Access method and device and computer readable storage medium

Abstract

The embodiment of the invention provides an access method and device and a computer readable storage medium, and relates to the technical field of communication, so that a terminal can access a plurality of network nodes by using one identity credential without storing a plurality of identity credentials, and the possibility of leakage of the identity credentials is effectively reduced. The method comprises the following steps: receiving indication information of a target transceiving node of a base station network; the indication information is used for indicating the terminal to use the digital identity to request the access authority of the network on the target time-frequency resource; in response to the indication information, sending first request information on the target time-frequency resource; the first request information comprises a digital identity of the terminal; receiving a network identity used for representing the access permission; and accessing the network by adopting the network identity. The method and the device can be used in a wireless communication process.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an access method, device, and computer-readable storage medium. Background Art

[0002] In communication technology, authentication is required before a terminal accesses a network to obtain access rights. Currently, authentication is performed by encrypting the transmitted information by jointly saving a peer key between the terminal and the network side, and the communicating parties verify the encrypted information through the peer key to perform authentication.

[0003] This peer-to-peer key authentication has a relatively simple function, and a peer-to-peer key can only be used for one authentication interface (i.e., between a pair of communication nodes). In actual scenarios, terminals generally need to access different network nodes, that is, terminals need to save multiple identity credentials (peer keys), which greatly increases the possibility of identity credential leakage. Summary of the invention

[0004] The embodiments of the present application provide an access method, an apparatus, and a computer-readable storage medium, so that a terminal can access multiple network nodes using one identity credential, without having to store multiple identity credentials, i.e., peer keys, thereby effectively reducing the possibility of identity credential leakage.

[0005] On the one hand, an access method is provided, which is applied to a terminal, including:

[0006] Receiving indication information of a target transceiver node of the network; the indication information is used to instruct the terminal to use a digital identity to request access authority to the network on the target time-frequency resource;

[0007] In response to the indication information, sending first request information on the target time-frequency resource; the first request information includes a digital identity of the terminal;

[0008] Receiving a network identity for characterizing access rights;

[0009] Use network identity to access the network.

[0010] On the other hand, an access method is provided, which is applied to a target transceiver node of a network, comprising:

[0011] Sending instruction information; the instruction information is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resource;

[0012] Receiving first request information from a terminal, and sending second request information to a target authentication node of the network; the first request information and the second request information include a digital identity of the terminal;

[0013] The network identity used to characterize the access authority sent by the target authentication node of the receiving network is sent to the terminal.

[0014] In another aspect, an access method is provided, which is applied to a target authentication node of a network, comprising:

[0015] Receiving second request information sent by a target transceiver node of the network;

[0016] When the second request information is verified successfully, the network identity used to represent the access authority is sent to the terminal through the target transceiver node of the network.

[0017] On the other hand, a communication device is provided, including: a receiving module, a sending module and an access module.

[0018] The receiving module is used to receive indication information of a target transceiver node of the network; the indication information is used to instruct the terminal to use a digital identity to request access rights to the network on the target time-frequency resource;

[0019] The sending module is used to send first request information on the target time-frequency resource in response to the indication information; the first request information includes the digital identity of the terminal;

[0020] The receiving module is also used to receive a network identity used to characterize access rights;

[0021] The access module is used to access the network using a network identity.

[0022] On the other hand, a communication device is provided, including: a sending module and a receiving module.

[0023] The sending module is used to send indication information; the indication information is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resource;

[0024] The receiving module is used to receive the first request information of the terminal and send the second request information to the target authentication node of the network; the first request information and the second request information include the digital identity of the terminal;

[0025] The receiving module is also used to receive a network identity for representing access authority sent by a target authentication node of the network, and send the network identity to the terminal.

[0026] On the other hand, a communication device is provided, including: a receiving module and a sending module.

[0027] The receiving module is used to receive the second request information sent by the target transceiver node of the network;

[0028] The sending module is used to send a network identity used to represent the access authority to the terminal through a target transceiver node of the network when the second request information is verified.

[0029] On the other hand, a communication system is provided, including: a terminal, a target transceiver node of a network, and a target authentication node of the network.

[0030] The transceiver node of the network sends an indication message to the terminal. In response to the indication message, the terminal sends a first request message on the target time-frequency resource, and the first request message includes the digital identity of the terminal. After receiving the first request message of the terminal, the transceiver node of the network sends a second request message to the target authentication node of the network, and the first request message and the second request message include the digital identity of the terminal. If the second request message is verified, the target authentication node of the network sends a network identity used to characterize the access authority to the terminal through the transceiver node of the network. After receiving the network identity, the terminal uses the network device to access the network.

[0031] On the other hand, a communication device is provided, comprising: a memory and a processor; the memory and the processor are coupled; the memory is used to store a computer program; and the processor implements the access method described in any one of the above embodiments when executing the computer program.

[0032] On the other hand, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the access method described in any of the above embodiments is implemented.

[0033] On the other hand, a computer program product is provided, which includes computer program instructions, and when the computer program instructions are executed by a processor, the access method described in any of the above embodiments is implemented.

[0034] The access method provided by the embodiment of the present application, in which the terminal sends a first request information including a digital identity to obtain a network identity representing access authority after receiving the indication information of the target transceiver node of the network, and uses the network identity to access the network. Since the digital identity has been authenticated by an authoritative organization and is the user's personal identification document, it is guaranteed that the individual can be traced back through the digital identity. In this way, the terminal only needs to use one digital identity, and different nodes in the network can authenticate the terminal based on the digital identity. In this way, the terminal does not need to save multiple identity credentials, which effectively reduces the possibility of identity credential leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solution in the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only drawings of some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0036] Figure 1 A schematic diagram of the structure of a communication system provided in some embodiments of the present application;

[0037] Figure 2 A flowchart of an access method provided in some embodiments of the present application;

[0038] Figure 3 A flowchart of another access method provided in some embodiments of the present application;

[0039] Figure 4 A flowchart of another access method provided in some embodiments of the present application;

[0040] Figure 5 A flowchart of another access method provided in some embodiments of the present application;

[0041] Figure 6 An interactive schematic diagram of a communication method provided in some embodiments of the present application;

[0042] Figure 7 A schematic diagram of the structure of a communication device provided in some embodiments of the present application;

[0043] Figure 8 A schematic diagram of another communication device provided in some embodiments of the present application;

[0044] Fig. 9 A schematic diagram of the composition of another communication device provided in some embodiments of the present application;

[0045] Fig.10 A schematic diagram of the composition of yet another communication device provided in some embodiments of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in this application to clearly and completely describe the technical solutions in this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0048] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0049] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "multiple" means two or more.

[0050] The user-side terminal needs to be authenticated when it initially accesses the network to obtain access rights. At present, the authentication process is that the user-side terminal and the network side jointly hold a peer key to encrypt some certain and random information, and then the user-side terminal and the network side respectively verify whether the encrypted content of the other party is encrypted with a peer key, so as to prove the identity of both parties. The existing fifth-generation mobile communication system's identity authentication and key agreement (5th-generation mobile communication technology authentication and agreement, 5G AKA) authentication includes traditional peer key verification and digital certificate verification. The authentication process of both is ultimately completed through the encryption and decryption of the subscriber identification module (SIM) card. This method requires the user-side terminal to obtain access credentials (SIM card) offline, which contains the peer key required for access network authentication.

[0051] In addition, the terminal can also access the network through a digital certificate. The basic steps of authentication in this method are similar to those of a SIM card. The user first obtains a digital certificate with network access authority in advance, and provides the digital certificate to the network side when accessing the network. The network side verifies that the digital certificate is legitimate and the user can access the network.

[0052] It can be seen that both methods require a credential (the above-mentioned peer key or digital certificate) to be pre-set in the physical device, and the credential has a single function and can only be used in one authentication interface (i.e. between a pair of communication nodes). In actual scenarios, terminals generally need to access different network nodes, that is, users need to save multiple credentials to meet daily needs, which increases the demand for device performance and the difficulty of preventing credential leakage.

[0053] On the one hand, the unified data management (UDM) network element needs to serve millions of users, which can easily cause pipeline congestion and latency surges during peak hours. If the authentication process takes too long, the entire process needs to be restarted. If the UDM fails, the entire network will be paralyzed. On the other hand, both peer-to-peer keys and digital certificates need to be physically written offline, and in the face of various application scenarios, users need to save multiple keys or digital certificates.

[0054] In summary, there is an urgent need for a method that can implement multi-party network access verification based on one identity.

[0055] Based on this, an embodiment of the present application provides an access method, in which after receiving the indication information of the target transceiver node of the network, the terminal sends a first request information including a digital identity to obtain a network identity representing the access authority, and uses the network identity to access the network. Since the digital identity has been authenticated by an authoritative organization and is the user's personal identification document, it is guaranteed that the individual can be traced back through the digital identity. In this way, the terminal only needs to use one digital identity, and different nodes in the network can authenticate the terminal based on the digital identity. In this way, the terminal does not need to save multiple credentials, effectively reducing the possibility of key leakage.

[0056] Figure 1 This is a schematic diagram of the structure of a communication system provided in an embodiment of the present application. Figure 1 As shown, the communication system includes a terminal, a transceiver node (also called a base station) and an authentication node. The transceiver node and the authentication node belong to the same public land mobile network (PLMN). For ease of description, they are referred to as belonging to the same network hereinafter. The transceiver node and the terminal can be connected via a wireless network, and the transceiver node and the authentication node can be connected via a wired network. The wireless network can be supported by a router, a switch, or other devices that facilitate communication between the base station and the terminal, which is not limited in the embodiments of the present application.

[0057] In some embodiments, a base station is used to provide wireless access services to terminals. Specifically, a base station provides a service coverage area (also called a cell). Terminals entering the area can communicate with the base station through wireless signals to receive wireless access services provided by the base station. In addition, the service coverage area of ​​the base station can also be divided into near field and far field. The terminal may be within the range of the near field or the range of the far field.

[0058] In some embodiments, the base station may be a millimeter wave base station, an evolution nodeB (eNB), a next generation nodeB (gNB), a transmission receive point (TRP), a transmission point (TP), and some other access node. According to the size of the service coverage area provided, the base station can be divided into a macro base station for providing macro cells (Macro cells), a micro base station for providing micro cells (Pico cells), and a femto base station for providing femto cells (Femto cells). With the continuous evolution of wireless communication technology, future base stations may also adopt other names.

[0059] In some embodiments, the authentication node may be an authentication service function (AUSF) network element. The AUSF network element is used to receive an identity authentication request from a terminal and perform authentication.

[0060] In some embodiments, Figure 1 In the communication system shown, the network may also include an access and mobility management function (AMF) network element (not shown in the figure). The AMF network element is connected to the base station on one side and to the AUSF network element on the other side. The AMF network element is used to obtain the terminal identity authentication request sent by the base station and forward the request to the AUSF network element for terminal identity authentication.

[0061] In some embodiments, the terminal may be a device with wireless transceiver functions, such as a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiments of the present invention do not limit the specific types of terminals.

[0062] It should be understood that Figure 1 is an exemplary structural diagram, Figure 1 The communication system shown includes an unlimited number of devices, such as an unlimited number of base stations and an unlimited number of terminals. Figure 1 In addition to the equipment shown, Figure 1 The communication system shown may also include other devices, which is not limited thereto.

[0063] Figure 2 The following is a flow chart of an access method provided in an embodiment of the present application. For example, the access method provided in the present application can be applied to Figure 1 In the communication system shown in FIG. Figure 1 in the terminal.

[0064] like Figure 2 As shown, the access method provided by this application may specifically include the following steps:

[0065] S201. A terminal receives indication information of a target transceiver node of a network.

[0066] The indication information may also be referred to as access authority guidance information (digital-id-access-guide), which is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resources.

[0067] For S201, before the terminal accesses the network for the first time, it does not have network access rights, so it needs to perform authentication to obtain network access rights. The access rights can specifically be a network identity (corresponding to a new number in the traditional solution). In the embodiment of the present application, the terminal has a digital identity issued by a legitimate certification body, which can be a digital certificate or a distributed digital identity (decentralized identify, DID).

[0068] When network access is required, the terminal may receive indication information from a transceiver node of the network, where the indication information instructs the network to request network access authority on a target time-frequency resource by using a digital identity.

[0069] In some embodiments, the above indication information is carried in a system information block (SIB) signaling. For example, when the terminal actively requests the indication information, the indication information can be carried in an undefined SIB20 signaling. For another example, when the base station actively broadcasts the indication information, the indication information can be carried in the SIB1 signaling. In addition, the indication information can also be carried in a newly defined broadcast information, independent of the existing access process, and the embodiments of the present application do not impose specific restrictions on this.

[0070] S202. In response to the indication information, the terminal sends first request information on the target time-frequency resources.

[0071] The first request information includes the digital identity of the terminal.

[0072] For S202, after receiving the indication information sent by the transceiver node of the network, the terminal can respond to the indication information and send a first request information carrying the digital identity of the terminal on the target time-frequency resource indicated in the indication information to request access authority.

[0073] In some embodiments, the indication information includes first verification information (also referred to as digital-id-certification), which is used to verify the legitimacy of the digital identity of the terminal. The first request information also includes second verification information. The second verification information is the encrypted first verification information.

[0074] In some embodiments, the second verification information is the first verification information encrypted by a private key corresponding to the digital identity of the terminal.

[0075] In some embodiments, the first verification information may change over time to prevent the terminal reply information from being intercepted by unlawful users, which may lead to authentication security risks.

[0076] In some embodiments, the indication information is also used to instruct the terminal to send relevant information for access (or referred to as access authority requirement information digital-id-access-requirement), and the above-mentioned first request information also includes the relevant information.

[0077] Among them, the relevant information includes at least one of the following: the type of digital identity, the content of the digital identity, the information of the blockchain related to the digital identity, and the payment method. The type of the above-mentioned digital identity can be used to indicate whether the terminal sends a digital certificate or a DID. The content of the above-mentioned digital identity indicates the information that should be contained in the digital identity, such as the identity identification of the terminal, etc. The information of the blockchain related to the above-mentioned digital identity can be used to indicate whether the digital identity has been uploaded to the blockchain, and if it has been uploaded, it also indicates the uploaded blockchain number. In addition, since the present application uses a digital identity instead of a SIM card for authentication, the payment method for telephone charges can be negotiated. The above-mentioned fee payment method can indicate payment by binding a blockchain account, or it can be paid by other payment binding methods. In addition, the above-mentioned relevant information can also define the encryption type for subsequent encryption and decryption of the sent network identity.

[0078] It should be noted that if the fee payment method is not defined in the relevant information, a payment negotiation mechanism may be defined. The process of defining the payment negotiation mechanism may be performed in step S202 or after the digital identity of the terminal is verified as described below.

[0079] S203: The terminal receives a network identity used to represent access authority.

[0080] With respect to S203, after sending the first request message, the terminal may receive a network identity (network-id) sent by a target authentication node from the network through a target transceiver node, and the network identity represents the access authority.

[0081] In some embodiments, the received network identity is encrypted by the public key corresponding to the digital identity, that is, the target authentication node encrypts the network identity before sending it to the terminal, which can prevent the network identity from being intercepted by illegal users. Further, the terminal can use the private key corresponding to the digital identity to decrypt the received network identity and obtain the actual network identity for subsequent network access.

[0082] In other embodiments, the above-mentioned received network identity is encrypted by a preset encryption method, and the preset encryption method can be the encryption type indicated in the relevant information in the above-mentioned S202, or it can be negotiated between the terminal and the target authentication node of the network after the following digital identity authentication is passed. The embodiments of the present application do not make specific limitations on this.

[0083] S204: The terminal accesses the network using the network identity.

[0084] In some embodiments, Figure 3 As shown, the above S204 can be specifically implemented as follows: S2041-S2042.

[0085] S2041. The terminal verifies the legitimacy of the network identity.

[0086] S2042: When the verification is legitimate, the terminal uses the network identity to access the network.

[0087] It should be understood that the base station may be illegally occupied. Therefore, the network identity obtained by the terminal through the target transceiver node may be a false network identity sent by the target transceiver node that has been illegally occupied. If the terminal accesses the network without verifying the legitimacy of the network identity, there will be a huge security loophole. Therefore, after receiving the network identity, the terminal can further verify the legitimacy of the network identity through the following two implementation methods, and use the network identity to access the network if it is verified to be legitimate.

[0088] In one possible implementation, the terminal can verify the legitimacy of the network identity based on the target legitimate terminal. The target legitimate terminal is a terminal that has been verified by the target authentication node and is managed by other transceiver nodes in the network except the target transceiver node. The target authentication node is a node that issues the network identity in the network. In other words, the terminal can grant the network identity to the same authentication node (i.e., the above-mentioned target authentication node), but send authentication verification information to other terminals that access the network through different base stations. The legitimacy of the network identity is determined by judging whether these terminals have received the authentication verification information. For example, by receiving the response information fed back by the above-mentioned other terminals, it can be determined that the other terminals have received the authentication verification information.

[0089] In another possible implementation, when the target authentication node of the network has a digital identity, the terminal verifies the legitimacy of the network identity through the digital identity of the target authentication node. Exemplarily, the terminal can send verification information to the target authentication node through the target transceiver node, and the target authentication node encrypts the verification information with the private key corresponding to its own digital identity and feeds it back to the terminal. The terminal obtains the public key of the granting agency to decrypt the digital identity of the target authentication node to obtain the public key corresponding to the digital identity of the target authentication node, and further uses the public key to decrypt the verification information to see whether the decrypted verification information is consistent with the original verification information, and then judges the legitimacy of the network identity.

[0090] Figure 4 The following is a flow chart of an access method provided in an embodiment of the present application. For example, the access method provided in the present application can be applied to Figure 1 In the communication system shown in FIG. Figure 1 In the sending and receiving nodes of the network.

[0091] like Figure 4 As shown, the access method provided by this application may specifically include the following steps:

[0092] S401. A target transceiver node of a network sends instruction information.

[0093] The indication information is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resources.

[0094] For S401 above, the target transceiver node of the network may send indication information to the terminal after receiving the terminal's request to instruct the terminal to request access authority. Alternatively, the target transceiver node of the network may broadcast indication information to all terminals managed by itself to instruct the terminals with access requirements to request access authority.

[0095] S402: The target transceiver node of the network receives the first request information of the terminal, and sends the second request information to the target authentication node of the network.

[0096] The first request information and the second request information include the digital identity of the terminal.

[0097] For the above S402, after receiving the indication information, the terminal can send the first request information to the target transceiver node of the network. The target transceiver node of the network obtains the first request information and processes it to obtain the second request information, and sends the second request information to the target authentication node of the network through the AMF network element.

[0098] In some embodiments, the first request information includes not only the digital identity of the terminal, but also the second verification information. The second request information includes not only the digital identity of the terminal, but also the first verification information and the second verification information, and the second verification information (encrypted digital identity auxiliary verification digital-id-certification-encrypted) is the encrypted first verification information. The first verification information and the second verification information are used by the target authentication node of the network to verify the legitimacy of the terminal. In other words, the target transceiver node of the network processes the first request information by adding the first verification information to the first request information to obtain the second request information.

[0099] S403: The transceiver node of the network receives the network identity used to represent the access authority sent by the target authentication node of the network, and sends it to the terminal.

[0100] For the above S403, after the network's transceiver node sends the second request information to the target authentication node under the same network, it can obtain the network identity issued by the target authentication node through the AMF network element, and further send the network identity representing the access authority to the terminal so that the terminal can subsequently access the network.

[0101] In some embodiments, the network identity is encrypted using the public key corresponding to the digital identity of the terminal to prevent the network identity from being intercepted during transmission, thereby preventing security issues such as information leakage.

[0102] Figure 5 The following is a flow chart of an access method provided in an embodiment of the present application. For example, the access method provided in the present application can be applied to Figure 1 In the communication system shown in FIG. Figure 1 In the target authentication node of the network.

[0103] like Figure 5 As shown, the access method provided by this application may specifically include the following steps:

[0104] S501. A target authentication node of a network receives second request information sent by a target transceiver node of the network.

[0105] The second request information includes the digital identity of the terminal.

[0106] S502: When the second request information is verified successfully, the target authentication node of the network sends a network identity used to represent the access authority to the terminal through the target transceiver node of the network.

[0107] For the above S501 and S502, the target authentication node of the network can receive the second request information sent by the target transceiver node of the same network. Then, based on the digital identity of the terminal included in the second request information, verification is performed. If the verification is successful, the target authentication node of the network determines that the terminal is legitimate, then issues a network identity, and sends it to the terminal through the target transceiver node of the network. In addition, the target authentication node can also save the digital identity and network identity of the terminal accordingly.

[0108] In some embodiments, verifying the second request information includes the following two possible implementations:

[0109] In a possible implementation, the following steps are used for verification: Step a: Obtain the public key of the granting institution to which the digital identity belongs. Step b: Decrypt the digital identity using the public key of the granting institution to obtain the public key of the digital identity. Step c: Decrypt the second verification information using the public key of the digital identity to obtain the third verification information (digital-id-certification*). Step d: If the third verification information is consistent with the first verification information, determine that the second access permission request information is verified.

[0110] It should be understood that the digital identity is issued by a legitimate granting agency, and the digital identity includes a pair of public and private keys. Among them, the private key is stored on the terminal side and is not transmitted externally, and the public key can be informed to other nodes for auxiliary verification. The target authentication node can obtain the public key of the granting agency by accessing the blockchain (if the digital identity of the terminal has been uploaded to the blockchain) for verification. The public key of the granting agency can also be obtained from a preset storage space (such as a unified data management network element (UDM)) for verification. This verification can not only verify whether the digital identity is legal, but also verify whether the digital identity belongs to the terminal.

[0111] In addition, the current verification process is based on obtaining peer keys from UDM, which will cause UDM to serve millions of users, which can easily cause pipeline congestion and latency surges during peak hours. When the authentication process is delayed too long, the entire process needs to be re-initiated. If the UDM fails, the entire network will be paralyzed. The digital identity authentication method used in this application does not rely on UDM. Most nodes in the network can verify the legitimacy of the terminal, effectively improving the stability of the communication system.

[0112] In another possible implementation, the target authentication node may query whether the digital identity has a corresponding network identity. If so, it is determined that the second request information is verified, and then the queried corresponding network identity is encrypted and sent to the terminal. If not, the verification step described in the above implementation may be performed.

[0113] It should be understood that if it is found that the terminal has applied for a network identity before, the target authentication node does not need to repeat the verification, thereby reducing the waste of computing resources of the target authentication node.

[0114] In some embodiments, the network identity may be composed of the target authentication node information (AUSF information) that grants the identity + other information such as the blockchain node number. The target authentication node may use the network identity to record the corresponding phone charges of the terminal, the package used, and other information.

[0115] In some embodiments, after the network identity is generated, in order for the terminal to be able to directly access other nodes in the same network in the future without having to generate a new network identity again, the target authentication node can inform other network nodes of the network identity. Exemplarily, the network identity can be uploaded to the blockchain in the form of a blockchain, and other network nodes can access the blockchain to obtain it. It can also be a distributed storage method to broadcast the network node to other network nodes for storage, and the embodiments of the present application do not impose specific restrictions on this.

[0116] It should be understood that broadcasting the network identity to other network nodes can achieve multi-party access of the terminal, without the need for the terminal to re-verify when accessing other network nodes, effectively improving the network access efficiency of the terminal and thereby improving the user experience.

[0117] The access method provided by the embodiment of the present application, in which the terminal sends a first request information including a digital identity to obtain a network identity representing access authority after receiving the indication information of the target transceiver node of the network, and uses the network identity to access the network. Since the digital identity has been authenticated by an authoritative organization and is the user's personal identification document, it is guaranteed that the individual can be traced back through the digital identity. In this way, the terminal only needs to use one digital identity, and different nodes in the network can authenticate the terminal based on the digital identity. In this way, the terminal does not need to save multiple identity credentials, which effectively reduces the possibility of identity credential leakage.

[0118] Furthermore, by adopting the digital identity authentication method, the terminal can authenticate and access different network nodes, which can avoid the risk of single point failure of traditional central node authentication causing the entire network to be paralyzed, and avoid the waste of storage resources and security risks caused by the terminal storing multiple credentials. In addition, the terminal can also authenticate the network identity issued by the network node to ensure the legitimacy of the network node to be accessed, and further ensure communication security.

[0119] Figure 6 An interactive flow chart of an access method provided for an embodiment of the present application. The interactive process can be applied to a communication system, which includes a terminal, a base station (the target transceiver node of the above-mentioned network), an AMF network element, and an AUSF network element (the target authentication node of the above-mentioned network). First, the base station sends an indication message to the terminal, and the terminal generates a first request message carrying a digital identity and sends it to the base station. The base station further generates a second request message based on the first request message, and sends it to the AUSF network element through the AMF network element. The AUSF network element verifies whether the digital identity in the second request message is legal, and generates a network identity after the verification is passed, which is sent to the terminal through the AMF network element and the base station in turn. The terminal can further verify the legitimacy of the network identity, and then use the network identity to access the network.

[0120] It is understandable that the communication device (which can be the above-mentioned terminal, the target transceiver node of the network or the target authentication node of the network) includes a hardware structure and / or software module corresponding to the execution of each function in order to realize the above-mentioned functions. Those skilled in the art should be easily aware that, in conjunction with the algorithm steps of each example described in the embodiment of the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but this implementation should not be considered to exceed the scope of the present application.

[0121] The embodiment of the present application can divide the functional modules of the communication device according to the above method embodiment. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one functional module. The above integrated module can be implemented in the form of hardware or software. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.

[0122] Figure 7is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. The communication device can execute the access method provided in the above method embodiment. Figure 7 As shown, the communication device includes: a receiving module 701, a sending module 702 and an access module 703.

[0123] The receiving module 701 is used to receive indication information of a target transceiver node of a base station network; the indication information is used to instruct the terminal to use a digital identity to request network access authority on a target time-frequency resource.

[0124] The sending module 702 is used to send first request information on the target time-frequency resource in response to the indication information; the first request information includes the digital identity of the terminal.

[0125] The receiving module 701 is further used to receive a network identity used to characterize access authority.

[0126] The access module 703 is used to access the network using a network identity.

[0127] In some embodiments, the indication information includes first verification information; the first request information also includes second verification information; and the second verification information is the encrypted first verification information.

[0128] In some embodiments, the second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

[0129] In some embodiments, the access module 703 is specifically used to verify the legitimacy of the network identity; if the network identity is verified to be legitimate, the network is accessed using the network identity.

[0130] In some embodiments, the access module 703 is specifically used to verify the legitimacy of the network identity based on the target legitimate terminal, where the target legitimate terminal is a terminal that has been verified by the target authentication node and is managed by other transceiver nodes in the network except the target transceiver node; the target authentication node is a node in the network that issues the network identity; or, when the target authentication node of the network has a digital identity, the legitimacy of the network identity is verified through the digital identity of the target authentication node.

[0131] In some embodiments, the indication information is carried in system information block SIB signaling.

[0132] In some embodiments, the indication information is also used to instruct the terminal to send relevant information for access; the first request information also includes relevant information.

[0133] In some embodiments, the relevant information includes at least one of the following: the type of digital identity, the content of the digital identity, the information of the blockchain related to the digital identity, and the payment method.

[0134] In some embodiments, the received network identity is encrypted by a public key corresponding to the digital identity.

[0135] Figure 8 is a schematic diagram of the structure of another communication device provided in an embodiment of the present application, and the communication device can execute the access method provided in the above method embodiment. Figure 8 As shown, the communication device includes: a sending module 801 and a receiving module 802.

[0136] The sending module 801 is used to send indication information; the indication information is used to instruct the terminal to use a digital identity to request network access authority on a target time-frequency resource.

[0137] The receiving module 802 is used to receive first request information from the terminal and send second request information to a target authentication node of the network; the first request information and the second request information include the digital identity of the terminal.

[0138] The receiving module 802 is used to receive a network identity for representing access authority sent by a target authentication node of the network, and send the network identity to the terminal.

[0139] In some embodiments, the indication information includes first verification information; the first request information also includes second verification information; the second verification information is the encrypted first verification information; and the second request information also includes the first verification information and the second verification information.

[0140] In some embodiments, the second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

[0141] Fig. 9 is a schematic diagram of the structure of another communication device provided in an embodiment of the present application, and the communication device can execute the access method provided in the above method embodiment. Fig. 9 As shown, the communication device includes: a receiving module 901 and a sending module 902.

[0142] The receiving module 901 is used to receive second request information sent by a target transceiver node of the network; the second request information includes a digital identity of a terminal.

[0143] The sending module 902 is used to send a network identity used to represent the access authority to the terminal through a target transceiver node of the network when the second request information is verified.

[0144] In some embodiments, the second request information further includes first verification information and second verification information; the second verification information is the encrypted first verification information.

[0145] In some embodiments, the second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

[0146] In some embodiments, the above device further includes: an acquisition module 903 and a processing module 904. The acquisition module 903 is used to acquire the public key of the granting institution to which the digital identity belongs; the processing module 904 is used to decrypt the second verification information using the public key of the digital identity to obtain third verification information; if the third verification information is consistent with the first verification information, it is determined that the second access permission request information is verified.

[0147] An embodiment of the present application provides a communication system, which includes a terminal, a target transceiver node of the network and a target authentication node of the network, the terminal is used to execute the methods described in S201-S204 above, the target transceiver node of the network is used to execute the methods described in S401-S403 above, and the target authentication node of the network is used to execute the methods described in S501-S502 above.

[0148] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present application provides another possible structure of the communication device involved in the above-mentioned embodiment. Fig.10 As shown, the communication device 100 includes: a processor 1002 and a bus 1004. Optionally, the electronic device or communication device may further include a memory 1001; optionally, the electronic device or communication device may further include a communication interface 1003.

[0149] Processor 1002 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 1002 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. Processor 1002 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0150] The communication interface 1003 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0151] The memory 1001 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0152] As a possible implementation, the memory 1001 may exist independently of the processor 1002, and the memory 1001 may be connected to the processor 1002 via the bus 1004 for storing instructions or program codes. When the processor 1002 calls and executes the instructions or program codes stored in the memory 1001, the access method provided in the embodiment of the present application can be implemented.

[0153] In another possible implementation, the memory 1001 may also be integrated with the processor 1002 .

[0154] The bus 1004 may be an extended industry standard architecture (EISA) bus, etc. The bus 1004 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0155] In some embodiments, executable instructions are stored in the memory 1001. When the processor 1002 executes the executable instructions, the communication device executes the access method described in any of the above embodiments.

[0156] Some embodiments of the present application provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the access method described in any of the above embodiments.

[0157] Exemplarily, the above-mentioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or magnetic tapes, etc.), optical disks (e.g., compact disks (CD), digital versatile disks (DVD), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). The various computer-readable storage media described in this application may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0158] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the access method described in any one of the above embodiments.

[0159] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An access method, characterized in that: Applied to a terminal, the method comprises: Receiving indication information of a target transceiver node of a network; the indication information is used to instruct the terminal to use a digital identity to request access authority to the network on a target time-frequency resource; In response to the indication information, sending first request information on the target time-frequency resource; the first request information includes the digital identity of the terminal; Receiving a network identity representing the access right; The network is accessed using the network identity.

2. The method according to claim 1, characterized in that The indication information includes first verification information; the first request information also includes second verification information; the second verification information is the encrypted first verification information.

3. The method according to claim 2, characterized in that The second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

4. The method according to claim 1, characterized in that: The using the network identity to access the network includes: Verify the legitimacy of the network identity; If the verification is legitimate, the network identity is used to access the network.

5. The method according to claim 4, characterized in that The verifying the legitimacy of the network identity includes: Verifying the legitimacy of the network identity based on a target legitimate terminal, the target legitimate terminal being a terminal that has been verified by a target authentication node and is managed by other transceiver nodes in the network except the target transceiver node; the target authentication node is a node in the network that issues the network identity; Alternatively, when the target authentication node of the network has a digital identity, the legitimacy of the network identity is verified by the digital identity of the target authentication node.

6. The method according to claim 1, characterized in that The indication information is carried in the system information block SIB signaling.

7. The method according to claim 1, characterized in that The indication information is also used to instruct the terminal to send relevant information for access; the first request information also includes the relevant information.

8. The method according to claim 7, characterized in that The relevant information includes at least one of the following: the type of digital identity, the content of the digital identity, the information of the blockchain related to the digital identity, and the payment method.

9. The method according to claim 1, characterized in that: The received network identity is encrypted by the public key corresponding to the digital identity.

10. An access method, characterized in that: Applied to a target transceiver node of a network, the method comprises: Sending instruction information; the instruction information is used to instruct the terminal to use a digital identity to request access authority to the network on the target time-frequency resource; receiving first request information from the terminal, and sending second request information to a target authentication node of the network; the first request information and the second request information including a digital identity of the terminal; A network identity for characterizing the access authority sent by a target authentication node of the network is received and sent to the terminal.

11. The method according to claim 10, characterized in that The indication information includes first verification information; the first request information also includes second verification information; the second verification information is the encrypted first verification information; the second request information also includes the first verification information and the second verification information.

12. The method according to claim 11, characterized in that The second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

13. An access method, characterized in that: Applied to a target authentication node of a network, the method comprises: Receiving a second request message sent by a target transceiver node of the network; the second request message includes a digital identity of a terminal; When the second request information is verified successfully, a network identity used to represent the access authority is sent to the terminal through the target transceiver node of the network.

14. The method according to claim 13, characterized in that The second request information also includes first verification information and second verification information; the second verification information is the encrypted first verification information.

15. The method according to claim 14, characterized in that The second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

16. The method according to claim 13, characterized in that The method further comprises: Obtaining the public key of the authority that grants the digital identity; Decrypting the digital identity using the public key of the granting institution to obtain the public key of the digital identity; Decrypting the second verification information using the public key of the digital identity to obtain third verification information; When the third verification information is consistent with the first verification information, it is determined that the second access authority request information is verified successfully.

17. The method according to claim 13, characterized in that The method further comprises: Query whether the digital identity has a corresponding network identity; If so, it is determined that the second request information is verified successfully.

18. The method according to claim 13, characterized in that The network identity is encrypted by the public key corresponding to the digital identity.

19. A communication device, characterized in that: include: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instruction so that the communication device performs the access method according to any one of claims 1 to 18.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on the communication device, the communication device executes the access method according to any one of claims 1 to 18.

Images