Network registration method and device and related equipment

Abstract

The present disclosure provides a network registration method, device and related equipment, which relates to the technical field of communication. The method comprises: sending a network registration request to a home network, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output includes an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identification code ciphertext and a message authentication code; receiving the network registration response returned by the home network. Through the above technical means, the problem that the quantum algorithm affects the user network registration in the prior art, resulting in that the security of the user network registration cannot be guaranteed, is solved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and particularly relates to a network access registration method, device and related equipment. BACKGROUND

[0002] With the development of quantum computing hardware and quantum algorithms, there is a huge threat to information encrypted using traditional cryptographic algorithms, especially in the network access registration scenario. If the network access registration has security risks, all subsequent communications are unsafe. How to avoid the influence of quantum algorithms on user network access registration and protect the security of user network access registration is a major research hotspot at present. SUMMARY

[0003] The present disclosure provides a network access registration method, device, electronic equipment and computer readable storage medium, which at least improves the security protection of users to a certain extent.

[0004] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0005] According to one aspect of the present disclosure, a network access registration method is provided, applied to a user side, comprising: sending a network access registration request to a home network, wherein the network access registration request carries a user hidden identifier code, the user hidden identifier code includes a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output includes an elliptic curve cryptographic algorithm public key of the user, a post-quantum ciphertext, a user identification code ciphertext and a message authentication code; receiving a network access registration response returned by the home network.

[0006] In one embodiment of the present disclosure, before the network access registration request is sent to the home network, the method further comprises: when it is determined that the protection scheme adopted to generate the user hidden identifier code is a hybrid protection scheme, determining that the protection scheme identifier is a hybrid protection scheme identifier; when it is determined that the protection scheme adopted to generate the user hidden identifier code is a post-quantum protection scheme, determining that the protection scheme identifier is a post-quantum protection scheme identifier; when it is determined that the protection scheme adopted to generate the user hidden identifier code is an elliptic curve protection scheme, determining that the protection scheme identifier is an elliptic curve protection scheme identifier; and composing the user hidden identifier code based on the protection scheme identifier, the home network public key identifier and the protection scheme output.

[0007] In one embodiment of the present disclosure, when it is determined that the protection scheme adopted for generating the user hidden identifier code is a hybrid protection scheme, the method further comprises: calculating a first key based on the elliptic curve cryptography private key of the user and the elliptic curve cryptography public key of the home network; encrypting a randomly generated second key using the post-quantum cryptography public key of the home network to obtain post-quantum ciphertext; calculating a shared key based on the first key and the second key; encrypting the user identifier code using the shared key to obtain user identifier code ciphertext, and generating a message authentication code for the user identifier code.

[0008] In one embodiment of the present disclosure, when it is determined that the protection scheme adopted for generating the user hidden identifier code is a post-quantum protection scheme, the method further comprises: encrypting a randomly generated second key using the post-quantum cryptography public key of the home network to obtain post-quantum ciphertext; encrypting the user identifier code using the second key to obtain user identifier code ciphertext, and generating a message authentication code for the user identifier code.

[0009] In one embodiment of the present disclosure, the method further comprises: obtaining encryption-related information, wherein the encryption-related information includes attribute information of the user, a service scenario, post-quantum cryptography support conditions, and a network environment; determining a security level for network access registration according to the encryption-related information; and determining a protection scheme according to the security level.

[0010] In one embodiment of the present disclosure, determining the protection scheme according to the security level comprises: when the security level is level one protection, determining the protection scheme to be a hybrid protection scheme; when the security level is level two protection, determining the protection scheme to be a post-quantum protection scheme; when the security level is level three protection, determining the protection scheme to be an elliptic curve protection scheme; and when the security level is level four protection, determining not to adopt a protection scheme.

[0011] According to another aspect of the present disclosure, a network access registration method is provided, applied to a home network side, comprising: receiving a network access registration request of a user, wherein the network access registration request carries a user hidden identifier code, the user hidden identifier code includes a protection scheme identifier, a home network public key identifier, and protection scheme output, the protection scheme output includes an elliptic curve cryptography public key of the user, post-quantum ciphertext, user identifier code ciphertext, and a message authentication code; completing network access registration of the user based on the user hidden identifier code, and returning a network access registration response to the user.

[0012] In an embodiment of the present disclosure, the network access registration of the user is completed based on the user identification code, comprising: when the protection scheme identifier is the hybrid protection scheme identifier, the user identification code is obtained by decrypting the user hidden identification code using the hybrid protection scheme; when the protection scheme identifier is the post-quantum protection scheme identifier, the user identification code is obtained by decrypting the user hidden identification code using the post-quantum protection scheme; and when the protection scheme identifier is the elliptic curve protection scheme identifier, the user identification code is obtained by decrypting the user hidden identification code using the elliptic curve protection scheme.

[0013] In an embodiment of the present disclosure, when the protection scheme identifier is the hybrid protection scheme identifier, the user identification code is obtained by decrypting the user hidden identification code using the hybrid protection scheme, comprising: querying the elliptic curve cryptography private key and the post-quantum cryptography private key of the home network according to the home network public key identifier; calculating a first key based on the elliptic curve cryptography public key of the user and the elliptic curve cryptography private key of the home network; decrypting the post-quantum ciphertext using the post-quantum cryptography private key of the home network to obtain a second key; calculating a shared key based on the first key and the second key, and decrypting the user identification code ciphertext using the shared key to obtain the user identification code.

[0014] In an embodiment of the present disclosure, when the protection scheme identifier is the post-quantum protection scheme identifier, the user identification code is obtained by decrypting the user hidden identification code using the post-quantum protection scheme, comprising: querying the post-quantum cryptography private key of the home network according to the home network public key identifier; decrypting the post-quantum ciphertext using the post-quantum cryptography private key of the home network to obtain a second key; and decrypting the user identification code ciphertext using the second key to obtain the user identification code.

[0015] In an embodiment of the present disclosure, the network access registration of the user is completed based on the user identification code, comprising: verifying whether the user identification code is complete based on the message authentication code; if the verification is passed, completing the network access registration of the user based on the user identification code; and if the verification is not passed, determining that the network access registration of the user fails.

[0016] According to still another aspect of the present disclosure, there is provided a network access registration apparatus applied to a user side, comprising: a sending module configured to send a network access registration request to a home network, wherein the network access registration request carries a user hidden identification code, the user hidden identification code comprising a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output comprising an elliptic curve cryptography public key of the user, post-quantum ciphertext, user identification code ciphertext and a message authentication code; and a first receiving module configured to receive a network access registration response returned by the home network.

[0017] According to still another aspect of the present disclosure, a network registration device is provided, applied to a home network side, comprising: a second receiving module configured to receive a network registration request of a user, wherein the network registration request carries a user hidden identifier code, the user hidden identifier code comprising a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output comprising an elliptic curve cryptography public key of the user, a post-quantum cryptogram, a user identifier cryptogram and a message authentication code; and a registration module configured to complete the network registration of the user based on the user hidden identifier code, and return a network registration response to the user.

[0018] According to still another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above network registration methods via execution of the executable instructions.

[0019] According to still another aspect of the present disclosure, a computer readable storage medium is provided, having a computer program stored thereon, the computer program being executed by a processor to implement any of the above network registration methods.

[0020] In the embodiments of the present disclosure, by carrying the post-quantum cryptogram and the user identifier cryptogram in the network registration request, the problem that the quantum algorithm affects the network registration of the user and causes the security of the network registration of the user to be not guaranteed in the prior art is solved, and the security of the network registration is guaranteed at the quantum level.

[0021] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0022] The drawings herein are incorporated into the specification and form a part of the specification, show embodiments consistent with the present disclosure, and together with the specification serve to explain the principles of the present disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0023] Figure 1 A schematic diagram showing the system architecture of the network registration method in the embodiments of the present disclosure.

[0024] Figure 2 A flowchart showing a network registration method in an embodiment of the present disclosure.

[0025] Figure 3 A flowchart showing a hybrid protection scheme encryption method in an embodiment of the present disclosure.

[0026] Figure 4 A flowchart showing a post-quantum protection scheme encryption method in an embodiment of the present disclosure.

[0027] Figure 5 A flow chart showing another onboarding method in an embodiment of the present disclosure.

[0028] Figure 6 A flow chart showing another hybrid protection scheme encryption method in an embodiment of the present disclosure.

[0029] Figure 7 A flow chart showing another post-quantum protection scheme encryption method in an embodiment of the present disclosure.

[0030] Figure 8 A schematic diagram of an onboarding device in an embodiment of the present disclosure.

[0031] Figure 9 A schematic diagram of another onboarding device in an embodiment of the present disclosure.

[0032] Figure 10 A structural block diagram of an electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations may, however, be implemented in many different forms and should not be construed as limited to the implementations set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the inventive concept to those skilled in the art. Like reference numerals refer to like elements throughout the description.

[0034] Moreover, the drawings are not necessarily to scale. Like reference numerals designate like parts throughout the specification. Some of the blocks in the drawings can be functional building blocks, and can not necessarily have a corresponding physical or logical entity in an implementation. These building blocks can be implemented in software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0035] It should be understood that each of the steps in the method implementations of the present disclosure can be performed in a different order, and / or in parallel. Additionally, the method implementations can include additional steps and / or omit performing the steps shown. The scope of the present disclosure is not limited in this regard.

[0036] It should be noted that the terms "first", "second", and so on, mentioned in the present disclosure are merely used to distinguish different apparatuses, modules or units, and are not intended to limit the order or interdependence of the functions performed by these apparatuses, modules or units.

[0037] It should be noted that the modification of "one", "multiple" mentioned in the present disclosure is illustrative but not restrictive, and those skilled in the art should understand that unless otherwise explicitly indicated in the context, it should be understood as "one or more".

[0038] It should be noted that the embodiments of the present disclosure and the technical features in the embodiments can be combined with each other without conflict.

[0039] For the convenience of understanding, the following first explains several terms related to the present disclosure as follows:

[0040] Subscription Concealed Identifier (SUCI): is a one-time use identifier, also known as a subscription hidden identifier, which contains a scheme output and additional non-hidden information required by the home network routing and protection scheme.

[0041] Subscription Permanent Identifier (SUPI): the user permanent identifier corresponds to the user concealed identifier, and the important information (such as the user identification code) in the user permanent identifier is encrypted to correspond to the user concealed identifier.

[0042] Mobile Subscriber Identification Number (MSIN): used to identify a unique user under a PLMN (Public Land Mobile Network), which together with the mobile country code (MCC) and the mobile network code (MNC) constitutes the SUPI.

[0043] Unified Data Management (UDM): responsible for the management of user identification, subscription data, authentication data, and the registration management of user service network elements.

[0044] Elliptic Curve Integrated Encryption Scheme (ECIES): a public key encryption scheme based on Elliptic Curve Cryptography (ECC).

[0045] Post-Quantum cryptography (PQC): a new generation of cryptographic algorithms that can resist quantum computing attacks on existing cryptographic algorithms, which can ensure the security of cryptographic algorithms in a quantum environment.

[0046] A MAC (Message Authentication Code) is a short block of data used to verify the integrity and authenticity of a message. It is generated by combining a message and a key, and the receiver can use the same key to verify whether the message has been tampered with. The MAC is an important tool in information security to ensure data integrity and authentication.

[0047] The specific implementation of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0048] Figure 1 A schematic diagram of a network registration method system structure in an embodiment of the present disclosure is shown, which can apply the network registration method or network registration device in various embodiments of the present disclosure.

[0049] As Figure 1 shown, the system architecture can include a user 101 and a home network 102. The user 101 can be an electronic device used by the user, including but not limited to a mobile phone, a computer, and a tablet, etc., and the home network (Home Network) refers to the network to which the user is connected by default.

[0050] Figure 2 A flowchart of a network registration method in an embodiment of the present disclosure is shown, which is applied to the user side, as Figure 2 shown, including the following steps:

[0051] S201, sending a network registration request to a home network, wherein the network registration request carries a user hidden identification code, the user hidden identification code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, the protection scheme output includes an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identification code ciphertext, and a message authentication code;

[0052] S202, receiving a network registration response returned by the home network.

[0053] The user hidden identification code is composed of a user permanent identification type, a main network identifier, a routing indication identifier, a protection scheme identifier, a home network public key identifier, and a protection scheme output. The user permanent identification type is used to mark the type of SUPI, the main network identifier is used to distinguish different networks, the routing indication identifier is used to indicate the transmission path of the network registration request in the network, the protection scheme identifier is used to distinguish the protection scheme used for encryption, and the home network public key identifier is used to distinguish the public key of the home network used by the user (the home network has multiple pairs of public key and private key).

[0054] According to the technical scheme provided by the embodiment of the present disclosure, the network access registration request is sent to the home network, wherein the network access registration request carries a user hidden identifier code, the user hidden identifier code includes a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output includes an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identifier code ciphertext and a message authentication code; and the network access registration response returned by the home network is received. Through the above technical means, the problem that the user network access registration is affected by the quantum algorithm in the prior art, and the security of the user network access registration cannot be guaranteed is solved, and the security of the network access registration is guaranteed at the quantum level.

[0055] In one embodiment of the present disclosure, when it is determined that the protection scheme adopted to generate the user hidden identifier code is a hybrid protection scheme, it is determined that the protection scheme identifier is a hybrid protection scheme identifier; when it is determined that the protection scheme adopted to generate the user hidden identifier code is a post-quantum protection scheme, it is determined that the protection scheme identifier is a post-quantum protection scheme identifier; when it is determined that the protection scheme adopted to generate the user hidden identifier code is an elliptic curve protection scheme, it is determined that the protection scheme identifier is an elliptic curve protection scheme identifier; and the user hidden identifier code is composed based on the protection scheme identifier, the home network public key identifier and the protection scheme output.

[0056] The embodiment of the present disclosure distinguishes different protection schemes through the protection scheme identifier, and uses the corresponding protection scheme for encryption and decryption in the future to meet the needs in different situations.

[0057] Figure 3 A flowchart of a hybrid protection scheme encryption method in an embodiment of the present disclosure is shown, which is applied to the user side, as shown in Figure 3 The method comprises the following steps:

[0058] S301, a first key is calculated based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network;

[0059] S302, a second key randomly generated is encrypted by using a post-quantum cryptography public key of the home network to obtain a post-quantum ciphertext;

[0060] S303, a shared key is calculated based on the first key and the second key;

[0061] S304, a user identifier code is encrypted by using the shared key to obtain a user identifier code ciphertext, and a message authentication code is generated for the user identifier code.

[0062] The hybrid protection scheme uses both ECIES and PQC encryption methods. First, a first key is calculated based on the user's elliptic curve cryptography private key and the home network's elliptic curve cryptography public key using the elliptic curve cryptography algorithm. A second key is randomly generated, and the second key is encrypted using the home network's post-quantum cryptography public key to obtain post-quantum ciphertext. The first key and the second key are XORed to obtain a shared key. The shared key is used to encrypt the user identification code to obtain user identification code ciphertext. A message authentication code is generated for the user identification code. The information is encrypted by the hybrid protection scheme in the embodiment of the present disclosure, providing double protection for network registration.

[0063] Figure 4 A flowchart of a post-quantum protection scheme encryption method in an embodiment of the present disclosure is shown, which is applied to the user side, as shown in Figure 4 The method comprises the following steps:

[0064] S401, encrypting the randomly generated second key using the home network's post-quantum cryptography public key to obtain post-quantum ciphertext;

[0065] S402, encrypting the user identification code using the second key to obtain user identification code ciphertext, and generating a message authentication code for the user identification code.

[0066] The post-quantum protection scheme uses the PQC encryption method. The second key is encrypted using the home network's post-quantum cryptography public key to obtain post-quantum ciphertext, and the user identification code is encrypted using the second key to obtain user identification code ciphertext. The information is encrypted by the post-quantum protection scheme in the embodiment of the present disclosure, ensuring communication security at the quantum level.

[0067] In an embodiment of the present disclosure, when it is determined that the protection scheme used to generate the user hidden identification code is an elliptic curve protection scheme, a first key is calculated based on the user's elliptic curve cryptography private key and the home network's elliptic curve cryptography public key; the user identification code is encrypted using the first key to obtain user identification code ciphertext, and a message authentication code is generated for the user identification code.

[0068] The elliptic curve protection scheme uses the ECIES encryption method. The information is encrypted by the elliptic curve protection scheme in the embodiment of the present disclosure, improving efficiency in the case of low communication security requirements.

[0069] In an embodiment of the present disclosure, encryption-related information is obtained, wherein the encryption-related information includes the user's attribute information, the business scenario, the post-quantum cryptography algorithm support situation, and the network environment; the security level of network registration is determined according to the encryption-related information; and the protection scheme is determined according to the security level.

[0070] The attribute information includes the occupation, gender and age of the user and the like. The business scenario is the business selected by the user when registering, the post-quantum cryptography algorithm support condition includes support and non-support, and the network environment is the current status of the network when the user registers. The higher the security level is in the attribute information, the higher the security level is; the higher the security requirement of the business scenario is, the higher the security level is; the post-quantum cryptography algorithm support condition is support, and the security level is one-level protection or one-level protection; the better the network environment is, the higher the security level is. The security level corresponding to the condition is determined through the embodiment of the disclosure, and then the protection scheme is selected, a plurality of choices are provided for encryption and decryption, and the needs of different conditions are met.

[0071] In one embodiment of the disclosure, the protection scheme is determined according to the security level, including: when the security level is one-level protection, the protection scheme is determined as a hybrid protection scheme; when the security level is two-level protection, the protection scheme is determined as a post-quantum protection scheme; when the security level is three-level protection, the protection scheme is determined as an elliptic curve protection scheme; and when the security level is four-level protection, it is determined that no protection scheme is adopted.

[0072] Figure 5 A flowchart of another network registration method in an embodiment of the disclosure is shown, which is applied to the home network side, as shown in Figure 5 The method includes the following steps:

[0073] S501, receiving a network registration request of a user, wherein the network registration request carries a user hidden identifier code, the user hidden identifier code includes a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography public key of the user, post-quantum ciphertext, user identification code ciphertext and message authentication code;

[0074] S502, completing the network registration of the user based on the user hidden identifier code, and returning a network registration response to the user.

[0075] The UDM unit can also be provided in the home network, and the above method is executed by the UDM unit.

[0076] According to the technical scheme provided by the embodiment of the disclosure, the network registration request of the user is received, wherein the network registration request carries the user hidden identifier code, the user hidden identifier code includes the protection scheme identifier, the home network public key identifier and the protection scheme output, and the protection scheme output includes the elliptic curve cryptography public key of the user, the post-quantum ciphertext, the user identification code ciphertext and the message authentication code; the network registration of the user is completed based on the user hidden identifier code, and the network registration response is returned to the user. Through the above technical means, the problem that the quantum algorithm affects the network registration of the user in the prior art, and the security of the network registration of the user cannot be guaranteed is solved, and the security of the network registration at the quantum level is guaranteed.

[0077] In an embodiment of the present disclosure, the network access registration of the user is completed based on the user hidden identifier, including: when the protection scheme identifier is a hybrid protection scheme identifier, the user hidden identifier is decrypted using a hybrid protection scheme to obtain a user identifier; when the protection scheme identifier is a post-quantum protection scheme identifier, the user hidden identifier is decrypted using a post-quantum protection scheme to obtain the user identifier; when the protection scheme identifier is an elliptic curve protection scheme identifier, the user hidden identifier is decrypted using an elliptic curve protection scheme to obtain the user identifier; and the network access registration of the user is completed based on the user identifier.

[0078] The embodiments of the present disclosure distinguish different protection schemes through the protection scheme identifier, and subsequently use corresponding protection schemes for encryption and decryption to meet the needs in different situations.

[0079] Figure 6 A flowchart of another hybrid protection scheme encryption method in an embodiment of the present disclosure is shown, which is applied to the home network side, as shown in Figure 6 The method includes the following steps:

[0080] S601, querying the elliptic curve cryptographic algorithm private key and the post-quantum cryptographic algorithm private key of the home network according to the home network public key identifier;

[0081] S602, calculating a first key based on the elliptic curve cryptographic algorithm public key of the user and the elliptic curve cryptographic algorithm private key of the home network;

[0082] S603, decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network to obtain a second key;

[0083] S604, calculating a shared key based on the first key and the second key, and decrypting the user identifier ciphertext using the shared key to obtain the user identifier.

[0084] First, the first key is calculated using the elliptic curve cryptographic algorithm based on the elliptic curve cryptographic algorithm public key of the user and the elliptic curve cryptographic algorithm private key of the home network. The second key is obtained by decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network. The shared key is obtained by performing XOR operation on the first key and the second key. The user identifier is obtained by decrypting the user identifier ciphertext using the shared key. The embodiments of the present disclosure provide double protection for the network access registration by encrypting information using the hybrid protection scheme.

[0085] In an embodiment of the present disclosure, the network access registration of the user is completed based on the user hidden identifier, including: using the main network identifier and the user identifier to form a user permanent identifier, the main network identifier including a mobile country code and a mobile network code; and completing the network access registration of the user based on the user permanent identifier.

[0086] Figure 7A flowchart of another post-quantum protection scheme encryption method in an embodiment of the present disclosure is shown, which is applied to the home network side, as shown in Figure 7 as shown, comprising:

[0087] S701, querying the post-quantum cryptographic algorithm private key of the home network according to the home network public key identifier;

[0088] S702, decrypting the post-quantum ciphertext using the post-quantum cryptographic algorithm private key of the home network to obtain a second key;

[0089] S703, decrypting the user identification code ciphertext using the second key to obtain the user identification code.

[0090] The post-quantum ciphertext is decrypted using the post-quantum cryptographic algorithm private key of the home network to obtain the second key. The user identification code ciphertext is decrypted using the second key to obtain the user identification code. The embodiment of the present disclosure encrypts information through a post-quantum protection scheme to guarantee communication security at the quantum level.

[0091] In an embodiment of the present disclosure, when it is determined that the protection scheme adopted to generate the user hidden identification code is an elliptic curve protection scheme, a first key is calculated based on the elliptic curve cryptographic algorithm public key of the user and the elliptic curve cryptographic algorithm private key of the home network, and the user identification code ciphertext is decrypted using the first key to obtain the user identification code. The embodiment of the present disclosure encrypts information through an elliptic curve protection scheme to improve efficiency in the case of low communication security requirements.

[0092] In an embodiment of the present disclosure, the user's network access registration is completed based on the user identification code, including: verifying whether the user identification code is complete based on the message authentication code; if the verification is passed, completing the user's network access registration based on the user identification code; if the verification is not passed, determining that the user's network access registration fails.

[0093] The embodiment of the present disclosure directly determines that the user's network access registration fails in the case that the message authentication code verification fails, thereby improving the efficiency of network access registration.

[0094] Based on the same inventive concept, an embodiment of the present disclosure also provides a network access registration device, as follows. Since the principle of solving problems of the device embodiment is similar to the above-mentioned method embodiment, the implementation of the device embodiment can be referred to the implementation of the above-mentioned method embodiment, and the repeated parts will not be described here.

[0095] Figure 8 A schematic diagram of a network access registration device in an embodiment of the present disclosure is shown, which is applied to the home network side, as shown in Figure 8 The network access registration device can include:

[0096] The sending module 801 is configured to send a network registration request to a home network, wherein the network registration request carries a user hidden identifier, and the user hidden identifier includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography public key of the user, post-quantum ciphertext, user identifier ciphertext, and message authentication code.

[0097] The first receiving module 802 is configured to receive a network registration response returned by the home network.

[0098] According to the technical scheme provided by the embodiments of the present disclosure, the network registration request is sent to the home network, wherein the network registration request carries the user hidden identifier, and the user hidden identifier includes the protection scheme identifier, the home network public key identifier, and the protection scheme output, and the protection scheme output includes the elliptic curve cryptography public key of the user, the post-quantum ciphertext, the user identifier ciphertext, and the message authentication code; and the network registration response returned by the home network is received. Through the above technical means, the problem that the quantum algorithm affects the user network registration and causes the security of the user network registration to be not guaranteed in the prior art is solved, and the security of the network registration is guaranteed at the quantum level.

[0099] In an optional embodiment, the sending module 801 is further configured to: when it is determined that the protection scheme used to generate the user hidden identifier is a hybrid protection scheme, determine that the protection scheme identifier is a hybrid protection scheme identifier; when it is determined that the protection scheme used to generate the user hidden identifier is a post-quantum protection scheme, determine that the protection scheme identifier is a post-quantum protection scheme identifier; and when it is determined that the protection scheme used to generate the user hidden identifier is an elliptic curve protection scheme, determine that the protection scheme identifier is an elliptic curve protection scheme identifier; and compose the user hidden identifier based on the protection scheme identifier, the home network public key identifier, and the protection scheme output.

[0100] In some embodiments, the sending module 801 is further configured to: calculate a first key based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network; encrypt a second key randomly generated by using a post-quantum cryptography public key of the home network to obtain post-quantum ciphertext; calculate a shared key based on the first key and the second key; encrypt the user identifier by using the shared key to obtain user identifier ciphertext, and generate a message authentication code for the user identifier.

[0101] In some embodiments, the sending module 801 is further configured to: encrypt a second key randomly generated by using a post-quantum cryptography public key of the home network to obtain post-quantum ciphertext; encrypt the user identifier by using the second key to obtain user identifier ciphertext, and generate a message authentication code for the user identifier.

[0102] In some embodiments, the sending module 801 is further configured to, when it is determined that the protection scheme adopted for generating the user hidden identifier code is an elliptic curve protection scheme, calculate a first key based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network; encrypt the user identifier code by using the first key to obtain user identifier code ciphertext, and generate a message authentication code for the user identifier code.

[0103] In some embodiments, the sending module 801 is further configured to obtain encryption related information, wherein the encryption related information includes attribute information of the user, a service scenario, a post-quantum cryptography algorithm support condition, and a network environment; determine a security level of the network access registration according to the encryption related information; and determine the protection scheme according to the security level.

[0104] In some embodiments, the sending module 801 is further configured to, when the security level is level one protection, determine that the protection scheme is a hybrid protection scheme; when the security level is level two protection, determine that the protection scheme is a post-quantum protection scheme; when the security level is level three protection, determine that the protection scheme is an elliptic curve protection scheme; and when the security level is level four protection, determine not to adopt the protection scheme.

[0105] Figure 9 A schematic diagram of another network access registration device in the embodiments of the present disclosure is shown, which is applied to the home network side, as shown in the figure, the network access registration device can include: Figure 9

[0106] The second receiving module 901 is configured to receive a network access registration request of a user, wherein the network access registration request carries a user hidden identifier code, the user hidden identifier code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography public key of the user, post-quantum ciphertext, user identifier code ciphertext, and a message authentication code.

[0107] The registration module 902 is configured to complete network access registration of the user based on the user hidden identifier code, and return a network access registration response to the user.

[0108] According to the technical scheme provided by the embodiments of the present disclosure, the network access registration request of the user is received, wherein the network access registration request carries a user hidden identifier code, the user hidden identifier code includes a protection scheme identifier, a home network public key identifier, and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography public key of the user, post-quantum ciphertext, user identifier code ciphertext, and a message authentication code. The network access registration of the user is completed based on the user hidden identifier code, and a network access registration response is returned to the user. Through the above technical means, the problem that the quantum algorithm affects the network access registration of the user in the prior art, resulting in that the security of the network access registration of the user cannot be guaranteed, is solved, and the security of the network access registration is guaranteed at the quantum level.

[0109] ​In some embodiments, the second receiving module 901 is further configured to, when the protection scheme identifier is the hybrid protection scheme identifier, decrypt the user hidden identifier code by using the hybrid protection scheme to obtain the user identifier code; when the protection scheme identifier is the post-quantum protection scheme identifier, decrypt the user hidden identifier code by using the post-quantum protection scheme to obtain the user identifier code; when the protection scheme identifier is the elliptic curve protection scheme identifier, decrypt the user hidden identifier code by using the elliptic curve protection scheme to obtain the user identifier code; and complete the network access registration of the user based on the user identifier code.

[0110] In some embodiments, the second receiving module 901 is further configured to query the elliptic curve cryptographic algorithm private key and the post-quantum cryptographic algorithm private key of the home network according to the home network public key identifier; calculate a first key based on the elliptic curve cryptographic algorithm public key of the user and the elliptic curve cryptographic algorithm private key of the home network; decrypt the post-quantum ciphertext by using the post-quantum cryptographic algorithm private key of the home network to obtain a second key; calculate a shared key based on the first key and the second key, and decrypt the user identifier code ciphertext by using the shared key to obtain the user identifier code.

[0111] In some embodiments, the second receiving module 901 is further configured to use the home network identifier and the user identifier code to form a user permanent identifier code, and the home network identifier includes a mobile country code and a mobile network code; and complete the network access registration of the user based on the user permanent identifier code.

[0112] In some embodiments, the second receiving module 901 is further configured to query the post-quantum cryptographic algorithm private key of the home network according to the home network public key identifier; decrypt the post-quantum ciphertext by using the post-quantum cryptographic algorithm private key of the home network to obtain a second key; and decrypt the user identifier code ciphertext by using the second key to obtain the user identifier code.

[0113] In some embodiments, the second receiving module 901 is further configured to, when it is determined that the protection scheme used to generate the user hidden identifier code is the elliptic curve protection scheme, calculate a first key based on the elliptic curve cryptographic algorithm public key of the user and the elliptic curve cryptographic algorithm private key of the home network, and decrypt the user identifier code ciphertext by using the first key to obtain the user identifier code.

[0114] In some embodiments, the second receiving module 901 is further configured to verify whether the user identifier code is complete based on the message authentication code; if the verification is passed, complete the network access registration of the user based on the user identifier code; and if the verification is not passed, determine that the network access registration of the user fails.

[0115] Those skilled in the art can understand that the various aspects of the present disclosure can be implemented as a system, a method or a program product. Therefore, the various aspects of the present disclosure can be embodied as a whole hardware implementation, a whole software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0116] The electronic device 1000 according to this embodiment of the present disclosure will be described below with reference to Figure 10 Figure 10 The displayed electronic device 1000 is merely an example and should not impose any limitation on the function and scope of use of the embodiments of the present disclosure.

[0117] As Figure 10 shown, the electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 can include, but are not limited to, the above-mentioned at least one processing unit 1010, the above-mentioned at least one storage unit 1020, and a bus 1030 connecting different system components, including the storage unit 1020 and the processing unit 1010.

[0118] The storage unit stores program code that can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification. For example, the processing unit 1010 can perform the following steps of the above-mentioned method embodiments: sending a network registration request to a home network, wherein the network registration request carries a user hidden identifier, and the user hidden identifier includes a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identification code ciphertext and a message authentication code; receiving a network registration response returned by the home network. The processing unit 1010 can also perform the following steps of the above-mentioned method embodiments: receiving a network registration request of a user, wherein the network registration request carries a user hidden identifier, and the user hidden identifier includes a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output includes an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identification code ciphertext and a message authentication code; completing the network registration of the user based on the user hidden identifier, and returning a network registration response to the user.

[0119] The storage unit 1020 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 10201 and / or a cache memory unit 10202, and can further include a read-only memory (ROM) 10203.

[0120] ​The storage unit 1020 also includes a number of program modules 10205 that are stored in the memory 10202, that include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, and each or a combination thereof, can include an implementation of a web environment.

[0121] The bus 1030 can represent one or more of several types of bus structures, including a storage unit bus or bus controller, a peripheral bus, a graphics acceleration port, a processing unit bus, or a local bus using any of a variety of bus architectures.

[0122] The electronic device 1000 can also communicate with one or more external devices 1040 such as a keyboard or pointing device, a Bluetooth device, etc.; other devices that enable a user to interact with the electronic device 1000; and / or one or more devices that enable the electronic device 1000 to communicate with one or more other computing devices. Such communication can occur via an input / output (I / O) interface 1050. Still yet, the electronic device 1000 can communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network, such as the Internet, via a network adapter 1060. As depicted, the network adapter 1060 communicates with the other components of the electronic device 1000 via the bus 1030. It should be appreciated that although the network adapter 1060 is depicted as a single component, the network adapter 1060 can comprise two or more components that work together to facilitate communications with one or more other computing devices.

[0123] Those skilled in the art will readily appreciate that the example embodiments described herein can be implemented by software and / or firmware in addition to the necessary hardware, and that the technical solutions according to the embodiments of the present disclosure can be embodied in a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the methods according to the embodiments of the present disclosure.

[0124] In the disclosed example embodiments, a computer readable storage medium is also provided, which can be a readable signal medium or a readable storage medium.

[0125] In some possible implementation manners, various aspects of the present disclosure can also be implemented as a program product, including a program code, which, when run on a terminal device, is used to cause the terminal device to perform the steps described in the above “specific implementation” section according to various exemplary embodiments of the present disclosure.

[0126] More specific examples of the computer readable storage medium in the present disclosure can include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination of the foregoing.

[0127] In the present disclosure, the computer readable storage medium can include a data signal carried in the baseband or as a part of a carrier wave, in which readable program codes are borne. Such a propagated data signal can take multiple forms, including but not limited to electro-magnetic signal, optical signal, or any appropriate combination of the foregoing. The readable signal medium can also be any readable medium that can be used to carry or store program codes for use by or in connection with an instruction execution system, apparatus or device.

[0128] Optionally, the program codes contained in the computer readable storage medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical cable, RF, or the like, or any appropriate combination of the foregoing.

[0129] In the implementation, the program codes for performing the operations of the present disclosure can be written in any combination of one or more programming languages, including an object-oriented programming language, such as Java, C++, or the like, and a conventional procedural programming language, such as the “C” language or the like. The program codes can be executed entirely on the user computing device, partly on the user device, as an independent software package, partly on the user computing device and partly on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, through an Internet service provider to connect through the Internet).

[0130] The embodiment of the present disclosure provides a computer program product or computer program, the computer program product or computer program includes computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the network registration method provided in any of the various optional manners in the embodiment of the present disclosure.

[0131] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into modules or units embodied by multiple modules or units.

[0132] In addition, although the steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired result. In addition or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be divided into multiple steps, etc.

[0133] Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

[0134] Other embodiments of the present disclosure will be apparent to those skilled in the art with the disclosure herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure following, in general, the principles of the present disclosure and including such departures from the present disclosure that come within known or customary practice in the art to which the present disclosure pertains. The specification and drawings should be considered in an illustrative rather than a restrictive sense.

Claims

1. A network access registration method, applied to the user side, characterized in that, The method comprises the following steps: sending a network registration request to a home network, wherein the network registration request carries a user hidden identifier, the user hidden identifier comprises a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output comprises an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identifier ciphertext and a message authentication code, and the home network public key identifier is used to query an elliptic curve cryptography private key and a post-quantum cryptography private key of the home network; receiving a network registration response returned by the home network; Before the step of sending the network registration request to the home network, the method further comprises the following steps: when it is determined that the protection scheme used to generate the user hidden identifier is a hybrid protection scheme, determining that the protection scheme identifier is a hybrid protection scheme identifier; calculating a first key based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network; encrypting a randomly generated second key by using a post-quantum cryptography public key of the home network to obtain the post-quantum ciphertext; calculating a shared key based on the first key and the second key; 2. The method of claim 1, wherein, encrypting a user identifier by using the shared key to obtain the user identifier ciphertext and generating the message authentication code for the user identifier. Before the step of sending the network registration request to the home network, the method further comprises the following steps: when it is determined that the protection scheme used to generate the user hidden identifier is a post-quantum protection scheme, determining that the protection scheme identifier is a post-quantum protection scheme identifier; when it is determined that the protection scheme used to generate the user hidden identifier is an elliptic curve protection scheme, determining that the protection scheme identifier is an elliptic curve protection scheme identifier; 3. The method of claim 2, wherein, composing the user hidden identifier based on the protection scheme identifier, the home network public key identifier and the protection scheme output. After the step of determining that the protection scheme used to generate the user hidden identifier is a post-quantum protection scheme, the method further comprises the following steps: encrypting the randomly generated second key by using the post-quantum cryptography public key of the home network to obtain the post-quantum ciphertext; 4. The method of claim 2, wherein, encrypting the user identifier by using the second key to obtain the user identifier ciphertext and generating the message authentication code for the user identifier. The method further comprises the following steps: obtaining encryption related information, wherein the encryption related information comprises attribute information of the user, a business scenario, post-quantum cryptography support and a network environment; determining a security level of network registration according to the encryption related information; 5. The method of claim 4, wherein, determining the protection scheme according to the security level. The step of determining the protection scheme according to the security level comprises the following steps: when the security level is first-level protection, determining that the protection scheme is the hybrid protection scheme; when the security level is second-level protection, determining that the protection scheme is the post-quantum protection scheme; when the security level is third-level protection, determining that the protection scheme is the elliptic curve protection scheme; 6. A network registration method, applied to the home network side, characterized in that, when the security level is fourth-level protection, determining not to use the protection scheme. The method comprises the following steps: Receiving a network access registration request of a user, wherein the network access registration request carries a user hidden identifier, the user hidden identifier comprising a protection scheme identifier, a home network public key identifier and a protection scheme output, the protection scheme output comprising an elliptic curve cryptography public key of the user, a post-quantum ciphertext, a user identifier ciphertext and a message authentication code; Completing network access registration of the user based on the user hidden identifier, and returning a network access registration response to the user; Wherein, completing network access registration of the user based on the user hidden identifier comprises: when the protection scheme identifier is a hybrid protection scheme identifier, decrypting the user hidden identifier by using a hybrid protection scheme to obtain the user identifier; Wherein, when the protection scheme identifier is a hybrid protection scheme identifier, decrypting the user hidden identifier by using a hybrid protection scheme to obtain the user identifier comprises: Querying the elliptic curve cryptography private key and the post-quantum cryptography private key of the home network according to the home network public key identifier; Calculating a first key based on the elliptic curve cryptography public key of the user and the elliptic curve cryptography private key of the home network; Decrypting the post-quantum ciphertext by using the post-quantum cryptography private key of the home network to obtain a second key; Calculating a shared key based on the first key and the second key, and decrypting the user identifier ciphertext by using the shared key to obtain the user identifier.

7. The method of claim 6, wherein, Completing network access registration of the user based on the user hidden identifier comprises: When the protection scheme identifier is a post-quantum protection scheme identifier, decrypting the user hidden identifier by using a post-quantum protection scheme to obtain the user identifier; When the protection scheme identifier is an elliptic curve protection scheme identifier, decrypting the user hidden identifier by using an elliptic curve protection scheme to obtain the user identifier; Completing network access registration of the user based on the user identifier.

8. The method of claim 7, wherein, When the protection scheme identifier is a post-quantum protection scheme identifier, decrypting the user hidden identifier by using a post-quantum protection scheme to obtain the user identifier comprises: Querying the post-quantum cryptography private key of the home network according to the home network public key identifier; Decrypting the post-quantum ciphertext by using the post-quantum cryptography private key of the home network to obtain the second key; Decrypting the user identifier ciphertext by using the second key to obtain the user identifier.

9. The method of claim 7, wherein, Completing network access registration of the user based on the user identifier comprises: Verifying whether the user identifier is complete based on the message authentication code; If the verification is passed, completing network access registration of the user based on the user identifier; If the verification is not passed, determining that the network access registration of the user fails.

10. A device for onboarding, applied to a user side, characterized in that, Comprises: The sending module is configured to send a network registration request to a home network, wherein the network registration request carries a user hidden identifier, and the user hidden identifier comprises a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output comprises an elliptic curve cryptography public key of a user, post-quantum ciphertext, user identifier ciphertext and a message authentication code, wherein the home network public key identifier is used to query an elliptic curve cryptography private key and a post-quantum cryptography private key of the home network; The first receiving module is configured to receive a network registration response returned by the home network; The sending module is further configured to, when it is determined that the protection scheme used to generate the user hidden identifier is a hybrid protection scheme, determine that the protection scheme identifier is a hybrid protection scheme identifier; calculate a first key based on an elliptic curve cryptography private key of the user and an elliptic curve cryptography public key of the home network; encrypt a second key generated randomly by using a post-quantum cryptography public key of the home network to obtain post-quantum ciphertext; calculate a shared key based on the first key and the second key; encrypt a user identifier by using the shared key to obtain user identifier ciphertext, and generate the message authentication code for the user identifier.

11. A device for onboarding, applied to a home network side, characterized in that, The computer program is executed by a processor to implement the network registration method in any one of claims 1-5 and 6-9. The second receiving module is configured to receive a network registration request of a user, wherein the network registration request carries a user hidden identifier, and the user hidden identifier comprises a protection scheme identifier, a home network public key identifier and a protection scheme output, and the protection scheme output comprises an elliptic curve cryptography public key of a user, post-quantum ciphertext, user identifier ciphertext and a message authentication code; The registration module is configured to complete network registration of the user based on the user hidden identifier, and return a network registration response to the user; The second receiving module is further configured to, when the protection scheme identifier is a hybrid protection scheme identifier, decrypt the user hidden identifier by using a hybrid protection scheme to obtain the user identifier; query the elliptic curve cryptography private key and the post-quantum cryptography private key of the home network according to the home network public key identifier; calculate a first key based on an elliptic curve cryptography public key of the user and an elliptic curve cryptography private key of the home network; decrypt the post-quantum ciphertext by using a post-quantum cryptography private key of the home network to obtain a second key; calculate a shared key based on the first key and the second key, and decrypt the user identifier ciphertext by using the shared key to obtain the user identifier.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the network registration method in any one of claims 1-5 and 6-9.

Images