Equipment authentication method and device based on 5G-A network, equipment and storage medium

Abstract

The invention provides an equipment authentication method and device based on a 5G-A network, equipment and a storage medium, relates to the technical field of data security, and solves the problem that an authentication scheme in the related technology is difficult to meet the dynamic security requirement of the 5G-A network. And binding is carried out according to the dynamic token and the spatial position of the access equipment to obtain corresponding space-time proof information, so that the space-time proof information obtained from the base station and the actual position of the corresponding access equipment are acquired through the server, and the space-time proof information of the access equipment is obtained based on a dynamic binding mechanism of the dynamic token and the position. According to the technical scheme, dual-source position verification is realized, the dynamic token is anchored through the block chain to verify the dynamic token, the reliability of equipment authentication is improved through dual verification, the credibility of general sensing data is ensured, and the data security in the 5G-A network is effectively improved, so that the dynamic security requirement of the 5G-A network is met.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a device authentication method and device based on a 5G-A network, an apparatus, and a storage medium. BACKGROUND

[0002] The 5G-A (5G-Advanced, 5G evolution) network realizes capability leap through technologies such as 3CC (three-carrier aggregation), all-sensing integration, passive IoT (Internet of Things), and the like. Based on this, the 5G-A network promotes global digital transformation through core technologies such as all-sensing integration, gigabit downlink rate, and trillion IoT, and is increasingly widely used in scenarios such as low-altitude economy and vehicle networking.

[0003] However, the data security of the 5G-A network in scenarios such as low-altitude economy and vehicle networking has great risks, such as difficulty in authentication of a large number of heterogeneous terminals in the use of IoT devices, authentication risks in low-latency scenarios, and security risks in all-sensing integration. For heterogeneous terminal authentication, the computing power of devices such as passive IoT tags and RedCap industrial sensors is limited (which is lower than 10MHz frequency), which cannot bear the latency requirement (more than 150ms of calculation latency) of traditional PKI certificate verification, and unmanned aerial vehicles lack tamper-proof hardware identifiers, resulting in a high rate of illegal access. For authentication in low-latency scenarios, the existing SIM authentication scheme produces 300% signaling redundancy due to frequent certificate updates, and the OBU (On board Unit, vehicle-mounted unit) device authentication latency is 50-100ms, which cannot adapt to the authentication needs of the mobility and anonymity of unmanned aerial vehicles and vehicle networking terminals, and is vulnerable to brute force attacks, leading to data leakage. In addition, the coupling of base station sensing data and communication data brought about by all-sensing integration allows attackers to brute-force static keys through quantum computing, resulting in an increased success rate of unmanned aerial vehicle trajectory forgery. Therefore, the existing authentication scheme cannot simultaneously meet the dynamic security needs of lightweight, low-latency, and quantum attack-resistant in the 5G-A network. SUMMARY

[0004] The present application provides a device authentication method and device based on a 5G-A network, an apparatus, and a storage medium, which solves the problem that the authentication scheme of the related art is difficult to meet the dynamic security needs of the 5G-A network, and the present scheme can provide a more reliable device authentication method to improve data security, thereby meeting the dynamic security needs of the 5G-A network.

[0005] In a first aspect, the application provides a device authentication method based on a 5G-A network, which is applied to an access device in a secure authentication system, the secure authentication system comprising a server, a base station device and the access device, the server being configured to authenticate an authentication request initiated by the base station device, the authentication request being a request initiated by the base station device after receiving an authentication data packet of the access device, the method comprising: generating a dynamic token based on device information of the access device, and registering the dynamic token in a blockchain; generating spatiotemporal proof information according to the dynamic token and first location information of the access device; uploading the spatiotemporal proof information and the first location information as the authentication data packet to the base station device for authentication of the access device by the base station device; in a case where it is determined that the authentication is passed, establishing a secure communication channel with the server and the base station device based on a received dynamic key.

[0006] In a second aspect, the application provides a device authentication method based on a 5G-A network, which is applied to a server in a secure authentication system, the secure authentication system comprising the server, a base station device and an access device, the access device generating a dynamic token based on device information and registering the dynamic token in a blockchain, and the access device generating spatiotemporal proof information according to the dynamic token and first location information of the access device and uploading the spatiotemporal proof information to the base station device, the method comprising: in response to receiving an authentication request sent by the base station device, analyzing the authentication request and determining authentication information of the corresponding access device, the authentication information comprising second location information detected by the base station device on the access device and spatiotemporal proof information corresponding to the access device; analyzing the spatiotemporal proof information to determine a to-be-verified token and the first location information corresponding to the access device; accessing the blockchain through a MEC node to determine a state of the to-be-verified token; verifying the first location information and the second location information to determine whether the first location information and the second location information are consistent; in a case where the to-be-verified token is in a valid state and the first location information is consistent with the second location information, determining that the access device passes the verification and establishing a secure communication channel with the access device and the base station device.

[0007] In a third aspect, the application further provides a device authentication apparatus based on a 5G-A network, which is applied to an access device in a secure authentication system, the secure authentication system comprising a server, a base station device and the access device, the server being configured to authenticate an authentication request initiated by the base station device, the authentication request being a request initiated by the base station device after receiving an authentication data packet of the access device, the apparatus comprising: The first data generation module is configured to generate a dynamic token based on device information of the access device, and register the dynamic token in a blockchain. The second data generation module is configured to generate space-time proof information according to the dynamic token and first location information of the access device. The data uploading module is configured to upload the space-time proof information and the first location information as an authentication data packet to the base station device for authentication of the access device. The first encrypted communication module is configured to, in a case where it is determined that the authentication is passed, establish a secure communication channel with the server and the base station device respectively based on the received dynamic key.

[0008] In a fourth aspect, the present application also provides a device authentication apparatus based on a 5G-A network, which is applied to a server in a security authentication system, the security authentication system including the server, a base station device and an access device, the access device generating a dynamic token based on device information and registering the dynamic token in a blockchain, and the access device generating space-time proof information according to the dynamic token and first location information of the access device and uploading the space-time proof information to the base station device, the apparatus including: The first data analysis module is configured to, in response to receiving an authentication request sent by the base station device, analyze the authentication request and determine authentication information of the corresponding access device, the authentication information including second location information detected by the base station device on the access device and space-time proof information of the corresponding access device. The second data analysis module is configured to analyze the space-time proof information to determine a to-be-verified token and first location information corresponding to the access device. The first data verification module is configured to access the blockchain through the MEC node to determine a state of the to-be-verified token. The second data verification module is configured to verify the first location information and the second location information to determine whether the first location information and the second location information are consistent. The second encrypted communication module is configured to, in a case where the to-be-verified token is in a valid state and the first location information is consistent with the second location information, determine that the access device passes the verification and establish a secure communication channel with the access device and the base station device.

[0009] In a fifth aspect, the present application also provides an electronic device, including: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the device authentication method based on the 5G-A network provided by the above-mentioned aspect.

[0010] In a sixth aspect, the present application also provides a storage medium storing computer executable instructions, which, when executed by a processor, are used to perform the device authentication method based on the 5G-A network provided in the above aspect.

[0011] The present scheme generates a dynamic token based on the device information of the access device, and binds the dynamic token and the spatial position of the access device to obtain corresponding space-time proof information, so that the server verifies the space-time proof information obtained from the base station and the actual position of the corresponding access device, and further based on the dynamic binding mechanism of the dynamic token and the position, realizes double-source position verification and verification of the dynamic token through the block chain anchoring, improves the reliability of device authentication through double verification, ensures the credibility of the sensing data, and can prevent trajectory forgery and position fraud attacks, effectively improves the data security in the 5G-A network, thereby meeting the dynamic security requirements of the 5G-A network. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 The step schematic diagram of the device authentication method provided by an embodiment of the present application.

[0013] Figure 2 The step schematic diagram of the device authentication method provided by another embodiment of the present application.

[0014] Figure 3 The information interaction schematic diagram of the security authentication system provided by an embodiment of the present application.

[0015] Figure 4 The structure schematic diagram of the device authentication apparatus provided by an embodiment of the present application.

[0016] Figure 5 The structure schematic diagram of the device authentication apparatus provided by another embodiment of the present application.

[0017] Figure 6 The structure schematic diagram of the electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0018] The present application will be further described in detail below in combination with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the embodiments of the present application, but not to limit the embodiments of the present application. In addition, it should be noted that, in order to facilitate description, only part of the structures related to the embodiments of the present application are shown in the drawings, and those skilled in the art should understand that, as long as the technical features are not contradictory, any combination of technical features can constitute an optional embodiment.

[0019] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a particular order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances to facilitate the implementation of the embodiments of the present application in an order other than that illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of a kind and do not limit the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / " generally represents an "or" relationship between the front and rear associated objects. In the description of the present application, "a plurality of" means two or more, and "several" means one or more.

[0020] The data security of 5G-A network in low-altitude economy, Internet of Vehicles and other scenarios has great risks, such as authentication difficulty of a large number of heterogeneous terminals in the use of Internet of Things devices, authentication risk in low-latency scenarios, and security risk in the integration of sensing and communication.

[0021] When a large number of heterogeneous terminals access the 5G-A network, there is a problem of authentication difficulty. Heterogeneous terminals refer to network devices produced by different manufacturers, running different protocols or operating systems, such as computers, routers, switches, etc., which are interconnected through protocol conversion or virtual networks. For example, in the field of low-altitude economy, terminals such as drones and passive Internet of Things devices are diverse, and the computing power varies greatly. For authentication of heterogeneous terminals, the computing power of devices such as passive Internet of Things tags and RedCap industrial sensors is limited (which is lower than 10MHz frequency), and cannot bear the time delay requirement (requires more than 150ms of calculation time delay) of traditional PKI certificate verification, and drones lack tamper-proof hardware identifiers, making it easy for terminals such as drones to illegally access, resulting in a high rate of illegal access.

[0022] For authentication in low-latency scenarios, the existing SIM authentication scheme generates 300% signaling redundancy due to frequent certificate updates, and the OBU device authentication delay reaches 50-100ms, which cannot adapt to the authentication requirements of the mobility and anonymity of drones and Internet of Vehicles terminals, and is vulnerable to brute force attacks, leading to data leakage, data errors and other problems. For example, in the field of low-altitude economy, the above situation can easily cause the flight trajectory of the drone to be maliciously forged. Moreover, the coupling of base station sensing data and communication data caused by the integration of sensing and communication makes it possible for attackers to brute force static keys through quantum computing, resulting in an increase in the success rate of drone trajectory forgery. Therefore, the existing authentication scheme cannot simultaneously meet the dynamic security requirements of lightweight, low-latency, and anti-quantum attack in 5G-A network.

[0023] To this end, the application provides a device authentication method based on a 5G-A network, which can be applied in a security authentication system including a server, a base station device and an access device. The system architecture of the security authentication system can be divided into a terminal layer, a cloud service layer and an edge collaboration layer. The access device can be a terminal such as a drone or a passive Internet of Things device. The access device belongs to the terminal layer in the system architecture. The base station device is in communication connection with the access device and the server. The base station device belongs to the cloud service layer in the system architecture. The server is used to authenticate the access device in the terminal layer. The server belongs to the edge collaboration layer in the system architecture. Specifically, the access device generates a dynamic token based on device information and registers the dynamic token in a blockchain. The access device generates spatiotemporal proof information based on the dynamic token and first location information of the access device and uploads the spatiotemporal proof information to the base station device. The server is used to authenticate an authentication request initiated by the base station device. The authentication request is a request initiated by the base station device after receiving an authentication data packet of the access device.

[0024] Figure 1 The steps of the device authentication method provided by an embodiment of the application are shown in a schematic diagram. In an embodiment, the device authentication method can be applied to an access device. The access device can generate a dynamic token and spatiotemporal proof information for device authentication, so as to facilitate device authentication. The specific steps are as follows: In step S110, a dynamic token is generated based on device information of the access device, and the dynamic token is registered in a blockchain.

[0025] The access device generates a dynamic token based on its own device information. It can be conceived that the dynamic token is associated with the device information, and different device information corresponds to different dynamic tokens, thereby realizing "one device one secret". After generating the dynamic token, the dynamic token is further registered in a blockchain for query. The blockchain is a block chain storage medium generated by a decentralized distributed database technology, which has the characteristics of non-tamperability and security and credibility. After the dynamic token is registered, the dynamic token is associated with the device information, which helps to better realize "one device one secret" in the non-tamperable blockchain.

[0026] Optionally, the access device can be a drone, a vehicle-mounted OBU device, or a RedCap sensor. For the drone, the device information includes a UAS_ID (Unmanned Aerial system ID) and a CSI (Channel State Information) as the hardware identification. For the vehicle-mounted OBU device, the device information includes a VIN (Vehicle Identification Number) and a CSI as the hardware identification. For the RedCap sensor, the device information includes a device fingerprint and a CSI as the hardware identification, wherein the device fingerprint is a technology for identifying a specific device through device features or unique identifiers, and the core includes a hardware unique identifier (such as an IMEI (International Mobile Equipment Identity), a MAC (Media Access Control) address) and a device feature set (such as a model, an operating system type) for constructing a unique identity of the device.

[0027] In an embodiment, the dynamic token is generated based on device information including a hardware identification and a channel state information, and a calculation formula for generating the dynamic token is as follows:

[0028] wherein Token is the dynamic token; Compress() is a dimension compression function, which outputs a 256-bit value; B is a lattice base matrix, is an XOR operation, H() is a hash function, V CSI is a value of the channel state information, V UAS is a value of the hardware identification, and q is a preset modulus.

[0029] It can be understood that based on the hash function, a hash value obtained by performing an XOR operation on the hardware identification and the channel state information is determined, and optionally, the selected hash function can be a SHA3-256 hash function to perform a hash operation on the result of the XOR operation. Moreover, a product value of the preset lattice base matrix and the hash value is determined, and a remainder value is obtained by performing a modulo operation on the product value according to the preset modulus, wherein the lattice base matrix is a core tool for describing the structure of the "lattice" (Lattice), and the lattice is a discrete point set generated by a combination of integers from a set of linearly independent vectors, and the lattice base matrix is an ordered set of these generating vectors. Further, the remainder value is compressed based on the dimension compression function to obtain the dynamic token.

[0030] Step S120, generating space-time proof information according to the dynamic token and the first position information of the access device.

[0031] The first position information of the access device is a spatial position detected by the access device itself, which can be represented by coordinates in a corresponding spatial coordinate system, and can also represent the current spatial position by longitude, latitude and altitude. Optionally, the first position information of the access device can be determined by a GPS (Global Positioning System) or Beidou system. It can be understood that the generated spatiotemporal proof information can bind the dynamic token with the spatial position, so that it is difficult for an attacker to tamper with the position or clone the device alone.

[0032] In an embodiment, the spatiotemporal proof information is generated based on the dynamic token and the first position information, and the calculation formula for generating the spatiotemporal proof information is as follows:

[0033] wherein Proof is the spatiotemporal proof information, Sign sk () is a function corresponding to a post-quantum digital signature algorithm, H() is a hash function, P is a positioning coordinate corresponding to the first position information, H(P) is a position feature value obtained by hashing the current positioning coordinate, Token is the dynamic token, and || is an operator corresponding to a data splicing operation.

[0034] Optionally, the selected hash function is a BLAKE3 hash function, which is a hash function based on the Merkle-Damgard structure. It processes the input data in blocks and processes each block through a compression function. For this purpose, based on the BLAKE3 hash function, the first position information is hashed to obtain a position feature value. It can be understood that the first position information is represented by a corresponding positioning coordinate, such as the coordinate in the above example representing the current spatial position of the access device in the corresponding spatial coordinate system, to obtain the corresponding position feature value by hashing. Further, the position feature value and the dynamic token are subjected to a data splicing operation to determine a splicing value after the position feature value and the dynamic token are spliced. And based on the post-quantum digital signature algorithm, the digital signature corresponding to the splicing value is determined, and the spatiotemporal proof information is generated. Optionally, the Dilithium signature algorithm can be used as the post-quantum digital signature algorithm to obtain the corresponding digital signature, thereby obtaining the spatiotemporal proof information. For example, the access device obtains the splicing value obtained after the above splicing, and then uses the post-quantum digital signature algorithm based on the public key of the other party to encapsulate (encrypt) the previously generated splicing value into a ciphertext. The receiver receives the ciphertext and uses its own private key and a corresponding decryption algorithm (also based on the post-quantum digital signature algorithm) to decrypt (unseal) the ciphertext to obtain the splicing value. This scheme binds the dynamic token with the spatial position to generate the spatiotemporal proof information, so that it is difficult for an attacker to tamper with the position or clone the device alone, which helps to improve the security of device authentication.

[0035] Step S130, upload the authentication data packet to the base station device for authentication of the access device, wherein the authentication data packet comprises the spatiotemporal proof information and the first location information.

[0036] Optionally, when the access device accesses the base station device, the access device uploads an authentication data packet to the base station device, wherein the authentication data packet comprises spatiotemporal proof information and first location information, so that the base station device can authenticate the access device in combination with the authentication data packet. It is conceivable that when the base station device receives an access request of the access device, the base station device can perceive the actual location of the access device through the radar thereon as the second location information corresponding to the access device.

[0037] Step S140, in the case of determining that the authentication is passed, establish a secure communication channel with the server and the base station device respectively based on the received dynamic key.

[0038] Optionally, after the access device passes the authentication, the access device can receive an authentication result containing a dynamic key to determine that the authentication is passed and obtain the corresponding dynamic key through the authentication result. The dynamic key is used for encrypted communication, so that when the access device communicates with the base station device and the server, the access device sends ciphertext after encrypting data. It is understood that the dynamic key can be applied to build a secure communication channel between the access device, the base station device and the server, so as to perform encrypted communication between the access device, the base station device and the server, so as to ensure the security of communication.

[0039] Figure 2 The step schematic diagram of the device authentication method provided for another embodiment of the present application is provided. In an embodiment, the device authentication method can be applied to a server. The server authenticates an access device by responding to an authentication request sent by a base station device and associated with the access device. The specific steps are as follows: Step S210, in response to receiving the authentication request sent by the base station device, parse the authentication request and determine the authentication information of the corresponding access device.

[0040] The authentication information includes the second position information detected by the base station device on the access device and the space-time proof information of the corresponding access device. It is conceivable that after receiving the access request of the access device, the base station device obtains the space-time proof information of the access device and the second position information detected by the access device, such as the actual position of the access device perceived by the radar on the base station device, which is used as the second position information of the corresponding access device. Further, the base station device initiates an authentication request to the server to authenticate the access device, such as carrying the space-time proof information and the second position information of the access device in the authentication request. The server parses the received authentication request to obtain the space-time proof information and the second position information of the access device.

[0041] Step S220, parsing the space-time proof information to determine the to-be-verified token and the first position information corresponding to the access device.

[0042] It is conceivable that the space-time proof information binds the dynamic token with the spatial position, and the server determines the dynamic token and the spatial position by parsing the space-time proof information. In order to authenticate the access device and avoid malicious tampering of data, the parsed dynamic token is used as the to-be-verified token, and the obtained spatial position is used as the first position information, so as to double-verify the access device.

[0043] Optionally, the access device selects Dilithium signature algorithm as the post-quantum digital signature algorithm to obtain the space-time proof information. In an embodiment, the server can parse the space-time proof information based on the post-quantum digital signature algorithm to determine the to-be-verified token and the first position information. It can be understood that the access device obtains the splicing value obtained by splicing the above. Then, using the post-quantum digital signature algorithm and the public key of the other party, the splicing value generated before is encapsulated (encrypted) into a ciphertext, which is received by the server as the receiving party. Using its own private key and the corresponding decryption algorithm (also based on the post-quantum digital signature algorithm), the ciphertext is decrypted (unsealed) to obtain the splicing value. The scheme binds the dynamic token and the spatial position in the space-time proof information, thereby performing device authentication, which helps to improve the security of device authentication.

[0044] Step S230, accessing the blockchain through the MEC node to determine the state of the to-be-verified token.

[0045] MEC (Multi-access Edge Computing) node is a key component in the 5G network architecture, which sinks computing power to the network edge to reduce data transmission delay and improve real-time service performance. To this end, the MEC node can be deployed on edge devices such as servers to achieve local data processing and low-latency response. The dynamic token corresponding to each device stored in the blockchain can be thought of as a dynamic token registered in the blockchain, which has a corresponding state identifier to determine whether the dynamic token is valid. To this end, the MEC node accesses the blockchain to query the token to be verified from it, and then determines the state of the token to be verified, i.e., whether the token to be verified is valid.

[0046] Step S240, verifying the first position information and the second position information to determine whether the first position information and the second position information are consistent.

[0047] Similarly, for actual positioning, the server also needs to verify the first position information and the second position information, i.e., compare the positioning coordinates corresponding to the first position information and the positioning coordinates corresponding to the second position information to determine whether they are consistent. Alternatively, in the case where the spatial coordinate system adopted by the base station device is different from the spatial coordinate system adopted by the access device, the first position information and / or the second position information are converted in coordinates, so that the positioning coordinates corresponding to the first position information and the positioning coordinates corresponding to the second position information are in the same coordinate system for comparison.

[0048] Step S250, in the case that the token to be verified is in a valid state and the first position information and the second position information are consistent, determining that the access device is verified and establishing a secure communication channel with the access device and the base station device.

[0049] In an embodiment, in the process of establishing a secure communication channel, the server generates a corresponding dynamic key to facilitate encryption and decryption of information sent or received through the dynamic key when communicating with the access device and the base station device. Alternatively, based on the HKDF algorithm, the dynamic token of the access device is extracted and converted to generate a dynamic key, and then the dynamic key is sent to the access device and the base station device, respectively, for the access device and the base station device to encrypt or decrypt the information transmitted and received. Wherein, the HKDF (HMAC-Based Key Derivation Function) is a key derivation function based on HMAC (Hash-based Message Authentication Code), which is used to generate corresponding encryption keys such as AES (Advanced Encryption Standard) encryption keys, authentication keys, etc. from original key materials (such as shared keys, random numbers, etc.). For this, based on the HKDF algorithm, the dynamic token is used as the original key material to generate the encryption key as the dynamic key for encrypted communication. And by sending the dynamic key to the base station and the access device, the access device and the base station device encrypt or decrypt the information transmitted and received, thereby realizing the construction of a secure communication channel. It is conceivable that different dynamic keys correspond to different dynamic tokens, thereby realizing "one machine one secret", which helps to protect data security.

[0050] As can be seen from the above scheme, the scheme generates a dynamic token based on the device information of the access device, and binds the dynamic token and the spatial position of the access device to obtain corresponding space-time proof information, so that the server verifies the space-time proof information obtained from the base station and the actual position of the corresponding access device, and then based on the dynamic binding mechanism of the dynamic token and the position, realizes double-source position verification and verifies the dynamic token through the block chain to verify the dynamic token. Through double verification, the reliability of device authentication is improved, the data authenticity is ensured, and the trajectory forgery and location fraud attack is prevented, effectively improving the data security in the 5G-A network, thereby meeting the dynamic security requirements of the 5G-A network.

[0051] Figure 3An information interaction schematic diagram of a security authentication system provided for an embodiment of the present application, the security authentication system comprising an access device, a base station device and a server. As shown in the figure, the access device generates a dynamic token by collecting device information, such as collecting channel state information CSI and hardware identifier UAS ID, for generating a dynamic token, and also generates space-time proof information Proof based on the positioning coordinates P1 of the first location information of the corresponding access device itself and the generated dynamic token Token. After generating the dynamic token Token and the space-time proof information Proof, the access device registers the dynamic token Token with the blockchain to record the state of the dynamic token Token. Optionally, in addition to being able to set the corresponding valid state or invalid state identifier for the state of the dynamic token Token, a corresponding validity period can also be set. Moreover, the access device also sends an authentication data packet to the base station device, the authentication data packet comprising the space-time proof information Proof and the positioning coordinates P1 of the first location information of the corresponding access device itself, so as to facilitate the base station device to perform device authentication.

[0052] The base station device can also detect the second location information of the access device, such as by radar sensing the actual location of the access device to determine the positioning coordinates P2 of the second location information of the corresponding access device. After the base station device initiates an authentication request to the server, the base station device sends the space-time proof information Proof and the positioning coordinates P2 of the second location information of the corresponding access device to the server. Optionally, the base station device can also send the positioning coordinates P1 of the first location information of the corresponding access device to the server. The server parses the authentication request to determine the space-time proof information Proof and the positioning coordinates P2 of the second location information of the corresponding access device sent by the base station device, and then parses to obtain the to-be-verified token Token' and the first location information. The server then respectively verifies the to-be-verified token Token' and the first location information, such as by accessing the blockchain to query the state of the to-be-verified token Token' to determine whether it is still in a valid state; and for the location of the access device, a double-location consistency verification is performed, i.e. the first location information and the second location information are compared to determine whether the location of the access device remains consistent.

[0053] Optionally, in the case where the base station device sends the positioning coordinates of the first location information of the corresponding access device and the positioning coordinates of the second location information of the corresponding access device to the server, the server can directly compare the two positioning coordinates to determine whether the locations are consistent. After completing the above-mentioned double verification, the server feeds back an authentication result to the base station device, and it can be envisaged that the authentication is successful only when the token is in a valid state and the locations are consistent. Moreover, after the authentication is successful, the server also generates a corresponding dynamic key and sends it to the base station device and the access device, for establishing a secure communication channel to perform encrypted communication.

[0054] Figure 4 A structural diagram of a device authentication apparatus is provided for an embodiment of the present application. The apparatus is used to execute the device upgrade method provided by the above-mentioned embodiment and has corresponding functional modules and beneficial effects for executing the method. The apparatus can be applied to an access device in a security authentication system, which includes a server, a base station device, and an access device. The server is used to authenticate an authentication request initiated by the base station device. The authentication request is a request initiated by the base station device after receiving an authentication data packet of the access device. As shown in the figure, the device authentication apparatus includes a first data generation module 301, a second data generation module 302, a data upload module 303, and a first encrypted communication module 304.

[0055] The first data generation module 301 is configured to generate a dynamic token based on device information of the access device and register the dynamic token in a blockchain. The second data generation module 302 is configured to generate spatiotemporal proof information according to the dynamic token and first location information of the access device. The data upload module 303 is configured to upload the spatiotemporal proof information and the first location information as an authentication data packet to the base station device for authentication of the access device by the base station device. The first encrypted communication module 304 is configured to establish a secure communication channel with the server and the base station device based on the received dynamic key in the case of passing the authentication.

[0056] On the basis of the above-mentioned embodiment, the device information includes a hardware identifier and channel state information. The first data generation module 301 is specifically configured as follows: Based on a hash function, a hash value obtained by performing an exclusive OR operation on the hardware identifier and the channel state is determined. A product value of a preset lattice matrix and the hash value is determined, and a remainder value is obtained by performing a modulo operation on the product value according to a preset modulus. Based on a dimension compression function, the remainder value is compressed to obtain the dynamic token.

[0057] On the basis of the above-mentioned embodiment, the second data generation module 302 is specifically configured as follows: Based on a BLAKE3 hash function, a location feature value is obtained by performing a hash operation on the first location information. A splicing value obtained by splicing the location feature value and the dynamic token is determined. Based on a post-quantum digital signature algorithm, a digital signature corresponding to the splicing value is determined, and the spatiotemporal proof information is obtained.

[0058] Figure 5A structural diagram of a device authentication apparatus is provided for another embodiment of the present application, which is used to execute the device upgrading method provided by the above-mentioned embodiments and has corresponding functional modules and beneficial effects for executing the method. The apparatus can be applied to a server in a security authentication system, which includes a server, a base station device, and an access device. The access device generates a dynamic token based on device information and registers the dynamic token in a blockchain. The access device generates spatiotemporal proof information according to the dynamic token and first location information of the access device and uploads the spatiotemporal proof information to the base station device. As shown in the figure, the device authentication apparatus includes a first data analysis module 401, a second data analysis module 402, a first data verification module 403, a second data verification module 404, and a second encrypted communication module 405.

[0059] The first data analysis module 401 is configured to analyze an authentication request and determine authentication information of a corresponding access device in response to receiving the authentication request sent by the base station device. The authentication information includes second location information detected by the base station device on the access device and spatiotemporal proof information of the corresponding access device. The second data analysis module 402 is configured to analyze the spatiotemporal proof information to determine a to-be-verified token and first location information corresponding to the access device. The first data verification module 403 is configured to access the blockchain through an MEC node to determine the state of the to-be-verified token. The second data verification module 404 is configured to verify the first location information and the second location information to determine whether the first location information and the second location information are consistent. The second encrypted communication module 405 is configured to determine that the access device passes the verification and establish a secure communication channel with the access device and the base station device in the case that the to-be-verified token is in a valid state and the first location information is consistent with the second location information.

[0060] On the basis of the above-mentioned embodiments, the second data analysis module 402 is specifically configured as follows: Based on a post-quantum digital signature algorithm, the spatiotemporal proof information is signed and analyzed to determine the to-be-verified token and the first location information therefrom.

[0061] On the basis of the above-mentioned embodiments, the second encrypted communication module 405 is specifically configured as follows: Based on an HKDF algorithm, a dynamic token of the access device is extracted and converted to generate a dynamic key. Different dynamic keys correspond to different dynamic tokens. The dynamic key is sent to the access device and the base station device, respectively, so that the access device and the base station device encrypt or decrypt the information received and transmitted.

[0062] It is worth noting that in the above-mentioned embodiments of the device, the modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, the specific names of the modules are only for easy mutual differentiation, and do not serve to limit the protection scope of the embodiments of the present application.

[0063] Figure 6 The structural schematic diagram of an electronic device provided by an embodiment of the present application is used to execute the device authentication method based on the 5G-A network provided by the above-mentioned embodiments, and has the corresponding function modules and beneficial effects of the execution method. The electronic device can be an access device such as a drone, a vehicle-mounted OBU device, or a RedCap sensor, or a server. As shown in the figure, the device includes a processor 501, a memory 502, an input device 503, and an output device 504. The number of processors 501 can be one or more, and one processor 501 is taken as an example in the figure; the processor 501, the memory 502, the input device 503, and the output device 504 can be connected through a bus or other means, and connection through a bus is taken as an example in the figure. The memory 502, as a kind of computer readable storage medium, can be used to store software programs, computer executable programs, and modules, such as program instructions / modules corresponding to the device authentication method based on the 5G-A network in the embodiments of the present application. The processor 501 executes the software programs, instructions, and modules stored in the memory 502, thereby executing corresponding various function applications and data processing, that is, implementing the above-mentioned device authentication method based on the 5G-A network.

[0064] The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data recorded or created during the use process, etc. In addition, the memory 502 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 can further include a memory remotely arranged with respect to the processor 501, which can be connected to the device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0065] The input device 503 can be used to input corresponding digital or character information to the processor 501, and generate key signal inputs related to the user settings and function control of the device; the output device 504 can be used to send or display key signal outputs related to the user settings and function control of the device.

[0066] The embodiment of the present application further provides a storage medium storing computer executable instructions, which are used for performing the related operations in the device authentication method based on the 5G-A network provided by any embodiment of the present application when executed by a processor.

[0067] Computer readable storage media includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technologies, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0068] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0069] Note that the above is only the preferred embodiment of the present application and the technical principles applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments herein, and those skilled in the art can make various obvious changes, readjustments and substitutions without departing from the scope of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A device authentication method based on a 5G-A network, characterized in that, An access device is used in a security authentication system. The security authentication system includes a server, a base station device, and an access device. The server is used to authenticate authentication requests initiated by the base station device. The authentication request is a request initiated by the base station device after receiving the authentication data packet from the access device. The method includes: Based on the device information of the access device, a dynamic token is generated and registered in the blockchain; Based on the dynamic token and the first location information of the access device, a spatiotemporal proof information is generated; The spatiotemporal proof information and the first location information are used as the authentication data packet, and the authentication data packet is uploaded to the base station device so that the base station device can authenticate the access device. If authentication is successful, secure communication channels are established with the server and the base station equipment respectively based on the received dynamic key.

2. The device authentication method based on a 5G-A network according to claim 1, characterized in that, The device information includes hardware identifier and channel state information. The generation of a dynamic token based on the device information of the access device includes: Based on the hash function, determine the hash value obtained by XORing the hardware identifier and the channel state; Determine the product of the preset lattice base matrix and the hash value, and perform a remainder operation on the product value according to a preset modulus to obtain the remainder value; The residual value is compressed using a dimension compression function to obtain the dynamic token.

3. The device authentication method based on a 5G-A network according to claim 1 or 2, characterized in that, The step of generating spatiotemporal proof information based on the dynamic token and the first location information of the access device includes: Based on the BLAKE3 hash function, a hash operation is performed on the first location information to obtain the location feature value; Determine the concatenated value after concatenating the location feature value and the dynamic token; Based on the post-quantum digital signature algorithm, the digital signature corresponding to the concatenated value is determined, and the spatiotemporal proof information is generated.

4. A device authentication method based on a 5G-A network, characterized in that, A server is used in a security authentication system. The security authentication system includes a server, a base station device, and an access device. The access device generates a dynamic token based on device information and registers the dynamic token in a blockchain. The access device also generates spatiotemporal proof information based on the dynamic token and the first location information of the access device and uploads the spatiotemporal proof information to the base station device. The method includes: In response to receiving an authentication request sent by the base station device, the authentication request is parsed, and authentication information corresponding to the access device is determined. The authentication information includes second location information detected by the base station device for the access device and spatiotemporal proof information corresponding to the access device. The spatiotemporal proof information is parsed to determine the token to be verified and the first location information corresponding to the access device; Access the blockchain via the MEC node to determine the status of the token to be verified; Verify the first location information and the second location information to determine whether the first location information and the second location information are consistent; If the token to be verified is valid and the first location information is consistent with the second location information, it is determined that the access device has passed the verification and a secure communication channel is established between the access device and the base station device.

5. The device authentication method based on a 5G-A network according to claim 4, characterized in that, The step of parsing the spatiotemporal proof information to determine the token to be verified and the first location information corresponding to the access device includes: Based on the post-quantum digital signature algorithm, the spatiotemporal proof information is parsed to determine the token to be verified and the first location information.

6. The device authentication method based on a 5G-A network according to claim 4 or 5, characterized in that, The step of determining that the access device has passed verification and establishing a secure communication channel with the access device and the base station device when the token to be verified is valid and the first location information is consistent with the second location information includes: Based on the HKDF algorithm, the dynamic token of the access device is extracted and converted to generate a dynamic key, and different dynamic keys correspond to different dynamic tokens; The dynamic key is sent to the access device and the base station device respectively, so that the access device and the base station device can encrypt or decrypt the information sent and received.

7. A device authentication device based on a 5G-A network, characterized in that, An access device is used in a security authentication system. The security authentication system includes a server, a base station device, and an access device. The server is used to authenticate authentication requests initiated by the base station device. The authentication request is a request initiated by the base station device after receiving the authentication data packet from the access device. The device includes: The first data generation module is configured to generate a dynamic token based on the device information of the access device, and register the dynamic token in the blockchain; The second data generation module is configured to generate spatiotemporal proof information based on the dynamic token and the first location information of the access device; The data upload module is configured to use the spatiotemporal proof information and the first location information as the authentication data packet and upload the authentication data packet to the base station device so that the base station device can authenticate the access device. The first encrypted communication module is configured to establish secure communication channels with the server and the base station device respectively, based on the received dynamic key, after confirming that authentication has been passed.

8. A device authentication device based on a 5G-A network, characterized in that, A server is used in a security authentication system. The security authentication system includes a server, a base station device, and an access device. The access device generates a dynamic token based on device information and registers the dynamic token in a blockchain. The access device also generates spatiotemporal proof information based on the dynamic token and the first location information of the access device and uploads the spatiotemporal proof information to the base station device. The device includes: The first data parsing module is configured to, in response to receiving an authentication request sent by the base station device, parse the authentication request and determine the authentication information corresponding to the access device. The authentication information includes the second location information detected by the base station device for the access device and the spatiotemporal proof information corresponding to the access device. The second data parsing module is configured to parse the spatiotemporal proof information to determine the token to be verified and the first location information corresponding to the access device. The first data verification module is configured to access the blockchain through the MEC node to determine the status of the token to be verified. The second data verification module is configured to verify the first location information and the second location information to determine whether the first location information and the second location information are consistent. The second encrypted communication module is configured to determine that the access device has passed verification and establish a secure communication channel with the access device and the base station device when the token to be verified is in a valid state and the first location information is consistent with the second location information.

9. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the device authentication method based on a 5G-A network as described in any one of claims 1-6.

10. A storage medium for storing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a processor, are used to perform the device authentication method based on a 5G-A network as described in any one of claims 1-6.

Images