Intelligent agent authentication method, apparatus, and related device

Abstract

The present disclosure provides an agent authentication method and device and related equipment. The method comprises: obtaining an access authentication request of an agent, the access authentication request containing at least access state information of a user and an agent certificate signature request, the access state information including at least a user identifier and a session identifier, and the agent certificate signature request containing an agent identifier and public key information of the agent; binding the agent certificate signature request and the access state information to generate an agent authentication request, the agent authentication request containing at least the agent certificate signature request, the user identifier and the session identifier; sending the agent authentication request to a certificate management network element; receiving an agent digital certificate issued by the certificate management network element, the agent digital certificate being issued by the certificate management network element according to the agent certificate signature request, the user identifier and the session identifier; and issuing the agent digital certificate to the agent. The present disclosure can guarantee the trustworthiness and security in the agent interaction process.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to an intelligent agent authentication method, apparatus and related equipment. Background Technology

[0002] With the rapid development of artificial intelligence technology, intelligent agents with autonomous decision-making and task execution capabilities are being widely deployed in various network scenarios.

[0003] However, as a new type of logical entity, intelligent agents lack effective technical guarantees for their identity credibility. Under existing systems, intelligent agents themselves do not possess independent, verifiable identity identifiers, making it difficult to reliably confirm the source and integrity of their behavioral instructions. The receiving party cannot determine whether an instruction originates from the autonomous decision of a legitimate intelligent agent or is a forged action resulting from malicious code hijacking or parameter tampering. Furthermore, when abnormal operations occur, it is difficult to trace the behavior back to the specific responsible party. Therefore, existing technical solutions are insufficient to guarantee the credibility and security of intelligent agent interactions and cannot meet the requirements for unified security management based on responsible parties.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides a method, apparatus, and related equipment for authenticating intelligent agents, which can ensure the trustworthiness and security of intelligent agent interaction processes.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a smart agent authentication method is provided, applied to a network access control gateway, comprising: obtaining a smart agent's access authentication request, wherein the access authentication request includes at least user access status information and a smart agent certificate signing request, wherein the access status information includes at least a user identifier and a session identifier, and the smart agent certificate signing request includes the smart agent's smart agent identifier and public key information; binding the smart agent certificate signing request with the access status information to generate a smart agent authentication request, wherein the smart agent authentication request includes at least the smart agent certificate signing request, the user identifier, and the session identifier; sending the smart agent authentication request to a certificate management network element; receiving a smart agent digital certificate issued by the certificate management network element, wherein the smart agent digital certificate is issued by the certificate management network element based on the smart agent certificate signing request, the user identifier, and the session identifier; and distributing the smart agent digital certificate to the smart agent.

[0008] In some embodiments, obtaining the access authentication request of the intelligent agent includes: receiving an access authentication request initiated by the intelligent agent, the access authentication request carrying network access authentication credentials of the broadband user to which the intelligent agent belongs and the intelligent agent certificate signing request; forwarding the network access authentication credentials to an authentication server so that the authentication server can perform access authentication and authorization for the broadband user; receiving the user identifier returned by the authentication server after successful authentication, establishing the current access session, and generating the session identifier corresponding to the current access session; and generating the access status information based on the user identifier and the session identifier.

[0009] In some embodiments, the certificate management network element includes a registration authority and a certificate authority; sending the agent authentication request to the certificate management network element includes: sending the agent authentication request to the registration authority, so that the registration authority performs signature validity verification on the agent certificate signature request included in the agent authentication request, and performs consistency verification on the access state information included in the agent authentication request, and forwards the agent authentication request to the certificate authority after the verification is passed; receiving the agent digital certificate issued by the certificate management network element includes: receiving the agent digital certificate issued by the certificate authority according to the agent authentication request.

[0010] In some embodiments, the access status information may further include access location information and current access status information.

[0011] In some embodiments, the consistency verification of the access status information included in the agent authentication request includes at least one of the following: verifying the matching between the session identifier and the user identifier in the access status information; verifying the matching between the access location information in the access status information and the physical access location corresponding to the agent authentication request; and verifying the validity of the current access status information in the access status information.

[0012] In some embodiments, the method further includes: establishing a binding relationship between the agent digital certificate and the current access session, and recording the associated record information corresponding to the binding relationship, wherein the associated record information includes agent identifier, certificate identifier, session identifier, user identifier, and the current effective status information of the binding relationship.

[0013] In some embodiments, the method further includes: receiving a communication establishment request initiated by the agent; obtaining the agent identifier and the agent digital certificate of the agent according to the communication establishment request; querying the associated record information according to the agent identifier and the agent digital certificate, and generating a communication establishment response; and sending the communication establishment response to the agent.

[0014] In some embodiments, the network access control gateway is a virtual broadband network gateway.

[0015] According to another aspect of this disclosure, an agent authentication method is also provided, applied to an agent, comprising: sending an access authentication request to a network access control gateway, the access authentication request including at least an agent certificate signing request and a network access authentication credential for triggering the network access control gateway to perform access authentication on the broadband user to which the agent belongs, the agent certificate signing request including the agent identifier and public key information of the agent; receiving an agent digital certificate issued by the network access control gateway, the agent digital certificate being requested and received by the certificate management network element by the network access control gateway after binding the access status information with the agent certificate signing request, the access status information including a user identifier and a session identifier.

[0016] In some embodiments, the method further includes: sending a communication establishment request to the network access control gateway, the communication establishment request carrying the agent identifier and the agent digital certificate; and receiving a communication establishment response returned by the network access control gateway, the communication establishment response being generated by the network access control gateway based on the communication establishment request.

[0017] According to another aspect of this disclosure, an intelligent agent authentication device is also provided, applied to a network access control gateway, comprising: an acquisition module, configured to acquire an access authentication request of an intelligent agent, the access authentication request including at least user access status information and an intelligent agent certificate signing request, the access status information including at least a user identifier and a session identifier, and the intelligent agent certificate signing request including the intelligent agent identifier and public key information of the intelligent agent; a generation module, configured to bind the intelligent agent certificate signing request with the access status information to generate an intelligent agent authentication request, the intelligent agent authentication request including at least the intelligent agent certificate signing request, the user identifier, and the session identifier; a first sending module, configured to send the intelligent agent authentication request to a certificate management network element; a first receiving module, configured to receive an intelligent agent digital certificate issued by the certificate management network element, wherein the intelligent agent digital certificate is issued by the certificate management network element based on the intelligent agent certificate signing request, the user identifier, and the session identifier; and a second sending module, configured to distribute the intelligent agent digital certificate to the intelligent agent.

[0018] According to another aspect of this disclosure, an intelligent agent authentication device is also provided, applied to an intelligent agent, comprising: The third sending module is used to send an access authentication request to the network access control gateway. The access authentication request includes at least an agent certificate signing request and a network access authentication credential used to trigger the network access control gateway to perform access authentication on the broadband user to which the agent belongs. The agent certificate signing request includes the agent identifier and public key information of the agent. The second receiving module is used to receive an agent digital certificate issued by the network access control gateway. The agent digital certificate is generated by the network access control gateway based on the access status information and the agent certificate signing request, and is requested and received from the certificate management network element. The access status information includes a user identifier and a session identifier.

[0019] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the agent authentication method described in any of the preceding claims by executing the executable instructions.

[0020] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the agent authentication method described in any of the preceding claims.

[0021] According to another aspect of this disclosure, a computer program product is also provided, comprising: a computer program or instructions that, when executed by a processor, implement the agent authentication method of any one of the above.

[0022] This disclosure provides an intelligent agent authentication method, apparatus, and related devices in its embodiments. The method includes: obtaining an access authentication request from an intelligent agent, the access authentication request including at least user access status information and an intelligent agent certificate signing request; the access status information including at least a user identifier and a session identifier; and the intelligent agent certificate signing request including the intelligent agent identifier and public key information; binding the intelligent agent certificate signing request with the access status information to generate an intelligent agent authentication request, the intelligent agent authentication request including at least the intelligent agent certificate signing request, the user identifier, and the session identifier; sending the intelligent agent authentication request to a certificate management network element; receiving an intelligent agent digital certificate issued by the certificate management network element, wherein the intelligent agent digital certificate is issued by the certificate management network element based on the intelligent agent certificate signing request, the user identifier, and the session identifier; and distributing the intelligent agent digital certificate to the intelligent agent. Therefore, an independent and verifiable logical identity is established for the intelligent agent, solving the problem that the intelligent agent itself does not possess an independent and verifiable identity identifier, and ensuring the reliability and authenticity of the intelligent agent's identity. Simultaneously, by binding the intelligent agent's certificate signing request with the user identifier and session identifier, the issued digital certificate embeds the association information of the intelligent agent's current user and current access session. The recipient can verify the legitimacy of the instruction source based on the certificate, solving the problem of difficulty in identifying the source of intelligent agent behavior instructions. Furthermore, since the digital certificate is associated with the user identifier and access session identifier, any behavior of the intelligent agent can be traced back to the specific user and network access session, solving the problem of difficulty in tracing the responsible party for abnormal behavior. Therefore, the solution provided by this disclosure embodiment can ensure the trustworthiness and security of the intelligent agent interaction process, meeting the requirements of unified security management based on the responsible party.

[0023] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0025] Figure 1 This diagram illustrates the application system architecture of an intelligent agent authentication method according to an embodiment of the present disclosure. Figure 2This diagram illustrates the system architecture of an agent authentication method according to an embodiment of the present disclosure. Figure 3 This illustration shows one of the flowcharts of an intelligent agent authentication method according to an embodiment of the present disclosure; Figure 4 This is a second flowchart of an intelligent agent authentication method according to an embodiment of the present disclosure; Figure 5 This is a third flowchart of an intelligent agent authentication method according to an embodiment of the present disclosure; Figure 6 This is shown as the fourth flowchart of an intelligent agent authentication method according to an embodiment of the present disclosure; Figure 7 A flowchart illustrating a specific agent authentication method according to an embodiment of this disclosure is shown. Figure 8 This illustration shows one of the schematic diagrams of an intelligent agent authentication device according to an embodiment of the present disclosure; Figure 9 This is a second schematic diagram of an intelligent agent authentication device according to an embodiment of the present disclosure; Figure 10 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0026] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0027] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0028] The inventors discovered that existing identity authentication systems are primarily designed for physical terminal devices, with certificate issuance limited to the hardware level. This fails to establish independent logical identities for the intelligent agent programs running on these devices, leaving the intelligent agents in an identity-deficient state within the authentication system. Furthermore, in existing solutions, device certificates, user accounts, and network access sessions are isolated. Although intelligent agent commands are issued through legitimate hardware, they cannot be effectively bound to the true intent of their respective users or the current access link context. This makes it difficult to detect malicious intelligent agent impersonation, command tampering, and other attacks beforehand, intercept them during the attack, or trace them afterward. For example, in a home network scenario, when a private intelligent agent deployed within the home interacts with other intelligent agents within the home or with external public intelligent agents, the receiver can only obtain the device identifier of the terminal. It cannot confirm the specific identity and authorization status of the intelligent agent program actually initiating the interaction on that terminal, nor can it determine whether the command truly represents the true intent of the broadband user. It should be noted that although some existing solutions include agent registration mechanisms, such registration only registers information and does not establish an independent, verifiable identity for the agent based on cryptography, nor does it bind the agent's identity to the broadband user and home network access session. Therefore, it still cannot solve the aforementioned problems. In scenarios where home agents interact with external public agents, since the home private agent and the external public agent belong to different management domains, they lack a unified trust anchor, and existing solutions cannot achieve two-way trusted identity mutual recognition in cross-domain scenarios. Overall, under existing technical solutions, agents face security risks such as untrusted identity, unverifiable intent, and untraceable behavior, making it difficult to meet the requirements for trusted interaction between agents and unified security management based on responsible entities.

[0029] In view of this, embodiments of this disclosure provide an agent authentication method. By establishing an independent and verifiable logical identity for the agent, it solves the problem that the agent itself does not possess an independent and verifiable identity identifier, thus ensuring the reliability and authenticity of the agent's identity. Simultaneously, by binding the agent's certificate signing request with the user identifier and session identifier, the issued digital certificate embeds the association information of the agent's current user and current access session. The recipient can verify the legitimacy of the instruction source based on the certificate, solving the problem of difficulty in identifying the source of agent behavior instructions. Furthermore, since the digital certificate is associated with the user identifier and access session identifier, any action of the agent can be traced back to the specific user and network access session, solving the problem of difficulty in tracing the responsible party for abnormal behavior. Therefore, the solution provided by embodiments of this disclosure can ensure the trustworthiness and security of the agent interaction process, meeting the requirements of unified security management based on responsible parties.

[0030] To facilitate understanding, before introducing the embodiments of this disclosure, the following explanations are provided for several terms involved in the embodiments of this disclosure: Intelligent Agent (Agent): A logical entity deployed in a network or on a terminal that has the ability to make autonomous decisions and execute tasks. It can respond to external events or internal triggering conditions and independently or collaboratively complete specific service processing and task execution.

[0031] Network access control gateway: An access control device deployed at the network edge, used to perform identity authentication, authorization and session management for users or devices accessing the network, and to act as a communication node between the internal network and the external network.

[0032] Virtual Broadband Network Gateway (vBNG): Based on network function virtualization architecture and combined with software-defined networking technology, it is a virtualized network access control element built on the basis of broadband network gateway functions, used to realize user access authentication, session management and traffic policy control.

[0033] Certificate Signing Request (CSR): A data structure generated by the certificate applicant to apply for a digital certificate from a certificate authority. It contains the applicant's identity information, public key information, and a digital signature generated based on the corresponding private key.

[0034] Registration Authority (RA): An entity responsible for verifying the identity of certificate applicants and validating application information. It verifies the legality of certificate applications and submits approved applications to the certificate issuing authority.

[0035] Certificate Authority (CA): A trusted entity responsible for the issuance, management, renewal, and revocation of digital certificates. It is used to bind the applicant's public key and identity information and add a digital signature based on the review results of the registration authority in order to generate a trustworthy digital certificate.

[0036] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0037] Figure 1 A schematic diagram of an exemplary application system architecture to which the agent authentication method of the embodiments of this disclosure can be applied is shown. For example... Figure 1 As shown, the system architecture may include terminal device 101, network 102 and server 103.

[0038] Network 102 is a medium used to provide a communication link between terminal device 101 and server 103, and can be a wired network or a wireless network.

[0039] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats, including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPSec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0040] Terminal device 101 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0041] Optionally, the client of the application installed on different terminal devices 101 may be the same, or the client of the same type of application based on different operating systems. Depending on the terminal platform, the specific form of the application client may also be different; for example, the application client may be a mobile client, a PC client, etc.

[0042] Server 103 can be a server that provides various services, such as a backend management server that supports the device operated by the user using terminal device 101. The backend management server can analyze and process received requests and other data, and feed the processing results back to the terminal device.

[0043] Optionally, the server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0044] Those skilled in the art will know that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative; any number of terminal devices, networks, and servers can be included depending on actual needs. This disclosure does not limit the scope of the embodiments.

[0045] Figure 2 An exemplary system architecture diagram is shown that can be applied to the agent authentication method in the embodiments of this disclosure. For example... Figure 2 As shown, the system architecture may include an intelligent agent 201, a virtual broadband network gateway 202, an AAA server 203, a registration authority 204, and a certificate authority 205. The intelligent agent 201 communicates with the virtual broadband network gateway 202 via a user network-side interface. The virtual broadband network gateway 202 communicates with the AAA server 203 and the registration authority 204 via control plane interfaces. The registration authority 204 communicates with the certificate authority 205 via a secure communication interface. The interaction between the intelligent agent 201 and the virtual broadband network gateway 202 is specifically implemented through the virtual broadband network gateway forwarding plane 212. The interaction between the virtual broadband network gateway 202 and the AAA server 203 and the registration authority 204 is specifically implemented through the virtual broadband network gateway control plane 222. The virtual broadband network gateway forwarding plane 212 and the virtual broadband network gateway control plane 222 are connected via an internal control channel.

[0046] Specifically, agent 201 is a logical entity deployed in the user network environment that has the ability to make autonomous decisions and execute tasks. It is used to initiate access authentication requests and communicate with virtual broadband network gateway 202.

[0047] The virtual broadband network gateway 202 is used to process the access authentication request of the intelligent agent 201, including user access authentication, session establishment, binding of the intelligent agent certificate signing request with access state information, and issuance of digital certificates. Specifically, the virtual broadband network gateway 202 may include a virtual broadband network gateway forwarding plane 212 and a virtual broadband network gateway control plane 222. The virtual broadband network gateway forwarding plane 212, as the data plane component of the network access control gateway, is used to receive the access authentication request initiated by the intelligent agent 201 and transmit the request to the virtual broadband network gateway control plane 222 for processing. The virtual broadband network gateway control plane 222, as the control plane component of the virtual broadband network gateway, is used to process the received access authentication request, including interacting with the AAA server 203 to complete user access authentication and authorization, and establishing an access session and generating access state information after successful authentication. The virtual broadband network gateway control plane 222 is also used to bind the intelligent agent's certificate signing request with the access state information, generate an intelligent agent authentication request, and send the intelligent agent authentication request to the registration authority 204. In addition, the virtual broadband network gateway control plane 222 is also used to receive the agent digital certificate issued by the certificate authority 205, establish the binding relationship between the digital certificate and the access session, and distribute the digital certificate to the agent 201.

[0048] In some embodiments, the virtual broadband network gateway control plane 222 includes a Virtual Machine (VM) 2220, which includes a Agent Online Authentication Module 2221 and an Agent Authentication State Storage Module 2222. The Agent Online Authentication Module 2221 performs logical processing during the agent online and authentication process; the Agent Authentication State Storage Module 2222 maintains an Agent Authentication State Table, which records associated information such as agent identifier, certificate identifier, session identifier, user identifier, and authentication status, to achieve persistent storage and state maintenance of the binding relationship between digital certificates and access sessions.

[0049] The AAA server 203 is used to receive user access authentication requests forwarded by the virtual broadband network gateway control plane 222, perform access authentication and authorization for the broadband users to which the agent belongs, and return the user identifier to the virtual broadband network gateway control plane 222 after successful authentication.

[0050] The registration authority 204 is used to receive the agent authentication request sent by the virtual broadband network gateway control plane 222, perform signature validity verification on the certificate signature request contained therein, perform consistency verification on the access status information, and submit the authentication request to the certificate authority 205 after the verification is passed.

[0051] Certificate Authority 205 is used to issue digital certificates for intelligent agents based on the audit results of Registration Authority 204, and to return the issued digital certificates to Registration Authority 204.

[0052] Under the above system architecture, this disclosure provides an agent authentication method, which can be executed by any electronic device with computing power.

[0053] In some embodiments, the agent authentication method provided in this disclosure can be executed by a terminal device in the above-described system architecture; in other embodiments, the agent authentication method provided in this disclosure can be executed by a server in the above-described system architecture; in still other embodiments, the agent authentication method provided in this disclosure can be implemented by the terminal device and the server in the above-described system architecture through interaction.

[0054] Figure 3 This diagram illustrates a flowchart of an intelligent agent authentication method according to an embodiment of the present disclosure, applied to a network access control gateway, such as... Figure 3 As shown, the agent authentication method provided in this embodiment includes the following steps: S302, Obtain the access authentication request of the intelligent agent.

[0055] In this embodiment, the access authentication request includes at least the user's access status information and an agent certificate signing request. The access status information includes at least a user identifier and a session identifier. The user identifier uniquely identifies the network subscriber to which the agent belongs, such as a broadband user, and the session identifier uniquely identifies the user's current network access session. The agent certificate signing request includes the agent's agent identifier, public key information, and digital signature information generated based on the agent's private key. The agent identifier uniquely identifies the agent's logical identity, and the public key information is used for subsequent digital certificate issuance and authentication. The agent certificate signing request is a data structure generated by the agent itself when initiating authentication, used to apply for a digital certificate from the certificate management network element.

[0056] In some embodiments, the access status information further includes access location information and current access status information. Access location information indicates the physical access location of the intelligent agent, such as an access port or PON port, while current access status information indicates the status of the current access session, such as online, offline, or abnormal. By further including access location information and current access status information in the access status information, subsequently issued digital certificates can be associated with the intelligent agent's access location and session status. When a certificate is used in an unauthorized location or abnormal session, it can be identified and intercepted, further enhancing the reliability and security of identity authentication.

[0057] In some embodiments, the network access control gateway is a virtual broadband network gateway. The virtual broadband network gateway is implemented based on a network function virtualization architecture, combining broadband access control functions with agent gateway functions. It can sense the state of a home broadband access session and perform enhanced processing and proxy forwarding of agent authentication requests on the network side. This eliminates the need to deploy additional authentication clients or modify the agent's own authentication logic on the agent side, reducing the complexity of agent deployment and maintenance.

[0058] S304 binds the agent certificate signing request with the access status information to generate an agent authentication request.

[0059] In this embodiment, the network access control gateway associates and binds the agent certificate signing request obtained in S302 with the access status information to generate an agent authentication request. This agent authentication request includes at least the original agent certificate signing request, user identifier, and session identifier. Through this binding operation, the logical identity of the agent (agent identifier and public key information) is associated with its corresponding user identity (user identifier) ​​and the current network access context (session identifier), enabling the binding information of these three elements to be embedded in the subsequently issued digital certificate.

[0060] In some embodiments, the agent authentication request further includes access location information and access status information, wherein the access location information is used to indicate the physical access location of the agent, and the access status information is used to indicate the online status of the current access session.

[0061] S306 sends the agent authentication request to the certificate management network element.

[0062] In this embodiment, the network access control gateway sends the intelligent agent authentication request generated in S304 to the certificate management network element, which then reviews the intelligent agent authentication request and issues a digital certificate.

[0063] In some embodiments, the certificate management network element includes a Registration Authority (RA) and a Certificate Authority (CA). The RA is responsible for verifying the identity of the certificate applicant and confirming the application information, while the CA is responsible for issuing, managing, updating, and revoking digital certificates. Sending an agent authentication request to the certificate management network element specifically includes: the network access control gateway sending the agent authentication request to the RA; upon receiving the request, the RA verifies the signature validity of the agent certificate signature request included in the request to verify that the signature request was indeed generated by the corresponding private key holder and has not been tampered with; the RA also verifies the consistency of the access state information included in the agent authentication request to verify that the fields in the access state information are logically consistent and valid, such as verifying whether the session identifier matches the user identifier and whether the current access state is normal; after successful verification, the RA forwards the agent authentication request to the CA. The CA issues an agent digital certificate based on the RA's verification result and returns the issued digital certificate to the RA, which then returns it to the network access control gateway.

[0064] Specifically, upon receiving an agent authentication request, the registration authority verifies the validity of the agent certificate signing request contained in the request to confirm that the signing request was indeed generated by the corresponding private key holder and has not been tampered with. The registration authority also verifies the consistency of the access state information contained in the agent authentication request. This consistency verification includes at least one of the following: verifying the match between the session identifier and the user identifier in the access state information to confirm that the access session indeed belongs to the user; verifying the match between the access location information in the access state information and the physical access location corresponding to the agent authentication request to confirm that the agent indeed initiated the request from the physical access link of its affiliated user; and verifying the validity of the current access state information in the access state information to confirm that the access session is currently in a normal online state. When all the above verifications pass, the registration authority confirms the agent authentication request as legitimate and valid, and forwards the authentication request to the certificate authority; when any verification fails, the registration authority rejects the authentication request and returns an authentication failure response to the network access control gateway.

[0065] After receiving the agent authentication request forwarded by the registration authority, the certificate authority issues a digital certificate for the agent based on the registration authority's review results. This digital certificate contains the agent's identity information, public key information, certificate validity period, and authentication extension information, which includes at least a user identifier and a session identifier. The certificate authority returns the issued digital certificate to the registration authority, which then returns it to itself.

[0066] S308 receives digital certificates for intelligent agents issued by the certificate management network element.

[0067] In this embodiment, the network access control gateway receives an agent digital certificate issued by the certificate management network element. This agent digital certificate is issued by the certificate management network element based on the agent certificate signing request, user identifier, and session identifier. In addition to the agent's identity information and public key information, the digital certificate also includes the user identifier and session identifier as extended authentication information. That is, the digital certificate not only proves the agent's identity but also binds that identity to a specific user and network access session.

[0068] For example, after receiving a digital certificate for an intelligent agent issued by a certificate management network element, the network access control gateway establishes a binding relationship between the digital certificate and the current access session, and generates a local intelligent agent authentication status table. This authentication status table records the intelligent agent identifier, certificate identifier, session identifier, user identifier, and current authentication status. Specifically, the intelligent agent identifier uniquely identifies the logical identity of the intelligent agent, the certificate identifier uniquely identifies the digital certificate, the session identifier identifies the network session the intelligent agent is currently accessing, the user identifier identifies the broadband user to which the intelligent agent belongs, and the current authentication status indicates whether the binding relationship is currently effective. By establishing this authentication status table, the network access control gateway binds the digital certificate to the network access session, enabling the gateway to quickly verify the validity of the intelligent agent certificate and its binding relationship with the access session when the intelligent agent initiates communication, thereby achieving real-time control over the intelligent agent's communication behavior.

[0069] In some embodiments, after receiving the agent digital certificate issued by the certificate management network element, the network access control gateway further establishes a binding relationship between the agent digital certificate and the current access session, and records the associated record information corresponding to the binding relationship. This associated record information includes the agent identifier, certificate identifier, session identifier, user identifier, and the current effective status information of the binding relationship. By establishing and recording this binding relationship, the network access control gateway can perform real-time verification of the agent's identity based on this associated record information during subsequent communication interactions. For example, it can verify whether the currently used digital certificate matches the agent's access session, whether the certificate is still valid, and whether the session is still active. Recording the associated record information corresponding to the binding relationship provides a verification basis for subsequent communication control, ensuring the traceability and manageability of certificate and session binding.

[0070] In some embodiments, the network access control gateway receives a digital certificate of an intelligent agent issued by a certificate management network element, specifically including: the network access control gateway receiving a digital certificate of an intelligent agent issued by a certificate authority in accordance with an intelligent agent authentication request.

[0071] S310 distributes the agent's digital certificate to the agent.

[0072] In this embodiment, the network access control gateway distributes the agent's digital certificate received in S308 to the agent. Upon receiving the digital certificate, the agent can use it to prove its identity and the legitimacy of its user when establishing communication connections with other agents within the home or external public agents. Since the digital certificate is associated with both a user identifier and a session identifier, the recipient can verify the agent's identity based on the certificate and confirm that the agent's actions are traceable to its user and the current network access session.

[0073] This embodiment establishes an independent and verifiable logical identity for the intelligent agent, solving the problem that the intelligent agent itself lacks an independent and verifiable identity identifier, thus ensuring the reliability and authenticity of the intelligent agent's identity. Simultaneously, by binding the intelligent agent's certificate signing request with the user identifier and session identifier, the issued digital certificate embeds the association information of the intelligent agent's current user and current access session. The recipient can verify the legitimacy of the instruction source based on this certificate, solving the problem of difficulty in identifying the source of intelligent agent behavior instructions. Furthermore, since the digital certificate is associated with the user identifier and access session identifier, any behavior of the intelligent agent can be traced back to the specific user and network access session, solving the problem of difficulty in tracing the responsible party for abnormal behavior. Therefore, the solution provided by this embodiment can ensure the trustworthiness and security of the intelligent agent interaction process, meeting the requirements of unified security management based on the responsible party.

[0074] In some embodiments, Figure 4 This diagram illustrates a flowchart of an agent authentication method according to an embodiment of the present disclosure, such as... Figure 4 As shown in the embodiments of this disclosure, obtaining the access authentication request of the intelligent agent includes the following steps: S402 receives the access authentication request initiated by the intelligent agent.

[0075] In this embodiment, the network access control gateway receives an access authentication request initiated by the agent. This access authentication request carries the network access authentication credentials of the broadband user to which the agent belongs, and an agent certificate signing request. The network access authentication credentials are used to trigger the network access control gateway to perform network access authentication for the broadband user to which the agent belongs, such as broadband account and password, EAP response information, etc. The agent certificate signing request contains the agent's agent identifier and public key information, which is generated by the agent itself when initiating authentication.

[0076] It should be noted that in this step, the access authentication request received by the network access control gateway may not directly contain available user identifiers and session identifiers. The user identifier and session identifier in the access state information are determined by the network access control gateway after user access authentication and the establishment of an access session. When initiating a request, the agent only needs to provide its own generated certificate signing request and the network access authentication credentials of its user.

[0077] S404 forwards network access authentication credentials to the authentication server so that the authentication server can authenticate and authorize broadband users for access.

[0078] In this embodiment, the network access control gateway extracts the network access authentication credential from the access authentication request received in S402 and forwards the credential to the authentication server (such as an AAA server). The authentication server performs access authentication and authorization for the broadband user based on the credential, verifying whether the user is a legitimate network subscriber and whether they have access permissions, etc.

[0079] S406: Receive the user identifier returned by the authentication server after successful authentication, establish the current access session, and generate the session identifier corresponding to the current access session.

[0080] In this embodiment, after the authentication server successfully authenticates the broadband user, it returns the user's identifier (such as a Subscriber ID) to the network access control gateway. Upon receiving the user identifier, the network access control gateway establishes the current access session and generates a session identifier (Session ID) corresponding to the session. This session identifier is used to uniquely identify this network access session in subsequent processes.

[0081] S408 generates access status information based on the user identifier and session identifier.

[0082] In this embodiment, the network access control gateway generates access status information based on the user identifier received in S406 and the generated session identifier. This access status information includes at least the user identifier and the session identifier. At this point, the network access control gateway has completed the access authentication of the broadband user to which the agent belongs and generated access status information for subsequent use. This access status information will be used to bind with the agent certificate signing request to generate an agent authentication request.

[0083] Through the above embodiments, the network access control gateway realizes the complete process from receiving the agent's original request to completing user access authentication, establishing an access session, and generating access status information. It is important to note that when initiating an access authentication request, the agent can only provide its own user's network access authentication credentials and its own certificate signing request. The user identifier and session identifier are only generated after successful user authentication. Therefore, the agent cannot include this information in the request itself; it must be obtained and supplemented by the network access control gateway after successful authentication. Based on this process design of user authentication first, followed by obtaining status information, the network access control gateway can bind the agent's certificate signing request with real-time, valid access status information, avoiding the risk of the agent forging or obtaining access status information in advance, and enhancing the authenticity and reliability of the authentication process.

[0084] In some embodiments, Figure 5 This diagram illustrates a flowchart of an agent authentication method according to an embodiment of the present disclosure, such as... Figure 5 As shown, the agent authentication method provided in this embodiment further includes the following steps: S502 receives a communication establishment request initiated by the agent.

[0085] In this embodiment, the network access control gateway receives a communication establishment request initiated by the intelligent agent. This communication establishment request is initiated by the intelligent agent when it needs to establish a communication connection with other intelligent agents within the home or with external public intelligent agents. The communication establishment request carries the intelligent agent's agent identifier and intelligent agent digital certificate.

[0086] S504: Based on the communication establishment request, obtain the agent's agent identifier and agent digital certificate.

[0087] In this embodiment, the network access control gateway extracts the agent identifier and agent digital certificate from the communication establishment request received in S502, as input information for subsequent authentication.

[0088] S506 queries associated record information based on the agent's identifier and digital certificate, and generates a communication establishment response.

[0089] In this embodiment, the network access control gateway queries the locally recorded association record information based on the agent identifier and agent digital certificate obtained in S504. This association record information is established and recorded when the digital certificate is issued, and includes the agent identifier, certificate identifier, session identifier, user identifier, and the current effective status information of the binding relationship.

[0090] The network access control gateway verifies whether the agent has legitimate communication conditions based on the query results. Specifically, it verifies whether the agent's digital certificate is valid (e.g., within the validity period and not revoked), whether the current access session is active, and whether the binding relationship between the digital certificate and the access session is still effective.

[0091] When the verification passes, the network access control gateway generates a first communication establishment response that allows communication to be established; when the verification fails (e.g., certificate expires, certificate is revoked, session is abnormal, or binding relationship fails), the network access control gateway generates a second communication establishment response that rejects communication establishment.

[0092] S508 sends a communication establishment response to the agent.

[0093] In this embodiment, the network access control gateway sends the communication establishment response generated in S506 to the intelligent agent. The intelligent agent learns the processing result of the communication establishment request based on the received communication establishment response: if it receives a response allowing communication establishment, the intelligent agent can establish a communication connection with the target intelligent agent; if it receives a response rejecting communication establishment, the intelligent agent cannot establish a communication connection.

[0094] Through the above embodiments, the network access control gateway verifies the identity of an agent in real time based on locally recorded association information each time the agent initiates a communication establishment request. This ensures that only agents holding valid digital certificates whose binding relationship with the current access session remains effective can establish a communication connection. When a certificate expires, is revoked, or the session is abnormal, the network access control gateway enforces access control by refusing communication establishment, thereby ensuring the security and controllability of the agent's communication process.

[0095] Figure 6 This diagram illustrates a flowchart of an agent authentication method according to an embodiment of the present disclosure, applied to an agent, such as... Figure 6 As shown, the agent authentication method provided in this embodiment includes the following steps: S602 sends an access authentication request to the network access control gateway.

[0096] In this embodiment, the access authentication request includes at least an agent certificate signing request and a network access authentication credential used to trigger the network access control gateway to perform access authentication on the broadband user to which the agent belongs. The agent certificate signing request includes the agent identifier, public key information, and signature information based on the agent's private key.

[0097] For example, taking the initial network access of a home private agent as an example: The agent initiates an access authentication request to the network access control gateway (such as vBNG, Virtual Broadband Network Gateway) through the home broadband access link. Before this, the agent locally generates a public-private key pair and generates a Certificate Signing Request (CSR) based on the public key. This CSR contains at least the agent ID, subject identity information, public key information, and digital signature information generated based on the agent's private key. The agent encapsulates the CSR along with network access authentication credentials (such as broadband account password or authentication token derived from it) in the access authentication request and sends it to the Virtual Broadband Network Gateway to trigger the subsequent access authentication and certificate issuance process.

[0098] S604 Receive the agent digital certificate issued by the network access control gateway. The agent digital certificate is generated by the network access control gateway based on the access status information and the agent certificate signature request, and is requested and received by the certificate management network element. The access status information includes user identifier and session identifier.

[0099] In some embodiments, the agent authentication method provided in this disclosure further includes: sending a communication establishment request to a network access control gateway, the communication establishment request carrying an agent identifier and an agent digital certificate; and receiving a communication establishment response returned by the network access control gateway, the communication establishment response being generated by the network access control gateway based on the communication establishment request.

[0100] In this embodiment, the agent generates a public-private key pair locally and generates a digital signature based on the private key. The private key never leaves the agent, fundamentally eliminating the risk of leakage during network transmission or server-side storage. Simultaneously, the certificate signing request includes signature information based on the private key, which the network access control gateway uses to verify the agent's identity and prevent identity forgery. The finally issued agent digital certificate is bound to the broadband user's access status information, namely the user identifier and session identifier, achieving a strong association between the agent's identity and the broadband user's identity, thus preventing identity impersonation and unauthorized access.

[0101] Figure 7 This illustration shows a flowchart of a specific agent authentication method according to an embodiment of the present disclosure, such as... Figure 7 As shown, the agent authentication method provided in this embodiment includes the following steps: S702, the agent sends an access authentication request to the virtual broadband network gateway.

[0102] In this embodiment, the access authentication request includes at least an agent certificate signing request and a network access authentication credential used to trigger the network access control gateway to perform access authentication on the broadband user to which the agent belongs. The agent certificate signing request includes the agent identifier, public key information, and signature information based on the agent's private key.

[0103] For example, taking the initial network access of a home private agent as an example: the agent initiates an access authentication request to the virtual broadband network gateway through the home broadband access link. Before this, the agent locally generates a public-private key pair and generates a Certificate Signing Request (CSR) based on the public key. The CSR contains at least the agent ID, subject identity information, public key information, and digital signature information generated based on the agent's private key. The agent encapsulates the CSR along with network access authentication credentials (such as broadband account password or authentication token derived from it) in the access authentication request and sends it to the vBNG.

[0104] S704, the virtual broadband network gateway forwards the access authentication request to the AAA server to complete user access authentication and authorization.

[0105] After successful authentication, the network access control gateway establishes the corresponding access session and generates access status information. This access status information includes: Subscriber ID, Session ID, Access Location ID, and Current Access Status.

[0106] S706, the virtual broadband network gateway binds the access status information with the agent certificate signing request, generates an agent authentication request, and submits the agent authentication request to the certificate management network element.

[0107] In this embodiment, the network access control gateway binds the current access session state information with the Certificate Sign-On (CSR) to generate an agent authentication request. This request includes: original CSR information, user identification information, session identification information, access location information, and access state information. The network access control gateway then submits the agent authentication request to the certificate management network element.

[0108] S708, the certificate management network element reviews the intelligent agent's authentication request and issues an intelligent agent digital certificate after the review is passed.

[0109] In this embodiment, the certificate management network element may include a Registration Authority (RA) and a Certificate Authority (CA). The RA performs identity information verification, CSR signature validity verification, and access context consistency verification. After the verification is passed, the authentication request is submitted to the CA. The CA issues a digital certificate for the intelligent agent based on the RA's verification result and returns it to the network access control gateway.

[0110] S710, the virtual broadband network gateway receives and issues digital certificates to the agent.

[0111] In this embodiment, the network access control gateway receives the agent's digital certificate issued by the CA, establishes a binding relationship between the digital certificate and the network access session, and generates a local agent authentication status table. The authentication status table records: agent identifier, certificate identifier, session identifier, user identifier, and current authentication status. The network access control gateway then distributes the digital certificate to the corresponding agent.

[0112] S712, the agent sends a communication establishment request to the network access control gateway, which carries the agent's identifier and digital certificate. The network access control gateway receives the communication establishment request, performs identity verification based on the certificate status and access session status, and allows the establishment of a communication connection after successful authentication.

[0113] For example, when a private agent establishes a communication connection with other agents within the home or a public agent on the public network, the agent sends a communication establishment request to the vBNG, carrying the agent's identifier and digital certificate. The vBNG verifies the certificate status and access session status based on the local agent authentication status table. If the certificate is valid and the session is normal, the communication connection is allowed; if the certificate is invalid, revoked, or the session is abnormal, the vBNG implements access restriction or connection blocking policies.

[0114] In this embodiment, vBNG is first used as the intelligent agent access gateway to uniformly receive authentication requests initiated by intelligent agents on the receiving end and to submit authentication applications to the Registration Authority (RA) and Certificate Authority (CA) on their behalf, thereby achieving unified access and centralized management of the intelligent agent authentication process. Secondly, based on the intelligent agent's original Certificate Signing Request (CSR), vBNG extracts the intelligent agent's current network access context information and associates it with the CSR to generate an intelligent agent authentication request, which is then submitted to the certificate management network element for digital certificate issuance. Through these methods, joint verification of intelligent agent identity authentication and network access status is achieved, ensuring that the final issued digital certificate is naturally associated with the intelligent agent's identity, broadband user identifier, and access session status. This enables unified authentication and management of intelligent agents based on the user dimension, significantly enhancing the operator's manageability and controllability over massive intelligent agent access.

[0115] It should be noted that the acquisition, storage, use, and processing of data in this disclosed technical solution comply with the relevant provisions of national laws and regulations. The various types of data, such as personal identity data, operational data, and behavioral data related to individuals, customers, and groups, obtained in the embodiments of this disclosure have all been authorized.

[0116] Based on the same inventive concept, this disclosure also provides an intelligent agent authentication device, as described in the following embodiments. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiment, the implementation of this device embodiment can refer to the implementation of the above-described method embodiment, and repeated details will not be elaborated further.

[0117] Figure 8 This diagram illustrates a smart agent authentication device according to an embodiment of the present disclosure, applied to a network access control gateway. Figure 8As shown, the device includes: an acquisition module 81, a generation module 82, a first sending module 83, a first receiving module 84, and a second sending module 85; the acquisition module 81 is used to acquire an access authentication request of an intelligent agent, the access authentication request including at least user access status information and an intelligent agent certificate signing request, the access status information including at least user identifier and session identifier, and the intelligent agent certificate signing request including the intelligent agent identifier and public key information of the intelligent agent; the generation module 82 is used to bind the intelligent agent certificate signing request with the access status information to generate an intelligent agent authentication request, the intelligent agent authentication request including at least the intelligent agent certificate signing request, the user identifier, and the session identifier; the first sending module 83 is used to send the intelligent agent authentication request to a certificate management network element; the first receiving module 84 is used to receive an intelligent agent digital certificate issued by the certificate management network element, wherein the intelligent agent digital certificate is issued by the certificate management network element based on the intelligent agent certificate signing request, the user identifier, and the session identifier; the second sending module 85 is used to distribute the intelligent agent digital certificate to the intelligent agent.

[0118] In some embodiments, the acquisition module is specifically configured to: receive an access authentication request initiated by the agent, the access authentication request carrying network access authentication credentials of the broadband user to which the agent belongs and the agent's certificate signing request; forward the network access authentication credentials to the authentication server so that the authentication server can perform access authentication and authorization for the broadband user; receive the user identifier returned by the authentication server after successful authentication, establish the current access session, and generate the session identifier corresponding to the current access session; and generate the access status information based on the user identifier and the session identifier.

[0119] In some embodiments, the certificate management network element includes a registration authority and a certificate authority; the first sending module is configured to: send the agent authentication request to the registration authority, so that the registration authority performs signature validity verification on the agent certificate signature request included in the agent authentication request, and performs consistency verification on the access state information included in the agent authentication request, and forwards the agent authentication request to the certificate authority after the verification is passed; the first receiving module is configured to receive the agent digital certificate issued by the certificate authority according to the agent authentication request.

[0120] In some embodiments, the access status information may further include access location information and current access status information.

[0121] In some embodiments, the consistency verification of the access status information included in the agent authentication request includes at least one of the following: verifying the matching between the session identifier and the user identifier in the access status information; verifying the matching between the access location information in the access status information and the physical access location corresponding to the agent authentication request; and verifying the validity of the current access status information in the access status information.

[0122] In some embodiments, the second sending module is further configured to: establish a binding relationship between the agent digital certificate and the current access session, and record the associated record information corresponding to the binding relationship, wherein the associated record information includes agent identifier, certificate identifier, session identifier, user identifier, and the current effective status information of the binding relationship.

[0123] In some embodiments, the first receiving module is further configured to: receive a communication establishment request initiated by the agent; obtain the agent identifier and the agent digital certificate of the agent according to the communication establishment request; query the associated record information according to the agent identifier and the agent digital certificate, and generate a communication establishment response; and send the communication establishment response to the agent.

[0124] In some embodiments, the network access control gateway is a virtual broadband network gateway.

[0125] Figure 9 This diagram illustrates a smart agent authentication device according to an embodiment of the present disclosure, which applies smart agents. For example... Figure 9 As shown, the device includes: a third sending module 91 and a second receiving module 92; the third sending module is used to send an access authentication request to the network access control gateway, the access authentication request including at least an agent certificate signing request and a network access authentication credential for triggering the network access control gateway to perform access authentication on the broadband user to which the agent belongs, the agent certificate signing request including the agent identifier and public key information of the agent; the second receiving module is used to receive an agent digital certificate issued by the network access control gateway, the agent digital certificate being generated by the network access control gateway based on the access status information and the agent certificate signing request, the agent authentication request being requested from and received by the certificate management network element, the access status information including user identifier and session identifier.

[0126] In some embodiments, the third sending module is further configured to: send a communication establishment request to the network access control gateway, the communication establishment request carrying the agent identifier and the agent digital certificate; the second receiving module is configured to receive a communication establishment response returned by the network access control gateway, the communication establishment response being generated by the network access control gateway based on the communication establishment request.

[0127] It should be noted that the examples and application scenarios implemented by the modules in the above device embodiments and the corresponding steps in the method embodiments are the same, but are not limited to the content disclosed in the above method embodiments. It should also be noted that the above modules, as part of the device, can be executed in a computer system such as a set of computer-executable instructions.

[0128] Those skilled in the art will understand that various aspects of this disclosure can be implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to herein as a "circuit", "module" or "system".

[0129] Based on the same inventive concept, this disclosure also provides an electronic device, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the agent authentication X method described above by executing the executable instructions. Since the principle by which this electronic device solves the problem is similar to that of the above method embodiments, the implementation of this electronic device embodiment can refer to the implementation of the above method embodiments, and repeated details will not be described again.

[0130] The following reference Figure 10 To describe an electronic device 1000 according to such an embodiment of the present disclosure. Figure 10 The electronic device 1000 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0131] like Figure 10 As shown, the electronic device 1000 is manifested in the form of a general-purpose computing device. The components of the electronic device 1000 may include, but are not limited to: at least one processing unit 1010, at least one storage unit 1020, and a bus 1030 connecting different system components (including storage unit 1020 and processing unit 1010).

[0132] The storage unit stores program code that can be executed by the processing unit 1010, causing the processing unit 1010 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 1010 can perform the following steps of the above method embodiment: obtaining an access authentication request for an intelligent agent, the access authentication request including at least user access status information and an intelligent agent certificate signing request, the access status information including at least user identifier and session identifier, and the intelligent agent certificate signing request including the intelligent agent identifier and public key information; binding the intelligent agent certificate signing request with the access status information to generate an intelligent agent authentication request, the intelligent agent authentication request including at least the intelligent agent certificate signing request, user identifier, and session identifier; sending the intelligent agent authentication request to the certificate management network element; receiving an intelligent agent digital certificate issued by the certificate management network element, wherein the intelligent agent digital certificate is issued by the certificate management network element based on the intelligent agent certificate signing request, user identifier, and session identifier; and distributing the intelligent agent digital certificate to the intelligent agent.

[0133] Storage unit 1020 may include readable media in the form of volatile storage units, such as random access memory (RAM) 10201 and / or cache memory 10202, and may further include read-only memory (ROM) 10203.

[0134] Storage unit 1020 may also include a program / utility 10204 having a set (at least one) program module 10205, such program module 10205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0135] Bus 1030 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the multiple bus structures.

[0136] Electronic device 1000 can also communicate with one or more external devices 1040 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1000, and / or any device that enables electronic device 1000 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1050. Furthermore, electronic device 1000 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1060. As shown, network adapter 1060 communicates with other modules of electronic device 1000 via bus 1030. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0137] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0138] Based on the same inventive concept, this disclosure also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the agent authentication method X described above. Since the principle by which this computer-readable storage medium embodiment solves the problem is similar to that of the above method embodiments, the implementation of this computer-readable storage medium embodiment can refer to the implementation of the above method embodiments, and repeated details will not be elaborated further.

[0139] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0140] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0141] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0142] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0143] Based on the same inventive concept, this disclosure also provides a computer program product, comprising: a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the intelligent agent authentication method of any one of the above method embodiments. Since the principle by which this computer program product embodiment solves the problem is similar to that of the above method embodiments, the implementation of this computer program product embodiment can refer to the implementation of the above method embodiments, and repeated details will not be elaborated further.

[0144] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0145] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0146] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0147] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for authenticating intelligent agents, characterized in that, Applied to network access control gateways, including: Obtain the access authentication request of the intelligent agent. The access authentication request includes at least the user's access status information and the intelligent agent certificate signing request. The access status information includes at least the user identifier and the session identifier. The intelligent agent certificate signing request includes the intelligent agent identifier and public key information of the intelligent agent. The agent certificate signing request is bound to the access status information to generate an agent authentication request. The agent authentication request includes at least the agent certificate signing request, the user identifier, and the session identifier. The intelligent agent authentication request is sent to the certificate management network element; Receive the agent digital certificate issued by the certificate management network element, wherein the agent digital certificate is issued by the certificate management network element based on the agent certificate signing request, the user identifier, and the session identifier; The digital certificate of the intelligent agent is issued to the intelligent agent.

2. The intelligent agent authentication method according to claim 1, characterized in that, The process of obtaining the access authentication request for the intelligent agent includes: Receive the access authentication request initiated by the intelligent agent, the access authentication request carrying the network access authentication credentials of the broadband user to which the intelligent agent belongs and the intelligent agent certificate signing request; The network access authentication credentials are forwarded to the authentication server so that the authentication server can perform access authentication and authorization for the broadband user. Receive the user identifier returned by the authentication server after successful authentication, establish the current access session, and generate the session identifier corresponding to the current access session; The access status information is generated based on the user identifier and the session identifier.

3. The intelligent agent authentication method according to claim 1, characterized in that, The certificate management network elements include registration authorities and certificate issuing authorities; Sending the agent authentication request to the certificate management network element includes: The agent authentication request is sent to the registration authority so that the registration authority can verify the signature validity of the agent certificate signature request contained in the agent authentication request and verify the consistency of the access status information contained in the agent authentication request. After the verification is passed, the registration authority forwards the agent authentication request to the certificate authority. Receiving the agent digital certificate issued by the certificate management network element includes: Receive the digital certificate of the intelligent agent issued by the certificate authority in accordance with the intelligent agent authentication request.

4. The intelligent agent authentication method according to any one of claims 1 to 3, characterized in that, The access status information also includes access location information and current access status information.

5. The intelligent agent authentication method according to claim 4, characterized in that, Perform consistency verification on the access state information included in the agent authentication request, including at least one of the following: Verify the match between the session identifier and the user identifier in the access status information; The matching between the access location information in the access status information and the physical access location corresponding to the agent authentication request is verified. The validity of the current access status information in the access status information is verified.

6. The intelligent agent authentication method according to claim 1, characterized in that, The method further includes: Establish a binding relationship between the agent's digital certificate and the current access session, and record the associated record information corresponding to the binding relationship. The associated record information includes the agent identifier, certificate identifier, session identifier, user identifier, and the current effective status information of the binding relationship.

7. The intelligent agent authentication method according to claim 6, characterized in that, The method further includes: Receive the communication establishment request initiated by the intelligent agent; Based on the communication establishment request, obtain the agent identifier and the agent digital certificate of the agent; Based on the agent identifier and the agent digital certificate, query the associated record information and generate a communication establishment response; Send the communication establishment response to the intelligent agent.

8. The intelligent agent authentication method according to claim 1, characterized in that, The network access control gateway is a virtual broadband network gateway.

9. A method for authenticating intelligent agents, characterized in that, Applied to intelligent agents, including: Send an access authentication request to the network access control gateway. The access authentication request includes at least an agent certificate signing request and a network access authentication credential for triggering the network access control gateway to perform access authentication on the broadband user to which the agent belongs. The agent certificate signing request includes the agent identifier and public key information of the agent. The system receives a digital certificate for an intelligent agent issued by the network access control gateway. The digital certificate for an intelligent agent is generated by the network access control gateway based on the access status information and the intelligent agent certificate signature request. The network access control gateway requests and receives the certificate management network element for the intelligent agent authentication request. The access status information includes a user identifier and a session identifier.

10. The intelligent agent authentication method according to claim 9, characterized in that, The method further includes: Send a communication establishment request to the network access control gateway, the communication establishment request carrying the agent identifier and the agent digital certificate; Receive a communication establishment response returned by the network access control gateway, which is generated by the network access control gateway based on the communication establishment request.

11. A smart agent authentication device, characterized in that, Applied to network access control gateways, including: The acquisition module is used to acquire the access authentication request of the intelligent agent. The access authentication request includes at least the user's access status information and the intelligent agent certificate signing request. The access status information includes at least the user identifier and the session identifier. The intelligent agent certificate signing request includes the intelligent agent identifier and public key information of the intelligent agent. The generation module is used to bind the agent certificate signing request with the access status information to generate an agent authentication request. The agent authentication request includes at least the agent certificate signing request, the user identifier, and the session identifier. The first sending module is used to send the intelligent agent authentication request to the certificate management network element; The first receiving module is used to receive the intelligent agent digital certificate issued by the certificate management network element, wherein the intelligent agent digital certificate is issued by the certificate management network element based on the intelligent agent certificate signing request, the user identifier, and the session identifier; The second sending module is used to send the digital certificate of the intelligent agent to the intelligent agent.

12. A smart agent authentication device, characterized in that, Applied to intelligent agents, including: The third sending module is used to send an access authentication request to the network access control gateway. The access authentication request includes at least an agent certificate signing request and a network access authentication credential used to trigger the network access control gateway to perform access authentication on the broadband user to which the agent belongs. The agent certificate signing request includes the agent identifier and public key information of the agent. The second receiving module is used to receive the agent digital certificate issued by the network access control gateway. The agent digital certificate is generated by the network access control gateway based on the access status information and the agent certificate signature request, and is requested and received by the certificate management network element. The access status information includes user identifier and session identifier.

13. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the agent authentication method according to any one of claims 1 to 10 by executing the executable instructions.

Images