Network authentication method and apparatus, communication device, and computer readable storage medium

Abstract

The present application relates to a network authentication method and apparatus, a communication device, and a computer readable storage medium. The method comprises: in response to receiving a target registration request sent by a relay device, a first network device generating an authentication request on the basis of a user equipment identifier and a relay device identifier carried in the target registration request, and sending the authentication request to a second network device (S202); the second network device generating an authentication parameter response on the basis of the user equipment identifier in the received authentication request and a corresponding authentication protocol, and sending the authentication parameter response to the first network device (S204); the first network device generating authentication intermediate data on the basis of target authentication parameters, and sending the authentication intermediate data to the relay device (S206); and receiving a target authentication response fed back by the relay device, authenticating a user equipment and the relay device on the basis of response parameters corresponding to the target authentication response, and sending the authentication result to the relay device (S208).

Description

Network authentication method, device, communication equipment and computer-readable storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 2023107740699, filed on June 27, 2023, entitled “Network Authentication Method, Apparatus, Communication Equipment and Computer-Readable Storage Medium,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present application relates to the field of network communication technology, and in particular to a network authentication method, apparatus, communication device, and computer-readable storage medium. Background Art

[0004] With the development of network communication technology, when a terminal accesses the network through one or more relays, mutual authentication between terminals and between terminals and the network needs to be considered.

[0005] Existing mechanisms generally use additional mechanisms different from cellular network access authentication to independently solve this problem. This requires enabling additional identity authentication mechanisms between devices, resulting in high system complexity and low network authentication efficiency.

[0006] Summary of the Invention

[0007] In a first aspect, the present application provides a network authentication method, which is applied to a core network, where the core network includes a first network device and a second network device, including:

[0008] In response to receiving the target registration request sent by the relay device, the first network device generates an authentication request based on the user equipment identifier and the relay device identifier carried in the target registration request, and sends the authentication request to the second network device;

[0009] The second network device obtains the corresponding contract information according to the user device identifier in the received authentication request, determines the corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends it to the first network device;

[0010] The first network device determines the target authentication parameter from the authentication parameter response, generates authentication intermediate data based on the target authentication parameter, and sends the data to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and generates a target authentication response based on the response parameter corresponding to the initial authentication response and receiving the initial authentication response fed back by the user equipment based on the target reference authentication data, and sends the target authentication response to the core network;

[0011] Receive the target authentication response fed back by the relay device, authenticate the user device and the relay device according to the response parameters corresponding to the target authentication response, and send the authentication result to the relay device.

[0012] In some embodiments of the first aspect, the second network device includes a first functional device and a second functional device, the second network device obtaining corresponding contract information based on a user device identifier in a received authentication request, determining a corresponding authentication protocol based on the contract information, generating an authentication parameter response based on the authentication protocol, and sending the response to the first network device, including:

[0013] The first functional device receives the authentication request and forwards the authentication request to the second functional device;

[0014] The second functional device obtains corresponding contract information according to the user equipment identifier in the authentication request, determines the corresponding authentication protocol according to the contract information, and generates a first authentication vector using a preset algorithm according to the authentication protocol;

[0015] The second functional device sends the first authentication vector to the first functional device;

[0016] The first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response based on the expected response parameter and a random number, and constructs a second authentication vector based on the hash value;

[0017] An authentication parameter response is generated according to the second authentication vector and sent to the first network device.

[0018] In some embodiments of the first aspect, the authentication request includes a device location parameter corresponding to the relay device and a location network identifier corresponding to the relay device; the second functional device obtains corresponding subscription information based on the user device identifier in the authentication request, determines a corresponding authentication protocol based on the subscription information, and generates a first authentication vector using a preset algorithm according to the authentication protocol, including:

[0019] Obtain network location parameters based on the logical operation of the device location parameters and the location network identifier;

[0020] Based on the network location parameters, a first authentication vector is constructed.

[0021] In some embodiments of the first aspect, the first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response based on the expected response parameter and a random number, and constructs a second authentication vector based on the hash value, including:

[0022] Based on the hash value and the network location parameter, a second authentication vector is constructed.

[0023] In some embodiments of the first aspect, the network authentication method further includes:

[0024] The first network device sends a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction;

[0025] Determine the relay service authority of the relay device based on the query results;

[0026] When the relay service permission is no permission, the target registration request is rejected.

[0027] In a second aspect, the present application provides another network authentication method, which is applied to a first network device in a core network, wherein the core network also includes a second network device. The method includes:

[0028] In response to receiving a target registration request sent by the relay device, generating an authentication request based on the user equipment identifier and the relay device identifier carried in the target registration request, and sending the authentication request to the second network device;

[0029] receiving an authentication parameter response sent by the second network device, and determining a target authentication parameter from the authentication parameter response;

[0030] Based on the target authentication parameters, authentication intermediate data is generated and sent to the relay device, so that the relay device selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and enables the relay device to receive the initial authentication response fed back by the user device based on the target reference authentication data, and generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network.

[0031] In some embodiments of the second aspect, the method further comprises:

[0032] Sending a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction;

[0033] Determining the relay service authority of the relay device according to the query result; and

[0034] When the relay service authority is no authority, the target registration request is rejected.

[0035] In a third aspect, the present application provides another network authentication method, which is applied to a second network device in a core network, wherein the core network also includes a first network device. The method includes:

[0036] receiving an authentication request sent by the first network device;

[0037] According to the user equipment identifier in the authentication request, the corresponding contract information is obtained, and the corresponding authentication protocol is determined according to the contract information, and an authentication parameter response is generated according to the authentication protocol and sent to the first network device.

[0038] In some embodiments of the third aspect, the second network device includes a first functional device and a second functional device; and the acquiring, according to the user equipment identifier in the authentication request, corresponding contract information, determining a corresponding authentication protocol according to the contract information, generating an authentication parameter response according to the authentication protocol, and sending the response to the first network device includes:

[0039] The first functional device receives the authentication request and forwards the authentication request to the second functional device;

[0040] The second function device obtains corresponding contract information according to the user equipment identifier in the authentication request, determines a corresponding authentication protocol according to the contract information, and generates a first authentication vector according to the authentication protocol using a preset algorithm;

[0041] The second functional device sends the first authentication vector to the first functional device;

[0042] The first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response based on the expected response parameter and a random number, and constructs a second authentication vector based on the hash value; and

[0043] An authentication parameter response is generated according to the second authentication vector and sent to the first network device.

[0044] In some embodiments of the third aspect, the authentication request includes a device location parameter corresponding to the relay device and a location network identifier corresponding to the relay device; the second function device obtains corresponding subscription information based on the user equipment identifier in the authentication request, determines a corresponding authentication protocol based on the subscription information, and generates a first authentication vector using a preset algorithm according to the authentication protocol, including:

[0045] Obtaining a network location parameter based on a logical operation of the device location parameter and the location network identifier; and

[0046] A first authentication vector is constructed based on the network location parameter.

[0047] In some embodiments of the third aspect, the first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response based on the expected response parameter and a random number, and constructs a second authentication vector based on the hash value, including:

[0048] A second authentication vector is constructed based on the hash value and the network location parameter.

[0049] In a fourth aspect, the present application further provides a network authentication method, applied to a relay device, comprising:

[0050] receiving an initial registration request sent by a user equipment, where the initial registration request includes a user equipment identifier of the user equipment;

[0051] Generate a target registration request based on the initial registration request, where the target registration request includes a user equipment identifier and a relay device identifier of the relay device;

[0052] Sending the target registration request to the core network, so that the core network determines the target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data according to the target authentication protocol using the user equipment identifier and the relay device identifier;

[0053] Receive the authentication intermediate data fed back by the core network, generate corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and send the target reference authentication data to the user equipment;

[0054] Receive an initial authentication response fed back by the user equipment based on the target reference authentication data, generate a target authentication response based on the response parameters corresponding to the initial authentication response, and send the target authentication response to the core network, so that the core network generates corresponding response parameters based on the target authentication response, authenticates the user equipment and the relay device based on the response parameters and the target parameters in the authentication intermediate data, and feeds back the authentication result to the relay device;

[0055] The authentication result fed back by the core network is sent to the user equipment to complete the network authentication between the user equipment and the relay device and between the user equipment and the core network.

[0056] In some embodiments of the fourth aspect, the target reference data includes a random parameter and an authentication token parameter; receiving authentication intermediate data fed back by a core network, generating corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and sending the target reference authentication data to a user equipment, comprises:

[0057] Generate corresponding target reference authentication data based on the random parameter and the authentication token parameter;

[0058] The target reference authentication data is sent to the user equipment so that the user equipment verifies the authentication token parameters carried in the target reference authentication data according to the 3GPP standard rules, generates an initial authentication response based on the verification result, and feeds it back to the relay device.

[0059] In some embodiments of the fourth aspect, receiving an initial authentication response fed back by a user equipment based on target reference authentication data, generating a target authentication response according to a response parameter corresponding to the initial authentication response, and sending the target authentication response to a core network includes:

[0060] The response parameter and the random number are calculated through the hash function to obtain the response intermediate parameter;

[0061] The verification parameter is obtained by calculating the hash function based on the intermediate parameter and the random number;

[0062] Compare the verification parameters with the target verification parameters corresponding to the authentication intermediate data, and generate a target authentication response based on the response parameters and the comparison result;

[0063] Send the target authentication response to the core network.

[0064] In a fifth aspect, the present application provides a network authentication apparatus, which is applied to a core network, wherein the core network includes a first network device and a second network device. The network authentication apparatus includes:

[0065] a verification module configured to cause the first network device to generate, in response to receiving a target registration request sent by the relay device, an authentication request based on the user device identifier and the relay device identifier carried in the target registration request, and send the authentication request to the second network device; the second network device to obtain corresponding contract information based on the user device identifier in the received authentication request, determine a corresponding authentication protocol based on the contract information, generate an authentication parameter response based on the authentication protocol, and send the authentication parameter response to the first network device;

[0066] A response module is used for the first network device to determine the target authentication parameters from the authentication parameter response, and based on the target authentication parameters, generate authentication intermediate data, and send it to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates the corresponding target reference authentication data, and based on the initial authentication response fed back by the user device based on the target reference authentication data, generates the target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network; receives the target authentication response fed back by the relay device, authenticates the user device and the relay device according to the response parameters corresponding to the target authentication response, and sends the authentication result to the relay device.

[0067] In a sixth aspect, the present application provides another network authentication apparatus, applied to a first network device of a core network, wherein the core network further includes a second network device, the apparatus comprising:

[0068] a verification module configured to, in response to receiving a target registration request sent by the relay device, generate an authentication request based on the user equipment identifier and the relay equipment identifier carried in the target registration request, and send the authentication request to the second network device; and

[0069] A response module is used to receive an authentication parameter response sent by the second network device; determine a target authentication parameter from the authentication parameter response; generate authentication intermediate data based on the target authentication parameter, and send it to the relay device, so that the relay device selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and enables the relay device to receive an initial authentication response fed back by the user device based on the target reference authentication data, and generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network.

[0070] In a seventh aspect, the present application provides another network authentication apparatus, applied to a second network device of a core network, wherein the core network further includes a first network device, the apparatus comprising:

[0071] A verification module is used to receive an authentication request sent by the first network device; obtain corresponding contract information according to the user device identifier in the authentication request, and determine the corresponding authentication protocol according to the contract information, and generate an authentication parameter response according to the authentication protocol, and send it to the first network device.

[0072] In an eighth aspect, the present application provides another network authentication device, which is applied to a relay device. The network authentication device includes:

[0073] a transceiver module configured to receive an initial registration request sent by a user device, the initial registration request including a user device identifier of the user device; generate a target registration request based on the initial registration request, the target registration request including the user device identifier and a relay device identifier of the relay device; and send the target registration request to a core network, so that the core network determines a target authentication protocol based on contract information corresponding to the user device identifier, and generates corresponding authentication intermediate data using the user device identifier and the relay device identifier according to the target authentication protocol;

[0074] A verification module is configured to receive authentication intermediate data fed back by the core network, generate corresponding target reference authentication data based on target reference data selected from the authentication intermediate data, and send the target reference authentication data to the user device; receive an initial authentication response fed back by the user device based on the target reference authentication data, generate a target authentication response based on response parameters corresponding to the initial authentication response, and send the target authentication response to the core network, so that the core network generates corresponding response parameters based on the target authentication response, authenticates the user device and the relay device based on the response parameters and the target parameters in the authentication intermediate data, and feeds back the authentication result to the relay device;

[0075] The authentication module is used to send the authentication result fed back by the core network to the user equipment, completing the network authentication between the user equipment and the relay device and between the user equipment and the core network.

[0076] In a ninth aspect, the present application provides a communication device. The communication device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0077] In response to receiving the target registration request sent by the relay device, the first network device generates an authentication request based on the user equipment identifier and the relay device identifier carried in the target registration request, and sends the authentication request to the second network device;

[0078] The second network device obtains the corresponding contract information according to the user device identifier in the received authentication request, determines the corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends it to the first network device;

[0079] The first network device determines the target authentication parameter from the authentication parameter response, generates authentication intermediate data based on the target authentication parameter, and sends the data to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and generates a target authentication response based on the response parameter corresponding to the initial authentication response and receiving the initial authentication response fed back by the user equipment based on the target reference authentication data, and sends the target authentication response to the core network;

[0080] Receive the target authentication response fed back by the relay device, authenticate the user device and the relay device according to the response parameters corresponding to the target authentication response, and send the authentication result to the relay device.

[0081] In a tenth aspect, the present application provides another communication device. The communication device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0082] receiving an initial registration request sent by a user equipment, where the initial registration request includes a user equipment identifier of the user equipment;

[0083] Generate a target registration request based on the initial registration request, where the target registration request includes a user equipment identifier and a relay device identifier of the relay device;

[0084] Sending the target registration request to the core network, so that the core network determines the target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data according to the target authentication protocol using the user equipment identifier and the relay device identifier;

[0085] Receive the authentication intermediate data fed back by the core network, generate corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and send the target reference authentication data to the user equipment;

[0086] Receive an initial authentication response fed back by the user equipment based on the target reference authentication data, generate a target authentication response based on the response parameters corresponding to the initial authentication response, and send the target authentication response to the core network, so that the core network generates corresponding response parameters based on the target authentication response, authenticates the user equipment and the relay device based on the response parameters and the target parameters in the authentication intermediate data, and feeds back the authentication result to the relay device;

[0087] The authentication result fed back by the core network is sent to the user equipment to complete the network authentication between the user equipment and the relay device and between the user equipment and the core network.

[0088] In an eleventh aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0089] In response to receiving the target registration request sent by the relay device, the first network device generates an authentication request based on the user equipment identifier and the relay device identifier carried in the target registration request, and sends the authentication request to the second network device;

[0090] The second network device obtains the corresponding contract information according to the user device identifier in the received authentication request, determines the corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends it to the first network device;

[0091] The first network device determines the target authentication parameter from the authentication parameter response, generates authentication intermediate data based on the target authentication parameter, and sends the data to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and generates a target authentication response based on the response parameter corresponding to the initial authentication response and receiving the initial authentication response fed back by the user equipment based on the target reference authentication data, and sends the target authentication response to the core network;

[0092] Receive the target authentication response fed back by the relay device, authenticate the user device and the relay device according to the response parameters corresponding to the target authentication response, and send the authentication result to the relay device.

[0093] In a twelfth aspect, the present application provides another computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0094] receiving an initial registration request sent by a user equipment, where the initial registration request includes a user equipment identifier of the user equipment;

[0095] Generate a target registration request based on the initial registration request, where the target registration request includes a user equipment identifier and a relay device identifier of the relay device;

[0096] Sending the target registration request to the core network, so that the core network determines the target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data according to the target authentication protocol using the user equipment identifier and the relay device identifier;

[0097] Receive the authentication intermediate data fed back by the core network, generate corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and send the target reference authentication data to the user equipment;

[0098] Receive an initial authentication response fed back by the user equipment based on the target reference authentication data, generate a target authentication response based on the response parameters corresponding to the initial authentication response, and send the target authentication response to the core network, so that the core network generates corresponding response parameters based on the target authentication response, authenticates the user equipment and the relay device based on the response parameters and the target parameters in the authentication intermediate data, and feeds back the authentication result to the relay device;

[0099] The authentication result fed back by the core network is sent to the user equipment to complete the network authentication between the user equipment and the relay device and between the user equipment and the core network.

[0100] The details of one or more embodiments of the present application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the present application will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0101] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. The drawings described below are merely some embodiments of the present application and do not constitute a limitation on the disclosure content and protection scope of the present application.

[0102] FIG1 is a diagram illustrating an application environment of a core network participating in a network authentication method according to an embodiment;

[0103] FIG2 is a schematic diagram of a flow chart of a network authentication method in one embodiment;

[0104] FIG3 is a schematic diagram of a flow chart of the step of generating a second authentication vector in one embodiment;

[0105] FIG4 is a schematic diagram of a flow chart of a method for generating a first authentication vector in one embodiment;

[0106] FIG5 is a schematic flow chart of the step of generating a second authentication vector in another embodiment;

[0107] FIG6 is a flow chart showing steps for rejecting a target registration request in one embodiment;

[0108] FIG7 is a schematic diagram of a process in which a relay device participates in network authentication in one embodiment;

[0109] FIG8 is a schematic diagram of a process for generating target reference authentication data and feeding it back to a relay device in one embodiment;

[0110] FIG9 is a schematic diagram of a process for generating a target authentication response and feeding it back to the core network in one embodiment;

[0111] FIG10 is a system architecture diagram of a network authentication method according to an embodiment;

[0112] FIG11 is a schematic flow chart of a network authentication method in another embodiment;

[0113] FIG12 is a block diagram of a network authentication device according to an embodiment;

[0114] FIG13 is a block diagram of a network authentication device according to another embodiment;

[0115] FIG14 is a diagram showing the internal structure of a communication device according to an embodiment;

[0116] FIG15 is a diagram showing the internal structure of a communication device in another embodiment. DETAILED DESCRIPTION

[0117] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0118] The network authentication method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1, wherein the user device 102 communicates with the relay device 104 through the network, and the core network 106 communicates with the relay device 104 through the network. The core network 106 includes a first network device and a second network device. The first network device, in response to receiving a target registration request sent by the relay device, generates an authentication request based on the user equipment identifier and the relay device identifier carried in the target registration request, and sends the authentication request to the second network device. The second network device obtains corresponding subscription information based on the user equipment identifier in the received authentication request, determines a corresponding authentication protocol based on the subscription information, generates an authentication parameter response based on the authentication protocol, and sends the authentication parameter response to the first network device. The first network device determines target authentication parameters from the authentication parameter response, generates authentication intermediate data based on the target authentication parameters, and sends the authentication parameter response to the relay device 104, so that the relay device 104 selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and generates a target authentication response based on the initial authentication response received from the user equipment 102 based on the target reference authentication data, and sends the target authentication response to the core network 106 according to the response parameters corresponding to the initial authentication response. The relay device 104 receives the target authentication response fed back by the relay device 104, authenticates the user equipment 102 and the relay device 104 according to the response parameters corresponding to the target authentication response, and sends the authentication result to the relay device 104.

[0119] In one embodiment, as shown in FIG2 , a network authentication method is provided, which is described by taking the application of the method to the core network 106 in FIG1 as an example, and includes steps S202 - S208 .

[0120] Step S202: In response to receiving the target registration request sent by the relay device, the first network device generates an authentication request based on the user equipment identifier and the relay device identifier carried in the target registration request, and sends the authentication request to the second network device.

[0121] Among them, the target registration request includes the user device identifier and the relay device identifier. The target registration request is generated by the relay device based on the initial registration request sent by the user device, and the initial registration request carries the user device identifier. The first network device can be a device responsible for the security anchor function in the core network. It can be a single device or a combination of multiple devices that jointly perform specific functions. The second network device includes a first functional device and a second functional device, wherein the first functional device can be a device that undertakes the authentication service function, and the second functional device can be a device that undertakes the unified data management function.

[0122] In some embodiments, the first network device receives a target registration request sent by the relay device, and then generates an authentication request based on the user device identifier and the relay device identifier carried in the target registration request, such that the authentication request carries the user device identifier and the relay device identifier. Optionally, when generating the authentication request, the authentication request may also carry a serving network name and a relay device location parameter, which may be the latitude and longitude parameters of the current relay device.

[0123] Optionally, upon receiving a target registration request, the first network device performs an authorization verification on the relay device identifier in the target registration request, and rejects the target registration request if the target registration request is denied. The authorization verification method includes the first network device querying the second functional device in the second network device and obtaining contract information corresponding to the current relay device, and determining, based on the contract information, whether the relay device has authorization to provide relay services.

[0124] In step S204, the second network device obtains the corresponding contract information according to the user device identifier in the received authentication request, determines the corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends it to the first network device.

[0125] In some embodiments, after the first functional device in the second network device receives the authentication request, it obtains the corresponding contract information from the second functional device based on the user device identifier carried in the authentication request, determines the corresponding authentication protocol, and then generates a first authentication vector based on the authentication protocol, and sends the first authentication vector to the first functional device. The first functional device then generates a corresponding second authentication vector based on the first authentication vector, generates an authentication parameter response, so that the authentication parameter response carries the second authentication vector, and sends the authentication parameter response to the first network device.

[0126] In step S206, the first network device determines the target authentication parameter from the authentication parameter response, and based on the target authentication parameter, generates authentication intermediate data, and sends it to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and based on the initial authentication response fed back by the receiving user device based on the target reference authentication data, generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network.

[0127] In some embodiments, the first network device receives an authentication parameter response sent back by the second network device, determines the target authentication parameter from the authentication parameter response, fuses the target authentication parameter with a random number, generates authentication intermediate data, and sends the authentication intermediate data to the relay device, wherein the fusion method can be a random combination of operations such as addition, subtraction, multiplication, division, and square root, so that the relay device selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and based on the initial authentication response fed back by the receiving user device based on the target reference authentication data, generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network.

[0128] Step S208: Receive the target authentication response fed back by the relay device, authenticate the user device and the relay device according to the response parameters corresponding to the target authentication response, and send the authentication result to the relay device.

[0129] In some embodiments, the relay device receives the initial authentication response sent by the user device, calculates the verification parameter based on the corresponding response parameter in the initial authentication response, and then compares the verification parameter with the corresponding standard parameter. If the two are consistent, the relay device generates a corresponding target authentication response and sends it to the core network.

[0130] Optionally, when calculating the verification parameter, the relay device may use a hash function to calculate the response parameter and the random number to obtain a corresponding initial verification parameter, and then use a hash function to calculate the initial verification parameter and the random number to obtain a corresponding verification parameter.

[0131] In this embodiment, the first network device responds to a target registration request sent by a receiving relay device, generates an authentication request based on the user device identifier and the relay device identifier carried in the target registration request, and sends it to the second network device. The second network device obtains the corresponding contract information based on the user device identifier in the received authentication request, determines the corresponding authentication protocol based on the contract information, generates an authentication parameter response based on the authentication protocol, and sends it to the first network device. The first network device determines the target authentication parameters from the authentication parameter response, and generates authentication intermediate data based on the target authentication parameters, and sends it to the relay device, so that the relay device selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and generates a target authentication response based on the initial authentication response fed back by the receiving user device based on the target reference authentication data, and generates a target authentication response based on the response parameters corresponding to the initial authentication response, and sends it to the core network. The target authentication response fed back by the relay device is received, and the user device and the relay device are authenticated based on the response parameters corresponding to the target authentication response, and the authentication result is sent to the relay device. This enables the authentication between the user device and the relay device, as well as the authentication between the relay device and the network to be completed in the same authentication process. Compared with the existing technology that uses an additional mechanism different from the cellular network access authentication and independently authenticates the processes, the network authentication method of the present application can effectively reduce the system complexity and improve the efficiency of network authentication.

[0132] In one embodiment, the second network device includes a first functional device and a second functional device. The first functional device may be a device in the core network that performs authentication service functions, and the second functional device may be a device in the core network that performs unified data management functions. The user equipment identifier is used to identify the identity of the corresponding user equipment in the network, and may be, for example, the IP address of the user equipment. As shown in FIG3 , the second network device obtains corresponding contract information based on the user equipment identifier in the received authentication request, determines the corresponding authentication protocol based on the contract information, generates an authentication parameter response based on the authentication protocol, and transmits it to the first network device, including steps S302-S310.

[0133] Step S302: The first functional device receives the authentication request and forwards the authentication request to the second functional device.

[0134] In step S304, the second functional device obtains corresponding contract information according to the user equipment identifier in the authentication request, determines the corresponding authentication protocol according to the contract information, and generates a first authentication vector using a preset algorithm according to the authentication protocol.

[0135] In some embodiments, after receiving the authentication request, the second functional device searches for the contract information pre-stored in the local database according to the user device identifier in the authentication request, determines the authentication protocol corresponding to the user device identifier based on the contract information, and then generates the first authentication vector using the corresponding method / preset algorithm based on the type of the authentication protocol.

[0136] Optionally, the second function device generates a vector AV (RAND, AUTN, XRES, CK, IK) using the Milenage algorithm set in a manner defined by the 3GPP standard, and then generates a parameter K using parameters CK, IK, service network name SNN, etc. AUSF , and use XRES, RAND, SNN, CK, IK and other parameters to generate parameter XRES*, generate the first authentication vector HE AV (RAND, AUTN, XRES*, K AUSF ).

[0137] Step S306: The second functional device sends the first authentication vector to the first functional device.

[0138] In some embodiments, the second functional device generates an authentication parameter intermediate response according to the first authentication vector, so that the authentication parameter intermediate response carries the first authentication vector, and then sends the authentication parameter intermediate response to the first functional device.

[0139] In step S308 , the first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response by fusing the expected response parameter with a random number, and constructs a second authentication vector based on the hash value.

[0140] In some embodiments, after receiving the first authentication vector in the above step, the first functional device determines the expected response parameter in the first authentication vector, and merges the preset response parameter with the random number to obtain a hash value of the expected response, and then constructs a second authentication vector based on the hash value.

[0141] Step S310: Generate an authentication parameter response according to the second authentication vector and send it to the first network device.

[0142] In some embodiments, the first functional device generates an authentication parameter response according to the second authentication vector, so that the authentication parameter response carries the second authentication vector.

[0143] In this embodiment, the first functional device receives an authentication request and forwards the authentication request to the second functional device. The second functional device obtains the corresponding contract information based on the user device identifier in the authentication request, determines the corresponding authentication protocol based on the contract information, generates a first authentication vector through a preset algorithm according to the authentication protocol, and the second functional device sends the first authentication vector to the first functional device. The first functional device determines the expected response parameter from the first authentication vector, and obtains a hash value of the expected response by fusing the expected response parameter with a random number, and constructs a second authentication vector based on the hash value. An authentication parameter response is generated according to the second authentication vector and sent to the first network device. In this way, the parameter verification process of the network authentication is realized through the process of mutual authentication and interaction of parameters between the first functional device and the second functional device in the second network device, effectively improving the accuracy of the verification during the network authentication process.

[0144] In one embodiment, the authentication request includes a device location parameter corresponding to the relay device and a network identifier corresponding to the location of the relay device. As shown in FIG4 , the second functional device obtains corresponding subscription information based on the user device identifier in the authentication request, determines the corresponding authentication protocol based on the subscription information, and generates a first authentication vector using a preset algorithm based on the authentication protocol, including steps S402-S404.

[0145] Step S402: Obtain network location parameters based on a logical operation of the device location parameters and the location network identifier.

[0146] In some embodiments, the second function device performs an OR operation on the device location parameter corresponding to the relay device and the local network identifier to obtain the network location parameter.

[0147] Step S404: construct a first authentication vector based on the network location parameter.

[0148] In some embodiments, the second function device generates a first authentication vector based on the network location parameter in the aforementioned step, so that the first authentication vector carries the network location parameter.

[0149] In this embodiment, the network location parameters are obtained based on the logical operation of the device location parameters and the location network identifier, and the first authentication vector is constructed based on the network location parameters, thereby achieving accurate determination of the network location parameters, and then achieving the accuracy of the location dimension of the first authentication vector, thereby improving the reliability of the first authentication vector.

[0150] In one embodiment, the authentication request includes a device location parameter corresponding to the relay device and a network identifier corresponding to the location of the relay device. As shown in FIG5 , the first functional device determines an expected response parameter from the first authentication vector, combines the expected response parameter with a random number to obtain a hash value of the expected response, and constructs a second authentication vector based on the hash value, including steps S502-S504.

[0151] Step S502: Obtain network location parameters based on a logical operation of the device location parameters and the location network identifier.

[0152] In some embodiments, the first functional device performs an OR operation on the device location parameter corresponding to the relay device and the local network identifier to obtain the network location parameter.

[0153] Step S504: construct a second authentication vector based on the hash value and the network location parameter.

[0154] In some embodiments, the first functional device determines an expected response parameter from the first authentication vector, and obtains a hash value of the expected response based on the expected response parameter and a random number, and then obtains a second authentication vector based on a combination of the hash value and the network location parameter.

[0155] In this embodiment, the network location parameter is obtained based on the logical operation of the device location parameter and the location network identifier, and the second authentication vector is constructed based on the hash value and the network location parameter, thereby achieving accurate determination of the network location parameter, and then achieving the accuracy of the location dimension of the second authentication vector, thereby improving the reliability of the second authentication vector.

[0156] In one embodiment, as shown in FIG6 , the network authentication method further includes steps S602 - S606 .

[0157] In step S602, the first network device sends a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction.

[0158] The query instruction corresponds to the relay device identifier currently processed by the first network device, that is, is used to query the relay service authority of the corresponding relay device.

[0159] In some embodiments, the first network device sends a query instruction to the second functional device of the second network device, so that the second functional device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction.

[0160] Step S604: Determine the relay service authority of the relay device according to the query result.

[0161] Step S606: When the relay service authority is no authority, the target registration request is rejected.

[0162] In some embodiments, when it is found that the corresponding relay device does not have the authority to provide relay services, a request result is fed back to the relay device as a request rejection.

[0163] In this embodiment, the first network device sends a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction, and determines the relay service authority of the relay device based on the query result. When the relay service authority is no authority, the target registration request is rejected, effectively preventing unauthorized relay devices from performing network authentication and improving network security.

[0164] In one embodiment, as shown in FIG. 7 , a network authentication method is provided. The method is described by taking the application of the method to the relay device 104 in FIG. 1 as an example, and includes steps S702 - S712 .

[0165] Step S702: Receive an initial registration request sent by a user equipment.

[0166] The initial registration request includes a user equipment identifier of the user equipment, and the user equipment may be various user terminals, such as a mobile phone, a computer, a wearable device, etc.

[0167] Step S704: Generate a target registration request based on the initial registration request.

[0168] The target registration request includes the user equipment identifier and the relay device identifier of the relay device.

[0169] Step S706: Send the target registration request to the core network, so that the core network determines the target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data according to the target authentication protocol using the user equipment identifier and the relay device identifier.

[0170] The target registration request may include a user equipment identifier, a relay equipment identifier, a relay equipment location parameter, and a service network name.

[0171] In some embodiments, the relay device sends the target registration request to the core network. After receiving the target registration request, the first network device of the core network identifies the user equipment identifier in the target registration request. If it is a specific relay service business representation assigned to the user equipment, it converts it into a remote user equipment identifier (such as SUPI) corresponding to the user equipment.

[0172] Step S708: Receive the authentication intermediate data fed back by the core network, generate corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and send the target reference authentication data to the user equipment.

[0173] In some embodiments, after the relay device receives the authentication intermediate data, it determines the target reference data in the authentication intermediate data according to the method defined by 3GPP, and generates corresponding target reference authentication data based on the target reference data, so that the target reference authentication data carries the target reference data, and sends the target reference authentication data to the user device.

[0174] Step S710, receiving the initial authentication response fed back by the user device based on the target reference authentication data, and generating a target authentication response according to the response parameters corresponding to the initial authentication response, and sending it to the core network, so that the core network generates corresponding response parameters according to the target authentication response, authenticates the user device and the relay device based on the response parameters and the target parameters in the authentication intermediate data, and feeds back the authentication result to the relay device.

[0175] In some embodiments, the user equipment verifies the target reference data according to the target reference data in the target reference authentication data received in the aforementioned steps in accordance with the method defined by 3GPP, and calculates the corresponding response parameters based on the target reference data, generates a corresponding initial authentication response, so that the initial authentication response carries the response parameters, and then sends the initial authentication response to the relay device. After the relay device receives the initial authentication response, it generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network, so that the core network generates the corresponding response parameters according to the target authentication response, authenticates the user equipment and the relay device based on the response parameters and the target parameters in the authentication intermediate data, and feeds back the authentication result to the relay device.

[0176] Step S712: Send the authentication result fed back by the core network to the user equipment, completing the network authentication between the user equipment and the relay device and between the user equipment and the core network.

[0177] In this embodiment, the relay device participates in the two-way authentication between the remote user device and the core network, thereby completing the authentication between the user device and the relay device and the authentication between the relay device and the network in the same authentication process. Compared with the existing technology that uses an additional mechanism different from the cellular network access authentication and independently authenticates its process, the network verification method of the present application can effectively reduce the system complexity and improve the efficiency of network authentication.

[0178] In one embodiment, the target reference data includes random parameters and authentication token parameters. As shown in FIG8 , receiving authentication intermediate data fed back by the core network, generating corresponding target reference authentication data based on target reference data selected from the authentication intermediate data, and sending the target reference authentication data to the user equipment includes steps S802-S804.

[0179] Step S802: Generate corresponding target reference authentication data based on the random parameters and the authentication token parameters.

[0180] In some embodiments, the relay device generates target reference authentication data from the target reference data in the authentication intermediate data received from the core network, so that the target reference data carries the random parameters and authentication token parameters in the target reference data.

[0181] Step S804: Send the target reference authentication data to the user equipment so that the user equipment verifies the authentication token parameters carried in the target reference authentication data according to 3GPP standard rules, generates an initial authentication response based on the verification result, and feeds it back to the relay device.

[0182] In this embodiment, corresponding target reference authentication data is generated based on random parameters and authentication token parameters, and the target reference authentication data is sent to the user device, so that the user device verifies the authentication token parameters carried in the target reference authentication data according to the 3GPP standard rules, and generates an initial authentication response based on the verification result, and feeds it back to the relay device, thereby achieving effective verification of the authentication intermediate data fed back by the core network and improving the accuracy of network authentication.

[0183] In one embodiment, as shown in FIG9 , an initial authentication response fed back by the user equipment based on the target reference authentication data is received, and a target authentication response is generated according to the response parameters corresponding to the initial authentication response and sent to the core network, including steps S902 - S908 .

[0184] Step S902: Calculate the response parameter and the random number through a hash function to obtain a response intermediate parameter.

[0185] Step S904: A verification parameter is obtained by calculating the intermediate parameter and the random number through a hash function.

[0186] Step S906: Compare the verification parameter with the target verification parameter corresponding to the authentication intermediate data, and generate a target authentication response based on the response parameter and the comparison result.

[0187] In some embodiments, the relay device compares the verification parameter with the target verification parameter corresponding to the authentication intermediate data. If the two are consistent, the current authentication step is considered to have passed, and a target authentication response is generated based on the response parameter and the comparison result, so that the target authentication response carries the response parameter.

[0188] Step S908: Send the target authentication response to the core network.

[0189] In this embodiment, the response parameter and the random number are calculated through a hash function to obtain a response intermediate parameter, the verification parameter is calculated based on the intermediate parameter and the random number through a hash function, the verification parameter is compared with the target verification parameter corresponding to the authentication intermediate data, and the target authentication response is generated based on the response parameter and the comparison result, and the target authentication response is sent to the core network, thereby realizing the re-verification process of the user equipment for network authentication and improving the efficiency of network authentication.

[0190] This application also provides an application scenario, which applies the above-mentioned network authentication method. The method is applied to a scenario where a remote UE (User Equipment) accesses a network authentication process through a relay UE. Specifically, as shown in Figure 10, the application of the network authentication method in this application scenario is as follows:

[0191] In this embodiment, a flowchart of a remote UE accessing a network authentication process through a relay UE is shown in FIG11 , and the specific steps are as follows:

[0192] 1. The remote UE and the relay UE first establish a U2U connection. The remote UE initiates a registration request to the relay UE, and the message carries the network identifier of the remote UE. The connection method can be based on WiFi Direct or Sidelink. The remote UE network identifier can be SUCI or SUPI in 5G networks and other corresponding user identifiers in 6G networks. The remote UE network identifier can also be an identifier specifically allocated to the relay service UE.

[0193] 2. The relay UE forwards the registration request message of the remote UE to the core network. The message is forwarded to the security anchor function to request authentication of the remote UE. The registration request message carries the remote UE identifier and the relay UE identifier. The registration message carries specific fields. In one implementation, the registration message may optionally carry a relay UE location parameter. In one implementation, the relay UE location parameter may be the latitude and longitude parameters of the current relay UE.

[0194] 3. The security anchor function determines that the remote UE needs to be authenticated and initiates an authentication request message to the authentication service function. The security anchor function needs to verify whether the relay UE has the authority to provide relay services. If not, the registration request is rejected.

[0195] Optionally, the security anchor function queries the unified data management function to obtain the contract information of the relay UE, and obtains whether the relay UE has the authority to provide relay services based on the contract information; wherein the message carries the service network name SNN; the message carries the relay UE location parameter. If the remote UE identifier received by the security anchor function is a specific relay service business identifier allocated to the UE, it needs to be converted into the remote UE network identifier corresponding to the UE (such as SUPI);

[0196] 4. The authentication service function initiates an authentication parameter request message to the unified data management function; the message carries the remote UE identifier, the service network name SNN, and the relay UE location parameters;

[0197] 5. After receiving the request message, the unified data management function determines the corresponding authentication protocol according to the contract situation, generates an authentication vector, and sends an authentication parameter response message to the authentication service function, which carries the generated authentication vector. The specific process is that the unified data management function uses the 3GPP standard definition method and the Milenage algorithm set to generate vectors AV (RAND, AUTN, XRES, CK, IK), generate CK', IK', and then use CK, IK, SNN, etc. to generate K AUSF , and use XRES, RAND, SNN, CK, IK, etc. to generate XRES*, and use the authentication vector HE AV (RAND, AUTN, XRES*, K AUSF ) is sent to the authentication service function;

[0198] Where, RAND: random number, AUTN: AUthentication TokeN, authentication token, XRES: eXpected RESponse, CK: Cipher Key, confidentiality key (or encryption key), IK: Integrity key (or integrity protection key), SNN serving network name, Kausf: AUSF key, Authentication Server Function, authentication service function;

[0199] Among them, in generating K AUSF When using XRES*, the relay UE location parameter is added to the input parameters, and the K AUSF The SNN in the generation function is replaced by "SNN||relay UE location parameter";

[0200] 6. After receiving the information, the authentication service function saves the XRES* parameter and calculates HXRES* using XRES* and RAND parameters.AUSF and SNN generates K SEAF Parameters, and send the authentication vector SE AV (RAND, AUTN, HXRES*) to the security anchor function through the authentication response message;

[0201] Note: In one implementation, when generating K SEAF When the relay UE location parameter is added to the input parameter, the K SEAF The SNN in the generation function is replaced by "SNN||relay UE location parameter";

[0202] 7. After receiving the message, the security anchor function saves the HXRES* parameter and calculates RXRES* using HXRES* and RAND parameters. It then sends an authentication request message to the relay UE, carrying the authentication vector RE AV (RAND, AUTN, RXRES*).

[0203] 8. The relay UE receives the message and sends an authentication request message to the remote UE, which carries parameters such as RAND and AUTN.

[0204] 9. After receiving the authentication request message, the remote UE verifies AUTN according to the method defined by 3GPP, completes the authentication of the network, and calculates CK, IK, RES, and calculates RES*, K AUSF and K SEAF , and sends an authentication response message to the relay UE, which carries RES*;

[0205] 10. After receiving the response message, the relay UE calculates RRES* and compares it with RXRES*. If the two are consistent, the relay UE considers the authentication successful and sends an authentication response message to the security anchor function, which carries RES*.

[0206] 11. After receiving the authentication response message, the security anchor function uses RES* and RAND to calculate HRES* and compares it with HXRES*. If the two are consistent, the security anchor function considers the authentication successful and sends an authentication request message to the authentication service function, carrying RES*.

[0207] 12. After receiving the message, the authentication service function compares RES* with XRES*. If the two are consistent, the authentication service function considers the authentication successful and sends an authentication response message to the security anchor function. The message contains K SEAF ;

[0208] 13. After receiving the message, the security anchor function sends an authentication success message to the relevant network element of the core network. After the relevant network element of the core network completes the relevant registration process, it sends a registration response message to the relay UE, indicating that the registration authentication is successful.

[0209] 14. After receiving the message, the relay UE sends a registration response message to the remote UE and assists the remote UE in completing subsequent business processes such as user plane connection establishment, thereby completing network authentication between the remote UE and the relay UE and between the remote UE and the core network.

[0210] In this embodiment, the relay UE participates in the two-way authentication between the remote UE and the core network, thereby completing the authentication between the remote UE and the relay UE and the authentication between the relay UE and the network in the same authentication process. Compared with the existing technology that adopts an additional mechanism different from the cellular network access authentication and independently authenticates its process, the network verification method of the present application can effectively reduce the system complexity and improve the efficiency of network authentication.

[0211] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0212] In one embodiment, as shown in FIG12 , a network authentication apparatus is provided, which is applied to a core network. The core network includes a first network device and a second network device. The apparatus may be a software module or a hardware module, or a combination of the two, to form a part of the communication device. The apparatus specifically includes: a verification module 1202 and a response module 1204, wherein:

[0213] Verification module 1202 is configured to cause the first network device to generate, in response to receiving a target registration request sent by the relay device, an authentication request based on the user device identifier and the relay device identifier carried in the target registration request, and send the authentication request to the second network device; the second network device to obtain corresponding contract information based on the user device identifier in the received authentication request, determine a corresponding authentication protocol based on the contract information, generate an authentication parameter response based on the authentication protocol, and send the response to the first network device;

[0214] Response module 1204 is used for the first network device to determine the target authentication parameters from the authentication parameter response, and based on the target authentication parameters, generate authentication intermediate data, and send it to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and based on the initial authentication response fed back by the user device based on the target reference authentication data, generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network; receives the target authentication response fed back by the relay device, authenticates the user device and the relay device according to the response parameters corresponding to the target authentication response, and sends the authentication result to the relay device.

[0215] In one embodiment, the second network device includes a first functional device and a second functional device, and the verification module 1202 is also used for the first functional device to receive an authentication request and forward the authentication request to the second functional device; the second functional device obtains the corresponding contract information based on the user device identifier in the authentication request, and determines the corresponding authentication protocol based on the contract information, and generates a first authentication vector through a preset algorithm according to the authentication protocol; the second functional device sends the first authentication vector to the first functional device; the first functional device determines the expected response parameter from the first authentication vector, and obtains a hash value of the expected response by fusing the expected response parameter with a random number, and constructs a second authentication vector based on the hash value; generates an authentication parameter response based on the second authentication vector, and sends it to the first network device.

[0216] In one embodiment, the authentication request includes a device location parameter corresponding to the relay device and a location network identifier corresponding to the relay device. The verification module 1202 is further used to obtain a network location parameter based on a logical operation of the device location parameter and the location network identifier; and construct a first authentication vector based on the network location parameter.

[0217] In one embodiment, the authentication request includes a device location parameter corresponding to the relay device and a location network identifier corresponding to the relay device. The verification module 1202 is further used to obtain a network location parameter based on a logical operation of the device location parameter and the location network identifier; and to construct a second authentication vector based on the hash value and the network location parameter.

[0218] In one embodiment, the response module 1204 is also used by the first network device to send a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction; determines the relay service authority of the relay device based on the query result; and rejects the target registration request when the relay service authority is no authority.

[0219] The above-mentioned network authentication device, through the first network device, responds to the target registration request sent by the receiving relay device, generates an authentication request based on the user device identifier and the relay device identifier carried in the target registration request, and sends it to the second network device. The second network device obtains the corresponding contract information according to the user device identifier in the received authentication request, and determines the corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends it to the first network device. The first network device determines the target authentication parameter from the authentication parameter response, and generates authentication intermediate data based on the target authentication parameter, and sends it to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates the corresponding target reference authentication data, and generates the target authentication response based on the initial authentication response fed back by the receiving user device based on the target reference authentication data, and generates the target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network, receives the target authentication response fed back by the relay device, authenticates the user device and the relay device according to the response parameters corresponding to the target authentication response, and sends the authentication result to the relay device. This enables the authentication between the user device and the relay device, as well as the authentication between the relay device and the network to be completed in the same authentication process. Compared with the existing technology that uses an additional mechanism different from the cellular network access authentication and independently authenticates the processes, the network verification method of the present application can effectively reduce the system complexity and improve the efficiency of network authentication.

[0220] The specific definition of the network authentication device can be found in the definition of the network authentication method above and will not be repeated here. Each module in the aforementioned network authentication device may be implemented in whole or in part through software, hardware, or a combination thereof. Each of these modules may be embedded in or independent of a processor within a communication device in hardware form, or may be stored in a memory within the communication device in software form, allowing the processor to call and execute the corresponding operations of each module.

[0221] In one embodiment, as shown in FIG13 , a network authentication device is provided for use in a relay device. The device may be a software module or a hardware module, or a combination of the two, to form a part of a communication device. The device specifically includes: a transceiver module 1302, a verification module 1304, and an authentication module 1306, wherein:

[0222] The transceiver module 1302 is configured to receive an initial registration request sent by a user equipment, the initial registration request including a user equipment identifier of the user equipment; generate a target registration request based on the initial registration request, the target registration request including the user equipment identifier and a relay device identifier of the relay device; and send the target registration request to the core network, so that the core network determines a target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data using the user equipment identifier and the relay device identifier according to the target authentication protocol.

[0223] Verification module 1304 is configured to receive intermediate authentication data fed back by the core network, generate corresponding target reference authentication data based on target reference data selected from the intermediate authentication data, and send the target reference authentication data to the user equipment; receive an initial authentication response fed back by the user equipment based on the target reference authentication data, generate a target authentication response based on response parameters corresponding to the initial authentication response, and send the target authentication response to the core network, so that the core network generates corresponding response parameters based on the target authentication response, authenticates the user equipment and the relay device based on the response parameters and the target parameters in the intermediate authentication data, and feeds back the authentication result to the relay device;

[0224] The authentication module 1306 is configured to send the authentication result fed back by the core network to the user equipment, thereby completing network authentication between the user equipment and the relay device and between the user equipment and the core network.

[0225] In one embodiment, the target reference data includes random parameters and authentication token parameters; the verification module 1304 is also used to generate corresponding target reference authentication data based on the random parameters and the authentication token parameters; the target reference authentication data is sent to the user device so that the user device verifies the authentication token parameters carried in the target reference authentication data according to the 3GPP standard rules, and generates an initial authentication response based on the verification result, and feeds it back to the relay device.

[0226] In one embodiment, the verification module 1304 is also used to calculate the response parameter and the random number through a hash function to obtain a response intermediate parameter; obtain the verification parameter based on the intermediate parameter and the random number through a hash function calculation; compare the verification parameter with the target verification parameter corresponding to the authentication intermediate data, and generate a target authentication response based on the response parameter and the comparison result; and send the target authentication response to the core network.

[0227] The specific definition of the network authentication device can be found in the definition of the network authentication method above and will not be repeated here. Each module in the aforementioned network authentication device may be implemented in whole or in part through software, hardware, or a combination thereof. Each of these modules may be embedded in or independent of a processor within a communication device in hardware form, or may be stored in a memory within the communication device in software form, allowing the processor to call and execute the corresponding operations of each module.

[0228] In one embodiment, a communication device is provided, which may be a server, and its internal structure diagram may be as shown in FIG14 . The communication device includes a processor, a memory, and a network interface connected via a system bus. The processor of the communication device is used to provide computing and control capabilities. The memory of the communication device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the communication device is used to store user device contract information data. The network interface of the communication device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a network authentication method is implemented.

[0229] In one embodiment, a communication device is provided, which may be a terminal, and its internal structure diagram may be shown in Figure 15. The communication device includes a processor, memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of the communication device is used to provide computing and control capabilities. The memory of the communication device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The communication interface of the communication device is used to communicate with an external terminal in a wired or wireless manner. The wireless manner may be achieved through WiFi, a mobile cellular network, NFC (near field communication), or other technologies. When the computer program is executed by the processor, a network authentication method is implemented. The display screen of the communication device may be a liquid crystal display or an electronic ink display screen. The input device of the communication device may be a touch layer covering the display screen, or may be a key, trackball, or touchpad provided on the communication device housing, or may be an external keyboard, touchpad, or mouse.

[0230] Those skilled in the art will understand that the structures shown in Figures 14 and 15 are merely block diagrams of partial structures related to the scheme of the present application, and do not constitute a limitation on the communication equipment to which the scheme of the present application is applied. The specific communication equipment may include more or fewer components than shown in the figures, or combine certain components, or have a different arrangement of components.

[0231] In one embodiment, a communication device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0232] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0233] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0234] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0235] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0236] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A network authentication method, applied to a core network, wherein the core network includes a first network device and a second network device, and the method includes: The first network device generates an authentication request based on the user equipment identifier and the relay equipment identifier carried in the target registration request in response to receiving the target registration request sent by the relay device, and sends the authentication request to the second network device; The second network device obtains corresponding contract information according to the user equipment identifier in the received authentication request, determines a corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends the response to the first network device; The first network device determines the target authentication parameter from the authentication parameter response, generates authentication intermediate data based on the target authentication parameter, and sends the target authentication data to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates the corresponding target reference authentication data, and generates the target authentication response based on the initial authentication response fed back by the receiving user equipment based on the target reference authentication data and according to the response parameter corresponding to the initial authentication response, and sends the target authentication response to the core network; as well as Receive the target authentication response fed back by the relay device, authenticate the user equipment and the relay device according to the response parameters corresponding to the target authentication response, and send the authentication result to the relay device.

2. The method according to claim 1, wherein: The second network device includes a first functional device and a second functional device; the second network device obtains corresponding contract information according to the user equipment identifier in the received authentication request, determines a corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends it to the first network device, including: The first functional device receives the authentication request and forwards the authentication request to the second functional device; The second functional device obtains corresponding contract information according to the user equipment identifier in the authentication request, determines a corresponding authentication protocol according to the contract information, and generates a first authentication vector according to the authentication protocol by using a preset algorithm; The second functional device sends the first authentication vector to the first functional device; The first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response based on the expected response parameter and a random number, and constructs a second authentication vector based on the hash value; and An authentication parameter response is generated according to the second authentication vector, and sent to the first network device.

3. The method according to claim 2, wherein: The authentication request includes a device location parameter corresponding to the relay device and a location network identifier corresponding to the relay device; the second functional device obtains corresponding contract information according to the user device identifier in the authentication request, determines a corresponding authentication protocol according to the contract information, and generates a first authentication vector according to the authentication protocol by a preset algorithm, including: Obtaining a network location parameter according to a logical operation of the device location parameter and the location network identifier; and Based on the network location parameter, a first authentication vector is constructed.

4. The method according to claim 3, wherein: The first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response according to the expected response parameter and a random number, and constructs a second authentication vector based on the hash value, including: A second authentication vector is constructed based on the hash value and the network location parameter.

5. The method according to claim 1, wherein: The method further comprises: The first network device sends a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction; Determining the relay service authority of the relay device according to the query result; and When the relay service authority is no authority, the target registration request is rejected.

6. A network authentication method, applied to a first network device of a core network, wherein the core network further includes a second network device, the method comprising: In response to receiving a target registration request sent by the relay device, generating an authentication request based on the user equipment identifier and the relay equipment identifier carried in the target registration request, and sending the authentication request to the second network device; receiving an authentication parameter response sent by the second network device, and determining a target authentication parameter from the authentication parameter response; Based on the target authentication parameters, authentication intermediate data is generated and sent to the relay device, so that the relay device selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and receives the initial authentication response fed back by the user device based on the target reference authentication data, and generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network.

7. The method according to claim 6, further comprising: Sending a query instruction to the second network device, so that the second network device queries the contract information corresponding to the relay device identifier in the target registration request according to the query instruction; Determining the relay service authority of the relay device according to the query result; as well as When the relay service authority is no authority, the target registration request is rejected.

8. A network authentication method, applied to a second network device of a core network, wherein the core network also includes a first network device, the method comprising: Receiving an authentication request sent by the first network device; According to the user equipment identifier in the authentication request, the corresponding contract information is obtained, and the corresponding authentication protocol is determined according to the contract information, and an authentication parameter response is generated according to the authentication protocol and sent to the first network device.

9. The method according to claim 8, wherein the second network device includes a first functional device and a second functional device; the acquiring corresponding contract information according to the user equipment identifier in the authentication request, determining a corresponding authentication protocol according to the contract information, generating an authentication parameter response according to the authentication protocol, and sending the response to the first network device, comprises: The first functional device receives the authentication request and forwards the authentication request to the second functional device; The second functional device obtains corresponding contract information according to the user equipment identifier in the authentication request, determines a corresponding authentication protocol according to the contract information, and generates a first authentication vector according to the authentication protocol by using a preset algorithm; The second functional device sends the first authentication vector to the first functional device; The first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response based on the expected response parameter and a random number, and constructs a second authentication vector based on the hash value; and An authentication parameter response is generated according to the second authentication vector, and sent to the first network device.

10. The method according to claim 9, wherein: The authentication request includes a device location parameter corresponding to the relay device and a location network identifier corresponding to the relay device; the second functional device obtains corresponding contract information according to the user device identifier in the authentication request, determines a corresponding authentication protocol according to the contract information, and generates a first authentication vector according to the authentication protocol by a preset algorithm, including: Obtaining a network location parameter according to a logical operation of the device location parameter and the location network identifier; and Based on the network location parameter, a first authentication vector is constructed.

11. The method according to claim 10, wherein: The first functional device determines an expected response parameter from the first authentication vector, obtains a hash value of the expected response according to the expected response parameter and a random number, and constructs a second authentication vector based on the hash value, including: A second authentication vector is constructed based on the hash value and the network location parameter.

12. A network authentication method, wherein: Applied to a relay device, the method comprises: Receiving an initial registration request sent by a user equipment, wherein the initial registration request includes a user equipment identifier of the user equipment; Generate a target registration request based on the initial registration request, the target registration request including the user equipment identifier and the relay device identifier of the relay device; Sending the target registration request to the core network, so that the core network determines the target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data according to the target authentication protocol through the user equipment identifier and the relay device identifier; receiving the authentication intermediate data fed back by the core network, generating corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and sending the target reference authentication data to the user equipment; receiving an initial authentication response fed back by the user equipment based on the target reference authentication data, generating a target authentication response according to a response parameter corresponding to the initial authentication response, and sending the target authentication response to the core network, so that the core network generates a corresponding response parameter according to the target authentication response, authenticates the user equipment and the relay device based on the response parameter and the target parameter in the authentication intermediate data, and feeds back an authentication result to the relay device; and The authentication result fed back by the core network is sent to the user equipment, so as to complete the network authentication between the user equipment and the relay device and between the user equipment and the core network.

13. The method according to claim 12, wherein: The target reference data includes a random parameter and an authentication token parameter; the receiving the authentication intermediate data fed back by the core network, generating corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and sending the target reference authentication data to the user equipment, including: generating corresponding target reference authentication data based on the random parameter and the authentication token parameter; and The target reference authentication data is sent to the user equipment so that the user equipment verifies the authentication token parameters carried in the target reference authentication data according to the 3GPP standard rules, generates an initial authentication response according to the verification result, and feeds it back to the relay device.

14. The method according to claim 12, wherein: The receiving an initial authentication response fed back by the user equipment based on the target reference authentication data, generating a target authentication response according to a response parameter corresponding to the initial authentication response, and sending the target authentication response to the core network, including: The response parameter and the random number are calculated by a hash function to obtain a response intermediate parameter; Obtaining a verification parameter by calculating the intermediate parameter and the random number through a hash function; Comparing the verification parameter with a target verification parameter corresponding to the authentication intermediate data, and generating a target authentication response based on a response parameter and the comparison result; and The target authentication response is sent to the core network.

15. A network authentication device, applied to a core network, the core network comprising a first network device and a second network device, the device comprising: A verification module, configured for the first network device to generate an authentication request based on the user equipment identifier and the relay equipment identifier carried in the target registration request in response to receiving the target registration request sent by the relay equipment, and send the authentication request to the second network device; The second network device obtains corresponding contract information according to the user equipment identifier in the received authentication request, determines a corresponding authentication protocol according to the contract information, generates an authentication parameter response according to the authentication protocol, and sends the response to the first network device; as well as A response module, used for the first network device to determine the target authentication parameter from the authentication parameter response, and based on the target authentication parameter, generate authentication intermediate data, and send it to the relay device, so that the relay device selects the target reference data from the authentication intermediate data, generates the corresponding target reference authentication data, and based on the initial authentication response fed back by the receiving user equipment based on the target reference authentication data, generates the target authentication response according to the response parameter corresponding to the initial authentication response, and sends it to the core network; Receive the target authentication response fed back by the relay device, authenticate the user equipment and the relay device according to the response parameters corresponding to the target authentication response, and send the authentication result to the relay device.

16. A network authentication device, applied to a first network device of a core network, wherein the core network further includes a second network device, the device comprising: a verification module, configured to generate an authentication request based on the user equipment identifier and the relay equipment identifier carried in the target registration request in response to receiving the target registration request sent by the relay equipment, and send the authentication request to the second network equipment; as well as A response module, configured to receive an authentication parameter response sent by the second network device; determining a target authentication parameter from the authentication parameter response; Based on the target authentication parameters, authentication intermediate data is generated and sent to the relay device, so that the relay device selects target reference data from the authentication intermediate data, generates corresponding target reference authentication data, and receives the initial authentication response fed back by the user device based on the target reference authentication data, and generates a target authentication response according to the response parameters corresponding to the initial authentication response, and sends it to the core network.

17. A network authentication device, applied to a second network device of a core network, wherein the core network further includes a first network device, the device comprising: A verification module, configured to receive an authentication request sent by the first network device; According to the user equipment identifier in the authentication request, the corresponding contract information is obtained, and the corresponding authentication protocol is determined according to the contract information, and an authentication parameter response is generated according to the authentication protocol and sent to the first network device.

18. A network authentication device, applied to a relay device, comprising: a transceiver module, configured to receive an initial registration request sent by a user equipment, wherein the initial registration request includes a user equipment identifier of the user equipment; Generate a target registration request based on the initial registration request, the target registration request including the user equipment identifier and the relay device identifier of the relay device; send the target registration request to the core network, so that the core network determines the target authentication protocol based on the contract information corresponding to the user equipment identifier, and generates corresponding authentication intermediate data according to the target authentication protocol through the user equipment identifier and the relay device identifier; A verification module, configured to receive the authentication intermediate data fed back by the core network, generate corresponding target reference authentication data based on the target reference data selected from the authentication intermediate data, and send the target reference authentication data to the user equipment; receiving an initial authentication response fed back by the user equipment based on the target reference authentication data, generating a target authentication response according to a response parameter corresponding to the initial authentication response, and sending the target authentication response to the core network, so that the core network generates a corresponding response parameter according to the target authentication response, authenticates the user equipment and the relay device based on the response parameter and the target parameter in the authentication intermediate data, and feeds back an authentication result to the relay device; as well as The authentication module is used to send the authentication result fed back by the core network to the user equipment, so as to complete the network authentication between the user equipment and the relay device and between the user equipment and the core network.

19. A communication device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 14 are implemented.

20. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 14 are implemented.

Images