Joint authentication method and apparatus, storage medium, and computer program product

Abstract

The application discloses a joint authentication method and device, a storage medium and a computer program product. The method comprises the following steps: in the case that a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, performing satellite terminal authentication; in the case that the satellite terminal authentication is passed, performing mobile user authentication, wherein the mobile user authentication is used for verifying whether a user account corresponding to the mobile terminal is legal; in the case that the mobile user authentication is passed, performing access gateway authentication, and in the case that the access gateway authentication is passed, allowing the wireless network voice service to be executed, wherein the access gateway authentication is used for judging whether the access gateway allows the wireless network voice service to access. The application solves the technical problem that the legality of the access terminal is difficult to guarantee due to the fact that the authentication mode for the wireless network voice service based on the space-ground integrated networking is single in the related art, and only the legality of the access user can be identified.

Description

Technical Field

[0001] This application relates to the field of mobile communication technology, and more specifically, to a joint authentication method, apparatus, storage medium, and computer program product. Background Technology

[0002] With the rapid development and widespread adoption of mobile communications, users' demand for high-quality wireless communication services is increasing daily. Especially in certain special scenarios, such as oceans, deserts, and aviation, traditional mobile network signals often struggle to provide coverage, causing numerous inconveniences for users during calls and data transmission. Building satellite internet is a crucial means of bridging the digital divide for the world's "unconnected" populations and an effective supplement to achieving continuous geographical coverage and universal sharing of network information.

[0003] Currently, satellite and WiFi (Wireless Fidelity) converged networking primarily provides data services. However, by effectively combining satellite, WiFi, and cellular networks, and connecting to an IMS (IP Multimedia Subsystem) network through satellite and WiFi converged networking, VoWiFi (Voice over WiFi) services based on terrestrial-satellite converged networking can be implemented, extending beyond data services to basic communication services such as voice and SMS. However, current authentication methods for wireless voice services based on terrestrial-satellite converged networking are limited, only identifying the legitimacy of the access user, which raises the issue of difficulty in guaranteeing the legitimacy of the access terminal.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a joint authentication method, apparatus, storage medium, and computer program product to at least solve the technical problem that the authentication method for wireless network voice services based on terrestrial-space converged networking in related technologies is singular and can only identify the legitimacy of the access user, making it difficult to guarantee the legitimacy of the access terminal.

[0006] According to one aspect of the embodiments of this application, a joint authentication method is provided, comprising: when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, performing satellite terminal authentication, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate; if the satellite terminal authentication is successful, performing mobile user authentication, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; if the mobile user authentication is successful, performing access gateway authentication, and if the access gateway authentication is successful, allowing the wireless network voice service to be executed, wherein the access gateway authentication is used to determine whether the access gateway allows the wireless network voice service to be accessed, and the access gateway includes: a satellite terminal.

[0007] Optionally, satellite terminal authentication includes: when a satellite terminal requests network access to establish a satellite link, obtaining the authentication request sent by the satellite terminal, wherein the authentication request contains the satellite terminal's identification information, which includes at least one of the following: the satellite terminal's device information and serial number; if the satellite terminal's identification information is included in a preset list of trusted devices, determining that the satellite terminal has passed authentication, assigning an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

[0008] Optionally, if the satellite terminal authentication is successful, the method further includes: obtaining the geographical location information and access time information reported by the satellite terminal, wherein the geographical location information includes the latitude and longitude corresponding to the satellite terminal.

[0009] Optionally, mobile user authentication includes: when a mobile terminal requests access to the core network via a satellite link, sending authentication parameters to the mobile terminal, and determining whether the user account corresponding to the mobile terminal is trustworthy by comparing the response result returned by the mobile terminal to the authentication parameters with the expected response corresponding to the authentication parameters. The authentication parameters include at least one of the following: a random number or an authentication token. Based on the subscription parameters of the user account corresponding to the mobile terminal, determining whether the user account is allowed to use wireless network voice services, the subscription parameters include: parameters configured for the user account in the home user server network element or unified data management network element of the core network to characterize whether the user account is allowed to use wireless network voice services.

[0010] Optionally, access gateway authentication includes: obtaining the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address translation; determining the satellite terminal corresponding to the mobile terminal when initiating a wireless network voice service request based on the Internet Protocol address and port number reported by the mobile terminal, and verifying whether the satellite terminal allows wireless network voice service access.

[0011] Optionally, the method further includes: determining the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determining the geographical location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, so as to obtain the geographical location corresponding to the mobile terminal when initiating wireless network voice service.

[0012] Optionally, the method further includes: when a mobile terminal initiates a wireless network voice service request through a space-ground converged network, performing joint authentication, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and to verify whether the satellite terminal, acting as an access gateway, allows access to the wireless network voice service through the subscription parameters corresponding to the satellite terminal in the core network; if the joint authentication is successful, performing mobile user authentication, and if the mobile user authentication is successful, allowing the wireless network voice service to be executed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0013] According to another aspect of the embodiments of this application, a joint authentication device is also provided, comprising: a first authentication module, configured to perform satellite terminal authentication when a mobile terminal initiates a wireless network voice service request through a terrestrial-satellite converged network, wherein the satellite terminal authentication is used to verify whether the satellite terminal is legitimate; a second authentication module, configured to perform mobile user authentication when the satellite terminal authentication is successful, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; and a third authentication module, configured to perform access gateway authentication when the mobile user authentication is successful, and to allow the execution of the wireless network voice service when the access gateway authentication is successful, wherein the access gateway authentication is used to determine whether the access gateway allows the wireless network voice service access, and the access gateway includes: a satellite terminal.

[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes a joint authentication method by running the computer program.

[0015] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of a joint authentication method.

[0016] In this embodiment, when a mobile terminal initiates a wireless network voice service request through a terrestrial-satellite integrated network, satellite terminal authentication is performed to verify the legitimacy of the satellite terminal. If satellite terminal authentication is successful, mobile user authentication is performed to verify the legitimacy of the user account corresponding to the mobile terminal. If mobile user authentication is successful, access gateway authentication is performed, and if access gateway authentication is successful, the wireless network voice service is allowed to execute. Access gateway authentication determines whether the access gateway allows access to the wireless network voice service. The access gateway includes a satellite terminal. This cross-domain network joint authentication method, involving satellite terminal authentication, mobile user authentication, and access gateway authentication, achieves multi-level authentication capabilities for satellite-based VoWiFi services. This ensures the legitimacy of the satellite terminal, mobile user, and access gateway, thereby solving the technical problem that the authentication method for wireless network voice services based on terrestrial-satellite integrated networks in related technologies is singular, only able to identify the legitimacy of the access user, making it difficult to guarantee the legitimacy of the access terminal. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a joint authentication method according to an embodiment of this application;

[0019] Figure 2 This is a schematic diagram of a joint authentication method flow provided according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of the architecture of a space-ground integrated network according to an embodiment of this application;

[0021] Figure 4 This is a flowchart illustrating a cross-domain joint authentication and tracing method provided according to an embodiment of this application;

[0022] Figure 5 This is a schematic diagram of an optimized joint authentication process provided according to an embodiment of this application;

[0023] Figure 6 This is a schematic diagram of a joint authentication device provided according to an embodiment of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] To facilitate a better understanding of the embodiments of this application by those skilled in the art, some technical terms or nouns involved in the embodiments of this application are explained as follows:

[0027] S2b: Defined in the 3GPP (Third Generation Partnership Project) standard, it is a scheme for the convergence of WiFi and LTE (Long Term Evolution) networks, mainly targeting untrusted WiFi networks.

[0028] In related technologies, authentication and tracing methods for VoWiFi services have many shortcomings. For example, authentication methods are often limited, only identifying the legitimacy of the accessing user, and failing to ensure the legitimacy of the accessing terminal. In satellite-integrated networking scenarios, there are no effective tracing methods, making it difficult to achieve precise tracing capabilities down to the household level. These problems not only affect the security and stability of the service but also limit its application and development in a wider range of fields. Therefore, researching authentication and tracing methods for terrestrial-satellite integrated networking has become an essential issue to be addressed.

[0029] To address this issue, relevant solutions are provided in the embodiments of this application, which are described in detail below.

[0030] According to an embodiment of this application, a method embodiment for joint authentication is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware block diagram of a computer terminal (or electronic device) for implementing a joint authentication method is shown. Figure 1 As shown, the computer terminal 10 (or electronic device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0032] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or electronic device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the joint authentication method in the embodiments of this application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned joint authentication method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0035] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or electronic device).

[0036] Under the above operating environment, this application provides a joint authentication method. Figure 2 This is a schematic diagram of a joint authentication method flow provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0037] Step S202: When the mobile terminal initiates a wireless network voice service request through the terrestrial-satellite converged network, satellite terminal authentication is performed, wherein satellite terminal authentication is used to verify whether the satellite terminal is legitimate.

[0038] Step S204: If the satellite terminal authentication is successful, mobile user authentication is performed, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0039] Step S206: If the mobile user authentication is successful, access gateway authentication is performed, and if access gateway authentication is successful, wireless network voice service is allowed to execute. Access gateway authentication is used to determine whether the access gateway allows wireless network voice service access. The access gateway includes: satellite terminal.

[0040] Through the above steps, a cross-domain network joint authentication method involving satellite terminal authentication, mobile user authentication, and access gateway authentication is implemented to achieve multi-authentication capabilities for satellite-based VoWiFi services. This ensures the legitimacy of satellite terminals, mobile users, and access gateways, thereby solving the technical problem of difficulty in guaranteeing the legitimacy of access terminals caused by the single authentication method for wireless network voice services based on terrestrial-space converged networking in related technologies, which can only identify the legitimacy of access users.

[0041] Currently, international commercial VoWiFi operators all adopt the ePDG (Evolved Packet Data Gateway) solution based on S2b. The joint authentication method provided in this application is based on this architecture. The satellite-based VoWiFi service design includes satellite systems, terrestrial cellular systems, etc., and the overall architecture is as follows: Figure 3 As shown, the business data flow is represented by the blue line, while the authentication and traceability data flow is represented by the yellow line. Cross-domain authentication and traceability involve multiple systems.

[0042] The joint authentication method in steps S202 to S206 of the embodiments of this application will be further described below.

[0043] Figure 4 This is a flowchart illustrating a cross-domain joint authentication and tracing method provided in an embodiment of this application, as shown below. Figure 4 As shown.

[0044] When a mobile terminal (such as a mobile phone) initiates a request for wireless network voice service (VoWiFi service), satellite terminal authentication can be performed. The specific steps are as follows.

[0045] In some embodiments of this application, satellite terminal authentication includes the following steps: when a satellite terminal requests access to the network to establish a satellite link, an authentication request sent by the satellite terminal is obtained, wherein the authentication request contains identification information of the satellite terminal, and the identification information includes at least one of the following: satellite terminal device information, serial number; if the identification information of the satellite terminal is included in a preset list of trusted devices, the satellite terminal is determined to be authenticated, an Internet Protocol address and port number are assigned to the satellite terminal, and the satellite terminal is allowed to access the network.

[0046] Specifically, when a satellite terminal accesses the network and establishes a satellite link, it sends an authentication request (containing the terminal's device information, serial number, and other identification information) to the network management system. Upon receiving the authentication request, the network verifies whether the satellite terminal's device information is stored in a pre-defined list of trusted devices. If the trusted device list contains the satellite terminal's identification information, the device information verification is successful. The network management system then executes the corresponding authentication algorithm. After execution, the network management system sends the authentication result to the satellite terminal. If authentication is successful, the terminal is allowed to access the network; otherwise, the access request is rejected.

[0047] In addition, after the satellite terminal authentication is completed, the satellite terminal can be assigned an IP address (Internet Protocol Address) and port number to access the Internet, and its longitude, latitude and longitude information reported in real time can be obtained. That is, if the satellite terminal authentication is successful, the method also includes the following steps: obtaining the geographical location information and access time information reported by the satellite terminal, wherein the geographical location information includes the longitude and latitude of the satellite terminal.

[0048] Specifically, the geographical location information and access time information reported by the satellite terminal can be shown in Table 1 below.

[0049] Table 1

[0050] Satellite Terminal A XYZ 1.1.1.1 100 E 120°52′ N30°40′ 6 / 1 8：00

[0051] Once the satellite terminal authentication is successful, subsequent mobile user authentication can proceed, with the specific steps as follows.

[0052] In some embodiments of this application, mobile user authentication includes the following steps: when a mobile terminal requests access to the core network via a satellite link, authentication parameters are sent to the mobile terminal, and the user account corresponding to the mobile terminal is determined to be trustworthy by comparing the response result returned by the mobile terminal to the authentication parameters with the expected response corresponding to the authentication parameters. The authentication parameters include at least one of the following: a random number or an authentication token. Based on the subscription parameters of the user account corresponding to the mobile terminal, it is determined whether the user account is allowed to use wireless network voice services. The subscription parameters include parameters configured for the user account in the home user server network element or unified data management network element of the core network to characterize whether the user account is allowed to use wireless network voice services.

[0053] Specifically, when a mobile terminal requests access to the cellular network core network via a satellite link, a cellular authentication process can be used. This process verifies the user's identity and legitimacy through authentication parameters (such as XRES (Expected Response), RAND (Random Number), AUTN (Authentication Token), etc.) and algorithms. For 5G users, dual authentication is performed using both home and roaming locations, and this process will not be elaborated upon here.

[0054] In addition, during the registration process, the user's permission to use the VoWiFi service can be determined by the subscription parameters. For users of satellite-based VoWiFi services, the subscription parameters can be selected from cellular core network elements, such as parameters in HSS (Home Subscriber Server) / UDM (Unified Data Management).

[0055] Once the mobile user authentication is successful, access gateway authentication can be performed. The specific steps are as follows.

[0056] In some embodiments of this application, access gateway authentication includes the following steps: obtaining the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address translation; determining the satellite terminal corresponding to the mobile terminal when initiating a wireless network voice service request based on the Internet Protocol address and port number reported by the mobile terminal, and verifying whether the satellite terminal allows wireless network voice service access.

[0057] It should be noted that in satellite-based VoWiFi services, the IP address and port number reported by the mobile phone are the Internet IP address and port number of the satellite terminal after network address translation, as shown in Table 2.

[0058] Table 2

[0059] Phone B 1.1.1.1 100 6 / 1 8：00

[0060] Based on this, location tracing can be achieved by mapping the Internet Protocol address and port number reported by the mobile terminal to the Internet Protocol address and port number assigned to the satellite terminal. The specific steps are as follows.

[0061] In some embodiments of this application, the method further includes the following steps: determining the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determining the geographical location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, so as to obtain the geographical location corresponding to the mobile terminal when initiating wireless network voice service.

[0062] Specifically, by matching the information in Tables 1 and 2 above, the real-time location (latitude and longitude information) of the mobile terminal when making a satellite VoWiFi call can be obtained, as shown in Table 3.

[0063] Table 3

[0064]

[0065] In addition, as an optional implementation, the information obtained in Table 3 can be further supplemented by information stored in the traceability gateway in advance, such as supplementing information on terminal attributes, usage areas, etc. The relevant information can be transmitted to the cellular core network as supplementary information.

[0066] Furthermore, since in most scenarios, the access gateway in access gateway authentication refers to the satellite terminal, this application embodiment also provides an optimized scheme for the above authentication method, which can determine in advance whether the satellite terminal is allowed to use the Haiti Air VoWiFi service during satellite terminal authentication. The specific steps are as follows.

[0067] In some embodiments of this application, the method further includes the following steps: when a mobile terminal initiates a wireless network voice service request through a space-ground converged network, joint authentication is performed, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and to verify whether the satellite terminal, as an access gateway, allows access to the wireless network voice service through the subscription parameters corresponding to the satellite terminal in the core network; if the joint authentication is successful, mobile user authentication is performed, and if the mobile user authentication is successful, the wireless network voice service is allowed to execute, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0068] Specifically, such as Figure 5As shown, satellite terminal authentication and access gateway authentication are combined. Specifically, during satellite terminal authentication, the subscription parameters of the satellite terminal in the satellite core network are used to pre-determine whether the access gateway (satellite terminal) allows access to the satellite VoWiFi service. If the subscription parameters indicate permission, the mobile terminal can use the VoWiFi service through the satellite terminal, and the registration process continues. If the subscription parameters indicate disallowance, the mobile terminal cannot use the VoWiFi service through the satellite terminal, authentication fails, and the registration process stops. Since this parameter is not specified in existing protocols or systems, any parameter can be used to represent this function. Through joint authentication, legitimate and authorized mobile terminals are identified in the satellite network, enabling... Figure 4 The three-step authentication process has been shortened to two steps, which simplifies the authentication process.

[0069] Using the above Figure 5 When the joint authentication method shown completes authentication, the location tracing step can be implemented after the joint authentication step by adding a field to carry relevant location information to the cellular core network. By adding a field, location information can be obtained in advance, reducing the tracing process.

[0070] This application's solution achieves multi-level authentication capabilities for satellite-based VoWiFi services through satellite terminal authentication, mobile user authentication, and access gateway authentication, ensuring the legitimacy of satellite terminals, mobile users, and access gateways. Furthermore, based on the unique identifier of the satellite terminal, a cross-domain traceability method is constructed, resolving the issues of user access legitimacy and service traceability for satellite-based VoWiFi services, and addressing regulatory problems caused by the inability to trace the source. Through cross-domain network joint authentication, the legitimacy of user access to satellite-based VoWiFi services can be jointly determined across domains and traced, ensuring service security and enabling traceability.

[0071] According to an embodiment of this application, an embodiment of a joint authentication device is also provided. Figure 6 This is a schematic diagram of a joint authentication device provided according to an embodiment of this application. Figure 6 As shown, the device includes:

[0072] The first authentication module 60 is used to authenticate the satellite terminal when the mobile terminal initiates a wireless network voice service request through the terrestrial-satellite converged network. The satellite terminal authentication is used to verify whether the satellite terminal is legitimate.

[0073] The second authentication module 62 is used to authenticate the mobile user when the satellite terminal authentication is successful. The mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0074] The third authentication module 64 is used to perform access gateway authentication when the mobile user authentication is successful, and to allow the wireless network voice service to be executed when the access gateway authentication is successful. The access gateway authentication is used to determine whether the access gateway allows the wireless network voice service to access. The access gateway includes: satellite terminal.

[0075] Optionally, satellite terminal authentication includes: when a satellite terminal requests network access to establish a satellite link, obtaining the authentication request sent by the satellite terminal, wherein the authentication request contains the satellite terminal's identification information, which includes at least one of the following: the satellite terminal's device information and serial number; if the satellite terminal's identification information is included in a preset list of trusted devices, determining that the satellite terminal has passed authentication, assigning an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

[0076] Optionally, if the satellite terminal authentication is successful, the joint authentication device is also used to: obtain the geographical location information and access time information reported by the satellite terminal, wherein the geographical location information includes: the latitude and longitude corresponding to the satellite terminal.

[0077] Optionally, mobile user authentication includes: when a mobile terminal requests access to the core network via a satellite link, sending authentication parameters to the mobile terminal, and determining whether the user account corresponding to the mobile terminal is trustworthy by comparing the response result returned by the mobile terminal to the authentication parameters with the expected response corresponding to the authentication parameters. The authentication parameters include at least one of the following: a random number or an authentication token. Based on the subscription parameters of the user account corresponding to the mobile terminal, determining whether the user account is allowed to use wireless network voice services, the subscription parameters include: parameters configured for the user account in the home user server network element or unified data management network element of the core network to characterize whether the user account is allowed to use wireless network voice services.

[0078] Optionally, access gateway authentication includes: obtaining the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address translation; determining the satellite terminal corresponding to the mobile terminal when initiating a wireless network voice service request based on the Internet Protocol address and port number reported by the mobile terminal, and verifying whether the satellite terminal allows wireless network voice service access.

[0079] Optionally, the joint authentication device is also used to: determine the satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal, and determine the geographical location information reported by the satellite terminal corresponding to the access time reported by the mobile terminal, so as to obtain the geographical location corresponding to the mobile terminal when initiating wireless network voice service.

[0080] Optionally, the joint authentication device is further configured to: perform joint authentication when a mobile terminal initiates a wireless network voice service request through the space-ground converged network, wherein the joint authentication is used to verify whether the satellite terminal is legitimate, and to verify whether the satellite terminal, acting as an access gateway, allows access to the wireless network voice service through the subscription parameters corresponding to the satellite terminal in the core network; and perform mobile user authentication when the joint authentication is successful, and allow the wireless network voice service to execute when the mobile user authentication is successful, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate.

[0081] It should be noted that each module in the above-mentioned joint authentication device can be a program module (e.g., a set of program instructions that implement a certain function) or a hardware module. For the latter, it can be manifested in the following forms, but is not limited to them: each of the above modules is manifested as a processor, or the functions of each of the above modules are implemented by a processor.

[0082] It should be noted that the joint authentication device provided in this embodiment can be used to execute... Figure 2 The joint authentication method shown above is also applicable to the embodiments of this application, and will not be repeated here.

[0083] This application embodiment also provides a non-volatile storage medium, which includes a stored computer program. The device containing the non-volatile storage medium executes the following joint authentication method by running the computer program: when a mobile terminal initiates a wireless network voice service request through a terrestrial-satellite converged network, satellite terminal authentication is performed, wherein satellite terminal authentication is used to verify whether the satellite terminal is legitimate; if satellite terminal authentication is successful, mobile user authentication is performed, wherein mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; if mobile user authentication is successful, access gateway authentication is performed, and if access gateway authentication is successful, wireless network voice service execution is allowed, wherein access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes a satellite terminal.

[0084] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the joint authentication method described in various embodiments of this application: when a mobile terminal initiates a wireless network voice service request through a space-ground integrated network, satellite terminal authentication is performed, wherein satellite terminal authentication is used to verify whether the satellite terminal is legitimate; if satellite terminal authentication is successful, mobile user authentication is performed, wherein mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; if mobile user authentication is successful, access gateway authentication is performed, and if access gateway authentication is successful, wireless network voice service execution is allowed, wherein access gateway authentication is used to determine whether the access gateway allows wireless network voice service access, and the access gateway includes: a satellite terminal.

[0085] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0086] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0087] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0088] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0089] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0090] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0091] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A joint authentication method, characterized in that, include: When a mobile terminal initiates a wireless network voice service request through a space-ground converged network, satellite terminal authentication and access gateway authentication are combined for joint authentication. The joint authentication is used to verify whether the satellite terminal is legitimate, and to verify in advance whether the satellite terminal, which acts as the access gateway, allows wireless network voice service access by using the subscription parameters of the satellite terminal in the core network. If the joint authentication is successful, mobile user authentication is performed, and if the mobile user authentication is successful, the wireless network voice service is allowed to execute, wherein the mobile user authentication is used to verify whether the user account corresponding to the mobile terminal is legitimate; The satellite terminal authentication process includes: when the satellite terminal requests network access to establish a satellite link, obtaining the authentication request sent by the satellite terminal, wherein the authentication request contains the identification information of the satellite terminal, and the identification information includes at least one of the following: the satellite terminal's device information and serial number; if the identification information of the satellite terminal is included in a preset list of trusted devices, determining that the satellite terminal has passed authentication, assigning an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

2. The joint authentication method according to claim 1, characterized in that, If the satellite terminal authentication is successful, the method further includes: Obtain the geographical location information and access time information reported by the satellite terminal, wherein the geographical location information includes the latitude and longitude corresponding to the satellite terminal.

3. The joint authentication method according to claim 1, characterized in that, Mobile user authentication includes: When the mobile terminal requests access to the core network via the satellite link, authentication parameters are sent to the mobile terminal, and the user account corresponding to the mobile terminal is determined to be trustworthy by comparing the response result returned by the mobile terminal to the authentication parameters with the expected response corresponding to the authentication parameters. The authentication parameters include at least one of the following: random number, authentication token. Based on the subscription parameters of the user account corresponding to the mobile terminal, it is determined whether the user account is allowed to use the wireless network voice service. The subscription parameters include parameters configured for the user account in the core network's home user server network element or unified data management network element to indicate whether the user account is allowed to use the wireless network voice service.

4. The joint authentication method according to claim 2, characterized in that, Access gateway authentication includes: Obtain the Internet Protocol address and port number reported by the mobile terminal, wherein the Internet Protocol address and port number reported by the mobile terminal are the Internet Protocol address and port number of the satellite terminal corresponding to the mobile terminal after network address translation; Based on the Internet Protocol address and port number reported by the mobile terminal, the satellite terminal corresponding to the mobile terminal when it initiates a wireless network voice service request is determined, and it is verified whether the satellite terminal allows wireless network voice service access.

5. The joint authentication method according to claim 4, characterized in that, The method further includes: The satellite terminal corresponding to the Internet Protocol address and port number reported by the mobile terminal is determined, and the geographical location information corresponding to the access time reported by the mobile terminal is determined, so as to obtain the geographical location of the mobile terminal when it initiates the wireless network voice service.

6. A joint authentication device, characterized in that, The joint authentication device is used to perform joint authentication by combining satellite terminal authentication and access gateway authentication when a mobile terminal initiates a wireless network voice service request through a space-ground converged network. The joint authentication verifies the legitimacy of the satellite terminal and, based on the subscription parameters corresponding to the satellite terminal in the core network, pre-verifies whether the satellite terminal, acting as the access gateway, allows access to the wireless network voice service. If the joint authentication is successful, mobile user authentication is performed, and if the mobile user authentication is successful, the wireless network voice service is allowed to execute. The mobile user authentication verifies the legitimacy of the user account corresponding to the mobile terminal. The satellite terminal authentication process includes: when the satellite terminal requests network access to establish a satellite link, obtaining the authentication request sent by the satellite terminal, wherein the authentication request contains the identification information of the satellite terminal, and the identification information includes at least one of the following: the satellite terminal's device information and serial number; if the identification information of the satellite terminal is included in a preset list of trusted devices, determining that the satellite terminal has passed authentication, assigning an Internet Protocol address and port number to the satellite terminal, and allowing the satellite terminal to access the network.

7. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the joint authentication method according to any one of claims 1 to 5 by running the computer program.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the joint authentication method according to any one of claims 1 to 5.

Images