Detailed Description
The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
It should be understood that the terms "comprises" and "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, operations, elements, components, and/or groups thereof.
It is also to be understood that the terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should be further understood that the term "and/or" as used in the present specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations.
Referring to fig. 1, fig. 1 is a flow chart of a method for authenticating a 5G user identity based on header enhancement according to an embodiment of the present invention. The 5G user identity authentication method based on the head enhancement is applied to computer equipment and used for authenticating the access of the 5G user to the intranet service through the Internet of things terminal, and the security of the Internet of things terminal when accessing to the intranet service is improved. As shown in FIG. 1, the method includes steps S110 to S130.
S110, if an intranet access request for accessing intranet service sent by an Internet of things terminal is received, analyzing the intranet access request to obtain identification information of the Internet of things terminal.
In the embodiment of the present invention, the internet of things terminal is generally referred to as a 5G terminal, for example, a mobile phone, and a user may send an intranet access request through the internet of things terminal to access an intranet service. When an intranet access request of the terminal of the Internet of things is received, the intranet access request is analyzed, so that identification information of the terminal of the Internet of things is obtained.
The identification information is used for identifying different terminals of the internet of things, and can include information such as an identification number, an IP address, a device code and the like, for example, if a user sends an intranet access request through a mobile phone, the identification information can include the mobile phone number of the mobile phone, the IP address when the intranet access request is sent, and the device code of the mobile phone.
S120, confirming whether the header enhancement information matched with the identification information is recorded.
In the embodiment of the invention, for the non-primary access internet of things terminal, if the non-primary access internet of things terminal successfully accesses the intranet service before, corresponding header enhancement information is recorded, the header enhancement information is matched with the identification information of the internet of things terminal, whether authentication is successful or not can be judged by confirming whether the header enhancement information is matched with the identification information of the internet of things terminal, namely whether the internet of things terminal is allowed to access the intranet service or not.
For the first accessed internet of things terminal or the internet service is accessed before, but the rejected internet of things terminal can enter a verification process to confirm whether the internet of things terminal is authorized.
For example, if the user accesses the intranet service through the mobile phone, and the obtained identification information may include a mobile phone number, an IP address, and a device code, if header enhancement information matched with the identification information is recorded, the header enhancement information is obtained, and whether the information included in the header enhancement information is consistent with the mobile phone number, the IP address, and the device code is confirmed. That is, the header enhancement information may also include a mobile phone number, an IP address, and a device code. When the mobile phone number is recorded, the head enhancement information of the internet of things terminal is indicated to be recorded, and whether the internet of things terminal is allowed to access the intranet service can be further judged.
And S130, if the head enhancement information matched with the identification information is recorded, allowing the Internet of things terminal to access the intranet service.
In the embodiment of the invention, when the head enhancement information matched with the identification information is recorded, the terminal of the Internet of things is allowed to access the intranet service. That is, in the foregoing embodiment, when the same mobile phone number as that included in the identification information is recorded in the header enhancement information, it is indicated that the header enhancement information of the internet of things terminal is recorded, it can be further confirmed whether it is allowed to access the intranet service.
The identification information is also provided with an IP address, the IP address is recorded in the head enhancement information, the IP address recorded in the head enhancement information is an IP address allowing the Internet of things terminal to access the intranet, when the IP address in the identification information is inconsistent with the IP address in the head enhancement information, the access is refused or a re-authorization step is carried out, and when the IP address in the identification information is consistent with the IP address in the head enhancement information, the Internet of things terminal is allowed to access the intranet service.
In some embodiments, for example, the method for authenticating a 5G user identity based on header enhancement may include the following steps:
If the header enhancement information matched with the identification information is not recorded, a first redirection instruction is sent to the Internet of things terminal so that the Internet of things terminal accesses a first preset address and configures the header enhancement information for the Internet of things terminal;
if the fact that the internet of things terminal accesses the first preset address is detected, acquiring head enhancement information of the internet of things terminal, and verifying the internet of things terminal according to the head enhancement information of the internet of things terminal;
If the authentication of the internet of things terminal is passed, the head enhancement information of the internet of things terminal is recorded, and a second redirection instruction is sent to the internet of things terminal so that the internet of things terminal accesses an initial access address;
and if the authentication of the internet of things terminal is not passed, rejecting the internet of things terminal to access the intranet service.
In the embodiment of the invention, when the header enhancement information matched with the identification information is not recorded, the verification process can be entered. The method comprises the steps that firstly, a simulation server sends a first redirection instruction to an Internet of things terminal, an access target of the Internet of things terminal is changed from an access intranet service to an access first preset address, head enhancement information is configured for the Internet of things terminal, then when the first preset address is detected to be accessed by the Internet of things terminal, the Internet of things terminal is verified according to the head enhancement information of the Internet of things terminal, for example, whether the Internet of things terminal is legal in a system is verified, if the Internet of things terminal is legal in the system, the verification is passed, and if the Internet of things terminal is an illegal user in the system, the Internet of things terminal is refused to access the intranet service.
And after the verification is passed, recording the head enhancement information of the terminal of the Internet of things, sending a second redirection instruction to the terminal of the Internet of things, modifying the access address of the terminal of the Internet of things into the initial access address of the terminal of the Internet of things, and then entering step S110 to authenticate the terminal of the Internet of things again.
As shown in fig. 2, the authentication method may be configured in a 5G security management platform, and SMF (Session Management Function) G session management function in fig. 2 is used for managing sessions of the internet of things terminal, UPF (User Plane Function) is used for processing data of the internet of things terminal, and AMF (ACCESS AND Mobility Management Function) is used for completing access and mobility management of the internet of things terminal. And the internet of things terminal sends an intranet access request to the UPF through the base station, and the UPF forwards the intranet access request to the 5G security management platform.
As shown in fig. 3, the 5G security management platform analyzes the intranet access request to obtain the identification information of the internet of things terminal, when the 5G security management platform does not record the header enhancement information matched with the identification information, a first redirection instruction is sent to the internet of things terminal, that is, the access address of the internet of things terminal is modified from the intranet to a first preset address, the first preset address can be the 5G security management platform, the internet of things terminal revisits the 5G security management platform, at this time, the UPF detects that the access address of the internet of things terminal is the 5G security management platform, and then the header enhancement information is configured for the access request of the internet of things terminal before forwarding the access request to the 5G security management platform. For example, the access address may be generally represented as URL (Uniform Resource Locator) uniform resource locator, and when the UPF detects that the URL has the first preset address, header enhancement information is added to the header of the URL, where the header enhancement information may be information such as a mobile phone number, a device code, and the related information is encrypted.
After the UPF finishes adding the head enhancement information, sending an access request of the Internet of things terminal to a 5G security management platform, wherein the address received by the 5G security management platform is an enhanced first preset address, identifying the enhanced first preset address, analyzing the head enhancement information added by the UPF to obtain information such as a mobile phone number, a device code, an IP address and the like of the Internet of things terminal, and then verifying whether the Internet of things terminal is legal in a system, for example, whether the mobile phone number is legal in the system or not can be verified, if the Internet of things terminal is legal in the system, recording the head enhancement information of the Internet of things terminal, and sending a second redirection instruction to the Internet of things terminal, wherein the second redirection instruction is also used for modifying the access address of the Internet of things terminal, and modifying the access address of the Internet of things terminal from the first preset address to an initial address which the Internet of things terminal originally accesses, namely, the address of an intranet service which the Internet of things terminal needs to access.
And the internet of things terminal resends the intranet access request according to the second redirection instruction, after receiving the intranet access request, the 5G security management platform analyzes the intranet access request and acquires the identification information of the internet of things terminal, and at the moment, the 5G security management platform generally records the head enhancement information matched with the identification information, so that the internet of things terminal is allowed to access intranet services. By verifying and adding the header enhancement information, the safety of the intranet service can be ensured, and illegal users can be prevented from accessing the intranet service.
In addition, the 5G security management platform can autonomously manage user access rules or butt-joint identity authentication systems, the systems can acquire user identity information and access rights periodically or when terminal information changes, and when the access rights change, corresponding rules are updated in time. A user can associate a plurality of rules, wherein the plurality of rules are in an OR relationship, namely, hit one rule which is not to be searched for next rule continuously, a plurality of attributes can be arranged in one rule, and the plurality of attributes are in an AND relationship, namely, the plurality of attributes are met at the same time, namely, hit the rule. After the 5G security management platform identifies the user identity information, the corresponding rule is acquired, the rule is matched with the rule according to the information such as user access service, access time and the like, if the rule is hit, forwarding or discarding is carried out according to the rule requirement, and if the rule is not hit, the data is directly discarded.
In some embodiments, for example, the method for authenticating a 5G user identity based on header enhancement may include the following steps:
And confirming the access authority of the terminal of the Internet of things, and limiting the access of the terminal of the Internet of things to the intranet service according to the access authority.
In the embodiment of the invention, different internet of things terminals have different access rights, for example, different IP addresses correspond to different access rights, if a user accesses an intranet service through the internet of things terminal within a specified range, normal access rights can be granted, and if the user accesses the intranet service outside the specified range, limited access rights can be granted, for example, only partial functions are opened. Besides adjusting the access right according to the IP address, the access right of the terminal of the Internet of things can be actively adjusted, and the access right can be specifically set by an administrator.
In some embodiments, for example, the method for authenticating a 5G user identity based on header enhancement may include the following steps:
acquiring a first identification number and a first IP address of the terminal of the Internet of things according to the identification information, and confirming whether a second identification number matched with the first identification number exists in the header enhancement information;
if the second identification number matched with the first identification number exists in the header enhancement information, whether a second IP address corresponding to the second identification number is consistent with the first IP address or not is confirmed;
And if the second IP address corresponding to the second identification number is inconsistent with the first IP address, sending a first redirection instruction to the Internet of things terminal so that the Internet of things terminal accesses a first preset address and reconfigures head enhancement information for the Internet of things terminal.
In the embodiment of the invention, the first identification number can be a mobile phone number of the internet of things terminal, the first IP address is an address when the internet of things terminal accesses the intranet, the second identification number is the same as the first identification number, and if the first identification number is a mobile phone number, the second identification number is the same as the mobile phone number. When the second identification number matched with the first identification number exists in the system, whether the first IP address is consistent with the second IP address is further verified, when the first IP address is consistent with the second IP address, the Internet of things terminal is allowed to access the intranet service, if the first IP address is inconsistent with the second IP address, the head enhancement information can be reconfigured, and when the head enhancement information is reconfigured, the corresponding access authority is adjusted according to the specific IP address.
Fig. 4 is a schematic block diagram of a 5G user identity authentication device 100 based on header enhancement according to an embodiment of the present invention. As shown in fig. 4, the present invention further provides a 5G user identity authentication device 100 based on header enhancement, corresponding to the above 5G user identity authentication method based on header enhancement. The head-enhancement based 5G user identity authentication apparatus 100 includes means for performing the head-enhancement based 5G user identity authentication method described above. Specifically, referring to fig. 4, the header enhancement-based 5G user identity authentication apparatus 100 includes a first parsing unit 110, a first confirmation unit 120, and a first passing unit 130.
The first analyzing unit 110 is configured to analyze an intranet access request for accessing an intranet service if the intranet access request sent by an internet of things terminal is received, so as to obtain identification information of the internet of things terminal;
the first confirming unit 120 is configured to confirm whether header enhancement information matched with the identification information is recorded;
The first pass unit 130 is configured to allow the internet of things terminal to access the intranet service if header enhancement information matched with the identification information is recorded.
In some embodiments, for example, in this embodiment, the 5G user identity authentication device based on header enhancement further includes a first sending unit, a first detecting unit, a first verifying unit, and a second verifying unit.
The first sending unit is configured to send a first redirection instruction to the internet of things terminal if the header enhancement information matched with the identification information is not recorded, so that the internet of things terminal accesses a first preset address and configures header enhancement information for the internet of things terminal;
the first detection unit is configured to obtain header enhancement information of the internet of things terminal if the first detection unit detects that the internet of things terminal accesses the first preset address, and verify the internet of things terminal according to the header enhancement information of the internet of things terminal;
The first verification unit is used for recording the head enhancement information of the internet of things terminal and sending a second redirection instruction to the internet of things terminal if the first verification unit passes the verification of the internet of things terminal so that the internet of things terminal accesses an initial access address;
and the second verification unit is used for rejecting the internet of things terminal to access the intranet service if the second verification unit fails to verify the internet of things terminal.
In some embodiments, for example the present embodiment, the head-based enhanced 5G user identity authentication device further comprises a second validation unit.
The second confirmation unit is used for confirming the access authority of the internet of things terminal and limiting the access of the internet of things terminal to the intranet service according to the access authority.
In some embodiments, for example, in this embodiment, the apparatus for authenticating a 5G user identity based on header enhancement further includes a first obtaining unit, a third confirming unit, and a second sending unit.
The first obtaining unit is used for obtaining a first identification number and a first IP address of the terminal of the Internet of things according to the identification information, and confirming whether a second identification number matched with the first identification number exists in the header enhancement information;
The third confirming unit is used for confirming whether a second IP address corresponding to the second identification number is consistent with the first IP address or not if the second identification number matched with the first identification number exists in the head enhancement information;
and the second sending unit is used for sending a first redirection instruction to the internet of things terminal if the second IP address corresponding to the second identification number is inconsistent with the first IP address, so that the internet of things terminal accesses a first preset address and reconfigures the head enhancement information for the internet of things terminal.
It should be noted that, as those skilled in the art can clearly understand, the specific implementation process of the head-based enhanced 5G user identity authentication device and each unit may refer to the corresponding description in the foregoing method embodiment, and for convenience and brevity of description, the description is omitted here.
The head-based enhanced 5G user identity authentication apparatus described above may be implemented in the form of a computer program which may be run on a computer device as shown in fig. 5.
Referring to fig. 5, fig. 5 is a schematic block diagram of a computer device according to an embodiment of the present application. With reference to FIG. 5, the computer device 500 includes a processor 502, memory, and a network interface 505 connected by a system bus 501, where the memory may include a non-volatile storage medium 503 and an internal memory 504.
The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. The computer program 5032, when executed, may cause the processor 502 to perform a head-enhanced 5G user identity authentication method.
The processor 502 is used to provide computing and control capabilities to support the operation of the overall computer device 500.
The internal memory 504 provides an environment for the execution of a computer program 5032 in the non-volatile storage medium 503, which computer program 5032, when executed by the processor 502, causes the processor 502 to perform a head-enhanced 5G user identity authentication method.
The network interface 505 is used to communicate with other devices. It will be appreciated by those skilled in the art that the architecture shown in fig. 5 is merely a block diagram of some of the architecture relevant to the present inventive arrangements and is not limiting of the computer device 500 to which the present inventive arrangements may be implemented, as a particular computer device 500 may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.
It should be appreciated that in embodiments of the present application, the Processor 502 may be a central processing unit (Central Processing Unit, CPU), the Processor 502 may also be other general purpose processors, digital signal processors (FIGITAL SIGNAL processors, FSP), application SPECIFIC INTEGRATEF Circuits (ASIC), off-the-shelf Programmable gate arrays (FielF-Programmable GATE ARRAY, FPGA) or other Programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. Wherein the general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
Those skilled in the art will appreciate that all or part of the flow in a method embodying the above described embodiments may be accomplished by computer programs instructing the relevant hardware. The computer program may be stored in a storage medium that is a computer readable storage medium. The computer program is executed by at least one processor in the computer system to implement the flow steps of the embodiments of the method described above.
Accordingly, the present invention also provides a storage medium. The storage medium may be a computer readable storage medium. The storage medium stores a computer program. The computer program, when executed by a processor, implements any of the embodiments of the head-based enhanced 5G user identity authentication method described above.
The storage medium may be a U-disk, a removable hard disk, a Read Only Memory (ROM), a magnetic disk, or an optical disk, or other various computer readable storage media capable of storing program codes.
Those of ordinary skill in the art will appreciate that the elements and algorithm steps described in connection with the embodiments disclosed herein may be embodied in electronic hardware, in computer software, or in a combination of the two, and that the elements and steps of the examples have been generally described in terms of function in the foregoing description to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
In the several embodiments provided by the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of each unit is only one logic function division, and there may be another division manner in actual implementation. For example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed.
The steps in the method of the embodiment of the invention can be sequentially adjusted, combined and deleted according to actual needs. The units in the device of the embodiment of the invention can be combined, divided and deleted according to actual needs. In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The integrated unit may be stored in a storage medium if implemented in the form of a software functional unit and sold or used as a stand-alone product. Based on such understanding, the technical solution of the present invention is essentially or partly contributing to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device to perform all or part of the steps of the method according to the embodiments of the present invention.
In the foregoing embodiments, the descriptions of the embodiments are focused on, and for those portions of one embodiment that are not described in detail, reference may be made to the related descriptions of other embodiments.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
While the invention has been described with reference to certain preferred embodiments, it will be understood by those skilled in the art that various changes and substitutions of equivalents may be made and equivalents will be apparent to those skilled in the art without departing from the scope of the invention. Therefore, the protection scope of the invention is subject to the protection scope of the claims.