Private network security authentication method, apparatus and system, and electronic device, storage medium and computer program product

Abstract

Provided in the present application are a private network security authentication method, apparatus and system, and an electronic device, a storage medium and a computer program product. The method comprises: an SIM card sending card information to a service system by means of a short message gateway; the service system returning user information to the SIM card; the first terminal sending an intranet application access request to a private network; a gateway device intercepting the intranet application access request, and redirecting an identity authentication link to the first terminal; the first terminal acquiring the user information of the SIM card and sending same to the service system by means of the gateway device; and the service system performing identity authentication on a user of the first terminal on the basis of the user information.

Description

Private network security authentication method, device and system, electronic device, storage medium and computer program product

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on the Chinese patent application with application number 202311113791.4 and application date of August 30, 2023, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby introduced into this application in its entirety. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a private network security authentication method, device and system, electronic equipment, storage medium and computer program product. Background Art

[0004] At present, operators generally adopt the core network user plane function (UPF) sinking model to build 5th Generation Mobile Communication Technology (5G) private networks for industry users. This model relies on the operator's core network and base stations, and terminal access is activated by the operator. However, for industry users, the completed 5G private network is equivalent to the enterprise intranet. Relying solely on the operator's one-time authentication in the 5G core network is not enough to meet the access security needs of industry users, especially in high-security scenarios for individual user access such as the party, government, military, public security, procuratorial, judicial, and financial sectors. Relying solely on operators for security access management is far from meeting the needs of industry users.

[0005] The current 5G private network construction plan relies on the operator's core network and base stations. Terminal access is activated by the operator, and data contracts are configured on the operator side. For industry users, it is impossible to independently manage users' access rights to business systems through the 5G private network.

[0006] Summary of the Invention

[0007] This application provides a private network security authentication method, device and system, electronic device, storage medium and computer program product. The technical solution of this application is as follows:

[0008] In a first aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a Subscriber Identity Module (SIM) card, comprising:

[0009] In response to triggering a card information reporting operation, sending a first data SMS to a business system via an SMS gateway, wherein the first data SMS includes the card information;

[0010] receiving a second data SMS message sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS message; wherein the user information includes a mobile phone number;

[0011] Receive a first instruction sent by the first terminal where the SIM card is located, and send the user information to the first terminal, so that the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information; wherein the first instruction instructs to obtain the user information.

[0012] In some implementations, before responding to triggering the card information reporting operation, the steps include:

[0013] Registering with the first terminal to monitor network access events;

[0014] An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

[0015] In some implementations, sending the first data SMS to the service system through the SMS gateway includes:

[0016] Reading card information and assembling the card information into a response data packet of the first data SMS;

[0017] A response data packet of the first data SMS is sent to the business system through the SMS gateway.

[0018] In some implementations, receiving a second data SMS message sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS message, includes:

[0019] receiving a second data SMS message sent by the business system and forwarded by the SMS gateway; wherein the second data SMS message includes an application command message, and the application command message includes the user information;

[0020] Decrypting the second data SMS message to obtain SMS content in the application command message;

[0021] Parse the text message content, obtain and store the user information.

[0022] In some implementations, sending the user information to the first terminal includes:

[0023] establishing a secure access channel with the first terminal;

[0024] Read user information; and encrypt the user information to obtain user information ciphertext;

[0025] The user information ciphertext is sent to the first terminal through the secure access channel.

[0026] In some implementations, the response data packet includes a card application major version number, a security parameter identifier, an application response data packet, and a Media Access Control (MAC) address; the application response data packet includes the card information; and the security parameter identifier includes an encryption identifier and an environment identifier.

[0027] In some implementations, storing the user information includes:

[0028] The user information is stored in the secure storage space of the SIM card.

[0029] In a second aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a first terminal, where the first terminal includes a SIM card; the method includes:

[0030] Sending an intranet application access request to a private network, wherein the intranet application access request indicates access to a business system;

[0031] receiving an identity authentication link redirected by a gateway device, and sending a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information, the user information being sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information including a mobile phone number;

[0032] Receive the user information sent by the SIM card, send first information to the service system through the gateway device, and request the service system to perform identity authentication on the first terminal user based on the user information in the first information.

[0033] In some implementations, before sending the intranet application access request to the private network, the process includes:

[0034] The first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

[0035] In some implementations, the method further includes:

[0036] Receive a registration request for monitoring network access events sent by the SIM card.

[0037] In a third aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a gateway device and includes:

[0038] Intercepting an intranet application access request sent by a first terminal to a private network, and redirecting an identity authentication link to the first terminal; wherein the first terminal includes a SIM card, and the intranet application access request indicates access to a business system;

[0039] Receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card. The user information includes a mobile phone number, and the user information is used by the first terminal to request the business system to perform identity authentication on the user of the first terminal.

[0040] In a fourth aspect, an embodiment of the present application provides a private network security authentication method, which is applied to a business system within a private network, including:

[0041] Receiving a first data SMS sent by the SIM card through the SMS gateway, wherein the first data SMS includes card information;

[0042] Based on the first data SMS, obtain the mobile phone number and the card information corresponding to the SIM card, and record the binding relationship between the card information and the mobile phone number;

[0043] Sending a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number;

[0044] Receive first information sent by the first terminal where the SIM card is located through a gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

[0045] In a fifth aspect, an embodiment of the present application provides a private network security authentication system, including a SIM card, a first terminal where the SIM card is located, a short message gateway, a gateway device, and a service system.

[0046] The SIM card is configured to execute the private network security authentication method described in the first aspect;

[0047] The first terminal where the SIM card is located is configured to execute the private network security authentication method described in the second aspect;

[0048] The gateway device is configured to execute the private network security authentication method according to the third aspect;

[0049] The business system is configured to execute the private network security authentication method described in the fourth aspect.

[0050] In a sixth aspect, an embodiment of the present application provides a private network security authentication device, which is configured on a SIM card and includes:

[0051] a card information reporting module configured to, in response to triggering a card information reporting operation, send a first data SMS to a business system via an SMS gateway, wherein the first data SMS includes card information;

[0052] The card information reporting module is further configured to receive a second data SMS sent by the business system through the SMS gateway, and obtain and store user information based on the second data SMS; wherein the user information includes a mobile phone number;

[0053] The first transceiver module is configured to receive a first instruction sent by the first terminal where the SIM card is located, and send the user information to the first terminal, so that the first terminal requests the business system to authenticate the identity of the first terminal user based on the user information; wherein the first instruction instructs to obtain the user information.

[0054] In some implementations, the card information reporting module is further configured to:

[0055] In response to triggering the card information reporting operation, registering with the first terminal to monitor network access events;

[0056] An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

[0057] In some implementations, the card information reporting module is configured to:

[0058] Reading card information and assembling the card information into a response data packet of the first data SMS;

[0059] A response data packet of the first data SMS is sent to the business system through the SMS gateway.

[0060] In some implementations, the card information reporting module is configured to:

[0061] receiving a second data SMS message sent by the business system and forwarded by the SMS gateway; wherein the second data SMS message includes an application command message, and the application command message includes the user information;

[0062] Decrypting the second data SMS message to obtain SMS content in the application command message;

[0063] Parse the text message content, obtain and store the user information.

[0064] In some implementations, the first transceiver module is configured to:

[0065] establishing a secure access channel with the first terminal;

[0066] Read user information; and encrypt the user information to obtain user information ciphertext;

[0067] The user information ciphertext is sent to the first terminal through the secure access channel.

[0068] In some implementations, the response data packet includes a card application major version number, a security parameter identifier, an application response data packet, and a MAC address; the application response data packet includes the card information; and the security parameter identifier includes an encryption identifier and an environment identifier.

[0069] In some implementations, the card information reporting module is configured to:

[0070] The user information is stored in the secure storage space of the SIM card.

[0071] In a seventh aspect, an embodiment of the present application provides a private network security authentication device, the device being configured in a first terminal, the first terminal including a SIM card, including:

[0072] A second transceiver module is configured to send an intranet application access request to the private network, wherein the intranet application access request indicates access to a business system;

[0073] The second transceiver module is further configured to receive an identity authentication link redirected by a gateway device, and send a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information, the user information being sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information including a mobile phone number;

[0074] The second transceiver module is further configured to receive the user information sent by the SIM card, send first information to the service system through the gateway device, and request the service system to perform identity authentication on the first terminal user based on the user information in the first information.

[0075] In some implementations, the second transceiver module is further configured to:

[0076] Before sending an intranet application access request to the private network, the first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

[0077] In some implementations, the second transceiver module is further configured to:

[0078] Receive a registration request for monitoring network access events sent by the SIM card.

[0079] In an eighth aspect, an embodiment of the present application provides a private network security authentication device, which is configured in a gateway device and includes:

[0080] an access gateway module configured to intercept an intranet application access request sent by a first terminal to a private network and redirect an identity authentication link to the first terminal; wherein the first terminal includes a SIM card, and the intranet application access request indicates access to a service system;

[0081] The control center module is configured to receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card. The user information includes a mobile phone number, and the user information is used by the first terminal to request the business system to authenticate the identity of the first terminal user.

[0082] In a ninth aspect, an embodiment of the present application provides a private network security authentication device, wherein the device is configured in a business system within the private network, including:

[0083] A third transceiver module is configured to receive a first data SMS sent by the SIM card through the SMS gateway, wherein the first data SMS includes card information;

[0084] a processing module configured to obtain the mobile phone number and the card information corresponding to the SIM card based on the first data SMS, and record the binding relationship between the card information and the mobile phone number;

[0085] The third transceiver module is further configured to send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number;

[0086] The identity authentication module is configured to receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

[0087] In the tenth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the private network security authentication method described in any one of the embodiments of the first to fourth aspects of the present application.

[0088] In the eleventh aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are configured to enable the computer to execute the private network security authentication method described in any one of the embodiments of the first to fourth aspects of the present application.

[0089] In the twelfth aspect, an embodiment of the present application provides a computer program product, including computer instructions, which, when executed by a processor, implement the private network security authentication method described in any one of the embodiments of the first to fourth aspects of the present application.

[0090] The technical solutions provided by the embodiments of the present application bring at least the following beneficial effects:

[0091] The SIM card reports card information to the service system within the private network, and the user information returned by the service system is stored on the SIM card. When the first terminal containing the SIM card requests access to the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored on the SIM card to the service system for identity authentication. This enables the private network user to independently manage the access rights of users to the service system through the private network, and implements identity authentication control on the private network enterprise side.

[0092] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application, and do not constitute an improper limitation on the present application.

[0094] FIG1 is a flow chart showing a method for secure authentication of a private network according to an exemplary embodiment.

[0095] FIG2 is a schematic diagram showing the structure of a first data SMS according to an example.

[0096] FIG3 is a schematic diagram showing the structure of a response data packet according to an example.

[0097] FIG4 is a schematic diagram showing the structure of a second data SMS according to an example.

[0098] FIG5 is a schematic diagram showing the structure of an application command message according to an example.

[0099] FIG6 is a flowchart showing a method for private network security authentication according to another exemplary embodiment.

[0100] FIG7 is a flowchart showing a method for secure authentication of a private network according to yet another exemplary embodiment.

[0101] Fig. 8 is a flowchart showing a private network security authentication method according to yet another exemplary embodiment.

[0102] FIG9 is a flowchart showing a method for secure authentication of a private network according to yet another exemplary embodiment.

[0103] Fig. 10 is a block diagram showing a private network security authentication device according to an exemplary embodiment.

[0104] FIG11 is a block diagram showing a private network security authentication device according to another exemplary embodiment.

[0105] Fig. 12 is a block diagram showing a private network security authentication device according to yet another exemplary embodiment.

[0106] Fig. 13 is a block diagram showing a private network security authentication device according to yet another exemplary embodiment.

[0107] FIG14 is a block diagram showing a private network security authentication system according to an exemplary embodiment.

[0108] Fig. 15 is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0109] In order to enable ordinary people in the art to better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0110] It should be noted that the terms "first," "second," and the like in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with certain aspects of the present application as detailed in the appended claims.

[0111] Since its official commercial launch, 5G networks have rapidly achieved popularization in the civilian stage. In the commercial field, the construction of 5G private networks by operators led by China Mobile has also developed rapidly. With the low latency, high bandwidth, and high capacity of private networks, they are highly consistent with the needs of digital transformation. They are a comprehensive integration and improvement of operation technology (OT) + Internet technology (IT) + communication technology (CT), which can quickly help traditional industries, vertical public security, rail transit, social departments, etc. to achieve digital transformation.

[0112] A 5G private network is a local area network (LAN) that leverages 5G network slicing technology to create a dedicated network connection system for target customers and enterprises with unified connectivity, optimized service functions, and communication security within a specific area. As a dedicated service, the network's stability, serviceability, and security are better guaranteed.

[0113] Currently, operators generally adopt the core network UPF sinking model to build 5G private networks for industry users. This model relies on the operator's core network and base stations. Terminal access is provided by the operator through service activation, and data contracting is configured on the operator side. However, for industry users, the completed 5G private network is equivalent to the enterprise intranet. Relying solely on the operator's one-time authentication in the 5G core network is not enough to meet the access security needs of industry users. Especially in scenarios with high security levels for individual user access, relying solely on the operator for security access management is far from meeting the needs of industry users, and it is impossible to independently manage user access rights to business systems through the 5G private network.

[0114] In order to solve the above problems, the embodiments of the present application provide a private network security authentication method, device and system, electronic device, storage medium and computer program product. By introducing SIM cards and gateway devices as infrastructure and IT support, secure identity authentication of 5G private networks at the CT layer is realized, solving the problems of the inability to authenticate and control the enterprise side of the 5G private network, the need for frequent logins for secondary user identity control authentication, and low security levels.

[0115] Figure 1 is a flowchart illustrating a private network security authentication method according to an exemplary embodiment. This method is applied to a private network security authentication system, which includes a SIM card, a first terminal containing the SIM card, a text message gateway, a gateway device, and a service system within the private network. The text message gateway and the gateway device serve as gateways for the private network. As shown in Figure 1, the private network security authentication method may include the following steps.

[0116] In step S101 , in response to triggering a card information reporting operation, the SIM card sends a first data message to a service system via a text message gateway, wherein the first data message includes card information.

[0117] First of all, it should be noted that the SIM card in the embodiment of the present application is a smart card that supports the ISO / IEC 7816-4 specification and the 3GPP TS 31.111 specification. Specifically, it supports the Application Protocol Data Unit (APDU) instruction and the connection-oriented Bearer Independent Protocol (BIP).

[0118] In some embodiments, the SIM card registers with the first terminal where the SIM card is located to monitor network access events; after monitoring the first terminal's first network access authentication pass event, the card information reporting operation is triggered.

[0119] Exemplarily, the SIM card registers a STATUS network access event monitor with the first terminal. When the first terminal passes the network access authentication for accessing the private network, the SIM card detects that the SIM card has successfully accessed the network for the first time and automatically triggers a card information report, i.e., triggers the SIM card to report the card information to the SMS gateway.

[0120] As an implementation manner, the card information reporting module of the SIM card registers with the first terminal where the SIM card is located to monitor the network access event.

[0121] As an implementation method, the SIM card reads the card information, assembles the card information into a response data packet of the first data SMS, and sends the response data packet of the first data SMS to the service system through the SMS gateway.

[0122] The SIM card sends a first data message to the SMS gateway. The first data message includes a response data packet. The response data packet includes card information. The SMS gateway transparently transmits the card information and the mobile phone number to the business system.

[0123] It should be noted that a data SMS is a digital identifier that can be understood as an APDU instruction. When a SIM card sends a first data SMS to a service system via an SMS gateway, the SMS gateway's gateway port can retrieve the SIM card's phone number, as the SIM card needs to send the SMS to the SMS gateway using its phone number. That is, when a SIM card accesses the network, it needs to access the mobile network using its phone number. After receiving the first data SMS, the service system can retrieve the phone number associated with the SIM card. This phone number is bound to the end user, allowing the service system to authenticate the end user based on the phone number.

[0124] Optionally, the SIM card assembles card information such as the blank card serial number, integrated circuit card identification code (ICCID) (i.e., SIM card number), international mobile subscriber identity code (IMSI), and security element identifier (SEID) into a response data packet and sends it to the SMS gateway as part of the first data message. The first data message is an uplink message. The SMS gateway receives the first data message, i.e., the card information reporting message, and transparently transmits the card information and mobile phone number to the business system.

[0125] For example, FIG2 shows the structure of the first data SMS message. The structure of the first data SMS message is an uplink SMS message structure, which includes an uplink message header, an SMS security field, and a response data packet. FIG3 shows the structure of the response data packet of the first data SMS message. The response data packet includes the card application main version number (Ver(1Byte(B))), the security parameter identifier (Flag(1B)), the application response data packet (APP-DATA), and the MAC address. The application response data packet includes card information. Specifically, APP-DATA includes TAG (i.e., APP-DATA tag, 1B), length (i.e., APP-DATA length), card application sub-version number (2B), empty card serial number length (1B), empty card serial number (10B), IMSI length (1B), IMSI (9B), SEID length (1B), and SEID (10B). Table 1 is a schematic diagram of the definition of the uplink SMS response data packet field, and Table 2 is a schematic diagram of the definition of the security parameter identifier field. The security parameter identifier includes an encryption identifier and an environment identifier.

[0126] Table 1

[0127] Among them, "XX" in Table 1 indicates that the length value of APP-DATA is variable.

[0128] Table 2

[0129] Among them, the security parameter identification field has a total of 1 Byte (8 bits), namely b1 to b8. In actual applications, two bits can be selected from b1 to b8 to represent the security parameter identification field definition. For example, as shown in Table 2 above, b1 and b2 are selected and enabled, while b3 to b8 are not enabled yet (not enabled yet is indicated by 0). For example, when the security parameter identification includes an encryption identification, b1 is selected to be enabled (X indicates that the position value of b1 is variable, and the value can be 0 or 1, 0 indicates no encryption, and 1 indicates encryption); when the security parameter identification includes an environment identification, b2 is selected to be enabled (X indicates that the position value of b2 is variable, and the value can be 0 or 1, 0 indicates test environment, and 1 indicates production environment). It should be noted that b1 and b2 are not mutually exclusive, but independent of each other.

[0130] In step S102, the service system receives a first data message sent by the SIM card through the SMS gateway, obtains the mobile phone number and card information corresponding to the SIM card based on the first data message, and records the binding relationship between the card information and the mobile phone number.

[0131] It can be understood that after receiving the first data SMS, the service system can obtain the mobile phone number corresponding to the SIM card. The service system can then bind the received card information to the mobile phone number and record the binding relationship between the card information and the mobile phone number. In other words, because the blank card serial number, ICCID, IMSI, etc. in the card information are unique, the mobile phone number is bound to this unique card information one-to-one. The card information and mobile phone number are associated through the SIM card, and the SIM card serves as the identity of the end user.

[0132] Step S103: The service system sends a second data message to the SIM card through the SMS gateway, wherein the second data message includes user information, and the user information includes a mobile phone number.

[0133] It can be understood that the service system assembles a second data message carrying the mobile phone number and requests the SMS gateway to send the second data message to the SIM card. The SMS gateway sends the second data message to the SIM card corresponding to the mobile phone number. The second data message is a downlink message.

[0134] In some embodiments, the second data SMS message includes an application command message, and the application command message includes a mobile phone number.

[0135] For example, Figure 4 shows the structure of the second data message. The structure of the second data message is a downlink message format, which includes a message header, an application command security field, and an application command message. Figure 5 shows the structure of the application command message of the second data message. The application command message includes main_Ver (i.e., the downlink message main version number, 1B), Flag (i.e., the downlink message identifier, 1B), APP-DATA (downlink message application data), and MAC address. Table 3 is a schematic diagram of the definition of the downlink message application data APP-DATA field, as shown in Table 3:

[0136] Table 3

[0137] Among them, "XX" in Table 3 respectively represents the length of the downlink SMS application data field (such as the length in Table 3), the length of the mobile phone number, and the variable value of the mobile phone number.

[0138] Step S104: The SIM card receives a second data message sent by the service system through the SMS gateway, and obtains and stores user information based on the second data message.

[0139] As an implementation method, the SIM card receives a second data SMS sent by the service system and forwarded by the SMS gateway; decrypts the second data SMS to obtain SMS content in the application command message; parses the SMS content to obtain and store user information.

[0140] It can be understood that the SIM card receives the second data SMS sent by the business system forwarded by the SMS gateway, performs message authentication code verification on the second data SMS, decrypts the second data SMS after the verification is passed, obtains the content of the second data SMS, parses the content, extracts user information such as mobile phone number, and writes the user information into storage.

[0141] Optionally, the SIM card stores the user information in a secure storage space of the SIM card.

[0142] Step S105: The first terminal sends an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system.

[0143] It should be noted that the terminal corresponds to the private network. For example, when the business system belongs to the intranet application of the 5G private network, the first terminal is the 5G terminal.

[0144] In some embodiments, before the first terminal sends an intranet application access request to the private network, the method further includes: the first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

[0145] This means that when a user accesses a private network through a first terminal, the operator's core network assigns a private network Internet Protocol (IP) address, enabling one-time authentication. Once authenticated, the first terminal sends a request to access an intranet application. This request triggers a user identity verification check.

[0146] In some embodiments, the first terminal receives a registration request for monitoring network access events sent by the SIM card, so that the SIM card triggers a card information reporting operation after monitoring an event in which the first terminal passes the first network access authentication for the private network.

[0147] In step S106 , the gateway device intercepts the intranet application access request sent by the first terminal to the private network, and redirects the identity authentication link to the first terminal.

[0148] It can be understood that the gateway device intercepts the private network traffic and initiates the redirection request. Optionally, the access gateway module of the gateway device intercepts the private network traffic and initiates the redirection request.

[0149] Exemplarily, the network traffic of the intranet application access request sent by the first terminal is mirrored to the access gateway module of the gateway device via the switch / router. The access gateway module receives the mirrored intranet application access request from the switch / router, sends a Transmission Control Protocol (TCP) reset (RESET) blocking packet to the switch / router, and redirects the identity authentication link (access gateway 8081 port Uniform Resource Locator (URL)) to the first terminal.

[0150] Step S107: The first terminal receives the identity authentication link redirected by the gateway device, and sends a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information.

[0151] It can be understood that when the first terminal sends an intranet application access request to the private network, the gateway device intercepts the intranet application access request sent by the first terminal to the private network and redirects the identity authentication link to the first terminal.

[0152] It can be understood that after receiving the identity authentication link, the first terminal obtains the user information ciphertext from the SIM card.

[0153] Optionally, the first instruction is an APDU instruction, that is, the first terminal sends an APDU instruction to the SIM card, and the APDU instruction instructs to obtain user information.

[0154] Step S108: The SIM card receives the first instruction sent by the first terminal, and sends the user information to the first terminal.

[0155] It can be understood that when a user accesses a private network through a first terminal and requests an enterprise intranet application, user identity verification is triggered. The first terminal then sends a first instruction to the SIM card configured therein to request the user information previously stored in the SIM card.

[0156] As an implementation method, the SIM card establishes a secure access channel with the first terminal; reads the stored user information, encrypts the user information, and obtains user information ciphertext; and sends the user information ciphertext to the first terminal through the secure access channel.

[0157] Optionally, after receiving the first instruction, the SIM card reads the user information stored in the secure storage space and encrypts the user information using a pre-set key on the card to obtain the user information ciphertext. Optionally, the key is pre-set during the SIM card production process and is shared only with the business system to ensure data security.

[0158] Step S109: The first terminal receives the user information sent by the SIM card, and sends first information to the service system through the gateway device; wherein the first information includes the user information.

[0159] In this embodiment, the "information" in the first information may also be a name such as a message, signaling, or instruction.

[0160] It should be noted that the user information in the first information is ciphertext of the user information.

[0161] As an implementation method, the first terminal receives the user information ciphertext sent by the SIM card, and sends a proxy identity authentication request including the user information ciphertext, accesses the gateway device through the access identity authentication link, and sends the proxy identity authentication request to the control center of the gateway device; wherein, the proxy identity authentication request instructs the gateway device to transmit the user information to the business system.

[0162] It can be understood that after the first terminal receives the user information ciphertext, it transparently transmits the user information ciphertext to the business system through the gateway device.

[0163] In step S110 , the gateway device receives first information sent by the first terminal, and sends the first information to the service system.

[0164] As an implementation method, the gateway device receives a proxy identity authentication request sent by the first terminal and sends the user information to the business system; wherein the proxy identity authentication request instructs the gateway device to send the user information to the business system, and the proxy identity authentication request includes the first information.

[0165] In some embodiments, the control center of the gateway device receives the proxy identity authentication request sent by the first terminal through the identity authentication link, and transparently transmits the user information to the business system.

[0166] It should be noted that the first information includes ciphertext of user information.

[0167] As an implementation method, the control center receives the proxy authentication request and encapsulates the encrypted user information into a universal authentication interface protocol message. This message is then sent to the identity authentication platform of the business system within the enterprise intranet. Since the entire transmission process is encrypted, the secure transmission of user information is guaranteed.

[0168] In step S111 , the service system receives first information sent by a first terminal where a SIM card is located through a gateway device, and performs identity authentication on a user of the first terminal based on user information in the first information.

[0169] That is, the business system receives the user information and performs identity authentication on the first terminal user based on the user information.

[0170] As an implementation method, the identity authentication platform of the business system parses the received universal authentication interface protocol message to obtain the user information ciphertext; decrypts it through the local private key to obtain the user information; compares the user information with the user information whitelist configured by the local administrator, and only allows access after verification, that is, authorizes the first terminal user to access the business system.

[0171] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the user information returned by the business system is stored in the SIM card; when the first terminal where the SIM card is located requests to access the business system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored in the SIM card to the business system for identity authentication. It enables the private network user side to independently manage the access rights of users to access the business system through the private network, and realizes the identity authentication management and control on the private network enterprise side. The business system collects and binds user information through the SIM card and the SMS gateway, without the need for an interface to collect user information, and provides a good experience. User information is encrypted at the hard medium layer of the SIM card and transmitted in ciphertext throughout the process to achieve secure authentication. User identity information verification is performed through gateway device redirection, which can cover all terminals and is easy to promote.

[0172] Based on the above embodiment, FIG6 is a flowchart of a private network security authentication method according to another exemplary embodiment. The method is applied to a SIM card. As shown in FIG6, the private network security authentication method may include the following steps.

[0173] Step S601: In response to triggering a card information reporting operation, a first data SMS is sent to a business system via an SMS gateway, wherein the first data SMS includes card information.

[0174] Step S602: Receive a second data SMS message sent by the business system through the SMS gateway, and obtain and store user information based on the second data SMS message; wherein the user information includes a mobile phone number.

[0175] Step S603: Receive a first instruction sent by the first terminal where the SIM card is located, and send user information to the first terminal, so that the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information; wherein the first instruction instructs to obtain user information.

[0176] The user information is sent to the first terminal, so that the first terminal sends the user information to the business system through the gateway device to request the business system to perform identity authentication on the first terminal user.

[0177] It should be noted that, in the embodiment of the present application, the implementation process of steps S601 to S603 can be referred to the description of the implementation process of the corresponding steps in the embodiment shown in FIG1 of the present application, and will not be repeated here.

[0178] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the user information returned by the business system is stored in the SIM card; when the first terminal where the SIM card is located requests access to the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. This enables the private network user side to independently manage the access rights of users to access the business system through the private network, and realizes identity authentication management and control on the private network enterprise side. The business system collects and binds user information through the SIM card and SMS gateway, without the need for an interface to collect user information, and provides a good user experience. User information is encrypted at the hard medium layer of the SIM card and transmitted in ciphertext throughout the process to achieve secure authentication.

[0179] Based on any of the above embodiments, Figure 7 is a flowchart of a private network security authentication method according to another exemplary embodiment. The method is applied to a first terminal, which includes a SIM card. As shown in Figure 7, the private network security authentication method may include the following steps.

[0180] Step S701: Send an intranet application access request to a private network, wherein the intranet application access request indicates access to a business system.

[0181] The first terminal sends an intranet application access request to the private network, wherein the intranet application access request indicates access to a business system.

[0182] Step S702: Receive the identity authentication link redirected by the gateway device, and send a first instruction to the SIM card based on the identity authentication link.

[0183] The first instruction instructs to obtain user information, where the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number.

[0184] Step S703: Receive user information sent by the SIM card, send first information to the service system through the gateway device, and request the service system to perform identity authentication on the first terminal user based on the user information in the first information.

[0185] It should be noted that, in the embodiment of the present application, the implementation process of steps S701 to S703 can be referred to the description of the implementation process of the corresponding steps in the embodiment shown in FIG1 of the present application, and will not be repeated here.

[0186] By implementing this embodiment, the SIM card reports card information to the service system within the private network, and the user information returned by the service system is stored on the SIM card. When the first terminal containing the SIM card requests access to the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored on the SIM card to the service system for identity authentication. This enables the private network user to independently manage the access rights of users to the service system through the private network, and implements identity authentication control on the private network enterprise side.

[0187] Based on any of the above embodiments, Figure 8 is a flowchart of a private network security authentication method according to another exemplary embodiment. The method is applied to a gateway device; as shown in Figure 8, the private network security authentication method may include the following steps.

[0188] Step S801: intercepting an intranet application access request sent by a first terminal to a private network, and redirecting an identity authentication link to the first terminal; wherein the first terminal includes a SIM card, and the intranet application access request indicates access to a business system.

[0189] Step S802: Receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, which is sent to the SIM card by the business system based on the card information reported by the SIM card. The user information includes a mobile phone number, and the user information is used by the first terminal to request the business system to perform identity authentication on the user of the first terminal.

[0190] It should be noted that, in the embodiment of the present application, the implementation process of step S801-step S802 can refer to the description of the implementation process of the corresponding steps in the embodiment shown in Figure 1 of the present application, and will not be repeated here.

[0191] By implementing this embodiment, when a first terminal containing a SIM card requests access to a service system, the gateway device redirects identity authentication. The first terminal then sends the user information stored on the SIM card, returned by the service system based on the card information reported by the SIM card, to the service system for identity authentication. This enables private network users to independently manage their access rights to the service system through the private network, and enables identity authentication management and control on the private network enterprise side. User identity verification through gateway device redirection can cover all terminals and is easy to implement.

[0192] Based on any of the above embodiments, Figure 9 is a flowchart of a private network security authentication method according to another exemplary embodiment. The method is applied to a service system within a private network; as shown in Figure 9, the private network security authentication method may include the following steps.

[0193] Step S901: Receive a first data SMS message sent by a SIM card via a SMS gateway, wherein the first data SMS message includes card information.

[0194] Step S902: Based on the first data SMS, obtain the mobile phone number and card information corresponding to the SIM card, and record the binding relationship between the card information and the mobile phone number.

[0195] Step S903: Send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes a mobile phone number.

[0196] Step S904: Receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

[0197] It should be noted that, in the embodiment of the present application, the implementation process of steps S901 to S904 can refer to the description of the implementation process of the corresponding steps in the embodiment shown in FIG1 of the present application, and will not be repeated here.

[0198] By implementing this embodiment, the SIM card reports card information to the service system within the private network, and the service system returns user information to the SIM card. When the first terminal containing the SIM card requests access to the service system, the first terminal sends the user information stored on the SIM card to the service system for identity authentication. This enables the private network user to independently manage user access rights to the service system through the private network, and implements identity authentication control on the private network enterprise side. The service system collects and binds user information through the SIM card and SMS gateway, eliminating the need for an interface to collect user information, resulting in a better user experience.

[0199] Based on any of the above embodiments, FIG10 is a block diagram of a private network security authentication device according to an exemplary embodiment, wherein the device is configured in a SIM card. Referring to FIG10 , the private network security authentication device may include: a card information reporting module 1001 and a first transceiver module 1002.

[0200] Specifically, the card information reporting module 1001 is configured to send a first data SMS to the business system through the SMS gateway in response to triggering the card information reporting operation, wherein the first data SMS includes the card information;

[0201] The card information reporting module 1001 is further configured to receive a second data SMS message sent by the business system via the SMS gateway, and obtain and store user information based on the second data SMS message; wherein the user information includes a mobile phone number;

[0202] The first transceiver module 1002 is configured to receive a first instruction sent by the first terminal where the SIM card is located, and send the user information to the first terminal, so that the first terminal requests the service system to authenticate the first terminal user based on the user information; wherein the first instruction instructs to obtain the user information.

[0203] In some implementations, the card information reporting module 1001 is further configured to:

[0204] In response to triggering the card information reporting operation, registering with the first terminal to monitor network access events;

[0205] Monitor the event that the first terminal passes the first network authentication, and trigger the card information reporting operation.

[0206] In some implementations, the card information reporting module 1001 is configured to:

[0207] Read the card information and assemble the card information into a response data packet of the first data SMS; send the response data packet of the first data SMS to the business system through the SMS gateway.

[0208] In some implementations, the card information reporting module 1001 is configured to:

[0209] Receiving a second data SMS message sent by the service system forwarded by the SMS gateway; wherein the second data SMS message includes an application command message, and the application command message includes user information;

[0210] Decrypt the second data SMS message to obtain SMS content in the application command message;

[0211] Parse SMS content, obtain and store user information.

[0212] In some implementations, the first transceiver module 1002 is configured to:

[0213] Establishing a secure access channel with the first terminal;

[0214] Read user information; encrypt user information to obtain user information ciphertext;

[0215] The user information ciphertext is sent to the first terminal through a secure access channel.

[0216] In some implementations, the response data packet includes the card application major version number, security parameter identifier, application response data packet and MAC address, the application response data packet includes card information, and the security parameter identifier includes an encryption identifier and an environment identifier.

[0217] In some implementations, the card information reporting module 1001 is configured to:

[0218] Store user information in the secure storage space of the SIM card.

[0219] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0220] By implementing this embodiment, the card information is reported to the business system in the private network through the SIM card, and the user information returned by the business system is stored in the SIM card; when the first terminal where the SIM card is located requests access to the business system, the first terminal sends the user information stored in the SIM card to the business system for identity authentication. This enables the private network user side to independently manage the access rights of users to access the business system through the private network, and realizes identity authentication management and control on the private network enterprise side. The business system collects and binds user information through the SIM card and SMS gateway, without the need for an interface to collect user information, and provides a good user experience. User information is encrypted at the hard medium layer of the SIM card and transmitted in ciphertext throughout the process to achieve secure authentication.

[0221] Based on any of the above embodiments, FIG11 is a block diagram of a private network security authentication device according to another exemplary embodiment, wherein the device is configured in a first terminal, and the first terminal includes a SIM card. Referring to FIG11 , the private network security authentication device may include: a second transceiver module 1101.

[0222] Specifically, the second transceiver module 1101 is configured to send an intranet application access request to the private network, wherein the intranet application access request indicates access to the business system;

[0223] The second transceiver module 1101 is further configured to receive an identity authentication link redirected by the gateway device, and send a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information, and the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number;

[0224] The second transceiver module 1101 is further configured to receive user information sent by the SIM card, send first information to the service system through the gateway device, and request the service system to authenticate the first terminal user based on the user information in the first information.

[0225] In some implementations, the second transceiver module 1101 is further configured to:

[0226] Before sending an intranet application access request to the private network, the first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

[0227] In some implementations, the second transceiver module 1101 is further configured to:

[0228] Receive the registration request for monitoring network access events sent by the SIM card.

[0229] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0230] By implementing this embodiment, the SIM card reports card information to the service system within the private network, and the user information returned by the service system is stored on the SIM card. When the first terminal containing the SIM card requests access to the service system, the gateway device redirects the identity authentication, and the first terminal sends the user information stored on the SIM card to the service system for identity authentication. This enables the private network user to independently manage the access rights of users to the service system through the private network, and implements identity authentication control on the private network enterprise side.

[0231] Based on any of the above embodiments, FIG12 is a block diagram of a private network security authentication device according to another exemplary embodiment, which is configured in a gateway device. Referring to FIG12 , the private network security authentication device may include: an access gateway module 1201 and a control center module 1202 .

[0232] Specifically, the access gateway module 1201 is configured to intercept an intranet application access request sent by the first terminal to the private network and redirect the identity authentication link to the first terminal; wherein the first terminal includes a SIM card, and the intranet application access request indicates access to the business system;

[0233] The control center module 1202 is configured to receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, which is sent to the SIM card by the business system based on the card information reported by the SIM card. The user information includes a mobile phone number, and the user information is used by the first terminal to request the business system to authenticate the identity of the first terminal user.

[0234] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0235] By implementing this embodiment, when a first terminal containing a SIM card requests access to a service system, the gateway device redirects identity authentication. The first terminal then sends the user information stored on the SIM card, returned by the service system based on the card information reported by the SIM card, to the service system for identity authentication. This enables private network users to independently manage their access rights to the service system through the private network, and enables identity authentication management and control on the private network enterprise side. User identity verification through gateway device redirection can cover all terminals and is easy to implement.

[0236] Based on any of the above embodiments, Figure 13 is a block diagram of a private network security authentication device according to another exemplary embodiment, which is configured in a service system within a private network. Referring to Figure 13 , the private network security authentication device may include: a third transceiver module 1301, a processing module 1302, and an identity authentication module 1303.

[0237] Specifically, the third transceiver module 1301 is configured to receive a first data SMS message sent by the SIM card through the SMS gateway, wherein the first data SMS message includes card information.

[0238] The processing module 1302 is configured to obtain the mobile phone number and card information corresponding to the SIM card based on the first data SMS, and record the binding relationship between the card information and the mobile phone number.

[0239] The third transceiver module 1301 is further configured to send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes a mobile phone number.

[0240] The identity authentication module 1303 is configured to receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

[0241] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0242] By implementing this embodiment, the SIM card reports card information to the service system within the private network, and the service system returns user information to the SIM card. When the first terminal containing the SIM card requests access to the service system, the first terminal sends the user information stored on the SIM card to the service system for identity authentication. This enables the private network user to independently manage user access rights to the service system through the private network, and implements identity authentication control on the private network enterprise side. The service system collects and binds user information through the SIM card and SMS gateway, eliminating the need for an interface to collect user information, resulting in a better user experience.

[0243] Based on any of the above embodiments, Figure 14 is a block diagram of a private network security authentication system according to an exemplary embodiment. Referring to Figure 14, the private network security authentication system may include: a SIM card 1401, a first terminal (such as a 5G terminal) where the SIM card is located 1402, a text message gateway 1403, a gateway device 1404 and a business system 1405.

[0244] Specifically, the SIM card 1401 is configured to execute the private network security authentication method shown in FIG6 ;

[0245] The first terminal 1402 where the SIM card is located is configured to execute the private network security authentication method shown in FIG7 ;

[0246] The gateway device 1404 is configured to execute the private network security authentication method shown in FIG8 ;

[0247] The business system 1405 is configured to execute the private network security authentication method shown in FIG9 .

[0248] By implementing this embodiment, the SIM card reports card information to the service system within the private network, and the service system returns user information to the SIM card. When the first terminal containing the SIM card requests access to the service system, the first terminal sends the user information stored on the SIM card to the service system for identity authentication. This enables the private network user to independently manage user access rights to the service system through the private network, and implements identity authentication control on the private network enterprise side. The service system collects and binds user information through the SIM card and SMS gateway, eliminating the need for an interface to collect user information, resulting in a better user experience.

[0249] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0250] Figure 15 is a block diagram of an electronic device shown in accordance with an exemplary embodiment, which is an electronic device for implementing a method for private network security authentication. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0251] As shown in Figure 15, the electronic device includes: one or more processors 1501, a memory 1502, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of a graphical user interface (GUI) on an external input / output device (such as a display device coupled to the interface). In other embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 15 takes a processor 1501 as an example.

[0252] Memory 1502 is the non-transitory computer-readable storage medium provided in this application. Memory 1502 stores instructions executable by at least one processor 1501, causing the at least one processor 1501 to perform the private network security authentication method provided in this application. The non-transitory computer-readable storage medium of this application stores computer instructions configured to cause a computer to perform the private network security authentication method provided in this application.

[0253] Memory 1502, as a non-transient computer-readable storage medium, can be used to store non-transient software programs, non-transient computer executable programs, and modules, such as the program instructions / modules corresponding to the method for private network security authentication in the embodiments of the present application (for example, the access gateway module 1201 and the control center module 1202 shown in FIG. 12 ). Processor 1501 executes the various functional applications and data processing of the server by running the non-transient software programs, instructions, and modules stored in memory 1502, thereby implementing the method for private network security authentication in the above method embodiment.

[0254] The memory 1502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the electronic device with private network security authentication, etc. In addition, the memory 1502 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1502 may optionally include a remote memory remotely located relative to the processor 1501, and these remote memories may be connected to the electronic device with private network security authentication via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0255] The electronic device for private network security authentication may further include: an input device 1503 and an output device 1504. The processor 1501, the memory 1502, the input device 1503 and the output device 1504 may be connected via a bus or other means, and FIG15 takes the bus connection as an example.

[0256] The input device 1503 can receive input digital or character information, and generate key signal input related to user settings and function control of the electronic device for private network security authentication, such as input devices such as a touch screen, a keypad, a mouse, a trackpad, a touch pad, an indicator stick, one or more mouse buttons, a trackball, and a joystick. The output device 1504 may include a display device, an auxiliary lighting device (e.g., a light emitting diode (LED)) and a tactile feedback device (e.g., a vibration motor). The display device may include, but is not limited to, a liquid crystal display (LCD), an LED display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0257] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, application specific integrated circuits (ASICs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0258] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., a disk, an optical disk, a memory, a programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0259] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or an LCD monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0260] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a LAN, a Wide Area Network (WAN), and the Internet.

[0261] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

[0262] In an exemplary embodiment, the embodiment of the present application also provides a computer program product. When the instructions in the computer program product are executed by the processor 1501 of the electronic device, the processor 1501 of the electronic device can execute the above-mentioned private network security authentication method.

[0263] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0264] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered merely as exemplary.

[0265] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A private network security authentication method, the method is applied to a user identification module SIM card, comprising: In response to triggering the card information reporting operation, sending a first data SMS to the business system through the SMS gateway, wherein the first data SMS includes the card information; Receiving a second data SMS sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS; wherein the user information includes a mobile phone number; Receive a first instruction sent by a first terminal where the SIM card is located, and send the user information to the first terminal, so that the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information; wherein the first instruction instructs to obtain the user information.

2. The method according to claim 1, wherein: Before the response triggers the card information reporting operation, the method includes: Registering with the first terminal to monitor network access events; An event that the first terminal passes the first network access authentication is monitored, triggering a card information reporting operation.

3. The method according to claim 1, wherein: The sending of the first data SMS to the business system through the SMS gateway includes: Reading card information, and assembling the card information into a response data packet of the first data SMS; A response data packet of the first data SMS is sent to the business system through the SMS gateway.

4. The method according to claim 1, wherein: The receiving a second data SMS sent by the business system through the SMS gateway, and acquiring and storing user information based on the second data SMS, includes: receiving a second data SMS sent by the business system and forwarded by the SMS gateway; wherein the second data SMS includes an application command message, and the application command message includes the user information; Decrypting the second data SMS message to obtain SMS content in the application command message; Parse the text message content, obtain and store the user information.

5. The method according to claim 1, wherein: The sending the user information to the first terminal includes: Establishing a secure access channel with the first terminal; Reading user information; and encrypting the user information to obtain a ciphertext of the user information; The user information ciphertext is sent to the first terminal through the secure access channel.

6. The method according to claim 3, wherein: The response data packet includes the card application major version number, security parameter identifier, application response data packet and media access control MAC address, the application response data packet includes the card information, and the security parameter identifier includes an encryption identifier and an environment identifier.

7. The method according to claim 4, wherein: The storing of the user information comprises: The user information is stored in the secure storage space of the SIM card.

8. A private network security authentication method, the method being applied to a first terminal, the first terminal comprising a subscriber identity module SIM card; the method comprising: Sending an intranet application access request to a private network, wherein the intranet application access request indicates access to a business system; Receive an identity authentication link redirected by a gateway device, and send a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information, the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number; The user information sent by the SIM card is received, and first information is sent to the service system through the gateway device, and based on the user information in the first information, the service system is requested to perform identity authentication on the first terminal user.

9. The method according to claim 8, wherein: Before sending the intranet application access request to the private network, the method includes: The first terminal sends an access request to the private network, where the access request instructs the private network to verify the authority of the first terminal.

10. The method according to claim 8, wherein: The method further comprises: Receive a network access event monitoring registration request sent by the SIM card.

11. A private network security authentication method, the method being applied to a gateway device, comprising: Intercepting an intranet application access request sent by a first terminal to a private network, and redirecting an identity authentication link to the first terminal; wherein the first terminal includes a subscriber identity module SIM card, and the intranet application access request indicates access to a business system; receiving first information sent by the first terminal, and sending the first information to the business system, wherein the first The information includes user information, which is sent to the SIM card by the service system based on the card information reported by the SIM card. The user information includes a mobile phone number, and the user information is used by the first terminal to request the service system to perform identity authentication on the first terminal user.

12. A private network security authentication method, the method being applied to a business system within a private network, comprising: Receiving a first data SMS sent by a subscriber identity module SIM card through a SMS gateway, wherein the first data SMS includes card information; Based on the first data SMS, obtain the mobile phone number and the card information corresponding to the SIM card, and record the binding relationship between the card information and the mobile phone number; Sending a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number; Receive first information sent by the first terminal where the SIM card is located through a gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

13. A private network security authentication system, comprising a user identification module SIM card, a first terminal where the SIM card is located, a short message gateway, a gateway device and a service system, The SIM card is configured to execute the private network security authentication method according to any one of claims 1 to 7; The first terminal where the SIM card is located is configured to execute the private network security authentication method according to any one of claims 8 to 10; The gateway device is configured to execute the private network security authentication method according to claim 11; The business system is configured to execute the private network security authentication method as described in claim 12.

14. A private network security authentication device, the device being configured on a user identification module SIM card, comprising: A card information reporting module, configured to send a first data SMS to a business system through a SMS gateway in response to triggering a card information reporting operation, wherein the first data SMS includes card information; The card information reporting module is further configured to receive a second data SMS sent by the business system through the SMS gateway, and obtain and store user information based on the second data SMS; wherein the user information includes a mobile phone number; The first transceiver module is configured to receive a first instruction sent by a first terminal where the SIM card is located, and send the user information to the first terminal, so that the first terminal requests the service system to perform identity authentication on the first terminal user based on the user information; wherein the first instruction instructs to obtain the user information.

15. A private network security authentication device, the device being configured in a first terminal, the first terminal comprising a subscriber identity module SIM card, comprising: A second transceiver module is configured to send an intranet application access request to the private network, wherein the intranet application access request indicates access to a business system; The second transceiver module is further configured to receive an identity authentication link redirected by a gateway device, and send a first instruction to the SIM card based on the identity authentication link, wherein the first instruction instructs to obtain user information, the user information is sent to the SIM card by the service system based on the card information reported by the SIM card, and the user information includes a mobile phone number; The second transceiver module is further configured to receive the user information sent by the SIM card, send first information to the service system through the gateway device, and request the service system to perform identity authentication on the first terminal user based on the user information in the first information.

16. A private network security authentication device, the device being configured in a gateway device, comprising: The access gateway module is configured to intercept an intranet application access request sent by the first terminal to the private network, and redirect the identity authentication link to the first terminal; wherein the first terminal includes a customer identification module SIM card, and the intranet application access request indicates access to the service system; The control center module is configured to receive the first information sent by the first terminal and send the first information to the business system, wherein the first information includes user information, and the user information is sent to the SIM card by the business system based on the card information reported by the SIM card, and the user information includes a mobile phone number, and the user information is used by the first terminal to request the business system to authenticate the first terminal user.

17. A private network security authentication device, the device being configured in a business system within a private network, comprising: A third transceiver module is configured to receive a first data SMS sent by a subscriber identity module SIM card through a SMS gateway, wherein the first data SMS includes card information; a processing module configured to obtain the mobile phone number and the card information corresponding to the SIM card based on the first data SMS, and record the binding relationship between the card information and the mobile phone number; The third transceiver module is further configured to send a second data SMS to the SIM card through the SMS gateway, wherein the second data SMS includes user information, and the user information includes the mobile phone number; The identity authentication module is configured to receive first information sent by the first terminal where the SIM card is located through the gateway device, and perform identity authentication on the first terminal user based on the user information in the first information.

18. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the private network security authentication method described in any one of claims 1 to 12.

19. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are configured to enable the computer to execute the private network security authentication method according to any one of claims 1 to 12.

20. A computer program product, comprising computer instructions, which, when executed by a processor, implement the private network security authentication method according to any one of claims 1 to 12.

Images