Identity authentication method and computer program product
By introducing the operator's authentication platform, the terminal interacts with the private network authentication system to generate a hash value HXRES, which solves the problem of customized transformation of SMF and UPF in 5G dual-domain private networks and realizes an efficient identity authentication process.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA MOBILE M2M
- Filing Date
- 2026-01-19
- Publication Date
- 2026-06-09
AI Technical Summary
In existing technologies, 5G dual-domain private network identity authentication requires customized modifications to the SMF or UPF, and additional deployment of the operator's security gateway and related systems within the private network campus, leading to increased complexity and cost.
By introducing the operator's authentication platform, the terminal interacts with the private network authentication system to generate a hash value HXRES. Using the authentication information determined by the interaction between the operator's authentication platform and the private network authentication system, terminal identity authentication can be achieved without customizing or modifying the SMF and UPF.
It enables identity authentication in 5G dual-domain private network scenarios without the need for customized modifications to SMF and UPF, simplifying the authentication process and improving efficiency and convenience.
Smart Images
Figure CN122179783A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of the Internet of Things, and more particularly to an identity authentication method and computer program product. Background Technology
[0002] 5G dual-domain private network is a dual-domain network model that provides services to 5G users, targeting both enterprises and individuals (ToBusiness To Consumer, 2B2C), based on 5G private networks. It solves the problem of collaborative access between public and private networks through 5G networks, and can meet users' needs for "no need to change SIM cards, no need to change phone numbers, and seamless switching", enabling them to access enterprise intranets and the Internet anytime, anywhere, securely and quickly.
[0003] In related technologies, the data transmission from the terminal to the 5G core network mainly refers to the Session Management Function (SMF), then to the User Plane Function (UPF), and finally to the private network authentication gateway. Throughout this process, the main focus is on adding header enhancements to the SMF or the dedicated UPF to insert the user's Mobile Subscriber International ISDN / PSTN number (MSISDN) information into the data packet. The MSISDN information is then parsed out at the private network authentication gateway to achieve user authentication. However, the authentication method of adding MSISDN to the protocol header has limited applicability to certain protocols, and the SMF or UPF requires customization and modification. Furthermore, it necessitates the additional deployment of the operator's security gateway and related systems within the user's private network campus. Summary of the Invention
[0004] This application provides an identity authentication method and computer program product to at least solve the problem in related technologies that identity authentication requires customization and modification of SMF or UPF.
[0005] In a first aspect, embodiments of this application provide an identity authentication method applied to a terminal, the method comprising: Send a connection request to the dedicated communication network; In response to the identity authentication of the private network authentication system of the dedicated communication network, the terminal's identification information is sent to the private network authentication system; The system receives authentication information sent by the private network authentication system and determines the expected response hash value HXRES based on the authentication information. The authentication information is information corresponding to the terminal that is determined by the interaction between the private network authentication system and the operator authentication platform. The HXRES is sent to the private network authentication system so that the private network authentication system can authenticate the terminal based on the HXRES. In response to the authentication success notification sent by the private network authentication system, the user accesses the private communication network.
[0006] Secondly, embodiments of this application provide an identity authentication method applied to a private network authentication system, the method comprising: In response to a connection request sent by a terminal, send an authentication notification to the terminal; Receive the identification information sent by the terminal; Based on the identification information, obtain the authentication information corresponding to the identification information, wherein the authentication information includes a random number combination encrypted value and a serial number; Receive HXRES sent by the terminal; The HXRES is compared with the stored HXRES. If the HXRES matches the stored HXRES, an authentication success notification is sent to the terminal.
[0007] Thirdly, embodiments of this application provide an identity authentication method applied to an operator authentication platform, the method comprising: Receive encrypted private network information sent by the receiving terminal; Verification of signatures is performed using the enterprise's public key corresponding to the dedicated communication network. If the signature verification is successful, the private key is used to decrypt the encrypted private network information to obtain a preset number of private network random numbers; Based on the preset number of private network random numbers, determine the HXRES and random number combination encryption value; Send a preset number of private network random numbers, HXRES, and encrypted values of random number combinations to the terminal.
[0008] Fourthly, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the steps of the method described in the first aspect, or implement the steps of the method described in the second aspect, or implement the steps of the method described in the third aspect.
[0009] In this embodiment, the terminal first sends a connection request to the dedicated communication network. Then, in response to the authentication of the dedicated network's authentication system, it sends its identification information to the authentication system. Next, it receives authentication information from the authentication system and determines the expected response hash value HXRES based on this information. The authentication information is determined by the interaction between the authentication system and the operator's authentication platform, corresponding to the terminal. HXRES is then sent back to the authentication system so that it can authenticate the terminal based on HXRES. Finally, the terminal responds to the authentication success notification from the authentication system and accesses the dedicated communication network. This embodiment introduces an operator's authentication platform to provide authentication information for the dedicated network's authentication system, eliminating the need for customized SMF and UPF. Conventional SMF and UPF can be used to achieve terminal authentication in a dual-domain dedicated network scenario, making authentication more convenient. Attached Figure Description
[0010] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of the identity authentication method provided in the embodiments of this application; Figure 2 This is a schematic diagram of the identity authentication structure provided in an embodiment of this application; Figure 3 This is a flowchart of another identity authentication method provided in the embodiments of this application; Figure 4 This is a flowchart of yet another identity authentication method provided in the embodiments of this application; Figure 5 This is a schematic diagram of the registration process provided in the embodiments of this application; Figure 6 This is a detailed flowchart illustrating the identity authentication method provided in the embodiments of this application; Figure 7 This is a schematic diagram of the identity authentication device provided in the embodiments of this application; Figure 8 This is a schematic diagram of another identity authentication device provided in an embodiment of this application; Figure 9 This is a schematic diagram of yet another identity authentication device provided in the embodiments of this application; Figure 10 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation
[0011] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0012] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.
[0013] The following is in conjunction with the appendix Figures 1 to 10 The present application provides a detailed description of an identity authentication method and computer program product through specific embodiments and application scenarios.
[0014] Figure 1 This is a flowchart illustrating an identity authentication method provided in an embodiment of this application. Figure 1 As shown, the authentication method is applied to the terminal, and the authentication method may include the contents shown in S101 to S105.
[0015] In S101, a connection request is sent to the dedicated communication network.
[0016] The dedicated communication network can be an internal network built by government agencies, enterprises, schools, and other organizations for their internal business needs. It can also be an internal network of other organizations, depending on the actual application; this embodiment does not impose any limitations.
[0017] In S102, in response to the identity authentication of the private network authentication system of the dedicated communication network, the terminal's identification information is sent to the private network authentication system.
[0018] In this embodiment, when the terminal sends a connection request to the dedicated communication network, the dedicated network authentication system of the dedicated network will authenticate the terminal's identity. The terminal sends its own identification information to the dedicated network authentication system so that the dedicated network authentication system can authenticate the terminal's identity based on the terminal's identification information.
[0019] The identification information can be the terminal's mobile phone number, the unique serial number of the SIM (Subscriber Identity Module) card, or other information, depending on the actual application. This embodiment does not limit the information.
[0020] In S103, the authentication information sent by the private network authentication system is received, and the hash value HXRES of the expected response is determined based on the authentication information. The authentication information is the information corresponding to the terminal determined by the interaction between the private network authentication system and the operator authentication platform.
[0021] The authentication information may include a random number combination encrypted value E (RandArg) and the corresponding serial number.
[0022] This embodiment can determine the hash value of the corresponding expected response (HXRES) based on the authentication information sent by the private network authentication system, so that the private network authentication system can perform identity authentication.
[0023] In S104, HXRES is sent to the private network authentication system so that the private network authentication system can authenticate the terminal based on HXRES.
[0024] In S105, the system responds to the authentication success notification sent by the private network authentication system and accesses the private communication network.
[0025] In this embodiment, the terminal first sends a connection request to the dedicated communication network. Then, in response to the authentication of the dedicated network's authentication system, it sends its identification information to the authentication system. Next, it receives authentication information from the authentication system and determines the expected response hash value HXRES based on this information. The authentication information is determined by the interaction between the authentication system and the operator's authentication platform, corresponding to the terminal. HXRES is then sent back to the authentication system so that it can authenticate the terminal based on HXRES. Finally, the terminal responds to the authentication success notification from the authentication system and accesses the dedicated communication network. This embodiment introduces an operator's authentication platform to provide authentication information for the dedicated network's authentication system, eliminating the need for customized SMF and UPF. Conventional SMF and UPF can be used to achieve terminal authentication in a dual-domain dedicated network scenario, making authentication more convenient.
[0026] Figure 2 This is a schematic diagram of the identity authentication structure. It includes the terminal, the operator network, and the dedicated communication network.
[0027] The terminal has a SIM card. The SIM card retains its original functions, namely supporting the authentication and key agreement (AKA) authentication response of the third-generation mobile communication network, and adds decryption functions and interfaces. The SIM card itself is used as the decryption key; it also adds hash operation capabilities, such as SHA256.
[0028] It's worth noting that the SIM AKA authentication process and principle are as follows: 1. The terminal, such as a mobile phone, reads the International Mobile Subscriber Identity (IMSI) from the SIM card. 2. The mobile phone sends the read IMSI to the operator network, which generates a random number RAND and sends it back to the mobile phone. 3. The mobile phone sends the random number to the SIM card. The SIM card uses the random number, its internally stored key (a 128-bit number paired with the IMSI, stored in the SIM card and unreadable externally; counterfeiters do not know the key), and an encryption algorithm to calculate a number RES and returns it to the mobile phone. 4. The mobile phone sends RES to the operator network. The operator network calculates RES based on the previously received IMSI, the corresponding key, RAND, and encryption algorithm, and compares it with the RES sent by the mobile phone. If they match, the SIM card is considered valid.
[0029] The operator network includes the operator authentication platform, namely the 5G dual-domain private network authentication platform.
[0030] Dedicated communication networks include dedicated network authentication systems and intranet applications, such as enterprise intranet authentication systems and applications. Dedicated communication networks do not require security gateways, identity authentication platforms, or other systems provided by operators.
[0031] It should be noted that the 5G core network does not require any additional customization or modification to the SMF.
[0032] In one possible implementation of this application, receiving authentication information sent by a private network authentication system and determining the hash value HXRES of the expected response based on the authentication information may include: receiving authentication information sent by the private network authentication system; sending the authentication information to the user identity SIM card of the terminal; and the SIM card determining HXRES based on the authentication information.
[0033] In this embodiment, after the terminal sends its own identification information to the private network authentication system, it can receive the authentication information sent by the private network authentication system. The authentication information is obtained based on the terminal's identification information, that is, the authentication information corresponds to the terminal's identification information. The terminal sends the authentication information to its own SIM card, and the SIM card can calculate the corresponding HXRES based on the authentication information.
[0034] In one example, the SIM card determines HXRES based on authentication information, which may include: the SIM card decrypting the authentication information using its own key to obtain a random number combination; determining a first random number corresponding to the private network authentication system based on the random number combination; determining the AKA response value of the random number combination based on the SIM card's key; and determining HXRES based on the first random number and the AKA response value.
[0035] Among them, the random number combination RandArg is a combination of the random number RandApp generated by the private network and the random number RandAuth generated by the operator's authentication platform.
[0036] In this embodiment, the SIM card can decrypt the authentication information E (RandArg) value using its own key to obtain the random number combination RandArg, and extract the string to obtain the RandApp value. Then, using the SIM card's key, the AKA response value Res of RandArg is calculated, and then Hxres is calculated, where Hxres = sha256(Res, RandApp). Finally, the Hxres value is returned to the terminal. This embodiment provides authentication information through the operator's authentication platform, and performs identity authentication based on the information generated by the interaction between the operator's authentication platform and the private network authentication system. This eliminates the need to deploy additional operator security gateways and related systems within the private network campus, making identity authentication more convenient and efficient.
[0037] Prior to the aforementioned identity authentication, the terminal needs to register or refresh its registration information in the private network authentication system so that the private network authentication system can obtain the terminal's identity information and the authentication information from the operator's authentication platform. In one possible embodiment of this application, the identity authentication method may further include: receiving a registration notification from the private network authentication system; sending a registration consent notification to the private network authentication system; receiving private network encrypted information from the private network authentication system, wherein the private network encrypted information is information encrypted using the public key of the operator's authentication platform; sending the private network encrypted information to the operator's authentication platform; receiving a preset number of private network random numbers, HXRES, and a preset number of random number combination encrypted values from the operator's authentication platform, and sending these to the private network authentication system.
[0038] Registration can refer to registration or refresh registration, depending on the actual application. This embodiment does not limit the scope.
[0039] This application embodiment enables registration in a private network authentication system, allowing the private network authentication system to interact with the operator's authentication platform. This allows the private network authentication system to save authentication information corresponding to the terminal. When the terminal subsequently connects to the private network, the terminal's information is compared with the saved authentication information to quickly perform identity authentication.
[0040] Figure 3 This is a flowchart illustrating an identity authentication method provided in an embodiment of this application. Figure 3 As shown, this identity authentication method is applied to a private network authentication system, and the identity authentication method may include the contents shown in S301 to S305.
[0041] In S301, in response to the connection request sent by the terminal, an authentication notification is sent to the terminal.
[0042] Upon receiving a network access request from a terminal, a connection is established with the terminal, and then the terminal is asked to provide identification information for identity authentication.
[0043] In S302, the identification information sent by the receiving terminal is received.
[0044] The identification information can be the terminal's mobile phone number, SIM card unique serial number, or other information, depending on the actual application. This embodiment does not impose any limitations.
[0045] In S303, based on the identification information, the authentication information corresponding to the identification information is obtained. The authentication information includes a random number combination encryption value and a serial number.
[0046] In this embodiment, the private network authentication system can obtain the authentication information corresponding to the terminal stored in its own memory based on the identification information.
[0047] In S304, the receiving terminal sends HXRES.
[0048] In S305, HXRES is compared with the stored HXRES. If the HXRES matches the stored HXRES, an authentication success notification is sent to the terminal.
[0049] In one embodiment, if HXRES is inconsistent with the stored HXRES, it indicates that authentication has failed, and an authentication failure notification is sent to the terminal.
[0050] In this embodiment, the system first responds to a connection request sent by the terminal and sends an authentication notification to the terminal. Next, it receives identification information sent by the terminal and, based on the identification information, obtains authentication information corresponding to the identification information. The authentication information includes a random number combination encrypted value and a sequence number. Then, it receives the HXRES sent by the terminal. Finally, it compares the HXRES with the stored HXRES. If the HXRES matches the stored HXRES, it sends an authentication success notification to the terminal. This embodiment of the application authenticates the terminal by comparing the authentication information stored in the private network authentication system with the HXRES sent by the terminal. This eliminates the need to deploy additional operator security gateways and related systems in the private network authentication system, making authentication more convenient and efficient.
[0051] Prior to the aforementioned identity authentication, the terminal needs to register or update its registration information in the private network authentication system so that the private network authentication system can obtain the terminal's identity information and the authentication information from the operator's authentication platform. In one possible embodiment of this application, the identity authentication method may further include: sending a registration notification to the terminal; responding to the received consent registration notification from the terminal by generating a preset number of private network random numbers; encrypting the preset number of private network random numbers using the public key of the operator's authentication platform to obtain encrypted private network random numbers; signing the encrypted private network random numbers, the enterprise identification information corresponding to the private communication network, and the terminal identification information using a private key to obtain encrypted private network information; and sending the encrypted private network information to the terminal.
[0052] In order to allow the random number value to be used to identify which random number it is in subsequent processes, and to ensure that the RandArg value is not repeated in subsequent processes, a preset number of private network random numbers are non-repeating random numbers.
[0053] In this embodiment, when a terminal registers or refreshes its registration in the private network authentication system, a random number can be generated. A preset number of private network random numbers are encrypted using the public key of the operator's authentication platform. The encrypted private network random number, the enterprise identification information corresponding to the dedicated communication network, and the terminal identification information are then signed. The signed encrypted random number is sent to the terminal so that the terminal can send the signed encrypted random number to the operator's authentication platform. The private network authentication system and the operator's authentication platform interact to achieve identity authentication.
[0054] In one possible implementation of this application, the authentication method may further include: receiving a preset number of private network random numbers, HXRES, and a preset number of encrypted combinations of random numbers sent by the terminal; and storing the preset number of private network random numbers, HXRES, and the preset number of encrypted combinations of random numbers, along with the terminal's identification information.
[0055] In this embodiment, the signed encrypted random number is sent to the terminal. The terminal can then send the signed encrypted random number to the operator authentication platform. The operator authentication platform generates an encrypted value combining HXRES and a preset number of random numbers based on the signed encrypted random number. The terminal sends the preset number of private network random numbers, HXRES, and the preset number of encrypted random numbers to the operator authentication platform. The operator authentication platform can store the above data in correspondence with the terminal so that when the terminal connects to the private network later, it can compare the terminal's information with the stored authentication information to quickly perform identity authentication.
[0056] Figure 4 This is a flowchart illustrating an identity authentication method provided in an embodiment of this application. Figure 4As shown, this identity authentication method is applied to the operator authentication platform, and the identity authentication method may include the contents shown in S401 to S405.
[0057] In S401, the receiving terminal sends encrypted private network information.
[0058] Among them, the private network encrypted information is obtained by the private network authentication system using the public key of the operator's authentication platform to encrypt a preset number of private network random numbers to obtain encrypted private network random numbers, and then using the private key to sign the encrypted private network random numbers, the enterprise identification information corresponding to the dedicated communication network, and the terminal identification information.
[0059] In S402, the signature is verified using the enterprise public key corresponding to the dedicated communication network.
[0060] This embodiment uses the enterprise public key corresponding to the dedicated communication network to verify the signature of the encrypted information on the dedicated network in order to determine the authenticity of the data.
[0061] In S403, if the signature verification is successful, the private key is used to decrypt the encrypted information of the private network to obtain a preset number of private network random numbers.
[0062] If the above verification is successful, the private key of the operator's authentication platform can be used to decrypt the encrypted private network information to obtain a preset number of private network random numbers.
[0063] In S404, the HXRES and random number combination encryption value is determined based on a preset number of private network random numbers.
[0064] In S405, a preset number of private network random numbers, HXRES, and encrypted values of random number combinations are sent to the terminal.
[0065] In this embodiment, the system first receives encrypted private network information from the terminal. Then, it verifies the signature using the enterprise public key corresponding to the private communication network. If the verification is successful, it decrypts the encrypted private network information using the private key to obtain a preset number of private network random numbers. Based on these preset number of random numbers, it determines the encrypted value of the combination of HXRES and the random numbers. Finally, it sends the preset number of random numbers, HXRES, and the encrypted value of the random numbers to the terminal. This embodiment enables mutual authentication between the terminal and the private network authentication system, thereby achieving terminal authentication within the system. This is not limited to specific application protocols, thus broadening the scope of authentication.
[0066] In one possible implementation of this application, determining the HXRES and the encrypted value of the random number combination based on a preset number of private network random numbers may include: generating a preset number of operator random numbers; obtaining a preset number of random number combinations based on the preset number of private network random numbers and operator random numbers; determining the AKA response value of the preset number of random number combinations using the key of the terminal's SIM card; obtaining a preset number of HXRES based on the AKA response value and the preset number of private network random numbers; encrypting the preset number of random number combinations using the key of the SIM card to obtain the encrypted value of the preset number of random number combinations; and sending the preset number of private network random numbers, the preset number of HXRES, and the encrypted value of the preset number of random number combinations to the terminal.
[0067] In this embodiment, after the operator authentication platform verifies the signature using the enterprise's public key, it decrypts the information using its own private key to obtain a preset number of random numbers. The operator authentication platform then generates another preset number of random numbers, which can be repeated, such as RandAuth1, RandAuth2, ..., RandAuthn. These random numbers are then combined with the received private network random numbers and the operator's own random numbers to form a new value, RandArg, which is mapped one-to-one with the received random numbers in a table. For ease of location, the table can be named after the user's mobile phone number.
[0068] The new value is composed of the private network random number and the operator random number. It can be a string concatenation or other methods to determine the new value, depending on the actual application. This embodiment does not limit it.
[0069] Figure 5 This is a diagram illustrating the registration process. It includes the following steps: S1. Terminal, such as a user terminal, accesses a dedicated communication network, such as an enterprise intranet, and establishes a connection with the dedicated network authentication system of the dedicated communication network, such as the enterprise intranet authentication system.
[0070] S2. The enterprise intranet authentication system requires user terminals to provide identification information.
[0071] S3. The user terminal provides identification information, such as a mobile phone number.
[0072] S4. The enterprise intranet authentication system detects that this mobile number is not registered and initiates a registration process. In other embodiments, if the enterprise intranet authentication system detects that the registration information corresponding to this mobile number has expired or needs to be updated, it initiates a refresh registration process.
[0073] S5. The user terminal agrees to start registration / refresh registration.
[0074] S6. The enterprise intranet authentication system generates n unique random numbers. n can be customized according to actual needs; the larger the value of n, the stronger the security and the longer the validity period of the registration information. Examples include RandApp1, RandApp2, ..., RandAppn. These numbers are encrypted using the public key of the operator's authentication platform, along with the enterprise name or enterprise identifier (ID) and user terminal ID (such as a mobile phone number). Finally, they are signed with the system's private key and returned to the user terminal.
[0075] The random number is unique for two reasons: first, to allow subsequent processes to identify the specific random number using the RandApp value; and second, to ensure that RandArg values in subsequent processes are not duplicated. Public key encryption is used for data transmission security. Signing with one's own private key is used to verify that the registration operation was indeed initiated by the enterprise's intranet authentication system. The same principle applies to encrypting and signing messages placed by the carrier platform in subsequent processes. Additionally, to prevent replay attacks, the current timestamp can be included in the signature.
[0076] S7. The user terminal forwards the received information to the operator's authentication platform.
[0077] S8. After the operator's authentication platform verifies the signature using the company's public key, it decrypts the information using its own private key to obtain the n non-repeating random numbers from S6 above.
[0078] S9. The operator authentication platform generates n random numbers, which can be repeated, such as RandAuth1, RandAuth2, ..., RandAuthn. These, along with the received n random numbers and its own n random numbers, form a new value RandArg, which is mapped one-to-one with the received random numbers in a table. For easy location, the table can be named after the user's mobile phone number, as shown in Table 1 below: Table 1
[0079] Then, using RandArg as the input parameter and the corresponding user's SIM card key, the corresponding AKA response result Res is calculated, and Hxres is calculated, where Hxres = sha256(Res, RandApp). The RandArg value is then encrypted using the user's corresponding SIM card key to obtain the encrypted value E(RandArg). This process is repeated n times to obtain Table 2, as shown below: Table 2
[0080] The reason RandApp is not used as an input parameter in calculating Res is to protect the SIM card key from being cracked. The reason SHA256 is performed on the result of calculating Res is also to protect the SIM card key from being cracked. RandApp is used instead of RandArg in calculating Hxres because in subsequent processes, the enterprise intranet authentication system calculates Hxres for verification, and the enterprise intranet authentication system only knows the RandApp value. The values of Res and RandArg are not provided. The values of RandApp, Hxres, and E (RandArg) are returned.
[0081] The operator's authentication platform encrypts RandApp, Hxres, and E (RandArg) using the public key of the enterprise's intranet authentication system, and then signs them with its own private key before returning them to the user terminal.
[0082] S10. The user terminal forwards the information returned by the operator's authentication platform to the enterprise's intranet authentication system.
[0083] S11. The enterprise intranet authentication system verifies and decrypts the signature to obtain RandApp, Hxres, and E (RandArg), then stores them and associates them one-to-one with the user's mobile phone number.
[0084] Figure 6 This is a detailed flowchart illustrating the identity authentication method. It includes the following steps: S1. The user terminal accesses the enterprise intranet and establishes a connection with the enterprise intranet authentication system.
[0085] S2. The enterprise intranet authentication system requires user terminals to provide identity information.
[0086] S3. The user terminal provides identity information, such as a mobile phone number.
[0087] S4. The enterprise intranet authentication system detects that this mobile number is registered. It randomly selects one of the n E (RandArg) values corresponding to the mobile number, records its sequence number, and returns the sequence number and E (RandArg). For example, if the 3rd value is selected, then the system returns the sequence number 3 and E (RandArg) 3.
[0088] S5. The user terminal transmits E (RandArg) to the SIM card.
[0089] S6. The SIM card decrypts the E (RandArg) value using its own key to obtain RandArg, extracts the string, and then obtains the RandApp value. Next, using the SIM card's key and according to the agreed-upon algorithm, it calculates the AKA response value Res of RandArg, and then calculates Hxres, where Hxres = sha256(Res, RandApp). Finally, the Hxres value is returned to the user terminal.
[0090] S7. The user terminal returns Hxres and the serial number to the enterprise intranet authentication system.
[0091] S8. The enterprise intranet authentication system compares the Hxres value. If they match, the authentication is successful; otherwise, the authentication fails.
[0092] This application's embodiment employs an operator authentication platform. In a dual-domain private network scenario, a series of authentication information is pre-generated according to an agreed-upon algorithm and returned to the authenticator. During the authentication process, when the authenticator and the authenticated party exchange data, this authentication information serves as verification information to help complete the authentication process. This application is not limited to the application's communication protocol and does not require the additional deployment of any operator-provided security gateways or operator-provided identity authentication platforms on the dedicated communication network. It also does not require additional customization or modification of the SMF / UPF to achieve a unified identity authentication platform for intranet users in a 5G dual-domain private network to authenticate user identities.
[0093] Figure 7 This is a schematic diagram of an identity authentication device provided in an embodiment of this application. Figure 7 As shown, the identity authentication device is applied to a terminal and may include: a first sending module 701, a second sending module 702, a determining module 703, a third sending module 704, and an access module 705.
[0094] The system comprises the following modules: a first sending module 701, used to send a connection request to the dedicated communication network; a second sending module 702, used to respond to the identity authentication of the dedicated network authentication system by sending the terminal's identification information to the dedicated network authentication system; a determining module 703, used to receive the authentication information sent by the dedicated network authentication system and determine the expected response hash value HXRES based on the authentication information, wherein the authentication information is information corresponding to the terminal determined by the interaction between the dedicated network authentication system and the operator authentication platform; a third sending module 704, used to send HXRES to the dedicated network authentication system so that the dedicated network authentication system can authenticate the terminal based on HXRES; and an access module 705, used to respond to the identity authentication pass notification sent by the dedicated network authentication system and access the dedicated communication network.
[0095] In this embodiment, the first sending module 701 first sends a connection request to the dedicated communication network. Then, the second sending module 702 responds to the authentication of the dedicated network's authentication system by sending the terminal's identification information to the authentication system. Next, the determining module 703 receives the authentication information sent by the authentication system and determines the expected response hash value HXRES based on the authentication information. The authentication information is the terminal-specific information determined by the interaction between the dedicated network authentication system and the operator's authentication platform. The third sending module 704 then sends HXRES to the dedicated network authentication system, enabling the system to authenticate the terminal based on HXRES. Finally, the access module 705 responds to the authentication success notification sent by the dedicated network authentication system and accesses the dedicated communication network. This embodiment introduces an operator's authentication platform to provide authentication information for the dedicated network's authentication system, eliminating the need for customized SMF and UPF. Conventional SMF and UPF can be used to achieve terminal authentication in a dual-domain dedicated network scenario, making authentication more convenient.
[0096] In one possible implementation of this application, the determining module 703 is configured to: receive authentication information sent by the private network authentication system; send the authentication information to the user identity recognition SIM card of the terminal; and determine HXRES based on the authentication information.
[0097] In one possible implementation of this application, the determining module 703 is configured to: decrypt the authentication information using its own key to obtain a random number combination; determine a first random number corresponding to the private network authentication system based on the random number combination; determine the AKA response value of the random number combination based on the key of the SIM card; and determine HXRES according to the first random number and the AKA response value.
[0098] In one possible embodiment of this application, the identity authentication device may further include a first receiving module, a fourth sending module, a second receiving module, a fifth sending module, and a third receiving module.
[0099] The system comprises: a first receiving module for receiving a registration notification sent by the private network authentication system; a fourth sending module for sending a registration consent notification to the private network authentication system; a second receiving module for receiving private network encrypted information sent by the private network authentication system, wherein the private network encrypted information is information encrypted using the public key of the operator authentication platform; a fifth sending module for sending the private network encrypted information to the operator authentication platform; and a third receiving module for receiving a preset number of private network random numbers, HXRES, and a preset number of random number combination encrypted values sent by the operator authentication platform, and sending these to the private network authentication system.
[0100] The identity authentication device in this application already has the functionality of... Figure 1 The method embodiments shown are described in detail. Therefore, for any parts not covered in detail in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.
[0101] Figure 8 This is a schematic diagram of an identity authentication device provided in an embodiment of this application. Figure 8 As shown, the identity authentication device is applied to a private network authentication system. The identity authentication device may include: a sixth sending module 801, a fourth receiving module 802, an acquisition module 803, a fifth receiving module 804, and a comparison module 805.
[0102] The sixth sending module 801 is used to respond to the connection request sent by the terminal and send an authentication notification to the terminal; the fourth receiving module 802 is used to receive the identification information sent by the terminal; the acquisition module 803 is used to acquire the authentication information corresponding to the identification information based on the identification information, the authentication information including a random number combination encrypted value and a sequence number; the fifth receiving module 804 is used to receive the HXRES sent by the terminal; and the comparison module 805 is used to compare the HXRES with the stored HXRES, and if the HXRES is consistent with the stored HXRES, send an authentication success notification to the terminal.
[0103] In this embodiment, firstly, the sixth sending module 801 responds to the connection request sent by the terminal and sends an authentication notification to the terminal. Secondly, the fourth receiving module 802 receives the identification information sent by the terminal, and the acquisition module 803 acquires the authentication information corresponding to the identification information based on the identification information. The authentication information includes a random number combination encrypted value and a sequence number. Then, the fifth receiving module 804 receives the HXRES sent by the terminal. Finally, the comparison module 805 compares the HXRES with the stored HXRES. If the HXRES matches the stored HXRES, an authentication success notification is sent to the terminal. This embodiment compares the authentication information stored in the private network authentication system with the HXRES sent by the terminal to authenticate the terminal. This eliminates the need to deploy additional operator security gateways and related systems in the private network authentication system, making authentication more convenient and efficient.
[0104] In one possible implementation of this application, the identity authentication device may further include: a seventh sending module, a generation module, an encryption module, a signature module, and an eighth sending module.
[0105] The seventh sending module is used to send a registration notification to the terminal; the generation module is used to generate a preset number of private network random numbers in response to receiving the consent registration notification sent by the terminal; the encryption module is used to encrypt the preset number of private network random numbers using the public key of the operator's authentication platform to obtain encrypted private network random numbers; the signature module is used to sign the encrypted private network random numbers, the enterprise identification information corresponding to the private communication network, and the terminal identification information using the private key to obtain encrypted private network information; and the eighth sending module is used to send the encrypted private network information to the terminal.
[0106] In one possible implementation of this application, the identity authentication device may further include: a sixth receiving module and a storage module.
[0107] The sixth receiving module is used to receive a preset number of private network random numbers, HXRES, and a preset number of encrypted combinations of random numbers sent by the terminal; the storage module is used to store the preset number of private network random numbers, HXRES, and the preset number of encrypted combinations of random numbers, as well as the terminal's identification information.
[0108] The identity authentication device in this application already has the functionality of... Figure 3 The method embodiments shown are described in detail. Therefore, for any parts not covered in detail in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.
[0109] Figure 9 This is a schematic diagram of an identity authentication device provided in an embodiment of this application. Figure 9 As shown, the identity authentication device is applied to the operator authentication platform. The identity authentication device may include: a seventh receiving module 901, a signature verification module 902, a decryption module 903, a second determining module 904, and a ninth sending module 905.
[0110] The system includes a seventh receiving module 901, which receives encrypted private network information sent by the terminal; a signature verification module 902, which verifies the signature using the enterprise public key corresponding to the private communication network; a decryption module 903, which, if the signature verification is successful, decrypts the encrypted private network information using a private key to obtain a preset number of private network random numbers; a second determining module 904, which determines the HXRES and random number combination encryption value based on the preset number of private network random numbers; and a ninth sending module 905, which sends the preset number of private network random numbers, HXRES, and random number combination encryption value to the terminal.
[0111] In this embodiment, the seventh receiving module 901 first receives the private network encrypted information sent by the terminal. Then, the signature verification module 902 verifies the signature using the enterprise public key corresponding to the private communication network. If the signature verification is successful, the decryption module 903 decrypts the private network encrypted information using the private key to obtain a preset number of private network random numbers. Next, the second determining module 904 determines the encrypted value of the combination of HXRES and the random numbers based on the preset number of private network random numbers. Finally, the ninth sending module 905 sends the preset number of private network random numbers, HXRES, and the encrypted value of the random numbers to the terminal. This embodiment enables mutual authentication between the terminal and the private network authentication system, thereby achieving terminal authentication within the private network authentication system. This is not limited to the application's protocol, thus broadening the scope of authentication.
[0112] In one possible implementation of this application, the second determining module 904 is configured to: generate a preset number of operator random numbers; obtain a preset number of random number combinations based on the preset number of private network random numbers and operator random numbers; determine the AKA response value of the preset number of random number combinations using the key of the terminal's SIM card; obtain a preset number of HXRES based on the AKA response value and the preset number of private network random numbers; encrypt the preset number of random number combinations using the key of the SIM card to obtain the encrypted value of the preset number of random number combinations; and send the preset number of private network random numbers, the preset number of HXRES, and the encrypted value of the preset number of random number combinations to the terminal.
[0113] The identity authentication device in this application already has the functionality of... Figure 4 The method embodiments shown are described in detail. Therefore, for any parts not covered in detail in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.
[0114] like Figure 10 As shown, this application embodiment also provides an electronic device 1000, including a processor 1001, a memory 1002, and a program or instructions stored in the memory 1002 and executable on the processor 1001. When the program or instructions are executed by the processor 1001, they implement the various processes of the above-described identity authentication processing method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.
[0115] Optionally, embodiments of this application also provide a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described identity authentication method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.
[0116] Optionally, this application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer, implement the various processes of the above-described identity authentication method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.
[0117] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.
[0118] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.
[0119] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.
Claims
1. An identity authentication method, characterized in that, Applied to a terminal, the method includes: Send a connection request to the dedicated communication network; In response to the identity authentication of the private network authentication system of the dedicated communication network, the terminal's identification information is sent to the private network authentication system; The system receives authentication information sent by the private network authentication system and determines the expected response hash value HXRES based on the authentication information. The authentication information is information corresponding to the terminal that is determined by the interaction between the private network authentication system and the operator authentication platform. The HXRES is sent to the private network authentication system so that the private network authentication system can authenticate the terminal based on the HXRES. In response to the authentication success notification sent by the private network authentication system, the user accesses the private communication network.
2. The method according to claim 1, characterized in that, The step of receiving authentication information sent by the private network authentication system and determining the hash value HXRES of the expected response based on the authentication information includes: Receive authentication information sent by the private network authentication system; The authentication information is sent to the user identification SIM card of the terminal; The SIM card determines HXRES based on the authentication information.
3. The method according to claim 2, characterized in that, The SIM card determines HXRES based on the authentication information, including: The SIM card uses its own key to decrypt the authentication information and obtain a random number combination; Based on the combination of random numbers, a first random number corresponding to the private network authentication system is determined; Based on the key of the SIM card, determine the AKA response value of the random number combination; HXRES is determined based on the first random number and the AKA response value.
4. The method according to claim 1, characterized in that, The method further includes: Receive the registration notification sent by the private network authentication system; Send a registration consent notification to the private network authentication system; Receive private network encrypted information sent by the private network authentication system, wherein the private network encrypted information is information encrypted using the public key of the operator's authentication platform; The encrypted private network information is sent to the operator's authentication platform; The system receives a preset number of private network random numbers, HXRES, and a preset number of encrypted combinations of random numbers sent by the operator's authentication platform, and then sends them to the private network authentication system.
5. An identity authentication method, characterized in that, The method, applied to a private network authentication system, includes: In response to a connection request sent by a terminal, send an authentication notification to the terminal; Receive the identification information sent by the terminal; Based on the identification information, obtain the authentication information corresponding to the identification information, wherein the authentication information includes a random number combination encrypted value and a serial number; Receive HXRES sent by the terminal; The HXRES is compared with the stored HXRES. If the HXRES matches the stored HXRES, an authentication success notification is sent to the terminal.
6. The method according to claim 5, characterized in that, The method further includes: Send a registration notification to the terminal; Upon receiving the consent registration notification sent by the terminal, a preset number of private network random numbers are generated; The preset number of private network random numbers are encrypted using the public key of the operator's authentication platform to obtain encrypted private network random numbers; The encrypted private network information is obtained by signing the encrypted private network random number, the enterprise identification information corresponding to the private communication network, and the terminal identification information using the private key. The encrypted private network information is sent to the terminal.
7. The method according to claim 6, characterized in that, The method further includes: Receives a preset number of private network random numbers, HXRES, and a preset number of encrypted combinations of random numbers sent by the terminal; The preset number of private network random numbers, HXRES, and the preset number of random number combination encryption values, along with the terminal's identification information, are stored accordingly.
8. An identity authentication method, characterized in that, Applied to an operator authentication platform, the method includes: Receive encrypted private network information sent by the receiving terminal; Verification of signatures is performed using the enterprise's public key corresponding to the dedicated communication network. If the signature verification is successful, the private key is used to decrypt the encrypted private network information to obtain a preset number of private network random numbers; Based on the preset number of private network random numbers, determine the HXRES and random number combination encryption value; Send a preset number of private network random numbers, HXRES, and encrypted values of random number combinations to the terminal.
9. The method according to claim 8, characterized in that, The process of determining the HXRES and random number combination encryption value based on the preset number of private network random numbers includes: Generate a preset number of operator random numbers; Based on the preset number of private network random numbers and operator random numbers, a preset number of random number combinations are obtained; Using the key of the SIM card of the terminal, determine the AKA response value of the preset number of random number combinations; Based on the AKA response value and the preset number of private network random numbers, a preset number of HXRES is obtained; The preset number of random number combinations are encrypted using the key of the SIM card to obtain the encrypted value of the preset number of random number combinations; The preset number of private network random numbers, the preset number of HXRES, and the preset number of random number combination encrypted values are sent to the terminal.
10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, implement the steps of the method as claimed in any one of claims 1 to 4, or the steps of the method as claimed in any one of claims 5 to 7, or the steps of the method as claimed in claim 8 or 9.