Joint authentication method and device, storage medium and computer program product

Abstract

The invention discloses a joint authentication method and device, a storage medium and a computer program product. The method comprises the following steps: under the condition that a mobile terminal initiates a wireless network voice service request through a space-ground convergence network, performing satellite terminal authentication; under the condition that the satellite terminal authentication is passed, mobile user authentication is carried out, and the mobile user authentication is used for verifying whether a user account corresponding to the mobile terminal is legal or not; access gateway authentication is carried out under the condition that the mobile user authentication is passed, the wireless network voice service is allowed to be executed under the condition that the access gateway authentication is passed, and the access gateway authentication is used for judging whether the access gateway allows the wireless network voice service to be accessed or not. The technical problem that the legality of the access terminal is difficult to guarantee due to the fact that the authentication mode for the wireless network voice service based on the space-ground fusion networking is single and only the legality of the access user can be identified in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of mobile communication technology, and in particular to a joint authentication method, device, storage medium and computer program product. Background Art

[0002] With the rapid development and popularization of mobile communications, users' demand for high-quality wireless communication services is increasing. In particular, in some special scenarios, such as oceans, deserts, and aviation, traditional mobile network signals are often difficult to cover, causing users to encounter many inconveniences in calls and data transmission. Building satellite Internet is an important means to solve the digital divide of the "no Internet" population on Earth, and is an effective supplement to achieve continuous regional coverage and inclusive sharing of network information.

[0003] At present, satellite and WiFi (Wireless Fidelity) fusion networking mainly provides data services. If satellite, WiFi and cellular networks are effectively combined and connected to the IMS (IP Multimedia Subsystem) network through satellite and WiFi fusion networking, VoWiFi (Voice over WiFi) services based on the integrated network of the earth and sky can be realized, data services can be extended to basic communication services such as voice and text messages. However, the authentication method for wireless network voice services based on the integrated network of the earth and sky in the related technology is single, which can only identify the legitimacy of the access user, and there is a problem that the legitimacy of the access terminal is difficult to guarantee.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a joint authentication method, device, storage medium and computer program product to at least solve the technical problem that the legitimacy of the access terminal is difficult to ensure because the authentication method for wireless network voice services based on the integrated network of the sky and the earth in the related technology is single and can only identify the legitimacy of the access user.

[0006] According to one aspect of an embodiment of the present application, a joint authentication method is provided, comprising: when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, performing satellite terminal authentication, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate; when the satellite terminal authentication passes, performing mobile user authentication, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; when the mobile user authentication passes, performing access gateway authentication, and when the access gateway authentication passes, allowing the wireless network voice service to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: a satellite terminal.

[0007] Optionally, performing satellite terminal authentication includes: when the satellite terminal requests to access the network to establish a satellite link, obtaining an authentication request sent by the satellite terminal, wherein the authentication request includes identification information of the satellite terminal, and the identification information includes at least one of the following: device information and a serial number of the satellite terminal; when the identification information of the satellite terminal is included in a preset trusted device list, determining that the satellite terminal authentication is passed, allocating an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

[0008] Optionally, when the satellite terminal passes authentication, the method further includes: acquiring geographic location information and access time information reported by the satellite terminal, wherein the geographic location information includes: the longitude and latitude corresponding to the satellite terminal.

[0009] Optionally, performing mobile user authentication includes: when the mobile terminal requests access to the core network via a satellite link, sending authentication parameters to the mobile terminal, and determining whether the user account corresponding to the mobile terminal is credible by comparing the response result to the authentication parameters returned by the mobile terminal to see whether it is consistent with the expected response corresponding to the authentication parameters, wherein the authentication parameters include at least one of the following: a random number, an authentication token; and determining whether the user account is allowed to use wireless network voice services based on the contract parameters of the user account corresponding to the mobile terminal, wherein the contract parameters include: parameters configured for the user account in the user server network element or the unified data management network element in the core network to characterize whether the user account is allowed to use wireless network voice services.

[0010] Optionally, performing access gateway authentication includes: obtaining the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address conversion; based on the Internet Protocol address and port number reported by the mobile terminal, determining the satellite terminal corresponding to the mobile terminal when initiating a wireless network voice service request, and verifying whether the satellite terminal allows wireless network voice service access.

[0011] Optionally, the method also includes: determining the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determining the geographical location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, to obtain the geographical location corresponding to the mobile terminal when initiating a wireless network voice service.

[0012] Optionally, the method also includes: when the mobile terminal initiates a wireless network voice service request through the space-ground integrated network, performing joint authentication, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and verifying whether the satellite terminal as an access gateway allows wireless network voice service access through the contract parameters corresponding to the satellite terminal in the core network; when the joint authentication passes, performing mobile user authentication, and when the mobile user authentication passes, allowing the wireless network voice service to be executed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0013] According to another aspect of an embodiment of the present application, a joint authentication device is also provided, including: a first authentication module, used to perform satellite terminal authentication when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legal; a second authentication module, used to perform mobile user authentication when the satellite terminal authentication passes, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal; a third authentication module, used to perform access gateway authentication when the mobile user authentication passes, and allow the wireless network voice service to be executed when the access gateway authentication passes, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: a satellite terminal.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the joint authentication method by running the computer program.

[0015] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which implements the steps of the joint authentication method when the computer program is executed by a processor.

[0016] In an embodiment of the present application, when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, satellite terminal authentication is performed, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate; when the satellite terminal authentication passes, mobile user authentication is performed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; when the mobile user authentication passes, access gateway authentication is performed, and when the access gateway authentication passes, the wireless network voice service is allowed to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: a satellite terminal method, through a cross-domain network joint authentication method of satellite terminal authentication, mobile user authentication, and access gateway authentication, multiple authentication capabilities of satellite-based VoWiFi services are realized, and the legitimacy of satellite terminals, mobile phone users, and access gateways is ensured, thereby solving the technical problem that the legitimacy of the access terminal is difficult to ensure due to the single authentication method for wireless network voice services based on space-ground integrated networking in the related technology, which can only identify the legitimacy of the access user. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a joint authentication method provided in an embodiment of the present application;

[0019] Figure 2 It is a schematic diagram of a joint authentication method flow provided according to an embodiment of the present application;

[0020] Figure 3 It is a schematic diagram of the architecture of a ground-ground integrated network provided according to an embodiment of the present application;

[0021] Figure 4 It is a flowchart of a cross-domain joint authentication and traceability method provided according to an embodiment of the present application;

[0022] Figure 5 It is a schematic diagram of an optimized process of joint authentication provided according to an embodiment of the present application;

[0023] Figure 6 It is a structural diagram of a joint authentication device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] In order to facilitate those skilled in the art to better understand the embodiments of the present application, some technical terms or nouns involved in the embodiments of the present application are explained as follows:

[0027] S2b: A solution defined in the 3GPP (Third Generation Partnership Project) standard for the converged networking of WiFi and LTE (Long Term Evolution), mainly for untrusted WiFi networks.

[0028] In the related technologies, there are many deficiencies in the authentication and traceability methods for VoWiFi services. For example, the authentication method is single and can only identify the legitimacy of the access user, but it is difficult to ensure the legitimacy of the access terminal; in the satellite fusion networking scenario, there is no effective traceability method, and it is difficult to achieve accurate traceability to households. These problems not only affect the security and stability of the service, but also limit its application and development in a wider range of fields. Therefore, studying the authentication and traceability methods of the space-ground fusion network has become a problem that must be solved.

[0029] In order to solve this problem, a relevant solution is provided in the embodiments of the present application, which is described in detail below.

[0030] According to an embodiment of the present application, a method embodiment of joint authentication is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or electronic device) for implementing a joint authentication method. Figure 1 As shown, the computer terminal 10 (or electronic device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the joint authentication method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, to implement the above-mentioned joint authentication method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0036] In the above operating environment, the embodiment of the present application provides a joint authentication method. Figure 2 is a schematic diagram of a joint authentication method flow according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0037] Step S202, when the mobile terminal initiates a wireless network voice service request through the space-ground integrated network, satellite terminal authentication is performed, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate;

[0038] Step S204, when the satellite terminal authentication is passed, mobile user authentication is performed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate;

[0039] Step S206, when the mobile user authentication is passed, the access gateway authentication is performed, and when the access gateway authentication is passed, the wireless network voice service is allowed to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows the wireless network voice service access, and the access gateway includes: a satellite terminal.

[0040] Through the above steps, through the cross-domain network joint authentication method of satellite terminal authentication, mobile user authentication, and access gateway authentication, the multiple authentication capabilities of the satellite-based VoWiFi service are realized, ensuring the legitimacy of the satellite terminal, mobile phone users, and access gateways, thereby solving the technical problem that the legitimacy of the access terminal is difficult to ensure because the authentication method for the wireless network voice service based on the space-ground integrated networking in the related technology is single and can only identify the legitimacy of the access user.

[0041] At present, all international commercial VoWiFi operators adopt the ePDG (Evolved Packet Data Gateway) solution based on S2b. The joint authentication method provided in the embodiment of the present application is based on this architecture. The satellite-based VoWiFi service designs satellite systems, ground cellular systems, etc. The overall architecture is as follows: Figure 3 As shown, the business data flow is shown by the blue line, the authentication and traceability data flow is shown by the yellow line, and cross-domain authentication and traceability involve multiple systems.

[0042] The following further introduces the joint authentication method in steps S202 to S206 of the embodiment of the present application.

[0043] Figure 4 is a flow chart of a cross-domain joint authentication and traceability method provided according to an embodiment of the present application, such as Figure 4 shown.

[0044] When a mobile terminal (such as a mobile phone terminal) initiates a request for a wireless network voice service (VoWiFi service), satellite terminal authentication may be performed, and the specific steps are as follows.

[0045] In some embodiments of the present application, performing satellite terminal authentication includes the following steps: when the satellite terminal requests to access the network to establish a satellite link, obtaining an authentication request sent by the satellite terminal, wherein the authentication request includes identification information of the satellite terminal, and the identification information includes at least one of the following: device information and serial number of the satellite terminal; when the identification information of the satellite terminal is included in a preset trusted device list, determining that the satellite terminal authentication is passed, allocating an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

[0046] Specifically, when the satellite terminal accesses the network and establishes a satellite link, it will send an authentication request (which contains the terminal's device information, serial number and other identification information) to the network management system. After receiving the authentication request, the network side will verify whether the satellite terminal's device information is stored in the preset trusted device list. If the trusted device list contains the satellite terminal's identification information, the device information is verified, and the network management system will execute the corresponding authentication algorithm. After the execution is completed, the network management system will send the authentication result to the satellite terminal. If the authentication is successful, the terminal will be allowed to access the network; otherwise, the access request will be rejected.

[0047] In addition, after the satellite terminal authentication is completed, the satellite terminal can also be assigned an IP address (Internet Protocol Address) and port number for accessing the Internet, and its longitude, latitude and other information reported in real time by the satellite terminal can be obtained. That is, when the satellite terminal authentication is passed, the method also includes the following steps: obtaining the geographic location information and access time information reported by the satellite terminal, wherein the geographic location information includes: the longitude and latitude corresponding to the satellite terminal.

[0048] Specifically, the acquired geographical location information and access time information reported by the satellite terminal may be as shown in Table 1 below.

[0049] Table 1

[0050] Example MAC Address IP address Port Number longitude latitude Access time Satellite Terminal A XYZ 1.1.1.1 100 E 120°52′ N30°40′ 6 / 1 8：00

[0051] When the satellite terminal authentication is passed, the subsequent mobile user authentication can be performed. The specific steps are as follows.

[0052] In some embodiments of the present application, mobile user authentication includes the following steps: when the mobile terminal requests access to the core network via a satellite link, sending authentication parameters to the mobile terminal, and comparing the response result to the authentication parameters returned by the mobile terminal to see whether they are consistent with the expected response corresponding to the authentication parameters, to determine whether the user account corresponding to the mobile terminal is credible, wherein the authentication parameters include at least one of the following: a random number, an authentication token; and determining whether the user account is allowed to use wireless network voice services based on the contract parameters of the user account corresponding to the mobile terminal, wherein the contract parameters include: parameters configured for the user account in the user server network element or the unified data management network element in the core network to characterize whether the user account is allowed to use wireless network voice services.

[0053] Specifically, when a mobile terminal requests access to a cellular network core network through a satellite link, a cellular authentication process can be used, that is, authentication parameters (such as XRES (Expected Response), RAND (Random Number), AUTN (Authentication Token), etc.) and algorithms are used to verify the user's identity and legitimacy. If it is a 5G user, dual authentication is performed at the home location and roaming location, so this process is not expanded here.

[0054] In addition, during the registration process, the contract parameters can also be used to determine whether the user is allowed to use this VoWiFi service. For users using satellite-based VoWiFi services, the contract parameters can be selected from cellular core network elements, such as HSS (Home Subscriber Server) / UDM (Unified Data Management) parameters for contract signing.

[0055] When the mobile user authentication is passed, the access gateway authentication can be performed. The specific steps are as follows.

[0056] In some embodiments of the present application, performing access gateway authentication includes the following steps: obtaining the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address conversion; based on the Internet Protocol address and port number reported by the mobile terminal, determining the satellite terminal corresponding to the mobile terminal when initiating a wireless network voice service request, and verifying whether the satellite terminal allows wireless network voice service access.

[0057] It should be noted that in the satellite-based VoWiFi service, the IP address and port number reported by the mobile phone are the Internet IP address and port number of the satellite terminal after network address conversion, as shown in Table 2.

[0058] Table 2

[0059] Example IP address Port Number Access time Mobile Phone B 1.1.1.1 100 6 / 1 8：00

[0060] On this basis, location tracing can be achieved by matching the Internet Protocol address and port number reported by the mobile terminal with the Internet Protocol address and port number assigned to the satellite terminal. The specific steps are as follows.

[0061] In some embodiments of the present application, the method also includes the following steps: determining the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determining the geographic location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, to obtain the geographic location corresponding to the mobile terminal when initiating a wireless network voice service.

[0062] Specifically, the information in Table 1 and Table 2 can be matched to obtain the real-time location (latitude and longitude information) of the mobile terminal when dialing the satellite VoWiFi service, as shown in Table 3.

[0063] Table 3

[0064]

[0065] In addition, as an optional implementation, the information obtained in Table 3 can be further supplemented by information stored in the tracing gateway in advance, such as supplementing its terminal attributes, usage area and other information. The relevant information can be transmitted to the cellular core network as supplementary information.

[0066] Furthermore, since in most scenarios, the access gateway in the access gateway authentication refers to the satellite terminal, an optimization scheme for the above-mentioned authentication method is also provided in an embodiment of the present application, which can determine in advance when the satellite terminal is authenticated whether to allow the satellite terminal to use the Haidi-Air VoWiFi service. The specific steps are as follows.

[0067] In some embodiments of the present application, the method also includes the following steps: when the mobile terminal initiates a wireless network voice service request through the space-ground integrated network, a joint authentication is performed, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and to verify whether the satellite terminal as an access gateway allows wireless network voice service access through the contract parameters corresponding to the satellite terminal in the core network; when the joint authentication passes, a mobile user authentication is performed, and when the mobile user authentication passes, the wireless network voice service is allowed to be executed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0068] Specifically, Figure 5As shown, satellite terminal authentication and access gateway authentication are combined, that is, in satellite terminal authentication, the satellite terminal’s contract parameters in the satellite core network are used to determine in advance whether the access gateway (satellite terminal) allows satellite VoWiFi service access. If the contract parameter is allowed, it means that the mobile terminal can use the VoWiFi service through the satellite terminal, and the registration process continues; if the contract parameter is not allowed, it indicates that the mobile terminal cannot use the VoWiFi service through the satellite terminal, the authentication fails, and the registration process stops. Since this parameter is not specified in the existing protocol or system, any parameter can be used to refer to this function. Through joint authentication, that is, identifying mobile terminals that are legal and allowed to use the service in the satellite network, Figure 4 The three-step authentication in is shortened to two-step authentication, which can simplify the authentication process.

[0069] In adopting the above Figure 5 When the joint authentication method shown is used to complete the authentication, the location tracing step can be implemented by adding a new field to carry the relevant location information and transmitting it to the cellular core network after the joint authentication step is completed. By adding a new field, the location information can be obtained in advance, reducing the tracing process.

[0070] This application scheme realizes the multiple authentication capabilities of satellite-based VoWiFi services through satellite terminal authentication, mobile user authentication, and access gateway authentication, ensuring the legitimacy of satellite terminals, mobile phone users, and access gateways. Based on the unique identification of the satellite terminal, a cross-domain traceability method is constructed to solve the legitimacy of user access and service traceability of the satellite-based VoWiFi service, and solve the regulatory problems caused by the inability to trace the source. Through the cross-domain network joint authentication method, the legitimacy of user access to the satellite-based VoWiFi service can be jointly determined across domains and traced, ensuring the security of the service and tracing the source.

[0071] According to an embodiment of the present application, an embodiment of a joint authentication device is also provided. Figure 6 Schematic diagram of a joint authentication device provided according to an embodiment of the present application. Figure 6 As shown, the device comprises:

[0072] The first authentication module 60 is used to perform satellite terminal authentication when the mobile terminal initiates a wireless network voice service request through the space-ground integrated network, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate;

[0073] The second authentication module 62 is used to perform mobile user authentication when the satellite terminal authentication is passed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal;

[0074] The third authentication module 64 is used to perform access gateway authentication when the mobile user authentication is passed, and to allow the wireless network voice service to be executed when the access gateway authentication is passed, wherein the access gateway authentication is used to determine whether the access gateway allows the wireless network voice service access, and the access gateway includes: a satellite terminal.

[0075] Optionally, performing satellite terminal authentication includes: when the satellite terminal requests to access the network to establish a satellite link, obtaining an authentication request sent by the satellite terminal, wherein the authentication request includes identification information of the satellite terminal, and the identification information includes at least one of the following: device information and a serial number of the satellite terminal; when the identification information of the satellite terminal is included in a preset trusted device list, determining that the satellite terminal authentication is passed, allocating an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

[0076] Optionally, when the satellite terminal passes authentication, the joint authentication device is further used to: obtain geographical location information and access time information reported by the satellite terminal, wherein the geographical location information includes: the longitude and latitude corresponding to the satellite terminal.

[0077] Optionally, performing mobile user authentication includes: when the mobile terminal requests access to the core network via a satellite link, sending authentication parameters to the mobile terminal, and determining whether the user account corresponding to the mobile terminal is credible by comparing the response result to the authentication parameters returned by the mobile terminal to see whether it is consistent with the expected response corresponding to the authentication parameters, wherein the authentication parameters include at least one of the following: a random number, an authentication token; and determining whether the user account is allowed to use wireless network voice services based on the contract parameters of the user account corresponding to the mobile terminal, wherein the contract parameters include: parameters configured for the user account in the user server network element or the unified data management network element in the core network to characterize whether the user account is allowed to use wireless network voice services.

[0078] Optionally, performing access gateway authentication includes: obtaining the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address conversion; based on the Internet Protocol address and port number reported by the mobile terminal, determining the satellite terminal corresponding to the mobile terminal when initiating a wireless network voice service request, and verifying whether the satellite terminal allows wireless network voice service access.

[0079] Optionally, the joint authentication device is also used to: determine the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determine the geographical location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, to obtain the geographical location corresponding to the mobile terminal when initiating a wireless network voice service.

[0080] Optionally, the joint authentication device is also used to: perform joint authentication when the mobile terminal initiates a wireless network voice service request through the space-ground integrated network, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and to verify whether the satellite terminal as an access gateway allows wireless network voice service access through the contract parameters corresponding to the satellite terminal in the core network; if the joint authentication passes, perform mobile user authentication, and if the mobile user authentication passes, allow the wireless network voice service to be executed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0081] It should be noted that the various modules in the above-mentioned joint authentication device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0082] It should be noted that the joint authentication device provided in this embodiment can be used to perform Figure 2 The joint authentication method shown, therefore, the relevant explanations and descriptions of the above-mentioned joint authentication method are also applicable to the embodiments of the present application and will not be repeated here.

[0083] An embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following joint authentication method by running the computer program: when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, satellite terminal authentication is performed, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legal; when the satellite terminal authentication passes, mobile user authentication is performed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal; when the mobile user authentication passes, access gateway authentication is performed, and when the access gateway authentication passes, the wireless network voice service is allowed to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: a satellite terminal.

[0084] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the joint authentication method described in each embodiment of the present application: when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, satellite terminal authentication is performed, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legal; when the satellite terminal authentication passes, mobile user authentication is performed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal; when the mobile user authentication passes, access gateway authentication is performed, and when the access gateway authentication passes, the wireless network voice service is allowed to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: a satellite terminal.

[0085] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0086] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0087] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0088] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0089] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0090] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0091] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A joint authentication method, characterized in that: include: When a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, performing satellite terminal authentication, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate; If the satellite terminal authentication is passed, mobile user authentication is performed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal; When the mobile user authentication is passed, access gateway authentication is performed, and when the access gateway authentication is passed, the wireless network voice service is allowed to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: the satellite terminal.

2. The joint authentication method according to claim 1, characterized in that: Satellite terminal authentication includes: In the case where the satellite terminal requests to access the network to establish a satellite link, obtaining an authentication request sent by the satellite terminal, wherein the authentication request includes identification information of the satellite terminal, and the identification information includes at least one of the following: device information and a serial number of the satellite terminal; When the identification information of the satellite terminal is included in the preset trusted device list, it is determined that the satellite terminal has passed the authentication, an Internet Protocol address and a port number are allocated to the satellite terminal, and the satellite terminal is allowed to access the network.

3. The joint authentication method according to claim 2, characterized in that: When the satellite terminal passes authentication, the method further includes: The geographical location information and access time information reported by the satellite terminal are obtained, wherein the geographical location information includes: the longitude and latitude corresponding to the satellite terminal.

4. The joint authentication method according to claim 2, characterized in that: Mobile user authentication includes: In the case where the mobile terminal requests to access the core network through the satellite link, sending authentication parameters to the mobile terminal, and judging whether the user account corresponding to the mobile terminal is credible by comparing the response result to the authentication parameters returned by the mobile terminal with the expected response corresponding to the authentication parameters, wherein the authentication parameters include at least one of the following: a random number, an authentication token; Determine whether the user account is allowed to use the wireless network voice service based on the contract parameters of the user account corresponding to the mobile terminal, wherein the contract parameters include: parameters configured for the user account in the home user server network element or the unified data management network element in the core network and used to characterize whether the user account is allowed to use the wireless network voice service.

5. The joint authentication method according to claim 3, characterized in that: Access gateway authentication includes: Acquire the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address conversion; According to the Internet protocol address and port number reported by the mobile terminal, the satellite terminal corresponding to the mobile terminal when initiating the wireless network voice service request is determined, and whether the satellite terminal allows wireless network voice service access is verified.

6. The joint authentication method according to claim 5, characterized in that: The method further comprises: Determine the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determine the geographical location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, to obtain the geographical location corresponding to the mobile terminal when initiating the wireless network voice service.

7. The joint authentication method according to claim 1, characterized in that: The method further comprises: When a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, a joint authentication is performed, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and to verify whether the satellite terminal as an access gateway allows wireless network voice service access through the subscription parameters corresponding to the satellite terminal in the core network; If the joint authentication passes, mobile user authentication is performed, and if the mobile user authentication passes, the wireless network voice service is allowed to be executed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal.

8. A joint authentication device, characterized in that: include: A first authentication module is used to perform satellite terminal authentication when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate; A second authentication module is used to perform mobile user authentication when the satellite terminal authentication is passed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legal; The third authentication module is used to perform access gateway authentication when the mobile user authentication is passed, and allow the wireless network voice service to be executed when the access gateway authentication is passed, wherein the access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: the satellite terminal.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the joint authentication method described in any one of claims 1 to 7 by running the computer program.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the joint authentication method described in any one of claims 1 to 7 are implemented.

Images