A method and system for application trust verification based on APN6 network

Abstract

The present invention belongs to the field of communication technology, and discloses a method and system for application trust verification based on an APN6 network. The method is based on a pre-built application middleware platform, including: sending a first authentication request to a trusted authentication platform based on user information to obtain a user-level trusted credential; based on the entry of the user-level trusted credential, triggering the application middleware platform to apply for an identification code for a target client corresponding to the user to the industrial Internet identification resolution system through the HTTPS protocol; based on the user-level trusted credential, identification code and business address, sending a second authentication request to the trusted authentication platform to verify the user-level trusted credential, and then obtain a business-level trusted credential; based on the business-level trusted credential and SLA indicators, generating a business request to request network resources from the APN6 controller, and then realizing the corresponding business activation. The present invention not only has low technical barriers and low costs, but also has better network security.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an application trust verification method and system based on an APN6 network. Background Art

[0002] APN6 network, or application-aware IPV6 network, is a core enabling technology for the further integration of services and bearer networks. It has important application value in promoting the development of cloud-network integration.

[0003] Specifically, from a technical perspective, the APN6 network has, to a certain extent, broken the end-to-end design principle of Internet layered decoupling, thus promoting changes in network architecture. From an application perspective, the APN6 network has refined network operation services and end-to-end collaboration capabilities, enabling network operators to accurately perceive key services and provide more refined network services, allowing both TOC and TOB users to obtain a better user experience, and enabling application APP providers to gain higher user stickiness due to improved user satisfaction.

[0004] However, the gradual penetration of user applications based on the APN6 network in the field of network transmission not only brings the above-mentioned application advantages, but also introduces a series of network security risks. In particular, the accurate identification of the legitimacy of the application and the correct identification of user information exist as the most basic network security issues. At present, the common solutions in the industry to achieve application legitimacy identification and user information identification are application information encryption, access verification, etc., to improve the corresponding network security by blocking illegal information from entering the network between peer networks. However, the inventors have found that this type of method not only has a high technical threshold, but most of them require payment for use. Inappropriate encryption settings are more likely to lead to data loss or encryption failure, thereby posing a security threat to the APN6 network. Summary of the invention

[0005] The purpose of the present invention is to provide an application trust verification method and system based on the APN6 network, so as to improve the technical problems of the existing application trust verification method in actual application, such as high technical threshold, high cost threshold, and inability to effectively avoid security risks.

[0006] To achieve the above object, the present invention proposes the following technical solutions:

[0007] In the first aspect, the technical solution provides an application trust verification method based on the APN6 network, which is performed based on a pre-built application middleware platform; wherein the application middleware platform is located on the user side and is associated with the industrial Internet identity resolution system, the trusted authentication platform, the APN6 controller and each application client;

[0008] The steps include:

[0009] The application middleware platform sends a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential;

[0010] Based on the entry of the user-level trusted credential, the application middleware platform is triggered to apply for an identification code for a target client corresponding to the user from the industrial Internet identification resolution system through the HTTPS protocol; wherein the identification code includes a prefix part and a suffix part; wherein the prefix part includes a country code, an industry code and a user code in sequence, and the suffix part includes a client address of the target client;

[0011] Sending a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential, thereby obtaining the business-level trusted credential;

[0012] Generate a service request based on the service-level trusted credentials and SLA indicators to request network resources from the APN6 controller, thereby realizing corresponding service activation; wherein the SLA indicators include latency parameters, bandwidth parameters, jitter parameters, and packet loss rate parameters;

[0013] Among them, after the APN6 controller obtains the service request, it first parses the service request and verifies the signature with the trusted authentication platform based on the parsed service-level trusted certificate; then, when it is determined that the signature verification is passed, it generates the APN service, builds the SLA network quality template, and sends the APN policy to the devices within the APN6 network domain to realize the activation of network resources; wherein, the encoding of the APN service includes the user information and the identification code.

[0014] Further, the application middleware platform is deployed in the CPE device; the service request is generated based on the service-level trusted credentials and SLA indicators to request network resources from the APN6 controller, thereby realizing corresponding service activation; including:

[0015] The CPE device obtains a service request from a target client;

[0016] Forwarding the service request to the APN6 network domain, and continuing to transmit it to the application server according to the SLA indicator;

[0017] After acquiring the content from the application server, continue to transmit it back to the target client according to the SLA indicator.

[0018] Further, the application middleware platform sends a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential; including:

[0019] The step of generating the user-level trusted credential through the trusted authentication platform includes:

[0020] Using the user information as the summary value, the platform private key is used to perform hash processing on the two-tuple consisting of the user information and the corresponding timestamp through the national secret SM3 hashing algorithm to generate the user-level trusted credential;

[0021] The user-level trusted credential is returned online to the application middleware platform.

[0022] Further, the sending of a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential, thereby obtaining the business-level trusted credential, includes:

[0023] The process of generating the business-level trusted credential through the trusted authentication platform includes:

[0024] After confirming that the user-level trusted credential has passed the signature verification, based on the blockchain distributed ledger technology, the four-tuple consisting of the user-level trusted credential, the identification code, the business address and the corresponding timestamp is hashed using the national secret SM3 hashing algorithm to generate the business-level trusted credential;

[0025] Return the business-level trusted credential to the application middleware platform online.

[0026] Further, including:

[0027] When it is determined that there is a need for application traceability, the identification code is obtained as a unique index;

[0028] All historical data of the target client is obtained based on the unique index; wherein the application traceability requirements include: application data query, application exception handling, and application update.

[0029] In the second aspect, the technical solution provides an application trust verification system based on the APN6 network, which is based on a pre-built application middleware platform; wherein the application middleware platform is located on the user side and is associated with the industrial Internet identification resolution system, the trusted authentication platform, the APN6 controller and each application client; including:

[0030] A first acquisition module, configured to enable the application middleware platform to send a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential;

[0031] A second acquisition module is used to trigger the application middleware platform to apply for an identification code for a target client corresponding to the user from the industrial Internet identification resolution system through the HTTPS protocol based on the entry of the user-level trusted credential; wherein the identification code includes a prefix part and a suffix part; wherein the prefix part includes a country code, an industry code and a user code in sequence, and the suffix part includes a client address of the target client;

[0032] A third acquisition module is used to send a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential, thereby acquiring the business-level trusted credential;

[0033] A service activation module, configured to generate a service request based on the service-level trusted credentials and the SLA indicators to request network resources from the APN6 controller, thereby realizing corresponding service activation; wherein the SLA indicators include latency parameters, bandwidth parameters, jitter parameters, and packet loss rate parameters;

[0034] Among them, after the APN6 controller obtains the service request, it first parses the service request and verifies the signature with the trusted authentication platform based on the parsed service-level trusted certificate; then, when it is determined that the signature verification is passed, it generates the APN service, builds the SLA network quality template, and sends the APN policy to the devices within the APN6 network domain to realize the activation of network resources; wherein, the encoding of the APN service includes the user information and the identification code.

[0035] Furthermore, the application middleware platform is deployed in the CPE device, and the service provisioning module includes:

[0036] A request acquisition unit, configured to enable the CPE device to acquire a service request from a target client;

[0037] A request forwarding unit, configured to forward the service request to the APN6 network domain, and continue to transmit it to the application server according to the SLA indicator;

[0038] The resource transmission unit is used to obtain the content from the application server and then transmit it back to the target client according to the SLA indicator.

[0039] Further, including:

[0040] A fourth acquisition module, configured to acquire the identification code as a unique index when determining that there is a need for application traceability;

[0041] The application tracing module is used to obtain all historical data of the target client based on the unique index; wherein the application tracing requirements include: application data query, application exception handling, and application update.

[0042] In a third aspect, the technical solution provides an electronic device, comprising at least one processor, wherein the processor is coupled to a memory, wherein a computer program is stored in the memory, and wherein the computer program is configured to execute the method described when executed by the processor.

[0043] In a fourth aspect, the present technical solution provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is used to be executed by a processor to implement the described method.

[0044] Beneficial effects:

[0045] It can be seen from the above technical solutions that the technical solution of the present invention provides a new application trust verification method based on the APN6 network to improve the technical defects of the existing verification method, such as technical complexity, high cost, and inability to effectively ensure application security.

[0046] The technical solution is based on a pre-built application middleware platform and includes the following steps: First, the application middleware platform sends a first authentication request to the trusted authentication platform based on user information to obtain a user-level trusted credential. Secondly, based on the entry of the user-level trusted credential, the application middleware platform is triggered to apply for an identification code for the target client corresponding to the user to the industrial Internet identification resolution system through the HTTPS protocol. Specifically, the identification code includes a prefix part and a suffix part, wherein the prefix part includes a country code, an industry code and a user code in sequence; the suffix part includes the client address of the target client. Then, based on the user-level trusted credential and the identification code, a second authentication request is sent to the trusted authentication platform to verify the user-level trusted credential to obtain a business-level trusted credential. Finally, based on the business-level trusted credential, the user information, the identification code, and the SLA indicator, a business request is generated to request network resources from the APN6 controller to realize the corresponding business activation. Among them, for the APN6 controller, after obtaining the service request, it also includes the following steps: first, parsing the service request, and verifying the signature with the trusted authentication platform based on the parsed service-level trusted certificate; then, when it is determined that the verification is passed, generating APN service, building an SLA network quality template, and issuing APN policy to the devices within the APN6 network domain to realize the activation of network resources; wherein, the encoding of the APN address includes the user information and the identification code.

[0047] From the above, it can be seen that this technical solution proposes a standardized user application trusted authentication mechanism. At the same time, with the help of identification coding resolution technology, it realizes the connection between user services and the industrial Internet identification resolution system, so that user behavior is not tampered with and can be traced throughout the process, eliminating application security issues from the root. Specifically, on the one hand, considering that the application client is provided by different service providers and the difficulty of transformation is large, this application provides personalized and customized network communication indicators for the application client without changing the original application client by adding an application middleware platform to meet the diverse needs of customers; thus, on the basis of compatibility with the original client application, the original client application can quickly access the APN6 network domain, realize the instant activation of the service, and let the user experience the network quality assurance of the precise application level. On the other hand, through the two-level issuance strategy and two-level verification strategy of the trusted authentication platform, the service that initiates the request is trusted and verified, which ensures the security of the APN6 network domain and benefits the end users, application providers and network operators.

[0048] It should be appreciated that all combinations of the foregoing concepts, as well as additional concepts described in greater detail below, may be considered to be part of the inventive subject matter of the present disclosure, provided such concepts are not mutually inconsistent.

[0049] The foregoing and other aspects, embodiments and features of the present invention can be more fully understood from the following description in conjunction with the accompanying drawings. Other additional aspects of the present invention, such as the features and / or beneficial effects of the exemplary embodiments, will be apparent from the following description or learned from the practice of the specific embodiments according to the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component shown in various figures may be represented by the same reference numeral. For clarity, not every component is labeled in every figure. Embodiments of various aspects of the present invention will now be described by way of example and with reference to the accompanying drawings, in which:

[0051] Figure 1 This is a flow chart of the application trust verification method based on the APN6 network described in this embodiment;

[0052] Figure 2 A flowchart for application tracing for this embodiment;

[0053] Figure 3 This is a specific flow chart of service activation based on the APN6 controller in this embodiment;

[0054] Figure 4 This is a specific flow chart of implementing resource transmission based on the application middleware platform in this embodiment;

[0055] Figure 5 A flowchart of generating a user-level trusted credential based on a trusted authentication platform in this embodiment;

[0056] Figure 6 A flowchart of generating a business-level trusted credential based on a trusted authentication platform in this embodiment;

[0057] Figure 7 This is a structural block diagram of the application trust verification system based on the APN6 network described in this embodiment;

[0058] Figure 8 is a structural block diagram of the electronic device described in this embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meaning understood by people with general skills in the field to which the present invention belongs.

[0060] The words "first", "second" and similar words used in the specification and claims of this application do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, unless the context clearly indicates otherwise, the singular form of "a", "an" or "the" and other similar words do not indicate a quantitative limitation, but rather indicate the presence of at least one. Words such as "include" or "comprise" and the like mean that the elements or objects appearing before "include" or "comprise" cover the features, wholes, steps, operations, elements and / or components listed after "include" or "comprise", and do not exclude the existence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0061] Since the APN6 network conforms to the development trend of cloud-network integration, it will become the core enabling technology for the further integration of services and bearer networks. However, in the application process of the APN6 network, with the penetration of user applications in the field of network transmission, a series of network security risks and challenges to user privacy have been introduced, including whether the legitimacy of the application and the identification of user information are accurate. At present, the common solution in the industry is to protect through application information encryption, access verification and other methods to block illegal information from entering the network between end networks. However, the threshold of information encryption technology is high, and inappropriate encryption settings may cause data loss or encryption failure, which will bring unnecessary trouble to users. It will also cause security threats to the APN6 network. Moreover, high-quality encryption software usually needs to be purchased for a fee, which puts a certain amount of economic pressure on individual users or small businesses. Based on this, the present embodiment aims to provide an application trust verification method based on the APN6 network to improve the above-mentioned technical defects at the same time.

[0062] The following is a detailed introduction to the application trust verification method based on the APN6 network described in this embodiment in conjunction with the accompanying drawings.

[0063] Considering that the application client is provided by different service providers and the transformation is difficult, this embodiment provides personalized and customized network communication indicators for the application client by adding an application middleware platform without changing the original application client, so as to meet the diverse needs of customers, realize instant service activation, and improve user experience and user stickiness. Specifically, the application middleware platform is deployed in the CPE device and located on the user side. At the same time, in order to facilitate the user's operation and use, it is also allowed to support both the mobile terminal and the WEB terminal.

[0064] In order to realize application verification, an application middleware platform is also set up to associate with each application client downward to obtain the client address of the application client; it is connected to the industrial Internet identification resolution system upward to assign a unique identifier to the application client; it is connected to the trusted authentication platform to obtain user-level and business-level trusted authentication credentials to ensure the security of the system; it is connected to the APN6 controller to complete the indicator request for network transmission requirements.

[0065] Based on the above application setting requirements, the application middleware platform is further configured to include a client management module, an identification code management module, a trusted credential management module, a business management module and a user management module. Specifically, the client management module is used to obtain the client address of the application client with personalized requirements for network transmission quality, and manage them uniformly.

[0066] The identification code management module is used to initiate a request to the industrial Internet identification resolution system through user information and client address (specifically, to initiate a request to the industrial Internet identification resolution secondary node), obtain a globally unique identification code, and realize a one-to-one correspondence between the client address and the identification code. Among them, the industrial Internet identification resolution system is an important part of the industrial Internet network system and the nerve center that supports the interconnection and interoperability of the industrial Internet. Its function is similar to the domain name resolution system (DNS) in the Internet field. Identification resolution technology connects all production factors and fragmented data and applications by establishing a unified identification system, so as to master information such as data sources, flow processes, and uses, and open up the entire life cycle of APP applications, network quality requirements creation, requirements tracking, and requirements extinction, so as to realize the true full life cycle management of network quality requirements. Specifically, the mapping rules for constructing identification codes are as follows:

[0067] The client address is a string of numbers, which can be a client-related letter code plus numbers, or pure numbers. Industrial Internet identification codes include six types: VAA identification system, GS1 identification system, Handle identification system, OID identification system, Ecode identification system, and DID identification system. In this embodiment, the VAA identification system is specifically adopted, and the identification coding rules are: using prefix + suffix two-stage coding. Among them, the prefix includes the country code, industry code and user code in sequence; the suffix is ​​a unique code that defines the identified object. In this embodiment, in order to ensure compatibility, the suffix part is set to include the client address of the target client.

[0068] The trusted credential management module is used to provide management of user-level and service-level security access authentication certificates C1 and C2 to ensure user-level and service-level security verification. The C1 certificate is imported offline, and the C2 certificate is applied for online in real time during service creation.

[0069] The service management module is used to set the network performance parameters required by the application APP according to the needs of the service, such as bandwidth, latency, jitter, packet loss rate, etc. For example, in the field of online games, relying on the APN6 network domain, the user needs to initiate a resource request from the game controller to the application server, and expects to apply for a low-latency acceleration tunnel of no more than 25ms. For the user, at this time, you only need to create a service, specify a request with a latency indicator of no more than 25ms in the SLA template, and send it to the APN6 controller to complete the application for network resources. When the service is activated, users can enjoy low-latency gaming services.

[0070] The user management module is used to manage the user's identity authentication information, and supports account password method or mobile phone number verification code method and the like.

[0071] At this time, combined with Figure 1As shown, the method comprises the following steps:

[0072] Step S102: The application middleware platform sends a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential.

[0073] In specific implementation, before step S102, the user needs to register and log in to the application middleware platform.

[0074] Step S104: based on the entry of the user-level trusted credential, trigger the application middleware platform to apply for an identification code for a target client corresponding to the user from the industrial Internet identification resolution system through the HTTPS protocol.

[0075] In the specific implementation, it is assumed that the client address of the target client is: 2024002109674672. Relying on the pre-built Industrial Internet identity resolution secondary node identification template shown in Table 1 below, the identity resolution secondary node first allocates the identification code 88.123.1 / 2024002109674672 for this request, and registers the client address and user information into the Industrial Internet identity resolution system as its globally unique digital "ID card".

[0076] Table 1 Industrial Internet Identity Resolution Secondary Node Identity Template

[0077]

[0078] Correspondingly, the registration information in the Industrial Internet Identity Resolution System is as follows:

[0079] {

[0080] "identification_id":"88.123.1 / 2024002109674672",

[0081] "app_id": "2024002109674672",

[0082] "user_name":"18651610411"

[0083] }

[0084] Subsequently, the identification code 88.123.1 / 2024002109674672 is used as the unique index of the target client to complete the traceability of its entire life cycle.

[0085] As a specific implementation method, Figure 2 As shown in the figure, the traceability process based on identification coding is realized through the following steps:

[0086] Step S202: When it is determined that there is a need for application traceability, the identification code is obtained as a unique index.

[0087] Step S204: Acquire all historical data of the target client based on the unique index.

[0088] In this embodiment, the application traceability requirements include: application data query, application exception handling, and application update. In specific implementation, steps S202 to S204 can be completed by terminal scanning.

[0089] Step S106: Send a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential, thereby obtaining the business-level trusted credential.

[0090] Step S108: Generate a service request based on the service-level trusted certificate and SLA indicators to request network resources from the APN6 controller, thereby realizing corresponding service activation.

[0091] In specific implementation, the SLA indicators include delay parameters, bandwidth parameters, jitter parameters, and packet loss rate parameters. Figure 3 As shown, after the APN6 controller obtains the service request, it specifically performs the following steps to implement service activation:

[0092] Step S10802: Parse the business request and verify the signature with the trusted authentication platform based on the parsed business-level trusted credential.

[0093] Step S10804: When it is determined that the signature verification is passed, an APN service is generated, an SLA network quality template is constructed, and an APN policy is issued to devices in the APN6 network domain to enable the activation of network resources.

[0094] In a specific implementation, the encoding of the APN address includes the user information and the identification encoding. At this time, based on steps S10802 to S10804, when the APN6 controller issues resources, it will verify the service-level credentials itself to improve data security.

[0095] As a specific implementation method, Figure 4 As shown, when the application middleware platform is deployed in the CPE device, the transmission of the entire resource is achieved in the following manner:

[0096] Step S10822: The CPE device obtains a service request from the target client.

[0097] Step S10824: forward the service request to the APN6 network domain, and continue to transmit it to the application server according to the SLA indicator.

[0098] Step S10826: After acquiring the content from the application server, continue to transmit it back to the target client according to the SLA indicator.

[0099] At this time, in steps S10822 to S10826, based on the forwarding function of the application middleware platform in the CPE device, the normal operation of the entire service is guaranteed, and instant service activation is achieved.

[0100] In the above process, the trusted authentication platform adopts a two-level signature issuance strategy (i.e., the first level generates user-level credentials, and the second level generates business-level credentials) and a two-level signature verification strategy to complete the distribution and verification of trusted credentials. In this embodiment, the blockchain distributed ledger technology is introduced into the trusted authentication platform to achieve technical advantages such as decentralization, non-tamperability, and distributed records, and build a more secure and reliable authentication platform.

[0101] Based on the above-mentioned trusted authentication platform that introduces blockchain distributed ledger technology, combined with Figure 5 As shown, the user-level trusted credential is generated in the following manner:

[0102] Step S302: Using the user information as the summary value, the platform private key is used to perform hash processing on the binary consisting of the user information and the corresponding timestamp through the national secret SM3 hashing algorithm to generate the user-level trusted credential.

[0103] Step S304: Return the user-level trusted credential online to the application middleware platform.

[0104] In a specific implementation, the user-level trusted credential is preset into the application APP middleware in an offline manner after the user logs in to the application middleware platform, generating a trusted user to ensure user-level security.

[0105] Combination Figure 6 As shown, the business-level trusted credential is generated in the following manner:

[0106] Step S402: After confirming that the user-level trusted credential has passed the signature verification, based on the blockchain distributed ledger technology, the four-tuple consisting of the user-level trusted credential, the identification code, the business address and the corresponding timestamp is hashed using the national secret SM3 hashing algorithm to generate the business-level trusted credential.

[0107] Step S404: Return the business-level trusted certificate to the application middleware platform online.

[0108] At this time, based on steps S302 to S304 and steps S402 to S404, the integrity and non-tamperability of the data in the user-level trusted credentials and the business-level trusted credentials are ensured.

[0109] In summary, the trusted verification method described in this embodiment adopts a standardized user application trusted authentication mechanism, and at the same time, with the help of identification code resolution technology, realizes the connection between user services and the industrial Internet identification resolution system, so that user behavior is not tampered with and can be traced throughout the process, thus eliminating security issues from the root. At the same time, the setting of the application middleware platform avoids the modification of the application client, reducing technical costs and barriers.

[0110] The above program can be run in the processor, or it can be stored in the memory (or computer-readable storage medium), which includes permanent and non-permanent, removable and non-removable media. Information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include temporary computer-readable media, such as modulated data signals and carrier waves.

[0111] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more blocks can be implemented by different modules corresponding to different steps.

[0112] Based on the above method, this embodiment also provides an application trust verification system based on the APN6 network. The system implements functions based on a pre-built application middleware platform; wherein the application middleware platform is located on the user side and is associated with the industrial Internet identification resolution system, the trusted authentication platform, the APN6 controller and each application client. Specifically, Figure 7As shown, the system includes the following functional modules:

[0113] The first acquisition module is used to enable the application middleware platform to send a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential.

[0114] The second acquisition module is used to trigger the application middleware platform to apply for an identification code for a target client corresponding to the user to the industrial Internet identification resolution system through the HTTPS protocol based on the entry of the user-level trusted credentials; wherein the identification code includes a prefix part and a suffix part; wherein the prefix part includes a country code, an industry code and a user code in sequence, and the suffix part includes the client address of the target client.

[0115] The third acquisition module is used to send a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential, and then obtain the business-level trusted credential.

[0116] The service activation module is used to generate a service request based on the service-level trusted credentials and SLA indicators to request network resources from the APN6 controller, thereby realizing corresponding service activation; wherein the SLA indicators include delay parameters, bandwidth parameters, jitter parameters, and packet loss rate parameters.

[0117] Among them, after the APN6 controller obtains the service request, it first parses the service request and verifies the signature with the trusted authentication platform based on the parsed service-level trusted certificate; then, when it is determined that the signature verification is passed, it generates the APN service, builds the SLA network quality template, and sends the APN policy to the devices within the APN6 network domain to realize the activation of network resources; wherein, the encoding of the APN service includes the user information and the identification code.

[0118] Since the system is used to implement the steps of the above method, those have already been described and will not be repeated here.

[0119] For example, in this embodiment, the application middleware platform is deployed in the CPE device. In this case, the service provisioning module includes the following functional units:

[0120] The request acquisition unit is used to enable the CPE device to acquire the service request of the target client.

[0121] A request forwarding unit is used to forward the service request to the APN6 network domain and continue to transmit it to the application server according to the SLA indicator.

[0122] The resource transmission unit is used to obtain the content from the application server and then transmit it back to the target client according to the SLA indicator.

[0123] For another example, in order to perform application tracing, the system further includes:

[0124] The fourth acquisition module is used to obtain the identification code as a unique index when it is determined that there is a need for application tracing.

[0125] The application tracing module is used to obtain all historical data of the target client based on the unique index; wherein the application tracing requirements include: application data query, application exception handling, and application update.

[0126] Combination Figure 8 As shown, this embodiment further provides an electronic device, comprising at least one processor, the processor being coupled to a memory, the memory storing a computer program, and the computer program being configured to execute the method when being executed by the processor.

[0127] Similarly, this embodiment also provides a computer-readable storage medium, characterized in that a computer program is stored thereon, and the computer program implements the described method when executed by a processor.

[0128] Since the system, the electronic device and the computer-readable storage medium are all built based on the method, they have the technical advantages of low technical threshold, low cost and better ability to ensure application security in actual application.

[0129] Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. A person with ordinary knowledge in the technical field to which the present invention belongs may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the definition of the claims.

Claims

1. A method for verifying application trust based on APN6 network, characterized in that: It is carried out based on a pre-built application middleware platform; wherein the application middleware platform is located on the user side and is associated with the industrial Internet identification resolution system, the trusted authentication platform, the APN6 controller and each application client; The steps include: The application middleware platform sends a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential; Based on the entry of the user-level trusted credential, the application middleware platform is triggered to apply for an identification code for a target client corresponding to the user from the industrial Internet identification resolution system through the HTTPS protocol; wherein the identification code includes a prefix part and a suffix part; wherein the prefix part includes a country code, an industry code and a user code in sequence, and the suffix part includes a client address of the target client; Sending a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential and obtain the business-level trusted credential; Generate a service request based on the service-level trusted credentials and SLA indicators to request network resources from the APN6 controller to activate the corresponding service; wherein the SLA indicators include latency parameters, bandwidth parameters, jitter parameters and packet loss rate parameters; Among them, after the APN6 controller obtains the service request, it first parses the service request and verifies the signature with the trusted authentication platform based on the parsed service-level trusted credentials; then, when it is determined that the signature verification is passed, it generates the APN service, builds the SLA network quality template, and sends the APN policy to the devices within the APN6 network domain to realize the activation of network resources; wherein, the encoding of the APN service includes the user information and the identification code.

2. The application trust verification method based on the APN6 network according to claim 1 is characterized in that: The application middleware platform is deployed in the CPE device.

3. The application trust verification method based on the APN6 network according to claim 1 is characterized in that: The application middleware platform sends a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential, wherein the user-level trusted credential is generated by the trusted authentication platform; The steps include: Using the user information as the summary value, the platform private key is used to perform hash processing on the two-tuple consisting of the user information and the corresponding timestamp through the national secret SM3 hashing algorithm to generate the user-level trusted credential; The user-level trusted credential is returned online to the application middleware platform.

4. The application trust verification method based on the APN6 network according to claim 1 is characterized in that: The step of sending a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential and obtain the business-level trusted credential, wherein the business-level trusted credential is generated by the trusted authentication platform; The steps include: After confirming that the user-level trusted credential has passed the signature verification, based on the blockchain distributed ledger technology, the four-tuple consisting of the user-level trusted credential, the identification code, the business address and the corresponding timestamp is hashed using the national secret SM3 hashing algorithm to generate the business-level trusted credential; Return the business-level trusted credential to the application middleware platform online.

5. The application trust verification method based on the APN6 network according to claim 1 is characterized in that: include: When it is determined that there is a need for application traceability, the identification code is obtained as a unique index; All historical data of the target client is obtained based on the unique index; wherein the application traceability requirements include: application data query, application exception handling and application update.

6. An application trust verification system based on APN6 network, characterized in that: Based on a pre-built application middleware platform; wherein the application middleware platform is located on the user side and is associated with the industrial Internet identification resolution system, the trusted authentication platform, the APN6 controller and each application client; including: A first acquisition module, configured to enable the application middleware platform to send a first authentication request to the trusted authentication platform based on the user information of the user to obtain a user-level trusted credential; A second acquisition module is used to trigger the application middleware platform to apply for an identification code for a target client corresponding to the user from the industrial Internet identification resolution system through the HTTPS protocol based on the entry of the user-level trusted credential; wherein the identification code includes a prefix part and a suffix part; wherein the prefix part includes a country code, an industry code and a user code in sequence, and the suffix part includes a client address of the target client; A third acquisition module is used to send a second authentication request to the trusted authentication platform based on the user-level trusted credential, the identification code and the business address to verify the signature of the user-level trusted credential and acquire the business-level trusted credential; A service activation module, configured to generate a service request based on the service-level trusted credentials and SLA indicators to request network resources from the APN6 controller to activate the corresponding service; wherein the SLA indicators include latency parameters, bandwidth parameters, jitter parameters and packet loss rate parameters; Among them, after the APN6 controller obtains the service request, it first parses the service request and verifies the signature with the trusted authentication platform based on the parsed service-level trusted certificate; then, when it is determined that the signature verification is passed, it generates the APN service, builds the SLA network quality template, and sends the APN policy to the devices within the APN6 network domain to realize the activation of network resources; wherein, the encoding of the APN service includes the user information and the identification code.

7. The application trust verification system based on the APN6 network according to claim 6, characterized in that: The application middleware platform is deployed in the CPE device.

8. The application trust verification system based on the APN6 network according to claim 6, characterized in that: include: A fourth acquisition module, configured to acquire the identification code as a unique index when determining that there is a need for application traceability; The application tracing module is used to obtain all historical data of the target client based on the unique index; wherein the application tracing requirements include: application data query, application exception handling and application update.

9. An electronic device, characterized in that: The method comprises at least one processor, wherein the processor is coupled to a memory, wherein a computer program is stored in the memory, and wherein the computer program is configured to execute the method according to any one of claims 1 to 5 when executed by the processor.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is used to be executed by a processor to implement the method according to any one of claims 1 to 5.

Images