Security authentication method, platform, device, system, medium and program product

Abstract

The present disclosure relates to the field of wireless communication and terminals. Provided are a security authentication method, a platform, a device, a system, a medium and a program product. The method comprises: receiving first encrypted data and a secondary authentication request sent by a user equipment; on the basis of the secondary authentication request, performing decryption and verification on the first encrypted data to generate a key; synchronizing the key to a cloud instance pool; and, in response to the cloud instance pool having successfully saved the key, sending the key and a secondary authentication success response message to the user equipment, such that the user equipment can access the Internet by using the key.

Description

Security authentication methods, platforms, devices, systems, media, and procedures products

[0001] Cross-references to related applications

[0002] This application is based on and claims priority to CN application number 202410481636.6, filed on April 22, 2024, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] This disclosure relates to the field of wireless communication and terminals, and more particularly to a security authentication method, platform, device, system, medium, and program product. Background Technology

[0004] P-RAN (Proximity Radio Access Network) is a distributed networking technology for 6G. The security of P-RAN is an important issue that must be addressed for operational services. The industry has proposed VMESS (an encrypted transmission protocol) to solve the security problem of the user plane.

[0005] As a prerequisite for the process, the P-RAN service management platform synchronizes the VMESS encryption key Key-V with the cloud instance pool Tun2sock VMESS in advance, and the cloud instance pool Tun2sock VMESS stores Key-V.

[0006] Summary of the Invention

[0007] According to one aspect of this disclosure, a security authentication method is proposed, comprising: receiving first encrypted data and a secondary authentication request sent by a user equipment; decrypting and verifying the first encrypted data according to the secondary authentication request to generate a key; synchronizing the key to a cloud instance pool; and in response to the cloud instance pool saving the successful key, sending the key and a secondary authentication success response message to the user equipment so that the user equipment can use the key to access the Internet.

[0008] In some embodiments, the first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting key generation after successful user identifier authentication.

[0009] In some embodiments, decrypting and verifying the first encrypted data includes: decrypting the first encrypted data to obtain a user identifier; and using the user identifier to verify the user identity of the user device.

[0010] In some embodiments, the first encrypted data is encrypted using a Token, and the security authentication method further includes: receiving a key identifier sent by a user equipment, wherein the key identifier corresponds to the Token.

[0011] In some embodiments, decrypting and verifying the first encrypted data further includes: obtaining the corresponding Token based on the key identifier; verifying the validity of the Token; and decrypting the first encrypted data using the Token.

[0012] In some embodiments, the key is encrypted to generate second encrypted data, wherein the key is sent to the user equipment as the second encrypted data.

[0013] In some embodiments, encrypting the key to generate second encrypted data includes: encrypting the key using a token to generate second encrypted data.

[0014] In some embodiments, a key identifier is sent to the user equipment so that the user equipment can obtain the corresponding token based on the key identifier, verify the validity of the token, and then use the token to decrypt the second encrypted data to obtain the key.

[0015] According to another aspect of this disclosure, a secure authentication method is also proposed, comprising: sending first encrypted data and a secondary authentication request to a business management platform to instruct the business management platform to decrypt and verify the first encrypted data, generate a key, and synchronize the key to a cloud instance pool; receiving the key and a secondary authentication success response message sent by the business management platform; and using the key to access the Internet.

[0016] In some embodiments, the first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting key generation after successful user identifier authentication.

[0017] In some embodiments, the first encrypted data is encrypted using a Token, and the security authentication method further includes sending a key identifier to the business management platform, wherein the key identifier corresponds to the Token.

[0018] In some embodiments, receiving a key sent by the business management platform includes receiving second encrypted data sent by the business management platform, wherein the second encrypted data includes the encrypted key.

[0019] In some embodiments, a key identifier sent by a business management platform is received; a corresponding token is obtained based on the key identifier; the validity of the token is verified; and the second encrypted data is decrypted using the token to obtain a key.

[0020] According to another aspect of this disclosure, a business management platform is also proposed, comprising: a first receiving module configured to receive first encrypted data and a secondary authentication request sent by a user equipment; a first processing module configured to decrypt and verify the first encrypted data according to the secondary authentication request, and generate a key; and a first sending module configured to synchronize the key to a cloud instance pool, and in response to the cloud instance pool successfully saving the key, send the key and a secondary authentication success response message to the user equipment, so that the user equipment can access the Internet using the key.

[0021] According to another aspect of this disclosure, a business management platform is also proposed, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the security authentication method described above based on instructions stored in the memory.

[0022] According to another aspect of this disclosure, a user equipment is also proposed, comprising: a second sending module configured to send first encrypted data and a secondary authentication request to a service management platform, instructing the service management platform to decrypt and verify the first encrypted data, generate a key, and synchronize the key to a cloud instance pool; a second receiving module configured to receive the key and a secondary authentication success response message sent by the service management platform; and a second processing module configured to access the Internet using the key.

[0023] According to another aspect of this disclosure, a user equipment is also proposed, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the security authentication method as described above based on instructions stored in the memory.

[0024] According to another aspect of this disclosure, a near-field wireless access network system is also proposed, comprising: the aforementioned service management platform; the aforementioned user equipment; and a cloud-based instance pool configured to store keys sent by the service management platform.

[0025] According to another aspect of this disclosure, a computer-readable storage medium is also proposed, on which computer program instructions are stored, which, when executed by a processor, implement the security authentication method as described above.

[0026] According to another aspect of this disclosure, a computer program product is also proposed, comprising a computer program or instructions that, when executed by a processor, implement the aforementioned security authentication method.

[0027] Other features and advantages of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0028] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the specification, serve to explain the principles of this disclosure.

[0029] This disclosure will become clearer with reference to the accompanying drawings and the following detailed description, wherein:

[0030] Figure 1 is a flowchart illustrating some embodiments of the security authentication method disclosed herein;

[0031] Figure 2 is a flowchart illustrating some other embodiments of the security authentication method disclosed herein;

[0032] Figure 3 is a flowchart illustrating some other embodiments of the security authentication method disclosed herein;

[0033] Figure 4 is a structural schematic diagram of some embodiments of the business management platform disclosed herein;

[0034] Figure 5 is a structural schematic diagram of some other embodiments of the business management platform of this disclosure;

[0035] Figure 6 is a schematic diagram of the structure of some embodiments of the user equipment of this disclosure;

[0036] Figure 7 is a structural schematic diagram of some other embodiments of the user equipment of this disclosure;

[0037] Figure 8 is a schematic diagram of the structure of some embodiments of the near-field wireless access network system disclosed herein;

[0038] Figure 9 is a schematic diagram of the structure of some other embodiments of the near-field wireless access network system disclosed herein. Detailed Implementation

[0039] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0040] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0041] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or use.

[0042] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0043] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0044] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0045] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0046] In related technologies, if the P-RAN service management platform synchronizes the VMESS encryption key Key-V with the cloud instance pool Tun2sock VMESS in advance, and the cloud instance pool Tun2sock VMESS stores Key-V, Key-V may ultimately not be used, resulting in a waste of P-RAN service management platform resources, or Key-V may be maliciously decrypted and become invalid during long-term storage in the cloud instance pool.

[0047] Figure 1 is a flowchart illustrating some embodiments of the security authentication method disclosed herein. These embodiments are executed by a service management platform and include steps S110-S140. P-RAN services require end-to-end system provision, and the service process involves interfacing with IT systems, etc. This service management platform is, for example, a P-RAN service management platform, which is an APP server supporting management and authentication within the P-RAN system.

[0048] In step S110, the first encrypted data and the secondary authentication request sent by the user equipment are received.

[0049] In some embodiments, the user equipment, referred to as a terminal device or terminal, is a device with wireless transceiver capabilities that can communicate with one or more core networks (CNs) via an access network device in a radio access network (RAN). It can be deployed on land, including indoors or outdoors, handheld, wearable, or vehicle-mounted; it can also be deployed on water, such as on ships; and it can be deployed in the air, such as on airplanes, balloons, or satellites. The user equipment can be a mobile phone, tablet, computer with wireless transceiver capabilities, VR (virtual reality) terminal device, AR (augmented reality) terminal device, wireless terminal in industrial control, wireless terminal in self-driving, wireless terminal in remote medical care, wireless terminal in smart grids, wireless terminal in transportation safety, wireless terminal in smart cities, wireless terminal in smart homes, etc.

[0050] User equipment includes remote UEs (User Equipment), relay UEs, and primary relay UEs. There can be multiple levels of relay UEs. A relay UE uses a P-RAN application to provide connectivity to remote UEs and also generates traffic itself, but communication is achieved through forwarding by primary relay UEs. A primary relay UE uses a P-RAN application to provide internet traffic support for other UEs using its own connection to the mobile network or WiFi.

[0051] In some embodiments, when a remote UE needs to access the Internet using a key, it sends first encrypted data and a secondary authentication request to the service management platform, so that the password generation of the service management platform matches the key requirements of the remote UE, thereby eliminating the need for the service management platform to pre-generate keys.

[0052] For example, the first encrypted data includes an encrypted user identifier and an encrypted key generation message. The key generation message includes a request to generate a key after successful user authentication. This user identifier can be used to verify user identity. This key generation message instructs the business management platform to generate a VMESS key upon request after successful user authentication.

[0053] In some embodiments, the first encrypted data is encrypted with a Token. The service management platform also receives a key identifier KeyID sent by the user equipment, wherein the key identifier corresponds to the Token, and the corresponding Token can be found through the key identifier.

[0054] For example, the user terminal sends the mapping between key identifiers and tokens to the business management platform, so the business management platform can find the corresponding token using the key identifier. Alternatively, the business management platform stores the mapping between key identifiers and tokens, so it can also find the corresponding token after receiving the key identifier.

[0055] The token needs to be bound to information such as user ID, device identifier, timestamp, and key identifier; the key identifier is transmitted in plaintext and is used to identify the APP.

[0056] In some embodiments, AES (Advanced Encryption Standard) can be used to encrypt the user identifier and key generation message. AES is one of the mainstream symmetric encryption algorithms currently available, offering high efficiency and relatively high security. However, because business operations have high requirements for decryption efficiency, ordinary business requests use symmetric encryption.

[0057] In step S120, the first encrypted data is decrypted and verified according to the secondary authentication request to generate a key.

[0058] In some embodiments, the first encrypted data is decrypted to obtain a user identifier, which is then used to verify the user's identity on the user device. After verifying the user's identity, the service management platform generates a VMESS key. In other words, the service management platform generates VMESS keys on demand.

[0059] In some embodiments, a corresponding token is obtained based on the key identifier, the validity of the token is verified, and the token is used to decrypt the first encrypted data. By verifying the validity of the token, the problem of reduced system security caused by using expired tokens to decrypt data can be reduced.

[0060] In this embodiment, secondary authentication refers to the process by which a user confirms their identity and receives the user plane IPsec security tunnel key information when using P-RAN services after logging into the APP.

[0061] In step S130, the key is synchronized to the cloud instance pool.

[0062] In some embodiments, the business management platform synchronizes the key to the cloud instance pool, the cloud instance pool stores the key, and sends a successful storage response back to the business management platform.

[0063] In the VMESS solution, this cloud instance pool supports receiving key information, returning responses to the platform, and establishing Tun2sock tunnels with the primary relay UE following the WiFi Direct protocol, and implementing VMESS encryption for cloud nodes.

[0064] In step S140, in response to the cloud instance pool successfully saving the key, the key and the secondary authentication success response message are sent to the user equipment so that the user equipment can use the key to access the Internet.

[0065] In some embodiments, the key is sent to the user equipment as second encrypted data. For example, the service management platform encrypts the key to generate the second encrypted data. The user equipment then encrypts the second encrypted data to obtain the key, which it can then use to access the Internet.

[0066] For example, the business management platform uses a token to encrypt the key, generating a second encrypted data. The business management platform also sends a key identifier to the user device. The user device obtains the corresponding token based on the key identifier, verifies the validity of the token, and then uses the token to decrypt the second encrypted data to obtain the key.

[0067] In the above embodiment, the precondition for the process is eliminated: the business management platform does not need to synchronize the key with the cloud instance pool in advance. Therefore, the cloud instance pool does not need to store the key in advance. Instead, when the user device needs the key, it sends a request to the business management platform, which then generates the key and synchronizes it to the cloud instance pool. The user device can then use this key to access the internet. This embodiment reduces the risk of wasted resources due to the business management platform pre-generating and synchronizing the key to the cloud instance pool, and the risk of the key becoming invalid due to malicious decryption after long-term storage.

[0068] Figure 2 is a flowchart illustrating some other embodiments of the security authentication method disclosed herein, which are executed by a user equipment and include steps S210-S230.

[0069] In step S210, the first encrypted data and a secondary authentication request are sent to the business management platform to instruct the business management platform to decrypt and verify the first encrypted data, generate a key, and synchronize the key to the cloud instance pool.

[0070] In some embodiments, the first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting key generation after successful user identifier authentication.

[0071] For example, when a user equipment requires a key, it encrypts the user identifier and key generation message, thereby sending the user identifier and key generation message to the business management platform in an encrypted manner, improving the security of data transmission.

[0072] In some embodiments, the first encrypted data is encrypted using a token. The user equipment also sends a key identifier to the service management platform, where the key identifier corresponds to the token. The service management platform uses the key identifier to find the corresponding token, verifies the token's validity, and then uses the token to decrypt the first encrypted data, obtaining the user identifier and a key generation message. After verifying the user's identity using the user identifier, the service management platform generates a key and synchronizes it to the cloud instance pool, where the cloud instance pool stores the key.

[0073] In step S220, the key and secondary authentication success response message sent by the business management platform are received.

[0074] In some embodiments, the user equipment receives second encrypted data sent by the service management platform, wherein the second encrypted data includes an encryption key.

[0075] For example, the business management platform encrypts the key to generate second encrypted data. Alternatively, it can encrypt the key using a token to generate second encrypted data. The business management platform sends a key identifier to the user device, enabling the user device to obtain the corresponding token using this identifier. After verifying the token's validity, the user device uses the token to decrypt the second encrypted data, obtaining the key.

[0076] In step S230, the Internet is accessed using a key.

[0077] For example, when a user device wants to access the Internet, it uses this key to encrypt data, thereby enabling Internet access.

[0078] In the above embodiments, when a user device needs a key, it requests a key from the business management platform. The business management platform does not need to generate and synchronize keys in advance, which reduces the risk of resource waste caused by unused keys and the risk of malicious decryption due to long-term key storage. It can also improve the terminal service ecosystem and facilitate the rational management of key usage.

[0079] As shown in Figure 3, the solution of this disclosure will be described below using a specific embodiment as an example. Figure 3 is a flowchart illustrating some other embodiments of the security authentication method of this disclosure, including steps 0-22.

[0080] In step 0, the remote UE uses a token to encrypt the user ID and requests the platform to generate a key after successful user ID authentication.

[0081] In step 1, the remote UE submits encrypted data, KeyID, and a secondary authentication request to the P-RAN service management platform.

[0082] In step 2, the P-RAN service management platform uses the Key-ID to find the corresponding Token, verifies the validity of the Token, decrypts the received encrypted data with the Token, verifies the user's identity based on the user ID, and generates a VMESS key Key-P according to the request after successful user authentication.

[0083] In step 3, the P-RAN service management platform synchronizes Key-P with the cloud instance pool.

[0084] In step 4, the cloud instance pool stores Key-P.

[0085] In step 5, the cloud instance pool returns a Key-P storage success response to the P-RAN service management platform.

[0086] In step 6, the P-RAN service management platform uses the Token to encrypt the key Key-P.

[0087] In step 7, the P-RAN service management platform returns the encrypted data, KeyID, and a successful secondary authentication response to the remote UE.

[0088] In step 8, the secondary verification is completed. The remote UE uses the Key-ID to find the corresponding Token, verifies the validity of the Token, and decrypts the Key-P with the Token. If the remote UE wants to access the Internet, it uses the Key-P to encrypt the data packet.

[0089] In step 9, the remote UE forwards the encrypted data packet to the ordinary relay UE.

[0090] In step 10, the relay UE decrypts the data packet using Key-P and then encrypts the data packet.

[0091] In step 11, the relay UE forwards the encrypted data packet to the primary relay UE.

[0092] In step 12, the primary relay UE decrypts the data packet using Key-P and then encrypts the data packet.

[0093] In step 13, the primary relay UE forwards the encrypted data packet to the cloud instance pool Tun2sock VMESS.

[0094] In step 14, the cloud instance pool Tun2sock VMESS decrypts the data packet using Key-P.

[0095] In step 15, the cloud instance pool Tun2sock VMESS forwards the original request data packet to the Internet.

[0096] In step 16, the Internet application returns the content data packet requested by the user to the cloud instance pool Tun2sock VMESS.

[0097] In step 17, the cloud instance pool Tun2sock VMESS encrypts the returned data packet using Key-P.

[0098] In step 18, the cloud instance pool Tun2sock VMESS forwards the encrypted data packet to the primary relay UE.

[0099] In step 19, the primary relay UE decrypts the data packet using Key-P and then encrypts it.

[0100] In step 20, the primary relay UE forwards the encrypted data packet to the ordinary relay UE.

[0101] In step 21, the relay UE decrypts the data packet using Key-P and then encrypts it.

[0102] In step 22, the relay UE forwards the encrypted data packet to the remote UE.

[0103] The above embodiments can reduce the resource waste caused by the P-RAN service management platform pre-generating keys that may not ultimately be used, and the problem of keys being maliciously decrypted and invalidated if stored in the cloud instance pool for a long time. At the same time, this embodiment can also improve communication security in near-field scenarios; by using encryption keys generated on-demand by the platform, it can effectively avoid various hidden dangers caused by malicious key decoding.

[0104] Figure 4 is a schematic diagram of the structure of some embodiments of the business management platform of this disclosure. The business management platform includes a first receiving module 410, a first processing module 420 and a first sending module 430.

[0105] The first receiving module 410 is configured to receive the first encrypted data and the secondary authentication request sent by the user equipment.

[0106] In some embodiments, the first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting key generation after successful user identifier authentication.

[0107] The first encrypted data is encrypted using a Token. The first receiving module 410 is also configured to receive a key identifier sent by the user equipment, wherein the key identifier corresponds to the Token.

[0108] The first processing module 420 is configured to decrypt and verify the first encrypted data according to the secondary authentication request, and generate a key.

[0109] In some embodiments, the first processing module 420 decrypts the first encrypted data to obtain a user identifier, and uses the user identifier to verify the user identity of the user device.

[0110] The first processing module 420 is also configured to obtain the corresponding Token based on the key identifier, verify the validity of the Token, and use the Token to decrypt the first encrypted data.

[0111] In some embodiments, the first processing module 420 is further configured to encrypt the key to generate second encrypted data, wherein the key is sent to the user device as the second encrypted data. For example, the key can be encrypted using a token to generate the second encrypted data.

[0112] The first sending module 430 is configured to synchronize the key to the cloud instance pool, and in response to the cloud instance pool successfully saving the key, send the key and a secondary authentication success response message to the user equipment so that the user equipment can use the key to access the Internet.

[0113] In some embodiments, the first sending module 430 is configured to send a key identifier to the user equipment so that the user equipment can obtain the corresponding token based on the key identifier, verify the validity of the token, and then use the token to decrypt the second encrypted data to obtain the key.

[0114] In the above embodiments, the business management platform does not need to synchronize keys to the cloud instance pool in advance. Therefore, the cloud instance pool does not need to store keys in advance. Instead, the business management platform generates keys and synchronizes them to the cloud instance pool when the user device needs them, so that the user device can use the key to access the Internet. This embodiment can reduce the risk of resources being wasted due to unused keys caused by the business management platform pre-generating and synchronizing the keys to the cloud instance pool, and the risk of keys becoming invalid due to malicious decryption after long-term storage.

[0115] Figure 5 is a schematic diagram of the structure of some other embodiments of the business management platform of this disclosure. The business management platform 500 includes a memory 510 and a processor 520. The memory 510 can be a disk, flash memory, or any other non-volatile storage medium. The memory is used to store the instructions in the above embodiments. The processor 520 is coupled to the memory 510 and can be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. The processor 520 is used to execute the instructions stored in the memory.

[0116] In some embodiments, the processor 520 is coupled to the memory 510 via a BUS bus 530. The business management platform 500 can also be connected to an external storage device 550 via a storage interface 540 to access external data, and can also be connected to a network or another computer system (not shown) via a network interface 560. Further details are omitted here.

[0117] In this embodiment, data instructions are stored in a memory and then processed by a processor to improve communication security in near-field scenarios. By using encryption keys generated in real time by the platform, various hidden dangers caused by malicious decoding of the keys can be effectively avoided.

[0118] Figure 6 is a schematic diagram of the structure of some embodiments of the user equipment of this disclosure, which includes a second transmitting module 610, a second receiving module 620 and a second processing module 630.

[0119] The second sending module 610 is configured to send the first encrypted data and a secondary authentication request to the business management platform, instructing the business management platform to decrypt and verify the first encrypted data, generate a key, and synchronize the key to the cloud instance pool.

[0120] In some embodiments, the first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting key generation after successful user identifier authentication.

[0121] The first encrypted data is encrypted using a Token. The second sending module 610 is also configured to send a key identifier to the business management platform, wherein the key identifier corresponds to the Token.

[0122] The second receiving module 620 is configured to receive the key and the secondary authentication success response message sent by the service management platform.

[0123] In some embodiments, the second receiving module 620 receives second encrypted data sent by the business management platform, wherein the second encrypted data includes an encryption key.

[0124] The second processing module 630 is configured to access the Internet using a key.

[0125] In some embodiments, the second receiving module 620 receives a key identifier sent by the business management platform, the second processing module 630 obtains the corresponding Token based on the key identifier, verifies the validity of the Token, and uses the Token to decrypt the second encrypted data to obtain the key.

[0126] In the above embodiments, when a user device needs a key, it requests a key from the business management platform. The business management platform does not need to generate and synchronize keys in advance, which reduces the risk of resource waste caused by unused keys and the risk of malicious decryption due to long-term key storage. It can also improve the terminal service ecosystem and facilitate the rational management of key usage.

[0127] Figure 7 is a schematic diagram of the structure of some other embodiments of the user equipment 700 of this disclosure, which includes a memory 710 and a processor 720. The memory 710 may be a disk, flash memory, or any other non-volatile storage medium. The memory is used to store instructions in the above embodiments. The processor 720 is coupled to the memory 710 and may be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. The processor 720 is used to execute the instructions stored in the memory.

[0128] In some embodiments, the processor 720 is coupled to the memory 710 via a BUS bus 730. The user equipment 700 can also be connected to an external storage device 750 via a storage interface 740 to access external data, and can also be connected to a network or another computer system (not shown) via a network interface 760. Further details are omitted here.

[0129] In this embodiment, storing data instructions in a memory and then processing those instructions with a processor can improve the terminal service ecosystem, facilitate the rational management of key usage, and reduce resource waste.

[0130] Figure 8 is a schematic diagram of the structure of some embodiments of the near-field wireless access network system disclosed herein. This embodiment includes a service management platform 600, user equipment 700, and a cloud-based instance pool 800.

[0131] The business management platform 600 and user equipment 700 have been described in detail in the above embodiments and will not be elaborated further here. The cloud instance pool 800 is configured to store the key sent by the business management platform. After storing the key, the cloud instance pool 800 sends a storage success response to the business management platform.

[0132] After receiving encrypted data packets sent by the user equipment, the cloud instance pool 800 decrypts the data packets using the stored key, and after receiving data packets returned from the Internet, encrypts the data packets and sends the encrypted data packets to the user equipment.

[0133] In some embodiments, as shown in Figure 9, the user equipment 700 includes a remote UE, a relay UE, and a primary relay UE, wherein the relay UE can be multi-level. P-RAN services require end-to-end system provision, and the business processes involve integration with IT systems, etc. The P-RAN service management platform 600 is the APP server in the P-RAN system that supports management, authentication, receiving and sorting traffic call detail records (CDRs), and performing CDR preprocessing. In the VMESS solution, the cloud instance pool 800 supports receiving Key-P information, returning responses to the platform, and establishing Tun2sock tunnels with primary relays following the WiFi Direct protocol, implementing VMESS encryption as a cloud node.

[0134] This embodiment can improve communication security in near-field scenarios and reduce various potential risks caused by malicious key decoding in future P-RAN systems.

[0135] In other embodiments, a computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the steps of the methods described above. Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, apparatus, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] In some embodiments, a computer program product is protected, comprising a computer program or instructions that, when executed by a processor, implement the methods described above. The computer program product includes a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from ROM. When the computer program is executed by a CPU, it performs the functions defined in the methods of embodiments of this disclosure.

[0137] In some embodiments, a computer program is also provided, comprising: instructions that, when executed by a processor, cause the processor to perform the security authentication method as described above.

[0138] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0139] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0140] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0141] This concludes the detailed description of the present disclosure. To avoid obscuring the concept of the disclosure, some details known in the art have not been described. Those skilled in the art will fully understand how to implement the technical solutions disclosed herein based on the above description.

[0142] The methods and apparatus of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.

[0143] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A security authentication method, comprising: Receive the first encrypted data and the second authentication request sent by the user equipment; Based on the secondary authentication request, the first encrypted data is decrypted and verified to generate a key; Synchronize the key to the cloud instance pool; as well as In response to the cloud instance pool successfully saving the key, the key and a secondary authentication success response message are sent to the user equipment so that the user equipment can use the key to access the Internet.

2. The security authentication method according to claim 1, wherein, The first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting the generation of the key after successful user identifier authentication.

3. The security authentication method according to claim 2, wherein, Decrypting and verifying the first encrypted data includes: Decrypt the first encrypted data to obtain the user identifier; and The user identifier is used to verify the user's identity on the user device.

4. The security authentication method according to any one of claims 1 to 3, wherein, The first encrypted data is encrypted using a token, and the security authentication method further includes: Receive a key identifier sent by the user equipment, wherein the key identifier corresponds to the token.

5. The security authentication method according to claim 4, wherein, Decrypting and verifying the first encrypted data also includes: Obtain the corresponding Token based on the key identifier; Verify the validity of the Token; and The first encrypted data is decrypted using the Token.

6. The security authentication method according to claim 4 or 5 further includes: The key is encrypted to generate second encrypted data, wherein the key is used in the second encrypted data. The data is sent to the user equipment in the manner described above.

7. The security authentication method according to claim 6, wherein, Encrypting the key to generate the second encrypted data includes: The key is encrypted using the Token to generate the second encrypted data.

8. The security authentication method according to claim 7 further includes: The key identifier is sent to the user equipment so that the user equipment can obtain the corresponding token based on the key identifier, verify the validity of the token, and then use the token to decrypt the second encrypted data to obtain the key.

9. A security authentication method, comprising: Send the first encrypted data and a secondary authentication request to the business management platform to instruct the business management platform to decrypt and verify the first encrypted data, generate a key, and synchronize the key to the cloud instance pool; Receive the key and secondary authentication success response message sent by the business management platform; as well as Use the key to access the Internet.

10. The security authentication method according to claim 9, wherein, The first encrypted data includes an encrypted user identifier and an encrypted key generation message, wherein the key generation message includes a message requesting the generation of the key after successful user identifier authentication.

11. The security authentication method according to claim 9 or 10, wherein, The first encrypted data is encrypted using a token, and the security authentication method further includes: Send a key identifier to the business management platform, wherein the key identifier corresponds to the token.

12. The security authentication method according to claim 11, wherein, The keys received from the business management platform include: The system receives second encrypted data sent by the business management platform, wherein the second encrypted data includes the encrypted key.

13. The security authentication method according to claim 12, further comprising: Receive the key identifier sent by the business management platform; Obtain the corresponding Token based on the key identifier; Verify the validity of the Token; as well as The key is obtained by decrypting the second encrypted data using the token.

14. A business management platform, comprising: The first receiving module is configured to receive the first encrypted data and the secondary authentication request sent by the user equipment. The first processing module is configured to decrypt and verify the first encrypted data according to the secondary authentication request, and generate a key; as well as The first sending module is configured to synchronize the key to the cloud instance pool, and in response to the cloud instance pool successfully saving the key, send the key and a secondary authentication success response message to the user equipment so that the user equipment can use the key to access the Internet.

15. A business management platform, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the security authentication method as described in any one of claims 1 to 8 based on instructions stored in the memory.

16. A user equipment, comprising: The second sending module is configured to send first encrypted data and a secondary authentication request to the business management platform, instructing the business management platform to decrypt and verify the first encrypted data, generate a key, and synchronize the key to the cloud instance pool. The second receiving module is configured to receive the key and the secondary authentication success response message sent by the business management platform; as well as The second processing module is configured to access the Internet using the key.

17. A user equipment, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to operate based on instructions stored in the memory. Perform the security authentication method as described in any one of claims 9 to 13.

18. A near-field wireless access network system, comprising: The business management platform as described in claim 14 or 15; The user equipment as described in claim 16 or 17; as well as The cloud instance pool is configured to store the keys sent by the business management platform.

19. A computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the security authentication method as described in any one of claims 1 to 13.

20. A computer program product comprising a computer program or instructions that, when executed by a processor, implement the security authentication method according to any one of claims 1 to 13.

21. A computer program comprising: Instructions, when executed by a processor, cause the processor to perform the security authentication method according to any one of claims 1 to 13.

Images