User authentication method and device, electronic equipment and computer program product

Abstract

The invention relates to the technical field of wireless communication, and particularly provides a user authentication method and device, electronic equipment and a computer program product. The method comprises: receiving a first message sent by a first network element, the first message comprising a user authentication instruction used for instructing a terminal device to perform user authentication; and a second message is sent to a second network element, the second message comprises an identifier used for indicating establishment of a data channel, and the data channel is used for transmitting identity authentication related data of the user to be authenticated. On the basis of the IMS registration process of the IP multimedia system data channel of the user card, the IMS data channel DC is used for transmitting the identity authentication related data of the natural person user, IMS authentication and service authorization of the identity of the natural person user are achieved, and then service control management of the network on the natural person user is achieved.

Description

Technical Field

[0001] The present disclosure relates to the field of wireless communication technology, and in particular to a user authentication method, device, electronic device and computer program product. Background Art

[0002] At present, network authentication and the allocation and use of network resources are mainly based on the dimension of user cards (such as SIM cards). However, with the development of personal and vertical industry businesses, the demand for a design concept centered on natural persons is increasing.

[0003] For example, the same tablet computer can be used by different individuals. The current method of network authentication and authorization based on user cards and network resource allocation and use cannot provide differentiated services for different individuals, that is, the services and quality of service (QoS) provided to adults and children may be the same.

[0004] For example, in some vertical industries with very high security requirements (such as military, nuclear power, etc.), for data security reasons, basically only dedicated terminals can access their internal services or data. However, it is still possible that multiple natural persons with different security levels use the same dedicated terminal. In this case, it is possible that a natural person accesses services or data that are not accessible to his or her own security level, thereby posing a data security risk.

[0005] Therefore, there is an urgent need to conduct network authentication and authorization as well as network resource allocation and utilization centered on natural persons, but the current operator networks cannot meet such needs. Summary of the invention

[0006] The present disclosure is proposed in view of the above problems. The present disclosure provides a user authentication method, device, electronic device and computer program product.

[0007] According to one aspect of the present disclosure, there is provided a user authentication method, which is applied to a terminal device, and the method comprises: receiving a first message sent by a first network element, wherein the first message comprises a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform user authentication; and sending a second message to a second network element, wherein the second message comprises: an identifier for indicating establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

[0008] In addition, according to a user authentication method according to one aspect of the present disclosure, the identity authentication related data of the user to be authenticated includes at least one of the following: first data, the first data is used to indicate the identity source data of the user to be authenticated; third data, the third data is used to indicate the identity identifier of the user to be authenticated.

[0009] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: sending a third message to the first network element, wherein the third message is used to request registration, and the third message includes a user authentication request.

[0010] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: acquiring first data; and sending the first data to a third network element based on a data channel.

[0011] In addition, according to an aspect of the user authentication method of the present disclosure, the method further includes: receiving third data sent by a third network element based on a data channel, wherein the third data is determined based on the first data.

[0012] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: sending a fourth message to a fourth network element, wherein the fourth message is used to establish a call request, and the fourth message includes third data.

[0013] In addition, according to a user authentication method according to one aspect of the present disclosure, the data channel includes: an IP Multimedia System Data Channel (IMSDC).

[0014] According to another aspect of the present disclosure, a user authentication method is provided, which is applied to a third network element, and the method includes: receiving first data sent by a terminal device based on a data channel; determining second data based on the first data, wherein the data channel is used to transmit identity authentication related data of the user to be authenticated, and the identity authentication related data of the user to be authenticated includes first data, the first data is used to indicate the identity source data of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

[0015] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: sending a fifth message to a fifth network element, wherein the fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes second data.

[0016] In addition, according to a user authentication method according to one aspect of the present disclosure, the method also includes: receiving a sixth message sent by a fifth network element, wherein the sixth message includes third data, the third data is identity authentication related data of the user to be authenticated, and is used to indicate the identity identification of the user to be authenticated, and the third data is determined based on the second data.

[0017] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: sending third data to the terminal device based on the data channel.

[0018] In addition, according to a user authentication method according to one aspect of the present disclosure, the data channel includes: an IP Multimedia System Data Channel (IMSDC).

[0019] According to another aspect of the present disclosure, a user authentication method is provided, which is applied to a fifth network element, and the method includes: receiving a fifth message sent by a third network element, wherein the fifth message is used to request identity authentication of a user to be authenticated, and the fifth message includes second data; based on the second data and pre-configured data, determining third data, wherein the third data is used to indicate an identity identifier of the user to be authenticated, and the second data is used to indicate identity identification data of the user to be authenticated.

[0020] In addition, according to a user authentication method according to one aspect of the present disclosure, the pre-configured data includes: an association relationship between the second data, the third data and the IMS identity of the user.

[0021] According to another aspect of the present disclosure, a user authentication method is provided, which is applied to a first network element, and the method includes: receiving a seventh message sent by a fifth network element, wherein the seventh message includes third data; based on the third data, controlling the service triggering of a call request of the user to be authenticated, wherein the third data is used to indicate an identity identifier of the user to be authenticated.

[0022] In addition, according to a user authentication method according to one aspect of the present disclosure, controlling the service triggering of a call request of the user to be authenticated includes: routing the call request to an IMS service platform that allows triggering.

[0023] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: receiving a third message sent by a terminal device, wherein the third message is used to request registration and includes a user authentication request.

[0024] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: sending a first message to a terminal device, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform user authentication.

[0025] According to another aspect of the present disclosure, a user authentication method is provided, which is applied to a second network element, and the method includes: receiving an eighth message sent by a fifth network element, wherein the eighth message includes third data; based on the third data, controlling a service request of the user to be authenticated, wherein the third data is used to indicate an identity identifier of the user to be authenticated.

[0026] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: receiving a second message sent by a terminal device, wherein the second message includes: an identifier for indicating establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

[0027] In addition, according to a user authentication method according to one aspect of the present disclosure, the method further includes: sending a ninth message to a third network element, wherein the ninth message includes: an identifier for indicating establishment of a data channel.

[0028] In addition, according to a user authentication method according to one aspect of the present disclosure, the data channel includes: an IP Multimedia System Data Channel (IMSDC).

[0029] According to another aspect of the present disclosure, a user authentication device is provided, the device comprising: a receiving module, used to receive a first message sent by a first network element, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct a terminal device to perform user authentication; a sending module, used to send a second message to a second network element, wherein the second message includes: an identifier for indicating establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

[0030] According to another aspect of the present disclosure, a user authentication device is provided, the device comprising: a receiving module, used to receive first data sent by a terminal device based on a data channel; a determining module, used to determine second data based on the first data, wherein the data channel is used to transmit identity authentication related data of the user to be authenticated, the identity authentication related data of the user to be authenticated includes first data, the first data is used to indicate identity source data of the user to be authenticated, and the second data is used to indicate identity identification data of the user to be authenticated.

[0031] According to another aspect of the present disclosure, a user authentication device is provided, the device comprising: a receiving module, used to receive a fifth message sent by a third network element, wherein the fifth message is used to request identity authentication of a user to be authenticated, and the fifth message includes second data; a determining module, used to determine third data based on the second data and pre-configured data, wherein the third data is used to indicate an identity identifier of the user to be authenticated, and the second data is used to indicate identity identification data of the user to be authenticated.

[0032] According to another aspect of the present disclosure, a user authentication device is provided, the device including: a receiving module, used to receive a seventh message sent by a fifth network element, wherein the seventh message includes third data; a control module, used to control the service triggering of a call request of the user to be authenticated based on the third data, wherein the third data is used to indicate an identity identifier of the user to be authenticated.

[0033] According to another aspect of the present disclosure, a user authentication device is provided, the device including: a receiving module, used to receive an eighth message sent by a fifth network element, wherein the eighth message includes third data; a control module, used to control a service request of a user to be authenticated based on the third data, wherein the third data is used to indicate an identity identifier of the user to be authenticated.

[0034] According to another aspect of the present disclosure, an electronic device is provided, including: a memory for storing computer-readable instructions; and a processor for executing the computer-readable instructions so that the electronic device performs the user authentication method as described above.

[0035] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the user authentication method as described above is implemented.

[0036] As will be described in detail below, according to the user authentication method of the embodiment of the present disclosure, the present disclosure utilizes the IMS data channel DC to transmit the identity authentication related data of the natural person user based on the IP multimedia system data channel IMS registration process of the user card, thereby realizing IMS authentication and service authorization of the natural person user identity, and further realizing the network's service control and management of the natural person user.

[0037] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0039] Figure 1 FIG. 1 is a schematic diagram of an IMS architecture supporting an IP multimedia system data channel (IMS data channel) in the prior art.

[0040] Figure 2 is a method flow chart illustrating a user authentication method according to an embodiment of the present disclosure.

[0041] Figure 3 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure.

[0042] Figure 4 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure.

[0043] Figure 5 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure.

[0044] Figure 6is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure.

[0045] Figure 7 It is an overall flow chart illustrating a user authentication method according to an embodiment of the present disclosure.

[0046] Figure 8 2 is a schematic diagram illustrating a user authentication device according to an embodiment of the present disclosure.

[0047] Fig. 9 is a device schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure.

[0048] Fig.10 is a device schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure.

[0049] Fig.11 is a device schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure.

[0050] Fig.12 is a device schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure.

[0051] Fig.13 is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0052] Fig.14 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0054] First, refer to Figure 1 The application scenarios according to the embodiments of the present disclosure are summarized.

[0055] Figure 1 The diagram is a schematic diagram of the IMS architecture supporting the IP multimedia system data channel (IMS data channel, IMSDC) in the prior art. In order to adapt to the ever-changing multimedia service needs, a flexible, reliable and closely integrated data transmission solution with audio and video channels is provided. 3GPP R16 introduces a new data channel IMS data channel technology independent of the original signaling, audio and video data channels in the multimedia phone calls established by users to support a variety of data types and protocols, while ensuring the real-time and reliability of data transmission.

[0056] Specifically, the new data channel IMSDC has the following characteristics:

[0057] 1. IMSDC shares the same path with audio and video. IMSDC is superimposed on audio and video capabilities, so the establishment process of the data channel is integrated with the IMS session establishment process to ensure that the channel is established at the same time as the audio / video channel and can be used immediately during real-time communication.

[0058] 2.IMSDC needs to support User Datagram Protocol (UDP) and / or Transmission Control Protocol (TCP) transmission to meet the subsequent high real-time and high reliability requirements of intrinsic content. Among them, UDP is suitable for applications that require fast transmission but may not guarantee the order of data packets, while TCP is suitable for applications that require reliable transmission and guaranteed data packet order. This flexibility can meet the real-time and reliability requirements of different business scenarios.

[0059] 3. IMSDC can carry a variety of protocols and content internally, and can be based on different protocols (for example, Hypertext Transfer Protocol (HTTP)), transmit rich content such as text, menus, files, etc., and provide different Quality of Service (QoS) guarantees for different types of data channels.

[0060] Furthermore, the IMS data channel may include a bootstrap data channel (BDC) and an application data channel (ADC).

[0061] Among them, BDC: a channel used to establish a connection and perform identity authentication between the terminal equipment (User Equipment, UE) and the network. The UE obtains the application that will be used in real-time communication through BDC, where the application can include web page rendering content (such as H5 pages, etc.) and application control logic (such as Javascript scripts).

[0062] ADC: UE can transmit application data through ADC. The application control logic (e.g. Javascript script) in BDC controls the dynamic application data transmission and reception in ADC. ADC transmission can be transmitted between UEs or between UEs and the network. The network provides users with rich real-time interactive experience enhancement content based on the Web interface. ADC is divided into P2P, P2A, P2A2P and other types.

[0063] like Figure 1 As shown in the figure, to support the actual deployment of IMS data channel, 3GPP defines the IMS architecture supporting IMS Data Channel. Specifically, the DC Signaling Function (DCSF), Media Function (MF), DC Application Server (DCAS) and DC Application Repository (DCAR) are introduced, and the IP Multimedia System Application Server (IMSAS), Media Resource Function (MRF) and Terminal (UE) are enhanced.

[0064] Among them, DCAS: interacts with DCSF through DC3 and DC4 to control DC resources, and interacts with DCSF through MDC3 to forward service flows;

[0065] DCAR: stores applications used in IMSDC;

[0066] DCSF: provides DC control logic and manages IMSDC;

[0067] MF / MRF: Provides the ability to reserve, update, and release DC media resources. MF is a service-oriented media function; MRF is the media function of the existing SIP interface of IMS.

[0068] IMS AS: The top application layer device in the IMS system, providing basic services and supplementary services, multimedia conferencing, converged communications, SMS gateway, standard attendant console, etc. Enhanced support for interfaces with DCSF and MRF / MF, and whether to interact with DCSF and MF / MRF is determined based on DC contract.

[0069] UE: Enhanced support for DC capabilities (DC capabilities may include: negotiation, establishment, release, application, etc.).

[0070] Additionally, it may include:

[0071] Home Subscriber Server (HSS): used to store user identity information, authentication information and device information, and is the central storage point for user information in IMS.

[0072] Serving-Call Session Control Function (S-CSCF): It is the main session controller in IMS and is responsible for handling session establishment, maintenance, and termination.

[0073] Proxy-Call Session Control Function (P-CSCF): It can act as an intermediary between the UE and the IMS core network, process signaling messages and provide security functions.

[0074] Figure 2 is a method flow chart illustrating a user authentication method according to an embodiment of the present disclosure. Figure 2 As shown, the user authentication method applied to the UE side may include at least the following steps.

[0075] In step S201, a first message sent by a first network element is received, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform user authentication. As described above, the present disclosure aims to solve the problem that the current network authentication and authorization and the allocation and use of network resources are mainly based on user cards rather than on natural persons. Therefore, the present disclosure adds authentication and authorization methods for natural person users (i.e., users to be authenticated) to the existing user card dimension to realize the network's service control and management of natural person users.

[0076] Specifically, the first network element may be an S-CSCF. As described above, the S-CSCF is responsible for session control. This step can be understood as the S-CSCF generating a registration success response message (200OK) after processing the UE's registration request, and then sending this message (i.e., the first message) back to the UE. The first message includes a user authentication indication, which is used to indicate that the UE can perform user authentication. For details, see Figure 7 Step S3 in is further described in detail.

[0077] In step S202, a second message is sent to the second network element, wherein the second message includes: an identifier for indicating the establishment of a data channel, and the data channel is used to transmit the identity authentication related data of the user to be authenticated. As described above, after receiving the user authentication indication in step S201, the UE will send a request (i.e., a second message) to establish an IMSDC to the second network element (e.g., IMS AS), and the IMSDC is used to transmit the identity authentication related data of the user to be authenticated.

[0078] The identity authentication related data of the user to be authenticated includes at least one of the following: first data, the first data is used to indicate the identity source data of the user to be authenticated; third data, the third data is used to indicate the identity identifier of the user to be authenticated. Figure 7 Step S5 in is further described in detail.

[0079] Figure 3 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure. Figure 3 As shown, the user authentication method applied to the third network element may include at least the following steps. Specifically, the third network element may be the above-mentioned DCSF.

[0080] In step S301, first data sent by a terminal device based on a data channel is received. As described above, Figure 2 The UE has initiated a request to establish an IMSDC. In this step, after the IMSDC is successfully established, the third network element (eg, DCSF) receives the first data sent by the UE through the IMSDC. As described above, the first data is used to indicate the identity source data of the user to be authenticated.

[0081] In one embodiment of the present disclosure, the first data may be biometric source data (e.g., fingerprint source data, facial source data, iris source data, etc.) of a user who is currently using or intending to use the UE, which is identified by the UE or card through its own sensor or camera or other device. Figure 7 Steps S10-S11 in are further described in detail.

[0082] In step S302, the second data is determined based on the first data. The data channel is used to transmit the identity authentication related data of the user to be authenticated, and the identity authentication related data of the user to be authenticated includes the first data, the first data is used to indicate the identity source data of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated. As mentioned above, the first data has been obtained in step S301. This step is intended to process the first data to generate the second data, wherein the second data is used to indicate the identity identification data of the user to be authenticated, so as to subsequently compare the second data with the pre-configured data stored in the HSS or UDM, and then determine the third data. For details, please refer to Figure 7 Step S12 in is further described in detail.

[0083] Figure 4 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure. Figure 4As shown, the user authentication method applied to the fifth network element may include at least the following steps. Specifically, the fifth network element may be the above-mentioned HSS, or may be a unified data management function (UDM), which may be used to centrally manage user identity, subscription information, and device information.

[0084] In step S401, a fifth message sent by a third network element is received, wherein the fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes second data. As described above, the third network element may be a DCSF, and the second data has been determined in step S302. This step is that the HSS or UDM receives an authentication request (i.e., the fifth message) sent by the DCSF including the second data. For details, see Figure 7 Step S13 in is further described in detail.

[0085] In step S402, based on the second data and the pre-configured data, the third data is determined, wherein the third data is used to indicate the identity of the user to be authenticated, and the second data is used to indicate the identity data of the user to be authenticated. As described above, the HSS or UDM stores the pre-configured data, which includes a large amount of identity data of natural person users, as well as the correspondence between the identity data of natural person users and the identity of natural person users. This step aims to compare the acquired second data with the pre-configured data to authenticate the user to be authenticated and determine its identity data (i.e., the third data). For details, please refer to Figure 7 Step S14 in is further described in detail.

[0086] Figure 5 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure. Figure 5 As shown, the user authentication method applied to the first network element may include at least the following steps. Specifically, the first network element may be the above-mentioned S-CSCF.

[0087] In step S501, a seventh message sent by a fifth network element is received, wherein the seventh message includes third data. As described above, the third data has been determined in step S402, and this step is intended to notify the S-CSCF of the identity of the user to be authenticated through the seventh message, so that the S-CSCF can subsequently execute step S502. Figure 7 Step S18 in is further described in detail.

[0088] In step S502, based on the third data, the service triggering of the call request of the user to be authenticated is controlled, wherein the third data is used to indicate the identity of the user to be authenticated. That is, the S-CSCF can implement service control management for the natural person user according to the user's identity. Figure 7 Step S20 in is further described in detail.

[0089] Figure 6 is a method flow chart further illustrating a user authentication method according to an embodiment of the present disclosure. Figure 6 As shown, the user authentication method applied to the second network element may include at least the following steps: Specifically, the first network element may be the above-mentioned IMSAS.

[0090] In step S601, an eighth message sent by the fifth network element is received, wherein the eighth message includes the third data. Similarly, the identity of the user to be authenticated determined in step S402 is notified to the IMS AS through the eighth message, so that the IMS AS can subsequently perform step S602. Figure 7 Step S19 in is further described in detail.

[0091] In step S602, based on the third data, the service request of the user to be authenticated is controlled, wherein the third data is used to indicate the identity of the user to be authenticated. That is, the IMS AS can implement service control management for the natural person user according to the user's identity. Figure 7 Step S21 in is further described in detail.

[0092] Figure 7 FIG. 1 is an overall flow chart illustrating a user authentication method according to an embodiment of the present disclosure. Figure 7 As shown, the user authentication method of the embodiment of the present disclosure may include the following execution entities: terminal equipment (UE), P-CSCF, fourth network element (PCF), first network element (S-CSCF), fifth network element (HSS / UDM), second network element (IMS AS), third network element (DCSF), MF, and the overall process of the user authentication method of the embodiment of the present disclosure may include at least the following steps.

[0093] The present disclosure uses the IMSDC data channel to transmit the identity authentication related data of the natural person user on the basis of the IMS registration process of the user card, so as to realize the IMS authentication and service authorization of the natural person user identity.

[0094] In step S0, HSS / UDM preconfigures data. As mentioned above, HSS / UDM can be used to store user identity information, device information and other information. After the user signs the contract, the operator preconfigures the binding relationship between the natural user's identity and the IP Multimedia Private Identity (IMPI) or IP Multimedia Public Identity (IMPU) in the HSS, as well as the identity identification data corresponding to the natural user's identity.

[0095] Among them, IMPI and IMPU are two types of user identifiers in the IMS system. IMPI is mainly used for registration, authentication, certification and billing of users accessing the IMS network; IMPU is mainly used for routing Session Initiation Protocol (SIP) messages. It is an identifier published by the user to the outside world and is used to communicate with other users.

[0096] Specifically, the identity of a natural person user can be associated with multiple IMPIs, indicating that a natural person user can use multiple terminals or multiple cards to access the network; an IMPI can also be associated with multiple natural person users' identities, indicating that multiple natural person users can access the network through the same card or the same device. The operator can allocate a corresponding IMPU to the identity of the natural person user, and further associate the identity of the natural person user with the IMPU under the IMPI.

[0097] The identity recognition data corresponding to the identity identifier of the natural person user may be obtained by the operator collecting the identity source data of the natural person user (for example, fingerprint feature source data, facial feature source data, iris feature source data, etc.), calculating the identity recognition data of the natural person user, and binding the identity recognition data to the identity identifier of the natural person user.

[0098] It should be noted that the above-mentioned IMPI / IMPU, the binding relationship between the natural person user's identity and IMPI or IMPU, the natural person user's identity identification data, and the correspondence between the natural person user's identity identification data and the natural person user's identity can all be stored in the HSS.

[0099] In step S1, the UE sends a third message to the S-CSCF, wherein the third message is used to request registration and includes a user authentication request. This step can be understood as the UE initiating an IMS registration process.

[0100] Specifically, the UE can send a third message for requesting registration to the S-CSCF via the P-CSCF. When the UE supports an authentication mechanism based on natural users (for example, the UE has devices such as cameras and sensors), the user authentication request is carried in the third message.

[0101] In step S2, the UE performs access authentication. Specifically, the IMS authentication process based on the user card may include the following steps: the UE initiates an IMS registration or session request; the request is sent to the P-CSCF and then forwarded to the I-CSCF; the I-CSCF routes the request to the S-CSCF; the S-CSCF requests the HSS to perform user authentication. The HSS verifies the user information and generates an authentication token; the IP Multimedia Service Identity Module (ISIM) in the UE uses this token to complete the authentication process.

[0102] In step S3, the S-CSCF sends a first message to the UE, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct the UE to perform user authentication. As described above, after processing the registration request of the UE, the S-CSCF generates a registration success response message (200OK, i.e., the first message).

[0103] Specifically, the S-CSCF may send a registration success response message to the UE via the P-CSCF, and carry a user authentication indication in the message to require the UE to perform user identity authentication.

[0104] In step S4, the UE decides to initiate identity authentication based on the user authentication indication.

[0105] In step S5, the UE sends a second message to the IMSDC, wherein the second message includes: an identifier for indicating the establishment of a data channel, and the data channel is used to transmit the identity authentication related data of the user to be authenticated. As mentioned above, in step S4, the UE has decided to initiate identity authentication, and this step can be understood as the UE initiating an INVITE session request for establishing the IMSDC.

[0106] Specifically, the UE may send a second message for establishing an IMS DC to the IMS AS via the P-CSCF and the S-CSCF. The type of the IMSDC is an identity authentication DC, indicating that the IMSDC established by the network this time is for identity authentication of the user to be authenticated.

[0107] In step S6, the IMS AS sends a ninth message to the DCSF, wherein the ninth message includes: the identifier for indicating the establishment of the data channel. As described above, the IMS AS notifies the DCSF to establish an IMSDC for authenticating the identity of the user to be authenticated.

[0108] In step S7, according to the existing process, a data channel for transmitting identity authentication related data of the user to be authenticated is established between the UE and the DCSF.

[0109] In steps S8-S9, the UE obtains first data, wherein the first data is used to indicate the identity source data of the user to be authenticated. As described above, the UE or card uses its own sensors or cameras to identify the biometric source data of the user who is currently using or intending to use the UE.

[0110] In steps S10-S11, the UE sends the acquired first data to the DCSF via the established IMSDC. Specifically, the UE may send the first data to the DCSF via the MF.

[0111] In step S12, the DCSF determines the second data based on the first data, wherein the second data is used to indicate the identity data of the user to be authenticated, that is, the DCSF processes the first data to generate the second data.

[0112] In step S13, the DCSF sends a fifth message to the HSS, wherein the fifth message includes the second data, that is, the DCSF sends the identity data of the user to be authenticated to the HSS for authentication.

[0113] In step S14, the HSS determines the third data based on the second data. The second data is used to indicate the identity of the user to be authenticated. As described above, the HSS determines the identity of the user to be authenticated by comparing the second data with the pre-configured data stored in the HSS.

[0114] In step S15, the HSS sends a sixth message to the DCSF, wherein the sixth message includes the authentication result and the third data. That is, if the above authentication is successful, the HSS returns the authentication result and the corresponding user identity to the DCSF.

[0115] In steps S16-S17, the DCSF sends the authentication result and the third data to the UE via the IMSDC. Specifically, the DCSF may send the third data to the UE via the MF.

[0116] In step S18, the HSS sends a seventh message to the S-CSCF, wherein the seventh message includes the third data, that is, the HSS sends the authenticated user identity to the S-CSCF.

[0117] In step S19, the HSS sends an eighth message to the IMS AS, wherein the eighth message includes the third data. Similarly, the HSS sends the authenticated user identity to the IMS AS.

[0118] In step S20, the S-CSCF subsequently controls the service triggering according to the user identity, for example, routing the call request to an IMS service platform that allows triggering.

[0119] In step S21, the IMS AS subsequently controls service provision according to the user identity.

[0120] In step S22, the UE sends a fourth message to the PCF, wherein the fourth message is used to establish a call request and the fourth message includes the third data, that is, the UE carries the user identity that has passed the network authentication in the call request message.

[0121] Figure 8 2 is a schematic diagram of a user authentication device according to an embodiment of the present disclosure. Figure 8 As shown, the user authentication device 800 may include at least the following modules.

[0122] The receiving module 801 is configured to receive a first message sent by a first network element, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct a terminal device to perform user authentication;

[0123] The sending module 802 is used to send a second message to the second network element, wherein the second message includes: an identifier for indicating the establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

[0124] The identity authentication related data of the user to be authenticated includes at least one of the following: first data, the first data is used to indicate the identity source data of the user to be authenticated; and third data, the third data is used to indicate the identity identifier of the user to be authenticated.

[0125] In addition, the user authentication device 800 may further include:

[0126] The sending module 803 is used to send a third message to the first network element, wherein the third message is used to request registration and includes a user authentication request.

[0127] The acquisition module 804 is used to acquire first data.

[0128] The transmission module 805 is used to send the first data to the third network element based on the data channel.

[0129] The receiving module 806 is configured to receive third data sent by a third network element based on a data channel, wherein the third data is determined based on the first data.

[0130] The sending module 807 is configured to send a fourth message to a fourth network element, wherein the fourth message is used to establish a call request and includes third data.

[0131] In the above, the data channel includes: IP multimedia system data channel IMSDC.

[0132] Fig. 9 is a schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure. Fig. 9 As shown, the user authentication device 900 may include at least the following modules.

[0133] A receiving module 901 is used to receive first data sent by a terminal device based on a data channel;

[0134] Determination module 902 is used to determine second data based on first data, wherein the data channel is used to transmit identity authentication related data of the user to be authenticated, the identity authentication related data of the user to be authenticated includes first data, the first data is used to indicate the identity source data of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

[0135] In addition, the user authentication device 900 may further include:

[0136] The sending module 903 is used to send a fifth message to the fifth network element, wherein the fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes the second data.

[0137] The receiving module 904 is used to receive a sixth message sent by the fifth network element, wherein the sixth message includes third data, the third data is identity authentication related data of the user to be authenticated, and is used to indicate the identity identifier of the user to be authenticated, and the third data is determined based on the second data.

[0138] The transmission module 905 is used to send third data to the terminal device based on the data channel.

[0139] In the above, the data channel includes: IP multimedia system data channel IMSDC.

[0140] Fig.10 is a schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure. Fig.10 As shown, the user authentication device 1000 may include at least the following modules.

[0141] The receiving module 1001 is configured to receive a fifth message sent by a third network element, wherein the fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes second data;

[0142] The determination module 1002 is used to determine third data based on the second data and the preconfigured data, wherein the third data is used to indicate the identity identifier of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

[0143] The pre-configured data includes: an association relationship between the second data, the third data and the IMS identifier of the user.

[0144] Fig.11 is a schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure. Fig.11 As shown, the user authentication device 1100 may include at least the following modules.

[0145] The receiving module 1101 is configured to receive a seventh message sent by a fifth network element, wherein the seventh message includes third data;

[0146] The control module 1102 is used to control the service triggering of the call request of the user to be authenticated based on the third data, wherein the third data is used to indicate the identity of the user to be authenticated.

[0147] The controlling of the service triggering of the call request of the user to be authenticated includes: routing the call request to an IMS service platform that allows triggering.

[0148] In addition, the user authentication device 1100 may further include:

[0149] The receiving module 1103 is used to receive a third message sent by the terminal device, wherein the third message is used to request registration and includes a user authentication request.

[0150] The sending module 1104 is used to send a first message to the terminal device, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform user authentication.

[0151] Fig.12 is a schematic diagram further illustrating a user authentication device according to an embodiment of the present disclosure. Fig.12 As shown, the user authentication device 1200 may include at least the following modules.

[0152] The receiving module 1201 is configured to receive an eighth message sent by the fifth network element, wherein the eighth message includes third data;

[0153] The control module 1202 is used to control the service request of the user to be authenticated based on the third data, wherein the third data is used to indicate the identity of the user to be authenticated.

[0154] In addition, the user authentication device 1200 may further include:

[0155] The receiving module 1203 is used to receive a second message sent by the terminal device, wherein the second message includes: an identifier for indicating the establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

[0156] The sending module 1204 is used to send a ninth message to the third network element, wherein the ninth message includes: an identifier used to indicate establishment of a data channel.

[0157] In the above, the data channel includes: IP multimedia system data channel IMSDC.

[0158] Fig.13 1 is a hardware block diagram of an electronic device according to an embodiment of the present disclosure. The electronic device according to an embodiment of the present disclosure includes at least a processor; and a memory for storing computer-readable instructions. When the computer-readable instructions are loaded and executed by the processor, the processor executes the user authentication method as described above.

[0159] Fig.13 The electronic device 1300 shown specifically includes: a central processing unit (CPU) 1301, a graphics processing unit (GPU) 1302 and a memory 1303. These units are connected to each other via a bus 1304. The central processing unit (CPU) 1301 and / or the graphics processing unit (GPU) 1302 can be used as the above-mentioned processor, and the memory 1303 can be used as the above-mentioned memory for storing computer-readable instructions. In addition, the electronic device 1300 may also include a communication unit 1305, a storage unit 1306, an output unit 1307, an input unit 1308 and an external device 1309, which are also connected to the bus 1304.

[0160] Fig.14 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Fig.14 As shown, a computer program product 1400 according to an embodiment of the present disclosure has a computer program 1401 stored thereon. When the computer program 1401 is executed by a processor, the user authentication method described with reference to the above figures is executed. The computer program product includes, but is not limited to, for example, a volatile memory and / or a non-volatile memory. The volatile memory may, for example, include a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, an optical disk, a magnetic disk, etc.

[0161] The user authentication method, device, electronic device and computer program product according to the embodiments of the present disclosure are described above with reference to the accompanying drawings. According to the user authentication method of the embodiments of the present disclosure, the present disclosure uses the IMS data channel DC to transmit the identity authentication related data of the natural person user on the basis of the IP multimedia system data channel IMS registration process of the user card, thereby realizing IMS authentication and service authorization of the natural person user identity, and further realizing the network's service control and management of the natural person user.

[0162] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0163] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0164] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0165] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0166] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0167] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0168] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0169] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A user authentication method, characterized in that: Applied to a terminal device, the method comprises: Receiving a first message sent by a first network element, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform the user authentication; A second message is sent to the second network element, wherein the second message includes: an identifier for indicating establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

2. The user authentication method according to claim 1, characterized in that: The identity authentication related data of the user to be authenticated includes at least one of the following: First data, the first data is used to indicate the identity source data of the user to be authenticated; The third data is used to indicate the identity of the user to be authenticated.

3. The user authentication method according to claim 1, characterized in that: The method further comprises: sending a third message to the first network element, The third message is used to request registration, and the third message includes a user authentication request.

4. The user authentication method according to claim 2, characterized in that: The method further comprises: acquiring the first data; Based on the data channel, the first data is sent to a third network element.

5. The user authentication method according to claim 4, characterized in that: The method further comprises: Receive third data sent by the third network element based on the data channel, wherein the third data is determined based on the first data.

6. The user authentication method according to claim 5, characterized in that: The method further comprises: sending a fourth message to a fourth network element, The fourth message is used to establish a call request, and the fourth message includes the third data.

7. The user authentication method according to any one of claims 1 to 6, characterized in that: The data channel includes: IP Multimedia System Data Channel IMSDC.

8. A user authentication method, characterized in that: Applied to a third network element, the method includes: Receiving first data sent by a terminal device based on a data channel; determining second data based on the first data, Among them, the data channel is used to transmit identity authentication related data of the user to be authenticated, and the identity authentication related data of the user to be authenticated includes the first data, the first data is used to indicate the identity source data of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

9. The user authentication method according to claim 8, characterized in that: The method further comprises: sending a fifth message to a fifth network element, The fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes the second data.

10. The user authentication method according to claim 9, characterized in that: The method further comprises: receiving a sixth message sent by the fifth network element, The sixth message includes third data, the third data is identity authentication related data of the user to be authenticated, and is used to indicate the identity identifier of the user to be authenticated, and the third data is determined based on the second data.

11. The user authentication method according to claim 10, characterized in that: The method further comprises: Based on the data channel, the third data is sent to the terminal device.

12. The user authentication method according to any one of claims 8 to 11, characterized in that: The data channel includes: IP Multimedia System Data Channel IMSDC.

13. A user authentication method, characterized in that: Applied to a fifth network element, the method includes: receiving a fifth message sent by the third network element, wherein the fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes the second data; determining third data based on the second data and preconfigured data, The third data is used to indicate the identity identifier of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

14. The user authentication method according to claim 13, characterized in that: The pre-configuration data includes: The association relationship between the second data, the third data and the IMS identifier of the user.

15. A user authentication method, characterized in that: Applied to a first network element, the method includes: receiving a seventh message sent by the fifth network element, wherein the seventh message includes third data; Based on the third data, the service triggering of the call request of the user to be authenticated is controlled, The third data is used to indicate the identity of the user to be authenticated.

16. The user authentication method according to claim 15, characterized in that: The controlling of the service triggering of the call request of the user to be authenticated includes: The call request is routed to the IMS service platform that allows triggering.

17. The user authentication method according to claim 15, characterized in that: The method further comprises: receiving a third message sent by the terminal device, The third message is used to request registration, and the third message includes a user authentication request.

18. The user authentication method according to claim 17, characterized in that: The method further comprises: sending a first message to the terminal device, The first message includes a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform the user authentication.

19. A user authentication method, characterized in that: Applied to a second network element, the method comprises: receiving an eighth message sent by the fifth network element, wherein the eighth message includes third data; Based on the third data, the service request of the user to be authenticated is controlled, The third data is used to indicate the identity of the user to be authenticated.

20. The user authentication method according to claim 19, characterized in that: The method further comprises: receiving a second message sent by the terminal device, The second message includes: an identifier for indicating the establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

21. The user authentication method according to claim 20, characterized in that: The method further comprises: Sending a ninth message to the third network element, The ninth message includes: the identifier used to indicate establishment of the data channel.

22. The user authentication method according to claim 20 or 21, characterized in that: The data channel includes: IP Multimedia System Data Channel IMSDC.

23. A user authentication device, characterized in that: The device comprises: A receiving module is used to receive a first message sent by a first network element, wherein the first message includes a user authentication indication, and the user authentication indication is used to instruct the terminal device to perform the user authentication; a sending module is used to send a second message to a second network element, wherein the second message includes: an identifier for indicating the establishment of a data channel, and the data channel is used to transmit identity authentication related data of the user to be authenticated.

24. A user authentication device, characterized in that: The device comprises: A receiving module, used for receiving first data sent by a terminal device based on a data channel; a determination module, configured to determine second data based on the first data, Among them, the data channel is used to transmit identity authentication related data of the user to be authenticated, and the identity authentication related data of the user to be authenticated includes the first data, the first data is used to indicate the identity source data of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

25. A user authentication device, characterized in that: The device comprises: A receiving module, configured to receive a fifth message sent by a third network element, wherein the fifth message is used to request identity authentication of the user to be authenticated, and the fifth message includes second data; a determination module, configured to determine third data based on the second data and preconfigured data, The third data is used to indicate the identity identifier of the user to be authenticated, and the second data is used to indicate the identity identification data of the user to be authenticated.

26. A user authentication device, characterized in that: The device comprises: A receiving module, configured to receive a seventh message sent by the fifth network element, wherein the seventh message includes third data; a control module, configured to control the service triggering of the call request of the user to be authenticated based on the third data, The third data is used to indicate the identity of the user to be authenticated.

27. A user authentication device, characterized in that: The device comprises: A receiving module, configured to receive an eighth message sent by the fifth network element, wherein the eighth message includes third data; a control module, configured to control the service request of the user to be authenticated based on the third data, The third data is used to indicate the identity of the user to be authenticated.

28. An electronic device, characterized in that: include: a memory for storing computer readable instructions; as well as A processor is used to run the computer-readable instructions so that the electronic device performs the user authentication method as described in any one of claims 1 to 22.

29. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the user authentication method according to any one of claims 1 to 22 is implemented.

Images