Multi-terminal parallel authentication authorization and equipment perception method for key task communication system

Abstract

The invention discloses a multi-terminal parallel authentication authorization and equipment perception method for a key task communication system, which belongs to the technical field of key task communication, and specifically comprises the following steps: S1, configuration preparation: a server pre-configures a terminal initial configuration file for a terminal; the initial configuration file of the terminal comprises lt; m < cpt >-UE-idgt; element, lt; m < cpt >-UE-idgt; the elements comprise the next-level lt; the method comprises the following steps: carrying out Instance-ID-URNgt; an element; lt; the method comprises the following steps: carrying out Instance-ID-URNgt; the elements are instantiated to be unique identifiers by the configuration terminal; s2, configuration issuing and effectiveness: the server issues the initial configuration file of the terminal to the terminal, and the initial configuration file of the terminal is restarted to take effect through the terminal; s3, authentication and information reporting: the terminal initiates an authentication and service authorization request, wherein the request carries the result; the method comprises the following steps: carrying out Instance-ID-URNgt; an element; s4, service authorization and configuration issuing: the server receives the request, analyzes the terminal instantiation unique identifier, records analysis information, and determines whether to issue matched user configuration file data to the terminal; according to the invention, the terminal registration authentication process is deeply coupled with the terminal type and capability evaluation, and intelligent decision-making can be carried out based on terminal difference.

Description

Technical Field

[0001] This invention belongs to the field of mission-critical communication technology, and particularly relates to a method for multi-terminal parallel authentication and authorization and device awareness in mission-critical communication systems. Background Technology

[0002] Mission-Critical Communications (MCX) systems are next-generation mission-critical and public safety communication solutions based on 3GPP standards. Their core value lies in providing users with highly reliable and secure group voice, video, and data services. In an MCX system, the server dynamically distributes user configuration files to each user. These files define the user's roles, permissions, and service capabilities in individual calls, group calls, and other services, forming the foundation for ensuring the normal operation of communication services.

[0003] With the rapid development of MCX technology, in order to meet the operational needs of different scenarios, the application scenario where the same MCX user account can log in to multiple different types of terminals at the same time is becoming increasingly common. These terminals are diverse, including fully functional dispatch consoles, vehicle-mounted terminals, and mobile handheld terminals. They differ significantly in hardware capabilities (such as screens and cameras), software functions, and network access methods, and may even be running different versions of client software.

[0004] However, in the current standard architecture and practice, the server cannot effectively perceive and distinguish the specific terminal type and capabilities used by the user during the user registration and authentication phase, resulting in problems such as incorrect role configuration data sent to the client, mismatched business capabilities, and inconsistent authorization scope.

[0005] The root cause of the aforementioned technical issues lies in the server's inability to recognize the differences between terminal instances, resulting in the server sending the same default user configuration file to all terminals logged into the same account. For example, when a user logs in through a regular mobile app, they may incorrectly obtain administrative permissions (such as environment monitoring and call permission revocation) that should be limited to the dispatch console; conversely, when a user logs in to the dispatch console, they may be unable to perform critical dispatch functions due to receiving a regular user configuration. This mismatch between roles and permissions will directly lead to conflicts or failures in core services such as individual calls and group calls.

[0006] Furthermore, in subsequent business processing, due to the server's lack of understanding of the terminal's capabilities, it will initiate business requests to all logged-in terminals. For example, when initiating a video group call, the server will also perform signaling interaction, media negotiation, and wireless bearer resource requests to terminals without screens or video processing capabilities. This not only consumes network and processing resources but also reduces the efficiency and reliability of the entire business setup due to the inevitable failure of the terminals.

[0007] It is evident that existing technologies lack a mechanism to effectively perceive the type and capabilities of terminal instances during the user authentication, authorization, and service initiation phases. This technological gap prevents the system from dynamically allocating appropriate configurations and permissions to different types of terminal instances, and also hinders the ability to make intelligent decisions that match the terminal's capabilities during service execution. This significantly limits the application performance and reliability of MCX systems in complex, heterogeneous terminal environments.

[0008] Therefore, there is an urgent need in this field for an innovative technical solution that can achieve parallel authentication and authorization across multiple terminals and device awareness. Summary of the Invention

[0009] The purpose of this invention is to overcome the technical defects of existing MCX systems when users log in from multiple terminals in parallel, which leads to configuration errors, mismatched business permissions, and wasted resources because the server cannot perceive differences in terminal types and capabilities. This invention provides a method for parallel authentication and authorization of multiple terminals and device awareness in a mission-critical communication system. By expanding the semantic connotation of the unique identifier of terminal instantiation and constructing an intelligent perception and decision-making mechanism on the server side that integrates terminal type identification, capability mapping, and dynamic authorization strategies, the method achieves the goal of accurately distributing user configurations based on terminal differences and executing business logic on demand. This significantly improves system resource allocation efficiency and business adaptation accuracy while ensuring the reliability of critical communication services.

[0010] The technical solution adopted in this invention is: The key to the method of multi-terminal parallel authentication and authorization and device awareness in mission-critical communication systems lies in the following steps: S1. Configuration Preparation: Pre-configure different initial configuration files for different types of terminals on the server side of the mission-critical communication system; the aforementioned initial configuration files contain... <mcptt-ue-id>Elements, the above <mcptt-ue-id>The element contains the next level <instance-id-urn>Elements; the above <instance-id-urn>The element is configured with a unique identifier for the terminal instance; S2. Configuration Distribution and Activation: The server distributes the initial configuration file to the terminal and activates it by restarting the terminal. S3. Authentication and Information Reporting: The terminal initiates an authentication and service authorization request to the mission-critical communication system, and the request carries the above... <instance-id-urn>element; S4. Service Authorization and Configuration Distribution: The server receives the above request and parses it. <instance-id-urn>The terminal instantiates a unique identifier and records the parsing information in the element; the server decides whether to send the matching user configuration file data to the terminal based on the parsing information.

[0011] Specifically, the aforementioned terminal instantiation unique identifier is embedded with at least one of client type information and terminal capability information; the aforementioned parsed information includes at least one of client type information and terminal capability information based on the terminal instantiation unique identifier.

[0012] Furthermore, step S1 also includes establishing and storing the mapping relationship data between the aforementioned terminal instantiation unique identifier and the client type and terminal capabilities on the server side; in step S4, the server obtains the client type and terminal capabilities corresponding to the aforementioned terminal instantiation unique identifier by querying the aforementioned mapping relationship data.

[0013] Furthermore, the aforementioned client type information is used to indicate the form and role of the terminal, including any one of mobile client applications, dispatch consoles, and vehicle terminals; the aforementioned terminal capability information includes terminal hardware capabilities and / or terminal software capabilities.

[0014] Specifically, in step S2, the aforementioned initial configuration file for the terminal is sent to the terminal either offline (imported or copied) or online (downloaded via the network).

[0015] Specifically, in step S3, the aforementioned request is carried through the SIP protocol. <instance-id-urn>The element is carried in the message body of the SIP registration signaling.

[0016] Specifically, step S3 includes the following steps: S31, Terminal initiates portability for the first time <instance-id-urn>SIP request for the element; The S32 and SIP Core network elements return a 401 Unauthorized response message to the terminal. S33. When the terminal receives a 401 Unauthorized response message, it adds authentication information to the SIP registration signaling and re-initiates the authentication and service authorization request. S34 and the SIP Core network element reconstruct the third-party registration request, taking the request message re-initiated by the terminal as the message body of the SIP registration signaling and forwarding it to the server, which is the MCX service network element.

[0017] It should be noted that in step S4, the server compares the parsed information with the preset service authorization policy; when the parsed information matches the service authorization policy, the server sends the matched user configuration file data to the terminal, which contains the business permission information corresponding to the parsed information.

[0018] On the one hand, in step S4, the server compares the parsed information with the preset service authorization policy; when the parsed information does not match the service authorization policy, it refuses to send complete user profile data to the terminal or only sends limited user profile data to the terminal.

[0019] On the other hand, in step S4, when the server refuses to send complete user profile data, the server sends a rejection response message to the terminal; when the server only sends limited user profile data to the terminal, the limited user profile data contains business permission information with limited functions corresponding to the limited client type or terminal capabilities.

[0020] Compared with the prior art, the present invention has the following advantages: This invention proposes a method for multi-terminal parallel authentication and authorization and device awareness in a mission-critical communication system. By constructing a technical solution of "terminal identity self-description - server-side intelligent perception - dynamic and precise authorization", the terminal registration and authentication process is deeply coupled with terminal type and capability assessment, realizing a fundamental transformation of the server from undifferentiated processing to intelligent decision-making based on terminal differences.

[0021] Specifically, the technical solution of the present invention has the following outstanding advantages: First, this invention fundamentally solves the configuration mismatch problem in multi-terminal scenarios, significantly improving business reliability. Addressing the role and permission mismatches caused by existing technologies where the server cannot perceive the terminal type and issues the same configuration to all terminals, this invention embeds client type and terminal capability information into the unique identifier of the terminal instance. This allows the server to accurately identify the terminal type and role, and issue a fully matching user configuration file accordingly. As shown in Application Scenario 1, this invention ensures that dispatch console users receive full management permissions, while ordinary mobile terminals only receive basic permissions corresponding to their roles. This avoids business conflicts and failures caused by permission confusion at the source, ensuring the accuracy and order of critical task communications.

[0022] Secondly, this invention achieves efficient utilization of network resources and optimization of service processing flows. Addressing the signaling and resource waste caused by existing technologies that indiscriminately initiate service requests to all terminals, this invention enables the server to intelligently filter terminals based on their perceived capabilities during the initiation phase. As demonstrated in application scenario two, for terminals that clearly lack the corresponding media processing capabilities, the server can prematurely terminate invalid signaling interactions, media negotiation, and radio bearer establishment processes. This not only significantly saves core network and air interface resources but also improves the overall efficiency and success rate of service establishment by reducing unnecessary interaction steps.

[0023] Third, this invention forms a complete and autonomous closed-loop system for terminal perception and authorization management. The core advantage of this invention lies in its realization of a fully automated process from terminal identity reporting and server-side parsing and perception to dynamic authorization decision-making. The system obtains terminal self-description information through standardized signaling processes and can verify and enrich the information by combining pre-set mapping relationships. Finally, it automatically completes the decision-making for user configuration based on an integrated intelligent policy library. This closed-loop management system overcomes the lag and complexity of relying on manual static configuration, achieving system-level self-adaptation and intelligent operation and maintenance.

[0024] Fourth, the system design of this invention combines flexibility and foresight, enabling it to adapt to complex future network environments. The terminal instantiation identifier design and server-side mapping mechanism of this invention together constitute a flexibly scalable framework. Whether adding new terminal types such as IoT sensors or new capabilities such as AI coprocessors, they can all be incorporated into the management scope by defining new identifier semantics or updating the mapping table. This inherent scalability allows this invention not only to meet the current needs of heterogeneous terminal access but also to provide a technical foundation for more complex device forms and business scenarios that may emerge in the future.

[0025] Fifth, the method of this invention has good compatibility with existing standards, a clear implementation path, and strong feasibility. The method of this invention is based on the 3GPP MCX standard system and features enhanced design. <mcptt-ue-id>and <instance-id-urn>All elements conform to standard specifications. Key signaling interaction processes such as SIP registration, third-party registration, and 401 authentication fully comply with standard protocols. This means that the method of this invention can be directly implemented on standard MCX service network elements through software upgrades, without modifying terminal hardware or core network infrastructure, maximizing the protection of existing investments and possessing extremely high engineering feasibility and commercialization value. Attached Figure Description

[0026] Figure 1 This is a flowchart of the terminal parallel authentication authorization and device perception method of the present invention.

[0027] Figure 2 This is a flowchart of application scenario one of the present invention.

[0028] Figure 3 This is a flowchart of application scenario two of the present invention. Detailed Implementation

[0029] Various exemplary embodiments of the present invention will now be described in detail. This detailed description should not be considered as a limitation of the present invention, but rather as a more detailed description of certain aspects, features, and embodiments of the present invention.

[0030] It should be understood that the terminology used in this invention is merely for describing particular embodiments and is not intended to limit the invention. Furthermore, with respect to numerical ranges in this invention, it should be understood that each intermediate value between the upper and lower limits of the range is also specifically disclosed. Any stated value or intermediate value within a stated range, as well as each smaller range between any other stated value or intermediate value within said range, is also included in this invention. The upper and lower limits of these smaller ranges may be independently included or excluded from the range.

[0031] Unless otherwise stated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art. While only preferred methods and materials have been described herein, any methods and materials similar or equivalent to those described herein may be used in the implementation or testing of this invention. All references to this specification are incorporated by way of citation to disclose and describe methods and / or materials associated with those references. In the event of any conflict with any incorporated reference, the content of this specification shall prevail.

[0032] Various modifications and variations can be made to the specific embodiments described in this specification without departing from the scope or spirit of the invention, as will be apparent to those skilled in the art. Other embodiments derived from this specification will also be apparent to those skilled in the art. This specification and embodiments are merely exemplary.

[0033] The terms "contains," "includes," "has," "contains," etc., used in this article are all open-ended terms, meaning they include but are not limited to. Example

[0034] This embodiment provides a method for multi-terminal parallel authentication and authorization and device awareness in a mission-critical communication system. See the flowchart below. Figure 1 The method specifically includes the following steps: S1. Configuration Preparation: In the MCX system, the server, namely the configuration management server (CMS network element), pre-configures different initial configuration files for different types of terminals; The terminal's initial configuration file contains <mcptt-ue-id>Element, the <mcptt-ue-id>The element contains the next level <instance-id-urn>element, <instance-id-urn>The element is configured with a unique identifier for the terminal instance; The unique identifier of the instantiated terminal is embedded in at least one of the client type information and the terminal capability information; The client type information indicates the form and role of the terminal, including any one of mobile client applications, dispatch consoles, and vehicle terminals. The terminal capability information includes the terminal's hardware capabilities and / or software capabilities. For example, "urn:uuid:ue-screen-camera-xxx-clientrole:apk" indicates that the terminal instance has screen and camera capabilities and is a mobile application client type. In practical implementation, a mapping relationship data as shown in Table 1, between the unique identifier of the terminal instance and the client type and terminal capabilities, can be established and stored on the server side, so that the server can perform centralized and authoritative queries and decisions. Table 1 only shows a portion of the mapping relationship data.

[0035] Table 1: Mapping Relationship Data Table

[0036] S2. Configuration Issuance and Activation: When the terminal is powered on, its initial configuration file is downloaded to the terminal via offline import, copying, or online methods. The terminal is powered on again, attaches to the wireless network, and completes registration with the core network. Meanwhile, the MCX client application running on the terminal completes authentication with IdMS (Identity Management Server) and authorization for MCX general services.

[0037] S3, Authentication and Information Reporting: After completing the above steps, the terminal sends an authentication and service authorization request to the MCX system, which carries the information from its initial configuration file. <instance-id-urn>element; This request can be carried via the SIP protocol, specifically... <instance-id-urn>The element is carried in the message body of the SIP registration signaling.

[0038] More specifically, the SIP registration and authentication process includes the following steps: S31, Terminal initiates portability for the first time <instance-id-urn>SIP request for the element; After receiving the request, the S32 and SIP Core network elements return a 401 Unauthorized response message to the terminal. S33. When the terminal receives a 401 Unauthorized response message, it adds authentication information to the SIP registration signaling and re-initiates the authentication and service authorization request. After receiving the re-initiated request, the S34 and SIP Core network elements reconstruct the third-party registration request, using the re-initiated request message from the terminal as the message body of the SIP registration signaling, and forward it to the MCX service network element.

[0039] S4. Service Authorization and Configuration Distribution: The MCX service element receives the request, receives a third-party registration request from the SIP Core, and obtains the information by parsing the SIP message body. <instance-id-urn>element; Subsequently, the MCX service network element obtains the client type and terminal capabilities corresponding to the terminal instantiation unique identifier by querying the pre-set mapping relationship data, completes the parsing of the terminal instantiation unique identifier and records the parsing information, and stores the parsing information locally; The MCX service element compares the parsed information with the pre-configured service authorization policy and determines how to distribute user configuration file data based on the comparison result, specifically including two scenarios: Scenario 1: When parsing information to match service authorization policies, the MCX service network element sends the matching user configuration file data to the terminal, which contains the business permission information corresponding to the parsed information; Scenario 2: When the parsed information does not match the service authorization policy, the MCX service network element refuses to send complete user profile data to the terminal, or only sends limited user profile data to the terminal. Specifically: If the MCX service network element refuses to send complete user configuration data, it sends a rejection response message to the terminal, which may also include a reason for rejection. When only restricted user profile data is sent to the terminal, the restricted user profile data contains business permission information with limited functionality corresponding to the restricted client type or terminal capabilities.

[0040] After completing the service authorization and configuration distribution decisions, the MCX service network element sends a 200 OK response message to the SIP Core network element. The SIP Core network element forwards this 200 OK response message to the terminal, marking the completion of the entire MCX system service authentication and authorization process. The 200 OK response message may also include information such as expiration time. Application Scenario 1

[0041] This embodiment provides an application scenario based on the method of Embodiment 1 to illustrate the implementation process and technical effects of the present invention in detail. The corresponding process can be found in [reference needed]. Figure 2 .

[0042] Dispatch console users typically have the authority to initiate remote environment monitoring for other users. In this application scenario, user A ( Figure 2 Client A can log in to the dispatch console to perform business operations as a dispatcher, or log in to the mobile terminal APP to perform business operations as a regular MC user; User B ( Figure 2 Client B is a regular user who logs into the mobile terminal APP.

[0043] When Client A logs into a regular mobile terminal APP and initiates a remote environment monitoring service to Client B, the server will, based on the client type and user configuration file data it has obtained, inform the user of the currently logged-in user type and that the user does not have the permission to initiate remote environment monitoring.

[0044] The workflow for this application scenario is as follows: 1. MCX client A initiates a remote environment monitoring request to client B.

[0045] 2. When the MCX service network element receives the remote environment monitoring request sent by Client A, it first verifies whether Client A has the permission to initiate the request. During the registration authentication and service authorization process according to the method in Implementation Example 1, it obtains information such as the client type, user configuration data and corresponding permissions from the terminal instantiation information and finds that Client A is a regular user.

[0046] 3. Since ordinary users do not have the authority to initiate remote environment monitoring requests to other users, the MCX service network element rejects the remote environment monitoring request initiated by Client A.

[0047] 4. The MCX service network element sends a rejection response message to Client A, namely "403 Forbidden", with the reason for the rejection, namely "WARN: User has no permission". Application Scenario 2

[0048] This embodiment provides an application scenario based on the method of Embodiment 1 to illustrate the implementation process and technical effects of the present invention in detail. The corresponding process can be found in [reference needed]. Figure 3 .

[0049] User A ( Figure 3 Client A initiates a video group call to Group-1, and user B ( Figure 3 Client B and User C Figure 3 Client C) is a member of Group-1. Client B's terminal has no display screen, meaning this user lacks the ability to view and operate the video group call and cannot participate in it.

[0050] The workflow for this application scenario is as follows: 1. MCX client A initiates a video group call request to group-1.

[0051] 2. After receiving the request, the MCX service element parses Group-1 and obtains the group members Client B and Client C.

[0052] 3. During the registration, authentication, and service authorization process according to the method in Embodiment 1, based on the terminal capability information in the terminal instantiation information, it is found that the terminal logged in by Client B is a screenless terminal and does not have the hardware capability for video group calls. Therefore, the MCX service network element does not initiate a video call request to Client B. User C is a large-screen terminal and has the capability for video group calls. The MCX service network element decides to initiate a video call request to Client C.

[0053] 4. The MCX service network element sends a video call request to Client C.

[0054] 5. After receiving the request message, Client C can manually or automatically pick up the phone and return a video call response message, i.e., a 200 OK response message.

[0055] 6. After receiving the 200 OK response message, the MCX service element returns the response message to Client A.

[0056] As can be seen in this application scenario, the server can terminate the group call request to the terminal in advance based on the terminal's capabilities, and the server will not perform additional processing such as request, media negotiation, bearer application, signaling and media plane processing.

[0057] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for multi-terminal parallel authentication authorization and device awareness for mission critical communication systems, characterized in that, The method comprises the following steps: S1, configuration preparation: different terminal initial configuration files are preconfigured for different types of terminals at a server of a mission critical communication system; the terminal initial configuration file contains <mcptt-ue-id>elements, the <mcptt-ue-id>Element contains next level <instance-id-urn>elements; the <instance-id-urn>The element is configured with a terminal instantiation unique identifier;< / instance-id-urn> S2, configuration issuing and taking effect: the server issues a terminal initial configuration file to the terminal, and makes the terminal initial configuration file take effect through terminal restart; S3, authentication and information reporting: the terminal initiates an authentication and service authorization request to the mission critical communication system, and the request carries the <instance-id-urn>The element;< / instance-id-urn> S4, service authorization and configuration delivery: the service end receives the request, parses the request, and delivers the service configuration to the terminal. <instance-id-urn>The element records parsing information; the server decides whether to issue a matching user configuration file data to the terminal according to the parsing information.< / instance-id-urn> 2. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 1, characterized in that, The terminal instantiation unique identifier is embedded in at least one of client type information and terminal capability information; the parsing information contains at least one of the client type information and the terminal capability information according to the terminal instantiation unique identifier.

3. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 2, characterized in that, Step S1 further comprises establishing and storing mapping relationship data of the terminal instantiation unique identifier and the client type and the terminal capability on the server; in step S4, the server obtains the client type and the terminal capability corresponding to the terminal instantiation unique identifier by querying the mapping relationship data.

4. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 2, characterized in that, The client type information is used to indicate the form and role of the terminal, including any one of a mobile client application, a dispatching station and a vehicle-mounted terminal; the terminal capability information includes terminal hardware capability and / or terminal software capability.

5. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 1, characterized in that, In step S2, the terminal initial configuration file is issued to the terminal through offline import, offline copying or online downloading.

6. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 1, characterized in that, In step S3, the request is carried via the SIP protocol. <instance-id-urn>The element is carried in the message body of the SIP registration signaling.< / instance-id-urn> 7. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 6, characterized in that, Step S3 comprises the following steps: S31, the terminal initiates for the first time carrying <instance-id-urn>The SIP request of the element;< / instance-id-urn> S32, the SIP Core network element returns a 401 Unauthorized response message to the terminal; S33, the terminal receives the 401 Unauthorized response message, adds authentication information to the SIP registration signaling, and reinitiates an authentication and service authorization request; S34, the SIP Core network element reestablishes a third-party registration request, takes the reinitiated request message of the terminal as the message body of the SIP registration signaling, and forwards it to the server, which is an MCX service network element.

8. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 1, characterized in that, In step S4, the server compares the parsing information with a preset service authorization policy; when the parsing information matches the service authorization policy, the matching user configuration file data issued by the server to the terminal contains service permission information corresponding to the parsing information.

9. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 1, characterized in that, In step S4, the server compares the parsing information with a preset service authorization policy; when the parsing information does not match the service authorization policy, the server refuses to issue complete user configuration file data to the terminal or only issues limited user configuration file data to the terminal.

10. The method for mission critical communication system multi-terminal parallel authentication, authorization and device awareness according to claim 9, characterized in that, In step S4, when the server refuses to issue complete user configuration file data, the server sends a rejection response message to the terminal; when the server only issues limited user configuration file data to the terminal, the limited user configuration file data contains function-limited service permission information corresponding to limited client types or terminal capabilities.

Images