Communication method and device and computer readable storage medium

Abstract

The embodiment of the invention provides a communication method and device and a computer readable storage medium, relates to the technical field of communication, and can realize decentralized authentication without depending on a UDM network element. The method comprises the following steps: receiving an authentication indication of a second node; the authentication instruction is used for instructing the first node to perform network authentication; sending a first authentication request to a second node; the first authentication request is used for requesting to verify the identity legality of the first node; receiving a second authentication request of a second node; the second authentication request is used for requesting to verify the identity legality of the second node; and after the second authentication request passes verification, communicating with the second node. The method and the device can be used in a wireless communication process.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method, device and computer-readable storage medium. Background Art

[0002] In communication technology, authentication is required before a terminal accesses a network. Currently, authentication is performed by encrypting the transmitted information by jointly storing a peer key between the terminal and the network side, and the communicating parties verify the encrypted information through the peer key to perform authentication.

[0003] Due to the importance of peer keys, the peer keys need to be stored in the unified data management (UDM) network element to ensure security. In actual scenarios, the UDM network element includes the peer keys of many terminal devices, and each terminal device relies on the UDM for authentication. This centralized authentication method may lead to the risk of paralysis of the entire network once the UDM network element fails. Summary of the invention

[0004] The embodiments of the present application provide a communication method, an apparatus, and a computer-readable storage medium, which can realize decentralized authentication without relying on UDM network elements.

[0005] In one aspect, a communication method is provided, which is applied to a first node and includes:

[0006] receiving an authentication instruction from the second node; the authentication instruction is used to instruct the first node to perform network authentication;

[0007] Sending a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0008] Receiving a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node;

[0009] After the second authentication request is verified, communicate with the second node.

[0010] On the other hand, a communication method is provided, which is applied to a second node, comprising:

[0011] Sending an authentication instruction; the authentication instruction is used to instruct the first node to perform network authentication;

[0012] Receiving a first authentication request from a first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0013] After the first authentication request is verified, a second authentication request is sent to the first node; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0014] On the other hand, a communication device is provided, including: a receiving module, a sending module and a communication module.

[0015] The receiving module is used to receive an authentication instruction from the second node; the authentication instruction is used to instruct the first node to perform network authentication;

[0016] The sending module is used to send a first authentication request to the second node; the first authentication request is used to request to verify the legitimacy of the identity of the first node;

[0017] The receiving module is further used to receive a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node;

[0018] The communication module is used to communicate with the second node after the second authentication request is verified.

[0019] On the other hand, a communication device is provided, including: a sending module and a receiving module.

[0020] The sending module is used to send an authentication instruction; the authentication instruction is used to instruct the first node to perform network authentication;

[0021] The receiving module is used to receive a first authentication request from a first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node;

[0022] The sending module is used to send a second authentication request to the first node after the first authentication request is verified; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0023] In yet another aspect, a communication system is provided, including: a first node and a second node.

[0024] The second node sends an authentication indication, which is used to instruct the first node to perform network authentication; the first node sends a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node; after the first authentication request is verified, the second node sends a second authentication request to the first node; the second authentication request is used to request verification of the legitimacy of the identity of the second node; after the second authentication request is verified, the first node communicates with the second node.

[0025] On the other hand, a communication device is provided, comprising: a memory and a processor; the memory and the processor are coupled; the memory is used to store a computer program; and the processor implements the communication method described in any of the above embodiments when executing the computer program.

[0026] On the other hand, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the communication method described in any of the above embodiments is implemented.

[0027] On the other hand, a computer program product is provided, which includes computer program instructions, and when the computer program instructions are executed by a processor, the communication method described in any of the above embodiments is implemented.

[0028] The communication method provided by the embodiment of the present application, in which the first node can send an authentication request after receiving the authentication instruction of the second node so that the second node verifies the legitimacy of the first node, and obtains the authentication request sent by the second node to verify the legitimacy of the second node. Communicate with the second node after the verification is passed. The communication method provided by the present application adopts a two-way authentication method, so that the authentication can be independent of the UDM network element, so that any node in the network can realize the authentication of the terminal, avoiding the risk of a single point failure causing the entire network to be paralyzed, and effectively improving the stability of the communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solution in the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only drawings of some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0030] Figure 1 A schematic diagram of the structure of a communication system provided in some embodiments of the present application;

[0031] Figure 2 A flow chart of a communication method provided in some embodiments of the present application;

[0032] Figure 3 A flowchart of another communication method provided for some embodiments of the present application;

[0033] Figure 4 A flowchart of another communication method provided in some embodiments of the present application;

[0034] Figure 5 An interactive schematic diagram of a communication method provided in some embodiments of the present application;

[0035] Figure 6 An interactive schematic diagram of another communication method provided in some embodiments of the present application;

[0036] Figure 7 An interactive schematic diagram of another communication method provided in some embodiments of the present application;

[0037] Figure 8 A schematic diagram of the structure of a communication device provided in some embodiments of the present application;

[0038] Fig. 9 A schematic diagram of another communication device provided in some embodiments of the present application;

[0039] Fig.10 A schematic diagram of the composition of yet another communication device provided in some embodiments of the present application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in this application to clearly and completely describe the technical solutions in this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0042] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0043] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "multiple" means two or more.

[0044] The user-side terminal needs to be authenticated when it initially accesses the network to obtain access rights. The existing fifth-generation mobile communication system's identity and key agreement (5G AKA) authentication includes traditional peer-to-peer key verification, that is, the user-side terminal and the network side jointly hold peer keys, encrypt some certain and random information, and then the user-side terminal and the network side respectively verify whether the encrypted content of the other party is encrypted with the peer key, so as to prove the identity of both parties. For the network side, it is necessary to centrally save the peer keys of all user terminals to perform authentication when the terminal accesses.

[0045] The following is a brief description of the 5G AKA authentication process. When the terminal initiates registration with the network to start the authentication process, the UDM network element generates a 5G home environment authentication vector (5G HE AV) and provides it to the authentication service function (AUSF) network element. 5GHE AV contains XRES*, AUTN, RAND and Kausf. Kausf is derived from two keys (CK and IK, derived from the root key) and SQN. The AUSF network element exports XRES* and Kausf into HXRES* and Kseaf, the latter of which will be used as the key for the next step. The AUSF network element passes AUTN, RAND and HXRES* to form a 5GSE AV and passes it to the security anchor function (SEAF) network element. The SEAF network element sends AUTN and RAND to the terminal. The terminal calculates MAC using the common keys CK, IK and SQN and compares it with the MAC* contained in AUTH to authenticate the network. If it passes, the RES* corresponding to XRES* is calculated in the same way and sent to the SEAF network element. The SEAF network element processes RES* to obtain HRES* and compares it with HXRES* to authenticate the terminal. If it passes, RES* is sent to the AUSF network element and compared with XRES* for secondary authentication. If it passes, the authentication process ends.

[0046] From the above description of the 5G AKA authentication process, it can be seen that the authentication of all terminals needs to be carried out with the help of the root key stored in the UDM network element. Because of the importance of the root key in network security, it can only be stored in the UDM network element. Since the UDM network element often needs to serve millions of users, when users access at a high frequency, the load of the UDM network element will be very large, which can easily cause the communication channel to be blocked and the delay to soar. According to the existing 5G AKA process, when the authentication process delay is too long, the entire process needs to be re-initiated, which will further increase the congestion of the UDM network element. This centralized authentication method may have the risk of failure of the UDM network element, causing the entire network to be paralyzed.

[0047] In summary, there is an urgent need for a decentralized authentication method.

[0048] Based on this, an embodiment of the present application provides a communication method, in which the first node can send an authentication request after receiving the authentication instruction of the second node so that the second node verifies the legitimacy of the first node, and obtains the authentication request sent by the second node to verify the legitimacy of the second node. Communicate with the second node after the verification is passed. The communication method provided by the present application adopts a two-way authentication method, so that the authentication can be independent of the UDM network element, so that any node in the network can realize the authentication of the terminal, avoiding the risk of a single point failure causing the entire network to be paralyzed, and effectively improving the stability of the communication system.

[0049] The network architecture of the mobile communication system (including but not limited to 5G and future 6G mobile communication systems) in the embodiment of the present application may include a first node and a second node. In some examples, the first node may be a terminal / user equipment (UE), and the second node may be a network side device (e.g., a core network element, a base station, etc.). In other examples, the first node may be a network side device, and the second node may be a terminal. In yet other examples, in a user-to-user communication scenario, the first node and the second node may both be terminals. The embodiments of the present application are not limited thereto.

[0050] The following description is made by taking the first node as a terminal and the second node as a network side device / terminal as an example.

[0051] Figure 1 This is a schematic diagram of the structure of a communication system provided in an embodiment of the present application. Figure 1 As shown, the communication system includes a network side device and a terminal. The network side device and the terminal can be connected via a wireless network. The wireless network can be supported by a router, a switch, or other devices that facilitate communication between the network side device and the terminal, which is not limited in the embodiments of the present application.

[0052] In some embodiments, the network side device may be a base station or a core network element, such as an authentication server function (AUSF) element. When the network side device is a core network element, the communication system further includes a base station for signal transfer between the terminal and the core network element.

[0053] In some embodiments, a base station is used to provide wireless access services to terminals. Specifically, a base station provides a service coverage area (also called a cell). Terminals entering the area can communicate with the base station through wireless signals to receive wireless access services provided by the base station. In addition, the service coverage area of ​​the base station can also be divided into near field and far field. The terminal may be within the range of the near field or the range of the far field.

[0054] In some embodiments, the base station may be a millimeter wave base station, an evolution nodeB (eNB), a next generation nodeB (gNB), a transmission receive point (TRP), a transmission point (TP), and some other access node. According to the size of the service coverage area provided, the base station can be divided into a macro base station for providing macro cells (Macro cells), a micro base station for providing micro cells (Pico cells), and a femto base station for providing femto cells (Femto cells). With the continuous evolution of wireless communication technology, future base stations may also adopt other names.

[0055] In some embodiments, the terminal may be a device with wireless transceiver functions, such as a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiments of the present invention do not limit the specific types of terminals.

[0056] It should be understood that Figure 1 is an exemplary structural diagram, Figure 1 The communication system shown includes an unlimited number of devices, such as an unlimited number of network devices and an unlimited number of terminals. Figure 1 In addition to the equipment shown, Figure 1The communication system shown may also include other devices, which is not limited thereto.

[0057] Figure 2 The following is a flow chart of a communication method provided in an embodiment of the present application. For example, the communication method provided in the present application can be applied to Figure 1 In the communication system shown in FIG. 1 , it can be specifically applied to the first node, that is, Figure 1 in the terminal.

[0058] like Figure 2 As shown, the communication method provided by the present application may specifically include the following steps:

[0059] S201. A first node receives an authentication instruction from a second node.

[0060] The authentication instruction is used to instruct the first node to perform network authentication.

[0061] S202: The first node sends a first authentication request to the second node.

[0062] The first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0063] For S201 and S202 above, when network access is required, the second node can broadcast an authentication instruction to instruct the terminal to perform network authentication. After receiving the authentication instruction, the first node can send a first authentication request to the second node to request the second node to verify the legitimacy of its own identity.

[0064] In some embodiments, the authentication indication includes first user authentication information (ue-certification), and the first user authentication information is used to verify the legitimacy of the identity of the first node. The above-mentioned first authentication request includes: the digital identity of the first node, the second user authentication information and the first network authentication information, and the second user authentication information (ue-certification-encrypted) is the encrypted first user authentication information; the first network authentication information is used to verify the legitimacy of the second node.

[0065] It is understandable that the above digital identity is a digital code issued by a legitimate certification body and is the identity proof of a device in the network. The digital identity can be a digital certificate or a distributed digital identity (DID). In the case where the digital identity is a digital certificate, the above transmission of the digital identity transmits the entire digital certificate. In the case where the digital identity is a DID, the above transmission of the digital identity can only transmit the minimum information that can identify the user, such as the user number.

[0066] In some embodiments, the digital identity can be transmitted in an encrypted manner to prevent the user from being tracked. The encryption method is not specifically limited in the embodiments of the present application. As an example, the encryption of the digital identity can be achieved by encrypting the user permanent identifier (SUPI) into a user concealed identifier (SUCI).

[0067] In some embodiments, the first user authentication information may be carried in a system information block (SIB) signaling, for example, carried in SIB1.

[0068] In some embodiments, the second user authentication information is the first user authentication information encrypted by the private key (K-private-ue) of the digital identity of the first node.

[0069] In some embodiments, the first user verification information and the first network verification information may be a string of numbers or a string of characters, etc. In addition, the verification information may change after a period of time to prevent the verification information from being intercepted and obtained by other illegal users and used in the authentication process.

[0070] S203: The first node receives a second authentication request from the second node.

[0071] The second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0072] In some embodiments, the first authentication request includes first network authentication information (network-certification), and the first network authentication information is used to verify the legitimacy of the second node. The second authentication request includes: the digital identity of the second node and second network authentication information, and the second network authentication information (network-certification-encrypted) is the encrypted first network authentication information.

[0073] In some embodiments, the second network authentication information is the first network authentication information encrypted by a private key (K-privte-network) of the digital identity of the second node.

[0074] S204: After the second authentication request is verified, the first node communicates with the second node.

[0075] With respect to the above S203 and S204, after sending the first authentication request to the second node, the first node may receive a second authentication request from the second node, and verify the legitimacy of the identity of the second node based on the second authentication request. After the second authentication request is verified, a communication connection is established between the first node and the second node.

[0076] In some embodiments, before the above S204, a verification process for the second authentication request is also performed, and the specific verification process includes the following steps:

[0077] Step a: The first node obtains the public key of the first granting institution to which the digital identity of the second node belongs. Step b: The first node uses the public key of the first granting institution to decrypt the digital identity of the second node and obtains the public key of the digital identity of the second node (K-publick-network). Step c: The first node uses the public key of the digital identity of the second node to decrypt the second network verification information and obtain the third network verification information (network-certification*). Step d: If the third network verification information is consistent with the first network verification information, it is determined that the second authentication request verification is successful.

[0078] In some embodiments, the public key of the first authority may be stored in a storage space of the first node.

[0079] It can be understood that the above verification method can not only verify whether the digital identity is legal (using the public key of the first granting agency to decrypt the digital identity, and successfully obtaining the public key of the digital identity can be considered legal), but also verify whether the digital identity belongs to the second node (by comparing the first network verification information with the decrypted second network verification information), thereby improving the accuracy of verification.

[0080] In some embodiments, the second node may carry the encrypted symmetric key (communication parameter) in the second authentication request to inform the first node of the symmetric key to be used for subsequent communication. Figure 3 As shown, the above S204 can also be specifically implemented as the following S2041-S2042.

[0081] S2041. The first node uses the private key of the digital identity of the first node to decrypt the communication parameters to obtain a symmetric key.

[0082] S2042: The first node communicates with the second node using a symmetric key.

[0083] It should be understood that the use of symmetric keys for encryption and decryption can effectively improve the efficiency of data encryption and decryption and shorten the time of data processing. Therefore, after the authentication request is verified, the use of symmetric keys for communication can effectively improve the communication efficiency. In addition, the use of the public key corresponding to the digital identity of the terminal for encryption can ensure that only the private key corresponding to the digital identity of the terminal can be decrypted, which can ensure the transmission security of the symmetric key.

[0084] In some embodiments, when certain special circumstances cause the base station to fail temporarily and cannot work, the terminal (first node) cannot access the network through the base station for communication. The communication method provided in the embodiment of the present application can also support communication between terminals. That is, when the first node and the second node are both terminals, before the above S201, the first node also performs the following S200.

[0085] S200: The first node broadcasts a communication requirement.

[0086] The communication requirement is used to request communication with the second node.

[0087] For the above S200, if the first node has a communication demand, it can broadcast the communication demand to other surrounding terminals. If a terminal (ie, the second node) responds to the communication demand, the first node executes the above S201-S204 process to establish a communication connection with the second node.

[0088] Figure 4 The following is a flow chart of a communication method provided in an embodiment of the present application. For example, the communication method provided in the present application can be applied to Figure 1 In the communication system shown in FIG. 1 , the second node may be used to Figure 1 In the network side device.

[0089] like Figure 4 As shown, the communication method provided by the present application may specifically include the following steps:

[0090] S401. The second node sends an authentication instruction.

[0091] The authentication instruction is used to instruct the first node to perform network authentication.

[0092] S402: The second node receives a first authentication request from the first node.

[0093] The first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0094] S403: After the first authentication request is verified, the second node sends a second authentication request to the first node.

[0095] The second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0096] For the above S401-S403, when network access is required, the second node can broadcast an authentication instruction to instruct the terminals within its signal coverage to perform network authentication. Then, the second node can receive the first authentication request sent by the first node and verify the legitimacy of the identity of the first node. After the first authentication request is verified, the second node determines that the first node is legitimate and sends a second authentication request to the first node to request the first node to verify the legitimacy of its own identity, thereby achieving two-way authentication.

[0097] In some embodiments, the communication method provided by the embodiment of the present application also includes the following verification steps: Step a, obtain the public key of the second granting agency to which the digital identity of the first node belongs. Step b, use the public key of the second granting agency to decrypt the digital identity of the first node to obtain the public key (K-publick-ue) of the digital identity of the first node. Step c, use the public key of the digital identity of the first node to decrypt the second user verification information to obtain the third user verification information. Step d, when the third user verification information is consistent with the first user verification information, determine that the first authentication request verification is successful.

[0098] It should be understood that the second granting institution and the first granting institution may be the same institution or different institutions.

[0099] In some embodiments, when the second node is a network-side device (e.g., a base station, AUSF network element), the public key of the second granting agency can be uploaded to the blockchain storage, and the second node can obtain the public key of the second granting agency by accessing the blockchain. Alternatively, the public key of the second granting agency can be stored in a preset storage space (e.g., a base station, an edge node, a UDM network element, an AUSF network element, etc. of the network), and the second node can obtain the public key of the second granting agency from the preset storage space. When the second node is a terminal, the public key of the second granting agency can be stored in the terminal in advance and directly obtained and used when needed.

[0100] When the second node is a base station, the digital identity of the second node should be stored in a dedicated authentication unit that is physically isolated from other units, similar to a SIM card, and the encryption of the first network authentication information should also be completed in this dedicated authentication unit. The digital identity of the second node can be the digital identity of the network or the digital identity of the base station itself.

[0101] In some embodiments, the second node can inform the first node of the symmetric key used for communication, so that the first node can subsequently use the symmetric key to communicate with the second node, thereby improving communication efficiency. Therefore, the second authentication request also includes a communication parameter, which is a symmetric key encrypted by the public key of the digital identity of the first node.

[0102] As mentioned above, when a base station fails to work, the communication method provided in the embodiment of the present application can also realize communication between terminals. That is, when both the first node and the second node are terminals, before S401, the second node also performs the following S400.

[0103] S400: In response to a communication request from the first node, the second node sends an authentication instruction to the first node.

[0104] As mentioned above, in S200, the first node broadcasts a communication request to the surroundings. If the second node receives the communication request and the second node also has a communication demand, the second node can agree to the communication request, that is, respond to the communication request of the first node and send an authentication indication to the first node. Then the second node continues to perform the above steps S401-S403.

[0105] The communication method provided by the embodiment of the present application, in which the first node can send an authentication request after receiving the authentication instruction of the second node so that the second node verifies the legitimacy of the first node, and obtains the authentication request sent by the second node to verify the legitimacy of the second node. Communicate with the second node after the verification is passed. The communication method provided by the present application adopts a two-way authentication method, so that the authentication can be independent of the UDM network element, so that any node in the network can realize the authentication of the terminal, avoiding the risk of a single point failure causing the entire network to be paralyzed, and effectively improving the stability of the communication system.

[0106] In addition, the use of digital identity for authentication can not only determine whether the digital identity is legitimate, but also determine whether the device sending the authentication request matches the digital identity, further ensuring communication security. Moreover, after the authentication is passed, the communication efficiency of the communication system can be improved through symmetric key communication, which complies with existing communication standards.

[0107] Figure 5 The interactive diagram of a communication method provided in an embodiment of the present application is shown in FIG. Figure 5As shown, the communication system also includes a base station and an AMF network element. First, the base station broadcasts the indication information. After receiving the indication information, the terminal generates a user authentication request (the above-mentioned first authentication request) and sends it to the AMF network element through the base station. Then the AMF network element adds the network name to the user authentication request and forwards the user authentication request to the AUSF network element. The AUSF network element verifies the user authentication request. After the verification is passed, it generates a symmetric key based on the network name carried in the user authentication request and encrypts the symmetric key to generate a network authentication request (the above-mentioned second authentication request) carrying the encrypted symmetric key. Then the AUSF network element sends the network authentication request to the terminal through the AMF network element and the base station in turn. After the terminal verifies that the network authentication request is passed, it decrypts the symmetric key and uses the symmetric key for communication.

[0108] Figure 6 The following is an interactive diagram of a communication method provided in an embodiment of the present application. Taking the network side device as a base station as an example, Figure 6 As shown, first, the base station broadcasts the indication information. After receiving the indication information, the terminal generates a user authentication request (the first authentication request mentioned above) and sends it to the base station. The base station then verifies the user authentication request, and after passing it, generates a network authentication request (the second authentication request mentioned above) carrying an encrypted symmetric key and sends it to the terminal. The terminal verifies and decrypts the symmetric key and uses the symmetric key to communicate with the base station.

[0109] Figure 7 The following is an interactive diagram of a communication method provided in an embodiment of the present application. Taking the network side device as a terminal as an example, Figure 7 As shown, the communication system includes terminal a and terminal b. First, terminal a broadcasts the communication demand. If terminal b agrees with the communication demand, it sends an indication message to terminal a. After receiving the indication message, terminal a generates a user authentication request (the above-mentioned first authentication request) and sends it to terminal b. Then terminal b verifies the user authentication request, and after passing it, generates a network authentication request (the above-mentioned second authentication request) carrying an encrypted symmetric key and sends it to terminal a. Terminal a verifies and decrypts the symmetric key to obtain the symmetric key, and uses the symmetric key to communicate with terminal b.

[0110] It is understandable that the communication device (which can be the above-mentioned first node or the second node) includes a hardware structure and / or software module corresponding to each function in order to realize the above-mentioned functions. Those skilled in the art should be easily aware that, in conjunction with the algorithm steps of each example described in the embodiment of the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but this implementation should not be considered to exceed the scope of the present application.

[0111] The embodiment of the present application can divide the functional modules of the communication device according to the above method embodiment. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one functional module. The above integrated module can be implemented in the form of hardware or software. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.

[0112] Figure 8 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application, and the communication device can execute the communication method provided in the above method embodiment. Figure 8 As shown, the communication device includes: a receiving module 801, a sending module 802 and a communication module 803.

[0113] The receiving module 801 is used to receive an authentication instruction from the second node; the authentication instruction is used to instruct the first node to perform network authentication.

[0114] The sending module 802 is used to send a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0115] The receiving module 801 is further used to receive a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0116] The communication module 803 is used to communicate with the second node after the second authentication request is verified.

[0117] In some embodiments, the authentication indication includes first user verification information, and the first user verification information is used to verify the legitimacy of the identity of the first node; the first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

[0118] In some embodiments, the second user authentication information is the first user authentication information encrypted by the private key of the digital identity of the first node.

[0119] In some embodiments, the first authentication request includes first network verification information, which is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and the second network verification information; the second network verification information is the encrypted first network verification information.

[0120] In some embodiments, the second network verification information is the first network verification information encrypted by the private key of the digital identity of the second node.

[0121] In some embodiments, the above device further includes: an acquisition module 804 and a processing module 805 .

[0122] The acquisition module 804 is used to acquire the public key of the first granting institution to which the digital identity of the second node belongs.

[0123] The processing module 805 is used to use the public key of the first granting agency to decrypt the digital identity of the second node to obtain the public key of the digital identity of the second node; use the public key of the digital identity of the second node to decrypt the second network verification information to obtain the third network verification information; when the third network verification information is consistent with the first network verification information, determine that the second authentication request verification is successful.

[0124] In some embodiments, the second authentication request also includes: communication parameters; the communication module 803 is specifically used to use the private key of the digital identity of the first node to decrypt the communication parameters to obtain a symmetric key; and use the symmetric key to communicate with the second node.

[0125] In some embodiments, when both the first node and the second node are terminals, the sending module 802 is further used to broadcast a communication demand; the communication demand is used to request communication with the second node.

[0126] Fig. 9 is a schematic diagram of the structure of another communication device provided in an embodiment of the present application, and the communication device can execute the communication method provided in the above method embodiment. Fig. 9 As shown, the communication device includes: a sending module 901 and a receiving module 902.

[0127] The sending module 901 is used to send an authentication indication; the authentication indication is used to instruct the first node to perform network authentication.

[0128] The receiving module 902 is used to receive a first authentication request from a first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node.

[0129] The sending module 901 is also used to send a second authentication request to the first node after the first authentication request is verified; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

[0130] In some embodiments, the authentication indication includes first user verification information, and the first user verification information is used to verify the legitimacy of the identity of the first node; the first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

[0131] In some embodiments, the second user authentication information is the first user authentication information encrypted by the private key of the digital identity of the first node.

[0132] In some embodiments, the first authentication request includes first network verification information, which is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and the second network verification information; the second network verification information is the encrypted first network verification information.

[0133] In some embodiments, the second network verification information is the first network verification information encrypted by the private key of the digital identity of the second node.

[0134] In some embodiments, the above device further includes an acquisition module 903 and a processing module 904 .

[0135] The acquisition module 903 is used to acquire the public key of the second granting institution to which the digital identity of the first node belongs.

[0136] Processing module 904 is used to obtain the public key of the second granting agency to which the digital identity of the first node belongs; use the public key of the second granting agency to decrypt the digital identity of the first node to obtain the public key of the digital identity of the first node; use the public key of the digital identity of the first node to decrypt the second user verification information to obtain the third user verification information; when the third user verification information is consistent with the first user verification information, it is determined that the first authentication request verification is successful.

[0137] In some embodiments, the second authentication request also includes a communication parameter; the communication parameter is a symmetric key encrypted by the public key of the digital identity of the first node.

[0138] In some embodiments, when both the first node and the second node are terminals, the sending module 901 is specifically configured to send an authentication indication to the first node in response to a communication request of the first node.

[0139] An embodiment of the present application provides a communication system, which includes a first node and a second node. The first node is used to execute the methods described in S201-S204 above, and the second node is used to execute the methods described in S401-S403 above.

[0140] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiments of the present application provide another possible structure of the electronic device or communication device involved in the above-mentioned embodiments. Fig.10 As shown, the communication device 100 includes: a processor 1002 and a bus 1004. Optionally, the electronic device or communication device may further include a memory 1001; optionally, the electronic device or communication device may further include a communication interface 1003.

[0141] Processor 1002 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 1002 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. Processor 1002 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0142] The communication interface 1003 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0143] The memory 1001 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0144] As a possible implementation, the memory 1001 may exist independently of the processor 1002, and the memory 1001 may be connected to the processor 1002 via a bus 1004 for storing instructions or program codes. When the processor 1002 calls and executes the instructions or program codes stored in the memory 1001, the communication method provided in the embodiment of the present application can be implemented.

[0145] In another possible implementation, the memory 1001 may also be integrated with the processor 1002 .

[0146] The bus 1004 may be an extended industry standard architecture (EISA) bus, etc. The bus 1004 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0147] In some embodiments, executable instructions are stored in the memory 1001. When the processor 1002 executes the executable instructions, the electronic device or communication device executes the communication method described in any of the above embodiments.

[0148] Some embodiments of the present application provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the communication method described in any of the above embodiments.

[0149] Exemplarily, the above-mentioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or magnetic tapes, etc.), optical disks (e.g., compact disks (CD), digital versatile disks (DVD), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). The various computer-readable storage media described in this application may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0150] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the communication method described in any one of the above embodiments.

[0151] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: Applied to the first node, the method comprises: receiving an authentication instruction from a second node; the authentication instruction is used to instruct the first node to perform network authentication; Sending a first authentication request to the second node; the first authentication request is used to request verification of the legitimacy of the identity of the first node; receiving a second authentication request from the second node; the second authentication request is used to request verification of the legitimacy of the identity of the second node; After the second authentication request is verified, communicate with the second node.

2. The method according to claim 1, characterized in that The authentication indication includes first user verification information, and the first user verification information is used to verify the legitimacy of the identity of the first node; the first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

3. The method according to claim 2, characterized in that The second user authentication information is the first user authentication information encrypted by the private key of the digital identity of the first node.

4. The method according to claim 1, characterized in that: The first authentication request includes first network verification information, and the first network verification information is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and second network verification information; the second network verification information is the encrypted first network verification information.

5. The method according to claim 4, characterized in that The second network authentication information is the first network authentication information encrypted by the private key of the digital identity of the second node.

6. The method according to claim 5, characterized in that The method further comprises: Obtaining a public key of a first granting institution to which the digital identity of the second node belongs; Decrypting the digital identity of the second node using the public key of the first granting institution to obtain the public key of the digital identity of the second node; decrypting the second network verification information using the public key of the digital identity of the second node to obtain third network verification information; When the third network verification information is consistent with the first network verification information, it is determined that the second authentication request is verified successfully.

7. The method according to any one of claims 1 to 6, characterized in that: The second authentication request further includes: communication parameters; The communicating with the second node comprises: Decrypting the communication parameters using the private key of the digital identity of the first node to obtain a symmetric key; The symmetric key is used to communicate with the second node.

8. The method according to claim 1, characterized in that In the case where both the first node and the second node are terminals, the method further includes: Broadcasting communication requirements; the communication requirements are used to request communication with the second node.

9. A communication method, characterized in that: Applied to the second node, the method comprises: Sending an authentication instruction; the authentication instruction is used to instruct the first node to perform network authentication; Receiving a first authentication request from the first node; the first authentication request is used to request verification of the legitimacy of the identity of the first node; After the first authentication request is verified, a second authentication request is sent to the first node; the second authentication request is used to request verification of the legitimacy of the identity of the second node.

10. The method according to claim 9, characterized in that The authentication indication includes first user verification information, and the first user verification information is used to verify the legitimacy of the identity of the first node; the first authentication request includes: the digital identity of the first node, second user verification information and first network verification information; the second user verification information is the encrypted first user verification information; the first network verification information is used to verify the legitimacy of the second node.

11. The method according to claim 10, characterized in that The second user authentication information is the first user authentication information encrypted by the private key of the digital identity of the first node.

12. The method according to claim 9, characterized in that The first authentication request includes first network verification information, and the first network verification information is used to verify the legitimacy of the second node; the second authentication request includes: the digital identity of the second node and second network verification information; the second network verification information is the encrypted first network verification information.

13. The method according to claim 12, characterized in that The second network authentication information is the first network authentication information encrypted by the private key of the digital identity of the second node.

14. The method according to claim 11, characterized in that The method further comprises: Obtaining a public key of a second granting institution to which the digital identity of the first node belongs; Decrypting the digital identity of the first node using the public key of the second granting institution to obtain the public key of the digital identity of the first node; Decrypting the second user authentication information using the public key of the digital identity of the first node to obtain third user authentication information; When the third user verification information is consistent with the first user verification information, it is determined that the first authentication request is verified successfully.

15. The method according to any one of claims 9 to 14, characterized in that: The second authentication request also includes a communication parameter; the communication parameter is a symmetric key encrypted by the public key of the digital identity of the first node.

16. The method according to claim 9, characterized in that In a case where both the first node and the second node are terminals, the sending an authentication indication includes: In response to the communication request of the first node, the authentication indication is sent to the first node.

17. A communication device, characterized in that: include: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instruction so that the communication device executes the communication method according to any one of claims 1 to 16.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on the communication device, the communication device executes the communication method according to any one of claims 1 to 16.

Images