figure 6 The relevant description of the illustrated embodiment will not be repeated here.

[0168] Figure 7 The hardware structure block diagram of a computer terminal for implementing the authentication method of a terminal device is shown. Figure 7 As shown, the computer terminal 70 may include one or more (shown as 702a, 702b, ..., 702n in the figure) processors 702 (the processor 702 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 704 for storing data, and a transmission module 706 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 7 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 7 More or fewer components as shown, or with Figure 7 Different configurations are shown.

[0169] It should be noted that the one or more processors 702 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 70. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0170] The memory 704 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the authentication method of the terminal device in the embodiment of the present application. The processor 702 executes various functional applications and data processing by running the software programs and modules stored in the memory 704, that is, the authentication method of the terminal device described above is realized. The memory 704 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 704 may further include a memory remotely arranged relative to the processor 702, and these remote memories may be connected to the computer terminal 70 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0171] The transmission module 706 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 70. In one example, the transmission module 706 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 706 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0172] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 70 .

[0173] It should be noted that, in some optional embodiments, the above Figure 7 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 7 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0174] It should be noted that Figure 7 The computer terminal shown is used to execute Figure 1 , Figure 3 as well as Figure 5 The authentication method of the terminal device shown in the figure, therefore the relevant explanations in the execution method of the above command are also applicable to the electronic device and will not be repeated here.

[0175] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above authentication method for the terminal device.

[0176] A program for executing the following functions in a non-volatile storage medium: a core network device receives an attachment request message sent by a terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and a non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; the terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; receiving an authentication response message sent by the terminal device corresponding to the authentication request message, wherein the authentication response message includes at least: a first random number; determining a first chip identifier corresponding to the first random number, and searching for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, determining that the terminal device is attached successfully.

[0177] An embodiment of the present application further provides an electronic device, including: a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the above authentication method for the terminal device is executed when the program is run.

[0178] The processor is used to run a program that performs the following functions: a core network device receives an attachment request message sent by a terminal device; in response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and a non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message at least includes: a random number; the terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; receiving an authentication response message sent by the terminal device corresponding to the authentication request message, wherein the authentication response message at least includes: a first random number; determining a first chip identifier corresponding to the first random number, and searching for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

[0179] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0180] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0181] In the above-mentioned embodiments of the present application, the collected information is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary protection measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0182] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0183] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0184] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0185] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0186] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A terminal device authentication method, characterized in that: include: The core network device receives the attachment request message sent by the terminal device; In response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; the terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; receiving an authentication response message corresponding to the authentication request message sent by the terminal device, wherein the authentication response message at least includes: the first random number; Determine the first chip identifier corresponding to the first random number, and search for the first chip identifier in the chip identifier set; If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

2. The method according to claim 1, characterized in that If the first chip identifier is found in the chip identifier set, determining that the terminal device is attached successfully includes: Sending a non-access layer-based security mode command message to the terminal device; receiving a safe mode completion message sent by the terminal device in response to the safe mode command message; An attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

3. The method according to claim 1, characterized in that The method further includes: if the first chip identifier is not found in the chip identifier set, sending an attachment rejection message to the terminal device to determine that the terminal device fails to attach.

4. The method according to claim 1, characterized in that: The first random number is a mandatory element in the authentication response message, and the first random number is a length-value LV type.

5. The method according to claim 1, characterized in that The first random number is an optional information element in the authentication response message, and the first random number is a tag-length-value TLV type, wherein the length of the first random number in the authentication response message is determined by a preset algorithm, and the preset algorithm is used to determine the first random number corresponding to the random number and the first chip identifier and determine the first chip identifier corresponding to the first random number, and the information element identifier of the first random number is a first preset character.

6. A terminal device authentication method, characterized in that: include: The core network device receives the attachment request message sent by the terminal device; In response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; receiving an authentication response message corresponding to the authentication request message sent by the terminal device, and sending a security mode command message based on the non-access layer to the terminal device, wherein the terminal device is used to respond to the security mode command message to perform security configuration, and when the security configuration is completed, determine the random number and a second random number corresponding to the first chip identifier; receiving a security mode completion message sent by the terminal device in response to the security mode command message, wherein the security mode completion message includes at least: the second random number; Determine the first chip identifier corresponding to the second random number, and search for the first chip identifier in the chip identifier set; If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

7. The method according to claim 6, characterized in that If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully, including: if the first chip identifier is found in the chip identifier set, an attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

8. The method according to claim 6, characterized in that The method further includes: if the first chip identifier is not found in the chip identifier set, sending an attachment rejection message to the terminal device to determine that the terminal device fails to attach.

9. The method according to claim 6, characterized in that The second random number is a mandatory element in the security mode completion message, and the second random number is a length-value LV type.

10. The method according to claim 6, characterized in that The second random number is an optional information element in the security mode completion message, and the second random number is a tag-length-value TLV type, wherein the length of the second random number in the security mode completion message is determined by a preset algorithm, and the preset algorithm is used to determine the second random number corresponding to the random number and the first chip identifier and to determine the first chip identifier corresponding to the second random number, and the information element identifier of the second random number is a second preset character, wherein the second preset character does not include one of the following: 23, 66 and 79.

11. A terminal device authentication method, characterized in that: include: The core network device receives the attachment request message sent by the terminal device; In response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier; Sending a non-access layer-based security mode command message to the terminal device, and receiving a security mode completion message sent by the terminal device in response to the security mode command message; The core network device sends a random allocation command message to the terminal device, wherein the random allocation command message includes at least: a random number; the terminal device is used to determine a third random number corresponding to the random number and the first chip identifier; receiving a random allocation completion message sent by the terminal device in response to the machine allocation command message, wherein the random allocation completion message at least includes: the third random number; Determine the first chip identifier corresponding to the third random number, and search for the first chip identifier in the chip identifier set; If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

12. The method according to claim 11, characterized in that If the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully, including: if the first chip identifier is found in the chip identifier set, an attachment acceptance message is sent to the terminal device, and an attachment completion message sent by the terminal device in response to the attachment acceptance message is received, to determine that the terminal device is attached successfully.

13. The method according to claim 11, characterized in that The method further includes: if the first chip identifier is not found in the chip identifier set, sending an attachment rejection message to the terminal device to determine that the terminal device fails to attach.

14. A terminal device authentication system, characterized in that: include: A core network device and a terminal device connected to the core network device for communication, wherein: The core network device is used to receive the attachment request message sent by the terminal device; In response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; The terminal device is used to determine a first random number corresponding to the random number and the first chip identifier; The core network device is used to receive an authentication response message corresponding to the authentication request message sent by the terminal device, wherein the authentication response message at least includes: the first random number; The core network device is used to determine the first chip identifier corresponding to the first random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

15. A terminal device authentication system, characterized in that: include: A core network device and a terminal device connected to the core network device for communication, wherein: The core network device is used to receive the attachment request message sent by the terminal device; In response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, the non-terrestrial network chip of the terminal device includes a preset first chip identifier, and the authentication request message includes at least: a random number; The core network device is used to receive an authentication response message corresponding to the authentication request message sent by the terminal device, and send a security mode command message based on the non-access layer to the terminal device; The terminal device is used to respond to the security mode command message to perform security configuration, and when the security configuration is completed, determine the random number and a second random number corresponding to the first chip identifier; The core network device is used to receive a security mode completion message sent by the terminal device in response to the security mode command message, wherein the security mode completion message at least includes: the second random number; The core network device is used to determine the first chip identifier corresponding to the second random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

16. A terminal device authentication system, characterized in that: include: A core network device and a terminal device connected to the core network device for communication, wherein: The core network device is used to receive the attachment request message sent by the terminal device; In response to the attachment request message sent by the terminal device, the core network device sends an authentication request message to the terminal device, wherein a preset chip identifier set is stored in the core network device, and the non-terrestrial network chip of the terminal device includes a preset first chip identifier; The core network device is used to send a non-access layer-based security mode command message to the terminal device, and receive a security mode completion message sent by the terminal device in response to the security mode command message; send a random allocation command message to the terminal device, wherein the random allocation command message at least includes: a random number; The terminal device is used to determine the random number and a third random number corresponding to the first chip identifier; The core network device is used to receive a random allocation completion message sent by the terminal device in response to the machine allocation command message, wherein the random allocation completion message at least includes: the third random number; The core network device is used to determine the first chip identifier corresponding to the third random number, and search for the first chip identifier in the chip identifier set; if the first chip identifier is found in the chip identifier set, it is determined that the terminal device is attached successfully.

17. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the authentication method of the terminal device described in any one of claims 1 to 5, the authentication method of the terminal device described in any one of claims 6 to 10, and the authentication method of the terminal device described in any one of claims 11 to 13.

18. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein when the program is run, the authentication method for a terminal device described in any one of claims 1 to 5, the authentication method for a terminal device described in any one of claims 6 to 10, and the authentication method for a terminal device described in any one of claims 11 to 13 are executed.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the authentication method of a terminal device described in any one of claims 1 to 5, the authentication method of a terminal device described in any one of claims 6 to 10, and the authentication method of a terminal device described in any one of claims 11 to 13.

Images