5G communication system and method based on self-tampering triggered according to secondary authentication result

Abstract

The invention discloses a 5G communication system and method based on self-tampering triggered according to a secondary authentication result, and the system comprises a local data comparison module, a login system module accessed to 5G network service, and a first system which communicates with the local data comparison module and is used for logging in a real user to operate to form real user data, the login system module communicates with the real user data, the second system is operated by login of an illegal entering person, a preset mapping relation is established, the real user data is mapped into tampering data to be presented in the second system, so that the second system is presented for the illegal entering person, otherwise, the first system is presented, and the message enhancement information public key self-updating module communicates with the login system module. And the encryption module is used for automatically triggering encryption update of the public key when the second system works, and re-encrypting the secondary authentication message. The method comprises the step of realizing a four-in-one protection mechanism aiming at preventing message tampering, maliciously implanting a program, intercepting data and ensuring the safety of user data by utilizing the system.

Description

Technical Field

[0001] This invention relates to 5G communication systems and methods, and in particular to a 5G communication system and method based on self-tampering triggered by secondary authentication results, belonging to the field of 5G communication security. Background Technology

[0002] Two-factor authentication refers to re-authenticating the permissions of users who have already been trusted or authenticated, thereby further strengthening network access security and preventing malicious data tampering by third parties. In 5G networks, two-factor authentication mainly includes secure gateway authentication, VPDN authentication based on virtual private dialing, and secondary identity authentication triggered by the home network before the session. However, the implementation results still cannot prevent more repeated attacks and tampering attempts. Therefore, finding a technology that can break down the hacker's psychological defenses and deter them from attempting such attacks is crucial to eliminating such behavior as much as possible.

[0003] Existing two-factor authentication methods involve sending a password to the user's mobile phone. During data transmission, a pre-defined header enhancement method is implemented for encrypted transmission. The key lies in the mapping relationship between the public key and the enhanced header. However, if this mapping relationship is leaked or cracked, it can be used to implant malicious programs or tamper with the message, allowing third-party intrusion and further data modification. This renders the encrypted transmission ineffective, instead becoming a protective layer against data tampering. Therefore, adding a second-factor authentication technique before data leakage, even if the mapping relationship is compromised, is crucial.

[0004] Honeypots are a type of deception technique that lures hackers to a dedicated address for targeted analysis and research. The logic is to deliberately create vulnerabilities, feigning a breach. This honeypot concept can also be effectively applied to secondary authentication. By intentionally allowing a hacker, whose identity has been confirmed by an additional technology, to pass authentication, we can lure them into accessing user data—but this data is entirely fake. Simultaneously, we can analyze their behavior on-site to obtain more crucial information for a decisive counterattack. However, current honeypot technologies require the addition of a honeypot server; therefore, implementing the honeypot concept without increasing equipment is a problem that needs to be solved. Summary of the Invention

[0005] I. Core Elements of the Invention First, a local data comparison module is involved to compare whether the data has changed before and after message transmission. While normal secondary authentication is considered successful and trust is granted, this invention also requires local comparison of the message. If an anomaly is found, the successful secondary authentication is cancelled and the message is deemed unsuccessful. This technology aims to prevent hackers from tampering with messages or implanting malicious programs. A secondary authentication login system is also set up, allowing secondary authentication requests only after successful password verification. This additional system login aims to obtain the login user's address and compare it with the addresses commonly found by legitimate users to initially determine if the user is suspicious.

[0006] Secondly, for unsuccessful secondary authentication attempts, access is still granted, but the corresponding user data has been self-modified due to the failure. This means that a specific algorithm alters the user information, ensuring that the data obtained by the unauthorized hacker is entirely fake. The user then automatically logs out after a predetermined time. The data generated by the hacker's actions is analyzed, and the true user data is restored. This eliminates the need for a honeypot server. The purpose of this technology is to lure hackers without increasing costs, keeping them unaware of the fraud, and allowing for analysis of their behavior for local capture.

[0007] Third, for secondary authentication requests detected during unauthorized access, the public key encryption is automatically updated to prevent hackers from cleverly discovering the data is fake and then impersonating a user to request secondary authentication again. At this point, the public key is automatically updated again, isolating the hacker from accessing the fake data and presenting the genuine data to the real user. This completely thwarts their attack. This technology aims to prevent further hacker attacks without affecting genuine user access, because the first core technology provides a guarantee that genuine users will not tamper with the messages. The key lies in the isolation of the data; fake data is still presented to the hacker, while genuine data is presented to the real user. The crucial factor is determining whether the hacker's address is related to the user's address based on the analysis results of the second core technology.

[0008] II. Detailed Technical Solution Description To achieve the aforementioned core technologies, this invention provides, on one hand, a self-tampering 5G communication system triggered by secondary authentication results, including a local data comparison module. This module is equipped with a secondary authentication login system and obtains the local location of the user. It compares the differences between the secondary authentication messages before and after the request, as well as whether the requester's address is abnormal. If the message comparison result and the requester's address are abnormal, the user is confirmed as an unauthorized entrant. The login system module, which accesses 5G network services, communicates with a local data comparison module. It includes a first system for generating real user data for legitimate users to log in, and a second system for unauthorized users to log in. A preset mapping relationship is established, mapping real user data to tampered data and presenting it in the second system. This results in the second system being presented to unauthorized users, and the first system being presented to legitimate users. The message enhancement information public key self-update module communicates with the login system module and is used to automatically trigger public key encryption update when the second system is activated, and then re-encrypt the subsequent secondary authentication messages.

[0009] Preferably, the password for the secondary authentication login system is the verification code sent to the user. After successful login, the login address is obtained by local data comparison. At the same time, the local data comparison compares the secondary authentication message sent by the SMF network element with the standard secondary authentication message. If a difference is found, the login user is determined to be an unauthorized entrant. If no difference is found, but the login address is abnormal, the user is suspected of being an unauthorized entrant.

[0010] Optionally, the differences include differences in message header enhancement information, additions to the message content, and differences in the message content itself; when a suspected unauthorized entrant is identified, a request to enable local location is sent to the suspected unauthorized entrant, and when location feedback is received after enabling the location, it is further confirmed whether the user is a real user.

[0011] Optionally, if the address of a suspected unauthorized user is indeed from the address of the mobile device they are using, or the IP address of a historically logged-in device, then they are confirmed as a legitimate user.

[0012] Preferably, the method for establishing the preset mapping relationship is as follows: for text, different characters are randomly selected from the dictionary to replace the original text using a random algorithm; for numbers, all are replaced with different numbers; for audio, audio from the audio library is randomly selected to replace the original audio; and for video files, preset animations from the video library are randomly selected to replace the original audio.

[0013] Preferably, the login system module is also controlled by a backend server to obtain behavioral data of unauthorized entrants and analyze their addresses.

[0014] Preferably, the login system module logs in by decrypting with a private key, and the method for generating and updating the public key using encryption is as follows: S1 acquires historical data on other user communications that are communicating with real users. S2 then uses artificial intelligence to generate AI facial data, and extracts facial feature points through facial recognition algorithms. It randomly selects multiple data segments from historical data and randomly assigns feature points to them. S3 connects each feature point according to a preset path, and concatenates the data assigned to the feature points along the path in the order of their occurrence as a public key. The S4 public key encryption update method is to repeat steps S1-S3, change the preset path in S3, generate an updated public key, obtain real user face data, generate a first private key in the same way as S2 and S3, extract the distribution map of feature points of real user face data as the second private key, and the first and second private keys together form the private key. When updating the public key, the real user is notified to update the private key.

[0015] Optionally, the method for identifying an unauthorized entrant and presenting them with the second system is that the unauthorized entrant logs into the second system via the login system module using a private key, or directly enters the second system without a key.

[0016] Optionally, the first private key can be updated by updating the path connecting the feature points, or by keeping the path unchanged, obtaining new historical data, and then repeating steps S2-S3.

[0017] Optionally, the message enhancement information public key self-update module exchanges public keys with each network element. It should be understood that, as a member of the network system, the exchange of public keys between the message enhancement information public key self-update module and network elements is essentially a public key exchange for users and for unauthorized access (which may not be necessary). This enables the secondary authentication message header enhancement information used for communication between both modules and the 5G network to be transmitted using public key encryption.

[0018] Therefore, the public key involved in this invention is based on real user historical data, sorted according to AI facial feature points. However, the private key is related to the sorting and distribution of real user facial feature points, making even the public key difficult to obtain, and the private key even more difficult. Due to the update of the public key, even if an unauthorized person attempts to intercept, they cannot exchange the public key and therefore cannot further use the updated public key to encrypt messages and conceal the tampering. Even if an unauthorized person attempts to encrypt and transmit tampered messages without the public key, the backend can easily intercept and analyze it. Even if an updated public key is exchanged, the exposure of this exchange immediately confirms that the person is an unauthorized user.

[0019] Another aspect of the present invention provides a 5G communication method based on a secondary authentication result that utilizes the above-described system to implement self-tampering. Includes the following steps: The first step is to build a 5G communication system that is self-tampering based on the result of secondary authentication; The second step involves the local data comparison module comparing and analyzing the secondary authentication request sent by the SMF network element with the standard message, as well as analyzing the requester's address, to generate two judgment results: unauthorized entry and suspected unauthorized entry. The former proceeds to the third step, and the latter proceeds to the fourth step. The third step involves the login system module allowing legitimate users to log in to the first system and allowing unauthorized individuals to log in to the second system. It also obtains the unauthorized individual's behavioral data, analyzes their address, and triggers the message enhancement information public key self-update module to update the public key encryption. The fourth step is to send a request to enable local location services to individuals suspected of unauthorized entry. Upon receiving location feedback after enabling the service, the system will further confirm whether the user is a legitimate user.

[0020] Beneficial effects By incorporating a local data comparison module, a 5G network service login system module, and a message enhancement information public key self-update module into a 5G network service with secondary authentication, a second system is implemented to compare message data and present self-tampered data in case of anomalies, triggering public key encryption updates. Simultaneously, a key generation and update mechanism is set up based on the distribution of facial feature points and the random distribution of historical data among feature points. This achieves a four-pronged protection mechanism to prevent message tampering, malicious program injection, data interception, and user data security. Attached Figure Description

[0021] Figure 1 This is a layout and functional description diagram of a 5G communication system based on a secondary authentication result that is subject to self-tampering, as described in Embodiment 1 of the present invention. Figure 2 This is a schematic diagram illustrating the principle of public key generation and public key encryption update mechanism. Figure 3 This is a flowchart of the method based on the system of Embodiment 1 in Embodiment 2 of the present invention. Detailed Implementation

[0022] Example 1

[0023] This embodiment describes the system.

[0024] Figure 1 This paper presents the layout of a 5G communication system based on a self-tampering mechanism triggered by secondary authentication results, between 5G network services and the authentication interface. The local data comparison module is connected to the authentication interface and is used to receive secondary authentication messages sent by network elements (using the SMF network element as an example in this embodiment) via a network cable. In this module, after successfully logging in using the secondary authentication system and entering the verification code and password sent to the user, the module obtains the login address and then compares the messages. If a difference is found, the user is determined to be an unauthorized entrant; if no difference is found but the login address is abnormal, the user is suspected of being an unauthorized entrant.

[0025] The login system module, which accesses 5G network services, communicates with a local data comparison module. It includes a first system for generating real user data for legitimate users to log in, and a second system for unauthorized users to log in. A preset mapping relationship is established, mapping real user data to tampered data and presenting it in the second system. This results in the second system being presented to unauthorized users, and the first system being presented to legitimate users. The message enhancement information public key self-update module communicates with the login system module and is used to automatically trigger public key encryption update when the second system is activated, and then re-encrypt the subsequent secondary authentication messages.

[0026] Specifically, the SMF network element connects to the network cable through the request channel and communicates with the authentication channel and authentication interface. In the diagram, the real user enters the SMF1 network element legally, enters the corresponding authentication channel and authentication interface, and first enters the local data comparison module to compare the request message with the standard message. If they are the same, the login system module presents the first system to SMF1 for the real user to operate.

[0027] If the comparison results differ, as shown in the diagram where an unauthorized intruder compromises the network element SMFx, then calls to authentication interfaces (such as UDM) to generate authentication vectors are prohibited. This occurs when an unauthorized intruder initiates a request after tampering with the message. The requester is identified as an unauthorized intruder by the local data comparison module. At this point, the 5G network service presents the second system to the unauthorized intruder through the login system module. The unauthorized intruder can only see the self-tampered data in the second system. Simultaneously, the message enhancement information public key self-update module triggers a public key encryption update, re-encrypting subsequent secondary authentication messages.

[0028] The method for establishing the preset mapping relationship is as follows: for text, different characters are randomly selected from the dictionary to replace the original text using a random algorithm; for numbers, all are replaced with different numbers; for audio, audio from the audio library is randomly selected to replace the original audio; and for video files, preset animations from the video library are randomly selected to replace the original audio.

[0029] Both the first and second systems log in using private key decryption within the login system module. However, once the second system starts up, it initiates a public key encryption update.

[0030] Public key encryption updates include updating both the public key and the private key, specifically as follows: Figure 1The illustrated method involves the message enhancement information public key self-update module receiving a second system start signal from the login system module, triggering a public key exchange with the network element to update the public key. Specifically, the network element's own public key is exchanged with the newly generated public key from the message enhancement information public key self-update module. This exchange is then conducted through communication with the login system module to encrypt the transmission of the new public key to the 5G network service, as well as the secondary authentication message, using this new public key for encrypted transmission. This prevents interception attempts by the unauthorized user or other new unauthorized users. For network elements that have already been confirmed to be compromised, the updated public key exchange is not required. Simultaneously with the public key update, the legitimate user's private key is also notified of the update.

[0031] Specifically, the methods for generating and updating public keys using encryption are as follows: Figure 2 As shown, S1 acquires historical data on other user communications that are communicating with real users. S2 then uses artificial intelligence to generate AI facial data, and extracts facial feature points (14) through a facial recognition algorithm. Multiple data segments are randomly selected from historical data (shown as binary code in the diagram), and these feature points are randomly assigned to them. S3 connects each feature point according to the preset path in the diagram, and concatenates the data assigned to the feature points along the path in the order of their occurrence as the public key. The S4 public key encryption update method involves repeating steps S1-S3, changing the preset path in S3, generating an updated public key, and obtaining the real user's facial data. Figure 2 (Not shown in the image) The first private key is formed in the same way as S2 and S3. The distribution map of the feature points of the real user's face data (i.e., the distribution map of 14 feature points) is extracted and used as the second private key. The first private key and the second private key together form the private key. When the public key is updated, the real user is notified to update the first and second private keys.

[0032] Example 2 This embodiment describes the method based on the system of Embodiment 1.

[0033] like Figure 3 As shown, the first step is to construct a self-tampering 5G communication system based on the result of secondary authentication; The second step involves the local data comparison module comparing and analyzing the secondary authentication request sent by the SMF network element with the standard message, as well as analyzing the requester's address, to generate two judgment results: unauthorized entry and suspected unauthorized entry. The former proceeds to the third step, and the latter proceeds to the fourth step. The third step involves the login system module allowing legitimate users to log in to the first system and allowing unauthorized individuals to log in to the second system. It also obtains the unauthorized individual's behavioral data, analyzes their address, and triggers the message enhancement information public key self-update module to update the public key encryption. The fourth step is to send a request to enable local location services to individuals suspected of unauthorized entry. Upon receiving location feedback after enabling the service, the system will further confirm whether the user is a legitimate user.

Claims

1. A self-tamper based 5G communication system triggered based on the result of a two-factor authentication, characterized in that, The local data comparison module is provided with a secondary authentication login system and obtains the local positioning of the login person, and is used to compare the differences between the secondary authentication messages before and after the request and whether the address of the request person is abnormal, and when the message comparison result and the address of the request person are abnormal, it is confirmed that the person is an illegal intruder, The login system module of the access 5G network service communicates with the local data comparison module, includes a first system for operating to form real user data for real user login, and a second system for operating for illegal intruder login, and establishes a preset mapping relationship, maps the real user data to tampered data and presents the second system to the illegal intruder, and presents the first system to the real user, and The message enhancement information public key self-updating module communicates with the login system module, and is used to automatically trigger public key encryption update when the second system is in operation, and re-encrypt the secondary authentication message thereafter, The password of the secondary authentication login system is the verification code sent to the user, and after successful login, the local data comparison module obtains the login address, and at the same time, the local data comparison module compares the secondary authentication message sent by the SMF network element with the standard secondary authentication message, and if a difference is found, it is determined that the login person is an illegal intruder, and if no difference is found, but the login address is abnormal, it is a suspected illegal intruder.

2. The system of claim 1, wherein, The difference includes the difference of the message header enhancement information, the addition of the message content, and the difference of the message content itself; after determining that it is a suspected illegal intruder, further send a request to open the local positioning to the suspected illegal intruder, and when receiving the positioning feedback after opening, further confirm whether it is a real user.

3. The system of claim 2, wherein, When it is determined that the address of the suspected illegal intruder is indeed from the address of the mobile device held or the IP address of the historical login device, it is confirmed that it is a real user.

4. The system of claim 3, wherein, The preset mapping relationship is established as follows: for text, different text is randomly selected in the word library to replace the original text by using a random algorithm, for numbers, all are replaced with different numbers, for audio, audio in the audio library is randomly selected to replace the original audio, and for video files, preset animation in the video library is randomly selected to replace the original audio.

5. The system of any one of claims 1-4, wherein, The login system module is further used to obtain the behavior data of the illegal intruder and analyze the address under the control of the background server.

6. The system of claim 5, wherein, The login system module decrypts the login by a private key, and the method for generating and updating the public key is as follows: S1 obtain the historical data of the communication of other users in communication with the real user, S2 generate AI face data by artificial intelligence, and extract face feature points by face recognition algorithm, randomly select multiple data in the historical data, and randomly assign the feature points, S3 connect each feature point according to the preset path, and splice the data assigned to the feature points in the path in chronological order as the public key. The S4 public key encryption update method is to perform steps S1-S3 again and change the preset path in S3 to form an updated public key, obtain real user face data, form a first private key in the same way as S2 and S3, extract a distribution map of real user face data feature points as a second private key, and the first private key and the second private key jointly form a private key. The public key is updated, and the real user is notified to update the private key.

7. The system of claim 6, wherein, The method for confirming the illegal intruder to present the second system is that the illegal intruder logs in the second system through the private key decryption of the login system module or directly enters the second system without the key.

8. The system of claim 7, wherein, The way to update the first private key is to update the path of the connected feature points or to obtain new historical data and perform steps S2-S3 again.

9. The system of claim 8, wherein, The public key is exchanged between the message enhancement information public key self-update module and each network element.

10. A self-tamper based 5G communication method triggered based on a result of a two-factor authentication using the system of any one of claims 1-9: characterized in that, The method comprises the following steps: First, construct a self-tampered 5G communication system based on the secondary authentication result trigger; Second, the local data comparison module compares and analyzes the message and the standard message of the secondary authentication request sent by the SMF network element, and analyzes the address of the requester to form two judgment results of illegal intruders and suspected illegal intruders. The former enters the third step, and the latter enters the fourth step, Third, the login system module allows the real user to log in the first system, and allows the illegal intruder to log in the second system, and obtains the behavior data analysis of the illegal intruder and its address, and triggers the message enhancement information public key self-update module to update the public key encryption, Fourth, send an open local positioning request to the suspected illegal intruder. When the positioning feedback after opening is received, it is further confirmed whether it is a real user.

Images