WO2022111016A1 - 移动网络接入系统、方法、存储介质及电子设备 - Google Patents

移动网络接入系统、方法、存储介质及电子设备 Download PDF

Info

Publication number
WO2022111016A1
WO2022111016A1 PCT/CN2021/120009 CN2021120009W WO2022111016A1 WO 2022111016 A1 WO2022111016 A1 WO 2022111016A1 CN 2021120009 W CN2021120009 W CN 2021120009W WO 2022111016 A1 WO2022111016 A1 WO 2022111016A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
authentication
network
node
user equipment
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/120009
Other languages
English (en)
French (fr)
Inventor
谢辉
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Cloudminds Robotics Co Ltd
Original Assignee
Cloudminds Robotics Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Cloudminds Robotics Co Ltd filed Critical Cloudminds Robotics Co Ltd
Priority to JP2021577675A priority Critical patent/JP7312279B2/ja
Priority to KR1020217043009A priority patent/KR102636275B1/ko
Priority to EP21827376.1A priority patent/EP4027677A4/en
Priority to US17/565,875 priority patent/US12342165B2/en
Publication of WO2022111016A1 publication Critical patent/WO2022111016A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/082—Access security using revocation of authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/12—Mobility data transfer between location registers or mobility servers

Definitions

  • the present disclosure relates to the field of information technology, and in particular, to a mobile network access system, method, storage medium and electronic device.
  • the authentication of UE (User Equipment) accessing the mobile network is based on the symmetric cryptographic mechanism, that is, the same key is used for encryption (Encryption) and decryption (Decryption).
  • the same key is used as the user equipment, so the security of mobile communication cannot be guaranteed.
  • every time a user makes a mobile network access request using a symmetric encryption algorithm he needs to use a unique key that no one else knows, so that the number of keys possessed by mobile operators and user equipment increases exponentially, increasing Burden of mobile operator and user device key management.
  • an access authentication method based on an asymmetric cryptographic mechanism that is, a pair of keys, a public key (Public Key) and a private key (Private Key) are used.
  • the private key is the only key, which is safely kept by the mobile operator and cannot be leaked.
  • the public key is sent to any user equipment that requests access.
  • the asymmetric encryption mechanism uses a pair of keys for encryption, which can improve the quality of mobile communication. security, and reduce the burden of key management.
  • a pair of keys is used asymmetrically, if the user equipment illegally obtains the public key of the authentication server, it can access the mobile network illegally, and the security of the mobile network access is also low.
  • the purpose of the present disclosure is to provide a mobile network access system, method, storage medium and electronic device, so as to solve the problem of low security of terminal equipment accessing the mobile network.
  • a first aspect of the embodiments of the present disclosure provides a mobile network access system, the system includes a first network authentication service node and a first certificate issuing node in a blockchain network, wherein the the first network authentication service node and the first certificate issuing node belong to a first operator;
  • the first certificate issuing node is configured to issue a first authentication certificate for indicating the identity of the first network authentication service node to the first network authentication service node, and issue a first authentication certificate to the user equipment of the first operator a first UE certificate for indicating the identity of the user equipment of the first operator, and storing the first UE certificate revocation information and the first CA certificate indicating the identity of the first certificate issuing node in the blockchain;
  • the first network authentication service node is configured to obtain the first UE certificate revocation information and the first CA certificate from the blockchain, and receive the first certificate of the user equipment of the first operator. In the case of accessing the authentication message, perform two-way identity authentication with the user equipment of the first operator, and when the two-way identity authentication is completed, access the user equipment of the first operator to the mobile network.
  • the system further includes a second network authentication service node and a second certificate issuance node in the blockchain network, and the second network authentication service node and the second certificate issuance node belong to the second network authentication service node and the second certificate issuance node. operator;
  • the first certificate issuing node is further configured to write the first roaming license issued by the second certificate issuing node into the blockchain;
  • the second certificate issuing node is configured to issue a second authentication certificate for indicating the identity of the second network authentication service node to the second network authentication service node, and issue a second authentication certificate to the user equipment of the second operator a second UE certificate for indicating the identity of the user equipment of the second operator, and storing the second UE certificate revocation information and the second CA certificate indicating the identity of the second certificate issuing node in the blockchain, and writing the second roaming license to be issued by the first certificate issuing node into the blockchain.
  • the first CA certificate and the first UE certificate issued by the first certificate issuing node to the user equipment of the first operator are preset in the identity card of the user equipment of the first operator ;
  • the first authentication certificate issued by the first certificate issuing node to the first network authentication service node is preset in the first network authentication service node or stored in the blockchain.
  • a second aspect of the embodiments of the present disclosure provides a mobile network access method, the method is applied to the first network authentication service node in the system of the first aspect, and the method includes:
  • the second access authentication message includes the first authentication certificate, and the first authentication certificate is used for the user equipment of the first operator to perform identity authentication on the first network authentication service node, and is used in the first network authentication service node. If the identity authentication is passed, the user equipment of the first operator is connected to the mobile network.
  • the method is applied to the first network authentication service node in the mobile network access system, and the method further includes:
  • the second UE certificate, the first roaming license, and the second roaming license verify the first CA certificate according to the public key in the first CA certificate Whether the first roaming license is issued by the first certificate issuing node, and whether the second UE certificate is issued by the second certificate is verified according to the public key of the second certificate issuing node in the second roaming license Issuing node issued;
  • the second UE certificate is issued by the second certificate issuing node
  • a fourth access authentication message where the fourth access authentication message includes the first authentication certificate and the first roaming license, the first authentication certificate and the first roaming license are used for the first authentication certificate and the first roaming license.
  • the user equipment of the second operator performs identity authentication on the first network authentication service node, and when the identity authentication is passed, the user equipment of the second operator is connected to the mobile network.
  • a third aspect of the embodiments of the present disclosure provides a mobile network access method, the method is applied to a user equipment of a first operator, and the method includes:
  • the authentication information includes the first UE certificate
  • the mobile network is accessed.
  • the method further includes:
  • the authentication information includes the second UE certificate
  • Accessing the mobile network in a case where it is determined that the first roaming certificate is issued by the first certificate issuing node and the second authentication certificate is issued by the second certificate issuing node.
  • a fourth aspect of the embodiments of the present disclosure provides a network authentication server storage medium, which stores a computer program, and when the program is executed by a processor, implements the steps of the method described in the second aspect.
  • a fifth aspect of the embodiments of the present disclosure provides a user equipment storage medium, on which a computer program is stored, and when the program is executed by a processor, implements the steps of the method described in the third aspect.
  • a sixth aspect of the embodiments of the present disclosure provides a network authentication server, including:
  • a processor for executing the computer program in the memory to implement the steps of the method of the second aspect.
  • a seventh aspect of the embodiments of the present disclosure provides a user equipment, including:
  • a processor for executing the computer program in the memory to implement the steps of the method in the third aspect.
  • a computer program including computer-readable codes, which, when the computer-readable codes are executed on a computing and processing device, cause the computing and processing device to execute the second aspect or the first aspect of the present disclosure.
  • a first authentication certificate for indicating the identity of the first network authentication service node is issued to the first network authentication service node through the first certificate issuing node, and a first authentication certificate for indicating the first operator is issued to the user equipment of the first operator
  • the first UE certificate of the identity of the user equipment, and the first UE certificate revocation information and the first CA certificate indicating the identity of the first certificate issuing node are stored in the blockchain; Obtain the first UE certificate revocation information and the first CA certificate in the blockchain, and in the case of receiving the first access authentication message of the user equipment of the first operator, conduct bidirectional communication with the user equipment of the first operator Identity authentication, when the two-way identity authentication is completed, access the user equipment of the first operator to the mobile network.
  • the user equipment of the first operator can perform mobile network access authentication nearby, and the security of mobile network access is improved.
  • terminal device access can be implemented in a private or isolated mobile network, which improves the convenience of mobile network access.
  • Fig. 1 is a block diagram of a mobile network access system according to an exemplary embodiment.
  • Fig. 2 is a block diagram of another mobile network access system according to an exemplary embodiment.
  • Fig. 3 is a flowchart showing a method for accessing a mobile network according to an exemplary embodiment.
  • Fig. 4 is a flowchart showing another method for accessing a mobile network according to an exemplary embodiment.
  • Fig. 5 is a flowchart showing a method for accessing a mobile network according to an exemplary embodiment.
  • Fig. 6 is a flowchart showing another method for accessing a mobile network according to an exemplary embodiment.
  • FIG. 7 is a block diagram of an electronic device 700 according to an exemplary embodiment.
  • FIG. 8 is a block diagram of an electronic device 1900 according to an exemplary embodiment.
  • FIG. 9 provides a schematic structural diagram of a computing processing device according to an embodiment of the present disclosure.
  • FIG. 10 provides a schematic diagram of a storage unit for portable or fixed program code implementing the method according to the present disclosure according to an embodiment of the present disclosure.
  • the mobile network access system provided by the present disclosure can allow the user equipment to access the mobile network of the operator after completing the authentication through the EAP-TLS authentication protocol.
  • FIG. 1 is a block diagram of a mobile network access system according to an exemplary embodiment, and the system 100 is used for performing mobile network access.
  • the system 100 includes: a first network authentication service node 110 and a first certificate issuance node 120 in a blockchain network, wherein the first network authentication service node 110 and the first certificate issuance node 120 belong to the first operator.
  • the first certificate issuing node 120 is configured to issue a first authentication certificate for indicating the identity of the first network authentication service node 110 to the first network authentication service node 110, and issue a first authentication certificate to the user equipment of the first operator for indicating the identity of the first network authentication service node 110.
  • the first UE certificate of the identity of the user equipment, and the first UE certificate revocation information and the first CA certificate indicating the identity of the first certificate issuing node are stored in the blockchain;
  • the first network authentication service node 110 is configured to obtain the first UE certificate revocation information and the first CA certificate from the blockchain, and in the case of receiving the first access authentication message of the user equipment of the first operator, and The user equipment performs two-way identity authentication, and when the two-way identity authentication is completed, accesses the user equipment to the mobile network.
  • the first network authentication service node 110 can be AUSF ((Authentication Server Function, authentication server function), the first network authentication service node 110 is connected to any blockchain node of the blockchain, and can be obtained from the blockchain.
  • the first UE certificate revocation information and the first CA certificate are included in the first network authentication service node 110 .
  • the first network authentication service node 110 may perform mutual identity authentication with the user equipment of the first operator through the authentication protocol of EAP-TLS.
  • the user equipment of the first operator may establish communication with the closest first network authentication service node 110 first, and then perform two-way identity authentication with it.
  • the first certificate issuing node 120 is further configured to issue first UE certificate revocation information, where the first UE certificate revocation information is used to indicate that the corresponding first UE certificate is invalid.
  • the first CA certificate and the first UE certificate issued by the first certificate issuing node 120 to the user equipment are preset in the identity card of the user equipment.
  • the identity card may be a USIM card, and the USIM card stores the first UE certificate issued by the first certificate issuing node 120 when it leaves the factory. Further, after the USIM card is installed in the user equipment, the user equipment can generate a private key based on the first UE certificate.
  • the identity card may also be an eSIM card, and after the user selects an operator package, the user equipment may generate a private key based on the first UE certificate.
  • the first network authentication service node 110 and the first certificate issuing node 120 may serve as a node of the blockchain network.
  • the first authentication certificate issued by the first certificate issuing node 120 to the first network authentication service node 110 is preset in the first network authentication service node 110 or stored in the blockchain.
  • the first certificate issuing node 120 stores the first CA certificate indicating its own identity in the blockchain, optionally, the first CA certificate may also be stored in any first network authentication service node 110. And, the first certificate issuing node 120 issues a first UE certificate indicating the identity of the user equipment of the first operator, wherein the first UE certificate corresponds to the first CA certificate. In this way, when the user equipment of the first operator performs access authentication with the first network authentication service node 110 through the EAP-TLS authentication protocol, the first UE certificate can be matched with the first CA certificate.
  • the first operator can issue the first UE certificate revocation information through the first certificate issuing node 120, so that the blockchain or the first network authentication service node 110 can form a revocation list based on multiple first UE certificate revocation information.
  • the first network authentication service node 110 may determine whether the user equipment of the first operator is disqualified from access through the revocation list.
  • the first network authentication service node 110 determines that the first UE certificate revocation information of the user equipment of the first operator exists in the revocation list, it generates user equipment revocation information, and feeds back the user equipment revocation information to the user equipment . In this way, it is convenient for the user to know in time that the first UE certificate of the user equipment is revoked.
  • the first network authentication service node 110 determines that the first UE certificate revocation information of the user equipment of the first operator does not exist in the revocation list, and the first UE certificate and the first CA certificate match each other, the first network authentication service node 110 receives: into the user equipment to the mobile network.
  • a first authentication certificate for indicating the identity of the first network authentication service node is issued to the first network authentication service node through the first certificate issuing node, and a certificate for indicating the identity of the user equipment is issued to the user equipment of the first operator
  • the first UE certificate, and the first UE certificate revocation information and the first CA certificate indicating the identity of the first certificate issuing node are stored in the blockchain; and obtained from the blockchain through the first network authentication service node
  • the first UE certificate revocation information and the first CA certificate and in the case of receiving the first access authentication message of the user equipment of the first operator, perform two-way identity authentication with the user equipment, and in the case that the two-way identity authentication is completed next, access the user equipment to the mobile network.
  • the user equipment of the first operator can perform mobile network access authentication nearby, and the security of mobile network access is improved.
  • terminal device access can be implemented in a private or isolated mobile network, which improves the convenience of mobile network access.
  • FIG. 2 is a block diagram of another mobile network access system shown.
  • the system 100 further includes a second network authentication service node 130 in the blockchain network and a first network authentication service node 130 in the blockchain network.
  • the second certificate issuing node 140, the second network authentication service node 130 and the second certificate issuing node 140 belong to the second operator;
  • the first certificate issuing node 120 is further configured to write the first roaming license issued by the second certificate issuing node 140 into the blockchain;
  • the second certificate issuing node 140 is configured to issue a second authentication certificate for indicating the identity of the second network authentication service node 130 to the second network authentication service node 130, and issue a second authentication certificate to the user equipment of the second operator for indicating the user
  • the second UE certificate of the identity of the device, and the second UE certificate revocation information and the second CA certificate indicating the identity of the second certificate issuing node 140 are stored in the blockchain, and will be issued by the first certificate issuing node 120.
  • the second roaming license is written into the blockchain.
  • the first network authentication service node 110, the first certificate issuing node 120, the second network authentication service node 130, and the second certificate issuing node 140 may serve as a node of the blockchain network.
  • the first operator and the second operator need to reach a roaming agreement, and the first operator issues the first roaming license for the second certificate issuing node 140 through the first certificate issuing node 120, and the second operator The second roaming license certificate issued by the second certificate issuing node 140 for the first certificate issuing node 120 .
  • the first certificate issuing node 120 uploads the first roaming license to the blockchain storage
  • the second certificate issuing node 140 uploads the second roaming license to the blockchain storage.
  • the second certificate issuing node 140 issues a second CA certificate indicating the identity of the second certificate issuing node 140, and the first UE certificate and the second certificate issued by the first certificate issuing node 120 are preset in the USIM card of the user equipment.
  • the second UE certificate issued by the issuing node 140 is issued.
  • the first certificate issuing node 120 writes the issued first UE certificate revocation information into the blockchain network
  • the second certificate issuing node 140 also writes the issued second UE certificate revocation information into the blockchain network.
  • a revocation list is constructed according to multiple first UE certificate revocation information and multiple second UE certificate revocation information.
  • the corresponding network authentication service node can determine whether there is corresponding UE certificate revocation information from the revocation list of the blockchain, so as to determine whether the corresponding UE certificate revocation information exists. Whether the first UE certificate or the second UE certificate of the user equipment is revoked.
  • system in the embodiments of the present disclosure is not limited to the 5th generation mobile communication network.
  • system can be used to realize a single service subject or cross-service Access authentication of the subject.
  • the roaming access of the UE in the mobile networks of different operators can be realized, which not only makes up for the defect that the UE does not support the roaming of the mobile networks of different operators in the EAP-TLS authentication mode, but also avoids access.
  • the inconvenience and resource overhead brought by the authentication must be performed at the UE's home location, which improves the convenience of the terminal device accessing the mobile network.
  • FIG. 3 is a diagram according to an exemplary embodiment. A flow chart of a mobile network access method. Referring to Figure 3, the method includes the following steps:
  • step S301 the first access authentication information sent by the user equipment of the first operator is received.
  • the first access authentication information includes the first UE certificate
  • step S302 the first UE certificate revocation information and the first CA certificate are obtained from the blockchain.
  • step S303 whether the first UE certificate is issued by the first certificate issuing node is verified according to the public key in the first CA certificate, and whether the first UE certificate is revoked is determined according to the first UE certificate revocation information.
  • step S304 if it is determined that the first UE certificate is issued by the first certificate issuing node and the first UE certificate has not been revoked, a second access authentication message is sent to the user equipment of the first operator.
  • the second access authentication message includes a first authentication certificate
  • the first authentication certificate is used for the user equipment of the first operator to perform identity authentication on the first network authentication service node, and when the identity authentication is passed, access the first authentication service node.
  • the first network authentication service node extracts the first UE certificate from the first access authentication information, and then searches whether there is a UE of the user equipment of the first operator in the revocation list of the blockchain based on the first UE certificate Certificate revocation information.
  • the first network authentication service node determines that the user equipment of the first operator has been revoked when it is determined that there is UE certificate revocation information of the user equipment of the first operator in the revocation list of the blockchain, Then, corresponding user equipment revocation information is generated, and the user equipment revocation information is fed back to the user equipment. In this way, it is convenient for the user to know in time that the first UE certificate of the user equipment is revoked, and the user equipment cannot access the mobile network.
  • the first network authentication service node determines that the user equipment of the first operator has not been revoked when it is determined that the revocation list of the first operator does not exist in the revocation list of the first operator's UE certificate.
  • the first network authentication service node obtains the public key from the first CA certificate, and verifies whether the first UE certificate is issued by the first CA certificate according to the public key.
  • the certificate issuing node issues. For example, the private key of the first UE certificate can be verified according to the public key, and if the public key matches the private key, it is determined that the first UE certificate is issued by the first certificate issuing node.
  • the first network authentication service node when determining that the first UE certificate is issued by the first certificate issuing node, the first network authentication service node generates a second access authentication message, and sends the second access authentication message to the user equipment of the first operator message, so that the user equipment of the first operator can verify the identity of the first network authentication service node according to the private key of the first authentication certificate.
  • the identity authentication of the user equipment of the first operator by the first network authentication service node is realized. In this way, the security and convenience of mobile network access can be improved.
  • FIG. 4 is a flowchart illustrating another method for accessing a mobile network according to an exemplary embodiment. 4, the method further includes the following steps:
  • step S401 the third access authentication information sent by the user equipment of the second operator is received.
  • the third access authentication information includes the second UE certificate.
  • step S402 the first CA certificate, the first roaming license, and the second roaming license are obtained from the blockchain.
  • step S403 when the first CA certificate, the second UE certificate, the first roaming license and the second roaming license are obtained, verify whether the first roaming license is authorized by the public key in the first CA certificate.
  • the first certificate issuing node issues, and verifies whether the second UE certificate is issued by the second certificate issuing node according to the public key of the second certificate issuing node in the second roaming license.
  • step S404 if it is determined that the first roaming license is issued by the first certificate issuing node and the second UE certificate is issued by the second certificate issuing node, send a fourth access certificate to the user equipment of the second operator information.
  • the fourth access authentication message includes a first authentication certificate and a first roaming license, and the first authentication certificate and the first roaming license are used for the user equipment of the second operator to perform identity authentication on the first network authentication service node, In the case that the identity authentication is passed, the user equipment of the second operator is connected to the mobile network.
  • the first UE certificate issued by the first certificate issuing node and the second UE certificate issued by the second certificate issuing node are preset on the identity card of the user equipment of the second operator.
  • the user equipment of the second operator may generate a first private key based on the first UE certificate, and generate a second private key based on the second UE certificate.
  • the user equipment of the second operator sends third access authentication information to the first network authentication service node of the first operator based on the EAP-TLS authentication protocol, and the first network authentication service node receives the third access authentication information , extract the second UE certificate from the third access authentication information.
  • the second UE certificate obtain the first CA certificate, the first roaming license, and the second roaming license from the blockchain, and then verify the first CA certificate according to the public key in the first CA certificate. Whether a roaming license is issued by the first certificate issuing node, whether the second UE certificate is issued by the second certificate issuing node is verified according to the public key of the second certificate issuing node in the second roaming license.
  • the private key of the first roaming license can be verified according to the public key in the first CA certificate, and if the public key matches the private key, it is determined that the first roaming license is issued by the first certificate issuing node, and can be issued according to the The public key of the second certificate issuing node in the second roaming license verifies the private key of the second UE certificate, and if the public key matches the private key, it is determined that the second UE certificate is issued by the second certificate issuing node.
  • the first network authentication service node generates a fourth access authentication message, and sends the fourth access authentication message to the user equipment of the second operator, so that the user equipment of the second operator can perform the authentication according to the first authentication certificate. and the private key of the first roaming license to verify the identity of the first network authentication service node.
  • the first network authentication service node when it is determined that the first roaming license is not issued by the first certificate issuing node, that is, the public key in the first CA certificate does not match the private key of the first roaming license, or the second UE certificate is not issued by If the second certificate issuing node issues the certificate, that is, the public key of the second certificate issuing node in the second roaming license does not match the private key of the second UE certificate, the first network authentication service node generates illegal access information, and The illegal access information is sent to the user equipment of the second operator, so that the user can learn about the access authentication failure information in time.
  • the user equipment of the first operator may also preset the ID card with the first UE certificate issued by the first certificate issuing node and the second UE certificate issued by the second certificate issuing node, so that the user equipment of the first operator can also be sent to the second certificate issuing node.
  • the operator's second network authentication service node sends an access authentication message, and further roams the user equipment of the first operator to the mobile network of the second operator.
  • the user equipment of the second operator can be roamed into the mobile network of the first operator, thereby increasing the roaming nearby access of the UE in the mobile networks of different operators, and improving the access of the terminal equipment.
  • FIG. 5 shows a mobile network access method according to an exemplary embodiment. Flowchart of the method. 5, the method includes the following steps:
  • step S501 the first access authentication information is sent to the first network authentication service node.
  • the first network authentication service node is the first network authentication service node 110 in the mobile network access system 100, and the first access authentication information includes the first UE certificate.
  • step S502 a second access authentication message sent by the first network authentication service node is received, where the second access authentication message includes the first authentication certificate.
  • step S503 it is verified whether the first authentication certificate is issued by the first issuing node according to the public key in the preset first CA certificate.
  • step S504 when it is determined that the first authentication certificate is issued by the first issuing node, the mobile network is accessed.
  • the user equipment of the first operator sends the first network authentication service node to the first network authentication service node. Access authentication information.
  • the first authentication certificate is extracted from the second access authentication message, and the first authentication certificate is verified.
  • the private key of the first authentication certificate is verified according to the public key in the preset first CA certificate, and the first authentication certificate is determined when the public key in the first CA certificate and the private key of the first authentication certificate match each other.
  • the certificate is issued by the first issuing node. Then, the identity authentication of the user equipment of the first operator to the first network authentication service node is completed. Then, the user equipment of the first operator is connected to the mobile network of the first operator.
  • the user equipment of the first operator is not connected to the mobile network of the first operator. This can improve the security and convenience of mobile network access.
  • FIG. 6 is a flowchart illustrating another method for accessing a mobile network according to an exemplary embodiment. 6, the method further includes the following steps:
  • step S601 the fifth access authentication information is sent to the second network authentication service node.
  • the second network authentication service node is the second network authentication service node 130 in the mobile network access system 100, and the fifth access authentication information includes the second UE certificate.
  • step S602 a sixth access authentication message sent by the second network authentication service node is received, where the sixth access authentication message includes the second authentication certificate and the first roaming permission certificate.
  • step S603 whether the first roaming license is issued by the first certificate issuing node is verified according to the public key in the preset first CA certificate, and the first roaming license is verified according to the public key of the second certificate issuing node in the first roaming license. Whether the second authentication certificate is issued by the second certificate issuing node.
  • step S604 when it is determined that the first roaming license is issued by the first certificate issuing node, and the second authentication certificate is issued by the second certificate issuing node, the mobile network is accessed.
  • the user equipment of the first operator may preset the USIM card with the first UE certificate issued by the first certificate issuing node and the second UE certificate issued by the second certificate issuing node.
  • the device When the device needs to roam to access the mobile network of the second operator, the device generates fifth access authentication information based on the second UE certificate, and sends the fifth access authentication information to the second network authentication service node.
  • the sixth access authentication message extract the second authentication certificate and the first roaming license certificate from the sixth access authentication message, and verify according to the public key in the preset first CA certificate. For the private key of the first roaming license, when it is determined that the public key in the first CA certificate matches the private key of the first roaming license, it is determined that the first roaming license is issued by the first certificate issuing node.
  • the user equipment of the first operator is not connected to the first certificate issuing node. Two operators' mobile networks.
  • the user equipment of the second operator can also use the same method to roam to access the mobile network of the first operator. It will not be repeated here.
  • the user equipment of the first operator can send an access authentication message to the second network authentication service node of the second operator, and then roam the user equipment of the first operator to the mobile network of the second operator , which improves the convenience of accessing the mobile network.
  • FIG. 7 is a block diagram of an electronic device 700 according to an exemplary embodiment.
  • the electronic device 700 may be provided as the above-mentioned user equipment.
  • the electronic device 700 may include: a processor 701 and a memory 702 .
  • the electronic device 700 may also include one or more of a multimedia component 703 , an input/output (I/O) interface 704 , and a communication component 705 .
  • I/O input/output
  • the processor 701 is configured to control the overall operation of the electronic device 700 to complete all or part of the steps in the above-mentioned method for accessing the mobile network on the user equipment side.
  • the memory 702 is used to store various types of data to support operations on the electronic device 700, such data may include, for example, instructions for any application or method operating on the electronic device 700, and application-related data, Such as contact data, messages sent and received, pictures, audio, video, and so on.
  • the memory 702 can be implemented by any type of volatile or non-volatile storage device or their combination, such as static random access memory (Static Random Access Memory, SRAM for short), electrically erasable programmable read-only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM for short), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (Read-Only Memory, ROM for short), magnetic memory, flash memory, magnetic disk or optical disk.
  • Multimedia components 703 may include screen and audio components. Wherein the screen can be, for example, a touch screen, and the audio component is used for outputting and/or inputting audio signals.
  • the audio component may include a microphone for receiving external audio signals.
  • the received audio signal may be further stored in memory 702 or transmitted through communication component 705 .
  • the audio assembly also includes at least one speaker for outputting audio signals.
  • the I/O interface 704 provides an interface between the processor 701 and other interface modules, and the above-mentioned other interface modules may be a keyboard, a mouse, a button, and the like. These buttons can be virtual buttons or physical buttons.
  • the communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, etc., or one or more of them The combination is not limited here. Therefore, the corresponding communication component 705 may include: Wi-Fi module, Bluetooth module, NFC module and so on.
  • the electronic device 700 may be implemented by one or more application-specific integrated circuits (Application Specific Integrated Circuit, ASIC for short), digital signal processors (Digital Signal Processor, DSP for short), digital signal processing devices (Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor or other electronic components
  • ASIC Application Specific Integrated Circuit
  • DSP Digital Signal Processor
  • DSP digital signal processing devices
  • DSPD Digital Signal Processing Device
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • controller microcontroller, microprocessor or other electronic components
  • microcontroller microprocessor or other electronic components
  • a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the foregoing method for accessing a mobile network on the user equipment side are implemented.
  • the computer-readable storage medium can be the above-mentioned memory 702 including program instructions, and the above-mentioned program instructions can be executed by the processor 701 of the electronic device 700 to complete the above-mentioned method for accessing the mobile network on the user equipment side.
  • FIG. 8 is a block diagram of an electronic device 1900 according to an exemplary embodiment.
  • the electronic device 1900 may be provided as a first network authentication service node in a mobile network access system.
  • the electronic device 1900 includes a processor 1922 , which may be one or more in number, and a memory 1932 for storing computer programs executable by the processor 1922 .
  • a computer program stored in memory 1932 may include one or more modules, each corresponding to a set of instructions.
  • the processor 1922 may be configured to execute the computer program to execute the above-mentioned method for accessing the mobile network on the node side of the first network authentication service.
  • the electronic device 1900 may also include a power supply assembly 1926, which may be configured to perform power management of the electronic device 1900, and a communication component 1950, which may be configured to enable communication of the electronic device 1900, eg, wired or wireless communication. Additionally, the electronic device 1900 may also include an input/output (I/O) interface 1958 . Electronic device 1900 may operate based on an operating system stored in memory 1932, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, and the like.
  • a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the above-mentioned first network authentication service node side mobile network access method is implemented. step.
  • the computer-readable storage medium can be the above-mentioned memory 1932 including program instructions, and the above-mentioned program instructions can be executed by the processor 1922 of the electronic device 1900 to complete the above-mentioned first network authentication service node side mobile network access method.
  • a computer program product comprising a computer program executable by a programmable apparatus, the computer program having, when executed by the programmable apparatus, for performing the above The code part of the mobile network access method on the first network authentication service node side.
  • the present disclosure also proposes a computing processing device, including:
  • One or more processors when the computer readable code is executed by the one or more processors, the computing processing device executes the aforementioned mobile network access method.
  • the present disclosure also proposes a computer program, comprising computer-readable codes, when the computer-readable codes are executed on a computing and processing device, causing the computing and processing device to perform the aforementioned connection of the mobile network enter method.
  • FIG. 9 provides a schematic structural diagram of a computing processing device according to an embodiment of the present disclosure.
  • the computing processing device typically includes a processor 1110 and a computer program product or computer readable medium in the form of a memory 1130 .
  • the memory 1130 may be electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the memory 1130 has storage space 1150 for program code 1151 for performing any of the method steps in the above-described methods.
  • the storage space 1150 for program codes may include various program codes 1151 for implementing various steps in the above methods, respectively.
  • the program codes can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as shown in FIG. 10 .
  • the storage unit may have storage segments, storage spaces, etc. arranged similarly to the memory 1130 in the computing processing device of FIG. 9 .
  • the program code may, for example, be compressed in a suitable form.
  • the storage unit includes computer readable code 1151', i.e. code readable by a processor such as 1110, for example, which when executed by a server, causes the server to perform the various steps in the methods described above.
  • a mobile network access system comprising a first network authentication service node and a first certificate issuing node in a blockchain network, wherein the first network authentication service node and the first certificate The issuing node belongs to the first operator;
  • the first certificate issuing node is configured to issue a first authentication certificate for indicating the identity of the first network authentication service node to the first network authentication service node, and issue a first authentication certificate to the user equipment of the first operator a first UE certificate for indicating the identity of the user equipment, and storing the first UE certificate revocation information and the first CA certificate indicating the identity of the first certificate issuing node in the blockchain;
  • the first network authentication service node is configured to obtain the first UE certificate revocation information and the first CA certificate from the blockchain, and receive the first certificate of the user equipment of the first operator.
  • two-way identity authentication is performed with the user equipment, and when the two-way identity authentication is completed, the user equipment is accessed to the mobile network.
  • system further comprises a second network authentication service node and a second certificate issuing node in the blockchain network, the second network authentication service node and the the second certificate issuing node belongs to the second operator;
  • the first certificate issuing node is further configured to write the first roaming license issued by the second certificate issuing node into the blockchain;
  • the second certificate issuing node is configured to issue a second authentication certificate for indicating the identity of the second network authentication service node to the second network authentication service node, and issue a second authentication certificate to the user equipment of the second operator a second UE certificate for indicating the identity of the user equipment, and storing the second UE certificate revocation information and the second CA certificate indicating the identity of the second certificate issuing node in the blockchain, and for the The second roaming license issued by the first certificate issuing node is written into the blockchain.
  • the first authentication certificate issued by the first certificate issuing node to the first network authentication service node is preset in the first network authentication service node or stored in the blockchain.
  • a mobile network access method is applied to a first network authentication service node in a mobile network access system, the method comprising:
  • sending a second access certificate to the user equipment of the first operator message the second access authentication message includes the first authentication certificate, and the first authentication certificate is used for the user equipment of the first operator to perform identity authentication on the first network authentication service node, and when the identity authentication is passed, the user equipment of the first operator is connected to the mobile network.
  • Embodiment 4 which is applied to the first network authentication service node in Embodiment 2, the method further comprising:
  • the second UE certificate, the first roaming license, and the second roaming license verify the first CA certificate according to the public key in the first CA certificate Whether the first roaming license is issued by the first certificate issuing node, and whether the second UE certificate is issued by the second certificate is verified according to the public key of the second certificate issuing node in the second roaming license Issuing node issued;
  • the device upon determining that the first roaming license was issued by the first certificate issuing node and the second UE certificate was issued by the second certificate issuing node, to the user of the second operator
  • the device sends a fourth access authentication message, where the fourth access authentication message includes the first authentication certificate and the first roaming authorization certificate, and the first authentication certificate and the first roaming authorization certificate are used for all
  • the user equipment of the second operator performs identity authentication on the first network authentication service node, and if the identity authentication is passed, accesses the user equipment of the second operator to the mobile network.
  • a method for accessing a mobile network the method being applied to a user equipment of a first operator, the method comprising:
  • the first network authentication service node is the first network authentication service node in the system according to any one of Embodiments 1-3, and the first access authentication information includes the first UE certificate;
  • the mobile network is accessed.
  • the authentication information includes the second UE certificate
  • Accessing the mobile network in a case where it is determined that the first roaming certificate is issued by the first certificate issuing node and the second authentication certificate is issued by the second certificate issuing node.
  • a network authentication server storage medium on which a computer program is stored, and when the program is executed by a processor, implements the steps of the mobile network access method described in Embodiment 4 or 5.
  • a user equipment storage medium on which a computer program is stored, and when the program is executed by a processor, implements the steps of the mobile network access method described in Embodiment 6 or 7.
  • a network authentication server comprising:
  • the processor is configured to execute the computer program in the memory to implement the steps of the mobile network access method in Embodiment 4 or 5.
  • a user equipment comprising:
  • the processor is configured to execute the computer program in the memory to implement the steps of the mobile network access method in Embodiment 6 or 7.
  • a computer program comprising computer readable code which, when the computer readable code is run on a computing processing device, causes the computing processing device to perform the method according to embodiment 4 or 5, or causes the The computing processing device executes the method according to Embodiment 6 or 7.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开涉及一种移动网络接入系统、方法、存储介质及电子设备，该系统包括：处于区块链网络中的第一网络认证服务节点、第一证书颁发节点，第一网络认证服务节点和第一证书颁发节点属于第一运营商；第一证书颁发节点用于向第一网络认证服务节点颁发用于表明第一网络认证服务节点身份的第一认证证书，向第一运营商的用户设备颁发用于表明该用户设备身份的第一UE证书，将第一UE证书撤销信息和表明第一证书颁发节点身份的第一CA证书存储到区块链中；第一网络认证服务节点用于从区块链中获取第一UE证书撤销信息以及第一CA证书，在接收到用户设备的第一接入认证消息时，与用户设备进行双向身份认证，在认证完成时，接入用户设备到移动网络。

Description

移动网络接入系统、方法、存储介质及电子设备
相关申请的交叉引用
本公开要求在2020年11月27日提交中国专利局、申请号为202011359296.8、名称为“移动网络接入系统、方法、存储介质及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本公开涉及信息技术领域，具体地，涉及一种移动网络接入系统、方法、存储介质及电子设备。
背景技术
在2G/3G/4G移动通信网络中，UE(User Equipment用户设备)接入移动网络的认证均是基于对称密码机制，即加密(Encryption)与解密(Decryption)使用同样的密钥，移动运营商和用户设备使用同样密钥，导致移动通信安全性得不到保证。此外，用户每次使用对称加密算法进行移动网络接入请求时，需要使用其他人不知道的惟一密钥，使得移动运营商以及用户设备所拥有的密钥的数量呈几何级数增长，增加了移动运营商以及用户设备密钥管理的负担。
因而，在5G移动通信网络中，引入了基于非对称密码机制的接入认证方法，即使用了一对密钥，公钥(Public Key)和私钥(Private Key)。私钥为唯一的密钥，由移动运营商安全保管，不能外泄，公钥发给任何请求接入的用户设备，非对称加密机制使用一对密钥中的进行加密，可以提升移动通信的安全性，并减少密钥管理的负担。但是，非对称虽然使用了一对密钥，但是，若用户设备非法获得了鉴权服务器的公钥，则可以非法接入移动网络，移动网络接入的安全性同样较低。
发明内容
本公开的目的是提供一种移动网络接入系统、方法、存储介质及电子设备，以解决终端设备接入移动网络的安全性较低的问题。
为了实现上述目的，本公开实施例的第一方面，提供一种移动网络接入系统，所述系统包括处于区块链网络中的第一网络认证服务节点、第一证书颁发节点，其中，所述 第一网络认证服务节点以及所述第一证书颁发节点属于第一运营商；
所述第一证书颁发节点用于向所述第一网络认证服务节点颁发用于表明所述第一网络认证服务节点的身份的第一认证证书，以及向所述第一运营商的用户设备颁发用于表明该第一运营商的用户设备的身份的第一UE证书，以及将第一UE证书撤销信息和表明所述第一证书颁发节点的身份的第一CA证书存储到区块链中；
所述第一网络认证服务节点用于从所述区块链中获取所述第一UE证书撤销信息以及所述第一CA证书，并在接收到所述第一运营商的用户设备的第一接入认证消息的情况下，与该第一运营商的用户设备进行双向身份认证，在所述双向身份认证完成的情况下，接入该第一运营商的用户设备到所述移动网络。
可选地，所述系统还包括处于所述区块链网络中的第二网络认证服务节点以及第二证书颁发节点，所述第二网络认证服务节点以及所述第二证书颁发节点属于第二运营商；
所述第一证书颁发节点还用于，将为所述第二证书颁发节点颁发的第一漫游许可证书写入所述区块链；
所述第二证书颁发节点用于向所述第二网络认证服务节点颁发用于表明所述第二网络认证服务节点的身份的第二认证证书，以及向所述第二运营商的用户设备颁发用于表明该第二运营商的用户设备的身份的第二UE证书，以及将第二UE证书撤销信息和表明所述第二证书颁发节点的身份的第二CA证书存储到区块链中，以及将为所述第一证书颁发节点颁发的第二漫游许可证书写入所述区块链。
可选地，所述第一CA证书以及所述第一证书颁发节点向第一运营商的用户设备颁发的所述第一UE证书预置在该第一运营商的用户设备的身份识别卡中；
所述第一证书颁发节点向所述第一网络认证服务节点颁发的所述第一认证证书预置在所述第一网络认证服务节点中或者存储在所述区块链中。
本公开实施例的第二方面，提供一种移动网络接入方法，所述方法应用于第一方面所述的系统中的第一网络认证服务节点，所述方法包括：
接收所述第一运营商的用户设备发送的第一接入认证信息，其中，所述第一接入认证信息包括所述第一UE证书；
从所述区块链中获取所述第一UE证书撤销信息以及所述第一CA证书；
根据所述第一CA证书中的公钥验证所述第一UE证书是否由所述第一证书颁发节点颁发，并根据所述第一UE证书撤销信息确定所述第一UE证书是否被撤销；
在确定所述第一UE证书由所述第一证书颁发节点颁发，且所述第一UE证书未被撤销的情况下，向所述第一运营商的用户设备发送第二接入认证消息，所述第二接入认证消息包括所述第一认证证书，所述第一认证证书用于所述第一运营商的用户设备对所述第一网络认证服务节点进行身份认证，并在所述身份认证通过的情况下，接入所述第一运营商的用户设备到所述移动网络。
可选地，所述方法应用于所述移动网络接入系统中的第一网络认证服务节点，所述方法还包括：
接收所述第二运营商的用户设备发送的第三接入认证信息，其中，所述第三接入认证信息包括所述第二UE证书；
从所述区块链中获取所述第一CA证书、所述第一漫游许可证书、所述第二漫游许可证书；
在获取到所述第一CA证书、所述第二UE证书、所述第一漫游许可证书以及所述第二漫游许可证书的情况下，根据所述第一CA证书中的公钥验证所述第一漫游许可证书是否由所述第一证书颁发节点颁发，根据所述第二漫游许可证书中的所述第二证书颁发节点的公钥验证所述第二UE证书是否由所述第二证书颁发节点颁发；
在确定所述第一漫游许可证书由所述第一证书颁发节点颁发，且所述第二UE证书由所述第二证书颁发节点颁发的情况下，向所述第二运营商的用户设备发送第四接入认证消息，所述第四接入认证消息包括所述第一认证证书以及所述第一漫游许可证书，所述第一认证证书以及所述第一漫游许可证书用于所述第二运营商的用户设备对所述第一网络认证服务节点进行身份认证，在所述身份认证通过的情况下，接入所述第二运营商的用户设备到所述移动网络。
本公开实施例的第三方面，提供一种移动网络接入方法，所述方法应用于第一运营商的用户设备，所述方法包括：
向第一网络认证服务节点发送第一接入认证信息，其中，所述第一网络认证服务节点为第一方面所述的系统中的所述第一网络认证服务节点，所述第一接入认证信息包括所述第一UE证书；
接收所述第一网络认证服务节点发送的第二接入认证消息，所述第二接入认证消息包括所述第一认证证书；
根据预置的所述第一CA证书中的公钥验证所述第一认证证书是否由所述第一颁发 节点颁发；
在确定所述第一认证证书由所述第一颁发节点颁发的情况下，接入所述移动网络。
可选地，所述方法还包括：
向第二网络认证服务节点发送第五接入认证信息，其中，所述第二网络认证服务节点为所述移动网络接入系统中的所述第二网络认证服务节点，所述第五接入认证信息包括所述第二UE证书；
接收所述第二网络认证服务节点发送的第六接入认证消息，所述第六接入认证消息包括所述第二认证证书以及所述第一漫游许可证书；
根据预置的所述第一CA证书中的公钥验证所述第一漫游许可证书是否由所述第一证书颁发节点颁发，根据所述第一漫游许可证书中的所述第二证书颁发节点的公钥验证所述第二认证证书是否由所述第二证书颁发节点颁发；
在确定所述第一漫游许可证书由所述第一证书颁发节点颁发，且所述第二认证证书由所述第二证书颁发节点颁发的情况下，接入所述移动网络。
本公开实施例的第四方面，提供一种网络认证服务器存储介质，其上存储有计算机程序，该程序被处理器执行时实现第二方面所述方法的步骤。
本公开实施例的第五方面，提供一种用户设备存储介质，其上存储有计算机程序，该程序被处理器执行时实现第三方面所述方法的步骤。
本公开实施例的第六方面，提供一种网络认证服务器，包括：
存储器，其上存储有计算机程序；
处理器，用于执行所述存储器中的所述计算机程序，以实现第二方面所述方法的步骤。
本公开实施例的第七方面，提供一种用户设备，包括：
存储器，其上存储有计算机程序；
处理器，用于执行所述存储器中的所述计算机程序，以实现第三方面所述方法的步骤。
本公开实施例的第八方面，提供一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算处理设备上运行时，导致所述计算处理设备执行本公开第二方面或者第三方面实施例所提出的方法。
通过上述技术方案，至少可以达到以下有益效果：
通过第一证书颁发节点向第一网络认证服务节点颁发用于表明第一网络认证服务节点的身份的第一认证证书，以及向第一运营商的用户设备颁发用于表明该第一运营商的用户设备的身份的第一UE证书，以及将第一UE证书撤销信息和表明所述第一证书颁发节点的身份的第一CA证书存储到区块链中；并通过第一网络认证服务节点从区块链中获取第一UE证书撤销信息以及第一CA证书，并在接收到第一运营商的用户设备的第一接入认证消息的情况下，与该第一运营商的用户设备进行双向身份认证，在双向身份认证完成的情况下，接入该第一运营商的用户设备到移动网络。第一运营商的用户设备可以就近进行移动网络接入认证，并且提高了移动网络接入的安全性。此外，可以在私有或隔离部署的移动网络中实现终端设备的接入，提高了移动网络接入的便捷性。
本公开的其他特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
附图是用来提供对本公开的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本公开，但并不构成对本公开的限制。在附图中：
图1是根据一示例性实施例示出的一种移动网络接入系统的框图。
图2是根据一示例性实施例示出的另一种移动网络接入系统的框图。
图3是根据一示例性实施例示出的一种移动网络的接入方法的流程图。
图4是根据一示例性实施例示出的另一种移动网络的接入方法的流程图。
图5是根据一示例性实施例示出的一种移动网络的接入方法的流程图。
图6是根据一示例性实施例示出的另一种移动网络的接入方法的流程图。
图7是根据一示例性实施例示出的一种电子设备700的框图。
图8是根据一示例性实施例示出的一种电子设备1900的框图。
图9为本公开实施例提供了一种计算处理设备的结构示意图。
图10为本公开实施例提供了一种用于便携式或者固定实现根据本公开的方法的程序代码的存储单元的示意图。
具体实施方式
以下结合附图对本公开的具体实施方式进行详细说明。应当理解的是，此处所描述的具体实施方式仅用于说明和解释本公开，并不用于限制本公开。
需要说明的是，在本公开中，说明书和权利要求书以及附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必理解为描述特定的顺序或先后次序。同理，术语“S301”、“S401”等用于区别步骤，而不必理解为按照特定的顺序或先后次序执行方法步骤。
在介绍本公开提供的移动网络接入系统、方法、存储介质及电子设备之前，首先对本公开的应用场景进行介绍。本公开提供的移动网络接入系统可以允许用户设备在通过EAP-TLS认证协议完成认证后接入运营商的移动网络，其中，用户设备例如可以是智能手机，智能手表，智能手环等具备移动通讯功能的电子设备。
发明人发现，相关技术在接入认证时，虽然采用了非对称密钥，但是，若用户设备非法获得了鉴权服务器的公钥，则可以非法接入移动网络，移动网络接入的安全性同样较低。并且，相关技术中，UE只能支持对应移动网络的接入，无法在不同的运营商的移动网络之间漫游，因而，在UE处于没有对应的运营商的移动网络的情况下，即使UE所处地区存在其他运营商的移动网络，UE也无法接入该移动网络，也会导致UE接入移动网络不便捷。
为解决上述技术问题，本公开提供一种移动网络接入系统。图1是根据一示例性实施例示出的一种移动网络接入系统的框图，该系统100用于执行移动网络接入。如图1所示，所述系统100包括：处于区块链网络中的第一网络认证服务节点110、第一证书颁发节点120，其中，第一网络认证服务节点110以及第一证书颁发节点120属于第一运营商。
其中，第一证书颁发节点120用于向第一网络认证服务节点110颁发用于表明第一网络认证服务节点110的身份的第一认证证书，以及向第一运营商的用户设备颁发用于表明该用户设备的身份的第一UE证书，以及将第一UE证书撤销信息和表明所述第一证书颁发节点的身份的第一CA证书存储到区块链中；
第一网络认证服务节点110用于从区块链中获取第一UE证书撤销信息以及第一CA证书，并在接收到第一运营商的用户设备的第一接入认证消息的情况下，与该用户设备进行双向身份认证，在双向身份认证完成的情况下，接入该用户设备到所述移动网络。
第一网络认证服务节点110可以是AUSF((Authentication Server Function，鉴权服务器功能)，第一网络认证服务节点110与区块链的任一区块链节点通信连接，并可以从区块链获取第一UE证书撤销信息以及第一CA证书。
可选地，第一网络认证服务节点110可以通过EAP-TLS的认证协议与第一运营商的用户设备进行双向身份认证。第一运营商的用户设备可以优先与距离最近的第一网络认证服务节点110建立通信，进而与其进行双向身份认证。
可选地，第一证书颁发节点120还用于颁发第一UE证书撤销信息，第一UE证书撤销信息用于表征相应的第一UE证书失效。
可选地，第一CA证书以及第一证书颁发节点120向用户设备颁发的第一UE证书预置在该用户设备的身份识别卡中。具体地，该身份识别卡可以是USIM卡，USIM卡在出厂时存储由第一证书颁发节点120颁发的第一UE证书。进一步地，在该USIM卡安装到用户设备后，用户设备可以基于该第一UE证书生成私钥。该身份识别卡也可以是eSIM卡，在用户选择运营商套餐后，用户设备可以基于该第一UE证书生成私钥。
可选地，第一网络认证服务节点110和第一证书颁发节点120可以作为区块链网络的一个节点。
可选地，第一证书颁发节点120向第一网络认证服务节点110颁发的第一认证证书预置在第一网络认证服务节点110中或者存储在所述区块链中。
示例地，第一证书颁发节点120将表明自身身份的第一CA证书存储到区块链，可选地，也可以将该第一CA证书存储到任意第一网络认证服务节点110。并且，第一证书颁发节点120颁发表明第一运营商的用户设备的身份的第一UE证书，其中，第一UE证书与第一CA证书相对应。这样，在第一运营商的用户设备通过EAP-TLS的认证协议与第一网络认证服务节点110进行接入认证时，可以将第一UE证书与第一CA证书进行匹配。
进一步地，第一运营商可以通过第一证书颁发节点120颁发第一UE证书撤销信息，这样，区块链或者第一网络认证服务节点110可以基于多个第一UE证书撤销信息可以构成撤销列表，在接收到第一运营商的用户设备的第一接入认证信息的情况下，第一网络认证服务节点110可以通过撤销列表确定该第一运营商的用户设备是否被取消接入资格。
若第一网络认证服务节点110在确定撤销列表中存在该第一运营商的用户设备的第一UE证书撤销信息的情况下，生成用户设备撤销信息，并向该用户设备反馈该用户设备撤销信息。这样，便于用户及时了解到该用户设备的第一UE证书被撤销。
进一步地，第一网络认证服务节点110在确定撤销列表中不存在该第一运营商的用 户设备的第一UE证书撤销信息，且第一UE证书与第一CA证书相互匹配的情况下，接入该用户设备到所述移动网络。
通过第一证书颁发节点向第一网络认证服务节点颁发用于表明第一网络认证服务节点的身份的第一认证证书，以及向第一运营商的用户设备颁发用于表明该用户设备的身份的第一UE证书，以及将第一UE证书撤销信息和表明所述第一证书颁发节点的身份的第一CA证书存储到区块链中；并通过第一网络认证服务节点从区块链中获取第一UE证书撤销信息以及第一CA证书，并在接收到第一运营商的用户设备的第一接入认证消息的情况下，与该用户设备进行双向身份认证，在双向身份认证完成的情况下，接入该用户设备到所述移动网络。第一运营商的用户设备可以就近进行移动网络接入认证，并且提高了移动网络接入的安全性。此外，可以在私有或隔离部署的移动网络中实现终端设备的接入，提高了移动网络接入的便捷性。
可选地，参考图2是所示的另一种移动网络接入系统的框图，如图2所示，所述系统100还包括处于区块链网络中的第二网络认证服务节点130以及第二证书颁发节点140，第二网络认证服务节点130以及第二证书颁发节点140属于第二运营商；
第一证书颁发节点120还用于，将为第二证书颁发节点140颁发的第一漫游许可证书写入区块链；
第二证书颁发节点140用于向第二网络认证服务节点130颁发用于表明第二网络认证服务节点130的身份的第二认证证书，以及向第二运营商的用户设备颁发用于表明该用户设备的身份的第二UE证书，以及将第二UE证书撤销信息和表明第二证书颁发节点140的身份的第二CA证书存储到区块链中，以及将为第一证书颁发节点120颁发的第二漫游许可证书写入区块链。
可选地，第一网络认证服务节点110、第一证书颁发节点120第二网络认证服务节点130和第二证书颁发节点140可以作为区块链网络的一个节点。
具体实施时，第一运营商和第二运营商需要达成漫游协议，并且第一运营商通过第一证书颁发节点120为第二证书颁发节点140颁发的第一漫游许可证书，并且第二运营商通过第二证书颁发节点140为第一证书颁发节点120颁发的第二漫游许可证书。第一证书颁发节点120将第一漫游许可证书上传到区块链存储，第二证书颁发节点140将第二漫游许可证书上传到区块链存储。
进一步地，第二证书颁发节点140颁发表明第二证书颁发节点140的身份的第二CA 证书，用户设备的USIM卡内预置有第一证书颁发节点120颁发的第一UE证书以及第二证书颁发节点140颁发的第二UE证书。
进一步地，第一证书颁发节点120将颁发的第一UE证书撤销信息写入到区块链网络中，第二证书颁发节点140将颁发的第二UE证书撤销信息也写入到区块链网络中，进而在区块链网络中根据多个第一UE证书撤销信息和多个第二UE证书撤销信息构建成撤销列表。进而，在任意网络认证服务节点接收到任意用户设备发送的接入认证信息的情况下，相应的网络认证服务节点可以从区块链的撤销列表中确定是否存在相应的UE证书撤销信息，从而确定该用户设备的第一UE证书或者第二UE证书是否被撤销。
值得说明的是，本公开实施例的系统并不局限于第5代移动通信网络，在其他采用类似基于证书的认证接入方式的场景，均可采用此系统，以实现单一服务主体或跨服务主体的接入认证。
采用上述系统，可以实现UE在不同运营商的移动网络的漫游就近接入，在弥补基于EAP-TLS认证方式下不支持UE在不同运营商的移动网络漫游的缺陷的同时，也避免了接入认证必须到UE归属地进行认证带来的不便以及资源开销，提高了终端设备接入移动网络的便捷性。
基于相同的发明构思，本公开还提供一种移动网络的接入方法，所述方法应用于移动网络接入系统中的第一网络认证服务节点，图3是根据一示例性实施例示出的一种移动网络的接入方法的流程图。参照图3，所述方法包括以下步骤：
在步骤S301中，接收第一运营商的用户设备发送的第一接入认证信息。
其中，所述第一接入认证信息包括所述第一UE证书；
在步骤S302中，从区块链中获取第一UE证书撤销信息以及第一CA证书。
在步骤S303中，根据第一CA证书中的公钥验证第一UE证书是否由第一证书颁发节点颁发，并根据第一UE证书撤销信息确定第一UE证书是否被撤销。
在步骤S304中，在确定第一UE证书由第一证书颁发节点颁发，且第一UE证书未被撤销的情况下，向第一运营商的用户设备发送第二接入认证消息。
其中，第二接入认证消息包括第一认证证书，第一认证证书用于第一运营商的用户设备对第一网络认证服务节点进行身份认证，并在身份认证通过的情况下，接入第一运营商的用户设备到移动网络。
具体实施时，第一网络认证服务节点从第一接入认证信息中提取第一UE证书，进 而基于第一UE证书查找区块链的撤销列表中是否存在该第一运营商的用户设备的UE证书撤销信息。
可选地，第一网络认证服务节点在确定区块链的撤销列表中存在该第一运营商的用户设备的UE证书撤销信息的情况下，确定该第一运营商的用户设备已被撤销，进而生成相应的用户设备撤销信息，并向该用户设备反馈该用户设备撤销信息。这样，便于用户及时了解到该用户设备的第一UE证书被撤销，该用户设备无法接入到移动网络。
进一步地，第一网络认证服务节点在确定区块链的撤销列表中不存在该第一运营商的UE证书撤销信息的情况下，确定该第一运营商的用户设备未被撤销。
进一步地，第一网络认证服务节点在确定该第一运营商的用户设备未被撤销的情况下，从第一CA证书中获取公钥，并根据该公钥验证第一UE证书是否由第一证书颁发节点颁发。例如，可以根据该公钥验证第一UE证书的私钥，若该公钥与私钥相匹配，则确定第一UE证书由第一证书颁发节点颁发。
进一步地，第一网络认证服务节点在确定第一UE证书由第一证书颁发节点颁发的情况下，生成第二接入认证消息，并向第一运营商的用户设备发送该第二接入认证消息，以便于第一运营商的用户设备根据第一认证证书的私钥验证第一网络认证服务节点的身份。从而实现第一网络认证服务节点对第一运营商的用户设备的身份认证。这样，可以提高移动网络接入的安全性和便捷性。
可选地，图4是根据一示例性实施例示出的另一种移动网络的接入方法的流程图。参照图4，所述方法还包括以下步骤：
在步骤S401中，接收第二运营商的用户设备发送的第三接入认证信息。
其中，所述第三接入认证信息包括所述第二UE证书。
在步骤S402中，从区块链中获取第一CA证书、第一漫游许可证书、以及第二漫游许可证书。
在步骤S403中，在获取到第一CA证书、第二UE证书、第一漫游许可证书以及第二漫游许可证书的情况下，根据第一CA证书中的公钥验证第一漫游许可证书是否由第一证书颁发节点颁发，根据第二漫游许可证书中的第二证书颁发节点的公钥验证第二UE证书是否由第二证书颁发节点颁发。
在步骤S404中，在确定第一漫游许可证书由第一证书颁发节点颁发，且第二UE证书由第二证书颁发节点颁发的情况下，向第二运营商的用户设备发送第四接入认证消息。
其中，第四接入认证消息包括第一认证证书以及第一漫游许可证书，第一认证证书以及第一漫游许可证书用于第二运营商的用户设备对第一网络认证服务节点进行身份认证，在身份认证通过的情况下，接入第二运营商的用户设备到移动网络。
具体实施时，在第二运营商的用户设备的身份识别卡预置有第一证书颁发节点颁发的第一UE证书以及第二证书颁发节点颁发的第二UE证书。示例地，在USIM卡安装到第二运营商的用户设备后，第二运营商的用户设备可以基于该第一UE证书生成第一私钥，基于该第二UE证书生成第二私钥。第二运营商的用户设备基于EAP-TLS的认证协议向第一运营商的第一网络认证服务节点发送第三接入认证信息，第一网络认证服务节点在接收到该第三接入认证信息时，从第三接入认证信息中提取第二UE证书。
进一步地，在提取到第二UE证书的情况下，从区块链中获取第一CA证书、第一漫游许可证书、以及第二漫游许可证书，进而根据第一CA证书中的公钥验证第一漫游许可证书是否由第一证书颁发节点颁发，根据第二漫游许可证书中的第二证书颁发节点的公钥验证第二UE证书是否由第二证书颁发节点颁发。
例如，可以根据第一CA证书中的公钥验证第一漫游许可证书的私钥，若该公钥与私钥相匹配，则确定第一漫游许可证书由第一证书颁发节点颁发，并可以根据第二漫游许可证书中的第二证书颁发节点的公钥验证第二UE证书的私钥，若该公钥与私钥相匹配，则确定第二UE证书由第二证书颁发节点颁发。
进一步地，第一网络认证服务节点生成第四接入认证消息，并将该第四接入认证消息发送到第二运营商的用户设备，以便于第二运营商的用户设备根据第一认证证书的私钥以及第一漫游许可证书的私钥，验证第一网络认证服务节点的身份。
进一步地，在确定第一漫游许可证书不是由第一证书颁发节点颁发的情况下，即第一CA证书中的公钥与第一漫游许可证书的私钥不匹配，或者第二UE证书不是由第二证书颁发节点颁发的情况下，即第二漫游许可证书中的第二证书颁发节点的公钥与第二UE证书的私钥不匹配，第一网络认证服务节点生成非法接入信息，并向第二运营商的用户设备发送该非法接入信息，以便用户及时了解接入认证失败的信息。
值得说明的是，第一运营商的用户设备也可以在身份识别卡预置有第一证书颁发节点颁发的第一UE证书以及第二证书颁发节点颁发的第二UE证书，进而可以向第二运营商的第二网络认证服务节点发送接入认证消息，进而将第一运营商的用户设备漫游到第二运营商的移动网络中。
采用上述技术方案，可以将第二运营商的用户设备漫游接入第一运营商的移动网络中，从而增加了实现UE在不同运营商的移动网络的漫游就近接入，提高了终端设备接入移动网络的便捷性。
基于相同的发明构思，本公开还提供一种移动网络的接入方法，所述方法应用于第一运营商的用户设备，图5是根据一示例性实施例示出的一种移动网络的接入方法的流程图。参照图5，所述方法包括以下步骤：
在步骤S501中，向第一网络认证服务节点发送第一接入认证信息。
其中，第一网络认证服务节点为移动网络接入系统100中的第一网络认证服务节点110，第一接入认证信息包括第一UE证书。
在步骤S502中，接收第一网络认证服务节点发送的第二接入认证消息，第二接入认证消息包括所述第一认证证书。
在步骤S503中，根据预置的第一CA证书中的公钥验证第一认证证书是否由第一颁发节点颁发。
在步骤S504中，在确定第一认证证书由第一颁发节点颁发的情况下，接入移动网络。
示例地，在用户设备装入USIM卡后，或者在用户设备在移动网络断开连接后，重新接入移动网络的情况下，第一运营商的用户设备向第一网络认证服务节点发送第一接入认证信息。
进一步地，在接收到第一网络认证服务节点发送的第二接入认证消息的情况下，从第二接入认证消息中提取第一认证证书，并对第一认证证书进行验证。例如，根据预置的第一CA证书中的公钥验证第一认证证书的私钥，在第一CA证书中的公钥与第一认证证书的私钥相互匹配的情况下，确定第一认证证书由第一颁发节点颁发。进而完成第一运营商的用户设备对第一网络认证服务节点的身份认证。进而将第一运营商的用户设备接入第一运营商的移动网络中。
进一步地，在确定第一认证证书不是由第一颁发节点颁发的情况下，不将第一运营商的用户设备接入第一运营商的移动网络。这样可以提高移动网络接入的安全性和便捷性。
可选地，图6是根据一示例性实施例示出的另一种移动网络的接入方法的流程图。参照图6，所述方法还包括以下步骤：
在步骤S601中，向第二网络认证服务节点发送第五接入认证信息。
其中，第二网络认证服务节点为移动网络接入系统100中的第二网络认证服务节点130，第五接入认证信息包括第二UE证书。
在步骤S602中，接收第二网络认证服务节点发送的第六接入认证消息，第六接入认证消息包括第二认证证书以及第一漫游许可证书。
在步骤S603中，根据预置的第一CA证书中的公钥验证第一漫游许可证书是否由第一证书颁发节点颁发，根据第一漫游许可证书中的第二证书颁发节点的公钥验证第二认证证书是否由第二证书颁发节点颁发。
在步骤S604中，在确定第一漫游许可证书由第一证书颁发节点颁发，且第二认证证书由第二证书颁发节点颁发的情况下，接入移动网络。
具体实施时，第一运营商的用户设备可以在USIM卡预置有第一证书颁发节点颁发的第一UE证书以及第二证书颁发节点颁发的第二UE证书，在确定第一运营商的用户设备需要漫游接入第二运营商的移动网络的情况下，基于第二UE证书生成第五接入认证信息，并向第二网络认证服务节点发送第五接入认证信息。
进一步地，在接收到第六接入认证消息的情况下，从第六接入认证消息中提取第二认证证书以及第一漫游许可证书，并根据预置的第一CA证书中的公钥验证第一漫游许可证书的私钥，在确定第一CA证书中的公钥与第一漫游许可证书的私钥相互匹配的情况下，确定第一漫游许可证书由第一证书颁发节点颁发。
进一步地，根据第一漫游许可证书中的第二证书颁发节点的公钥验证第二认证证书的私钥，在确定第一漫游许可证书中的第二证书颁发节点的公钥与第二认证证书的私钥相互匹配的情况下，确定第二认证证书由第二证书颁发节点颁发。
进一步地，在确定第一漫游许可证书不是由第一证书颁发节点颁发，或者在确定第二认证证书不是由第二证书颁发节点颁发的情况下，不将第一运营商的用户设备接入第二运营商的移动网络。
值得说明的是，第二运营商的用户设备也可以采用相同的方法漫游接入第一运营商的移动网络中。此处不再赘述。
采用上述技术方案，第一运营商的用户设备可以向第二运营商的第二网络认证服务节点发送接入认证消息，进而将第一运营商的用户设备漫游到第二运营商的移动网络中，提高了接入移动网络的便捷性。
基于相同的发明构思，本公开实施例还提供一种电子设备700，图7是根据一示例性 实施例示出的一种电子设备700的框图。可选地，该电子设备700可以被提供为一上述的用户设备，如图7所示，该电子设备700可以包括：处理器701，存储器702。该电子设备700还可以包括多媒体组件703，输入/输出(I/O)接口704，以及通信组件705中的一者或多者。
其中，处理器701用于控制该电子设备700的整体操作，以完成上述的用户设备侧的移动网络的接入方法中的全部或部分步骤。存储器702用于存储各种类型的数据以支持在该电子设备700的操作，这些数据例如可以包括用于在该电子设备700上操作的任何应用程序或方法的指令，以及应用程序相关的数据，例如联系人数据、收发的消息、图片、音频、视频等等。该存储器702可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，例如静态随机存取存储器(Static Random Access Memory，简称SRAM)，电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，简称EEPROM)，可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，简称EPROM)，可编程只读存储器(Programmable Read-Only Memory，简称PROM)，只读存储器(Read-Only Memory，简称ROM)，磁存储器，快闪存储器，磁盘或光盘。多媒体组件703可以包括屏幕和音频组件。其中屏幕例如可以是触摸屏，音频组件用于输出和/或输入音频信号。例如，音频组件可以包括一个麦克风，麦克风用于接收外部音频信号。所接收的音频信号可以被进一步存储在存储器702或通过通信组件705发送。音频组件还包括至少一个扬声器，用于输出音频信号。I/O接口704为处理器701和其他接口模块之间提供接口，上述其他接口模块可以是键盘，鼠标，按钮等。这些按钮可以是虚拟按钮或者实体按钮。通信组件705用于该电子设备700与其他设备之间进行有线或无线通信。无线通信，例如Wi-Fi，蓝牙，近场通信(Near Field Communication，简称NFC)，2G、3G、4G、NB-IOT、eMTC、或其他5G等等，或它们中的一种或几种的组合，在此不做限定。因此相应的该通信组件705可以包括：Wi-Fi模块，蓝牙模块，NFC模块等等。
在一示例性实施例中，电子设备700可以被一个或多个应用专用集成电路(Application Specific Integrated Circuit，简称ASIC)、数字信号处理器(Digital Signal Processor，简称DSP)、数字信号处理设备(Digital Signal Processing Device，简称DSPD)、可编程逻辑器件(Programmable Logic Device，简称PLD)、现场可编程门阵列(Field Programmable Gate Array，简称FPGA)、控制器、微控制器、微处理器或其他电子元件 实现，用于执行上述的用户设备侧的移动网络的接入方法。
在另一示例性实施例中，还提供了一种包括程序指令的计算机可读存储介质，该程序指令被处理器执行时实现上述的用户设备侧的移动网络的接入方法的步骤。例如，该计算机可读存储介质可以为上述包括程序指令的存储器702，上述程序指令可由电子设备700的处理器701执行以完成上述的用户设备侧的移动网络的接入方法。
基于相同的发明构思，本公开实施例还提供一种电子设备1900，图8是根据一示例性实施例示出的一种电子设备1900的框图。可选地，电子设备1900可以被提供为一移动网络接入系统中的第一网络认证服务节点。参照图8，电子设备1900包括处理器1922，其数量可以为一个或多个，以及存储器1932，用于存储可由处理器1922执行的计算机程序。存储器1932中存储的计算机程序可以包括一个或一个以上的每一个对应于一组指令的模块。此外，处理器1922可以被配置为执行该计算机程序，以执行上述的第一网络认证服务节点侧的移动网络的接入方法。
另外，电子设备1900还可以包括电源组件1926和通信组件1950，该电源组件1926可以被配置为执行电子设备1900的电源管理，该通信组件1950可以被配置为实现电子设备1900的通信，例如，有线或无线通信。此外，该电子设备1900还可以包括输入/输出(I/O)接口1958。电子设备1900可以操作基于存储在存储器1932的操作系统，例如Windows ServerTM，Mac OS XTM，UnixTM，LinuxTM等等。
在另一示例性实施例中，还提供了一种包括程序指令的计算机可读存储介质，该程序指令被处理器执行时实现上述的第一网络认证服务节点侧的移动网络的接入方法的步骤。例如，该计算机可读存储介质可以为上述包括程序指令的存储器1932，上述程序指令可由电子设备1900的处理器1922执行以完成上述的第一网络认证服务节点侧的移动网络的接入方法。
在另一示例性实施例中，还提供一种计算机程序产品，该计算机程序产品包含能够由可编程的装置执行的计算机程序，该计算机程序具有当由该可编程的装置执行时用于执行上述的第一网络认证服务节点侧的移动网络的接入方法的代码部分。
为了实现上述实施例，本公开还提出了一种计算处理设备，包括：
存储器，其中存储有计算机可读代码；以及
一个或多个处理器，当所述计算机可读代码被所述一个或多个处理器执行时，所述计算处理设备执行前述的移动网络的接入方法。
为了实现上述实施例，本公开还提出了一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算处理设备上运行时，导致所述计算处理设备执行前述的移动网络的接入方法。
本公开的前述计算机可读存储介质，其中存储了前述的计算机程序。
图9为本公开实施例提供了一种计算处理设备的结构示意图。该计算处理设备通常包括处理器1110和以存储器1130形式的计算机程序产品或者计算机可读介质。存储器1130可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器1130具有用于执行上述方法中的任何方法步骤的程序代码1151的存储空间1150。例如，用于程序代码的存储空间1150可以包括分别用于实现上面的方法中的各种步骤的各个程序代码1151。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如图10所示的便携式或者固定存储单元。该存储单元可以具有与图9的计算处理设备中的存储器1130类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码1151’，即可以由例如诸如1110之类的处理器读取的代码，这些代码当由服务器运行时，导致该服务器执行上面所描述的方法中的各个步骤。
以上结合附图详细描述了本公开的优选实施方式，但是，本公开并不限于上述实施方式中的具体细节，在本公开的技术构思范围内，可以对本公开的技术方案进行多种简单变型，这些简单变型均属于本公开的保护范围。
另外需要说明的是，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合，为了避免不必要的重复，本公开对各种可能的组合方式不再另行说明。
此外，本公开的各种不同的实施方式之间也可以进行任意组合，只要其不违背本公开的思想，其同样应当视为本公开所公开的内容。
实施例
1、一种移动网络接入系统，所述系统包括处于区块链网络中的第一网络认证服务节点、第一证书颁发节点，其中，所述第一网络认证服务节点以及所述第一证书颁发节点属于第一运营商；
所述第一证书颁发节点用于向所述第一网络认证服务节点颁发用于表明所述第一网络认证服务节点的身份的第一认证证书，以及向所述第一运营商的用户设备颁发用于表明该用户设备的身份的第一UE证书，以及将第一UE证书撤销信息和表明所述第一证书颁发节点的身份的第一CA证书存储到区块链中；
所述第一网络认证服务节点用于从所述区块链中获取所述第一UE证书撤销信息以及所述第一CA证书，并在接收到所述第一运营商的用户设备的第一接入认证消息的情况下，与该用户设备进行双向身份认证，在所述双向身份认证完成的情况下，接入该用户设备到所述移动网络。
2、根据实施例1所述的系统，其中，所述系统还包括处于所述区块链网络中的第二网络认证服务节点以及第二证书颁发节点，所述第二网络认证服务节点以及所述第二证书颁发节点属于第二运营商；
所述第一证书颁发节点还用于，将为所述第二证书颁发节点颁发的第一漫游许可证书写入所述区块链；
所述第二证书颁发节点用于向所述第二网络认证服务节点颁发用于表明所述第二网络认证服务节点的身份的第二认证证书，以及向所述第二运营商的用户设备颁发用于表明该用户设备的身份的第二UE证书，以及将第二UE证书撤销信息和表明所述第二证书颁发节点的身份的第二CA证书存储到区块链中，以及将为所述第一证书颁发节点颁发的第二漫游许可证书写入所述区块链。
3、根据实施例1或2所述的系统，其中，所述第一CA证书以及所述第一证书颁发节点向用户设备颁发的所述第一UE证书预置在该用户设备的身份识别卡中；
所述第一证书颁发节点向所述第一网络认证服务节点颁发的所述第一认证证书预置在所述第一网络认证服务节点中或者存储在所述区块链中。
4、一种移动网络接入方法，所述方法应用于移动网络接入系统中的第一网络认证服务节点，所述方法包括：
接收所述第一运营商的用户设备发送的第一接入认证信息，其中，所述第一接入认证信息包括所述第一UE证书；
从所述区块链中获取所述第一UE证书撤销信息以及所述第一CA证书；
根据所述第一CA证书中的公钥验证所述第一UE证书是否由所述第一证书颁发节点颁发，并根据所述第一UE证书撤销信息确定所述第一UE证书是否被撤销；
在确定所述第一UE证书由所述第一证书颁发节点颁发，且所述第一UE证书未被撤销的情况下，向所述第一运营商的所述用户设备发送第二接入认证消息，所述第二接入认证消息包括所述第一认证证书，所述第一认证证书用于所述第一运营商的所述用户设备对所述第一网络认证服务节点进行身份认证，并在所述身份认证通过的情况下，接入所述第一运营商的所述用户设备到所述移动网络。
5、根据实施例4所述的方法，所述方法应用于实施例2中的第一网络认证服务节点，所述方法还包括：
接收所述第二运营商的用户设备发送的第三接入认证信息，其中，所述第三接入认证信息包括所述第二UE证书；
从所述区块链中获取所述第一CA证书、所述第一漫游许可证书、所述第二漫游许可证书；
在获取到所述第一CA证书、所述第二UE证书、所述第一漫游许可证书以及所述第二漫游许可证书的情况下，根据所述第一CA证书中的公钥验证所述第一漫游许可证书是否由所述第一证书颁发节点颁发，根据所述第二漫游许可证书中的所述第二证书颁发节点的公钥验证所述第二UE证书是否由所述第二证书颁发节点颁发；
在确定所述第一漫游许可证书由所述第一证书颁发节点颁发，且所述第二UE证书由所述第二证书颁发节点颁发的情况下，向所述第二运营商的所述用户设备发送第四接入认证消息，所述第四接入认证消息包括所述第一认证证书以及所述第一漫游许可证书，所述第一认证证书以及所述第一漫游许可证书用于所述第二运营商的所述用户设备对所述第一网络认证服务节点进行身份认证，在所述身份认证通过的情况下，接入所述第二运营商的所述用户设备到所述移动网络。
6、一种移动网络接入方法，所述方法应用于第一运营商的用户设备，所述方法包括：
向第一网络认证服务节点发送第一接入认证信息，其中，所述第一网络认证服务节点为实施例1-3任一项所述的系统中的所述第一网络认证服务节点，所述第一接入认证信息包括所述第一UE证书；
接收所述第一网络认证服务节点发送的第二接入认证消息，所述第二接入认证消息包括所述第一认证证书；
根据预置的所述第一CA证书中的公钥验证所述第一认证证书是否由所述第一颁发节点颁发；
在确定所述第一认证证书由所述第一颁发节点颁发的情况下，接入所述移动网络。
7、根据实施例6所述的方法，所述方法还包括：
向第二网络认证服务节点发送第五接入认证信息，其中，所述第二网络认证服务节点为权利要求2所述的系统中的所述第二网络认证服务节点，所述第五接入认证信息包括所述第二UE证书；
接收所述第二网络认证服务节点发送的第六接入认证消息，所述第六接入认证消息包括所述第二认证证书以及所述第一漫游许可证书；
根据预置的所述第一CA证书中的公钥验证所述第一漫游许可证书是否由所述第一证书颁发节点颁发，根据所述第一漫游许可证书中的所述第二证书颁发节点的公钥验证所述第二认证证书是否由所述第二证书颁发节点颁发；
在确定所述第一漫游许可证书由所述第一证书颁发节点颁发，且所述第二认证证书由所述第二证书颁发节点颁发的情况下，接入所述移动网络。
8、一种网络认证服务器存储介质，其上存储有计算机程序，该程序被处理器执行时实现实施例4或5中所述移动网络的接入方法的步骤。
9、一种用户设备存储介质，其上存储有计算机程序，该程序被处理器执行时实现实施例6或7中所述移动网络的接入方法的步骤。
10、一种网络认证服务器，包括：
存储器，其上存储有计算机程序；
处理器，用于执行所述存储器中的所述计算机程序，以实现实施例4或5中所述移动网络的接入方法的步骤。
11、一种用户设备，包括：
存储器，其上存储有计算机程序；
处理器，用于执行所述存储器中的所述计算机程序，以实现实施例6或7中所述移动网络的接入方法的步骤。
12、一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算处理设备上运行时，导致所述计算处理设备执行根据实施例4或5所述的方法，或者，导致所述计算处理设备执行根据实施例6或7所述的方法。

Claims (12)

  1. 一种移动网络接入系统，其特征在于，所述系统包括处于区块链网络中的第一网络认证服务节点、第一证书颁发节点，其中，所述第一网络认证服务节点以及所述第一证书颁发节点属于第一运营商；
    所述第一证书颁发节点用于向所述第一网络认证服务节点颁发用于表明所述第一网络认证服务节点的身份的第一认证证书，以及向所述第一运营商的用户设备颁发用于表明该第一运营商的用户设备的身份的第一UE证书，以及将第一UE证书撤销信息和表明所述第一证书颁发节点的身份的第一CA证书存储到区块链中；
    所述第一网络认证服务节点用于从所述区块链中获取所述第一UE证书撤销信息以及所述第一CA证书，并在接收到所述第一运营商的用户设备的第一接入认证消息的情况下，与该第一运营商的用户设备进行双向身份认证，在所述双向身份认证完成的情况下，接入该第一运营商的用户设备到所述移动网络。
  2. 根据权利要求1所述的系统，其特征在于，所述系统还包括处于所述区块链网络中的第二网络认证服务节点以及第二证书颁发节点，所述第二网络认证服务节点以及所述第二证书颁发节点属于第二运营商；
    所述第一证书颁发节点还用于，将为所述第二证书颁发节点颁发的第一漫游许可证书写入所述区块链；
    所述第二证书颁发节点用于向所述第二网络认证服务节点颁发用于表明所述第二网络认证服务节点的身份的第二认证证书，以及向所述第二运营商的用户设备颁发用于表明该第二运营商的用户设备的身份的第二UE证书，以及将第二UE证书撤销信息和表明所述第二证书颁发节点的身份的第二CA证书存储到区块链中，以及将为所述第一证书颁发节点颁发的第二漫游许可证书写入所述区块链。
  3. 根据权利要求1或2所述的系统，其特征在于，所述第一CA证书以及所述第一证书颁发节点向第一运营商的用户设备颁发的所述第一UE证书预置在该第一运营商的用户设备的身份识别卡中；
    所述第一证书颁发节点向所述第一网络认证服务节点颁发的所述第一认证证书预置在所述第一网络认证服务节点中或者存储在所述区块链中。
  4. 一种移动网络接入方法，其特征在于，所述方法应用于权利要求1-3任一项所述的系统中的第一网络认证服务节点，所述方法包括：
    接收所述第一运营商的用户设备发送的第一接入认证信息，其中，所述第一接入认证信息包括所述第一UE证书；
    从所述区块链中获取所述第一UE证书撤销信息以及所述第一CA证书；
    根据所述第一CA证书中的公钥验证所述第一UE证书是否由所述第一证书颁发节点颁发，并根据所述第一UE证书撤销信息确定所述第一UE证书是否被撤销；
    在确定所述第一UE证书由所述第一证书颁发节点颁发，且所述第一UE证书未被撤销的情况下，向所述第一运营商的用户设备发送第二接入认证消息，所述第二接入认证消息包括所述第一认证证书，所述第一认证证书用于所述第一运营商的用户设备对所述第一网络认证服务节点进行身份认证，并在所述身份认证通过的情况下，接入所述第一运营商的用户设备到所述移动网络。
  5. 根据权利要求4所述的方法，其特征在于，所述方法应用于权利要求2所述的系统中的第一网络认证服务节点，所述方法还包括：
    接收所述第二运营商的用户设备发送的第三接入认证信息，其中，所述第三接入认证信息包括所述第二UE证书；
    从所述区块链中获取所述第一CA证书、所述第一漫游许可证书、所述第二漫游许可证书；
    在获取到所述第一CA证书、所述第二UE证书、所述第一漫游许可证书以及所述第二漫游许可证书的情况下，根据所述第一CA证书中的公钥验证所述第一漫游许可证书是否由所述第一证书颁发节点颁发，根据所述第二漫游许可证书中的所述第二证书颁发节点的公钥验证所述第二UE证书是否由所述第二证书颁发节点颁发；
    在确定所述第一漫游许可证书由所述第一证书颁发节点颁发，且所述第二UE证书由所述第二证书颁发节点颁发的情况下，向所述第二运营商的用户设备发送第四接入认证消息，所述第四接入认证消息包括所述第一认证证书以及所述第一漫游许可证书，所述第一认证证书以及所述第一漫游许可证书用于所述第二运营商的用户设备对所述第一网络认证服务节点进行身份认证，在所述身份认证通过的情况下，接入所述第二运营商的用户设备到所述移动网络。
  6. 一种移动网络接入方法，其特征在于，所述方法应用于第一运营商的用户设备，所述方法包括：
    向第一网络认证服务节点发送第一接入认证信息，其中，所述第一网络认证服务节 点为权利要求1-3任一项所述的系统中的所述第一网络认证服务节点，所述第一接入认证信息包括所述第一UE证书；
    接收所述第一网络认证服务节点发送的第二接入认证消息，所述第二接入认证消息包括所述第一认证证书；
    根据预置的所述第一CA证书中的公钥验证所述第一认证证书是否由所述第一颁发节点颁发；
    在确定所述第一认证证书由所述第一颁发节点颁发的情况下，接入所述移动网络。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    向第二网络认证服务节点发送第五接入认证信息，其中，所述第二网络认证服务节点为权利要求2所述的系统中的所述第二网络认证服务节点，所述第五接入认证信息包括所述第二UE证书；
    接收所述第二网络认证服务节点发送的第六接入认证消息，所述第六接入认证消息包括所述第二认证证书以及所述第一漫游许可证书；
    根据预置的所述第一CA证书中的公钥验证所述第一漫游许可证书是否由所述第一证书颁发节点颁发，根据所述第一漫游许可证书中的所述第二证书颁发节点的公钥验证所述第二认证证书是否由所述第二证书颁发节点颁发；
    在确定所述第一漫游许可证书由所述第一证书颁发节点颁发，且所述第二认证证书由所述第二证书颁发节点颁发的情况下，接入所述移动网络。
  8. 一种网络认证服务器存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现权利要求4或5所述方法的步骤。
  9. 一种用户设备存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现权利要求6或7所述方法的步骤。
  10. 一种网络认证服务器，其特征在于，包括：
    存储器，其上存储有计算机程序；
    处理器，用于执行所述存储器中的所述计算机程序，以实现权利要求4或5所述方法的步骤。
  11. 一种用户设备，其特征在于，包括：
    存储器，其上存储有计算机程序；
    处理器，用于执行所述存储器中的所述计算机程序，以实现权利要求6或7所述方 法的步骤。
  12. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算处理设备上运行时，导致所述计算处理设备执行根据权利要求4或5所述的方法，或者，导致所述计算处理设备执行根据权利要求6或7所述的方法。
PCT/CN2021/120009 2020-11-27 2021-09-23 移动网络接入系统、方法、存储介质及电子设备 Ceased WO2022111016A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2021577675A JP7312279B2 (ja) 2020-11-27 2021-09-23 モバイルネットワークアクセスシステム、方法、記憶媒体及び電子機器
KR1020217043009A KR102636275B1 (ko) 2020-11-27 2021-09-23 이동 네트워크 접속 시스템, 방법, 저장 매체 및 전자 장치
EP21827376.1A EP4027677A4 (en) 2020-11-27 2021-09-23 SYSTEM, METHOD, STORAGE MEDIA AND EQUIPMENT FOR MOBILE NETWORK ACCESS
US17/565,875 US12342165B2 (en) 2020-11-27 2021-12-30 System, method, storage medium and equipment for mobile network access

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011359296.8A CN112512048B (zh) 2020-11-27 2020-11-27 移动网络接入系统、方法、存储介质及电子设备
CN202011359296.8 2020-11-27

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/565,875 Continuation US12342165B2 (en) 2020-11-27 2021-12-30 System, method, storage medium and equipment for mobile network access

Publications (1)

Publication Number Publication Date
WO2022111016A1 true WO2022111016A1 (zh) 2022-06-02

Family

ID=74966978

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/120009 Ceased WO2022111016A1 (zh) 2020-11-27 2021-09-23 移动网络接入系统、方法、存储介质及电子设备

Country Status (6)

Country Link
US (1) US12342165B2 (zh)
EP (1) EP4027677A4 (zh)
JP (1) JP7312279B2 (zh)
KR (1) KR102636275B1 (zh)
CN (1) CN112512048B (zh)
WO (1) WO2022111016A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115277001A (zh) * 2022-06-20 2022-11-01 中国联合网络通信集团有限公司 一种共建共享网络的证书分发方法、装置、系统及介质
CN118802097A (zh) * 2024-02-27 2024-10-18 中国移动通信有限公司研究院 通信数据处理方法、区块链网络、装置、电子设备、存储介质和计算机程序产品

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109948371B (zh) * 2019-03-07 2021-06-25 深圳市智税链科技有限公司 为区块链节点发放身份证书的方法及相关装置
CN112512048B (zh) * 2020-11-27 2022-07-12 达闼机器人股份有限公司 移动网络接入系统、方法、存储介质及电子设备
CN112862560A (zh) * 2021-03-22 2021-05-28 于淼 一种基于物联网的电商交易平台及装置、电子设备
CN121942230A (zh) * 2023-09-21 2026-04-28 Oppo广东移动通信有限公司 认证方法和设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107079007A (zh) * 2014-09-23 2017-08-18 高通股份有限公司 基于证书的认证
CN108702622A (zh) * 2017-11-30 2018-10-23 深圳前海达闼云端智能科技有限公司 移动网络接入认证方法、装置、存储介质及区块链节点
CN109417709A (zh) * 2016-07-05 2019-03-01 三星电子株式会社 用于在移动无线网络系统中认证接入的方法和系统
CN110572824A (zh) * 2019-07-27 2019-12-13 中国人民解放军战略支援部队信息工程大学 基于区块链的异构无线网络切换认证方法及系统
WO2020223319A1 (en) * 2019-05-01 2020-11-05 Nix John A Distributed eap-tls authentication for wireless networks with concealed subscriber identities
CN112512048A (zh) * 2020-11-27 2021-03-16 达闼机器人有限公司 移动网络接入系统、方法、存储介质及电子设备

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101661933B1 (ko) * 2015-12-16 2016-10-05 주식회사 코인플러그 블록체인을 기반으로 하는 공인인증서 인증시스템 및 이를 이용한 인증방법
CN106372941B (zh) * 2016-08-31 2019-07-16 江苏通付盾科技有限公司 基于区块链的ca认证管理方法、装置及系统
US10547457B1 (en) * 2016-10-21 2020-01-28 Wells Fargo Bank N.A. Systems and methods for notary agent for public key infrastructure names
CN107360001B (zh) * 2017-07-26 2021-12-14 创新先进技术有限公司 一种数字证书管理方法、装置和系统
WO2019127278A1 (zh) * 2017-12-28 2019-07-04 深圳达闼科技控股有限公司 安全访问区块链的方法、装置、系统、存储介质及电子设备
SG11202007876QA (en) * 2018-04-09 2020-09-29 Mitsubishi Electric Corp Authentication system and authentication program
CN109344628B (zh) * 2018-08-23 2022-07-08 达闼机器人股份有限公司 区块链网络中可信节点的管理方法，节点及存储介质
CN109242467B (zh) * 2018-09-17 2021-01-01 金蝶软件（中国）有限公司 基于区块链的组网方法、装置、计算机设备和存储介质
CN109670284A (zh) * 2019-02-20 2019-04-23 中国互联网络信息中心 基于区块链和dnssec的用户认证方法、系统、设备及介质
CN110569674B (zh) * 2019-09-10 2023-11-17 腾讯科技（深圳）有限公司 基于区块链网络的认证方法及装置
CN111556035B (zh) * 2020-04-20 2022-04-19 中国工商银行股份有限公司 多认证节点的联盟链系统及方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107079007A (zh) * 2014-09-23 2017-08-18 高通股份有限公司 基于证书的认证
CN109417709A (zh) * 2016-07-05 2019-03-01 三星电子株式会社 用于在移动无线网络系统中认证接入的方法和系统
CN108702622A (zh) * 2017-11-30 2018-10-23 深圳前海达闼云端智能科技有限公司 移动网络接入认证方法、装置、存储介质及区块链节点
WO2020223319A1 (en) * 2019-05-01 2020-11-05 Nix John A Distributed eap-tls authentication for wireless networks with concealed subscriber identities
CN110572824A (zh) * 2019-07-27 2019-12-13 中国人民解放军战略支援部队信息工程大学 基于区块链的异构无线网络切换认证方法及系统
CN112512048A (zh) * 2020-11-27 2021-03-16 达闼机器人有限公司 移动网络接入系统、方法、存储介质及电子设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CABLELABS: "Error correction and clarification of Annex O", 3GPP TSG-SA3 MEETING #101E S3-203507, 20 November 2020 (2020-11-20) *
See also references of EP4027677A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115277001A (zh) * 2022-06-20 2022-11-01 中国联合网络通信集团有限公司 一种共建共享网络的证书分发方法、装置、系统及介质
CN118802097A (zh) * 2024-02-27 2024-10-18 中国移动通信有限公司研究院 通信数据处理方法、区块链网络、装置、电子设备、存储介质和计算机程序产品

Also Published As

Publication number Publication date
US12342165B2 (en) 2025-06-24
KR20220006655A (ko) 2022-01-17
CN112512048B (zh) 2022-07-12
EP4027677A1 (en) 2022-07-13
CN112512048A (zh) 2021-03-16
EP4027677A4 (en) 2022-08-17
US20220174490A1 (en) 2022-06-02
KR102636275B1 (ko) 2024-02-14
JP7312279B2 (ja) 2023-07-20
JP2023509806A (ja) 2023-03-10

Similar Documents

Publication Publication Date Title
CN112512048B (zh) 移动网络接入系统、方法、存储介质及电子设备
CN112566119B (zh) 终端认证方法、装置、计算机设备及存储介质
CN105723648B (zh) 一种密钥配置方法、系统和装置
CN101123811B (zh) 管理和wpa-psk无线网络连接的站的设备和方法
CN113055867A (zh) 终端辅助配网的方法和装置、电子设备
US20230344626A1 (en) Network connection management method and apparatus, readable medium, program product, and electronic device
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
CN104982053B (zh) 用于获得认证无线设备的永久身份的方法和网络节点
CN111182546B (zh) 接入无线网络的方法、设备及系统
CN109428874A (zh) 基于服务化架构的注册方法及装置
WO2018076740A1 (zh) 数据传输方法及相关设备
CN107820242A (zh) 一种认证机制的协商方法及装置
CN112423300A (zh) 无线网络接入认证方法及装置
JP7753623B2 (ja) アドレス検証方法及び対応する装置
CN115022850A (zh) 一种d2d通信的认证方法、装置、系统、电子设备及介质
US12477343B2 (en) Mobile virtual network operator network access control
CN101243642A (zh) 同时执行多个基于预共享密钥的认证的方法和执行该方法的设备
CN114650182B (zh) 身份认证方法、系统、装置、网关设备、设备和终端
EP3874394A1 (en) Authentication of an original equipment manufacturer entity
WO2022048125A1 (zh) 信息处理方法、装置、设备及存储介质
US20200162907A1 (en) Optimized simultaneous authentication of equals (sae) authentication in wireless networks
WO2019001509A1 (zh) 一种网络鉴权方法及系统
HK40053594B (zh) 网络连接管理方法、装置、计算机可读介质及电子设备
HK40043385B (zh) 终端认证方法、装置、计算机设备及存储介质
CN117135634A (zh) 无线网络接入方法、装置、系统、存储介质及电子设备

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021577675

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20217043009

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021827376

Country of ref document: EP

Effective date: 20211228

NENP Non-entry into the national phase

Ref country code: DE