A verification method, an identifier transmission method, and related equipment

Abstract

This application discloses a verification method, an identifier transmission method, and related equipment to address the problem in existing technologies where user terminals are directly allowed to access 5G / 5G-A networks without verifying their OS ID and SD ID, potentially leading to network security risks. The verification method includes receiving a core network registration request from a user terminal; the core network registration request contains a first identifier of the user terminal; the first identifier contains at least one of a unique operating system identifier and a security digital identifier; in response to the core network registration request, querying a user data management network element for a second identifier contained in the user terminal's subscription data; the second identifier contains at least one of a unique operating system identifier and a security digital identifier; and determining the legitimacy of the user terminal's identity based on the first identifier and the queried second identifier.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a verification method, an identification transmission method, an apparatus, a device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] For user terminals, the identifiers include Subscription Concealed Identifier (SUCI), Permanent Equipment Identifier (PEI), Operating System Identifier (OS ID), and Secure Digital Identification (SD ID) for user terminal storage cards / password cards.

[0003] According to existing technologies, the 5G / 5G-A core network can authenticate the SUCI of the user terminal through the Extensible Authentication Protocol-Authentication and Key Agreement prime (EAP-AKA) and the 5th-Generation Authentication and Key Agreement (5G AKA) authentication methods, and verify the PEI through the Equipment Identity Register (EIR) service. However, there is currently no technology to verify the OSID and SD ID of the user terminal.

[0004] In specific scenarios with high security requirements, users are required to use specific domestic operating systems or specific storage cards / encryption cards. If, in such scenarios, the 5G / 5G-A core network fails to verify the OS ID and SD ID of the user terminal and directly allows the user terminal to access the 5G / 5G-A network, it may result in unauthorized terminals that have tampered with the operating system or replaced with non-compliant storage cards / encryption cards being able to access the network and use network services normally. This could lead to network security risks such as leakage of core business data and unauthorized remote monitoring and control of user terminals by third parties. Summary of the Invention

[0005] This application provides a verification method and related equipment to address the problem in the prior art where user terminals are directly allowed to access 5G / 5G-A networks without verifying their OS ID and SD ID, which may lead to network security risks.

[0006] The embodiments of this application adopt the following technical solutions: A verification method is applied to a core network element in the core network control plane. The method includes: receiving a core network registration request sent by a user terminal; the core network registration request includes a first identifier of the user terminal; the first identifier includes at least one of a unique operating system identifier and a security digital identifier of the user terminal; in response to the core network registration request, querying a user data management network element for a second identifier contained in the user terminal's subscription data; the second identifier includes at least one of a unique operating system identifier and a security digital identifier of the user terminal; and determining whether the user terminal's identity is legitimate based on the first identifier and the queried second identifier.

[0007] A method for transmitting an identifier, the method being applied to a user data management network element, the method comprising: responding to a query request for a user terminal identifier from a core network control plane core network element, obtaining an identifier from the user terminal's subscription data; the identifier comprising at least one of the user terminal's operating system unique identifier and a security digital identifier; and sending the obtained identifier to the core network control plane core network element.

[0008] A method for sending an identifier, the method being applied to a user terminal, the method comprising: Obtain the identifier of the user terminal; the identifier includes at least one of the user terminal's operating system unique identifier and security digital identifier; and send the identifier to the radio access network in a core network registration request.

[0009] A verification device includes: a request receiving unit, configured to receive a core network registration request sent by a user terminal; the core network registration request includes a first identifier of the user terminal; the first identifier includes at least one of an operating system unique identifier and a security digital identifier of the user terminal; an identifier query unit, configured to query a user data management network element for a second identifier contained in the user terminal's subscription data in response to the core network registration request; the second identifier includes at least one of an operating system unique identifier and a security digital identifier of the user terminal; and an identity verification unit, configured to determine whether the identity of the user terminal is legitimate based on the first identifier and the queried second identifier.

[0010] An identifier sending apparatus, the apparatus comprising: an identifier acquisition unit, configured to acquire an identifier from the subscription data of a user terminal in response to a query request for a user terminal identifier from a core network element of the core network control plane; the identifier comprising at least one of a unique operating system identifier and a security digital identifier of the user terminal; and an identifier sending unit, configured to send the acquired identifier to the core network element of the core network control plane.

[0011] An identifier transmission apparatus, the apparatus comprising: an identifier acquisition unit for acquiring an identifier of a user terminal; the identifier comprising at least one of an operating system unique identifier and a security digital identifier of the user terminal; and an identifier transmission unit for transmitting the identifier in a core network registration request to a radio access network.

[0012] A computing device includes: a memory and a processor, wherein, The memory is used to store computer programs; The processor, coupled to the memory, is used to execute the computer program stored in the memory for performing the methods described above.

[0013] A computer-readable storage medium storing a computer program that, when executed by a computer, enables the implementation of the above-described method.

[0014] A computer program product storing instructions that, when executed by a computer, cause the computer to perform the method described above.

[0015] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects: Since the subscription data of a user terminal is a legitimate benchmark data that can prove the legitimacy of the user terminal, it is a reasonable and accurate verification method to determine the legitimacy of the user terminal's identity based on the first identifier (including at least one of the user terminal's OS ID and SD ID) contained in the core network registration request sent by the user terminal and the second identifier (including at least one of the user terminal's OS ID and SD ID) contained in the user terminal's subscription data. By adopting this verification method during the core network registration process of the user terminal, the problem of directly allowing the user terminal to access the 5G / 5G-A network without verifying the user terminal's OSID and SD ID, which may lead to network security risks, can be avoided in the existing technology. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating the specific implementation of a verification method provided in this application embodiment; Figure 2 A flowchart illustrating a specific implementation of an identifier sending method provided in this application embodiment; Figure 3A flowchart illustrating the specific implementation of another identifier sending method provided in this application embodiment; Figure 4 This is a flowchart illustrating the specific implementation of the scheme for authenticating the OS ID and SD ID of a UE in the scenario of UE registration to the 5G core network proposed in this application embodiment; Figure 5 This is a schematic diagram of the specific structure of a verification device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the specific structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] As will be known to those skilled in the art, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0019] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0020] Example 1 Embodiment 1 of this application provides a verification method to solve the problem in the prior art that user terminals are directly allowed to access 5G / 5G-A networks without verifying the OSID and SDID of the user terminal, which may cause network security risks.

[0021] Different steps of this method can be implemented by the same execution entity or by different execution entities. This application does not limit which execution entity is used to implement the method.

[0022] Furthermore, the embodiments of this application do not limit the execution order of different steps. When using the method provided in the embodiments of this application, the execution order of different steps can be adjusted according to actual needs.

[0023] The following describes the method provided in this application embodiment in detail, taking the core network element of the core network control plane as the execution subject of this method.

[0024] In one optional implementation, when the core network is a 5G core network, the core network elements of the core network control plane may include, but are not limited to, Access and Mobility Management Function (AMF) network elements.

[0025] In one optional implementation, when the core network is a 4G core network, the core network elements of the core network control plane may include, but are not limited to, a Mobility Management Entity (MME).

[0026] like Figure 1 The diagram shown is a flowchart illustrating a specific implementation of a verification method provided in this application, including the following steps: Step 11: Receive the core network registration request sent by the user terminal; The core network registration request includes a first identifier for the user terminal. This first identifier includes at least one of the user terminal's OSID and SD ID.

[0027] In one optional implementation, when the core network is a 5G core network, the core network registration request initiated by the user terminal can be a Registration Request. In another optional implementation, the user terminal can send a Registration Request to a Next Generation Node B (gNB, which is the core network element of the radio access network in a 5G NR network), and then the gNB can send the Registration Request to the AMF.

[0028] In one optional implementation, when the core network is a 4G core network, the attach request initiated by the user terminal is equivalent to the core network registration request described in the embodiments of this application.

[0029] Step 12: In response to the core network registration request, query the user data management network element for the second identifier contained in the subscription data of the user terminal; The second identifier includes at least one of the user terminal's OS ID and SD ID. The SD ID referred to here may be the SD ID of the user terminal's memory card and / or the SD ID of its password card.

[0030] In an optional implementation, when the core network is a 5G core network, the user data management network element may refer to Unified Data Management (UDM).

[0031] In an optional implementation, when the core network is a 4G core network, the user data management network element may refer to the Home Subscriber Server (HSS).

[0032] In one optional implementation, step 12 may include: in response to the core network registration request, querying the second identifier contained in the user terminal's subscription data by calling the terminal context registration service provided by the user data management network element.

[0033] In a specific example, for UDM, the terminal context registration service provided by UDM can be the Nudm_UECM_Registration service.

[0034] In one optional implementation, the method of invoking the terminal context registration service provided by the user data management network element may specifically include: sending a call message for the terminal context registration service to a dedicated interface for other network elements to access the user data management network element. For example, taking the terminal context registration service as the Nudm_UECM_Registration service, the call message may refer to the Nudm_UECM_Registration message.

[0035] In this embodiment, the call message may include a user identifier. When the core network is a 5G core network, this user identifier may, for example, refer to a Subscription Permanent Identifier (SUPI). The SUPI is a unique permanent identification number for a user in a 5G network, equivalent to the IMSI (International Mobile Subscriber Identity) in 4G, assigned by the operator and permanently bound to the user's subscription data.

[0036] The user identifier is used as a query condition for the user data management network element to query the second identifier.

[0037] Taking UDM as an example, after receiving the Nudm_UECM_Registration message sent by AMF, UDM first parses the message and extracts the core keyword SUPI. Then, according to the internal communication interface protocol, UDM issues a data query command to the associated Unified User Data Repository (uUDR). The query condition can specify only the SUPI. Since uUDR uses a relational / distributed database to store user data, the data table uses SUPI as the primary key index. The primary key index is unique and can skip the full table scan to directly locate the data row. Therefore, after receiving the SUPI, uUDR's database engine can use the SUPI as the query condition and quickly match the data record that is completely consistent with the SUPI through the index tree (B+ tree). A single match can lock the unique target user dataset corresponding to the SUPI.

[0038] This unique target user dataset typically stores the user's complete information, comprising three main categories: (1) Contract data; (2) Terminal capability data: specific values ​​of HoIVoPS, etc.; (3) Business permission data: voice, data, roaming, value-added service activation permissions, etc.

[0039] In this embodiment of the application, the subscription data may include: Access and Mobility Subscription data, SMF Selection Subscription data, and UE context in SMF data. SMF stands for Session Management Function.

[0040] The access and mobile user data includes: Allowed NSSAI / Default S-NSSAI, RFSPIndex (Radio Resource Scheduling Policy Index), Subscribed DNN / PDU Session parameters, AccessRestriction, UE operating system unique identifier OS ID, and UE memory card and / or password card unique identifier SD ID.

[0041] In one alternative implementation, the UDM, in response to the Nudm_UECM_Registration message, may provide only the queried OS ID and / or SD ID to the AMF.

[0042] In an optional implementation, when the core network is a 4G core network, the call message can be an InsertSubscriber Data message, which can be transmitted through a 4G core network standard interface (such as a dedicated interaction interface between the MME and HSS) to realize the registration, updating and association of terminal context and user subscription information.

[0043] Step 13: Determine whether the user terminal's identity is legitimate based on the first identifier and the retrieved second identifier.

[0044] As mentioned above, the second identifier originates from the subscription data. Since the subscription data of the user terminal is a legitimate benchmark data that can prove the legitimacy of the user terminal, it is a reasonable and accurate verification method to determine the legitimacy of the user terminal's identity based on the first identifier (including at least one of the user terminal's OS ID and SD ID) contained in the core network registration request sent by the user terminal and the second identifier (including at least one of the user terminal's OS ID and SD ID) contained in the user terminal's subscription data. By adopting this verification method during the core network registration process of the user terminal, the problem of directly allowing the user terminal to access the 5G / 5G-A network without verifying the user terminal's OS ID and SD ID, which may lead to network security risks, can be avoided in the prior art.

[0045] It should be noted that the inventive concept provided in this application is not limited to 5G / 5G-A networks, but can also be applied to 4G networks, 6G networks, etc. This application does not limit the specific application scenarios of the inventive concept.

[0046] In a specific example, when this method is applied to a 4G network, it can be implemented using the following steps: The MME receives an attach request sent by the user terminal (equivalent to a core network registration request in a 5G network in this embodiment). The attach request carries a first identifier reported by the user terminal. The first identifier is one or a combination of two of the terminal operating system unique identifier and a security digital identifier. In response to the attach request, the MME sends a query command to the HSS to read the second identifier from the user subscription data corresponding to the user terminal. The second identifier also contains at least one of the terminal operating system unique identifier and the security digital identifier. The MME compares and verifies the first identifier reported by the user terminal with the second identifier obtained from the HSS: if the two match, the user terminal is deemed to be legitimate and the subsequent attach process continues; if the two do not match, the terminal is deemed to be illegitimate and the attach request is rejected.

[0047] In one optional implementation, taking the AMF in the 5G core network as an example, in step 13, the AMF can determine whether the user terminal's identity is legitimate by comparing whether the first identifier and the queried second identifier match.

[0048] Assuming both the first and second identifiers include an OS ID, a unique storage card identifier (SD ID), and a cryptographic card identifier, then if the OS ID in the subscription data does not match the OS ID in the core network registration request, or if the SD ID of the storage card in the subscription data does not match the SD ID of the storage card in the core network registration request, or if the SD ID of the cryptographic card in the subscription data does not match the SD ID of the cryptographic card in the core network registration request, then the UE is determined to be an illegitimate UE. In such a case, in an optional implementation, the AMF can further send an EquipmentIdentity Check Response via the gNB to the UE to notify it of its legitimacy (in this case, this response is used to notify the UE of its illegitimacy), thereby denying the UE access to the 5G network.

[0049] If the comparison results show that the OS ID in the subscription data matches the OS ID in the core network registration request, and the SD ID of the storage card in the subscription data matches the SD ID of the storage card in the core network registration request, and the SD ID of the cryptographic card in the subscription data matches the SD ID of the cryptographic card in the core network registration request, then the UE is determined to be a legitimate UE. In such a case, in an optional implementation, the AMF can send an Equipment Identity Check Response to the UE via the gNB to notify the UE of its legitimacy (in this case, the response is used to notify the UE of its legitimacy).

[0050] Based on the same inventive concept described above, this application, taking the user data management network element as the executing entity, also provides an identifier sending method. The specific implementation flowchart of this method is as follows: Figure 2 As shown, it includes the following steps: Step 21: In response to the query request for the user terminal identifier from the core network element of the core network control plane, obtain the identifier from the user terminal's subscription data; The identifier includes at least one of the user terminal's OS ID and SD ID.

[0051] As mentioned above, when the core network is a 5G core network, the core network elements of the core network control plane may include, but are not limited to, AMF; when the core network is a 4G core network, the core network elements of the core network control plane may include, but are not limited to, MME.

[0052] Correspondingly, when the core network is a 5G core network, the user data management network element can refer to UDM; when the core network is a 4G core network, the user data management network element can refer to HSS.

[0053] Step 22: Send the identifier from the user terminal's subscription data to the core network elements of the core network control plane.

[0054] In one optional implementation, the query request for the user terminal identifier of the core network element in the core network control plane may include: a call message that invokes the terminal context registration service provided by the user data management element.

[0055] For UDM, the terminal context registration service provided by UDM can specifically be the Nudm_UECM_Registration service.

[0056] In one optional implementation, the invocation message includes a user identifier (e.g., SUPI). In such a case, the verification method provided in this application embodiment may further include: using the user identifier as a query condition to query the subscription data corresponding to the user identifier.

[0057] Based on the same inventive concept described above, this application also provides an identifier sending method from the perspective of the user terminal as the executing entity. A flowchart illustrating the specific implementation of this method is shown below. Figure 3 As shown, it includes the following steps: Step 31: Obtain the identifier of the user terminal; The identifier includes at least one of the user terminal's OS ID and SD ID.

[0058] Step 32: Send the obtained identifier to the radio access network in the core network registration request.

[0059] In one alternative implementation, before initiating core network registration, the user terminal's local program can sequentially read the operating system's unique identifier and the security digital identifier, and then encapsulate them into the core network registration request.

[0060] In a specific example, after the user terminal operating system starts, the underlying driver / system framework layer can preload the device's inherent parameter area; then, the terminal registration trigger module calls the system's preset standard application programming interface to access the device parameter area, thereby reading the factory-fixed, device-operating system unique identifier from the parameter area.

[0061] In a specific example, the user terminal can read the security number identifier in any of the following ways: Implementation Method 1: Obtaining based on a security chip (Trusted Execution Environment) Prerequisites for Implementation Method 1: The user terminal has a built-in independent security chip / trusted execution environment, and the security digital identifier is pre-programmed in the security chip's dedicated storage partition, which is physically isolated from the ordinary system partition.

[0062] Based on the preconditions, the upper-layer application of the user terminal initiates an identifier reading command to the trusted execution environment through the system security call interface; After the security chip verifies that the access permission is legitimate, it reads the locally stored security digital identifier and sends it back to the user terminal main system.

[0063] Implementation Method 2: Obtaining based on user identity card (SIM card) First, the user terminal establishes communication with the user identification card through the card reader / writer interface; Then, the user terminal sends a dedicated read command to read the pre-configured secure digital identifier from the encrypted storage area of ​​the user identification card; After the card completes the permission verification, the security digital identifier is returned to the terminal main system.

[0064] Example 2 Example 2 mainly introduces a specific implementation method for applying the verification method provided in Example 1 of this application to a real-world scenario.

[0065] In mobile communication networks, UE (User Equipment) must complete registration in the core network, which is a prerequisite for accessing the network and obtaining service permissions.

[0066] The following describes the conventional access process using UE access to the 5G core network and 4G core network as examples: I. 5G Core Network The 5G core network adopts a service-oriented architecture, which includes a key core network element: the Access and Mobility Management Function (AMF) element, hereinafter referred to as AMF. The AMF is a control plane element of the 5G core network, responsible for terminal access control, mobility management, and signaling routing, and is the core initiator of the terminal registration process.

[0067] The process of a UE accessing the 5G core network can be generally divided into: cell search → downlink synchronization → system message reading → random access → Radio Resource Control (RRC) connection establishment → 5G registration (core network registration) → default bearer establishment. A brief description of the specific process is as follows: 1. Cell search and downlink synchronization After powering on, the UE scans surrounding frequency points, captures primary synchronization signals and secondary synchronization signals, completes frame synchronization and time slot synchronization, and identifies cell ID and operator frequency band.

[0068] 2. Read system broadcast messages The UE decodes the cell broadcast to obtain basic configurations such as cell access parameters, neighbor cell information, core network routes, and tracking area (TA).

[0069] 3. Random access (uplink synchronization) The UE initiates a preamble, and the Next Generation Node B (gNB, which is the core network element of the radio access network of the 5G NR network) replies with a timing advance command to complete uplink time alignment and establish an air interface basic link.

[0070] 4. RRC connection establishment The UE establishes a radio resource control connection with the gNB, and the UE reports information such as its identity and capabilities.

[0071] 5. 5G Registration Process (Required for Core Network) The UE sends a registration request to the gNB, which forwards the registration request to the AMF. The AMF's Joint Authentication Server Function (AUSF, a network function in the 5G core network control plane responsible for user equipment master authentication and key generation) and Unified Data Management (UDM), which centrally manages logical functional units such as user subscription data, identity information, service configuration, and terminal context, and provides various user data-related services externally, complete the following: Terminal identity authentication, encryption, and integrity protection; Check user contract data, account opening status, and roaming permissions; Assign a 5G Globally Unique Temporary Identifier (5G-GUTI), a TA list, and other mobility identifiers; after successful registration, the UE status changes to 5G registered state.

[0072] Among them, AMF is the main entry point for 5G access layer signaling, and it plays a leading role in UE access and registration throughout the entire process.

[0073] 6. PDU Session Establishment The AMF forwards signaling to the Session Management Function (SMF) to establish a Protocol Data Unit (PDU) session (equivalent to data bearer), allowing the UE to officially access the network and make calls.

[0074] II. 4G LTE Core Network For the 4G LTE core network, the process framework for UE access to the 4G LTE core network is similar to that for access to the 5G network: cell search, synchronization, reading broadcast, random access, RRC connection establishment and the logic correspond to the 5G network. However, the key network element used to lead the UE to complete the 4G registration process in the 4G LTE core network is different. In the 4G LTE core network, this key network element is the Mobility Management Entity (MME) instead of the AMF.

[0075] In the attach procedure (4G core network registration, LTE termed "attach"), the UE initiates an attach request. The evolved Node B (eNB, a core network element of the 4G LTE radio access network) forwards the attach request to the MME. The MME performs authentication, encryption, queries the Home Subscriber Server (HSS) subscription data, allocates GUTIs, and the TA list. Successful attach equals complete core network registration.

[0076] The MME triggers the SGW / PGW to establish a default Evolved Packet System (EPS) bearer, allowing the UE to use services normally. SGW stands for Serving Gateway; PGW stands for Packet Data Network Gateway.

[0077] The aforementioned MME is the core of the 4G LTE core network control plane, and its functions are highly comparable to those of the 5G AMF. It plays a leading role in UE access and attachment throughout the entire process. In the embodiments of this application, the MME and AMF can be collectively referred to as core network elements of the core network control plane.

[0078] HSS is highly comparable to 5G UDM, both being core network elements for user data / subscription data management, and can be collectively referred to as user data management network elements in this application embodiment.

[0079] As explained above, UE network access involves an air interface process and a core network registration process, with core network registration being a necessary step. Specifically, 4G is handled by the MME (Mobile Equipment Manager) for attachment (registration), while 5G is handled by the AMF (Active Network Frame) for 5G registration. Both the MME and AMF are core network elements of the control plane, responsible for authentication, security, mobility, and signaling processing; they serve as the "control center" for terminal access to the core network.

[0080] As can be seen from the above description and background technology, the existing technology does not verify the OS ID and SD ID of the user terminal before directly allowing the user terminal to access the 4G, 5G or 5G-A network, which may cause network security risks.

[0081] To address this issue, in Embodiment 2 of this application, taking the scenario of UE registration to the 5G core network as an example, a scheme for authenticating the UE's OS ID and SD ID based on UDM / UDR in this scenario is proposed. This scheme involves technical improvements to the process from "UE initiating a registration request" to "completing authentication." The overall flowchart of the improved process is shown below. Figure 4 As shown, the specific steps include the following: 1. The UE sends a Registration Request to the (R)AN. (R)AN stands for Radio Access Network.

[0082] In a 5G network, the UE sends a Registration Request to the (R)AN in the following ways: the UE sends an AN message (access network message) to the gNB of the 5G wireless network. This AN message contains AN parameters and a Registration Request. The AN parameters include the 5G Short Temporary Mobile Subscriber Identity (5G-S-TMSI) or the Globally Unique Mobility Management Area Identifier (GUAMI), etc. According to the method provided in the embodiments of this application, the Registration Request includes Registration type, UE identifier (including 5G-GUTI, SUCI, PEI, OS ID and SD ID), Requested NSSAI, etc.

[0083] Among them, 5G-GUTI is the globally unique temporary identifier for the fifth-generation mobile communication system, and its full English name is 5G GloballyUnique Temporary Identifier; the Chinese and English meanings of SUCI, PEI, OS ID and SD ID can be found in the background technology; Requested NSSAI is the requested network slice selection assistance information, and its full English name is Requested Network SliceSelection Assistance Information.

[0084] 2. The 5G network gNB performs AMF selection; For example, 5G-GUTI / 5G-S-TMSI contains GUAMI, and GUAMI contains AMF number (which directly points to the AMF of the last serving UE), so gNB can directly select the AMF pointed to by the AMF number.

[0085] Alternatively, the gNB can also select the AMF that supports the network slices the UE wants based on the Requested NSSAI.

[0086] 3. The gNB sends a Registration Request to the selected AMF; The Registration Request must contain at least the UE identifier (including 5G-GUTI, SUCI, PEI, OSID, and SD ID).

[0087] 4. The AMF also functions as a Security Anchor Function (SEAF) to execute authentication and security processes (identity authentication and security negotiation, i.e.) Figure 2 (As shown in Authentication / Security). In this process, the AMF initiates authentication of the UE based on the UE's SUCI / SUPI.

[0088] SUPI stands for Subscription Permanent Identifier. It is a unique, permanent identification number for users in 5G networks, equivalent to the IMSI (International Mobile Subscriber Identity) in 4G. It is assigned by the operator and permanently linked to the user's subscription data.

[0089] Generally speaking, SUPI is a plaintext sensitive identity and is not directly transmitted over the air interface. The UE can encrypt SUPI to generate SUCI (User Hidden Identity) and transmit it through the air interface and N2 interface; the network side decrypts it to restore SUPI.

[0090] In this embodiment of the application, the UE may carry an encrypted SUCI in the Registration Request sent to the AMF via the gNB; the AMF obtains the UE's home network information by parsing the SUCI, selects the corresponding Authentication Server Function (AUSF), and triggers the authentication process.

[0091] As a SEAF, the AMF interacts with the AFS in the UE's home network. The AFS requests the authentication vector from the UDM / ARPF, and then the AFS forwards the processed authentication challenge parameters to the AMF to complete the authentication of the UE. —This process can be found in relevant mature technologies and will not be elaborated here.

[0092] In this embodiment of the application, when the UE authentication process is completed and the authentication result is successful, the AMF can obtain the UE's security-related information from the AFS / UDM of the user's home location, and then establish and generate a corresponding user security context between the AMF and the UE.

[0093] The UE security-related information mentioned here refers to the exclusive parameters and key data stored in AUSF / UDM that are strongly associated with user identity verification, communication encryption, and integrity protection. It serves as the fundamental data source for terminal authentication and link security protection. Specifically, security-related information can include four categories: First, authentication parameter sets such as SUPI, SUCI, authentication random numbers, expected responses, and authentication tokens, used to verify the legitimacy of the terminal identity; second, original key materials such as the 5G root key, key iteration parameters, and algorithm identifiers, used to derive communication working keys level by level; third, terminal security capability parameters, covering the encryption algorithms, integrity protection algorithms, key lengths, and security policy permissions supported by the terminal, for network elements and the terminal to negotiate and match security algorithms; and fourth, user security subscription data, including operator-preset security rules, key validity periods, security domain divisions, and abnormal security control policies.

[0094] The user security context mentioned here is a dynamic set of security data and security status records established between the AMF and the UE. It runs through the entire process of terminal network access, signaling interaction, and service transmission, and defines the keys, algorithms, security status, and control rules used by both parties for communication. It is the operating environment for secure interaction between the terminal and the network.

[0095] In one alternative implementation, the user security context generation process may include: After the UE authentication is successful, the AMF first requests and retrieves user terminal security-related information from the AUSF / UDM to which the terminal belongs; Subsequently, based on the obtained root key and authentication parameters, AMF derives the signaling plane and user plane working keys step by step according to the 5G standard key derivation algorithm, and selects encryption and integrity protection algorithms that are compatible with both parties by combining the terminal security capabilities. Next, the AMF sends the selected algorithm and working key parameters to the UE. The UE then completes the peer key calculation using the same source algorithm to achieve parameter alignment between the two ends. Finally, the AMF integrates various parameters, encapsulates them to generate a user security context, and stores it locally. The UE synchronously generates a peer security context, and activation is completed on both ends, at which point the user security context officially takes effect. Subsequent signaling interactions can be protected based on this security context.

[0096] 5. AMF performs UDM selection. For example, AMF can use the following information to select UDM: (1) SUPI: i.e., the user's IMSI, which includes the home PLMN (Public Land Mobile Network) identifier and the user identifier, is the core basis for locating the home UDM.

[0097] (2) SUCI: When registering for the first time or when there is no valid GUTI, the encrypted identifier reported by the UE can be decrypted by the AMF to obtain the SUPI, and then the UDM to which the UE belongs can be located based on the SUPI.

[0098] (3) User affiliation information: The UDM pool to which the user belongs is determined by PLMNID, IMSI number range, etc.

[0099] (4) NRF (Network Repository Function) service: The service information of the UDM instance (such as supported PLMNs, number ranges, and load status) is stored in the NRF.

[0100] After the AMF obtains the address of the target UDM (that is, the selected UDM), it will execute step 6: call the Nudm_UECM_Registration service to register the UE's current AMF information with the UDM so that the UDM can send paging, location update and other requests to the AMF in the future.

[0101] 6. The AMF uses the address of the AUSF / UDM / uUDR to initiate registration with the UDM / uUDR of the UE's home location—that is, it calls the Nudm_UECM_Registration service of the selected AUSF / UDM / uUDR; The specific form of invoking this service is that after the AMF establishes an end-to-end signaling channel with the peer network element based on the obtained home UDM / uUDR network address, it actively sends a Nudm_UECM_Registration message to the Nudm_UECM_Registration service. This message contains: SUPI and the identifier for Homogenous Support of IMS Voice over PS Sessions.

[0102] The UDM / uUDR of the UE's home location refers to the UDM / uUDR deployed in the location where the user signed up for their mobile number / 5G service. In the 5G network architecture, regardless of which network the UE roams to, its core processes such as user registration, subscription data query, and permission verification always access the network elements of the user's home location and do not call the resources of the network elements of the visited location, thus ensuring the uniqueness and consistency of the user's subscription data.

[0103] uUDR stands for Unified User Data Repository. uUDR is a functional unit that provides underlying data storage for UDM, carrying all user subscription data, configuration data, and status data. It serves as a persistent storage carrier for 5G network user data.

[0104] The Nudm_UECM_Registration service invoked by AMF refers to the terminal context registration service on the UDM side. It is an interface service defined by the 3GPP standard and uses standard signaling message format for data transmission. AMF can invoke this service through the Nudm interface. The Nudm interface is a 5G standard service interface, a dedicated interface for other network elements to access the UDM. UECM, or UEContext Management, is a functional module of the UDM used to maintain data such as terminal registration status, location information, and link context.

[0105] In this embodiment of the application, the SUPI carried in the Nudm_UECM_Registration message is used for UDM location of corresponding user data; the Homogenous Support of IMS Voiceover PS Sessions (which can be abbreviated as HoIVoPS) carried in the Nudm_UECM_Registration message is a 5G / 4G core network user subscription and terminal capability identifier, used to characterize whether the terminal and the network uniformly support voice services based on the IMS architecture in packet switching domain sessions, and is a key capability marker for VoLTE and 5G VoNR voice services.

[0106] HoIVoPS is a Boolean / enumerated state flag. Mainstream values ​​and their meanings include: Enabled / True: The UE has IMS voice capability, and the user's subscription allows IMS voice to be carried in the packet-switched domain. The network side uniformly enables this capability throughout the process, and the terminal can directly initiate / receive IMS voice calls (VoLTE / VoNR) in the PS domain without falling back to the 2G / 3G circuit-switched domain. Disabled / False: The UE or user subscription does not allow IMS voice to be carried in the PS domain. When initiating a voice call, the network will trigger CSFB circuit-switched domain fallback, switching to the traditional circuit-switched domain to complete the call.

[0107] In this embodiment, the UE reports HoIVoPS during the registration phase, and the AMF carries it to the UDM / uUDR via the Nudm_UECM_Registration message. The UDM verifies and stores the identifier based on the terminal's capabilities and the user's subscribed package, and returns it synchronously to the AMF. The AMF can then execute a policy based on the identifier: if the identifier indicates support, subsequent call requests will directly establish an IMS voice session in the 5G / 4G packet domain; if the identifier indicates non-support, the network will trigger a circuit-switched fallback mechanism to ensure voice calls.

[0108] In this embodiment, the UDM / uUDR stores massive amounts of user subscription data across the entire network, relying on SUPI as the primary key index. The AMF carries the SUPI in the Nudm_UECM_Registration message, enabling the UDM / uUDR to quickly retrieve the exclusive subscription data, terminal capabilities, and service permissions corresponding to the SUPI based on the SUPI carried in the message, achieving one-to-one data matching and avoiding user data corruption.

[0109] In a specific example, the implementation process of steps 5 and 6 above may include: ① Initial Information Parsing: After receiving the UE registration request, the AMF first parses the SUPI reported by the UE, and accurately determines the user's home region by matching the SUPI prefix and number segment coding rules with the locally configured operator number segment planning data; ② NRF Service Discovery: Based on the determined user location information, AMF initiates a service query request to NRF, reporting the network element type (AUSF, UDM, UDR) to be invoked and the user location dimension information; ③ Address return and filtering: Based on network topology configuration, network element load, and disaster recovery strategy, NRF retrieves available AUSF, UDM, and uUDR instances in the corresponding home region and returns the addressing information such as IP address, port, and service identifier of each network element to AMF; ④ Local caching and optimal call: After receiving the network element address list returned by NRF, AMF combines the local preset load balancing and primary / backup priority rules to select the optimal home UDM / uUDR instance address, and caches the corresponding AUSF address (for subsequent authentication process); this registration process only uses the UDM / uUDR address to initiate interaction, and the AUSF address is only reserved for backup and does not participate in this registration service call.

[0110] (3) Signaling channel and interaction implementation: After the AMF completes the selection of network element addresses, it establishes an end-to-end trusted signaling channel with the home UDM / uUDR through the HTTP / 2 protocol based on the 3GPP standard SBA architecture (service architecture), encapsulates the Nudm_UECM_Registration request message carrying SUPI and IMS voice homogeneity capability identifiers, and formally initiates user registration interaction.

[0111] 7. AMF obtains the UE's subscription data in UDM / uUDR; In conjunction with the interaction process described in step 6 above, after the AMF sends a Nudm_UECM_Registration request message to the Nudm_UECM_Registration service, the UDM / uUDR responds and returns the subscription data of the corresponding end user to the AMF.

[0112] Specifically: After receiving the Nudm_UECM_Registration message sent by the AMF, the UDM first parses the message packet, extracts the core keyword SUPI, and also extracts additional fields such as HoIVoPS; According to the internal communication interface protocol, the UDM sends a data query command to the associated uUDR. The query conditions can specify only the SUPI. Because uUDR uses a relational / distributed database to store user data, the data table uses SUPI as the primary key index. The primary key index is unique and can skip full table scans to directly locate data rows. Therefore, uUDR's database engine receives SUPI query conditions and quickly matches data records that are completely consistent with the SUPI through the index tree (B+ tree). A single match can lock the unique target user dataset corresponding to the SUPI.

[0113] This unique target user dataset stores all the user's information, which includes three main categories: (1) Contract data; (2) Terminal capability data: specific values ​​of HoIVoPS, etc.; (3) Business permission data: voice, data, roaming, value-added service activation permissions, etc.

[0114] The aforementioned subscription data specifically includes: Access and Mobility Subscription data, SMF Selection Subscription data, and UE context in SMF data. SMF stands for Session Management Function.

[0115] The access and mobile user data includes: Allowed NSSAI / Default S-NSSAI, RFSPIndex (Radio Resource Scheduling Policy Index), Subscribed DNN / PDU Session parameters, AccessRestriction, UE operating system unique identifier OS ID, and UE memory card / password card unique identifier SD ID.

[0116] In this embodiment, while retrieving the subscription data, the AMF can also configure the user's subscription data to the UDM / uUDR based on the service-oriented architecture interaction logic; if the user's subscription information or terminal context changes subsequently, the UDM / uUDR will proactively push updated data to the AMF.

[0117] 8. The AMF sends a response to the UE to determine whether the UE is legitimate (Equipment Identify Check Response); Specifically, the AMF compares the OS ID and SD ID in the UE's subscription data in the UDM / uUDR with the OS ID and SD ID stored in the UE's own memory (derived from the Registration Request sent by the UE to the AMF via the gNB). If the comparison result shows that the OS ID in the subscription data does not match the OS ID stored in the AMF's own memory, or the SD ID of the storage card in the subscription data does not match the SD ID of the storage card stored in the AMF's own memory, or the SD ID of the cryptographic card in the subscription data does not match the SD ID of the cryptographic card stored in the AMF's own memory, the UE is determined to be an illegitimate UE. The gNB then sends an Equipment Identity Check Response to the UE to notify it of its legitimacy (in this case, the response is used to notify the UE of its illegitimacy), thus denying the UE access to the 5G network. However, if the comparison result shows that the OS ID in the subscription data matches the OS ID stored in the AMF's own memory, and the SD ID of the storage card in the subscription data matches the SD ID of the storage card stored in the AMF's own memory, and the SD ID of the cryptographic card in the subscription data matches the SD ID of the cryptographic card stored in the AMF's own memory, the UE is deemed an illegitimate UE. If the IDs match, the UE is determined to be a legitimate UE. In one optional implementation, the gNB can send an Equipment IdentityCheck Response to the UE to notify it of its legitimacy (in this case, the response is used to notify the UE of its legitimacy).

[0118] In one alternative implementation, if the UE is determined to be an illegitimate UE, the AMF can also send feedback on the reason for the illegitimate status to the UE via the gNB. This reason could be, for example, non-compliant operating system or non-compliant memory card / cryptography card.

[0119] 9. This step can be performed in accordance with the relevant existing 3GPP regulations. Specifically, in step 9, if the UE is determined to be a legitimate UE, and the AMF local cache does not contain the complete subscription data of the user terminal, or the data is incomplete and needs to be updated, then it will actively initiate a Nudm_SDM_Get request to the UDM.

[0120] Among them, Nudm_SDM_Get is a service interface operation initiated by AMF to UDM in the 5G core network (5GC) service architecture to obtain user subscription data, and is one of the key signaling interactions in the 5G registration process.

[0121] In “Nudm_SDM_Get”, Nudm represents the N14 interface (service-oriented naming), which is the service-oriented interface identifier between AMF and UDM (in 5G, the interface between network elements is named with N + network element abbreviation, and udm represents UDM); SDM represents Subscriber Data Management Service, which is one of the core services provided by UDM and is responsible for handling the creation, deletion, modification and query of user subscription data; Get represents the HTTP GET method, which is a data reading operation based on the RESTful architecture, representing the action of “requesting data from UDM”.

[0122] Steps 1, 3, 7, and 8 in the above process all involve the key innovations of the embodiments of this application.

[0123] Example 3 To address the problem that existing technologies do not verify the OS ID and SD ID of user terminals before directly allowing user terminals to access 5G / 5G-A networks, which may lead to network security risks, this application provides a verification device based on the same inventive concept as the above embodiments.

[0124] A schematic diagram of the specific structure of the device is shown below. Figure 5 As shown, it includes the following functional units: The request receiving unit 51 is configured to receive a core network registration request sent by a user terminal; the core network registration request includes a first identifier of the user terminal; the first identifier includes at least one of the user terminal's operating system unique identifier and security number identifier; The identifier query unit 52 is used to query the user data management network element for a second identifier contained in the subscription data of the user terminal in response to the core network registration request; the second identifier contains at least one of the user terminal's operating system unique identifier and security digital identifier; The identity verification unit 53 is used to determine whether the identity of the user terminal is legitimate based on the first identifier and the queried second identifier.

[0125] In one optional implementation, the identifier query unit 52 can be specifically used to: in response to the core network registration request, query the second identifier contained in the subscription data of the user terminal by calling the terminal context registration service provided by the user data management network element.

[0126] In one optional implementation, the method of invoking the terminal context registration service provided by the user data management network element includes: Send a call message for the terminal context registration service to the dedicated interface that allows other network elements to access the user data management network element; The call message contains a user identifier; the user identifier is used as a query condition for the user data management network element to query the second identifier.

[0127] Using the apparatus provided in this application embodiment, since the user terminal's subscription data is a legitimate benchmark data that can prove the legitimacy of the user terminal, determining whether the user terminal's identity is legitimate based on the first identifier (including at least one of the user terminal's OS ID and SD ID) contained in the core network registration request sent by the user terminal and the second identifier (including at least one of the user terminal's OS ID and SD ID) contained in the user terminal's subscription data is a reasonable and accurate verification method. By adopting this verification method during the user terminal's core network registration process, the problem of directly allowing the user terminal to access the 5G / 5G-A network without verifying the user terminal's OS ID and SD ID, which may lead to network security risks, can be avoided in the prior art.

[0128] Based on the same inventive concept, embodiments of this application also provide an identification sending device, comprising: The identifier acquisition unit is used to obtain the identifier from the user terminal's subscription data in response to a query request for the user terminal identifier from a core network element in the core network control plane; the identifier includes at least one of the user terminal's unique operating system identifier and a security digital identifier. The identifier sending unit is used to send the acquired identifier to the core network element of the core network control plane.

[0129] Based on the same inventive concept, embodiments of this application also provide an identification sending device, comprising: The identifier acquisition unit is used to acquire the identifier of the user terminal; the identifier includes at least one of the user terminal's operating system unique identifier and security digital identifier; The identifier sending unit sends the identifier to the radio access network in the core network registration request.

[0130] Example 4 Based on the same inventive concept as the foregoing embodiments of this application, Embodiment 4 of this application provides a computing device to solve the problem in the prior art that user terminals are directly allowed to access 5G / 5G-A networks without verifying the OS ID and SD ID of the user terminal, which may cause network security risks.

[0131] like Figure 6As shown, the computing device includes a memory 61 and a processor 62. The memory 61 can be configured to store various other data to support operation on the electronic device. Examples of such data include instructions for any application or method used to operate on the electronic device. The memory 61 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0132] The processor 62, coupled to the memory 61, is used to execute the computer program stored in the memory 61 for performing a verification method as described in Embodiment 1 of this application.

[0133] When the processor 62 executes the computer program in the memory 61, in addition to the functions described above, it can also perform other functions, as detailed in the descriptions of the preceding embodiments.

[0134] Furthermore, such as Figure 6 As shown, the computing device also includes other components such as a display 64, a communication component 63, a power supply component 65, and an audio component 66. Figure 6 The diagram only shows some components and does not mean that the computing device includes only these components. Figure 6 The components shown.

[0135] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a computer, can implement the methods provided in the above embodiments.

[0136] Accordingly, this application also provides a computer program product, which stores instructions that, when executed by a computer, cause the computer to implement the methods provided in the above embodiments.

[0137] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0138] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

[0140] The entire process of model training and application involved in this application strictly follows Article 5 of the Patent Law of the People's Republic of China (hereinafter referred to as "A5") and the relevant examination standards of the Patent Examination Guidelines (2023 Edition) to ensure that the technical solution does not violate the law, social morality and public interest, and that the data acquisition and utilization and model training process all comply with ethical compliance requirements. Specific details are as follows: I. Explanation of whether the data used in the model meets A5 requirements 1. Data Source Legality: All datasets used in training this model were obtained through legal means, covering three categories: publicly authorized data, data authorized by partners, and self-collected compliant data. Publicly authorized data comes from compliant data sources following open-source licenses such as Apache 2.0, with complete copyright attribution and authorization scope clearly marked, and no unauthorized open-source code or data reuse. Data authorized by partners has a formal data usage agreement clearly defining the scope, duration, and confidentiality obligations, with complete authorization chain proof. For self-collected data involving personal information, strict informed consent procedures have been followed, and anonymization processes (including but not limited to field masking, feature anonymization, and differential privacy technology application) have been used to remove personally identifiable information, fully complying with the requirements of the "Interim Measures for the Administration of Generative Artificial Intelligence Services," the "Personal Information Protection Law," and other relevant laws and regulations.

[0141] 2. Data Content Compliance: This dataset has undergone multiple screening and cleaning processes to remove all content that may violate social morality or harm public interests. It contains no obscene, pornographic, violent, discriminatory, or information that endangers national or public safety, nor does it involve the illegal acquisition or use of genetic resources. For data in sensitive fields (such as medical and financial fields), an additional privacy-preserving computation module (including federated learning and secure multi-party computation technologies) ensures that the data is "usable but not visible," avoiding compliance risks during the original data transmission process and ensuring that the data application scenarios and uses comply with public order and good morals and industry regulatory requirements.

[0142] 3. Data Governance Compliance: Establish a complete data traceability system to automatically record the source, collection time, annotation process, cleaning rules, and permission allocation of training data, generating traceable compliance reports to ensure data is verifiable throughout its entire lifecycle. The dataset annotation process is completed by a professional human R&D team, clearly defining the proportion of human creative contributions, avoiding reliance on AI-generated data that has not undergone substantial human modification, and complying with the "human main contribution" examination requirements in AI patent applications.

[0143] II. Explanation of Model Training Process Meeting A5 Requirements 1. Compliance of Training Objectives and Schemes: The training objectives of this model focus on [specific technical scenarios that can be supplemented, such as intelligent driving decision optimization, multimodal information interaction, etc.]. The training scheme and the final output results do not violate any mandatory provisions of laws and administrative regulations, do not harm the public interest or the legitimate rights and interests of others, and do not pose any potential risks of being used for illegal activities, infringing on privacy, or undermining public safety. The model strictly adheres to the ethical principle of "intelligent for good".

[0144] 2. Compliance Management of Training Process: A closed-loop training framework is adopted to ensure compliance and controllability of the training process. The specific process is as follows: First, training samples are obtained through compliant data sources. After the aforementioned data cleaning and desensitization, they are input into the first neural network model to generate preliminary training results. Second, an expert system is introduced to verify the preliminary results. Based on preset rules and human expert experience, the feasibility of the results is evaluated, and outputs that may pose ethical risks or compliance hazards are corrected (such as removing decision logic that violates public order and good morals, and adjusting model parameters that do not comply with safety regulations). Finally, the loss function weights are dynamically optimized based on expert system feedback to strengthen the model's learning of compliant results, avoid overfitting errors or non-compliant labels, and form a closed-loop management system of "data input - model training - expert verification - parameter optimization - result feedback" to ensure that the entire training process complies with A5 ethical review requirements.

[0145] 3. Compliance of Training Environment and Tools: Model training is implemented on a compliant training platform. All open-source frameworks and components used in the training process have obtained the corresponding licenses, and copyright statements and patent citation information are fully retained, with no infringement or reuse. The training environment is built using virtual devices (containers / virtual machines) with fixed random seeds and initial parameter configurations to ensure the reproducibility of the training process. At the same time, through access control and operation log recording, risks such as data leakage and parameter tampering during training are prevented, ensuring the security and compliance of the training process.

[0146] 4. Ethical verification of training results: After the model is trained, it will undergo an additional third-party ethical compliance assessment and algorithm filing review to verify that the model output does not violate social morality or harm public interests. For potentially sensitive scenarios (such as public services and intelligent decision-making), a special result verification mechanism will be established to ensure that the model always complies with A5 and relevant laws and regulations in practical applications.

[0147] In summary, the data and training process used in this application model strictly comply with the relevant provisions of Article 5 of the Patent Law and the Patent Examination Guidelines (2023 Edition), and there are no violations of laws, social ethics, public interests, or illegal use of genetic resources. Therefore, it fully meets the compliance requirements for patent authorization.

Claims

1. A verification method, characterized in that, The method is applied to core network elements in the core network control plane, and the method includes: The system receives a core network registration request sent by a user terminal; the core network registration request includes a first identifier of the user terminal; the first identifier includes at least one of the user terminal's operating system unique identifier and security number identifier; In response to the core network registration request, the system queries the user data management network element for a second identifier contained in the user terminal's subscription data; the second identifier contains at least one of the user terminal's operating system unique identifier and security digital identifier. Based on the first identifier and the retrieved second identifier, determine whether the user terminal's identity is legitimate.

2. The method as described in claim 1, characterized in that, In response to the core network registration request, the system queries the user data management network element for the second identifier contained in the user terminal's subscription data, including: In response to the core network registration request, the system queries the second identifier contained in the user terminal's subscription data by invoking the terminal context registration service provided by the user data management network element.

3. A method for sending an identifier, characterized in that, The method is applied to a user data management network element, and the method includes: In response to a query request for the user terminal identifier of a core network element in the core network control plane, the identifier in the user terminal's subscription data is obtained; the identifier includes at least one of the user terminal's unique operating system identifier and security digital identifier. The acquired identifier is sent to the core network element of the core network control plane.

4. A method for sending an identifier, characterized in that, The method is applied to a user terminal, and the method includes: Obtain the identifier of the user terminal; the identifier includes at least one of the user terminal's operating system unique identifier and security number identifier; The identifier is carried in the core network registration request and sent to the radio access network.

5. A verification device, characterized in that, The device includes: A request receiving unit is configured to receive a core network registration request sent by a user terminal; the core network registration request includes a first identifier of the user terminal; the first identifier includes at least one of the user terminal's operating system unique identifier and security number identifier; The identifier query unit is used to query the user data management network element for a second identifier contained in the subscription data of the user terminal in response to the core network registration request; the second identifier includes at least one of the user terminal's operating system unique identifier and security digital identifier; An identity verification unit is used to determine whether the identity of the user terminal is legitimate based on the first identifier and the queried second identifier.

6. An identification transmitting device, characterized in that, The device includes: The identifier acquisition unit is used to obtain the identifier from the user terminal's subscription data in response to a query request for the user terminal identifier from a core network element in the core network control plane; the identifier includes at least one of the user terminal's unique operating system identifier and a security digital identifier. The identifier sending unit is used to send the acquired identifier to the core network element of the core network control plane.

7. An identification transmitting device, characterized in that, The device includes: The identifier acquisition unit is used to acquire the identifier of the user terminal; the identifier includes at least one of the user terminal's operating system unique identifier and security digital identifier; The identifier sending unit sends the identifier to the radio access network in the core network registration request.

8. A computing device, characterized in that, include: Memory and processor, among which, The memory is used to store computer programs; The processor, coupled to the memory, is configured to execute the computer program stored in the memory for performing the method according to any one of claims 1 to 4.

9. A computer-readable storage medium storing a computer program that, when executed by a computer, enables the implementation of the method according to any one of claims 1 to 4.

10. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to perform the method described in any one of claims 1 to 4.

Images