CN114257393A - Terminal equipment authentication method and device and computer readable storage medium - Google Patents

Abstract

Embodiments of the present invention provide a terminal device authentication method, apparatus, and computer-readable storage medium. The method includes: a controller receives an authentication identifier sent by a registration node; Perform verification; if the verification is successful, execute the registration process of the CPE.

Description

A terminal device authentication method, apparatus and computer-readable storage medium

technical field

The present invention relates to the field of mobile communication technologies, and in particular, to a terminal device authentication method, apparatus and computer-readable storage medium.

Background technique

In a large-scale software-defined wide area network (SD-WAN), multiple controllers are usually deployed, and all customer premises equipment (CPE) online requests need to be distributed to different controllers by means of registration nodes. In this way, each controller is responsible for the management of a part of the CPE, and the association between the CPE and the controller relies on a global registry. The CPE is deployed by the customer, and the verification of the registered node, CPE, and controller can be solved by certificate authentication.

However, SD-WAN systems not only need to prevent unauthorized CPE from going online, but also prevent CPE from binding any controller without authorization, and the current implementation has security risks.

SUMMARY OF THE INVENTION

In view of this, embodiments of the present invention are expected to provide a terminal device authentication method, apparatus, and computer-readable storage medium.

In order to achieve the above-mentioned purpose, the technical scheme of the embodiment of the present invention is realized as follows:

An embodiment of the present invention provides a terminal device authentication method, which is applied to a controller and includes: receiving an authentication identifier sent by a registration node;

Verifying with the client front-end equipment CPE based on the authentication identifier;

If it is determined that the verification is successful, the registration process of the CPE is executed.

Wherein, the receiving the authentication identifier sent by the registration node includes:

Receive the authentication identifier that the registration node actively initiates to update on a regular basis; or,

The authentication identifier received after initiating an update request to the registration node.

Wherein, the receiving the authentication identifier sent by the registration node includes:

The authentication identifier sent by the registration node is received through the northbound interface.

The performing verification with the client front-end equipment CPE based on the authentication identifier includes: judging whether the authentication identifier is consistent with the authentication identifier received by the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

Wherein, the judging whether the authentication identifier is consistent with the authentication identifier received by the CPE includes:

Carry the authentication identifier in the NetConf Hello handshake message of the network configuration protocol interacted with the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

The embodiment of the present invention also provides a terminal equipment authentication method, the method is applied to the client front-end equipment CPE, including:

Receive the authentication identifier sent by the registered node;

Verifying with the controller based on the authentication identifier;

If it is determined that the verification is successful, the registration process of the CPE is executed.

Wherein, the receiving the authentication identifier sent by the registration node includes:

A registration response message sent by a registration node is received; the registration response message carries the authentication identifier.

Optionally, before receiving the authentication identifier sent by the registration node, the method further includes:

Send a registration request message to the registration node.

Wherein, the verification with the controller based on the authentication identifier includes:

Determine whether the authentication identifier is consistent with the authentication identifier received by the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

Wherein, the judging whether the authentication identifier is consistent with the authentication identifier received by the controller includes:

Carry the authentication identifier in the network configuration protocol NetConf Hello handshake message interacting with the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

The embodiment of the present invention also provides a terminal device authentication method, and the method is applied to a registration node, including:

Send the authentication identifier to the controller and/or the client front-end equipment CPE;

The authentication identifier is used for the controller to verify with the client and to perform the registration process of the CPE after the verification is successful.

Among them, send the authentication identifier to the controller, including:

Periodically proactively send updated authentication IDs to the controller; or,

After receiving the update request initiated by the controller, the authentication identifier is carried in the feedback update response.

Among them, send the certification mark to the CPE, including:

Send a registration response message to the CPE; the registration response message carries the authentication identifier.

The embodiment of the present invention also provides a terminal device authentication apparatus, and the apparatus is applied to the controller, including:

a first receiving module, configured to receive the authentication identifier sent by the registration node;

The first verification module is configured to perform verification with the client front-end equipment CPE based on the authentication identifier; if it is determined that the verification is successful, the registration process of the CPE is executed.

The embodiment of the present invention also provides a terminal equipment authentication apparatus, the apparatus is applied to the client front-end equipment CPE, including:

a second receiving module, configured to receive the authentication identifier sent by the registration node;

The second verification module is configured to perform verification with the controller based on the authentication identifier; if it is determined that the verification is successful, the registration process of the CPE is executed.

The embodiment of the present invention also provides a terminal device authentication device, the device is applied to a registration node, including:

The sending module is used to send the authentication identifier to the controller and/or the client front-end equipment CPE;

The authentication identifier is used for the controller to verify with the client and to perform the registration process of the CPE after the verification is successful.

An embodiment of the present invention further provides an apparatus for authenticating a terminal device, the apparatus comprising: a processor and a memory for storing a computer program that can be run on the processor,

Wherein, the processor is configured to execute the steps of the above method when running the computer program.

Embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the above method.

In the terminal device authentication method, device, and computer-readable storage medium provided by the embodiments of the present invention, the controller receives the authentication identifier sent by the registration node; performs verification with the client front-end equipment CPE based on the authentication identifier; determines that the verification is successful, Then the registration process of the CPE is executed. It can be seen that in this embodiment of the present invention, if the registered node is a counterfeit node, the counterfeit registered node cannot send an authentication identifier to the controller; if the CPE skips the registered node and directly accesses the controller, the CPE will not have the correct authentication identifier , then the registration of the CPE cannot be completed, thus solving the problem that the CPE bypasses the registration node and directly connects to the controller.

Description of drawings

FIG. 1 is a schematic flowchart 1 of a terminal device authentication method according to an embodiment of the present invention;

FIG. 2 is a second schematic flowchart of a terminal device authentication method according to an embodiment of the present invention;

3 is a third schematic flowchart of a terminal device authentication method according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram 1 of a terminal device authentication apparatus according to an embodiment of the present invention;

FIG. 5 is a second schematic structural diagram of a terminal device authentication apparatus according to an embodiment of the present invention;

FIG. 6 is a third schematic structural diagram of a terminal device authentication apparatus according to an embodiment of the present invention;

FIG. 7 is a fourth schematic structural diagram of a terminal device authentication apparatus according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of system interaction according to a scenario embodiment of the present invention.

Detailed ways

The present invention will be described below with reference to the accompanying drawings and embodiments.

It can be seen that the current SD-WAN system implementation has security risks: first, when the DNS is attacked, it may cause the pseudo-registered node to assign a controller to the CPE; secondly, when the CPE knows the address of the controller, it can bypass the registered node and directly Connect the controller.

Based on this, an embodiment of the present invention provides a terminal device authentication method. As shown in FIG. 1 , the method is applied to a controller, including:

Step 101: Receive the authentication identifier sent by the registration node;

Step 102: Check with the client front-end equipment CPE based on the authentication identifier;

Step 103: If it is determined that the verification is successful, the registration process of the CPE is executed.

In this embodiment of the present invention, the receiving the authentication identifier sent by the registration node includes:

Receive the authentication identifier that the registration node actively initiates to update on a regular basis; or,

The authentication identifier received after initiating an update request to the registration node.

In this embodiment of the present invention, the receiving the authentication identifier sent by the registration node includes:

The authentication identifier sent by the registration node is received through the northbound interface.

In the embodiment of the present invention, the verification with the client front-end equipment CPE based on the authentication identifier includes:

Determine whether the authentication identifier is consistent with the authentication identifier received by the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

In this embodiment of the present invention, the judging whether the authentication identifier is consistent with the authentication identifier received by the CPE includes:

Carry the authentication identifier in the NetConf Hello handshake message of the network configuration protocol interacted with the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

An embodiment of the present invention also provides a terminal device authentication method. As shown in FIG. 2 , the method is applied to the client front-end device CPE, including:

Step 201: Receive the authentication identifier sent by the registration node;

Step 202: verifying with the controller based on the authentication identifier;

Step 203: If it is determined that the verification is successful, the registration process of the CPE is executed.

In this embodiment of the present invention, the receiving the authentication identifier sent by the registration node includes:

A registration response message sent by a registration node is received; the registration response message carries the authentication identifier.

In an embodiment of the present invention, before the receiving the authentication identifier sent by the registration node, the method further includes:

Send a registration request message to the registration node.

In the embodiment of the present invention, the verification with the controller based on the authentication identifier includes:

Determine whether the authentication identifier is consistent with the authentication identifier received by the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

In this embodiment of the present invention, the judging whether the authentication identifier is consistent with the authentication identifier received by the controller includes:

Carry the authentication identifier in the network configuration protocol NetConf Hello handshake message interacting with the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

An embodiment of the present invention also provides a terminal device authentication method. As shown in FIG. 3 , the method is applied to a registration node, including:

Step 301: Send an authentication identifier to the controller and/or the client front-end equipment CPE;

Step 302: The authentication identifier is used for the controller to verify with the client and to perform the CPE registration process after the verification is successful.

In this embodiment of the present invention, sending an authentication identifier to the controller includes:

Periodically proactively send updated authentication IDs to the controller; or,

After receiving the update request initiated by the controller, the authentication identifier is carried in the feedback update response.

In this embodiment of the present invention, sending an authentication identifier to the CPE includes:

Send a registration response message to the CPE; the registration response message carries the authentication identifier.

In order to implement the above method embodiments, an embodiment of the present invention further provides an apparatus for authenticating terminal equipment. As shown in FIG. 4 , the apparatus is applied to a controller, including:

The first receiving module 401 is configured to receive the authentication identifier sent by the registration node;

The first verification module 402 is configured to perform verification with the client front-end equipment CPE based on the authentication identifier; if it is determined that the verification is successful, the registration process of the CPE is executed.

In this embodiment of the present invention, the first receiving module 401 receives the authentication identifier sent by the registration node, including:

Receive the authentication identifier that the registration node actively initiates to update on a regular basis; or,

The authentication identifier received after initiating an update request to the registration node.

In this embodiment of the present invention, the first receiving module 401 receives the authentication identifier sent by the registration node, including:

The authentication identifier sent by the registration node is received through the northbound interface.

In this embodiment of the present invention, the first verification module 402 performs verification with the client front-end equipment CPE based on the authentication identifier, including:

Determine whether the authentication identifier is consistent with the authentication identifier received by the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

In this embodiment of the present invention, the first verification module 402 determines whether the authentication identifier is consistent with the authentication identifier received by the CPE, including:

Carry the authentication identifier in the NetConf Hello handshake message of the network configuration protocol interacted with the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

An embodiment of the present invention further provides a terminal equipment authentication apparatus. As shown in FIG. 5 , the apparatus is applied to the client front-end equipment CPE, including:

The second receiving module 501 is configured to receive the authentication identifier sent by the registration node;

The second verification module 502 is configured to perform verification with the controller based on the authentication identifier; if it is determined that the verification is successful, the registration process of the CPE is executed.

In this embodiment of the present invention, the second receiving module 501 receives the authentication identifier sent by the registration node, including:

A registration response message sent by a registration node is received; the registration response message carries the authentication identifier.

In an embodiment of the present invention, as shown in FIG. 6 , the apparatus further includes: a registration module 503;

Before the second receiving module 501 receives the authentication identifier sent by the registration node,

The registration module 503 is configured to send a registration request message to the registration node.

In this embodiment of the present invention, the second verification module 502 performs verification with the controller based on the authentication identifier, including:

Determine whether the authentication identifier is consistent with the authentication identifier received by the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

In this embodiment of the present invention, the second verification module 502 determines whether the authentication identifier is consistent with the authentication identifier received by the controller, including:

Carry the authentication identifier in the network configuration protocol NetConf Hello handshake message interacting with the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

An embodiment of the present invention also provides a terminal device authentication device, as shown in FIG. 7 , the device is applied to a registration node, including:

A sending module 701, configured to send an authentication identifier to the controller and/or the client front-end equipment CPE;

The authentication identifier is used for the controller to verify with the client and to perform the registration process of the CPE after the verification is successful.

In this embodiment of the present invention, the sending module 701 sends an authentication identifier to the controller, including:

Periodically proactively send updated authentication IDs to the controller; or,

As shown in FIG. 7, the apparatus further includes: a third receiving module 702,

After the third receiving module 702 receives the update request initiated by the controller, the sending module 701 carries the authentication identifier in the feedback update response.

In this embodiment of the present invention, the sending module 701 sends an authentication identifier to the CPE, including:

Send a registration response message to the CPE; the registration response message carries the authentication identifier.

An embodiment of the present invention further provides an apparatus for authenticating a terminal device, the apparatus comprising: a processor and a memory for storing a computer program that can be run on the processor,

Wherein, when the processor is configured to run the computer program, execute:

Receive the authentication identifier sent by the registered node;

Verifying with the client front-end equipment CPE based on the authentication identifier;

If it is determined that the verification is successful, the registration process of the CPE is executed.

When the authentication identifier sent by the registration node is received, the processor is further configured to, when running the computer program, execute:

Receive the authentication identifier that the registration node actively initiates to update on a regular basis; or,

The authentication identifier received after initiating an update request to the registration node.

When the authentication identifier sent by the registration node is received, the processor is further configured to, when running the computer program, execute:

The authentication identifier sent by the registration node is received through the northbound interface.

When the verification is performed with the client front-end equipment CPE based on the authentication identifier, the processor is further configured to execute: when running the computer program:

Determine whether the authentication identifier is consistent with the authentication identifier received by the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

When judging whether the authentication identifier is consistent with the authentication identifier received by the CPE, the processor is further configured to execute the following when running the computer program:

Carry the authentication identifier in the NetConf Hello handshake message of the network configuration protocol interacted with the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

An embodiment of the present invention further provides an apparatus for authenticating a terminal device, the apparatus comprising: a processor and a memory for storing a computer program that can be run on the processor,

Wherein, when the processor is configured to run the computer program, execute:

Receive the authentication identifier sent by the registered node;

Verifying with the controller based on the authentication identifier;

If it is determined that the verification is successful, the registration process of the CPE is executed.

When the authentication identifier sent by the registration node is received, when the processor is configured to run the computer program, execute:

A registration response message sent by a registration node is received; the registration response message carries the authentication identifier.

Before receiving the authentication identifier sent by the registration node, when the processor is configured to run the computer program, execute:

Send a registration request message to the registration node.

When the verification is performed with the controller based on the authentication identifier, when the processor is configured to run the computer program, execute:

Determine whether the authentication identifier is consistent with the authentication identifier received by the controller;

Make sure that the authentication marks of the two are the same, then the verification is successful

When judging whether the authentication identifier is consistent with the authentication identifier received by the controller, when the processor is used to run the computer program, execute:

Carry the authentication identifier in the network configuration protocol NetConf Hello handshake message interacting with the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

An embodiment of the present invention further provides an apparatus for authenticating a terminal device, the apparatus comprising: a processor and a memory for storing a computer program that can be run on the processor,

Wherein, when the processor is configured to run the computer program, execute:

Send the authentication identifier to the controller and/or the client front-end equipment CPE;

The authentication identifier is used for the controller to verify with the client and to perform the registration process of the CPE after the verification is successful.

When sending the authentication identifier to the controller, when the processor is configured to run the computer program, execute:

Periodically proactively send updated authentication IDs to the controller; or,

After receiving the update request initiated by the controller, the authentication identifier is carried in the feedback update response.

When sending the authentication identifier to the CPE, when the processor is configured to run the computer program, execute:

Send a registration response message to the CPE; the registration response message carries the authentication identifier.

It should be noted that when the apparatus provided in the above embodiment performs terminal device authentication, only the division of the above program modules is used as an example. The internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the apparatuses provided in the foregoing embodiments belong to the same concept as the corresponding method embodiments, and the specific implementation process thereof is detailed in the method embodiments, which will not be repeated here.

In an exemplary embodiment, an embodiment of the present invention further provides a computer-readable storage medium, and the computer-readable storage medium may be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, Or memory such as CD-ROM; it can also be various devices including one or any combination of the above memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

Embodiments of the present invention also provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, executes:

Receive the authentication identifier sent by the registered node;

Verifying with the client front-end equipment CPE based on the authentication identifier;

If it is determined that the verification is successful, the registration process of the CPE is executed.

When the authentication identifier sent by the registration node is received, when the computer program is run by the processor, the computer program further executes:

Receive the authentication identifier that the registration node actively initiates to update on a regular basis; or,

The authentication identifier received after initiating an update request to the registration node.

When the authentication identifier sent by the registration node is received, when the computer program is run by the processor, the computer program further executes:

The authentication identifier sent by the registration node is received through the northbound interface.

When the verification is performed with the client front-end equipment CPE based on the authentication identifier, when the computer program is run by the processor, the computer program also executes:

Determine whether the authentication identifier is consistent with the authentication identifier received by the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

When judging whether the authentication identifier is consistent with the authentication identifier received by the CPE, when the computer program is run by the processor, it also executes:

Carry the authentication identifier in the NetConf Hello handshake message of the network configuration protocol interacted with the CPE;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

Embodiments of the present invention also provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, executes:

Receive the authentication identifier sent by the registered node;

Verifying with the controller based on the authentication identifier;

If it is determined that the verification is successful, the registration process of the CPE is executed.

When the authentication identifier sent by the registration node is received, when the processor is configured to run the computer program, execute:

A registration response message sent by a registration node is received; the registration response message carries the authentication identifier.

Before receiving the authentication identifier sent by the registration node, when the processor is configured to run the computer program, execute:

Send a registration request message to the registration node.

When the verification is performed with the controller based on the authentication identifier, when the processor is configured to run the computer program, execute:

Determine whether the authentication identifier is consistent with the authentication identifier received by the controller;

Make sure that the authentication marks of the two are the same, then the verification is successful

When judging whether the authentication identifier is consistent with the authentication identifier received by the controller, when the processor is used to run the computer program, execute:

Carry the authentication identifier in the network configuration protocol NetConf Hello handshake message interacting with the controller;

It is determined that the authentication identifiers of the two are the same, and the verification is successful.

Embodiments of the present invention also provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, executes:

Send the authentication identifier to the controller and/or the client front-end equipment CPE;

The authentication identifier is used for the controller to verify with the client and to perform the registration process of the CPE after the verification is successful.

When sending the authentication identifier to the controller, when the processor is configured to run the computer program, execute:

Periodically proactively send updated authentication IDs to the controller; or,

After receiving the update request initiated by the controller, the authentication identifier is carried in the feedback update response.

When sending the authentication identifier to the CPE, when the processor is configured to run the computer program, execute:

Send a registration response message to the CPE; the registration response message carries the authentication identifier.

The present invention will be described below with reference to scenario embodiments.

This embodiment eliminates potential safety hazards by introducing a cryptogram (ie, an authentication identifier) mechanism. As shown in Figure 8, the CPE and the controller can be informed of a secret signal by the registration node.

In the actual application process, the registration node can actively update the password to the controller regularly; or,

After receiving the update request initiated by the controller, the registration node carries the secret code in the feedback update response.

In the actual application process, when the CPE sends a registration request to the registration node after going online, the registration node sends the latest secret code to the CPE.

In this way, if the registered node is a counterfeit node, the counterfeit registered node cannot send a secret code to the controller; if the CPE wants to skip the registered node and directly access the controller, the CPE will not have the correct secret code, and the registration of the CPE cannot be completed. . Therefore, the problem that the CPE bypasses the registration node and directly connects to the controller can be solved.

Wherein, the secret code is a random number, which may have different granularities, and may be the secret code of each client refreshed regularly, or the secret code of each controller refreshed regularly.

About the issuance of ciphers: The cipher issuance mechanism can be implemented by adding a northbound interface on the controller, and can be implemented by enhancing the registration response message on the CPE, as follows:

The controller can obtain the secret code in various ways, one of which is to add a URI to the Rest API call of the northbound interface to pass parameters to the controller;

CPE can be implemented by adding a cipher to the registration response message sent by the registration node;

Encryption can be used for transmission, and the northbound interface of the controller and the CPE can use HTTPS to distribute information.

For controllers and CPEs that have obtained secret codes, the NetConf protocol can be enhanced.

NetConf is a mainstream control protocol for telecom network equipment. The first step (generally) of the current terminal equipment entering the network needs to be connected to the controller; then the controller verifies the validity of the equipment through NetConf. The validity check here is mainly carried out through the underlying transmission protocol SSH of NetConf.

In this embodiment, it is done by enhancing the NetConf Hello handshake. The Hello message sent by the controller to the CPE and the Hello message sent by the CPE to the controller respectively carry the secret code. If the secret code of the other party matches the known one, the verification succeeds; otherwise, the verification fails.

In the existing mechanism, when a session is established between the NetConf controller and the CPE, the capability sets supported by each must be exchanged, and the two parties can proceed to the next step after receiving the capability set of the other party. As shown in the content of the HELLO message sent by the CPE below, add a code field (Code) to Hello to implement the code matching.

The content between <capabilities> and </capabilities> in the preceding message indicates the capability set supported by the controller and the CPE itself. The Hello packet sent by the CPE contains the <session-id> tag. The XML content indicates the session ID allocated by the CPE for this session, which is used to uniquely identify this session.

In this embodiment, when the CPE sends a registration request to the registration node, the registration node sends the latest cipher to the CPE, and the CPE is allowed to register only when the cipher received by the CPE is consistent with the cipher received by the controller. It can be seen that if the registered node is a counterfeit node, it is impossible for the counterfeit registered node to send a secret code to the controller; if the CPE wants to skip the registered node and directly access the controller, the CPE will not have the correct secret code, thus solving the problem of CPE bypassing the registration A problem with the node connecting directly to the controller.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (18)

1. A terminal equipment authentication method is applied to a controller and comprises the following steps:

receiving an authentication identifier sent by a registration node;

verifying the authentication identifier and the Customer Premise Equipment (CPE) based on the authentication identifier;

and if the verification is successful, executing the registration process of the CPE.

2. The method according to claim 1, wherein said receiving the authentication identifier sent by the registration node comprises:

receiving the authentication identification which is periodically and actively updated by the registered node; or,

and sending the received authentication identification to the registered node after the update request is sent.

3. The method according to claim 1, wherein said receiving the authentication identifier sent by the registration node comprises:

and receiving the authentication identification sent by the registration node through a northbound interface.

4. The method according to claim 1, wherein the checking with the CPE based on the authentication identifier comprises:

judging whether the authentication identification is consistent with the authentication identification received by the CPE;

and if the authentication identifications of the two are determined to be consistent, the verification is successful.

5. The method of claim 4, wherein the determining whether the authentication identifier is consistent with an authentication identifier received by the CPE comprises:

the authentication identification is carried in a network configuration protocol NetConf Hello handshake message interacted with the CPE;

and if the authentication identifications of the two are determined to be consistent, the verification is successful.

6. A terminal equipment authentication method is applied to a Customer Premise Equipment (CPE) and comprises the following steps:

receiving an authentication identifier sent by a registration node;

verifying the controller based on the authentication identifier;

and if the verification is successful, executing the registration process of the CPE.

7. The method according to claim 6, wherein said receiving the authentication identifier sent by the registration node comprises:

receiving a registration response message sent by a registration node; and the registration response message carries the authentication identification.

8. The method according to claim 6 or 7, wherein before receiving the authentication identifier sent by the registration node, the method further comprises:

a registration request message is sent to the registration node.

9. The method of claim 6, wherein the verifying with the controller based on the authentication identifier comprises:

judging whether the authentication identification is consistent with the authentication identification received by the controller;

and if the authentication identifications of the two are determined to be consistent, the verification is successful.

10. The method of claim 9, wherein determining whether the authentication identifier is consistent with an authentication identifier received by a controller comprises:

carrying the authentication identification in a network configuration protocol NetConf Hello handshake message interacted with the controller;

and if the authentication identifications of the two are determined to be consistent, the verification is successful.

11. A terminal equipment authentication method is applied to a registration node and comprises the following steps:

sending an authentication identifier to a controller and/or a Customer Premise Equipment (CPE);

and the authentication identifier is used for verifying the controller and the client and performing a registration process of the CPE after the verification is successful.

12. The method of claim 11, wherein sending the authentication identification to the controller comprises:

periodically and actively sending updated authentication identification to the controller; or,

and after receiving an updating request initiated by the controller, carrying the authentication identifier in a feedback updating response.

13. The method of claim 11, wherein sending the authentication identification to the CPE comprises:

sending a registration response message to the CPE; and the registration response message carries the authentication identification.

14. A terminal equipment authentication device is applied to a controller and comprises the following components:

the first receiving module is used for receiving the authentication identifier sent by the registration node;

the first checking module is used for checking with the Customer Premise Equipment (CPE) based on the authentication identification; and if the verification is successful, executing the registration process of the CPE.

15. An authentication device for terminal equipment, which is applied to a Customer Premise Equipment (CPE), comprising:

the second receiving module is used for receiving the authentication identifier sent by the registration node;

the second check module is used for checking with the controller based on the authentication identification; and if the verification is successful, executing the registration process of the CPE.

16. An authentication device for a terminal device, the device being applied to a registration node, comprising:

the sending module is used for sending the authentication identification to the controller and/or the Customer Premise Equipment (CPE);

and the authentication identifier is used for verifying the controller and the client and performing a registration process of the CPE after the verification is successful.

17. A terminal device authentication apparatus, characterized in that the apparatus comprises: a processor and a memory for storing a computer program capable of running on the processor,

wherein the processor is adapted to perform the steps of the method of any one of claims 1 to 5, or to perform the steps of the method of any one of claims 6 to 10, or to perform the steps of the method of any one of claims 11 to 13, when running the computer program.

18. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 5, or carries out the steps of the method of any one of claims 6 to 10, or carries out the steps of the method of any one of claims 11 to 13.

Images