User verification method in communication

Abstract

The embodiment of the invention provides a method, a system, a storage medium and a program product. The method comprises the following steps: a first network device obtains first biological identification information of a user of a first terminal device; and sending first biological identification information to the second network device or a third network device based on a first verification request message used for verifying the user received from the second network device, the first biological identification information being used for carrying out identity verification on the user of the first terminal device. According to the embodiment of the invention, verification of the identity of the natural person can be provided in communication.

Description

Technical Field

[0001] The embodiments of the present disclosure mainly relate to the field of communication technology. More specifically, the embodiments of the present disclosure relate to a method, system, electronic device, computer-readable storage medium, and computer program product for verifying a user in communication. Background Art

[0002] With the further development of 5Generation technology, in the coming 5.5Generation and even the next generation network 6Generation era, a new video-based interactive call mode will become an emerging special call service. In the new call scenario, the generation of digital people based on AIGC (artificial intelligence generated content) technology is a typical service. However, this service also brings huge challenges to the establishment of trust between the two communicating parties. At present, it is possible to achieve face tampering through technical means (network side); while attacks that directly tamper with faces on the terminal side are more common and easy to implement. Traditional uplink media streams may be generated in real time in the AIGC module of the 5G core network (5Generation Core, 5GC), which can save uplink bandwidth efficiency. At this time, the network side needs to prove that the media stream or generated media stream is credible.

[0003] The general communication verification mechanism is that the user equipment (UE) will complete the IMS key distribution / authentication and key agreement (AKA) authentication during the IP Multimedia Subsystem (IMS) network registration process. The certificate and identity used for authentication are the long-term key K stored on the Subscriber Identity Module (SIM) card and the IMS Private Identity (IMPI), that is, the IMS network obtains the binding relationship between the IMPI (which can correspond to the phone number) and the card. Therefore, when a UE initiates a call to another UE, the network can only ensure that the number of the UE initiating the call cannot be forged based on the binding relationship between the phone number and the card. Summary of the invention

[0004] The embodiment of the present disclosure provides a verification method in communication. The embodiment of the present disclosure obtains the biometric identification information of the user on the network side and verifies the identity of the user in communication by the biometric identification information, so as to verify the true identity of both parties in communication.

[0005] In a first aspect of the present disclosure, a method is provided. The method includes: a first network device obtains first biometric identification information of a user of a first terminal device; and based on receiving a first verification request message for verifying the user from a second network device, the first biometric identification information is sent to a second network device or a third network device, wherein the first biometric identification information is used to authenticate the user of the first terminal device. Thus, the user can be verified on the network side through the biometric identification information.

[0006] In some embodiments of the first aspect, the method further includes: determining that the first network device does not store the first biometric identification information; the first network device obtaining the first biometric identification information of the user of the first terminal device includes: receiving a first verification request message for verifying the user from the second network device, the verification request message carrying the first biometric identification information; and storing the first biometric identification information. Thus, in the absence of the first biometric identification information, the biometric identification information can be obtained from the user device, which increases the flexibility of obtaining the biometric identification information.

[0007] In some embodiments of the first aspect, the method further includes: determining that the first network device stores the first biometric identification information; and the first network device obtaining the first biometric identification information of the user of the first terminal device includes: obtaining the first biometric identification information of the user of the first terminal device from the stored first biometric identification information. Thus, the stored biometric identification information can be used in the verification process.

[0008] In some embodiments of the first aspect, the first verification request message includes an identifier of the first terminal device, second biometric information of the user collected by the first terminal device, and a verification identifier, and the method further includes: in response to the first network device not storing the second biometric information, or the stored biometric information does not match the second biometric information, verifying the second biometric information through a fifth network device. Thus, the biometric information can be verified through a third party, increasing the flexibility of verification.

[0009] In some embodiments of the first aspect, verifying the second biometric information through the fifth network device includes: sending a verification identifier to the fifth network device, the verification identifier being used to verify the second biometric information; receiving third biometric information corresponding to the second biometric information when the verification is passed at the fifth network device; storing a relationship between the first terminal device and the second biometric information and the third biometric information; and sending verification response information to the second network device. Thus, the biometric information can be verified and sent through a third party, increasing flexibility.

[0010] In some embodiments of the first aspect, the second biometric identification information and the third biometric identification information are sent after being encrypted, thereby protecting user privacy.

[0011] In some embodiments of the first aspect, verifying the second biometric identification information through the fifth network device includes: sending the second biometric identification information and a verification identifier to the fifth network device, the verification identifier being used to verify the second biometric identification information; receiving a verification result from the fifth network device; and sending verification response information to the second network device. Thus, the biometric identification information can be verified through a third party, increasing flexibility.

[0012] In some embodiments of the first aspect, it also includes: receiving a registration request message from a first terminal device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device; in response to the first network device storing feature recognition capability information of the first terminal device and / or anti-counterfeiting verification capability information of the first terminal device, verifying whether the stored feature recognition capability information and / or anti-counterfeiting verification capability information match the feature recognition capability information and / or anti-counterfeiting verification capability information carried in the registration request message; and sending a registration request response to the first terminal device, wherein the registration request response includes the anti-counterfeiting verification policy corresponding to the first terminal device. Thus, the anti-counterfeiting verification policy can be determined at the registration request stage, thereby accurately determining the verification method.

[0013] In some embodiments of the first aspect, it also includes: receiving a registration request message from a first terminal device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device; in response to the first network device not storing the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device recorded by the first network device, storing the identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or the anti-counterfeiting verification capability information of the first terminal device carried in the registration request message; and sending a registration request response to the first terminal device, wherein the registration request response includes the anti-counterfeiting verification strategy corresponding to the first terminal device. Thus, the verification capability can be stored and the anti-counterfeiting verification strategy can be determined in the registration request stage, thereby accurately determining the verification method.

[0014] In some embodiments of the first aspect, the method further includes: receiving a registration request message from a first terminal device, the registration request message not including feature recognition capability information of the first terminal device and / or anti-counterfeiting verification capability information of the first terminal device; and sending a registration request response to the first terminal device, wherein the registration request response includes a default anti-counterfeiting verification policy. Thus, the default verification policy can be sent to the terminal, thereby ensuring that the terminal obtains the anti-counterfeiting verification policy.

[0015] In some embodiments of the first aspect, the method further includes: sending a verification policy synchronization message to a third network device, wherein the verification policy synchronization message includes an anti-counterfeiting verification policy. Thus, the anti-counterfeiting verification policy can be sent to the third network device, thereby achieving distribution of the anti-counterfeiting verification policy.

[0016] In some embodiments of the first aspect, the method further includes: sending a media plane network device discovery request message to a fourth network device, the media plane network device discovery request message including an anti-counterfeiting verification capability; receiving a media plane network device discovery response message from the fourth network device; and sending an anti-counterfeiting verification policy to the third network device. Thus, the anti-counterfeiting verification policy can be registered.

[0017] In some embodiments of the first aspect, the anti-counterfeiting verification strategy is associated with the functions supported by the first terminal device, and the anti-counterfeiting verification strategy includes: network side verification; terminal side verification; network + terminal side verification; and / or no verification on both the network side and the terminal side. Thus, multiple verification methods can be implemented.

[0018] In some embodiments of the first aspect, the first verification request message includes an identifier of the first terminal device, and the method further includes: querying the stored first biometric identification information based on the identifier of the first terminal device. Thus, the biometric identification information can be queried through the terminal device identifier.

[0019] In some embodiments of the first aspect, the method further includes: receiving a second verification request message from a third network device, the second verification request message including: original information of the service information or second biometric information obtained from the original information and an identifier of a user of the first terminal device for verifying the second biometric information; and sending a verification response to the third network device. Thus, the biometric information can be verified during the service process, thereby improving security.

[0020] In a second aspect of the present disclosure, a method is provided. The method includes: a second network device receives a service request message from a first terminal device; and based on the received service request message, sends a first verification request message for verifying a user of the first terminal device to the first network device; and receives a first verification response message for the first verification request message from the first network device. Thus, the corresponding message of user verification can be processed at the second network device.

[0021] In some embodiments of the second aspect, the first verification response message includes first biometric identification information of a user of the first terminal device, and the method further includes: sending the first biometric identification information and / or a detection algorithm to a third network device, the first biometric identification information being used to verify the user of the first terminal device. Thus, the biometric identification and the verification algorithm can be sent to the third network device to achieve verification flexibility.

[0022] In some embodiments of the second aspect, wherein the first verification request message and / or the first verification response message includes the collected second biometric identification information, the method further includes: sending the second biometric identification information to a third network device, the second biometric identification information being used to verify a user of the first terminal device. Thus, the biometric identification can be sent to the third network device.

[0023] In some embodiments of the second aspect, the first verification request message includes the collected second biometric identification information and the verification identification. Thus, the verification request message may carry the corresponding biometric identification and the verification identification.

[0024] In a third aspect of the present disclosure, a method is provided. The method includes: a third network device receives first biometric identification information of a user of a first terminal device from a first network device or a second network device; based on receiving a service message from the first terminal device, obtaining second biometric identification information from the service message; and verifying the user based on the first biometric identification information and the second biometric identification information. Thus, the user can be verified through the biometric identification information.

[0025] In some embodiments of the third aspect, the method further includes: storing the identification of the first terminal device and the first biometric identification information. Thus, the network device stores the corresponding information.

[0026] In some embodiments of the third aspect, the method further includes: sending a second verification request message to the first network device, the second verification request message including original information of the service message or second biometric identification information and an identification of a user of the first terminal device; and receiving a second verification response message for the second verification request from the first network device. Thus, the user can be verified through the first network device.

[0027] In some embodiments of the third aspect, the method further includes: in response to the verification failing, sending verification prompt information indicating that the user verification failed to the second terminal device, so that the user can receive the prompt information.

[0028] In some embodiments of the third aspect, the method further includes: receiving an anti-counterfeiting verification policy for the first terminal device from the first network device, thereby receiving the anti-counterfeiting verification policy and implementing distribution of the anti-counterfeiting verification policy.

[0029] In some embodiments of the third aspect, the method further includes: in response to the verification being successful, generating and signing a media stream based on the second biometric identification information; and sending the media stream and the signature to the second terminal device. Thus, the media stream can be signed to improve security.

[0030] In some embodiments of the third aspect, the method further includes: receiving third biometric identification information from the first network device, wherein the third biometric identification information is provided by a fifth network device and corresponds to the second biometric identification information. Thus, the biometric identification information can be obtained through a third party.

[0031] In a fourth aspect of the present disclosure, a method is provided. The method includes: a first terminal device sends a service request message to a second network device, wherein the service request message includes first biometric identification information of a user of the first terminal device. Thus, the terminal sends the biometric identification information.

[0032] In some embodiments of the fourth aspect, the method further includes: sending a registration request message to the second network device, the registration request message including the identification information of the first terminal device, the feature recognition capability information of the first terminal device, and the anti-counterfeiting verification capability information of the first terminal device; and receiving a registration request response from the first network device, wherein the registration request response includes the anti-counterfeiting verification policy corresponding to the first terminal device. Thus, the terminal obtains the anti-counterfeiting verification policy.

[0033] In some embodiments of the fourth aspect, the service request message includes the identification of the first terminal device, the second biometric identification information of the user collected by the first terminal device, and the verification identification. Thus, the collected identification information and verification identification are sent via the message.

[0034] In a fifth aspect of the present disclosure, a method is provided. The method includes: a second terminal device sends a second verification request message for verifying a user of a first terminal device to a third network device; and receiving a second verification response message for the second verification request message from the third network device. Thus, a verification result can be received.

[0035] In some embodiments of the fifth aspect, the method further includes: receiving verification prompt information from a third network device, wherein the verification prompt information indicates that the user verification has failed. Thus, the corresponding verification prompt information can be received.

[0036] In a sixth aspect of the present disclosure, a method is provided. The method includes: a first network device obtains first biometric identification information of a user of a first terminal device; the first network device stores the first biometric identification information; a second network device receives a service request message from the first terminal device; the second network device sends a first verification request message for verifying the user of the first terminal device to the first network device based on the received service request message; and the first network device sends the first biometric identification information to the second network device or the third network device based on the first verification request message of the user, and the first biometric identification information is used to authenticate the user of the first terminal device.

[0037] In some embodiments of the sixth aspect, it also includes: the third network device obtains second biometric information from the service message based on receiving the service message from the first terminal device; and the third network device verifies the user based on the first biometric information and the second biometric information.

[0038] In the seventh aspect of the present disclosure, a method is provided, the method comprising: a first network device obtains first biometric identification information of a user of a first terminal device; the first network device stores the first biometric identification information; a second network device receives a service request message from the first terminal device; the second network device sends a first verification request message for verifying the user of the first terminal device to the first network device based on the received service request message; and the first network device sends the first biometric identification information to the second network device or the third network device based on the first verification request message of the user, and the first biometric identification information is used to authenticate the user of the first terminal device. Thus, the user's natural person identity can be verified on the network side, improving security.

[0039] In an eighth aspect of the present disclosure, a system is provided. The system comprises: a first network device configured to execute a method according to any one of the first aspects; a second network device configured to execute a method according to any one of the second aspects; and a third network device configured to execute a method according to any one of the third aspects.

[0040] In the ninth aspect of the present disclosure, an electronic device is provided, comprising: at least one computing unit; and at least one memory, the at least one memory being coupled to the at least one computing unit and storing instructions for execution by the at least one computing unit, the instructions, when executed by the at least one computing unit, causing the device to execute methods according to the first to seventh aspects.

[0041] In a tenth aspect of the present disclosure, a computer-readable storage medium is provided, storing a computer program, which implements the methods according to the first to seventh aspects when executed by a processor.

[0042] In an eleventh aspect of the present disclosure, a computer program product is provided, comprising computer executable instructions, which, when executed by a processor, cause a device to perform a method according to the first to seventh aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and other features, advantages and aspects of various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings.

[0044] In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0045] Figure 1A schematic diagram illustrating an example environment in which various embodiments of the present disclosure can be implemented;

[0046] Figure 2 A schematic diagram showing a process according to some embodiments of the present disclosure;

[0047] Figure 3 A generalized schematic diagram of a user verification process according to some embodiments of the present disclosure is shown;

[0048] Figure 4 A schematic diagram of a user verification process based on pre-registration and streaming media according to some embodiments of the present disclosure is shown;

[0049] Figure 5 A schematic diagram showing a configuration process of verification capability in the configuration phase according to some embodiments of the present disclosure is shown;

[0050] Figure 6 A schematic diagram showing an abnormal prompt process in business interaction according to some embodiments of the present disclosure is shown;

[0051] Figure 7 A schematic diagram showing a process of a terminal reporting biometric identification information according to some embodiments of the present disclosure is shown;

[0052] Figure 8 A schematic diagram showing a process of obtaining biometric identification information through an authority according to some embodiments of the present disclosure;

[0053] Fig. 9 A block diagram showing a method at a first network device according to some embodiments of the present disclosure is shown;

[0054] Fig.10 A block diagram showing a method in a second network device according to some embodiments of the present disclosure is shown;

[0055] Fig.11 A block diagram showing a method in a third network device according to some embodiments of the present disclosure;

[0056] Fig.12 A block diagram of a method in a first terminal device according to some embodiments of the present disclosure is shown;

[0057] Fig.13 A block diagram of a method in a second terminal device according to some embodiments of the present disclosure is shown;

[0058] Fig.14 A block diagram of an electronic device capable of implementing various embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0059] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0060] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "the", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to and includes any or all possible combinations of one or more listed items.

[0061] In the description of the embodiments of the present application, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". It should be understood that the expressions "first", "second", "third" and the like are only intended to indicate that multiple objects may be different, but at the same time do not exclude that two objects are the same. The expressions "first", "second", "third" and the like should not be interpreted as any limitation on the embodiments. The terms "first" and "second" are used only for descriptive purposes and should not be understood as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, the meaning of "multiple" is two or more. The following may also include other explicit and implicit definitions.

[0062] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0063] As mentioned above, the general communication verification mechanism is that the user equipment (UE) will complete the IMS key distribution / authentication and key agreement (AKA) authentication during the IP Multimedia Subsystem (IMS) network registration process. The certificate and identification used for authentication are the long-term key K stored on the SIM card and the IMS private user identity (IMPI), that is, the IMS network obtains the binding relationship between the IMPI (which can correspond to the phone number) and the card. Therefore, when a UE initiates a call to another UE, the network can only ensure that the number of the UE initiating the call cannot be forged based on the binding relationship between the phone number and the card. Therefore, the IMS network is currently unable to guarantee the unforgeability of the identity of a natural person, and thus cannot provide verification of the identity of the other party to the communication during the call process.

[0064] In view of this, the embodiments of the present disclosure specifically propose a solution. In some examples, the solution of the embodiments of the present disclosure obtains the user's biometric marker information (pre-registration, terminal reporting, and authority acquisition) through the network side, and in the process of executing services such as new calls, the network side can judge the authenticity of the user based on the corresponding information obtained.

[0065] Figure 1 Schematic diagram of an example environment in which various embodiments of the present disclosure can be implemented. Figure 1 As shown, the example environment includes a first terminal device 110 and a second terminal device 111, a first network device 120, a second network device 121 and a third network device 122. The first network device 120, the second network device 121 and the third network device 122 are located in a core network 130.

[0066] Specifically, the first network device 120, the second network device 121 and the third network device 122 may be an identification information management network element, a control plane network element or a media plane network element. More specifically, the first network device 120, the second network device 121 and the third network device 122 may be an application function (AF), which mainly transmits the requirements of the application side to the network side, such as quality of service (QoS) requirements or user status event subscriptions. AF may be a third-party functional entity or an application service deployed by an operator, such as an IMS voice call service. For the application function entity of the third-party application, when it interacts with the core network, it can also be authorized through the Network Exposure Function (NEF). For example, the third-party application function directly sends a request message to the NEF, and the NEF determines whether the AF is allowed to send the request message. If the verification is successful, the request message will be forwarded to the corresponding Policy Control Function (PCF) or Unified Data Management (UDM); or it is Unified Data Management (UDM), which is mainly responsible for managing functions such as contract data and user access authorization; or it is a unified data warehouse (UDR), which is mainly responsible for the access functions of contract data, policy data, application data and other types of data; or it is a Policy Control Function (PCF), which is mainly responsible for billing for sessions and service flow levels, QoS bandwidth guarantee and mobility management, UE policy decision-making and other policy control functions; or it is a Session Management Function (SMF), which is mainly responsible for session management, execution of control policies issued by PCF, selection of user plane function entities (UPF), UE Internet ProtocolAddress (IP) address allocation and other functions; or the Access and MobilityManagement Function (AMF), which mainly performs mobility management, access authentication / authorization and other functions. In addition, it is also responsible for transmitting user policies between UE and PCF; or the User Plane Function (UPF), as the interface UPF with the data network, completes user plane data forwarding, session / flow-level billing statistics, bandwidth limitation and other functions.

[0067] Understandably, Figure 1The number of terminal devices and network devices shown in the figure is only an example and is not intended to impose any limitation. According to actual needs, the communication network 100 may include any appropriate number of network elements of various types.

[0068] Figure 2 Schematic diagram of the process according to some embodiments of the present disclosure is shown. Figure 2 As shown, in some embodiments, the first network device 121 obtains 201 the first biometric identification information of the user of the first terminal device 110. The first terminal device 110 sends 202 a service request message 203 to the second network device, and the service request message optionally includes the first biometric identification information. The second network device sends 205 a first verification request message 206 to the first network device 121. The first network device 121 sends a first verification response message 208 to the second network device 120, which optionally includes the first biometric identification information. Alternatively, the first network device 121 sends the first biometric identification information 210 to the third network device 122. The second network device 120 may also send 212 the first biometric identification information 213 to the third network device. The first terminal device 110 sends 215 a service message 216 to the third network device 122. The second network device 111 sends a verification request 219 to the third network device 122. The third network device 122 obtains 221 the second biometric identification information in the service message, and verifies 222 the user according to the first biometric identification information and the second biometric identification information. The third network device 122 sends 223 a verification response 224 to the second terminal device 111 .

[0069] The above method obtains biometric identification information from the first network device 121, verifies the user and sends the biometric identification information according to the corresponding verification request message of the second network device 120, and the third network device 122 obtains the second biometric identification information in the service message, and verifies the user through the first biometric identification information and the second biometric identification information. In this way, the user's biometric identification information can be obtained on the network side, and in the execution of the service, the network side can verify the user based on the corresponding information obtained.

[0070] Figure 3 FIG. 1 is a schematic diagram showing a generalized user authentication process according to some embodiments of the present disclosure. Figure 3As shown, at 310, the network side can store biometric information, i.e., the first biometric identification information (bio0), offline, for example, storing the biometric information when the user signs the contract. Alternatively, the network side may not store the biometric information, but carry it in subsequent steps. In addition, the network side can also connect to an external authority to obtain the biometric information of the user pre-stored in the external authority. At 320, the user's service request can carry the user's biometric characteristics collected in real time, i.e., the second biometric identification information (bio1), for comparison with the pre-stored first biometric identification information (bio0); or when the network side does not have the first biometric identification information (bio0), the second biometric identification information (bio1) can be used as the first biometric identification information (bio0). In some embodiments, the user's biometric information is transmitted after encryption. The network side completes the corresponding verification and synchronizes it to the media plane network element 122 for subsequent use.

[0071] At 330, when the control plane completes the negotiation and the user plane / media plane actually transmits the user service flow / media flow, the flow itself will carry biometric information, i.e., the third biometric identification information (bio2), because it is an audio and video call. At this time, the network side can perform a comparison verification and anti-counterfeiting of the third biometric identification information (bio2) and the first biometric identification information (bio0) or the second biometric identification information (bio1). At 340, in a new call scenario, the user anti-counterfeiting verification can be further triggered by the second terminal device 111 of the receiving party.

[0072] In some embodiments, the first network device 121 is an identification information management network element, the second network device 120 is a control plane network element, and the third network device 122 is a media plane network element.

[0073] Figure 4 FIG. 2 shows a schematic diagram of a user verification process based on pre-registration and streaming media according to some embodiments of the present disclosure. Figure 4 As shown, at 401, when the user signs a contract, he can sign the contract offline by using his biometric information, i.e., the first biometric identification information (bio0) and the telephone number; for example, digital biometric collection (face, voiceprint, fingerprint, iris, etc.) is performed in a telecommunications business hall; the telecommunications operator can store the contract information in an out-of-band manner in an identification information management network element in the core network, such as a Home Subscriber Server or UDM; at the same time, the identification information network element can obtain the biometric detection capabilities of users of other network elements and terminal devices through network-side capabilities, and can synchronize related detection capability configuration strategies between different terminal devices and network elements Network Function.

[0074] In some embodiments, the first terminal device 110 initiates 402 a call request 403 to the network side, carrying the user's calling number and the called party number. The second network device 120 receives 404 the calling user call request 403, and sends 405 a contract query request to the first network device 121 according to the calling number to query the user's contract information. The first network device 121 queries 408 the pre-stored calling party biometric identification information corresponding to the calling number, that is, the first biometric identification information (bio0), based on the calling number and the information pre-stored at 401. If relevant information is queried, the first biometric identification information (bio0) is carried in the reply contract query response 410; otherwise, a query error message is replied. The second network device 120 sends an indication message 413 to the third network device 122 based on the received feature information and the pre-configured or allocated media plane network element information, indicating the biometric information detected by it. The message carries the first biometric identification information (bio0) obtained in the previous step and a verification strategy (the strategy may also be pre-configured), and may optionally carry a detection algorithm for the first biometric identification information (bio0), such as a face recognition algorithm, a voiceprint recognition algorithm, etc. The third network device 122 stores 415 the calling number and its corresponding first biometric identification information (bio0).

[0075] In some embodiments, after the control plane negotiation is completed, the user plane begins to transmit audio and video streams. The first terminal device 110 sends 416 service message 417 to the assigned third network device 122, including the original audio and video stream. The third network device 122 performs 421 network-side verification according to the previous verification strategy. Specifically, the third network device 122 directly extracts the caller's biometric information, that is, the second biometric identification information (bio1), from the media stream of 417, and then compares it with the acquired first biometric identification information (bio0). If the comparison passes, the service flow 425 426 is released to the second terminal device 111. Otherwise, the third network device 122 can directly refuse to release, or continue to release 428 service flow 429, but at the same time prompt UE2 on the video call interface that the character may be forged.

[0076] In some embodiments, the second terminal device 111 is a terminal that supports new calls, and there is an interactive "verify UE1 identity" related application / function / plug-in on the terminal, so the user of the second terminal device 111 can click on the function to actively trigger the legitimacy check of UE1 when suspecting that the user using the first terminal device 110 does not match. At this time, the third network device 122 can still perform the check according to the local policy, as described in step 421.

[0077] In addition, the third network device 122 may also send 422 a verification request 423 to the first network device 121 for verification, which carries the original stream information, or the second biometric identification information (bio1) information extracted from the original stream and the number of the first terminal device 110, and then sends it to the first network device 121, which completes the verification confirmation. Then the verification result is returned 424 to the third network device 122.

[0078] In some embodiments, the first network device 121 is an identification information management network element, the second network device 120 is a control plane network element, and the third network device 122 is a media plane network element.

[0079] Figure 5 A schematic diagram of a configuration phase verification capability configuration process according to some embodiments of the present disclosure is shown. Figure 5 The embodiment shown details how to achieve alignment of biometric detection capabilities between terminal devices and networks, corresponding to Figure 4 The following figure shows the configuration strategy of the detection capability related to synchronization between network elements NF.

[0080] like Figure 5 As shown, at 501, when the user signs the contract, the user can choose to encrypt and store the biometric information offline, i.e., the first biometric identification information (bio0), and can choose to store the user's signed permanent equipment identification / international mobile equipment identification Permanent Equipment Identifier / International Mobile.Equipment Identitynumber information on the network side, so that the network side can know the feature recognition capabilities supported by the terminal device and formulate corresponding anti-counterfeiting verification strategies. The feature recognition capability refers to which one or more of the biometric recognitions such as "finger, voice, face, and rainbow" supported by the terminal device.

[0081] In some embodiments, the first network device receives a registration request message from a first terminal device, and the registration request message includes identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device, that is, the registration request message may carry both the feature recognition capability information of the first terminal device and the anti-counterfeiting verification capability information of the first terminal device, or may carry only one of the two.

[0082] In response to the first network device storing the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device, verify whether the stored feature recognition capability information and / or the anti-counterfeiting verification capability information match the feature recognition capability information and the anti-counterfeiting verification capability information carried in the registration request message; and send a registration request response to the first terminal device, wherein the registration request response includes the anti-counterfeiting verification policy corresponding to the first terminal device. Alternatively, in response to the first network device not storing the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device recorded by the first network device, store the identification information of the first terminal device, the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device carried in the registration request message.

[0083] In addition, if the registration request message does not include the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device, the registration request response includes a default anti-counterfeiting verification policy.

[0084] The anti-counterfeiting verification strategy can be: network side, terminal side, network + terminal side and / or no verification (compatible with old network + old terminal). That is, the anti-counterfeiting verification strategy is various combinations of the above four situations. For example, it can be one of the above four situations, or a combination of two of them, a combination of three of them, or all four situations.

[0085] As described above, the terminal device can carry "feature recognition capability" and / or "anti-counterfeiting verification capability" in the registration request message. At this time, the network side can allocate different anti-counterfeiting verification strategies to the terminal according to its own pre-configured overall anti-counterfeiting verification strategy, for example:

[0086] 1. When the terminal reports both "feature recognition capability" and "anti-counterfeiting verification capability", the network's anti-counterfeiting verification strategy for the terminal can be: network side, terminal side, network + terminal side, neither verification, and terminal side verification as the main method;

[0087] 2. When the terminal only reports "feature recognition capability", the network's anti-counterfeiting verification strategy for the terminal can be: network side, no verification. At this time, since the terminal itself cannot prove clear anti-counterfeiting verification capability information (for example, there is no new call contract), the verification is mainly based on the network side;

[0088] 3. When the terminal only reports "anti-counterfeiting verification capability", the network's anti-counterfeiting verification strategy for the terminal can be: network side, network + terminal side, no verification, and network side verification is the main method. The terminal side can only make verification requests and may not have hardware support for local verification (missing or damaged);

[0089] 4. When the terminal does not report "feature recognition capability" and "anti-counterfeiting verification capability", the network's anti-counterfeiting verification strategy for the terminal can be: network side, no verification, and mainly no verification.

[0090] Specifically, Figure 5 As shown, the first terminal device 110 sends 502 a registration request message 503 to the first network device 121, which includes the terminal device ID, feature recognition capability, and anti-counterfeiting verification capability (for example, whether the terminal can verify biometric information). At 505, if the first network device 121 already has relevant information, it verifies whether it matches (machine model, supported capabilities), otherwise it records the corresponding information of the terminal device ID, and issues the verification policy corresponding to the UE according to the preset anti-counterfeiting verification policy. The first network device 121 sends a registration request response 507 to the first terminal device 110, which includes the anti-counterfeiting verification policy. The first network device 121 sends the verification policy synchronization to the third network device 122, which includes the terminal device ID and the anti-counterfeiting verification policy.

[0091] In some embodiments, the first network device 121 sends a media plane network device discovery request message to the fourth network device 530. The media plane network device discovery request message includes anti-counterfeiting verification capability. The first network device 121 receives a media plane network device discovery response message from the fourth network device, and sends an anti-counterfeiting verification policy to the third network device.

[0092] Specifically, Figure 5 As shown, the third network device 122 sends 512 a network element registration message 511 to the fourth network device 530, including the NF ID and the anti-counterfeiting verification capability. The first network device 121 sends 513 a media plane network element discovery request 514 to the fourth network device 530, including the NF type and the anti-counterfeiting verification capability. The fourth network device 530 sends 516 a media plane network element discovery response 517, including the NF ID. The first network device 121 sends 519 a default verification policy 520 to the third network device 122.

[0093] In some embodiments, the terminal-side anti-counterfeiting verification strategy is different for different models. For example, a mobile phone that does not support the new call function can only use the network-side verification mechanism; if it is a mobile phone that supports the new call function, it can support the new call interactive verification function. In some embodiments, the anti-counterfeiting verification capability of the third network device 122 needs to be reported to the fourth network device 530 during the network element registration stage, and then the UDM queries and obtains it from the fourth network device 530.

[0094] In some embodiments, the first network device 121 is an identification information management network element, the second network device 120 is a control plane network element, the third network device 122 is a media plane network element, and the fourth network device 530 is a network function management network element.

[0095] Figure 6 A schematic diagram of an abnormal prompt process in business interaction according to some embodiments of the present disclosure is shown. Figure 6 The embodiment shown is Figure 4 A refinement of the last described branch flow in the illustrated embodiment.

[0096] like Figure 6 As shown, at 601, the network side has learned about the UE model, supported biometric verification capabilities, and anti-counterfeiting verification strategy (this strategy includes a specific verification prompt method for the terminal device).

[0097] In some embodiments, when the terminal device supports interactive new calls, it can actively trigger a verification request for the suspected caller, and provide a verification result prompt (abnormal or normal) through various methods such as screen display, text message, pop-up window, etc.; at this time, the prompt information is based on Figure 5 The anti-counterfeiting verification strategy of the embodiment shown is uniformly configured. Specifically, Figure 6 As shown, the first terminal device 110 sends 602 a service message 603 to the third network device 122. The third network device 122 sends 602 a service message 604 to the second terminal device 111. At 605, the recipient, that is, the second terminal device 111, suspects that the first terminal device does not match the person and applies for verification through interactive operation. The second terminal device 111 sends 607 a verification request 608 to the third network device 122, which includes the ID of the first terminal device. At 610, the third network device 122 extracts the second biometric identification information (bio1) from the subsequent service message and compares it with the existing first biometric identification information (bio0). In some embodiments, the third network device 122 may also send a bio check 611 to the first network device 121, which includes the second biometric identification information (bio1) and the ID of the first terminal device. The first network device 121 returns the verification result to the third network device 122. The third network device 122 sends 613 a verification result 614 (e.g., a screen prompt) to the second terminal device 111.

[0098] In some embodiments, when the terminal device does not support interactive new calls, anti-counterfeiting verification can only be performed in advance through the network side. When the verification fails, the service information can be ignored as usual, but the user can be reminded of the abnormality through SMS or pop-up window; at the same time, the service message can be directly not ignored, but the verification abnormality message can be directly prompted. Specifically, Figure 6As shown, the first terminal device 110 sends 616 a service message 617 to the third network device 122, including the original stream / feature stream. At 619, the third network device 122 extracts the second biometric identification information (bio1) from the service message and compares it with the existing first biometric identification information (bio0). When the verification is successful, the third network device 122 sends a service message 621 to the second terminal device 111, including the original stream. When the verification fails, a verification prompt message 624 (e.g., SMS, pop-up window) is sent to the second terminal device 111.

[0099] In some embodiments, the first network device 121 is an identification information management network element, the second network device 120 is a control plane network element, and the third network device 122 is a media plane network element.

[0100] Figure 7 A schematic diagram of a process of a terminal reporting biometric identification information according to some embodiments of the present disclosure is shown. Figure 7 The embodiment shown is Figure 4 The difference between the embodiments shown is that the scenario shown may be applicable to situations where the terminal device desires high-strength privacy, and its second biometric identification information (bio1) and third biometric identification information (bio2) are encrypted and incomplete. In this scenario, it can be guaranteed that the user who initiates the service and the user who executes the service are the same, but it cannot be guaranteed that the user is the user who signed the contract, so the identification information management network element saves the second biometric identification information (bio1) obtained for the first time.

[0101] like Figure 7 As shown, at 701, when the user signs the contract, the user's biometric information, the first biometric identification information (bio0), is not stored. The first terminal device 110 sends 702 a service request message 703 to the second network device 120, which includes the number of the user of the first terminal device 110 and the second biometric identification information (bio1). The second network device 120 sends 705 a contract query request 706 to the first network device 121, which includes the above number and the second biometric identification information (bio1). At 708, if it is the first contract query request, the relationship between the number of the first terminal device 110 and the second biometric identification information (bio1) is saved. If it is not the first contract query request, the second biometric identification information (bio1) in the query message is queried to see if it matches the stored bio. Optionally, the first network device sends allocation information 709 to the third network device 122, which includes the second biometric identification information (bio1), and optionally includes a corresponding detection algorithm.

[0102] In some embodiments, the first network device 121 sends 711 a contract query response 711 to the second network device 120, including the second biometric identification information (bio1). The second network device 120 sends 714 an indication detection message to the third network device 122, including the second biometric identification information (bio1) and optionally a detection algorithm.

[0103] In some embodiments, the first terminal device 110 sends 716 a service message 717 to the third network device 122, which includes the ID of the first terminal device and the third biometric identification information (bio2). At 719, the third network device 122 compares the second biometric identification information (bio1) and the third biometric identification information (bio2), and generates a media stream based on the third biometric identification information (bio2), and an optional signature. The third network device 122 sends 720 a service message 721 to the second terminal device 111, which includes the ID of the first terminal device and the generated media stream.

[0104] In some embodiments, the first network device 121 is an identification information management network element, the second network device 120 is a control plane network element, and the third network device 122 is a media plane network element.

[0105] Figure 8 A schematic diagram of a process for obtaining biometric identification information through an authority according to some embodiments of the present disclosure is shown. Figure 8 The embodiment shown is Figure 4 Another branching situation of the control plane of the illustrated embodiment has the following specific differences: it includes a fifth network device 830. In some embodiments, the fifth network device 830 may be an authoritative identity authentication device, which may be inside the network or outside the network.

[0106] In some embodiments, the first verification request message includes a subscriber identification number of the first terminal device, a second biometric information of the user collected by the first terminal device, and a verification identifier. In response to the first network device 121 not storing the second biometric information, or the stored biometric information does not match the second biometric information, the second biometric information is verified based on communication with the fifth network device. Wherein verifying the second biometric information based on communication with the fifth network device includes: sending a verification identifier to the fifth network device, and when the verification is passed at the fifth network device, receiving the third biometric information corresponding to the second biometric information, storing the relationship between the first terminal device and the second biometric information and the third biometric information, and sending a verification response message to the second network device. In some embodiments, the second biometric information and the third biometric information are sent encrypted.

[0107] Specifically, Figure 8As shown, at 801, when the user signs a contract, the user biometric information of the first terminal device that is not stored is shared with the authoritative identity institution, and the authoritative identity institution assigns a verification identification to the user. The first terminal device 110 sends 802 a service request message 803 to the second network device 120, which includes the number of the first terminal device, the second biometric identification information (bio1) and the verification identification. The second network device 120 sends a second biometric identification information (bio1) verification request 805 to the first network device 121, which includes the number of the first terminal device, the second biometric identification information (bio1) and the verification identification. At 808, the first network device 121 queries whether the first terminal device has a stored second biometric identification information (bio1). If it is not stored, or the stored second biometric identification information (bio1)'≠ the second biometric identification information (bio1), the second biometric identification information (bio1) needs to be verified according to the verification identification information. The first network device 121 sends verification information 809 of the second biometric identification information (bio1) to the fifth network device 830. In some embodiments, the verification information may include only the verification identifier, and the fifth network device 830 returns the third biometric identification information (bio2). Alternatively, the verification information may also send the second biometric identification information (bio1) and the verification identifier at the same time, and the fifth network device only returns the result of whether it is legal.

[0108] In some embodiments, the third biometric information (bio2) is a desensitized biometric feature, which can be a biometric feature specifically used to generate a digital human image (but it may not be possible to reversely deduce the user's real biometric information), or it can be directly a digital human image that has been generated.

[0109] In some embodiments, at 811, the first network device 121 stores the relationship between the first network device 110 and the second biometric identification information (bio1)\third biometric identification information (bio2) after the above verification is passed. Optionally, the first network device 121 sends allocation information 812 to the third network device 122, which includes the third biometric identification information (bio2). The first network device 121 sends a bio verification response 815 to the second network device 120. The second network device 120 sends a service request response 818 to the first terminal device 110, which includes media plane network element information.

[0110] In some embodiments, the first network device 121 is an identification information management network element, the second network device 120 is a control plane network element, and the third network device 122 is a media plane network element.

[0111] Through the above embodiments, the technical solution of the present application realizes the anti-counterfeiting verification of the real user and his digital human image on the network side and the terminal side by combining the information of the biometric identification in the business process, and the biometric representation information can be transmitted in the channel through encryption, which will not cause privacy leakage. Specifically, the identification information management network element can complete the verification (presetting, authority, terminal reporting) and storage of the second biometric identification information (bio1) of the user's biometric information, and send the encrypted second biometric identification information (bio1) information to the media plane network element; or assist it to complete the verification, and comprehensively configure the anti-counterfeiting verification strategy of the terminal equipment and NF. The control plane network element can initiate a second biometric identification information (bio1) verification request. The media plane network element can verify whether UE1 is a real user based on the second biometric identification information (bio1) issued by the contract information network element and combined with the extracted third biometric identification information (bio2) information. It can also perform the first message verification according to the strategy, real-time continuous verification, and UE2 trigger verification. The media plane network element can also generate a safe and reliable digital human image based on the third biometric identification information (bio2) information, and provide verification capabilities. The terminal device initiating the call can provide the encrypted biometric information second biometric identification information (bio1) to achieve anti-counterfeiting. The called terminal device can actively verify whether the generated digital human image is legal, and according to its own capabilities, actively trigger the verification process, or receive verification information from the network side. The terminal device can also receive the anti-counterfeiting verification strategy configured on the network side.

[0112] Fig. 9 A block diagram of a method in a first network device according to some embodiments of the present disclosure is shown. In block 910, the first network device obtains first biometric identification information of a user of a first terminal device. In block 920, the first network device sends the first biometric identification information to a second network device or a third network device based on a first verification request message for verifying a user received from a second network device. Thus, verification of the user can be implemented on the network side.

[0113] In some embodiments, the method further includes: determining that the first network device does not store the first biometric identification information; the first network device obtaining the first biometric identification information of the user of the first terminal device includes: receiving a first verification request message for verifying the user from the second network device, the verification request message carrying the first biometric identification information; and storing the first biometric identification information. Thus, in the absence of the first biometric identification information, the biometric identification information can be obtained from the user device, which increases the flexibility of obtaining the biometric identification information.

[0114] In some embodiments, the method further includes: determining that the first network device stores the first biometric identification information; and the first network device obtaining the first biometric identification information of the user of the first terminal device includes: obtaining the first biometric identification information of the user of the first terminal device from the stored first biometric identification information. Thus, the stored biometric identification information can be used in the verification process.

[0115] In some embodiments, the first verification request message includes the identifier of the first terminal device, the second biometric identification information of the user collected by the first terminal device, and the verification identifier, and the method further includes: in response to the first network device not storing the second biometric identification information, or the stored biometric identification information does not match the second biometric identification information, verifying the second biometric identification information through a fifth network device. Thus, the biometric identification information can be verified by a third party, which increases the flexibility of verification.

[0116] In some embodiments, verifying the second biometric information through the fifth network device includes: sending a verification identifier to the fifth network device, the verification identifier is used to verify the second biometric information; if the verification is passed at the fifth network device, receiving the third biometric information corresponding to the second biometric information; storing the relationship between the first terminal device and the second biometric information and the third biometric information; and sending verification response information to the second network device. In this way, the biometric information can be verified and sent through a third party, which increases flexibility.

[0117] In some embodiments, the second biometric identification information and the third biometric identification information are encrypted and then sent, thereby protecting user privacy.

[0118] In some embodiments, verifying the second biometric information through the fifth network device includes: sending the second biometric information and a verification identifier to the fifth network device, the verification identifier being used to verify the second biometric information; receiving a verification result from the fifth network device; and sending verification response information to the second network device. Thus, the biometric information can be verified through a third party, increasing flexibility.

[0119] In some embodiments, it also includes: receiving a registration request message from a first terminal device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device; in response to the first network device storing feature recognition capability information of the first terminal device and / or anti-counterfeiting verification capability information of the first terminal device, verifying whether the stored feature recognition capability information and / or anti-counterfeiting verification capability information match the feature recognition capability information and / or anti-counterfeiting verification capability information carried in the registration request message; and sending a registration request response to the first terminal device, wherein the registration request response includes the anti-counterfeiting verification policy corresponding to the first terminal device. Thus, the anti-counterfeiting verification policy can be determined at the registration request stage, thereby accurately determining the verification method.

[0120] In some embodiments, it also includes: receiving a registration request message from a first terminal device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device; in response to the first network device not storing the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device recorded by the first network device, storing the identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or the anti-counterfeiting verification capability information of the first terminal device carried in the registration request message; and sending a registration request response to the first terminal device, wherein the registration request response includes the anti-counterfeiting verification strategy corresponding to the first terminal device. Thus, the verification capability can be stored and the anti-counterfeiting verification strategy can be determined in the registration request stage, thereby accurately determining the verification method.

[0121] In some embodiments, the method further includes: receiving a registration request message from a first terminal device, the registration request message not including feature recognition capability information of the first terminal device and / or anti-counterfeiting verification capability information of the first terminal device; and sending a registration request response to the first terminal device, wherein the registration request response includes a default anti-counterfeiting verification policy. Thus, the default verification policy can be sent to the terminal, thereby ensuring that the terminal obtains the anti-counterfeiting verification policy.

[0122] In some embodiments, the method further includes: sending a verification policy synchronization message to a third network device, wherein the verification policy synchronization message includes the anti-counterfeiting verification policy. Thus, the anti-counterfeiting verification policy can be sent to the third network device, thereby achieving the distribution of the anti-counterfeiting verification policy.

[0123] In some embodiments, the method further includes: sending a media plane network device discovery request message to a fourth network device, the media plane network device discovery request message including anti-counterfeiting verification capability; receiving a media plane network device discovery response message from the fourth network device; and sending an anti-counterfeiting verification policy to the third network device. Thus, the anti-counterfeiting verification policy can be registered.

[0124] In some embodiments, the anti-counterfeiting verification strategy is associated with the functions supported by the first terminal device, and the anti-counterfeiting verification strategy includes: network side verification; terminal side verification; network + terminal side verification; and / or no verification on both the network side and the terminal side. Thus, multiple verification methods can be implemented.

[0125] In some embodiments, the first verification request message includes an identifier of the first terminal device, and the method further includes: querying the stored first biometric identification information based on the identifier of the first terminal device. Thus, the biometric identification information can be queried through the terminal device identifier.

[0126] In some embodiments, the method further includes: receiving a second verification request message from a third network device, the second verification request message including: original information of the service information or second biometric information obtained from the original information and an identification of a user of the first terminal device used to verify the second biometric information; and sending a verification response to the third network device. Thus, the biometric information can be verified during the service process to improve security.

[0127] Fig.10 A block diagram of a method in a second network device according to some embodiments of the present disclosure is shown. In block 1010, the second network device receives a service request message from a first terminal device. In block 1020, the second network device sends a first verification request message for verifying a user of the first terminal device to the first network device based on the received service request message. In block 1030, the second network device receives a first verification response message for the first verification request message from the first network device. Thus, the corresponding message of the user verification can be processed in the second network device.

[0128] In some embodiments, the first verification response message includes first biometric information of a user of the first terminal device, and the method further includes: sending the first biometric information and / or a detection algorithm to a third network device, the first biometric information being used to verify the user of the first terminal device. Thus, the biometric and the verification algorithm can be sent to the third network device to achieve verification flexibility.

[0129] In some embodiments, the first verification request message and the first verification response message include the collected second biometric identification information, and the method further includes: sending the second biometric identification information to a third network device, the second biometric identification information being used to verify the user of the first terminal device. Thus, the biometric identification can be sent to the third network device.

[0130] In some embodiments, the first verification request message includes the collected second biometric identification information and the verification identification. Thus, the verification request message may carry the corresponding biometric identification and the verification identification.

[0131] Fig.11 A block diagram of a method in a third network device according to some embodiments of the present disclosure is shown. In box 1110, the third network device receives the first biometric identification information of the user of the first terminal device from the first network device or the second network device. In box 1120, the third network device obtains the second biometric identification information from the service message based on the service message received from the first terminal device. In box 1130, the third network device verifies the user based on the first biometric identification information and the second biometric identification information. Thus, the user can be verified through the biometric identification information.

[0132] In some embodiments, the method further includes: storing the identification of the first terminal device and the first biometric identification information. Thus, the network device stores the corresponding information.

[0133] In some embodiments, the method further includes: sending a second verification request message to the first network device, the second verification request message including original information of the service message or second biometric identification information and an identification of a user of the first terminal device; and receiving a second verification response message for the second verification request from the first network device. Thus, the user can be verified through the first network device.

[0134] In some embodiments, the method further includes: in response to the verification failing, sending verification prompt information indicating that the user's verification failed to the second terminal device. Thus, the user can receive the prompt information.

[0135] In some embodiments, the method further includes: receiving an anti-counterfeiting verification policy for the first terminal device from the first network device. Thus, the anti-counterfeiting verification policy can be received and the distribution of the anti-counterfeiting verification policy can be achieved.

[0136] In some embodiments, the method further includes: in response to the verification being successful, generating and signing a media stream based on the second biometric identification information; and sending the media stream and the signature to the second terminal device. Thus, the media stream can be signed to improve security.

[0137] In some embodiments, the method further includes: receiving third biometric identification information from the first network device, wherein the third biometric identification information is provided by the fifth network device and corresponds to the second biometric identification information. Thus, the biometric identification information can be obtained through a third party.

[0138] Fig.12 A block diagram of a method in a first terminal device according to some embodiments of the present disclosure is shown. In block 1210, the first terminal device sends a service request message to a second network device, wherein the service request message includes first biometric identification information of a user of the first terminal device. Thus, the terminal sends the biometric identification information.

[0139] In some embodiments, the method further includes: sending a registration request message to the second network device, the registration request message including the identification information of the first terminal device, the feature recognition capability information of the first terminal device, and the anti-counterfeiting verification capability information of the first terminal device; and receiving a registration request response from the first network device, wherein the registration request response includes the anti-counterfeiting verification policy corresponding to the first terminal device. Thus, the terminal obtains the anti-counterfeiting verification policy.

[0140] In some embodiments, the service request message includes the identification of the first terminal device, the second biometric identification information of the user collected by the first terminal device, and the verification identification. Thus, the collected identification information and verification identification are sent through the message.

[0141] Fig.13 A block diagram of a method at a second terminal device according to some embodiments of the present disclosure is shown. In block 1310, the second terminal device sends a second verification request message for verifying a user of the first terminal device to a third network device. In block 1320, the second terminal device receives a second verification response message for the second verification request message from the third network device. Thus, a verification result can be received.

[0142] In some embodiments, the method further includes: receiving verification prompt information from a third network device, wherein the verification prompt information indicates that the user verification has not passed. Thus, the corresponding verification prompt information can be received.

[0143] Fig.14 1 shows a block diagram of an electronic device 1400 capable of implementing multiple embodiments of the present disclosure. The device 1400 may be used to implement the following Figure 1 The first terminal device 110 and the second terminal device 111, the first network device 120, the second network device 121 and the third network device 122 are shown. Fig.14 As shown, device 1400 includes one or more processors (or processing units) 1410 , may further include one or more memories 1420 coupled to processor 1410 , and may further include a communication interface 1440 coupled to processor 1410 .

[0144] The communication interface 1440 may be used to communicate with other devices or apparatuses, such as the transmission or reception of data and / or signals. The communication interface 1440 may have at least one communication interface for communication. The communication interface may include any interface necessary for communicating with other devices. Exemplarily, the communication interface may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces.

[0145] Processor 1410 may include, but is not limited to, at least one of the following: a general-purpose computer, a special-purpose computer, a microcontroller, a digital signal controller (DSP), or one or more of a controller-based multi-core controller architecture. Device 1400 may have multiple processors, such as application-specific integrated circuit chips, which are time-dependent and synchronized with a clock of a main processor.

[0146] The memory 1420 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, at least one of the following: read-only memory (ROM) 1424, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disc (CD), digital video disk (DVD), or other magnetic storage and / or optical storage. Examples of volatile memories include, but are not limited to, at least one of the following: random access memory (RAM) 1422, or other volatile memories that do not persist during the duration of a power outage.

[0147] Computer program 1430 includes computer executable instructions executed by associated processor 1410. Program 1430 may be stored in ROM 1420. Processor 1410 may perform any suitable actions and processes by loading program 1430 into RAM 1420.

[0148] The program 1430 can be used to implement the possible implementation of the present application, so that the device 1400 can execute the reference Figures 2 to 12 Any process discussed. Possible implementations of the present application may also be implemented by hardware or by a combination of software and hardware.

[0149] In some implementations, the program 1430 may be tangibly embodied in a computer-readable medium that may be included in the device 1400 (such as in the memory 1420) or other storage device accessible by the device 1400. The program 1430 may be loaded from the computer-readable medium to the RAM 1422 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc.

[0150] It should be noted that the above embodiments are some implementation methods provided by this application, which are only for the purpose of more clearly illustrating the technical solution of this application, and do not limit other embodiments of this application. In other embodiments, more or fewer processes or steps, more or fewer components, more or fewer service functions, different scheduling strategies, etc. may also be included, which are not limited here. It is known to those of ordinary skill in the art that with the evolution of network architecture and the emergence of new business scenarios, the technical solution provided by this application is also applicable to solving similar technical problems.

[0151] The embodiment of the present application also provides a chip, which may include an input interface, an output interface and a processing circuit. In the embodiment of the present disclosure, the input interface and the output interface may complete the interaction of signaling or data, and the processing circuit may complete the generation and processing of signaling or data information.

[0152] The embodiments of the present application also provide a chip system, including a processor, for supporting a computing device to implement the functions involved in any of the above embodiments. In one possible design, the chip system may also include a memory for storing necessary program instructions and data, and when the processor runs the program instructions, the device on which the chip system is installed implements the method involved in any of the above embodiments. Exemplarily, the chip system may be composed of one or more chips, and may also include chips and other discrete devices.

[0153] An embodiment of the present application further provides a processor for coupling with a memory, wherein the memory stores instructions. When the processor runs the instructions, the processor executes the methods and functions involved in any of the above embodiments.

[0154] The embodiments of the present application also provide a computer-readable storage medium on which computer instructions or program codes are stored, and when the processor runs the instructions or program codes, the processor executes the methods and functions involved in any of the above embodiments. Computer-readable media can be any tangible medium containing or storing programs for or related to instruction execution systems, devices or equipment. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or devices, or any suitable combination thereof. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrations. More detailed examples of computer-readable storage media include electrical connections with one or more wires, magnetic media (e.g., disks, floppy disks, hard disks, tapes, magnetic storage devices), optical media (e.g., optical storage devices, DVDs), semiconductor media (e.g., solid-state hard drives), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), or any suitable combination thereof, etc.

[0155] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The embodiment of the present application also provides at least one computer program product tangibly stored on a non-temporary computer-readable storage medium. The computer program product includes one or more computer executable instructions, such as instructions included in a program module, which are executed in a device on a real or virtual processor of the target to perform the process, method and function involved in any of the above embodiments. When the computer program instruction is loaded and executed on a computer, a process or function according to an embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0156] According to the method provided in the embodiment of the present application, the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer performs the process, method and function in the above-mentioned embodiment. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of program modules can be combined or divided between program modules as needed. Machine executable instructions for program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0157] The computer program code for realizing the method of the present disclosure can be written in one or more programming languages. These computer program codes can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by a computer or other programmable data processing device, causes the function / operation specified in the flow chart and / or block diagram to be implemented. The program code can be executed completely on a computer, partly on a computer, as an independent software package, partly on a computer and partly on a remote computer or completely on a remote computer or server. In the context of the present disclosure, the computer program code or related data can be carried by any appropriate carrier so that equipment, devices or processors can perform various processing and operations described above. The example of carrier includes signal, computer readable medium, etc. The example of signal can include electric, optical, radio, sound or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0158] In general, various embodiments of the present application may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be performed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that the boxes, devices, systems, techniques, or methods described herein may be implemented as, for example, non-limiting examples, hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof.

[0159] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

[0160] The above specific implementation methods further explain in detail the purpose, technical solutions and beneficial effects of the embodiments of the present application. It should be understood that the above are only specific implementation methods of the embodiments of the present application and are not used to limit the protection scope of the embodiments of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of the present application should be included in the protection scope of the embodiments of the present application.

[0161] It should be noted that although the embodiments of the present application are described above in conjunction with the accompanying drawings, the above embodiments are not independent of each other, and they can also be combined to obtain other embodiments. The division of the modes, situations, categories and embodiments in the embodiments of the present application is only for the convenience of description and should not constitute a special limitation. The features in the various modes, categories, situations and embodiments can be combined with each other in a logical manner. The various implementation methods of the present application can be combined arbitrarily to achieve different technical effects. The embodiments of the present application no longer list various combinations.

[0162] In addition, although the operation of the method of the present disclosure is described in a particular order in the accompanying drawings, this does not require or imply that these operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flow chart can change the order of execution. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution. It should also be noted that the features and functions of two or more devices according to the present disclosure can be embodied in one device. Conversely, the features and functions of a device described above can be further divided into being embodied by multiple devices.

[0163] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

Claims

1. A method comprising: The first network device obtains first biometric identification information of a user of the first terminal device; as well as Based on receiving a first verification request message for verifying the user from a second network device, the first biometric identification information is sent to the second network device or a third network device, and the first biometric identification information is used to authenticate the user of the first terminal device.

2. The method according to claim 1, further comprising: determining that the first network device does not store the first biometric identification information; The first network device obtaining the first biometric identification information of the user of the first terminal device includes: receiving a first verification request message for verifying the user from the second network device, the verification request message carrying the first biometric identification information; as well as The first biometric identification information is stored.

3. The method according to claim 1, further comprising: Determining that the first network device stores the first biometric identification information; as well as The first network device obtaining the first biometric identification information of the user of the first terminal device includes: obtaining the first biometric identification information of the user of the first terminal device from the stored first biometric identification information.

4. The method according to claim 1, wherein the first verification request message includes an identifier of the first terminal device, second biometric identification information of the user collected by the first terminal device, and a verification identifier, and the method further comprises: In response to the first network device not storing the second biometric identification information, or the stored biometric identification information does not match the second biometric identification information, the second biometric identification information is verified through a fifth network device.

5. The method according to claim 4, wherein the verifying the second biometric identification information by the fifth network device comprises: Sending the verification identifier to the fifth network device, where the verification identifier is used to verify the second biometric identification information; In a case where the verification is passed at the fifth network device, receiving third biometric identification information corresponding to the second biometric identification information; storing a relationship between the first terminal device and the second biometric identification information and the third biometric identification information; as well as Send verification response information to the second network device. 6 . The method according to claim 5 , wherein the second biometric identification information and the third biometric identification information are sent after being encrypted.

7. The method according to claim 5, wherein verifying the second biometric identification information through the fifth network device comprises: Sending the second biometric identification information and a verification identifier to the fifth network device, where the verification identifier is used to verify the second biometric identification information; receiving a verification result from the fifth network device; as well as Send verification response information to the second network device.

8. The method according to any one of claims 1 to 7, further comprising: receiving a registration request message from a first terminal device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device; In response to the first network device storing feature recognition capability information of the first terminal device and / or anti-counterfeiting verification capability information of the first terminal device, verifying whether the stored feature recognition capability information and / or anti-counterfeiting verification capability information match the feature recognition capability information and / or anti-counterfeiting verification capability information carried in the registration request message; and A registration request response is sent to the first terminal device, wherein the registration request response includes an anti-counterfeiting verification policy corresponding to the first terminal device.

9. The method according to any one of claims 1 to 7, further comprising: receiving a registration request message from a first terminal device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and / or anti-counterfeiting verification capability information of the first terminal device; In response to the first network device not storing the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device recorded by the first network device, storing the identification information of the first terminal device, the feature recognition capability information of the first terminal device and / or the anti-counterfeiting verification capability information of the first terminal device carried in the registration request message; as well as A registration request response is sent to the first terminal device according to the registration request message, wherein the registration request response includes an anti-counterfeiting verification policy corresponding to the first terminal device.

10. The method according to any one of claims 1 to 7, further comprising: receiving a registration request message from a first terminal device, wherein the registration request message does not include feature recognition capability information of the first terminal device and anti-counterfeiting verification capability information of the first terminal device; as well as A registration request response is sent to the first terminal device, wherein the registration request response includes a default anti-counterfeiting verification policy.

11. The method according to claim 8 or 9, further comprising: A verification policy synchronization message is sent to the third network device, where the verification policy synchronization message includes the anti-counterfeiting verification policy.

12. The method according to claim 8 or 9, further comprising: Sending a media plane network device discovery request message to a fourth network device, wherein the media plane network device discovery request message includes the anti-counterfeiting verification capability; receiving a media plane network device discovery response message from the fourth network device; and The anti-counterfeiting verification policy is sent to the third network device.

13. The method according to any one of claims 8 to 12, wherein the anti-counterfeiting verification strategy is associated with a function supported by the first terminal device, and the anti-counterfeiting verification strategy comprises: Network side verification; Terminal side verification; Network and terminal side verification; and / or Neither the network side nor the terminal side is verified.

14. The method according to any one of claims 1 to 13, wherein the first verification request message includes an identification of the first terminal device, and the method further comprises: Based on the identification of the first terminal device, query the stored first biometric identification information.

15. The method according to any one of claims 1 to 14, further comprising: receiving a second verification request message from the third network device, the second verification request message including original information of the service information or second biometric identification information obtained from the original information and an identifier of a user of the first terminal device used to verify the second biometric identification information; as well as A verification response is sent to the third network device.

16. A method comprising: The second network device receives a service request message from the first terminal device; Based on receiving the service request message, sending a first verification request message for verifying a user of the first terminal device to the first network device; as well as A first authentication response message is received from the first network device in response to the first authentication request message.

17. The method according to claim 16, wherein the first verification response message includes first biometric identification information of a user of the first terminal device, and the method further comprises: The first biometric identification information and / or the detection algorithm is sent to a third network device, where the first biometric identification information is used to verify a user of the first terminal device.

18. The method according to claim 16, wherein the first verification request message and / or the first verification response message includes the collected second biometric identification information, and the method further comprises: The second biometric identification information is sent to a third network device, where the second biometric identification information is used to verify a user of the first terminal device.

19. The method according to claim 16, wherein the first verification request message includes the collected second biometric identification information and the verification identification.

20. A method comprising: The third network device receives the first biometric identification information of the user of the first terminal device from the first network device or the second network device; Based on receiving a service message from the first terminal device, obtaining second biometric identification information from the service message; as well as The user is authenticated based on the first biometric identification information and the second biometric identification information.

21. The method according to claim 20, further comprising: The identification of the first terminal device and the first biometric identification information are stored.

22. The method according to claim 20 or 21, further comprising: Sending a second verification request message to the first network device, where the second verification request message includes original information of the service message or the second biometric identification information and an identification of a user of the first terminal device; as well as A second authentication response message is received from the first network device in response to the second authentication request.

23. The method according to any one of claims 20 to 22, further comprising: In response to the verification failing, sending verification prompt information indicating that the user verification failed to the second terminal device.

24. The method according to any one of claims 20 to 23, further comprising: An anti-counterfeiting verification policy for the first terminal device is received from the first network device.

25. The method according to any one of claims 20 to 24, further comprising: In response to the verification being successful, generating and signing a media stream based on the second biometric identification information; as well as The media stream and the signature are sent to the second terminal device.

26. The method according to any one of claims 20 to 25, further comprising: Third biometric identification information is received from the first network device, wherein the third biometric identification information is provided by a fifth network device and corresponds to the second biometric identification information.

27. A method comprising: The first terminal device sends a service request message to the second network device, wherein the service request message includes first biometric identification information of a user of the first terminal device, and the first biometric identification information is used to verify the user of the first terminal device.

28. The method according to claim 27, further comprising: Sending a registration request message to the second network device, the registration request message including identification information of the first terminal device, feature recognition capability information of the first terminal device, and anti-counterfeiting verification capability information of the first terminal device; as well as A registration request response is received from the first network device, wherein the registration request response includes an anti-counterfeiting verification policy corresponding to the first terminal device.

29. The method according to claim 27 or 28, wherein the service request message includes the identifier of the first terminal device, the second biometric identifier information of the user collected by the first terminal device, and the verification identifier.

30. A method comprising: The second terminal device sends a second verification request message for verifying a user of the first terminal device to the third network device; as well as A second authentication response message is received from the third network device in response to the second authentication request message.

31. The method of claim 30, further comprising: Receive verification prompt information from the third network device, wherein the verification prompt information indicates that the user verification has failed.

32. A method comprising: The first network device obtains first biometric identification information of a user of the first terminal device; The first network device stores the first biometric identification information; The second network device receives a service request message from the first terminal device; The second network device sends, based on receiving the service request message, a first verification request message for verifying a user of the first terminal device to the first network device; as well as The first network device sends the first biometric identification information to the second network device or the third network device based on the first verification request message of the user, and the first biometric identification information is used to authenticate the user of the first terminal device.

33. The method of claim 32, further comprising: The third network device obtains second biometric identification information from the service message based on receiving the service message from the first terminal device; as well as The third network device authenticates the user based on the first biometric identification information and the second biometric identification information.

34. A system comprising: A first network device, configured to perform the method according to any one of claims 1-15; A second network device, configured to perform the method according to any one of claims 16-19; as well as The third network device is configured to execute the method according to any one of claims 20-26.

35. A computer-readable storage medium storing instructions, which, when executed by an electronic device, causes the electronic device to perform the method according to any one of claims 1-15, claims 16-19, claims 20-26, claims 27-29, or claims 30-31, or any one of claims 32-33.

36. A computer program product comprising instructions which, when executed by an electronic device, cause the electronic device to perform the method according to any one of claims 1-15, claims 16-19, claims 20-26, claims 27-29, or claims 30-31, or any one of claims 32-33.

37. A communication device, comprising: A unit or module for executing the method as described in any one of claims 1 to 15, or a unit or module for executing the method as described in any one of claims 16 to 19, or a unit or module for executing the method as described in any one of claims 20 to 26, or a unit or module for executing the method as described in any one of claims 27 to 29, or a unit or module for executing the method as described in any one of claims 30 to 31, or a unit or module for executing the method as described in any one of claims 32 to 33.

38. A communication device, comprising: A processor configured to execute the method as described in any one of claims 1-15, or configured to execute the method as described in any one of claims 16-19, or configured to execute the method as described in any one of claims 20-26, or configured to execute the method as described in any one of claims 27-29, or configured to execute the method as described in any one of claims 30-31, or configured to execute the method as described in any one of claims 32-33.

Images