Terminal identity security authentication method and system based on network link table, electronic device and storage medium

Abstract

The application provides a terminal identity security authentication method and system based on a network link table, electronic equipment and a storage medium, and relates to the fields of network technology and security. The application can effectively deal with the situation that a terminal is lost and misappropriated. Through a network link table constructed based on a special module identifier, a core network can identify the change of link information such as a base station or a WIFI network accessed by the terminal, control (such as reject) the illegal network access request in time, and prevent the security risk caused by the illegal access of the terminal to the network. The core network can make different judgments (allow, reject or temporarily not operate) on the network access request of the terminal with the change of link information according to the preset terminal state (such as lost, normal and temporarily not operated), so that the legal network access demand of the terminal taken out normally can be ensured, and the terminal can be blocked in time when the terminal is abnormal, and the fine and flexible management of the network access of the terminal is realized.

Description

Technical Field

[0001] This invention relates to the field of network technology and security, and in particular to a terminal identity security authentication method, system, electronic device, and storage medium based on a network link table. Background Technology

[0002] In specialized industry applications with high security requirements, unauthorized network access by terminals can have serious consequences. Therefore, a technology is needed to determine whether a terminal has unauthorizedly accessed the network and to effectively control such access. Summary of the Invention

[0003] Purpose of the invention: To propose a terminal identity security authentication method, system, electronic device, and storage medium based on network link table to solve the above-mentioned problems existing in the prior art.

[0004] In a first aspect, the present invention proposes a terminal identity security authentication method based on a network link table, comprising the following steps: The terminal reserves a secure storage area at the factory and writes a unique device number into it; When a terminal performs its first network access authentication, it initiates a network access request carrying the device number and constructs a link table with specific identification information of the terminal, network access device, and core network node. The core network stores the link table containing the terminal's device number, the network identifier of the network access device, and the core network node identifier, and allows the terminal to access the network. When the terminal subsequently joins the network, it initiates a network access request carrying the device number. The core network obtains the information of the current network access link, which includes the network identifier of the network access device currently connected to the network, the identifier of the corresponding core network node, and the device number of the terminal. The core network compares the information of the current access link with the stored link table; if the comparison matches, the terminal is directly authenticated and allowed to access the network; if the comparison does not match, the core network determines whether to allow the terminal to access the network based on the preset terminal status.

[0005] In a further embodiment of the first aspect, a secure storage area is reserved before the terminal leaves the factory, and the device number is written into the secure storage area.

[0006] In a further embodiment of the first aspect, the binding relationship between the device number of the network access device and the terminal follows a preset protocol standard.

[0007] In a further embodiment of the first aspect, before storing the link table, the core network first determines whether the terminal is registering for the first time; if it is registering for the first time, it executes the operation of storing the link table and allowing network access.

[0008] In a further embodiment of the first aspect, the operation corresponding to the preset terminal state includes allowing network access, denying network access, and not operating for the time being.

[0009] In a second aspect, the present invention proposes a terminal identity security authentication system based on a network link table, the system comprising a terminal, a network access device, and a core network.

[0010] The terminal is equipped with a secure storage area, which is written with a device number used to uniquely identify the terminal at the factory. The network access device is used to receive the device number carried by the terminal when the terminal joins the network, and bind its own network identifier with the core network and the terminal device number to form binding information, and transmit the binding information to the core network; The core network is used to store a link table, which includes the device number of the terminal, the network identifier of the network access device, and the core network node identifier. When a terminal subsequently joins the network, the core network obtains the information of the current network access link and compares it with the stored link table. If the comparison matches, the terminal can directly pass the identity authentication. If the comparison does not match, the core network determines whether to allow the terminal to join the network based on the preset terminal status.

[0011] In a further embodiment of the second aspect, the network access device includes a base station and a WIFI network device; the base station or WIFI network device is configured to bind to a specific device number of the terminal module through protocol standard specifications.

[0012] In a further embodiment of the second aspect, the core network device is further configured to determine whether the terminal is registering for the first time, and to perform the link table storage operation only when the terminal is registering for the first time.

[0013] A third aspect of the present invention provides an electronic device comprising: a processor and a memory storing computer program instructions; wherein the processor, when executing the computer program instructions, implements the terminal identity security authentication method based on a network link table as described in the first aspect.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium storing at least one executable instruction that, when executed on an electronic device, causes the electronic device to perform the terminal identity security authentication method based on a network link table as described in the first aspect.

[0015] Compared with the prior art, this application has the following advantages: (1) Compared with the existing terminal authentication method that only uses account and password, this solution can effectively deal with the situation where the terminal is lost or misused. By constructing a network link table based on the module's special identifier, the core network can identify changes in link information such as the base station or WIFI network accessed by the terminal, and promptly control unauthorized network access requests (such as refusing network access) to prevent the terminal from illegally accessing the network and causing security risks.

[0016] (2) The core network can make different judgments (allow, refuse or temporarily not operate) on the network access request of the terminal with changes in link information according to the preset terminal status (such as lost, normal, or temporarily not operating). This can not only ensure the legitimate network access needs of normal outings with terminals, but also block them in time when the terminal is abnormal, thus realizing refined and flexible management of terminal network access.

[0017] (3) For terminals whose link information matches the stored link table, the core network can skip the verification steps and directly pass the identity authentication, reducing unnecessary authentication steps and improving the efficiency of normal network access for terminals. Attached Figure Description

[0018] Figure 1 This is a flowchart of the terminal identity security authentication method based on the network link table in the embodiment.

[0019] Figure 2 This is an example of terminal A performing an identity security authentication method in the embodiment.

[0020] Figure 3 This is another example of terminal A performing an identity security authentication method in the embodiment. Detailed Implementation

[0021] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0022] The core idea of ​​this invention is to construct a network link table by binding the unique identifier (special device number) of the terminal module with the network link information (access network device identifier, core network node identifier, etc.) when the terminal enters the network; when the terminal enters the network subsequently, identity security authentication is achieved by comparing the consistency between the current link information and the link table.

[0023] The following embodiments are described in detail from both the method and system perspectives.

[0024] Example 1: This embodiment discloses a terminal identity security authentication method based on a network link table designed with a special identifier for the module. The specific process is detailed below. Figure 1 The steps are as follows: Step S1: Terminal module initialization – Write special device number Before leaving the factory, the manufacturer initializes and configures the built-in modules of the terminal device: The module has a pre-set independent secure storage area (such as an embedded security chip, encrypted Flash partition, etc.). This storage area has anti-tampering and anti-read characteristics and can only be accessed through a pre-set hardware interface or encrypted command. Write a specific device number into the secure storage area. This number is a globally unique identifier similar to IMEI (International Mobile Equipment Identity), and is 15-20 digits or letters long. It is generated by the manufacturer according to a preset algorithm to ensure that the number of terminals in the same batch and different batches is not duplicated. Once the special device number is written, the secure storage area is automatically locked, prohibiting subsequent modification or deletion, thus ensuring the uniqueness and stability of the identifier throughout the terminal's entire lifecycle.

[0025] Step S2: Terminal's first network access - Building the network link table When a terminal connects to the network for the first time, the following process is executed: After the terminal starts up, it reads the special device number from the module's secure storage area and carries the number in the network access request data packet to initiate a network access request to the nearby network access device (base station or WIFI network device); After receiving the request, the network access device (such as a 4G / 5G base station or a WIFI router) verifies the basic access qualifications of the terminal (such as signal legality and frequency band matching). If the verification is successful, the terminal's special device number is extracted. Network access devices bind their own network identifiers (such as the CellID of a base station, the MAC address or SSID of a WIFI device) with the special device number of the terminal to form binding information; The network access device sends the binding information and the identifier of the currently connected core network node (such as MME number, AMF number) to the core network through a preset communication protocol (such as S1AP protocol, CAPWAP protocol); After receiving the information, the core network first determines whether the terminal is registering for the first time (by querying the core network database to see if there is a record for the special device number). If it is registering for the first time, the core network associates and stores the terminal's special device number, the network identifier of the access network device, and the core network node identifier to form a complete link table record, and marks the terminal status as "normal". The core network returns an "allow access" command to the access network device, and the terminal successfully accesses the network.

[0026] Step S3: Subsequent Network Access by Terminal – Obtaining Current Link Information When a terminal is not registering with the network for the first time, the following procedure is executed: When a terminal initiates a network access request, it also carries a special device number. After receiving the request, the network access device (which may be the same or different from the one when it first joined the network) packages its own network identifier, the identifier of the currently connected core network node, and the special device number of the terminal together and sends them to the core network. The core network extracts information from the data packet to form a set of information for the current network access link, including: the terminal special device number, the network identifier of the current network access device, and the identifier of the current core network node.

[0027] Step S4: Link information comparison and authentication judgment The core network compares the current link information obtained in step S3 with the link table stored in step S2, and performs the following operations: Matching: If the network identifier and core network node identifier of the currently accessing network device completely match the records in the link table, the core network directly determines that the terminal identity is legitimate, skips the additional verification steps, and allows the terminal to quickly access the network; Inconsistency: If the current link information differs from the link table record (e.g., the terminal has connected to a new base station, changed its Wi-Fi network, or connected to a different core network node), the core network triggers an anomaly handling mechanism. The core network queries the terminal's preset status (this status can be set by the terminal user or administrator through the backend system, including three types: "normal", "lost", and "no operation for now"). If the terminal status is "normal": allow the terminal to access the network, but at the same time update the network identifier and core network node identifier of the terminal in the link table (applicable to scenarios where users change the network environment normally). If the terminal status is "lost": the core network rejects the terminal's access to the network and sends an alarm message to the preset administrator terminal (such as "Terminal number XXX attempted to access the network through an unfamiliar network and has been blocked"). If the terminal status is "No Operation for Now": the core network does not allow the terminal to enter the network and does not update the link table. At the same time, it records this abnormal access event (applicable to scenarios where the user temporarily lends out the terminal or no loss is found), and modifies the status after manual confirmation.

[0028] Example 2: This embodiment discloses a terminal identity security authentication system based on a network link table designed with a special identifier for the module. This system is used to implement the method disclosed in Embodiment 1 and includes the following components: (1) Terminal equipment Hardware structure: Includes components such as processor, communication module, secure storage area and antenna; Key features: The communication module integrates a secure storage area, which is written with a unique device number at the factory and can be read through hardware encryption. Function: After the terminal starts up, it reads the special device number through the module and carries the number in the network access request to establish communication with the network access device.

[0029] (2) Network access equipment Types include mobile communication base stations (such as 4G base station eNodeB, 5G base station gNodeB), WIFI network devices (such as wireless routers, wireless APs), etc. Function: Receive the network access request from the terminal and extract the special device number from it; Bind its own network identifier with the terminal's unique device number to generate binding information; Send the binding information and the core network node identifier to the core network; Receive the authentication result (allow / deny access) from the core network and forward it to the terminal.

[0030] (3) Core network equipment Hardware structure: including servers, databases, network switches, and security authentication modules, etc. Functional modules: Storage module: Used to store the link table, which includes fields such as terminal special device number, access network device identifier, core network node identifier, and terminal status; Verification module: Determines whether the terminal is registering for the first time (queries whether the special device number exists in the storage module); Comparison module: Compares the terminal's current network access link information with the link table in the storage module; Judgment module: Based on the comparison results and the terminal's preset status, generate instructions such as "Allow network access", "Reject network access" or "Do not operate for now"; Alarm module: When the terminal status is "lost" and link information is inconsistent, an alarm message is sent to the administrator terminal; Update module: When the terminal status is "normal" and the link information is inconsistent, update the link table record in the storage module.

[0031] See Figure 2 When a terminal performs its first network access authentication, it carries a specific identifier. When it passes through base station A and WIFI network A, base station A and WIFI network A will bind their own network identifiers with the specific identifier of the module and pass this information to the core network. The core network stores this link table information and enables the terminal to successfully access the network.

[0032] See Figure 3When a terminal moves to area B, it initiates a network access request to the core network through base station B or WIFI network B. The core network will compare the previously stored link table information and find that the link table information has changed. Based on the pre-set terminal status, whether it is lost, normal, or not operating for the time being, it will determine whether to allow the terminal to access the network or deny the terminal access.

[0033] Example 3: To more clearly illustrate the implementation process of this invention, the following describes the authentication of IoT terminals (such as smart meters) in detail as an example: (a) Terminal initialization When a smart meter leaves the factory, the manufacturer uses a dedicated device to write a special device number "SN2023050001" into the secure storage area of ​​its built-in communication module (such as an NB-IoT module). This number uniquely corresponds to this meter, and the secure storage area cannot be modified after it is locked.

[0034] (II) Initial Network Access Process The smart meter is installed in the user's home and starts up after the first power-on. It reads the special device number "SN2023050001" through the module and sends a network access request to the nearby NB-IoT base station. The request contains this number. The base station (CellID "LTE12345") receives the request, verifies the legality of the signal, and binds its own CellID with "SN2023050001" to form binding information; The base station sends the binding information and the core network AMF node identifier "AMF007" to the core network; The core network queried the database and found that there was no record for "SN2023050001" (first registration). Therefore, it associated "SN2023050001-LTE12345-AMF007" as a link table record and marked the terminal status as "normal". The core network returns a "network access allowed" command to the base station, and the smart meter successfully connects to the network and begins uploading electricity consumption data normally.

[0035] (III) Subsequent Normal Network Access Process Smart meters upload data to the network at set times every day, and the request includes "SN2023050001"; The base station “LTE12345” receives the request and sends its own CellID, AMF node identifier “AMF007” and number to the core network. The core network compares the current link information with the link table records and finds them to be completely consistent, so it directly allows network access, and the electricity meter quickly completes data upload.

[0036] (iv) Abnormal network access scenario (terminal status is "lost") If the smart meter is stolen, the user can set its status to "lost" through the management platform; The thieves installed the electricity meter in another area. After powering it on, the meter sent a network access request to the new base station (CellID "LTE67890"), carrying "SN2023050001". The new base station sends its own CellID, the AMF node identifier "AMF008" and its number to the core network; The core network comparison revealed that the current link information (LTE67890, AMF008) was inconsistent with the link table records (LTE12345, AMF007), and the terminal status was "lost". The core network triggers the alarm module, sends an alarm message to the administrator terminal, and returns a "reject network access" command to the new base station, preventing the electricity meter from accessing the network.

[0037] (v) Temporary change of scenario (terminal status is "normal") If a user moves their electricity meter to a new address due to relocation, the terminal status should be kept as "normal" through the management platform; The electricity meter connects to the new base station (CellID is "LTE54321") and initiates a network access request; The core network comparison found that the link information was inconsistent, but the terminal status was "normal", so it allowed access to the network and updated the link table to "SN2023050001-LTE54321-AMF009".

[0038] The logical ideas behind the methods disclosed in the above embodiments can be implemented, in whole or in part, through software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs.

[0039] When computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives (SSDs).

[0040] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0041] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0042] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0043] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. Although the present invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the invention itself. Various changes in form and detail may be made without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A terminal identity security authentication method based on a network link table, characterized in that, Includes the following steps: The terminal reserves a secure storage area at the factory and writes a unique device number into it; When a terminal performs its first network access authentication, it initiates a network access request carrying the device number and constructs a link table with specific identification information of the terminal, network access device, and core network node. The core network stores the link table containing the terminal's device number, the network identifier of the network access device, and the core network node identifier, and allows the terminal to access the network. When the terminal subsequently joins the network, it initiates a network access request carrying the device number. The core network obtains the information of the current network access link, which includes the network identifier of the network access device currently connected to the network, the identifier of the corresponding core network node, and the device number of the terminal. The core network compares the information of the current access link with the stored link table; if the comparison matches, the terminal is directly authenticated and allowed to access the network; if the comparison does not match, the core network determines whether to allow the terminal to access the network based on the preset terminal status.

2. The terminal identity security authentication method based on a network link table according to claim 1, characterized in that, A secure storage area is reserved before the terminal leaves the factory, and the device number is written into this secure storage area.

3. The terminal identity security authentication method based on a network link table according to claim 1, characterized in that, The binding relationship between the device numbers of the core network, network access equipment and terminals follows the preset protocol standard.

4. The terminal identity security authentication method based on a network link table according to claim 1, characterized in that, Before storing the link table, the core network first determines whether the terminal is registering for the first time; if it is registering for the first time, it executes the operation of storing the link table and allowing network access.

5. The terminal identity security authentication method based on a network link table according to claim 1, characterized in that, The preset terminal states correspond to operations including allowing network access, denying network access, and not performing any operation.

6. A terminal identity security authentication system based on a network link table, characterized in that, include: The terminal is equipped with a secure storage area, which is written with a device number used to uniquely identify the terminal at the factory. Network access device; the network access device is used to receive the device number carried by the terminal when the terminal accesses the network, and bind its own network identifier with the core network and the terminal device number to form binding information, and transmit the binding information to the core network; The core network is used to store a link table, which includes the device number of the terminal, the network identifier of the network access device, and the core network node identifier. When a terminal subsequently joins the network, the core network obtains the information of the current network access link and compares it with the stored link table. If the comparison matches, the terminal can directly pass the identity authentication. If the comparison does not match, the core network determines whether to allow the terminal to join the network based on the preset terminal status.

7. A terminal identity security authentication system based on a network link table according to claim 6, characterized in that, The network access devices include base stations and WIFI network devices; The base station or WIFI network device is configured to bind to a specific device number of the terminal module through protocol standard specifications.

8. A terminal identity security authentication system based on a network link table according to claim 6, characterized in that, The core network is also configured to determine whether a terminal is registering for the first time, and to perform the link table storage operation only when the terminal is registering for the first time.

9. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the terminal identity security authentication method based on a network link table as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on an electronic device, causes the electronic device to perform the terminal identity security authentication method based on a network link table as described in any one of claims 1 to 5.

Images