Identity authentication system and identity authentication method based on VORR network

Abstract

The invention discloses an identity authentication system based on a VORR network, which comprises a mobile terminal, an IMS network, a 5G core network and an identity security authentication module, and is characterized in that the mobile terminal is used for initiating a VORR video call request and carrying out real-time face photo information acquisition; the IMS network is used for verifying the VORR video call request and sending the face photo information to the 5G core network to determine the identity of a user and then complete the control and management of a call; the 5G core network is used for sending the face photo information to the identity security authentication module for face comparison, encrypting a comparison result and returning the comparison result to the IMS network; and the identity security authentication module is used for comparing the face photo information with data in the face database module and returning a comparison result to the 5G core network. A real-time face recognition mode is introduced in a VORR session establishment process, so that the accuracy and the safety of identity authentication are improved.

Description

Technical Field

[0001] The present application relates to the field of 5G security, and in particular to an identity authentication system and an identity authentication method based on a VoNR network. Background Art

[0002] In recent years, with the continuous improvement of 5G networks, VoNR has gradually matured. Under the 5G-SA network, 5G NR, 5G Core, and IMS end-to-end voice service carrying have been realized. Through IP-based voice services, network efficiency has been greatly improved, and the possibility of upgrading voice calls to high-definition video calls has been realized. At present, many new applications have been derived, such as: native high-definition video calls, video customer service, native video monitoring calls, virtual reality calls, etc.

[0003] Currently, when VoNR is establishing a session link, the terminal will be authenticated, and the process will involve the collaborative work of multiple network elements, including user equipment UE, 5G base station (gNB), IP multimedia subsystem (IMS), and 5G core network (5GC). After the user equipment UE detects the 5G NR cell, it registers to the 5G gNB and 5GC, and establishes a default protocol data unit (PDU) with the IMS through Data NDD. The IMS will forward the initial registration information of the user equipment UE to the I-CSCF through the P-CSCF, and verify the identity of the user equipment through the authentication server function (AUSF) and unified data management function (UDM) of the 5G core network. After the identity authentication is successful, the user equipment will establish a dedicated protocol data unit session to implement the calling / called call based on VoNR.

[0004] For example, the invention patent with publication number CN104753872A provides an authentication method, an authentication platform, a service platform, a network element and a system. The invention uses the authentication capability provided by the existing network element to authenticate the terminal information and save the terminal information.

[0005] However, the identity security verification method in the prior art can only compare and identify the terminal information, but cannot realize the real-time information identification of the user. There may be inconsistencies in identity verification, terminal verification, and business verification, which may lead to privacy security issues in some application scenarios.

[0006] Therefore, there is an urgent need for a technical solution for identity security verification that can solve the above problems. Summary of the invention

[0007] In order to address the deficiencies of the prior art, the present application provides an identity authentication system and an identity authentication method based on a VoNR network, which improves the accuracy and security of identity authentication by introducing real-time face recognition during the VoNR session establishment process.

[0008] The technical effects to be achieved by this application are achieved through the following solutions: According to a first aspect of the present application, an identity authentication system based on a VoNR network is provided, including a mobile terminal, an IMS network, a 5G core network, and an identity security authentication module, wherein: The mobile terminal is used to initiate a VoNR video call request and collect real-time face photo information; The IMS network is used to verify the VoNR video call request and complete the control and management of the call after confirming the user identity with the face photo information to the 5G core network; The 5G core network is used to send the face photo information to the identity security authentication module for face comparison, and encrypt the comparison result and return it to the IMS network; The identity security authentication module is used to compare the facial photo information with the data in the facial database module, and return the comparison result to the 5G core network.

[0009] Preferably, the IMS network includes: The proxy calls the session control network element, which is used to verify whether the format of the registration request is legal and correct; Querying a call session control network element, which is used to send the face photo information to the identity authentication network element of the 5G core network to determine the user's identity and query the services signed by the user; The service call session control network element is used to complete the control and management of the session through the contracted service and the user identity, and to establish or close the session.

[0010] Preferably, the 5G core network includes an authentication server and a unified data management module, wherein: The authentication server is used to perform user identity authentication based on face comparison result information; The unified data management module is used to store user-related data, and the user-related data at least includes the services subscribed by the user and related network session strategies.

[0011] Preferably, the identity security authentication module includes an information acquisition module, a face database module and a comparison and verification module, wherein: The information acquisition module is used to obtain the user's face photo information and the mobile phone number that initiates the request; The face database module is used to store the face information and mobile phone numbers of all registered users; The comparison and verification module is used to compare the facial photo information with the facial information in the facial database module, obtain the identity information of the user corresponding to the current facial photo information, and return the comparison result.

[0012] According to a second aspect of the present application, there is provided an identity authentication method using the above-mentioned VoNR network-based identity authentication system, comprising the following steps: Step 1: The mobile terminal initiates a VoNR video call request to the target terminal and collects user information in real time; Step 2: The IMS network initiates an identity authentication request to the 5G core network based on the user information; Step 3: The 5G core network sends the user information to the identity security authentication module, which retrieves and confirms the information stored in the database to obtain the registered identity, and returns the registered identity to the 5G core network; Step 4: The 5G core network obtains user-related data according to the registered identity, and returns the user-related data to the IMS network; Step 5: The IMS network controls whether to establish or terminate the session according to the user-related data.

[0013] Preferably, in step 1, the user information includes terminal information and face information, and the terminal information and face information are synchronized to the IMS network through a 5G base station.

[0014] Preferably, when a VoNR video call request is initiated, liveness detection is initiated by the mobile terminal, and subsequent steps are performed only when the liveness detection passes.

[0015] Preferably, in step 3, the identity security authentication module retrieves and confirms the facial information and the information stored in the facial database to obtain the registered identity.

[0016] Preferably, in step 4, the user-related data includes the service subscribed by the user and the relevant network session policy, and the IMS network controls the mobile terminal to establish or interrupt the VoNR video call according to the service subscribed by the user and the relevant network session policy.

[0017] Preferably, the 5G core network encrypts the user-related data and returns it to the IMS network.

[0018] According to one embodiment of the present application, the beneficial effect of adopting the VoNR network-based identity authentication system and identity authentication method of the present application is that by adding an identity security authentication system to the UDM (unified data management function), live face recognition of the caller and the person being called is achieved, further improving the secure establishment of the session and the viewing of private content, improving the comprehensiveness of identity authentication, and expanding the scope of authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the existing technical solutions, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1 This is a structural block diagram of an identity authentication system based on a VoNR network in an embodiment of the present application; Figure 2 The present invention is a flowchart of a method for identity authentication based on a VoNR network in one embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0022] like Figure 1 As shown, the identity authentication system based on the VoNR network in an embodiment of the present application includes a mobile terminal, an IMS network, a 5G core network and an identity security authentication module, wherein: A mobile terminal is used to initiate a VoNR video call request and collect real-time facial photo information; the mobile terminal initiates a VoNR video call to a target terminal, wherein the mobile terminal and the target terminal are not limited to mobile phone terminals, tablet terminals, camera terminals, customer service agent terminals, etc.

[0023] The IMS network is used to verify the VoNR video call request and complete the control and management of the call after confirming the user's identity by sending the face photo information to the 5G core network; the IMS network includes: The proxy call session control network element (P-CSCF) is the first access point network element function when the user equipment initiates a registration request to the IMS network. It is mainly used to verify whether the request format is legal and correct. The request is a request to initiate a video call. In some high-security identity verification scenarios, it is necessary to verify that the user and the credit terminal are consistent. For example: through a video call, call the video surveillance screen at home, or financial practitioners and court enforcement personnel conduct video calls for remote dual recording scenarios.

[0024] Query the call session control network element (I-CSCF), which is used to send the face photo information to the identity authentication network element of the 5G core network to determine the user's identity and query the user's contracted services; The service call session control network element (S-CSCF) is used to control and manage sessions, establish sessions, or close sessions based on the contracted services and user identities.

[0025] The 5G core network is used to send the face information to the identity security authentication module for face comparison, and encrypt the comparison result and return it to the IMS network; the interfaces used by the 5G core network include the N13 interface, including the authentication server AUSF and the unified data management module UDM, where: The authentication server is used to perform user identity authentication based on the face comparison result information to confirm whether the device has the authority to access network resources.

[0026] The unified data management module is used to store user-related data, which at least includes the services subscribed by the user and the relevant network session policies. The service call session control network element S-CSCF obtains the final policy from the UDM to establish or disconnect the session. The contracted service category includes the type of user identified, such as prepaid or postpaid users; the relevant network session policies include the user's communication rights and functional rights.

[0027] The identity security authentication module is used to compare the face information with the data in the face database module and return the comparison result to the 5G core network. The identity security authentication module includes an information acquisition module, a face database module and a comparison and verification module, among which: The information acquisition module is used to obtain the user's facial photo information and the mobile phone number that initiated the request; The face database module is used to store the face information and mobile phone numbers of all registered users; The comparison and verification module is used to compare the facial photo information with the facial information in the face database module, obtain the identity information of the user corresponding to the current facial photo information, and return the comparison result.

[0028] like Figure 2 As shown, in one embodiment of the present application, the identity authentication method of the above-mentioned identity authentication system based on the VoNR network is adopted, including the following steps: Step 1: The mobile terminal initiates a VoNR video call request to the target terminal and collects user information in real time; In this step, the user information includes terminal information and facial photo information, and the terminal information and facial photo information are synchronized to the IMS network through the 5G base station.

[0029] When initiating a VoNR video call request, the mobile terminal initiates liveness detection, and only when the liveness detection passes can the subsequent steps be performed. The purpose of liveness detection is to prevent users from using photos, videos, etc. to deceive the system to complete the connection, thereby improving security.

[0030] Step 2: The IMS network initiates an identity authentication request to the 5G core network based on the user information; In this step, in the IMS network, the acquired information is forwarded to the I-CSCF through the P-CSCF, and the authentication server function AUSF initiates an identity authentication request to the unified data management module UDM and the identity security authentication module based on the Nudm service interface; Step 3: The 5G core network sends the user information to the identity security authentication module, which retrieves and confirms the information stored in the database to obtain the registered identity, and returns the registered identity to the 5G core network; In this step, the identity security authentication module retrieves and confirms the facial photo information obtained in real time in step 1 and the facial information stored in the facial database to obtain the registered identity, which includes identity information, mobile phone number information at the time of registration, etc.

[0031] Step 4: The 5G core network obtains user-related data based on the registered identity and returns the user-related data to the IMS network; In this step, the corresponding user-related data can be obtained by using the identity information of the registered user, such as the mobile phone number information during registration, etc. The user-related data includes the service contracted by the user and the relevant network session policy. The IMS network controls the mobile terminal to establish or terminate the VoNR video call according to the service contracted by the user and the relevant network session policy. For example, through the mobile phone number used during registration, it is known that the current user is a prepaid user. According to the session policy related to prepaid users, the user can have the right to a video session of a specified duration.

[0032] Since the AUSF (Assurance Server Function) interaction involves the transmission of user authentication result information, the 5G core network encrypts the user-related data and returns it to the IMS network.

[0033] Step 5: The IMS network controls whether to establish or terminate the session based on the user-related data.

[0034] In this step, if the face verification is successful, a video call is established according to the service and network session policy corresponding to the face; if the face verification fails (the corresponding face information in the database does not exist, or does not match the registered mobile phone number, etc.), or the corresponding contracted service expires, the current session is interrupted.

[0035] This method is based on native VoNR call scenario identity recognition. For example, people with identity permissions can view real-time video surveillance images, and authorized corporate personnel can reach and dial the target user's phone, etc.

[0036] According to one embodiment of the present application, the beneficial effect of adopting the VoNR network-based identity authentication system and identity authentication method of the present application is that by adding an identity security authentication system to the UDM (unified data management function), live face recognition of the caller and the person being called is achieved, further improving the secure establishment of the session and the viewing of private content, improving the comprehensiveness of identity authentication, and expanding the scope of authentication.

[0037] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0038] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0039] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0040] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0041] For ease of description, spatially relative terms, such as "above", "above", "on the upper surface of", "above", etc., may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" may include both "above" and "below". The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatially relative descriptions used herein are interpreted accordingly.

[0042] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0043] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An identity authentication system based on VoNR network, characterized in that: It includes mobile terminals, IMS networks, 5G core networks and identity security authentication modules, including: The mobile terminal is used to initiate a VoNR video call request and collect real-time face photo information; The IMS network is used to verify the VoNR video call request and complete the control and management of the call after confirming the user identity by sending the face photo information to the 5G core network; The 5G core network is used to send the face photo information to the identity security authentication module for face comparison, and encrypt the comparison result and return it to the IMS network; The identity security authentication module is used to compare the facial photo information with the data in the face database module, and return the comparison result to the 5G core network.

2. The identity authentication system based on VoNR network according to claim 1, characterized in that: The IMS network includes: The proxy call session control network element is used to verify whether the format of the registration request is legal and correct; Querying a call session control network element, which is used to send the face photo information to the identity authentication network element of the 5G core network to determine the user's identity and query the services signed by the user; The service call session control network element is used to complete the control and management of the session through the contracted service and the user identity, and to establish or close the session.

3. The identity authentication system based on VoNR network according to claim 2, characterized in that: The 5G core network includes an authentication server and a unified data management module, wherein: The authentication server is used to perform user identity authentication based on face comparison result information; The unified data management module is used to store user-related data, and the user-related data at least includes the services subscribed by the user and related network session strategies.

4. The identity authentication system based on VoNR network according to claim 1, characterized in that: The identity security authentication module includes an information acquisition module, a face database module and a comparison and verification module, wherein: The information acquisition module is used to obtain the user's face photo information and the mobile phone number that initiates the request; The face database module is used to store the face information and mobile phone numbers of all registered users; The comparison and verification module is used to compare the facial photo information with the facial information in the facial database module, obtain the identity information of the user corresponding to the current facial photo information, and return the comparison result.

5. An identity authentication method using the identity authentication system based on the VoNR network according to claims 1 to 4, characterized in that: The steps include: Step 1: The mobile terminal initiates a VoNR video call request to the target terminal and collects user information in real time; Step 2: The IMS network initiates an identity authentication request to the 5G core network based on the user information; Step 3: The 5G core network sends the user information to the identity security authentication module, which retrieves and confirms the information stored in the database to obtain the registered identity, and returns the registered identity to the 5G core network; Step 4: The 5G core network obtains user-related data according to the registered identity, and returns the user-related data to the IMS network; Step 5: The IMS network controls whether to establish or terminate the session according to the user-related data.

6. The identity authentication method according to claim 5, characterized in that: In step 1, the user information includes terminal information and face information, and the terminal information and face information are synchronized to the IMS network through a 5G base station.

7. The identity authentication method according to claim 6, characterized in that: When a VoNR video call request is initiated, the mobile terminal initiates liveness detection, and subsequent steps are performed only after the liveness detection passes.

8. The identity authentication method according to claim 6, characterized in that: In step 3, the identity security authentication module retrieves and confirms the facial information and the information stored in the facial database to obtain the registered identity.

9. The identity authentication method according to claim 6, characterized in that: In step 4, the user-related data includes the service subscribed by the user and the relevant network session policy, and the IMS network controls the mobile terminal to establish or terminate the VoNR video call according to the service subscribed by the user and the relevant network session policy.

10. The identity authentication method according to claim 9, characterized in that: The 5G core network encrypts the user-related data and returns it to the IMS network.

Images