Anonymous Network Authentication Using Temporary Privacy Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity authentication methods in 5G networks are vulnerable to bogus request packets, leading to resource occupation and disruption of normal network services, and existing asymmetric cryptography does not adequately protect user privacy.
Innovation Solution
Implement a symmetric encryption mechanism using a temporary privacy identity identifier (TPII) generated by an identity management server, allowing network devices to perform authentication without maintaining an identity database, thereby filtering out bogus requests and reducing processing pressure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric cryptographic algorithm is used for identity authentication, then user privacy is protected, but processing resources are occupied by bogus request packets
Solution Approach 1:
The authentication process is divided into two stages: first-stage authentication using symmetric cryptographic algorithm for rapid filtering of bogus requests, and second-stage authentication using asymmetric cryptographic algorithm for secure identity verification. This segmentation allows the system to handle bulk requests efficiently while maintaining security for legitimate users.
Solution Approach 2:
The symmetric authentication is performed as a preliminary action before the asymmetric authentication. By pre-filtering requests using the faster symmetric algorithm, the system prepares the authentication pipeline to handle only legitimate requests, preventing resource occupation by bogus packets before they reach the resource-intensive asymmetric decryption stage.
2Reliability
If identity management server performs authentication for all requests, then security is maintained, but processing pressure increases during attacks
Solution Approach 1:
Instead of performing complete asymmetric authentication on all requests, the system applies partial authentication using symmetric algorithm to all requests, and reserves the complete asymmetric authentication only for requests that pass the first-stage filter. This partial action approach maintains security boundaries while reducing overall processing pressure during attack scenarios.
Solution Approach 2:
The symmetric cryptographic algorithm acts as an intermediary mechanism between the identity management server and the asymmetric authentication system. It provides a preliminary verification layer that filters out malicious requests, reducing the burden on the identity management server's asymmetric decryption capabilities while maintaining the security chain.
3Extent of automation
If centralized identity management server is used, then authentication control is centralized, but it becomes target for DDoS attacks
Solution Approach 1:
The authentication system implements local quality by enabling network devices to perform first-stage symmetric authentication independently without requiring centralized server involvement for each request. This distributes the filtering capability to multiple locations in the network, reducing the centralized server's exposure to DDoS attacks while maintaining overall authentication control.
Solution Approach 2:
Network devices are empowered to perform self-service authentication filtering using symmetric cryptographic algorithms stored locally. They can independently verify requests against authentication keys without immediately contacting the centralized identity management server, reducing the server's attack surface while maintaining security through subsequent centralized verification of legitimate requests.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application provides an identity authentication method and apparatus, and belongs to the field of communications technologies. In the solution provided in this application, when a terminal device has a network access requirement, the terminal device sends a network access request carrying a temporary privacy identity identifier to a network device, and performs message interaction and authentication with the network device based on an authentication key corresponding to the temporary privacy identity identifier. In this way, an identity authentication procedure is completed. The network device can implement authentication on an anonymous identity of a user without maintaining an identity database, which can ensure that user privacy is not disclosed. In addition, in the identity authentication procedure, the network device can filter out a bogus request packet before an identity management server. In this way, processing pressure of the network device is greatly reduced, and occupation of a large quantity of processing resources is avoided, so that processing of a normal request packet is not affected, and normal operation of the network service can be ensured.