Access method, communication device, and computer readable storage medium

Abstract

Embodiments of the present disclosure provide an access method, a communication device, and a computer readable storage medium. The access method comprises: receiving instruction information of a target transceiver node of a network, the instruction information being used for instructing a terminal to use a digital identity to request on a target time-frequency resource an access permission to the network; in response to the instruction information, sending first request information on the target time-frequency resource, the first request information comprising the digital identity of the terminal; receiving a network identity used for representing the access permission; and using the network identity to access the network.

Description

Access method, communication device, and computer-readable storage medium

[0001] This application claims priority to Chinese patent application No. 202310892575.8 filed on July 19, 2023, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present disclosure relates to the field of communication technologies, and in particular to an access method, a communication device, and a computer-readable storage medium. Background Art

[0003] In communications technology, terminals require authentication before accessing a network to obtain access rights. Currently, authentication is performed by encrypting transmitted information using a shared key between the terminal and the network. Both communicating parties then verify the encrypted information using the shared key.

[0004] Summary of the Invention

[0005] In one aspect, an access method is provided, applied to a terminal. The access method includes: receiving indication information from a target transceiver node of a network, the indication information being used to instruct the terminal to request network access permission on a target time-frequency resource using a digital identity; in response to the indication information, sending first request information on the target time-frequency resource, the first request information including the digital identity of the terminal; receiving a network identity representing the access permission; and accessing the network using the network identity.

[0006] In another aspect, an access method is provided, which is applied to a target transceiver node of a network. The access method includes: sending an indication message, the indication message being used to instruct a terminal to request network access permission on a target time-frequency resource using a digital identity; receiving a first request message from the terminal, and sending a second request message to a target authentication node of the network, the first request message and the second request message including the digital identity of the terminal; receiving a network identity sent by the target authentication node of the network to represent the access permission, and sending the network identity to the terminal.

[0007] In another aspect, an access method is provided, which is applied to a target authentication node of a network. The access method includes: receiving second request information sent by a target transceiver node of the network; and, if the second request information is verified, sending a network identity representing a terminal's request for network access permission to the target transceiver node of the network, so that the network identity representing the access permission is sent to the terminal via the target transceiver node of the network.

[0008] In another aspect, a communications device is provided, comprising: a receiving module, a sending module, and an access module. The receiving module is configured to receive indication information from a target transceiver node of a network; the indication information instructs a terminal to request network access rights on target time-frequency resources using a digital identity. The sending module is configured to, in response to the indication information, send a first request information on the target time-frequency resources; the first request information includes the digital identity of the terminal. The receiving module is further configured to receive a network identity representing access rights. The access module is configured to access the network using the network identity.

[0009] In another aspect, a communication device is provided, comprising: a sending module and a receiving module. The sending module is configured to send an instruction message instructing a terminal to request network access rights on target time-frequency resources using a digital identity. The receiving module is configured to receive a first request message from the terminal and send a second request message to a target authentication node of the network; the first and second request messages include the digital identity of the terminal. The receiving module is further configured to receive a network identity representing access rights, sent by the target authentication node of the network, and send the network identity to the terminal.

[0010] In another aspect, a communication device is provided, comprising: a receiving module and a sending module. The receiving module is configured to receive second request information sent by a target transceiver node of the network. The sending module is configured to, if the second request information is verified successfully, send a network identity representing a terminal's request for network access permission to the target transceiver node of the network, so that the network identity representing the access permission is sent to the terminal via the target transceiver node of the network.

[0011] On the other hand, a communication system is provided, which includes: a terminal, a target transceiver node of the network, and a target authentication node of the network. The target transceiver node of the network sends indication information to the terminal. In response to the indication information, the terminal sends a first request information on the target time-frequency resource, and the first request information includes the digital identity of the terminal. After receiving the first request information of the terminal, the target transceiver node of the network sends a second request message to the target authentication node of the network, and the first request information and the second request information include the digital identity of the terminal. If the second request message is verified, the target authentication node of the network sends a network identity used to represent the terminal's request for network access rights to the target transceiver node of the network, and then sends the network identity used to represent the access rights to the terminal through the target transceiver node of the network. After receiving the network identity, the terminal uses the network identity to access the network.

[0012] In another aspect, a communication device is provided, comprising: a memory and a processor. The memory and the processor are coupled; the memory is used to store a computer program; and the processor implements the access method described in any one of the above aspects when executing the computer program.

[0013] On the other hand, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the access method described in any one of the above aspects is implemented.

[0014] On the other hand, a computer program product is provided, which includes computer program instructions, and when the computer program instructions are executed by a processor, the access method described in any one of the above aspects is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present disclosure, the following briefly introduces the drawings required for use in some embodiments of the present disclosure. Obviously, the drawings described below are only drawings of some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0016] FIG1 is a schematic structural diagram of a communication system according to some embodiments of the present disclosure.

[0017] FIG2 is a flowchart of an access method according to some embodiments of the present disclosure.

[0018] FIG3 is a flowchart of another access method according to some embodiments of the present disclosure.

[0019] FIG4 is a flowchart of another access method according to some embodiments of the present disclosure.

[0020] FIG5 is a flowchart of another access method according to some embodiments of the present disclosure.

[0021] FIG6 is an interactive diagram of a communication method according to some embodiments of the present disclosure.

[0022] FIG7 is a schematic diagram of the structure of a communication device according to some embodiments of the present disclosure.

[0023] FIG8 is a schematic diagram illustrating the structure of another communication device according to some embodiments of the present disclosure.

[0024] FIG9 is a schematic diagram of the structure of yet another communication device according to some embodiments of the present disclosure.

[0025] FIG10 is a schematic diagram of the structure of yet another communication device according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0026] To help those skilled in the art better understand the technical solutions of the embodiments of the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the drawings in the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, not all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0027] It should be noted that in this disclosure, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this disclosure as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0028] In the following, the terms "first," "second," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the quantity of the technical features indicated. Therefore, a feature specified as "first," "second," etc. may explicitly or implicitly include one or more of the features.

[0029] In the description of this disclosure, unless otherwise specified, " / " means "or." For example, A / B can mean A or B. "And / or" in this document is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: only A, only B, and A and B. Furthermore, "at least one" means one or more, and "a plurality" means two or more.

[0030] When a user-side terminal initially accesses a network, it must undergo authentication to obtain access rights. Currently, the authentication process involves encrypting certain specific and random information using a shared peer key between the user-side terminal and the network. The user-side terminal and the network then verify that the encrypted content is encrypted using the shared peer key, thereby proving the identities of both parties. In some technologies, fifth-generation mobile communication technology authentication and key agreement (5G AKA) authentication involves traditional peer key verification and digital certificate verification. Both authentication processes are ultimately completed through encryption and decryption of the subscriber identification module (SIM) card. This method requires the user-side terminal to obtain an access credential (SIM card) offline, which contains, among other things, the peer key required for network access authentication. This peer key authentication method is relatively limited in functionality; a peer key can only be used for one authentication interface (i.e., between a pair of communication nodes). In real-world scenarios, terminals typically need to access different network nodes, requiring them to store multiple identity credentials (peer keys), significantly increasing the likelihood of identity credential leakage.

[0031] In addition, the terminal can also access the network through a digital certificate. The basic steps of authentication in this method are similar to those of a SIM card. The user obtains a digital certificate with network access authority in advance and provides the digital certificate to the network side when accessing the network. The network side verifies that the digital certificate is legitimate, and the user can access the network.

[0032] As can be seen, both methods require a credential (the aforementioned peer key or digital certificate) to be pre-installed on the physical device. Furthermore, the credential is single-purpose and can only be used on a single authentication interface (i.e., between a pair of communication nodes). In real-world scenarios, terminals typically need to access different network nodes, meaning users need to maintain multiple credentials to meet daily needs. This increases device performance requirements and makes it more difficult to prevent credential leaks.

[0033] On the one hand, the unified data management (UDM) network element needs to serve millions of users, which can easily cause pipeline congestion and increased latency during peak hours. If the authentication process is delayed too long, the entire process must be restarted. If the UDM fails, the entire network will be paralyzed. On the other hand, both peer-to-peer keys and digital certificates require physical storage offline, and users need to maintain multiple keys or digital certificates for various application scenarios. In summary, there is an urgent need for a method that can achieve multi-party network access authentication based on a single identity.

[0034] Based on this, an embodiment of the present disclosure provides an access method in which, after receiving indication information from a target transceiver node on the network, a terminal sends a first request message including a digital identity to obtain a network identity representing access rights, and then uses this network identity to access the network. Because the digital identity is authenticated by an authoritative organization and serves as the user's personal identification document, it ensures that the digital identity can be traced back to the individual. In this way, the terminal only needs to use one digital identity, and different nodes in the network can authenticate the terminal based on the digital identity. This eliminates the need for the terminal to store multiple credentials, effectively reducing the possibility of key leakage.

[0035] Figure 1 is a schematic diagram of the structure of a communication system according to an embodiment of the present disclosure. As shown in Figure 1, the communication system includes a terminal, a transceiver node (also called a base station), and an authentication node. The transceiver node and the authentication node belong to the same public land mobile network (PLMN). For ease of description, they are hereinafter referred to as belonging to the same network. The transceiver node and the terminal can be connected via a wireless network, and the transceiver node and the authentication node can be connected via a wired network. The wireless network can be supported by a router, a switch, or other device that facilitates communication between the base station and the terminal, which is not limited by the embodiments of the present disclosure.

[0036] In some embodiments, a base station is used to provide wireless access services to terminals. For example, a base station provides a service coverage area (also known as a cell). Terminals within this area can communicate with the base station via wireless signals to receive the wireless access services provided by the base station. Furthermore, the base station's service coverage area can be divided into near-field and far-field areas. Terminals may be within the near-field or far-field area.

[0037] In some embodiments, a base station may be a millimeter wave base station, an evolution nodeB (eNB), a next generation nodeB (gNB), a transmission and receiving point (TRP), a transmission point (TP), or some other access node. Depending on the size of the service coverage area provided, a base station can be divided into a macro base station for providing macro cells, a micro base station for providing pico cells, and a femto base station for providing femto cells. As wireless communication technology continues to evolve, future base stations may also adopt other names.

[0038] In some embodiments, the authentication node may be an authentication service function (AUSF) network element. The AUSF network element is configured to receive an identity verification request from a terminal and perform authentication.

[0039] In some embodiments, in the communication system shown in Figure 1, the network may further include an access and mobility management function (AMF) network element (not shown in the figure). The AMF network element is connected to the base station on one side and to the AUSF network element on the other side. The AMF network element is used to obtain a terminal identity authentication request sent by the base station and forward the request to the AUSF network element for terminal identity authentication.

[0040] In some embodiments, the terminal may be a device with wireless transceiver capabilities, such as a mobile phone, a tablet computer, a wearable device, an in-vehicle device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiments of the present disclosure do not limit the type of terminal.

[0041] It should be understood that Figure 1 is an exemplary structural diagram, and the number of devices included in the communication system shown in Figure 1 is not limited, for example, the number of base stations is not limited, and the number of terminals is not limited. Furthermore, in addition to the devices shown in Figure 1, the communication system shown in Figure 1 may also include other devices, which is not limited.

[0042] Figure 2 is a flow chart of an access method according to an embodiment of the present disclosure. Exemplarily, the access method provided by the present disclosure can be applied to the communication system shown in Figure 1, for example, can be applied to the terminal in Figure 1.

[0043] As shown in FIG. 2 , the access method provided by the present disclosure may include, for example, the following S201 to S204 .

[0044] In S201, the terminal receives indication information of a target transceiver node in the network.

[0045] The indication information may also be referred to as access authority guidance (digital-id-access-guide) information, which is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resource.

[0046] Regarding S201, before the terminal first accesses the network, it does not have network access rights, so it needs to perform authentication to obtain network access rights. This access right can be, for example, a network identity (corresponding to applying for a new number in traditional solutions). In the disclosed embodiment, the terminal has a digital identity issued by a legitimate certification authority, which can be a digital certificate or a distributed digital identity (DID).

[0047] When network access is required, the terminal may receive instruction information from a transceiver node of the network, where the instruction information instructs the network to request network access authority on target time-frequency resources by using a digital identity.

[0048] In some embodiments, the above-mentioned indication information is carried in system information block (SIB) signaling. For example, when the terminal actively requests indication information, the indication information can be carried in the undefined SIB 20 signaling. For another example, when the base station actively broadcasts indication information, the indication information can be carried in SIB 1 signaling. In addition, the indication information can also be carried in newly defined broadcast information, which is independent of the access process of some technologies and is not limited in the embodiments of the present disclosure.

[0049] In S202, in response to the indication information, the terminal sends first request information on the target time-frequency resources.

[0050] The first request information includes the digital identity of the terminal.

[0051] For S202, after receiving the indication information sent by the transceiver node of the network, the terminal can respond to the indication information and send a first request information carrying the digital identity of the terminal on the target time-frequency resource indicated in the indication information to request access permission.

[0052] In some embodiments, the indication information includes first verification information (also referred to as digital-id-certification), which is used to verify the legitimacy of the digital identity of the terminal. The first request information also includes second verification information. The second verification information is the encrypted first verification information.

[0053] In some embodiments, the second verification information is the first verification information encrypted with a private key corresponding to the digital identity of the terminal.

[0054] In some embodiments, the first verification information may change over time to prevent the terminal reply information from being intercepted by unauthorized users, which may lead to authentication security risks.

[0055] In some embodiments, the indication information is further used to instruct the terminal to send relevant information for access (or called digital-id-access-requirement information), and the first request information also includes the relevant information.

[0056] The relevant information includes at least one of the following: the type of digital identity, the content of the digital identity, the information of the related blockchain of the digital identity, and the payment method of the fee. The type of the above-mentioned digital identity can be used to indicate whether the terminal sends a digital certificate or a DID. The content of the above-mentioned digital identity indicates the information that should be included in the digital identity, such as the identity identification of the terminal, etc. The information of the related blockchain of the above-mentioned digital identity can be used to indicate whether the digital identity has been uploaded to the blockchain, and if so, it also indicates the uploaded blockchain number. In addition, since the present disclosure uses a digital identity instead of a SIM card for authentication, the payment method of the call fee can be negotiated. The above-mentioned payment method can indicate payment by binding a blockchain account, or it can be paid by using other payment binding methods. In addition, the above-mentioned relevant information can also define the encryption type for subsequent encryption and decryption of the sent network identity.

[0057] It should be noted that if the payment method is not defined in the relevant information, a payment negotiation mechanism may be defined. The process of defining the payment negotiation mechanism may be performed in S202 or after the digital identity of the terminal is verified as follows.

[0058] In S203, the terminal receives a network identity representing access authority.

[0059] With respect to S203 , after sending the first request message, the terminal may receive a network identity (network-id) sent by a target authentication node from the network via a target transceiver node. The network identity represents the access authority.

[0060] In some embodiments, the received network identity is encrypted using the public key corresponding to the digital identity. Specifically, the target authentication node encrypts the network identity before sending it to the terminal. This prevents security risks caused by the network identity being intercepted by unauthorized users. Furthermore, the terminal can decrypt the received network identity using the private key corresponding to the digital identity to obtain the actual network identity for subsequent network access.

[0061] In other embodiments, the above-mentioned received network identity is a network identity encrypted by a preset encryption method. The preset encryption method can be the encryption type indicated in the relevant information in the above-mentioned S202, or it can be negotiated between the terminal and the target authentication node of the network after the following digital identity authentication is passed. The embodiments of the present disclosure are not limited to this.

[0062] In S204, the terminal accesses the network using the network identity.

[0063] In some embodiments, as shown in FIG3 , the above S204 may be implemented as follows: S2041 and S2042 .

[0064] In S2041 , the terminal verifies the legitimacy of the network identity.

[0065] In S2042, if the verification is legal, the terminal accesses the network using the network identity.

[0066] It should be understood that base stations can be illegally occupied. Therefore, the network identity obtained by the terminal through the target transceiver node may be a false network identity sent by the target transceiver node, which has been illegally occupied. If the terminal accesses the network without verifying the legitimacy of the network identity, it will create a significant security vulnerability. Therefore, after receiving the network identity, the terminal can further verify the legitimacy of the network identity through the following two implementation methods. If the network identity is verified to be legitimate, it will use this network identity to access the network.

[0067] In one implementation, the terminal can verify the legitimacy of the network identity based on the target legitimate terminal. The target legitimate terminal is a terminal that has been verified by the target authentication node and is managed by other transceiver nodes in the network except the target transceiver node. The target authentication node is the node that issues the network identity in the network. In other words, the terminal can grant the network identity to the same authentication node (i.e., the above-mentioned target authentication node), but send authentication verification information to other terminals that access the network through different base stations. The legitimacy of the network identity is determined by judging whether these terminals have received the authentication verification information. For example, by receiving the response information fed back by the above-mentioned other terminals, it can be determined that the other terminals have received the authentication verification information.

[0068] In another implementation, if the target authentication node in the network possesses a digital identity, the terminal verifies the legitimacy of its network identity through the target authentication node's digital identity. For example, the terminal can send verification information to the target authentication node via the target transceiver node. The target authentication node encrypts the verification information using the private key corresponding to its own digital identity and then sends it back to the terminal. The terminal then obtains the public key of the granting authority, decrypts the target authentication node's digital identity, and obtains the public key corresponding to the target authentication node's digital identity. The terminal then uses this public key to decrypt the verification information, determines whether the decrypted verification information is consistent with the original verification information, and thus determines the legitimacy of the network identity.

[0069] Figure 4 is a flow chart of another access method according to an embodiment of the present disclosure. Exemplarily, the access method provided by the present disclosure can be applied to the communication system shown in Figure 1 , for example, can be applied to the transceiver nodes of the network in Figure 1 .

[0070] As shown in FIG4 , the access method provided by the present disclosure may include, for example, the following S401 to S403 .

[0071] In S401, a target transceiver node of the network sends indication information.

[0072] The indication information is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resources.

[0073] For the above S401, the target transceiver node of the network can send indication information to the terminal after receiving the terminal's request to instruct the terminal to request access permission; or, the target transceiver node of the network can broadcast indication information to all terminals managed by itself to instruct the terminal with access demand to request access permission.

[0074] In S402, the target transceiver node of the network receives the first request information of the terminal, and sends the second request information to the target authentication node of the network.

[0075] The first request information and the second request information include the digital identity of the terminal.

[0076] Regarding S402 above, after receiving the indication information, the terminal may send a first request information to the target transceiver node of the network. The target transceiver node of the network obtains and processes the first request information, obtains a second request information, and sends the second request information to the target authentication node of the network through the AMF network element.

[0077] In some embodiments, the first request message includes, in addition to the digital identity of the terminal, second verification information. The second request message also includes, in addition to the digital identity of the terminal, first verification information and second verification information, where the second verification information (encrypted digital identity auxiliary verification digital-id-certification-encrypted) is the encrypted first verification information. The first and second verification information are used by the target authentication node of the network to verify the legitimacy of the terminal. That is, the target transceiver node of the network processes the first request message by adding the first verification information to the first request message to obtain the second request message.

[0078] In S403, the target transceiver node of the network receives the network identity for representing the access authority sent by the target authentication node of the network, and sends the network identity to the terminal.

[0079] For the above S403, after the network's transceiver node sends the second request information to the target authentication node under the same network, it can obtain the network identity issued by the target authentication node through the AMF network element, and further send the network identity representing the access authority to the terminal so that the terminal can subsequently access the network.

[0080] In some embodiments, the network identity is a network identity encrypted with a public key corresponding to the digital identity of the terminal to prevent the network identity from being intercepted during transmission, thereby preventing security issues such as information leakage.

[0081] Figure 5 is a flow chart of another access method according to an embodiment of the present disclosure. Exemplarily, the access method provided by the present disclosure can be applied to the communication system shown in Figure 1 , for example, can be applied to the target authentication node of the network in Figure 1 .

[0082] As shown in FIG5 , the access method provided by the present disclosure may include, for example, the following S501 and S502 .

[0083] In S501, a target authentication node of a network receives second request information sent by a target transceiver node of the network.

[0084] The second request information includes the digital identity of the terminal.

[0085] In S502, when the second request information is verified successfully, the target authentication node of the network sends a network identity used to represent the access authority to the terminal through the target transceiver node of the network.

[0086] Regarding S501 and S502 above, the target authentication node of the network may receive the second request information sent by the target transceiver node of the same network, and then perform verification based on the digital identity of the terminal included in the second request information. If the verification is successful, the target authentication node of the network determines that the terminal is legitimate, issues a network identity, and transmits the issued network identity to the terminal via the target transceiver node of the network. In addition, the target authentication node may also store the digital identity and network identity of the terminal accordingly.

[0087] In some embodiments, verifying the second request information includes the following two implementation methods.

[0088] In one implementation, the following verification process is used: a. Obtain the public key of the granting agency to which the digital identity belongs; b. Use the public key of the granting agency to decrypt the digital identity to obtain the public key of the digital identity; c. Use the public key of the digital identity to decrypt the second verification information to obtain the third verification information (digital-id-certification*); d. If the third verification information is consistent with the first verification information, determine that the second (access permission request) information verification is successful.

[0089] It should be understood that the digital identity is issued by a legitimate granting agency, and the digital identity includes a pair of public and private keys. The private key is stored on the terminal side and is not transmitted externally, and the public key can be notified to other nodes for auxiliary verification. The target authentication node can obtain the public key of the granting agency by accessing the blockchain (if the digital identity of the terminal has been uploaded to the blockchain) for verification. The public key of the granting agency can also be obtained from a preset storage space (such as a unified data management network element (UDM)) for verification. In this way, verification can not only verify whether the digital identity is legitimate, but also verify whether the digital identity belongs to the terminal.

[0090] Furthermore, the current verification process relies on obtaining peer keys from the UDM. This results in the UDM having to serve millions of users, which can easily lead to pipeline congestion and increased latency during peak periods. If the authentication process is delayed too long, the entire process must be restarted. If the UDM fails, the entire network will be paralyzed. The digital identity verification method used in this disclosure is independent of the UDM. Most nodes in the network can verify the legitimacy of the terminal, effectively improving the stability of the communication system.

[0091] In another implementation, the target authentication node can query whether the digital identity corresponds to a network identity. If so, the target authentication node determines that the second request information has been verified successfully, and then encrypts the corresponding network identity and sends it to the terminal. If not, the target authentication node can perform the verification process described in the above implementation.

[0092] It should be understood that if it is found that the terminal has applied for a network identity before, the target authentication node does not need to repeat the verification, thereby reducing the waste of computing resources of the target authentication node.

[0093] In some embodiments, the network identity can be composed of the target authentication node information (AUSF information) that grants the identity plus other information such as the blockchain node number. The target authentication node can use the network identity to record the terminal's corresponding phone charges, the package used, and other information.

[0094] In some embodiments, after generating a network identity, the target authentication node may communicate the network identity to other network nodes, allowing the terminal to subsequently directly access other nodes on the same network without having to generate a new network identity. For example, this may be done by uploading the network identity to a blockchain, which other network nodes can access and retrieve. Alternatively, the network identity may be broadcast to other network nodes for storage using a distributed storage approach, which is not limited in the present disclosure.

[0095] It should be understood that broadcasting the network identity to other network nodes can achieve multi-party access of the terminal, without the need for the terminal to re-verify when accessing other network nodes, effectively improving the network access efficiency of the terminal and thus improving the user experience.

[0096] In the access method provided in the embodiments of the present disclosure, after receiving an indication from the target transceiver node of the network, the terminal sends a first request message including a digital identity to obtain a network identity representing access rights, and then uses this network identity to access the network. Because the digital identity is authenticated by an authoritative organization and serves as the user's personal identification document, it can be traced back to the individual through the digital identity. This ensures that the terminal only needs to use a single digital identity, and different nodes in the network can authenticate the terminal based on the digital identity. This eliminates the need for the terminal to store multiple identity credentials, effectively reducing the possibility of identity credential leakage.

[0097] Furthermore, by using digital identity authentication, terminals can authenticate and access different network nodes. This not only avoids the risk of a single point of failure in traditional central node authentication, which can lead to network paralysis, but also avoids the waste of storage resources and security risks associated with terminals storing multiple credentials. Furthermore, terminals can authenticate the network identity issued by the network node to ensure the legitimacy of the network node they are accessing, further ensuring communication security.

[0098] Figure 6 is an interactive flow chart of an access method according to an embodiment of the present disclosure. The interactive process can be applied to a communication system, which includes a terminal, a base station (the target transceiver node of the above-mentioned network), an AMF network element, and an AUSF network element (the target authentication node of the above-mentioned network). First, the base station sends an indication message to the terminal, and the terminal generates a first request message carrying a digital identity and sends it to the base station. The base station further generates and sends a second request message based on the first request message, and then transmits the second request message to the AUSF network element through the AMF network element. The AUSF network element verifies whether the digital identity in the second request message is legal, generates a network identity after the verification is passed, and sends the network identity to the terminal through the AMF network element and the base station in turn. The terminal can further verify the legitimacy of the network identity, and then use the network identity to access the network.

[0099] It is understandable that, in order to realize the above functions, the communication device (which can be the above-mentioned terminal, the target transceiver node of the network or the target authentication node of the network) includes hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the algorithm steps of each example described in the embodiments of the present disclosure, the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present disclosure.

[0100] The embodiments of the present disclosure can divide the functional modules of the communication device according to the above-mentioned method embodiments. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one functional module. The above-mentioned integrated modules can be implemented in the form of hardware or software. It should be noted that the division of modules in the embodiments of the present disclosure is schematic and is only a logical functional division. In actual implementation, there may be other division methods. The following is an example of dividing each functional module corresponding to each function.

[0101] FIG7 is a schematic diagram of the structure of a communication device according to an embodiment of the present disclosure, which can execute the access method provided by the above method embodiment. As shown in FIG7 , the communication device includes: a receiving module 701 , a sending module 702 and an access module 703 .

[0102] The receiving module 701 is used to receive indication information of a target transceiver node of a base station network. The indication information is used to instruct a terminal to use a digital identity to request network access authority on a target time-frequency resource.

[0103] The sending module 702 is configured to send first request information on the target time-frequency resource in response to the instruction information. The first request information includes the digital identity of the terminal.

[0104] The receiving module 701 is further configured to receive a network identity used to represent access rights.

[0105] The access module 703 is used to access the network using a network identity.

[0106] In some embodiments, the instruction information includes first verification information. The first request information also includes second verification information; and the second verification information is the encrypted first verification information.

[0107] In some embodiments, the second verification information is the first verification information encrypted with a private key corresponding to the digital identity.

[0108] In some embodiments, the access module 703 is used to verify the validity of the network identity, and if the network identity is verified to be valid, the network is accessed using the network identity.

[0109] In some embodiments, access module 703 is configured to verify the legitimacy of the network identity based on a target legitimate terminal. A target legitimate terminal is a terminal that has been authenticated by a target authentication node and is managed by a transceiver node other than the target transceiver node in the network. The target authentication node is the node in the network that issues the network identity; alternatively, if the target authentication node in the network has a digital identity, the legitimacy of the network identity is verified by the digital identity of the target authentication node.

[0110] In some embodiments, the indication information is carried in system information block (SIB) signaling.

[0111] In some embodiments, the instruction information is further used to instruct the terminal to send relevant information for access. The first request information also includes relevant information.

[0112] In some embodiments, the relevant information includes at least one of the following: the type of digital identity, the content of the digital identity, information about the relevant blockchain of the digital identity, and the payment method.

[0113] In some embodiments, the received network identity is a network identity encrypted with a public key corresponding to the digital identity.

[0114] FIG8 is a schematic diagram of the structure of another communication device according to an embodiment of the present disclosure, which can execute the access method provided by the above method embodiment. As shown in FIG8 , the communication device includes: a sending module 801 and a receiving module 802.

[0115] The sending module 801 is used to send instruction information. The instruction information is used to instruct the terminal to use a digital identity to request network access authority on the target time-frequency resource.

[0116] The receiving module 802 is configured to receive a first request message from a terminal and send a second request message to a target authentication node of the network. The first request message and the second request message include a digital identity of the terminal.

[0117] The receiving module 802 is configured to receive a network identity sent by a target authentication node of the network for representing access authority, and send the network identity to the terminal.

[0118] In some embodiments, the indication information includes first verification information. The first request information also includes second verification information; the second verification information is the encrypted first verification information; and the second request information also includes the first verification information and the second verification information.

[0119] In some embodiments, the second verification information is the first verification information encrypted with a private key corresponding to the digital identity.

[0120] FIG9 is a schematic diagram of the structure of another communication device according to an embodiment of the present disclosure, which can execute the access method provided by the above method embodiment. As shown in FIG9 , the communication device includes: a receiving module 901 and a sending module 902.

[0121] The receiving module 901 is configured to receive a second request message sent by a target transceiver node of the network. The second request message includes a digital identity of the terminal.

[0122] The sending module 902 is configured to, when the second request information is verified to be successful, send a network identity representing access authority to the terminal via a target transceiver node of the network.

[0123] In some embodiments, the second request information further includes first verification information and second verification information; the second verification information is the encrypted first verification information.

[0124] In some embodiments, the second verification information is the first verification information encrypted with a private key corresponding to the digital identity.

[0125] In some embodiments, the apparatus further includes an acquisition module 903 and a processing module 904. The acquisition module 903 is configured to acquire a public key of the authority that grants the digital identity. The processing module 904 is configured to decrypt the second verification information using the public key of the digital identity to obtain third verification information; if the third verification information is consistent with the first verification information, determining that the second (access permission) request information has been verified.

[0126] An embodiment of the present disclosure also provides a communication system, which includes a terminal, a target transceiver node of the network, and a target authentication node of the network. The terminal is used to execute the methods described in S201 to S204 above, the target transceiver node of the network is used to execute the methods described in S401 to S403 above, and the target authentication node of the network is used to execute the methods described in S501 and S502 above.

[0127] In the case of implementing the functions of the above-mentioned integrated modules in hardware, the embodiments of the present disclosure also provide another structure of the communication device involved in the above-mentioned embodiments. As shown in Figure 10, the communication device 100 includes: a processor 1002 and a bus 1004. In some embodiments, the electronic device or communication device may also include a memory 1001. In some embodiments, the electronic device or communication device may also include a communication interface 1003.

[0128] The processor 1002 may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present disclosure. The processor 1002 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof, and may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present disclosure. The processor 1002 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP (Digital Signal Processor) and a microprocessor, and the like.

[0129] The communication interface 1003 is used to connect to other devices via a communication network, such as Ethernet, wireless access network, or wireless local area network (WLAN).

[0130] The memory 1001 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0131] As an implementation, the memory 1001 may exist independently of the processor 1002. The memory 1001 may be connected to the processor 1002 via a bus 1004 for storing instructions or program codes. When the processor 1002 calls and executes the instructions or program codes stored in the memory 1001, the access method provided in the embodiment of the present disclosure can be implemented.

[0132] In another implementation, the memory 1001 may also be integrated with the processor 1002 .

[0133] Bus 1004 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 1004 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG10 shows only one thick line, but this does not mean that there is only one bus or only one type of bus.

[0134] In some embodiments, the memory 1001 stores executable instructions. When the processor 1002 executes the executable instructions, the communication device executes the access method described in any of the above embodiments.

[0135] Some embodiments of the present disclosure also provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the access method described in any of the above embodiments.

[0136] Exemplarily, the above-mentioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memories (EPROMs), cards, sticks, or key drives, etc.). The various computer-readable storage media described in the present disclosure may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0137] The embodiments of the present disclosure further provide a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the access method described in any one of the above embodiments.

[0138] In the access method provided in the embodiments of the present disclosure, after receiving an indication from the target transceiver node of the network, the terminal sends a first request message including a digital identity to obtain a network identity representing access rights, and then uses this network identity to access the network. Because the digital identity is authenticated by an authoritative organization and serves as the user's personal identification document, it can be traced back to the individual through the digital identity. This ensures that the terminal only needs to use a single digital identity, and different nodes in the network can authenticate the terminal based on the digital identity. This eliminates the need for the terminal to store multiple identity credentials, effectively reducing the possibility of identity credential leakage.

[0139] The above is only a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or replacements within the technical scope disclosed in the present disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. An access method, applied to a terminal, comprising: receiving indication information of a target transceiver node of the network; The indication information is used to instruct the terminal to use a digital identity to request access authority to the network on the target time-frequency resource; In response to the indication information, sending first request information on the target time-frequency resource; the first request information includes the digital identity of the terminal; Receiving a network identity representing the access right; The network is accessed using the network identity.

2. The method according to claim 1, wherein: The indication information includes first verification information; the first request information also includes second verification information; the second verification information is the encrypted first verification information.

3. The method according to claim 2, wherein: The second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

4. The method according to claim 1, wherein: The using the network identity to access the network includes: Verify the legitimacy of the network identity; If the verification is legitimate, the network identity is used to access the network.

5. The method according to claim 4, wherein: The verifying the legitimacy of the network identity includes: Verifying the legitimacy of the network identity based on a target legitimate terminal, the target legitimate terminal is a terminal that has been verified by a target authentication node and is managed by other transceiver nodes in the network except the target transceiver node; the target authentication node is a node in the network that issues the network identity; or, In the case where the target authentication node of the network has a digital identity, the legitimacy of the network identity is verified by the digital identity of the target authentication node.

6. The method according to claim 1, wherein: The indication information is carried in the system information block SIB signaling.

7. The method according to claim 1, wherein: The indication information is also used to instruct the terminal to send relevant information for access; the first request information also includes the relevant information.

8. The method according to claim 7, wherein: The relevant information includes at least one of the following: the type of the digital identity, the content of the digital identity, the information of the blockchain related to the digital identity, and the payment method.

9. The method according to claim 1, wherein: The received network identity is a network identity encrypted by a public key corresponding to the digital identity.

10. An access method, applied to a target transceiver node of a network, comprising: Send instruction information; The indication information is used to instruct the terminal to use a digital identity to request access authority to the network on the target time-frequency resource; receiving first request information from the terminal, and sending second request information to a target authentication node of the network; The first request information and the second request information include a digital identity of the terminal; A network identity for representing the access authority sent by a target authentication node of the network is received, and the network identity is sent to the terminal.

11. The method according to claim 10, wherein: The indication information includes first verification information; the first request information also includes second verification information; the second verification information is the encrypted first verification information; the second request information also includes the first verification information and the second verification information.

12. The method according to claim 11, wherein: The second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

13. An access method, applied to a target authentication node of a network, comprising: Receiving second request information sent by a target transceiver node of the network; The second request information includes a digital identity of the terminal; When the second request information is verified successfully, the target authentication node of the network sends a network identity used to represent the access authority to the terminal through the target transceiver node of the network.

14. The method according to claim 13, wherein: The second request information also includes first verification information and second verification information; the second verification information is the encrypted first verification information.

15. The method according to claim 14, wherein: The second verification information is the first verification information encrypted by the private key corresponding to the digital identity.

16. The method according to claim 13, further comprising: Obtaining the public key of the authority that grants the digital identity; Decrypting the digital identity using the public key of the granting institution to obtain the public key of the digital identity; Decrypting the second verification information using the public key of the digital identity to obtain third verification information; When the third verification information is consistent with the first verification information, it is determined that the second request information has passed verification.

17. The method according to claim 13, further comprising: Query whether the digital identity has a corresponding network identity; If so, it is determined that the second request information is verified successfully.

18. The method according to claim 13, wherein: The network identity is a network identity encrypted by a public key corresponding to the digital identity.

19. A communication device, comprising: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instruction so that the communication device performs the access method according to any one of claims 1-18.

20. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a communication device, the communication device executes the access method according to any one of claims 1 to 18.

Images