CN118740409A - Application authentication method and device - Google Patents

Abstract

The application authentication method and the device are beneficial to reducing the risk of user information leakage and improving the system security in the process of authenticating the application of the terminal equipment by the application server. The method comprises the following steps: the application server acquires first information from the terminal equipment, wherein the first information is used for requesting to acquire service data, and the first information carries a network identifier of the terminal equipment; the application server authenticates the terminal equipment based on the network identification of the terminal equipment and a prestored corresponding relation, wherein the corresponding relation is used for indicating the corresponding relation between the public key of at least one terminal equipment and at least one application identity identified by the application server, and the at least one application identity is obtained based on the network identification of the terminal equipment corresponding to the at least one application identity; and if the authentication is passed, the application server sends second information to the terminal equipment, wherein the second information is used for indicating the terminal equipment to pass the authentication.

Description

Application authentication method and device

Technical Field

The present application relates to the field of communications, and in particular to an application authentication method and device.

Background Art

In the era of big data in information technology, the number of applications (referred to as applications) in terminal devices has exploded. When users use applications in terminal devices, the terminal devices need to access the application server corresponding to the application through the application to obtain relevant data in order to provide relevant services to users. When the terminal device application accesses the application server, the application server needs to authenticate the accessed terminal device application (also known as authentication). After the authentication is passed, the application server can provide relevant service data for the terminal device application. In this way, user information security can be guaranteed, and network security issues caused by information theft and malicious intrusion can be prevented.

At present, application servers mainly authenticate applications through the network address of the terminal device and the identity and password information entered by the user when using the terminal device application. When the terminal device is connected to the network, when the user uses the application in the terminal device, the terminal device can send an application authentication request to the centralized identity agency (which can also be the application server). The centralized identity agency matches the network address of the terminal device and the identity and password information or biological characteristics entered by the user on the terminal device with the locally stored information. If there is a match, the centralized identity agency provides services for the terminal device application, so that the user can use the terminal device application normally.

The above-mentioned application authentication method requires the participation of a centralized identity agency, which stores user identity and password information. There is a risk of user information leakage, especially when the centralized identity agency has a single point of failure and lacks trust, and the security is not high.

Summary of the invention

The embodiments of the present application provide an application authentication method and device, which are beneficial to reducing the risk of user information leakage and improving system security during the process of an application server authenticating a terminal device application.

In a first aspect, an application authentication method is provided, comprising: obtaining first information from a terminal device, the first information being used to request service data, the first information carrying a network identifier of the terminal device; authenticating the terminal device based on the network identifier of the terminal device and a pre-stored correspondence, the correspondence being used to indicate a correspondence between a public key of at least one terminal device and at least one application identity authenticated by the application server, the at least one application identity being obtained based on the network identifier of the terminal device corresponding to the at least one application identity; and in a case where the authentication is successful, sending second information to the terminal device, the second information being used to indicate that the terminal device has passed the authentication.

The application authentication method of the embodiment of the present application generates an application identity of the terminal device by utilizing the network identifier of the terminal device, and writes the correspondence between the public key of the terminal device and the application identity authenticated by the application server into the application server. When the user uses the application of the terminal device, the terminal device initiates an authentication process to the application server. The application server can complete the authentication of the terminal device by relying on the network identifier of the terminal device and the above-mentioned pre-written correspondence, without resorting to user information, and without the risk of user information leakage, which is beneficial to improving the security of the system.

In combination with the first aspect, in some implementations of the first aspect, the execution entity of the above-mentioned application authentication method may be an application server.

In combination with the first aspect, in certain implementations of the first aspect, the application identity of the terminal device is a value obtained by processing the network identifier of the terminal device using a preset one-way derivative function, or the application identity of the terminal device is the network identifier of the terminal device.

It should be understood that the one-way derivative function can be a hash function or an encryption algorithm, which is not limited in the present embodiment. The specific type of hash function or encryption algorithm used is pre-negotiated by the application server and the terminal device, or is agreed upon by the protocol, which is not limited in the present embodiment.

This application will use a preset one-way derivative function to process the network identification of the terminal device and abbreviate the value obtained by a process as APPID, and the network identification of the terminal device will be abbreviated as BCADD. Exemplarily, the above-mentioned application identity can be Hash(BCADD), that is, APPID, and BCADD can be Hash(PKu). Among them, Hash(BCADD) represents the value obtained after performing a hash operation on BCADD using a hash function, and Hash(PKu) represents the value obtained after performing a hash operation on the public key PKu.

Exemplarily, the above application identity may be Hash(PKu), namely BCADD, wherein Hash(PKu) represents a value obtained after performing a hash operation on the public key PKu.

The application identity identification of the terminal device in the embodiment of the present application can complete the authentication of the terminal device by the application server based on the terminal device network identification by utilizing the above two possible implementation methods, without resorting to user information, and without the risk of user information leakage, which is conducive to improving the security of the system.

In combination with the first aspect, in certain implementations of the first aspect, the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivative function; the authenticating the terminal device based on the network identity of the terminal device and the pre-stored correspondence includes: processing the network identity of the terminal device using a preset one-way derivative function to obtain a processing result; if there is a first application identity in the at least one application identity that is equal to the processing result, it is determined that the terminal device has passed the authentication.

The embodiment of the present application uses APPID as the application identity identifier, so that different terminal devices have the same access path to the same application, which can prevent the terminal device from being tracked in the communication system, thereby avoiding user information leakage.

In combination with the first aspect, in some implementations of the first aspect, the application identity of the terminal device is the network identity of the terminal device; the method also includes: receiving a first authentication request from the terminal device, the first authentication request carrying a first random number and a first ciphertext, the first ciphertext being the ciphertext obtained by encrypting the network identity of the terminal device and the first random number using the private key of the terminal device; authenticating the terminal device based on the network identity of the terminal device and a pre-stored correspondence, including: using the public key of the terminal device to decrypt the first ciphertext to obtain the decrypted network identity of the terminal device and the decrypted first random number; and determining that the terminal device authentication is successful when there is a first application identity in the at least one application identity that is equal to the decrypted network identity of the terminal device, and the decrypted first random number is equal to the first random number carried in the first authentication request.

Exemplarily, the first ciphertext may be SKu(BCADD, first random number), where SKu(BCADD, first random number) is the ciphertext obtained by encrypting BCADD and the first random number with the private key SKu, where PKu is the public key of the terminal device, and SKu is the private key of the terminal device.

The embodiment of the present application uses BCADD as the application identity, which can ensure the identity uniformity of the terminal device between different layers such as the data link layer, network layer, transport layer and application layer. However, there is a risk of the terminal device being tracked, so the BCADD can be updated, and the specific update method is as follows. In combination with the first aspect, in some implementations of the first aspect, the method also includes: receiving fourth information from the terminal device, the fourth information is used to indicate the update of the application identity of the terminal device, the fourth information carries a second random number and a second ciphertext, the second ciphertext is the ciphertext obtained by encrypting the new network identifier of the terminal device, the network identifier and the second random number using the private key of the terminal device; decrypting the second ciphertext using the public key of the terminal device to obtain the decrypted new network identifier, the decrypted network identifier and the decrypted second random number; when the decrypted second random number is equal to the second random number carried in the second ciphertext, and the first application identity is equal to the decrypted network identifier in the at least one application identity, the first application identity is updated from the network identifier to the new network identifier.

Exemplarily, the second ciphertext may be SKu(new BCADD, BCADD, second random number), wherein SKu(new BCADD, BCADD, second random number) is the ciphertext obtained by encrypting new BCADD, BCADD and the second random number using the private key SKu.

In the embodiment of the present application, when the application identity of the terminal device is the network identity of the terminal device, updating the application identity of the terminal device is helpful to avoid tracking of the user's application usage behavior and causing leakage of user information, thereby improving the security of the system.

Optionally, the method further comprises: the application server sends an update response to the terminal device to indicate whether the update is successful. Correspondingly, the terminal device receives the update response from the application server.

In one possible implementation, if the update is successful, the update response may be a message indicating that the update is successful, such as an acknowledgement character (ACK); if the update fails, the update response may be a message indicating that the update fails, such as a negative acknowledgement character (NACK).

In another possible implementation, if the update is successful, the application server sends an update response to the terminal device, and the update response is a message indicating the update is successful, such as ACK. If the update fails, no response is made. In this case, the terminal device can set a timer, which starts after the fourth information is sent. If the terminal device does not receive the update response fed back by the application server before the timer times out, the terminal device defaults to the application server failing to update BCADD.

In combination with the first aspect, in certain implementations of the first aspect, before receiving a first authentication request from the terminal device, the method also includes: sending third information to a corresponding network device, the third information being used to respond to the first information, and the third information carrying a network identifier of the terminal device.

It should be understood that after receiving the third information, the network device corresponding to the above-mentioned application server can send a query request to the blockchain device based on the third information, and the query request carries the network identification of the terminal device, and the query request is used to query the ID of the network device corresponding to the terminal device and in the same network domain as the network device corresponding to the application server. Correspondingly, the blockchain device receives the query request, and determines the ID of the network device corresponding to the terminal device and in the same network domain as the network device corresponding to the application server, which corresponds to the received network identification, by using the correspondence between the network identification stored therein and the ID of the network device corresponding to the terminal device. The network device corresponding to the application server obtains the ID of the network device corresponding to the terminal device, thereby addressing the network device to which the terminal device is connected according to the ID of the network device, and then finding the terminal device.

In combination with the first aspect, in certain implementations of the first aspect, the method further includes: when the authentication is successful, allocating a temporary external identifier to the terminal device, wherein the temporary external identifier is used to externally identify an application of the terminal device; and sending information to the blockchain device indicating the correspondence between the network identifier and the temporary external identifier.

Exemplarily, the temporary external identifier may be a unified resource location address (URL), an application programming interface (API), or a port identifier.

The embodiment of the present application can prevent the internal identifier of the terminal device from being exposed in the network by setting a temporary external identifier, thereby increasing the security of the communication system.

In combination with the first aspect, in some implementations of the first aspect, the method also includes: receiving fifth information from the terminal device, the fifth information is used to request to use the first application identity as the identity of the terminal device under the corresponding application, and the fifth information carries the first application identity; based on the fifth information, sending a second authentication request to the terminal device, the second authentication request is used to request authentication of the terminal device; receiving a second authentication response from the terminal device, the second authentication response carries information used for authentication; based on the second authentication response, authenticating the terminal device; and if the authentication passes, storing the correspondence between the first application identity and the public key of the terminal device.

It should be understood that before the terminal device sends the fifth information to the application server, the terminal device needs to access the network. The embodiment of the present application does not limit the network access method and the network identifier used. In one possible implementation, the terminal device can use BCADD as the network identifier, initiate a random access process, and access the network. In another possible implementation, the terminal device can use other identifiers as the network identifier, initiate a random access process, and access the network.

In combination with the first aspect, in certain implementations of the first aspect, the information used for authentication includes: a public key of the terminal device, a third random number and a third ciphertext, the third ciphertext being a ciphertext obtained by encrypting the first application identity and the third random number using the private key of the terminal device; authenticating the terminal device based on the second authentication response, including: decrypting the third ciphertext using the public key of the terminal device to obtain the decrypted first application identity and the decrypted third random number; and determining that the terminal device authentication is successful when the decrypted first application identity is equal to the first application identity carried in the fifth information, and the decrypted third random number is equal to the third random number carried in the second authentication response.

The embodiment of the present application completes the authentication of the terminal device through a pre-stored correspondence relationship, without the need to establish a correspondence during the authentication process, making the authentication process simpler and faster, thereby improving authentication efficiency.

Exemplarily, the application identity of the terminal device is the network identity of the terminal device, and the third ciphertext may be SKu(BCADD, third random number), wherein SKu(BCADD, third random number) is the ciphertext obtained by encrypting BCADD and the third random number using the private key SKu.

Exemplarily, the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivative function, and the third ciphertext may be SKu (APPID, third random number), wherein SKu (APPID, third random number) is the ciphertext obtained by encrypting the APPID and the third random number using the private key SKu.

When the network is untrustworthy, the message sent by the terminal device to the application server may be tampered with, so two-way authentication can be performed again between the terminal device and the application server. If the two-way authentication passes, the application server will provide services for the application of the terminal device to improve the accuracy of application authentication.

In combination with the first aspect, in certain implementations of the first aspect, the method also includes: sending a third authentication request to the terminal device, the third authentication request carrying a fourth ciphertext, the fourth ciphertext being the ciphertext obtained by encrypting the application identity of the terminal device, the network identity of the terminal device and the fourth random number using the public key of the terminal device; receiving a third authentication response from the terminal device, the third authentication response carrying a fourth ciphertext, the fourth ciphertext being the ciphertext obtained by encrypting the application identity of the terminal device, the network identity of the terminal device and the fourth random number decrypted based on the fourth ciphertext using the private key of the terminal device; authenticating the terminal device based on the third authentication response; and sending the second information to the terminal device if the authentication is successful.

Optionally, the terminal device receives the third authentication request, and based on the third authentication request, sends a third authentication response to the application server, specifically including: the terminal device uses its own private key to decrypt the fourth ciphertext to obtain the decrypted application identity, the decrypted network identity and the decrypted fourth random number; the terminal device then uses its own private key to encrypt the decrypted application identity, the decrypted network identity and the decrypted fourth random number to obtain the fourth ciphertext encrypted by the private key, and sends a third authentication response to the application server, the third authentication response carries the fourth ciphertext encrypted by the private key. Exemplarily, the fourth ciphertext encrypted by the private key may be SKu (APPID, BCADD, fourth random number). Based on the third authentication response, the application server authenticates the terminal device, specifically including: the application server uses the public key of the terminal device to decrypt the fourth ciphertext encrypted by the private key to obtain the decrypted application identity, the decrypted network identity and the decrypted fourth random number; when the decrypted fourth random number is equal to the fourth random number carried in the third authentication request, the application server determines that the terminal device is authenticated.

In the embodiment of the present application, two-way authentication can be performed between the terminal device and the application server. When the two-way authentication is passed, the application server provides services for the application of the terminal device to improve the accuracy of application authentication.

In a second aspect, another application authentication method is provided, including: sending first information to an application server, the first information being used to request service data, the first information carrying a network identifier of a terminal device, the network identifier of the terminal device being used by the application server to authenticate the terminal device based on a pre-stored correspondence relationship, the correspondence being used to indicate a correspondence between a public key of at least one terminal device and at least one application identity identifier authenticated by the application server, the at least one application identity identifier being obtained based on the network identifier of the terminal device corresponding to the at least one application identity identifier; receiving second information from the application server, the second information being used to indicate that the terminal device has passed the authentication.

In combination with the second aspect, in some implementations of the second aspect, the execution subject of the above-mentioned application authentication method may be a terminal device.

In combination with the second aspect, in certain implementations of the second aspect, the application identity of the terminal device is a value obtained by processing the network identifier of the terminal device using a preset one-way derivative function, or the application identity of the terminal device is the network identifier of the terminal device.

In combination with the second aspect, in certain implementations of the second aspect, the method also includes: sending fourth information to the application server, the fourth information being used to indicate an update of an application identity of the terminal device, the fourth information carrying a second random number and a second ciphertext, the second ciphertext being the ciphertext obtained by encrypting the new network identifier of the terminal device, the network identifier and the second random number using the private key of the terminal device.

In combination with the second aspect, in certain implementations of the second aspect, the method further includes: sending fifth information to the application server, the fifth information being used to request that the first application identity be used as the identity of the terminal device under the application corresponding to the application server, the fifth information carrying the first application identity; receiving a second authentication request from the application server, the second authentication request being used to request authentication of the terminal device; and sending a second authentication response to the application server, the second authentication response carrying information used for authentication.

In combination with the second aspect, in certain implementations of the second aspect, the information used for authentication includes: a public key of the terminal device, a third random number and a third ciphertext, and the third ciphertext is the ciphertext obtained by encrypting the first application identity and the third random number using the private key of the terminal device.

In combination with the second aspect, in some implementations of the second aspect, the method also includes: receiving a third authentication request from the application server, the third authentication request carrying a fourth ciphertext, the fourth ciphertext being the ciphertext obtained by encrypting the first application identity, the network identity of the terminal device and the fourth random number using the public key of the terminal device; decrypting the fourth ciphertext using the private key of the terminal device to obtain the decrypted first application identity, the decrypted network identity of the terminal device and the decrypted fourth random number; encrypting the decrypted first application identity, the decrypted network identity of the terminal device and the decrypted fourth random number using the private key of the terminal device to obtain a fourth ciphertext; and sending a third authentication response to the application server, the third authentication response carrying the fourth ciphertext.

According to a third aspect, an application authentication method is provided, comprising: receiving a first correspondence relationship from a network device, wherein the first correspondence relationship is used to represent a correspondence relationship between a network identifier of a terminal device and an identifier of the network device; and storing the first correspondence relationship.

In combination with the third aspect, in certain implementations of the third aspect, the executor of the above-mentioned application authentication method may be a blockchain device.

It should be understood that the above-mentioned blockchain device can be an independent device, or multiple devices deployed in a distributed manner, or a chip driver that can realize related functions. The embodiments of the present application do not limit its specific product form.

In combination with the third aspect, in certain implementations of the third aspect, the method further includes: receiving a second correspondence from an application server, wherein the second correspondence is used to represent a correspondence between the network identifier and a temporary external identifier allocated by the application server to the terminal device.

In a fourth aspect, an application authentication device is provided, which is used to execute the method in any possible implementation of the first aspect, the second aspect, or the third aspect. Specifically, the device includes a module for executing the method in any possible implementation of the first aspect, the second aspect, or the third aspect.

In a fifth aspect, another application authentication device is provided, including a processor and a memory, the processor is coupled to the memory, and can be used to execute instructions in the memory to implement the method in any possible implementation of the first aspect, the second aspect, or the third aspect. Optionally, the application authentication device also includes a communication interface, and the processor is coupled to the communication interface.

In one implementation, the application authentication device is an application server. When the application authentication device is an application server, the communication interface may be a transceiver, or an input/output interface.

In another implementation, the application authentication device is a chip configured in the application server. When the application authentication device is a chip configured in the application server, the communication interface may be an input/output interface.

In one implementation, the application authentication device is a terminal device. When the application authentication device is a terminal device, the communication interface may be a transceiver, or an input/output interface.

In another implementation, the application authentication device is a chip configured in the terminal device. When the application authentication device is a chip configured in the terminal device, the communication interface may be an input/output interface.

In one implementation, the application authentication device is a blockchain device. When the application authentication device is a blockchain device, the communication interface may be a transceiver, or an input/output interface.

In another implementation, the application authentication device is a chip configured in the blockchain device. When the application authentication device is a chip configured in the blockchain device, the above-mentioned communication interface may be an input/output interface.

In a sixth aspect, a processor is provided, comprising: an input circuit, an output circuit, and a processing circuit. The processing circuit is used to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any possible implementation of the first aspect, the second aspect, or the third aspect.

In the specific implementation process, the above-mentioned processor can be a chip, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a trigger, and various logic circuits. The input signal received by the input circuit can be, for example, but not limited to, received and input by a receiver, and the signal output by the output circuit can be, for example, but not limited to, output to a transmitter and transmitted by the transmitter, and the input circuit and the output circuit can be the same circuit, which is used as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation methods of the processor and various circuits.

In a seventh aspect, a processing device is provided, comprising a processor and a memory. The processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter to execute the method in any possible implementation of the first aspect, the second aspect, or the third aspect.

Optionally, the number of the processors is one or more, and the number of the memories is one or more.

Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips respectively. The embodiments of the present application do not limit the type of memory and the setting method of the memory and the processor.

It should be understood that the relevant data interaction process, such as sending indication information, can be a process of outputting indication information from a processor, and receiving capability information can be a process of receiving input capability information from a processor. Specifically, the processed output data can be output to a transmitter, and the input data received by the processor can come from a receiver. Among them, the transmitter and the receiver can be collectively referred to as a transceiver.

The processing device in the seventh aspect mentioned above can be a chip. The processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

In an eighth aspect, a computer program product is provided, the computer program product comprising: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute a method in any possible implementation of the first aspect, the second aspect, or the third aspect.

In the ninth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions). When the computer-readable storage medium is run on a computer, the computer executes a method in any possible implementation of the first aspect, the second aspect, or the third aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a communication system applicable to an embodiment of the present application;

FIG2 is a schematic diagram of another communication system applicable to an embodiment of the present application;

FIG3 is a schematic diagram of a three-layer identity relationship in an embodiment of the present application;

FIG4 is a schematic flow chart of an application authentication method according to an embodiment of the present application;

FIG5 is a schematic flow chart of another application authentication method according to an embodiment of the present application;

FIG6 is a schematic flow chart of another application authentication method according to an embodiment of the present application;

FIG7 is a schematic flow chart of another application authentication method according to an embodiment of the present application;

FIG8 is a schematic flow chart of another application authentication method according to an embodiment of the present application;

FIG9 is a schematic block diagram of an application authentication device according to an embodiment of the present application;

FIG10 is a schematic block diagram of another application authentication device according to an embodiment of the present application;

FIG. 11 is a schematic block diagram of another application authentication device according to an embodiment of the present application.

DETAILED DESCRIPTION

The technical solution in this application will be described below in conjunction with the accompanying drawings.

In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

It should be noted that, in this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

In addition, "at least one" means one or more, and "plurality" means two or more. "And/or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character "/" generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) system or new radio (NR), future evolved communication systems, such as sixth generation (6G) system, etc.

It should also be understood that the technical solutions of the embodiments of the present application can also be applied to various communication systems based on non-orthogonal multiple access technology, such as sparse code multiple access (SCMA) system. Of course, SCMA may also be called other names in the communication field; further, the technical solutions of the embodiments of the present application can be applied to multi-carrier transmission systems using non-orthogonal multiple access technology, such as orthogonal frequency division multiplexing (OFDM), filter bank multi-carrier (FBMC), generalized frequency division multiplexing (GFDM), filtered orthogonal frequency division multiplexing (F-OFDM) system, etc.

To facilitate understanding of the embodiments of the present application, a communication system applicable to the embodiments of the present application is first described in conjunction with FIG1. FIG1 shows a schematic diagram of a communication system 100 applicable to the embodiments of the present application. The communication system 100 includes: a terminal device 110 and an application server 120. Among them, the terminal device 110 has at least one application installed, and the at least one application can correspond to at least one application server, and FIG1 shows an application server 120. The application server 120 can provide services for the applications of the terminal device 110. The terminal device 110 and the application server 120 can communicate through application layer messages.

It should be understood that the terminal device 110 may be configured with multiple antennas, which may include at least one transmitting antenna for sending signals and at least one receiving antenna for receiving signals. In addition, the terminal device 110 also includes a transmitter chain and a receiver chain, and those skilled in the art may understand that they may include multiple components related to signal transmission and reception (such as processors, modulators, multiplexers, demodulators, demultiplexers or antennas, etc.). Therefore, the terminal device 110 and other devices may communicate via multi-antenna technology.

In some deployments, the communication system 100 may further include: a network device 130. The network device 130 may communicate with the terminal device 110 via a wireless link. The network device 130 may also be configured with multiple antennas, similar to the terminal device 110, and will not be described in detail here. Therefore, the network device 130 may communicate with the terminal device 110 via a multi-antenna technology.

In some deployments, the communication system 100 may further include: a blockchain device 140. The blockchain device 140 includes a plurality of decentralized distributed devices, which jointly maintain a blockchain ledger. The distributed devices may communicate with each other to achieve data transmission and synchronization.

FIG2 shows a schematic diagram of another communication system 200 applicable to an embodiment of the present application. As shown in FIG2 , the communication system 200 may include a terminal device 210, an application server 220, and a network device 230. Among them, the terminal device 210 includes a terminal device application 211 and a terminal device network interface 212. The terminal device application 211 may include social applications, information applications, game applications, shopping applications, and tool applications that provide services to users using the terminal device 210. The terminal device network interface 212 is responsible for sending signaling such as authentication, mobility management, and access control to the application server 220 for processing. The application server 220 is similar to the above-mentioned application server 120, and will not be described in detail here. The network device 230 is a network device to which the terminal device 210 is connected.

In some deployments, the communication system 200 may further include: a network device 240 and a blockchain device 250. Exemplarily, the network device 240 may be understood as a router for forwarding data packets from the application server 220. The blockchain device 250 is similar to the blockchain device 140, and will not be described in detail here. The terminal device 210 may communicate with the application server 220, the network device 230 and the blockchain device 250, the application server 220 may communicate with the network device 240 and the blockchain device 250, and the blockchain device 250 may communicate with the network device 230 and the network device 240.

The terminal device in the embodiment of the present application can communicate with one or more core networks via a radio access network (RAN), and the terminal device can be called an access terminal, user equipment (UE), user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network, or a terminal device in a public land mobile network (PLMN) to be evolved in the future, etc.

The network device in the embodiment of the present application can be a device for communicating with a terminal device. The network device can be a base station (base transceiver station, BTS) in a global system for mobile communications (GSM) system or code division multiple access (CDMA), or a base station (NodeB, NB) in a wideband code division multiple access (WCDMA) system, or an evolved base station (evolved NodeB, eNB or eNodeB) in an LTE system, or a wireless controller in a cloud radio access network (CRAN) scenario, or the network device can be a relay station, an access point, a vehicle-mounted device, a wearable device, a network device in a 5G network, or a network device in a future evolved PLMN network, etc. The embodiment of the present application is not limited to this. For example, a gNB in an NR system, or a transmission point (transmission and receiving point, TRP or TP), one or a group of (including multiple antenna panels) antenna panels of a base station in a 5G system, or a network node constituting a gNB or a transmission point, such as a baseband unit (baseband unit, BBU), or a distributed unit (distributed unit, DU), etc.

In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may also include a radio unit (RU). The CU implements some functions of the gNB, and the DU implements some functions of the gNB, for example, the CU implements the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers, and the DU implements the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. Since the information of the RRC layer will eventually become the information of the PHY layer, or be converted from the information of the PHY layer, therefore, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU, or by the DU+CU. It can be understood that the network device can be a CU node, a DU node, or a device including a CU node and a DU node. In addition, the CU can be divided into a network device in an access network (radio access network, RAN), and the CU can also be divided into a network device in a core network (core network, CN), which is not limited in this application.

The above-mentioned network device can also refer to the general term for all devices on the network end. For example, when multiple TRPs are used to transmit data to a terminal device, multiple TRPs can be collectively referred to as network devices.

In an embodiment of the present application, a terminal device or a network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and a memory (also called main memory). The operating system can be any one or more computer operating systems that implement business processing through a process, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a windows operating system. The application layer includes applications such as a browser, an address book, a word processing software, and an instant messaging software. In addition, the embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application, as long as it can communicate according to the method provided in the embodiment of the present application by running a program that records the code of the method provided in the embodiment of the present application, for example, the execution subject of the method provided in the embodiment of the present application can be a terminal device or a network device, or a functional module in a terminal device or a network device that can call a program and execute the program.

In addition, various aspects or features of the present application can be implemented as methods, devices or products using standard programming and/or engineering techniques. The term "product" used in this application covers computer programs that can be accessed from any computer-readable device, carrier or medium. For example, computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or tapes, etc.), optical disks (e.g., compact discs (CDs), digital versatile discs (DVDs), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). In addition, the various storage media described herein may represent one or more devices and/or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.

In the era of big data in information technology, the number of applications (referred to as applications) in terminal devices has exploded. When users use applications in terminal devices, the terminal devices need to access the application server corresponding to the application through the application to obtain relevant data in order to provide relevant services to users. When the terminal device application accesses the application server, the application server needs to authenticate the accessed terminal device application (also known as authentication). After the authentication is passed, the application server can provide relevant service data for the terminal device application. In this way, user information security can be guaranteed, and network security issues caused by information theft and malicious intrusion can be prevented.

At present, application servers mainly authenticate applications through the network address of the terminal device and the identity and password information entered by the user when using the terminal device application. When the terminal device is connected to the network, when the user uses the application in the terminal device, the terminal device can send an application authentication request to the centralized identity agency (which can also be the application server). The centralized identity agency matches the network address of the terminal device and the identity and password information or biological characteristics entered by the user on the terminal device with the locally stored information. If there is a match, the centralized identity agency provides services for the terminal device application, so that the user can use the terminal device application normally.

The above-mentioned application authentication method requires the participation of a centralized identity agency, which stores user identity and password information. There is a risk of user information leakage, especially when the centralized identity agency has a single point of failure and lacks trust, and the security is not high.

In view of this, an embodiment of the present application proposes an application authentication method and device, which generates an application identity of the terminal device by utilizing the network identifier of the terminal device, and writes the correspondence between the public key of the terminal device and the application identity authenticated by the application server into the application server. When the user uses the application of the terminal device, the terminal device initiates an authentication process to the application server. The application server can complete the authentication of the terminal device by relying on the network identifier of the terminal device and the above-mentioned pre-written correspondence, without the need to rely on user information, and there is no risk of user information leakage, which is beneficial to improving the security of the system.

The application authentication method and device provided by the present application will be described in detail below in conjunction with the accompanying drawings. It should be understood that the technical solution of the present application can be applied to the communication system shown in Figure 1 or Figure 2 above. For example, in the communication system 100 shown in Figure 1, the terminal device described in the following embodiments may correspond to the terminal device 110 shown in Figure 1, such as, it can be the terminal device 110 shown in Figure 1, or it can be a chip configured in the terminal device 110; the application server described in the following embodiments may correspond to the application server 120 shown in Figure 1, such as, it can be the application server 120 shown in Figure 1, or it can be a chip configured in the application server 120.

In addition to the devices mentioned above, in other possible implementations, the application server 120 may also be other devices in the network. For example, in an open radio access network (O-RAN), the application server 120 may be a RAN intelligent controller (RIC) node, an open cloud (O-Cloud) node, a service management orchestration (SMO) node, an open base station (open eNB, O-eNB), an open radio unit (open radio unit, O-RU), an open DU (open DU, O-DU), an open CU (open CU, O-CU), etc., which is not limited to the embodiments of the present application.

In the following, without loss of generality, the application authentication method provided by the embodiment of the present application is described in detail by taking the interaction process between devices as an example. In order to better understand, the corresponding relationship between the application identity provided by the embodiment of the present application and the terminal device network identity is described below.

Fig. 3 shows a schematic diagram of a three-layer identity correspondence relationship 300 provided in an embodiment of the present application. As shown in Fig. 3, the three-layer identity correspondence relationship 300 may include: a first-layer identity RealID, a second-layer identity BCADD, and a third-layer identity APPID.

1. The first-level identity (real identity, RealID) can be understood as the public key PKu of the terminal device registered with the national regulatory agency. Among them, the first-level identity RealID is not used in any network or application.

2. The second-layer identity (block chain address, BCADD) is used to indicate the basic transmission identification between the link layer and the network layer, and is also used to indicate the network identification of the terminal device. It can be understood as the blockchain address of the above-mentioned terminal device derived from the public key PKu. The second-layer identity BCADD is obtained by performing mathematical operations on the first-layer identity RealID using a one-way derivative function. When a terminal device has only one network address, the second-layer identity BCADD can be used to indicate the network identification of the terminal device; when a terminal device has multiple network addresses, the second-layer identity BCADD can be used to indicate the network identification of a specific network card of the terminal device.

It should be understood that the above-mentioned one-way derivative function can be a hash function or an encryption algorithm, and the embodiments of the present application are not limited to this.

In a possible implementation, taking the first-layer identity RealID as the public key PKu of the terminal device as an example, the second-layer identity BCADD may be Hash(PKu), where Hash(PKu) represents the value obtained by performing a hash operation on the public key PKu of the terminal device using a hash function.

It should be understood that hash functions include multiple types, and hash operations may include different types such as addition hash, bitwise hash, multiplication hash, division hash, table lookup hash, and mixed hash. After performing different types of hash operations on the same seed, or after performing the same type of hash operations on different seeds, or after performing different types of hash operations on different seeds, the values obtained are also different. The embodiments of the present application do not limit the specific hash function used.

Optionally, the second-layer identity BCADD may be updated. For example, the seed may be a public key PKu. After obtaining the second-layer identity BCADD 1, a different hash function and/or a different hash operation method may be used to obtain the second-layer identity BCADD 2, and the second-layer identity BCADD 1 may be replaced with the second-layer identity BCADD 2, thereby completing the update of the second-layer identity BCADD.

FIG3 is only an example. In actual application, the second-layer identity BCADD may be updated 1 time or N times, where N is a positive integer greater than 1. The number of updates of the second-layer identity BCADD is not limited in the embodiment of the present application.

3. The third-layer identity (application identity, APPID) is used to indicate the identity of the user using the terminal device in different applications. The third-layer identity APPID is obtained by performing mathematical operations on the second-layer identity BCADD using a one-way derivative function. Among them, multiple different third-layer identities APPID can be obtained based on the same second-layer identity BCADD. Different third-layer identities APPID are used to indicate the identity of the user using the terminal device in different applications.

It should be understood that in Figure 3, the third-layer identity APPID 11, the third-layer identity APPID 12 and the third-layer identity APPID 13 can be obtained respectively according to the second-layer identity BCADD 1, which is only an example. In actual application, 1 or N third-layer identity APPIDs can be obtained according to the same second-layer identity BCADD, where N is a positive integer greater than 1, and the specific number of third-layer identity APPIDs is not limited in the embodiments of the present application.

In one possible implementation, the third-layer identity APPID is obtained by performing a hash operation on the second-layer identity BCADD. Taking the second-layer identity BCADD as Hash(PKu) as an example, the third-layer identity APPID may be Hash(BCADD), that is, the third-layer identity APPID may be Hash(Hash(PKu)), wherein Hash(BCADD) represents the value obtained by performing a hash operation on the second-layer identity BCADD, and Hash(PKu) represents the value obtained by performing a hash operation on the public key PK.

It should be understood that the difference between the third-layer identity APPID and the second-layer identity BCADD is that the second-layer identity BCADD has a corresponding public key pair to support its two-way authentication capability, while the third-layer identity APPID has no public key support and can only be two-way authenticated through its corresponding second-layer identity BCADD. That is, the third-layer identity APPID can only be obtained by performing a hash operation on the second-layer identity BCADD, and the second-layer identity BCADD cannot be obtained through the third-layer identity APPID. Therefore, the second-layer identity BCADD can be used to verify the correspondence between the second-layer identity BCADD and the third-layer identity APPID.

Similar to the above-mentioned second-layer identity BCADD, the third-layer identity APPID can be updated according to the updated second-layer identity BCADD, which will not be elaborated here.

FIG4 shows a schematic flow chart of an application authentication method 400 provided in an embodiment of the present application. The method can be applied to the communication system 100 shown in FIG1 , and can also be applied to the communication system 200 shown in FIG2 , and can also be applied to other communication systems, which is not limited in the embodiment of the present application. The method 400 includes:

S401, a terminal device sends a first message to an application server, the first message is used to request to obtain service data, and the first message carries a network identifier of the terminal device. Correspondingly, the application server receives the first message and obtains the network identifier of the terminal device.

S402, the application server authenticates the terminal device based on the network identification of the terminal device and a pre-stored correspondence, where the correspondence is used to indicate the correspondence between a public key of at least one terminal device and at least one application identity authenticated by the application server, and the at least one application identity is obtained based on the network identification of the terminal device corresponding to the at least one application identity.

S403, when the authentication is successful, the application server sends second information to the terminal device, where the second information is used to indicate that the terminal device has passed the authentication; correspondingly, the terminal device receives the second information.

It should be understood that if the authentication fails, the application server will not provide subsequent services to the terminal device. In one possible implementation, the application server sends a third message to the terminal device, where the third message is used to indicate that the terminal device has failed the authentication; correspondingly, the terminal device receives the third message. In another possible implementation, the application server does not respond to the terminal device.

The application authentication method of the embodiment of the present application generates an application identity of the terminal device by utilizing the network identifier of the terminal device, and writes the correspondence between the public key of the terminal device and the application identity authenticated by the application server into the application server. When the user uses the application of the terminal device, the terminal device initiates an authentication process to the application server. The application server can complete the authentication of the terminal device by relying on the network identifier of the terminal device and the above-mentioned pre-written correspondence, without resorting to user information, and without the risk of user information leakage, which is beneficial to improving the security of the system.

It should be understood that the at least one application identity is obtained based on the network identifier of the terminal device corresponding to the at least one application identity, including the following two possible implementations:

In a first possible implementation, the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivation function. In the above S402, the application server authenticates the terminal device based on the network identity of the terminal device and a pre-stored correspondence, including: the application server processes the network identity of the terminal device using a preset one-way derivation function to obtain a processing result; if there is a first application identity in the at least one application identity that is equal to the processing result, the application server determines that the terminal device has passed the authentication.

Optionally, if there is no first application identity identifier in the at least one application identity identifier that is equal to the processing result, the application server determines that the terminal device has not passed the authentication.

Exemplarily, the above application identity may be Hash (BCADD), namely APPID.

The embodiment of the present application uses APPID as the application identity identifier, so that different terminal devices have the same access path to the same application, which can prevent the terminal device from being tracked in the communication system, thereby avoiding user information leakage.

In a second possible implementation, the application identity of the terminal device is the network identity of the terminal device, and the method further includes: the terminal device sends a first authentication request to the application server, the first authentication request carries a first random number and a first ciphertext, and the first ciphertext is a ciphertext obtained by encrypting the network identity of the terminal device and the first random number using the private key of the terminal device. Correspondingly, the application server receives the first authentication request. In the above S402, the application server authenticates the terminal device based on the network identity of the terminal device and the pre-stored correspondence, including: the application server uses the public key of the terminal device to decrypt the first ciphertext to obtain the decrypted network identity of the terminal device and the decrypted first random number; when there is a first application identity in the at least one application identity that is equal to the decrypted network identity of the terminal device, and the decrypted first random number is equal to the first random number carried in the first authentication request, the application server determines that the terminal device is authenticated.

Optionally, when there is no first application identity in the at least one application identity that is equal to the network identity of the terminal device after decryption, and/or the first random number after decryption is not equal to the first random number carried in the first authentication request, the application server determines that the terminal device authentication has failed.

Exemplarily, the above application identity may be Hash(PKu), i.e., BCADD. The above first ciphertext may be SKu(BCADD, first random number), where SKu(BCADD, first random number) is the ciphertext obtained by encrypting BCADD and the first random number with the private key SKu. PKu is the public key of the terminal device, and SKu is the private key of the terminal device.

The embodiment of the present application uses BCADD as the application identity identifier, which can ensure the identity uniformity of the terminal device between different layers such as the data link layer, network layer, transport layer and application layer, but there is a risk of the terminal device being tracked. Therefore, BCADD can be updated to reduce the risk of the terminal device being tracked. The specific update method is as follows.

As an optional embodiment, the method further includes: the terminal device sends a fourth message to the application server, the fourth message is used to indicate the update of the application identity of the terminal device, the fourth message carries a second random number and a second ciphertext, and the second ciphertext is the ciphertext obtained by encrypting the new network identity of the terminal device, the network identity and the second random number using the private key of the terminal device. Correspondingly, the application server receives the fourth message. The application server decrypts the second ciphertext using the public key of the terminal device to obtain the decrypted new network identity, the decrypted network identity and the decrypted second random number; when the decrypted second random number is equal to the second random number carried in the second ciphertext, and when the first application identity exists in the at least one application identity that is equal to the decrypted network identity, the application server updates the first application identity from the network identity to the new network identity.

Exemplarily, the second ciphertext may be SKu(new BCADD, BCADD, second random number), wherein SKu(new BCADD, BCADD, second random number) is the ciphertext obtained by encrypting new BCADD, BCADD and the second random number using the private key SKu.

In the embodiment of the present application, when the application identity of the terminal device is the network identity of the terminal device, updating the application identity of the terminal device is helpful to avoid tracking of the user's application usage behavior and causing leakage of user information, thereby improving the security of the system.

Optionally, the method further comprises: the application server sends an update response to the terminal device to indicate whether the update is successful. Correspondingly, the terminal device receives the update response from the application server.

In one possible implementation, if the update is successful, the update response may be a message indicating that the update is successful, such as an acknowledgement character (ACK); if the update fails, the update response may be a message indicating that the update fails, such as a negative acknowledgement character (NACK).

In another possible implementation, if the update is successful, the application server sends an update response to the terminal device, and the update response is a message indicating the update is successful, such as ACK. If the update fails, no response is made. In this case, the terminal device can set a timer, which starts after the fourth information is sent. If the terminal device does not receive the update response fed back by the application server before the timer times out, the terminal device defaults to the application server failing to update BCADD.

It should be understood that when the application identity of the terminal device is the network identity of the terminal device, since BCADD has no globally accessible location, when the terminal device requests access to the application server, the network device 2 corresponding to the application server performs routing, and the application server needs to look up the address in the blockchain to route subsequent messages to the terminal device.

As an optional embodiment, before the application server receives the first authentication request from the terminal device, the method also includes: the application server sends third information to a network device corresponding to the application server, the third information is used to respond to the first information, and the third information carries the network identification of the terminal device; correspondingly, the network device corresponding to the application server receives the third information.

It should be understood that after receiving the third information, the network device corresponding to the above-mentioned application server can send a query request to the blockchain device based on the third information. The query request carries the network identification of the terminal device. The query request is used to query the identity (identity, ID) of the network device corresponding to the terminal device, which corresponds to the network identification of the terminal device and is in the same network domain as the network device corresponding to the application server. Correspondingly, the blockchain device receives the query request, and determines the ID of the network device corresponding to the terminal device, which corresponds to the received network identification and is in the same network domain as the network device corresponding to the application server, by using the correspondence between the network identification stored therein and the ID of the network device corresponding to the terminal device. The network device corresponding to the application server obtains the ID of the network device corresponding to the terminal device, thereby addressing the network device to which the terminal device is connected according to the ID of the network device, and then finding the terminal device.

As an optional embodiment, when the authentication is passed, the application server allocates a temporary external identifier to the terminal device, and the temporary external identifier is used to externally identify the application of the terminal device; the application server sends information indicating the correspondence between the network identifier and the temporary external identifier to the blockchain device. Correspondingly, the blockchain device receives the information.

Exemplarily, the temporary external identifier may be a unified resource location address (URL), an application programming interface (API), or a port identifier.

The embodiment of the present application can prevent the internal identifier of the terminal device from being exposed in the network by setting a temporary external identifier, thereby increasing the security of the communication system.

As an optional embodiment, the method further includes: the terminal device sends fifth information to the application server, the fifth information is used to request that the first application identity be used as the identity of the terminal device under the application corresponding to the application server, and the fifth information carries the first application identity. Correspondingly, the application server receives the fifth information, and based on the fifth information, sends a second authentication request to the terminal device, the second authentication request is used to request authentication of the terminal device. Correspondingly, the terminal device receives the second authentication request, and based on the second authentication request, sends a second authentication response to the application server, the second authentication response carries information used for authentication. Correspondingly, the application server receives the second authentication response, and based on the second authentication response, authenticates the terminal device. If the authentication is successful, the application server stores the correspondence between the first application identity and the public key of the terminal device.

It should be understood that before the terminal device sends the fifth information to the application server, the terminal device needs to access the network. The embodiment of the present application does not limit the network access method and the network identifier used. In one possible implementation, the terminal device can use BCADD as the network identifier, initiate a random access process, and access the network. In another possible implementation, the terminal device can use other identifiers as the network identifier, initiate a random access process, and access the network.

Optionally, the information used for authentication includes: the public key of the terminal device, a third random number and a third ciphertext, the third ciphertext being the ciphertext obtained by encrypting the first application identity and the third random number using the private key of the terminal device; the application server authenticates the terminal device based on the second authentication response, including: the application server uses the public key of the terminal device to decrypt the third ciphertext to obtain the decrypted first application identity and the decrypted third random number; when the decrypted first application identity is equal to the first application identity carried in the fifth information, and the decrypted third random number is equal to the third random number carried in the second authentication response, the application server determines that the terminal device authentication is successful.

Optionally, when the decrypted first application identity is not equal to the first application identity carried in the fifth information, and/or the decrypted third random number is not equal to the third random number carried in the second authentication response, the application server determines that the terminal device authentication has failed.

Optionally, if the above authentication fails, the application server may send an authentication request message to the terminal device again, requesting re-authentication of the terminal device. When the above authentication passes, the authentication request message will no longer be sent repeatedly. If the specific number of repetitions reaches the preset upper limit, the application server considers that the terminal device has failed the authentication.

It should be understood that the process in which the application server authenticates the terminal device and stores the correspondence between the first application identity and the public key of the terminal device may be performed before S402 in method 400 .

The embodiment of the present application completes the authentication of the terminal device through a pre-stored correspondence relationship, without the need to establish a correspondence during the authentication process, making the authentication process simpler and faster, thereby improving authentication efficiency.

Exemplarily, the application identity of the terminal device is the network identity of the terminal device, and the third ciphertext may be SKu(BCADD, third random number), wherein SKu(BCADD, third random number) is the ciphertext obtained by encrypting BCADD and the third random number using the private key SKu.

Exemplarily, the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivative function, and the third ciphertext may be SKu (APPID, third random number), wherein SKu (APPID, third random number) is the ciphertext obtained by encrypting the APPID and the third random number using the private key SKu.

When the network is untrustworthy, the message sent by the terminal device to the application server may be tampered with, so two-way authentication can be performed again between the terminal device and the application server. If the two-way authentication passes, the application server will provide services for the application of the terminal device to improve the accuracy of application authentication.

As an optional embodiment, the method further includes: the application server sends a third authentication request to the terminal device, the third authentication request carries a fourth ciphertext, and the fourth ciphertext is a ciphertext obtained by encrypting the application identity of the terminal device, the network identity of the terminal device, and the fourth random number using the public key of the terminal device. Correspondingly, the terminal device receives the third authentication request, and based on the third authentication request, sends a third authentication response to the application server. Correspondingly, the application server receives the third authentication response, the third authentication response carries a fourth ciphertext, and the fourth ciphertext is a ciphertext obtained by encrypting the application identity of the terminal device, the network identity of the terminal device, and the fourth random number obtained by decrypting the fourth ciphertext using the private key of the terminal device. The application server authenticates the terminal device based on the third authentication response; if the authentication is successful, the application server sends the second information to the terminal device.

Optionally, the terminal device receives the third authentication request, and based on the third authentication request, sends a third authentication response to the application server, which specifically includes: the terminal device uses its own private key to decrypt the fourth ciphertext to obtain a decrypted application identity, a decrypted network identity and a decrypted fourth random number; the terminal device then uses its own private key to encrypt the decrypted application identity, the decrypted network identity and the decrypted fourth random number to obtain a fourth ciphertext encrypted by the private key, and sends a third authentication response to the application server, wherein the third authentication response carries the fourth ciphertext encrypted by the private key.

Exemplarily, the fourth ciphertext encrypted by the private key may be SKu (APPID, BCADD, fourth random number). The application server authenticates the terminal device based on the third authentication response, specifically including: the application server decrypts the fourth ciphertext encrypted by the private key using the public key of the terminal device to obtain the decrypted application identity, the decrypted network identity and the decrypted fourth random number; when the decrypted fourth random number is equal to the fourth random number carried in the third authentication request, the application server determines that the terminal device is authenticated.

In the embodiment of the present application, two-way authentication can be performed between the terminal device and the application server. When the two-way authentication is passed, the application server provides services for the application of the terminal device to improve the accuracy of application authentication.

Below, the application authentication method of the embodiment of the present application is described in detail with reference to Figures 5 to 8.

FIG5 shows a schematic flow chart of an application authentication method 500 provided in an embodiment of the present application. The method can be applied to the communication system 100 shown in FIG1 , and can also be applied to other communication systems, which is not limited in the embodiment of the present application. The method 500 includes:

S501, the terminal device generates a public-private key pair (PKu, SKu), wherein PKu is the public key of the terminal device, and SKu is the private key of the terminal device.

It should be understood that based on the public key PKu, the terminal device can obtain Hash (PKu), that is, the above-mentioned BCADD, and Hash (PKu) represents the value obtained after hashing the public key PKu. BCADD can be understood as the blockchain address of the above-mentioned terminal device derived from the public key PKu. The above-mentioned Hash (BCADD) represents the value obtained after hashing BCADD. The Hash (BCADD) of the embodiment of the present application is APPID, which can be understood as the encrypted network identity identifier (also referred to as identity identifier) of the terminal device under the application.

S502, the terminal device accesses the network.

It should be understood that the above-mentioned access network does not limit the network access method of the terminal device and the network identifier used. In one possible implementation, the terminal device uses BCADD as the network identifier, initiates a random access process, and the terminal device accesses the network. In another possible implementation, the terminal device uses other identifiers as the network identifier, initiates a random access process, and the terminal device accesses the network.

S503, when a user opens an application through a terminal device, in response to the user's operation, the terminal device sends a first message to the application server of the application, the first message carrying the APPID, the first message being used to indicate that the APPID is used as the identity of the terminal device under the application. Correspondingly, the application server receives the first message.

S504, the application server sends an authentication request to the terminal device based on the received APPID, where the authentication request is used to request authentication of the terminal device. Correspondingly, the terminal device receives the authentication request.

S505: Based on the received authentication request, the terminal device sends an authentication response to the application server, which carries SKu (APPID, random number 1), public key PKu and random number 1, where SKu (APPID, random number 1) is the ciphertext obtained by encrypting APPID and random number 1 with private key SKu. Correspondingly, the application server receives the authentication response.

It should be understood that when the application server is disconnected from the network, the above authentication response may not be able to reach the application server. Therefore, in a possible implementation, the application server can set a timer, which starts counting after the authentication request is sent in S504. If the application server does not receive an authentication response from the terminal device before the timer times out, the application server sends an authentication failure message to the terminal device, and the authentication failure message can be, for example, a NACK message. Correspondingly, the terminal device receives the authentication failure message.

S506: The application server performs authentication based on the received authentication response.

The above authentication can be understood as: the application server uses the public key PKu to decrypt SKu (APPID, random number 1). If the decrypted APPID is the same as the APPID received in the above S504, and the decrypted random number 1 is the same as the random number 1 carried in the authentication response, the application server determines that the terminal device has passed the authentication.

S507, when the authentication is successful, the application server stores the APPID as the identity of the terminal device under the application, and stores the corresponding relationship between the APPID and the public key PKu.

It should be understood that when the above authentication fails, the application server can send an authentication request message to the terminal device again and repeat the above S504-S506. When the above authentication passes, it will no longer be repeated. If the specific number of repetitions reaches the preset upper limit, the application server considers that the terminal device has failed the authentication.

S508, the terminal device uses BCADD as the network identifier to access the network, establishes an RRC connection with the network device based on the public-private key pair (PKu, SKu), and establishes a protocol data unit (PDU) session through two-way authentication with the network device.

It should be understood that the terminal device uses BCADD as the network identifier to initiate a random access process to the network device. In one possible implementation, the terminal device sends an RRC connection establishment request to the network device, and the RRC connection establishment request carries BCADD. Correspondingly, the network device receives the RRC connection establishment request and triggers the RRC connection establishment process, and the terminal device establishes an RRC connection with the network device.

After the terminal device establishes an RRC connection with the network device, the terminal device sends an authentication request to the network device and performs two-way authentication with the network device. When the terminal device passes the authentication of the network device and the network device passes the authentication of the terminal device, a PDU session between the terminal device and the network device can be established and key negotiation can be performed.

S509, when the user logs in to the application through the terminal device, the terminal device sends a data packet encapsulated with a BCADD header to the application server based on the current communication protocol. Correspondingly, the application server receives the data packet encapsulated with the BCADD header.

S510, the application server decapsulates the received data packet encapsulated with the BCADD header, captures the BCADD, and determines Hash(BCADD) based on a preset hash function, and determines whether Hash(BCADD) is the same as the APPID stored in the above S507.

It should be understood that the above-mentioned preset hash function is the hash function used by the terminal device to generate the APPID.

Optionally, when the network is untrustworthy, the method 500 further includes S511 to S513:

S511, the application server sends a request message to the terminal device, the request message is used to request the terminal device to use the private key SKu to sign APPID, BCADD and random number 2, and the request message carries PKu (APPID, BCADD, random number 2). Correspondingly, the terminal device receives the request message.

The above PKu (APPID, BCADD, random number 2) is the ciphertext obtained by encrypting APPID, BCADD and random number 2 with the public key PKu.

It should be understood that the random numbers involved in the embodiments of the present application (such as the above-mentioned random number 1 and random number 2) are all randomly generated. The above-mentioned random number 2 may be the same as the above-mentioned random number 1 or different from the above-mentioned random number 1, and the embodiments of the present application do not limit this.

S512, the terminal device sends SKu (APPID, BCADD, random number 2) to the application server based on the received request message. Correspondingly, the application server receives SKu (APPID, BCADD, random number 2).

The above SKu (APPID, BCADD, random number 2) is the ciphertext obtained by encrypting APPID, BCADD and random number 2 with the private key SKu.

S513, the application server uses the public key PKu of the terminal device to decrypt SKu (APPID, BCADD, random number 2). If the decryption is successful, the application server determines that the terminal device has passed the authentication.

It should be understood that when the above authentication fails, the application server can send a request message to the terminal device again and repeat the above S511-S513. When the above authentication passes, it will no longer be repeated. If the specific number of repetitions reaches the preset upper limit, the application server considers that the terminal device has failed the authentication.

S514, when the Hash (BCADD) in S510 is the same as the APPID stored in S507, or when the terminal device passes the authentication in S513, the application server sends the second information to the terminal device, the second information is used to indicate that the terminal device passes the authentication and the application server can provide subsequent services for the terminal device. Correspondingly, the terminal device receives the second information from the application server.

It should be understood that, in the case where the Hash (BCADD) in S510 is different from the APPID stored in S507, and in the case where the terminal device fails to pass the authentication in S513, the application server will not provide subsequent services for the terminal device. In one possible implementation, the application server sends a third message to the terminal device, and the third message is used to indicate that the terminal device fails to pass the authentication; correspondingly, the terminal device receives the third message. In another possible implementation, the application server does not respond to the terminal device.

Next, the above application authentication method 500 is introduced in more detail in conjunction with the communication system shown in FIG. 2 .

FIG6 shows a schematic flow chart of an application authentication method 600 provided in an embodiment of the present application. The method can be applied to the communication system 200 shown in FIG2 , and can also be applied to other communication systems, which is not limited in the embodiment of the present application. The method 600 includes:

S601, the terminal device network interface generates a public-private key pair (PKu, SKu), wherein PKu is the public key of the terminal device network interface, and SKu is the private key of the terminal device network interface.

S602, the terminal device network interface sends first information to the terminal device application, the first information carries Hash (BCADD), and the first information is used to indicate that Hash (BCADD) is used as the APPID of the terminal device network interface. Correspondingly, the terminal device application receives the first information.

S603, the terminal device accesses the network.

S604, when a user opens an application through a terminal device, in response to the user's operation, the terminal device application sends a second message to the application server of the application, the second message carries the APPID, and the second message is used to indicate that the APPID is used as the identity of the terminal device network interface under the application. Correspondingly, the application server receives the second message.

S605, the application server sends an authentication request to the terminal device network interface based on the received APPID, where the authentication request is used to request authentication of the terminal device. Correspondingly, the terminal device network interface receives the authentication request.

S606, the terminal device network interface sends an authentication response to the application server based on the received authentication request, and the authentication response carries SKu (APPID, random number 1), PKu and random number 1, wherein SKu (APPID, random number 1) is the ciphertext obtained by encrypting APPID and random number 1 with the private key SKu. Correspondingly, the application server receives the authentication response.

The random number 1 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S607: The application server performs authentication based on the received authentication response.

The above authentication can be understood as: the application server uses the public key PKu to decrypt SKu (APPID, random number 1). If the decrypted APPID is the same as the APPID received in the above S604, and the decrypted random number 1 is the same as the random number 1 carried in the authentication response, the application server determines that the network interface of the terminal device has passed the authentication.

S608, when the authentication is successful, the application server stores the APPID as the identity identifier of the terminal device network interface under the application, and stores the corresponding relationship between the APPID and PKu.

S609, the terminal device network interface uses BCADD as the network identifier to access the network, establishes an RRC connection with the network device based on the public-private key pair (PKu, SKu), and establishes a PDU session through two-way authentication with the network device.

S610, when a user logs in to an application through a terminal device, the terminal device application sends a login instruction to the terminal device network interface through an application layer message. Correspondingly, the terminal device network interface receives the login instruction.

S611, the network interface of the terminal device sends a data packet encapsulated with a BCADD header to the application server based on the current communication protocol. Correspondingly, the application server receives the data packet encapsulated with the BCADD header.

S612, the application server decapsulates the received data packet encapsulated with the BCADD header, captures the BCADD, and determines Hash(BCADD) based on a preset hash function, and determines whether Hash(BCADD) is the same as the APPID stored in the above S608.

Optionally, when the network is untrustworthy, the method 600 further includes S613 to S615:

S613, the application server sends a request message to the terminal device network interface, the request message is used to request the terminal device network interface to use the private key SKu to sign APPID, BCADD and random number 2, and the request message carries PKu (APPID, BCADD, random number 2). Correspondingly, the terminal device network interface receives the request message.

The above PKu (APPID, BCADD, random number 2) is the ciphertext obtained by encrypting APPID, BCADD and random number 2 with the public key PKu.

The random number 2 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S614, the terminal device network interface sends SKu (APPID, BCADD, random number 2) to the application server based on the received request message. Correspondingly, the application server receives SKu (APPID, BCADD, random number 2).

The above SKu (APPID, BCADD, random number 2) is the ciphertext obtained by encrypting APPID, BCADD and random number 2 with the private key SKu.

S615, the application server uses the public key PKu of the network interface of the terminal device to decrypt SKu (APPID, BCADD, random number 2). If the decryption is successful, the network device determines that the network interface of the terminal device has passed the authentication.

It should be understood that when the above-mentioned authentication fails, the application server may send a request message to the terminal device network interface again and repeat the above-mentioned S613-S615. When the above-mentioned authentication passes, it will no longer be repeated. If the specific number of repetitions reaches the preset upper limit, the application server considers that the terminal device network interface has failed the authentication.

S616, when the Hash (BCADD) in S612 is the same as the APPID stored in S608, or when the terminal device network interface passes the authentication in S615, the application server sends the third information to the terminal device application, the third information is used to indicate that the terminal device network interface passes the authentication, and the application server can provide subsequent services for the terminal device application. Correspondingly, the terminal device application receives the third information from the application server.

In the case of authentication failure, the application server will not provide subsequent services for the terminal device application. In one possible implementation, the application server sends fourth information to the terminal device application, where the fourth information is used to indicate that the terminal device network interface has not passed authentication; correspondingly, the terminal device application receives the fourth information. In another possible implementation, the application server will not make any response to the terminal device application.

It should be understood that the details in method 600 can refer to the description in the above method 500 and will not be repeated here.

FIG7 shows a schematic flow chart of an application authentication method 700 provided in an embodiment of the present application. The method can be applied to the communication system 100 shown in FIG1 , and can also be applied to other communication systems, which is not limited in the embodiment of the present application. The method 700 includes:

S701, the terminal device generates a public-private key pair (PKu, SKu), wherein PKu is the public key of the terminal device, and SKu is the private key of the terminal device.

It should be understood that based on the public key PKu, the terminal device can obtain Hash(PKu), that is, the above-mentioned BCADD, and Hash(PKu) represents the value obtained after performing a hash operation on the public key PKu. BCADD can be understood as the blockchain address of the above-mentioned terminal device derived from the public key PKu. Since the BCADD of the embodiment of the present application is APPID, BCADD can also be understood as the encrypted network identity identifier (also referred to as identity identifier) of the terminal device under the application.

S702, the terminal device accesses the network.

It should be understood that the above-mentioned access network does not limit the network access method of the terminal device and the network identifier used. In one possible implementation, the terminal device uses BCADD as the network identifier, initiates a random access process, and the terminal device accesses the network. In another possible implementation, the terminal device uses other identifiers as the network identifier, initiates a random access process, and the terminal device accesses the network.

S703, when a user opens an application through a terminal device, in response to the user's operation, the terminal device sends a first message to the application server of the application, the first message carrying BCADD, the first message is used to indicate that the BCADD is used as the identity of the terminal device under the application. Correspondingly, the application server receives the first message.

S704, the application server sends an authentication request to the terminal device based on the received BCADD, where the authentication request is used to request authentication of the terminal device. Correspondingly, the terminal device receives the authentication request.

S705, based on the received authentication request, the terminal device sends an authentication response to the application server, the authentication response carrying SKu (BCADD, random number 1), public key PKu and random number 1, wherein SKu (BCADD, random number 1) is the ciphertext obtained by encrypting BCADD and random number 1 with private key SKu. Correspondingly, the application server receives the authentication response.

It should be understood that when the application server is disconnected from the network, the above authentication response may not be able to reach the application server. Therefore, in a possible implementation, the application server can set a timer, which starts timing after the authentication request is sent in S704. If the application server does not receive an authentication response from the terminal device before the timer times out, the application server sends an authentication failure message to the terminal device, and the authentication failure message can be, for example, a NACK message. Correspondingly, the terminal device receives the authentication failure message.

S706: The application server performs authentication based on the received authentication response.

The above authentication can be understood as: the application server uses the public key PKu to decrypt SKu (BCADD, random number 1). If the decrypted BCADD is the same as the BCADD received in the above S703, and the decrypted random number 1 is the same as the random number 1 carried in the authentication response, the application server determines that the terminal device has passed the authentication.

The random number 1 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S707, when the authentication is successful, the application server stores BCADD as the identity of the terminal device under the application, and stores the corresponding relationship between BCADD and the public key PKu.

S708, the terminal device uses BCADD as the network identifier to access the network, establishes an RRC connection with network device 1 based on the public-private key pair (PKu, SKu), and establishes a PDU session through two-way authentication with network device 1.

It should be understood that the terminal device uses BCADD as the network identifier to initiate a random access process to the network device 1. In one possible implementation, the terminal device sends an RRC connection establishment request to the network device 1, and the RRC connection establishment request carries BCADD. Correspondingly, the network device 1 receives the RRC connection establishment request and triggers the RRC connection establishment process, and the terminal device establishes an RRC connection with the network device 1.

During the RRC connection establishment process, network device 1 allocates a cell-radio network temporary identifier (C-RNTI) to the terminal device. In addition to obtaining the C-RNTI, the terminal device can also obtain the cell identifier (national cell identifier, NCI) of network device 1 and the ID of network device 1.

After the terminal device establishes an RRC connection with network device 1, the terminal device sends an authentication request to network device 1 and performs two-way authentication with network device 1. When the terminal device passes the authentication of network device 1 and network device 1 passes the authentication of the terminal device, a PDU session between the terminal device and network device 1 can be established and key negotiation can be performed.

S709, when the RRC connection between the terminal device and the network device 1 is successfully established, the network device 1 sends the BCADD and the ID of the network device 1 to the blockchain device. Correspondingly, the blockchain device receives the BCADD and the ID of the network device 1, and stores the corresponding relationship between the BCADD and the ID of the network device 1.

It should be understood that a terminal device may simultaneously access multiple interconnected or contained network domains, for example, the connection between the terminal device and the access network device, and the connection between the terminal device and the core network device. Since different network domains correspond to different network device IDs, a BCADD may have a corresponding relationship with multiple network device IDs. For a blockchain device, the corresponding relationship between the BCADD and multiple network device IDs can be saved.

Optionally, since BCADD has no globally network-reachable location, method 700 also includes S710 to S714. When a terminal device requests access to an application server, the network device 2 corresponding to the application server performs routing, and the application server needs to search for addressing in the blockchain to route subsequent messages to the terminal device.

S710, when a user logs in to an application through a terminal device, the terminal device sends an access request to an application server, the access request carries a BCADD, and the access request is used to instruct the application server to provide services for the terminal device. Correspondingly, the application server receives the access request.

S711, based on the received access request, the application server sends a login response to network device 2, the login response carrying the BCADD, the login response being used to determine the ID of network device 1 corresponding to the BCADD and in the same network domain as network device 2. Correspondingly, network device 2 receives the login response.

Exemplarily, the network device 2 may be a router.

S712, network device 2 sends a query request to the blockchain device based on the received login response, the query request carries BCADD, and the query request is used to query the ID of network device 1 corresponding to the BCADD and in the same network domain as network device 2. Correspondingly, the blockchain device receives the query request, and uses the correspondence between the BCADD and the ID of network device 1 stored in S710 to determine the ID of network device 1 corresponding to the received BCADD and in the same network domain as network device 2, and network device 2 obtains the ID of network device 1.

S713, network device 2 sends a login response to network device 1 corresponding to the ID of network device 1 based on the ID of network device 1, the login response carrying BCADD. Correspondingly, network device 1 receives the login response.

S714, network device 1 determines a terminal device corresponding to the BCADD based on the BCADD, and sends a login response to the terminal device, where the login response carries the BCADD.

S715, based on the received login response, the terminal device sends an authentication request to the application server, the authentication request carries SKu(BCADD, random number 2) and random number 2, wherein SKu(BCADD, random number 2) is the ciphertext obtained by encrypting BCADD and random number 2 with the private key SKu. Correspondingly, the application server receives the authentication request.

The random number 2 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S716: The application server performs authentication based on the received authentication request.

The above authentication can be understood as: the application server uses the public key PKu to decrypt SKu (BCADD, random number 2). If the decrypted BCADD is the same as the BCADD received in the above S712, and the decrypted random number 2 is the same as the random number 2 carried in the authentication request, the application server determines that the terminal device has passed the authentication.

S717: If the authentication is successful, the application server sends an authentication response to the terminal device, and the terminal device receives the authentication response accordingly.

Optionally, the above authentication response may carry SKs(BCADD, random number 3), public key PKs and random number 3, wherein PKs is the public key of the application server, SKs is the private key of the application server, and SKs(BCADD, random number 3) is the ciphertext obtained by encrypting BCADD and random number 3 with private key SKs. Correspondingly, the terminal device receives the authentication response.

The random number 3 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

Optionally, when the terminal device considers it necessary to authenticate the application server, the method 700 further includes S718:

S718: The terminal device performs authentication based on the received authentication response.

The above authentication can be understood as: the terminal device uses the public key PKs to decrypt SKs (BCADD, random number 3). If the decrypted BCADD is the same as the BCADD received in the above S716, and the decrypted random number 3 is the same as the random number 3 carried in the authentication response, the terminal device determines that the application server has passed the authentication.

S719, when the terminal device passes the authentication of the application server, the application server allocates a temporary external identifier for BCADD, and sends the correspondence between BCADD and the temporary external identifier to the blockchain device, where the temporary external identifier can be, for example, a unified resource location address (URL) and/or a port. Correspondingly, the blockchain device receives and stores the correspondence between the BCADD and the temporary external identifier. By setting a temporary external identifier, the internal identifier of the terminal device can be prevented from being exposed to the network, thereby increasing the security of the system.

S720, when the terminal device passes the authentication of the application server, the application server sends second information to the terminal device, the second information is used to indicate that the terminal device passes the authentication and the application server can provide subsequent services for the terminal device. Correspondingly, the terminal device receives the second information from the application server.

It should be understood that the result of the terminal device authenticating the application server in S718 above does not affect the application server providing subsequent services to the terminal device. For example, if the terminal device passes the authentication of the application server but the application server fails the authentication of the terminal device, the application server can provide subsequent services to the terminal device, and the terminal device may choose not to use the service.

Optionally, when the current PDU session needs to be replaced with a new BCADD due to security or privacy reasons, the method 700 further includes the following steps:

S721, after generating a new BCADD, the terminal device sends SKu (new BCADD, BCADD, random number 4) and random number 4 to the application server, where SKu (new BCADD, BCADD, random number 4) is the ciphertext obtained by encrypting the new BCADD, BCADD and random number 4 with the private key SKu. Correspondingly, the application server receives the SKu (new BCADD, BCADD, random number 4) and random number 4.

The random number 4 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

Exemplarily, the new BCADD can be obtained by hashing the public key PKu using a new hash function, or by hashing the public key PKu newly generated by the terminal device using the original hash function, or by hashing the public key PKu newly generated by the terminal device using a new hash function. This application does not limit this.

It should be understood that the above-mentioned private key SKu can be stored in a secure place such as a trusted execution environment (TEE) or a trusted platform module (TPM), and the embodiments of the present application are not limited thereto.

S722, the application server uses the public key PKu to decrypt SKu (new BCADD, BCADD, random number 4). If the decrypted BCADD is the same as the BCADD received in the above S710, and the decrypted random number 4 is the same as the received random number 4, the authentication is passed.

S723, if the authentication is successful, the application server sends an ACK to the terminal device; if the authentication fails, the application server sends a NACK to the terminal device. Correspondingly, the terminal device receives an ACK or a NACK from the application server.

S724, when the authentication is successful, the terminal device updates the BCADD to a new BCADD and uses the BCADD in subsequent PDU sessions.

It should be understood that when the above authentication fails, the terminal device can send an authentication request message to the application server again and repeat the above S721-S723. When the above authentication is successful, it will not be repeated. If the specific number of repetitions reaches the preset upper limit, the application server considers that the terminal device has not passed the authentication.

Next, the above-mentioned application authentication method 700 is introduced in more detail in conjunction with the communication system shown in FIG. 2 .

FIG8 shows a schematic flow chart of an application authentication method 800 provided in an embodiment of the present application. The method can be applied to the communication system 200 shown in FIG2 , and can also be applied to other communication systems, which is not limited in the embodiment of the present application. The method 800 includes:

S801, the terminal device network interface generates a public-private key pair (PKu, SKu), wherein PKu is the public key of the terminal device network interface, and SKu is the private key of the terminal device network interface.

S802, the terminal device network interface sends first information to the terminal device application, the first information carries BCADD, and the first information is used to indicate that BCADD is used as the APPID of the terminal device network interface. Correspondingly, the terminal device application receives the first information.

S803, the terminal device accesses the network.

S804, when a user opens an application through a terminal device, in response to the user's operation, the terminal device application sends a second message to the application server of the application, the second message carries BCADD, and the second message is used to indicate that the BCADD is used as the identity of the terminal device under the application. Correspondingly, the application server receives the second message.

S805, the application server sends an authentication request to the terminal device network interface based on the received BCADD, where the authentication request is used to request authentication of the terminal device network interface. Correspondingly, the terminal device network interface receives the authentication request.

S806, the terminal device network interface sends an authentication response to the application server based on the received authentication request, and the authentication response carries SKu (BCADD, random number 1), public key PKu and random number 1, wherein SKu (BCADD, random number 1) is the ciphertext obtained by encrypting BCADD and random number 1 with private key SKu. Correspondingly, the application server receives the authentication response.

The random number 1 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S807: The application server performs authentication based on the received authentication response.

The above authentication can be understood as: the application server uses the public key PKu to decrypt SKu (BCADD, random number 1). If the decrypted BCADD is the same as the BCADD received in the above S804, and the decrypted random number 1 is the same as the random number 1 carried in the authentication response, the application server determines that the terminal device has passed the authentication.

S808, when the authentication is successful, the application server stores BCADD as the identity of the terminal device under the application, and stores the corresponding relationship between BCADD and the public key PKu.

S809, the terminal device network interface uses BCADD as the network identifier to access the network, establishes an RRC connection with network device 1 based on the public-private key pair (PKu, SKu), and establishes a PDU session through two-way authentication with network device 1.

S810, when the RRC connection between the terminal device network interface and the network device 1 is successfully established, the network device 1 sends the BCADD and the ID of the network device 1 to the blockchain device. Correspondingly, the blockchain device receives the BCADD and the ID of the network device 1, and stores the corresponding relationship between the BCADD and the ID of the network device 1.

S811, when a user logs in to an application through a terminal device, the terminal device application sends a login instruction to a terminal device network interface through an application layer message. Correspondingly, the terminal device network interface receives the login instruction.

Optionally, since BCADD has no globally network-reachable location, method 800 also includes S812 to S816. When the terminal device network interface requests access to the application server, the network device 2 corresponding to the application server performs routing, and the application server needs to search for addressing in the blockchain to route subsequent messages to the terminal device network interface.

S812, the terminal device network interface sends an access request to the application server based on the received login instruction, the access request carries the BCADD, and the access request is used to instruct the application server to provide services for the terminal device. Correspondingly, the application server receives the access request.

S813, based on the received access request, the application server sends a login response to network device 2, the login response carrying the BCADD, the login response being used to determine the ID of network device 1 corresponding to the BCADD and in the same network domain as network device 2. Correspondingly, network device 2 receives the login response.

Exemplarily, the network device 2 may be a router.

S814, network device 2 sends a query request to the blockchain device based on the received login response, the query request carries BCADD, and the query request is used to query the ID of network device 1 corresponding to the BCADD and in the same network domain as network device 2. Correspondingly, the blockchain device receives the query request, and uses the correspondence between the BCADD and the ID of network device 1 stored in S810 to determine the ID of network device 1 corresponding to the received BCADD and in the same network domain as network device 2, and network device 2 obtains the ID of network device 1.

S815, network device 2 sends a login response to network device 1 corresponding to the ID of network device 1 based on the ID of network device 1, the login response carrying BCADD. Correspondingly, network device 1 receives the login response.

S816, network device 1 determines the terminal device network interface corresponding to the BCADD based on the BCADD, and sends a login response to the terminal device network interface, where the login response carries the BCADD.

S817, the terminal device network interface sends an authentication request to the application server based on the received login response, and the authentication request carries SKu(BCADD, random number 2) and random number 2, wherein SKu(BCADD, random number 2) is the ciphertext obtained by encrypting BCADD and random number 2 with the private key SKu. Correspondingly, the application server receives the authentication request.

The random number 2 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S818: The application server performs authentication based on the received authentication request.

The above authentication can be understood as: the application server uses the public key PKu to decrypt SKu (BCADD, random number 2). If the decrypted BCADD is the same as the BCADD received in the above S812, and the decrypted random number 2 is the same as the random number 2 carried in the authentication request, the application server determines that the network interface of the terminal device has passed the authentication.

S819, when the authentication is successful, the application server sends an authentication response to the network interface of the terminal device. Correspondingly, the network interface of the terminal device receives the authentication response.

Optionally, the above authentication response may carry SKs(BCADD, random number 3), public key PKs and random number 3, wherein PKs is the public key of the application server, SKs is the private key of the application server, and SKs(BCADD, random number 3) is the ciphertext obtained by encrypting BCADD and random number 3 with SKs. Correspondingly, the terminal device network interface receives the authentication response.

The random number 3 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

Optionally, when the terminal device network interface deems it necessary to authenticate the application server, the method 800 further includes S820:

S820, the terminal device network interface performs authentication based on the received authentication response.

The above authentication can be understood as: the terminal device network interface uses the public key PKs to decrypt SKs (BCADD, random number 3). If the decrypted BCADD is the same as the BCADD received in the above S816, and the decrypted random number 3 is the same as the random number 3 carried in the authentication response, then the terminal device network interface determines that the application server has passed the authentication.

S821, when the network interface of the terminal device passes the authentication of the application server, the application server allocates a temporary external identifier for BCADD, and sends the correspondence between BCADD and the temporary external identifier to the blockchain device, where the temporary external identifier can be, for example, a unified resource location address (URL) and/or a port. Correspondingly, the blockchain device receives and stores the correspondence between the BCADD and the temporary external identifier. By setting a temporary external identifier, the internal identifier of the terminal device can be prevented from being exposed to the network, thereby increasing the security of the system.

S822, when the terminal device network interface passes the authentication of the application server, the application server sends second information to the terminal device application, the second information is used to indicate that the terminal device application passes the authentication, and the application server can provide subsequent services for the terminal device application. Correspondingly, the terminal device application receives the second information from the application server.

It should be understood that the result of the terminal device network interface authenticating the application server in S820 does not affect the application server providing subsequent services to the terminal device application. For example, if the terminal device network interface passes the authentication of the application server, but the application server fails to authenticate it through the terminal device network interface, the application server can provide subsequent services to the terminal device application, and the terminal device application may choose not to use the service.

Optionally, when the current PDU session needs to be replaced with a new BCADD due to security or privacy reasons, the method 800 further includes the following steps:

S823, the terminal device network interface sends a new BCADD to the terminal device application. Correspondingly, the terminal device application receives the new BCADD.

S824, the terminal device network interface sends the private key SKu to the terminal device application. Correspondingly, the terminal device application receives the private key SKu.

The sending of the private key SKu and the sending of the new BCADD are not limited in order. In one possible implementation, the private key SKu can be sent to the terminal device application together with the new BCADD in the above S823. In another possible implementation, when the current PDU session needs to be replaced with a new BCADD again due to security or privacy reasons, and the private key SKu has not changed, the terminal device network interface does not need to repeatedly send SKu to the terminal device application, and only needs to send a new BCADD.

S825, the terminal device application sends SKu(new BCADD, BCADD, random number 4) and random number 4 to the application server based on the received private key SKu, wherein SKu(new BCADD, BCADD, random number 4) is the ciphertext obtained by encrypting new BCADD, BCADD and random number 4 with the private key SKu. Correspondingly, the application server receives SKu(new BCADD, BCADD, random number 4) and random number 4.

The random number 4 generally refers to a randomly generated value, which may be the same as or different from the other random numbers mentioned above, and the embodiment of the present application does not limit this.

S826, the application server uses the public key PKu to decrypt SKu (new BCADD, BCADD, random number 4). If the decrypted BCADD is the same as the BCADD received in the above S812, and the decrypted random number 4 is the same as the received random number 4, the authentication is passed.

S827, if the authentication is successful, the application server sends an ACK to the terminal device application; if the authentication fails, the application server sends a NACK to the terminal device application. Correspondingly, the terminal device application receives an ACK or NACK from the application server.

S828, when the authentication is successful, the terminal device network interface updates the BCADD to a new BCADD and uses the BCADD in subsequent PDU sessions.

It should be understood that when the above authentication fails, the application server can send an authentication request message to the terminal device again and repeat the above S823-S827. When the above authentication passes, it will no longer be repeated. If the specific number of repetitions reaches the preset upper limit, the application server considers that the terminal device has failed the authentication.

It should be understood that the details in method 800 can refer to the description in the above method 700 and will not be repeated here.

It should be understood that the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

The application authentication method according to the embodiment of the present application is described in detail above in combination with Figures 1 to 8. The application authentication device according to the embodiment of the present application will be described in detail below in combination with Figures 9 to 11.

FIG9 shows an application authentication device 900 provided in an embodiment of the present application. The device 900 includes: a transceiver unit 910 and a processing unit 920 .

Among them, the transceiver unit 910 is used to: obtain first information from the terminal device, the first information is used to request service data, and the first information carries the network identification of the terminal device; the processing unit 920 is used to: authenticate the terminal device based on the network identification of the terminal device and a pre-stored correspondence, the correspondence is used to indicate the correspondence between the public key of at least one terminal device and at least one application identity authenticated by the device 900, and the at least one application identity is obtained based on the network identification of the terminal device corresponding to the at least one application identity; the transceiver unit 910 is also used to: send second information to the terminal device when the authentication is successful, and the second information is used to indicate that the terminal device has passed the authentication.

Optionally, the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivation function, or the application identity of the terminal device is the network identity of the terminal device.

Optionally, the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivative function, and the processing unit 920 is specifically used to: use a preset one-way derivative function to process the network identity of the terminal device to obtain a processing result; if there is a first application identity in the at least one application identity that is equal to the processing result, it is determined that the terminal device has passed the authentication.

Optionally, the application identity of the terminal device is the network identity of the terminal device, and the transceiver unit 910 is specifically used to: receive a first authentication request from the terminal device, the first authentication request carries a first random number and a first ciphertext, the first ciphertext is the ciphertext obtained by encrypting the network identity of the terminal device and the first random number using the private key of the terminal device; the processing unit 920 is specifically used to: use the public key of the terminal device to decrypt the first ciphertext to obtain the decrypted network identity of the terminal device and the decrypted first random number; and when there is a first application identity in the at least one application identity that is equal to the decrypted network identity of the terminal device, and the decrypted first random number is equal to the first random number carried in the first authentication request, it is determined that the terminal device authentication is successful.

Optionally, the transceiver unit 910 is further used to: send third information to a network device corresponding to the apparatus 900, wherein the third information is used to respond to the first information, and the third information carries a network identifier of the terminal device.

Optionally, the processing unit 920 is also used to: when the authentication is successful, assign a temporary external identifier to the terminal device, and the temporary external identifier is used to externally identify the application of the terminal device; and send information to the blockchain device indicating the correspondence between the network identifier and the temporary external identifier.

Optionally, the transceiver unit 910 is also used to: receive fourth information from the terminal device, the fourth information is used to indicate an update of the application identity of the terminal device, the fourth information carries a second random number and a second ciphertext, the second ciphertext is the ciphertext obtained by encrypting the new network identifier of the terminal device, the network identifier and the second random number using the private key of the terminal device; the processing unit 920 is also used to: decrypt the second ciphertext using the public key of the terminal device to obtain the decrypted new network identifier, the decrypted network identifier and the decrypted second random number; when the decrypted second random number is equal to the second random number carried in the second ciphertext, and when the first application identity exists in the at least one application identity and is equal to the decrypted network identifier, the first application identity is updated from the network identifier to the new network identifier.

Optionally, the transceiver unit 910 is used to: receive fifth information from the terminal device, the fifth information is used to request that the first application identity be used as the identity of the terminal device under the application corresponding to the device 900, and the third information carries the first application identity; the processing unit 920 is used to: send a second authentication request to the terminal device based on the fifth information, and the second authentication request is used to request authentication of the terminal device; the transceiver unit 910 is also used to: receive a second authentication response from the terminal device, and the second authentication response carries information used for authentication; the processing unit 920 is also used to: authenticate the terminal device based on the second authentication response; and if the authentication is successful, store the correspondence between the first application identity and the public key of the terminal device.

Optionally, the information used for authentication includes: the public key of the terminal device, a third random number and a third ciphertext, wherein the third ciphertext is the ciphertext obtained by encrypting the first application identity and the third random number using the private key of the terminal device; the processing unit 920 is also used to: use the public key of the terminal device to decrypt the third ciphertext to obtain the decrypted first application identity and the decrypted third random number; when the decrypted first application identity is equal to the first application identity carried in the fifth information, and the decrypted third random number is equal to the third random number carried in the second authentication response, it is determined that the terminal device authentication is successful.

Optionally, the transceiver unit 910 is used to: send a third authentication request to the terminal device, the third authentication request carries a fourth ciphertext, and the fourth ciphertext is the ciphertext obtained by encrypting the application identity of the terminal device, the network identity of the terminal device and the fourth random number using the public key of the terminal device; receive a third authentication response from the terminal device, the third authentication response carries a fourth ciphertext, and the fourth ciphertext is the ciphertext obtained by encrypting the application identity of the terminal device, the network identity of the terminal device and the fourth random number decrypted based on the fourth ciphertext using the private key of the terminal device; the processing unit 920 is used to: authenticate the terminal device based on the third authentication response; the transceiver unit 910 is also used to: send the second information to the terminal device if the authentication is successful.

It should be understood that the device 900 here is embodied in the form of a functional unit. The term "unit" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and/or other suitable components that support the described functions. In an optional example, those skilled in the art will understand that the device 900 may be specifically an application server in the above-mentioned embodiment, and the device 900 may be used to execute the various processes and/or steps corresponding to the application server in the above-mentioned method embodiment, and to avoid repetition, it will not be repeated here.

FIG10 shows another application authentication device 1000 provided in an embodiment of the present application. The device 1000 includes: a sending unit 1010 and a receiving unit 1020 .

Among them, the sending unit 1010 is used to: send first information to the application server, the first information is used to request service data, the first information carries the network identification of the device 1000, the network identification of the device 1000 is used by the application server to authenticate the device 1000 based on a pre-stored correspondence relationship, the correspondence is used to indicate the correspondence between the public key of at least one device 1000 and at least one application identity authenticated by the application server, the at least one application identity is obtained based on the network identification of the device 900 corresponding to the at least one application identity; the receiving unit 1020 is used to: receive second information from the application server, the second information is used to indicate that the device 1000 has passed the authentication.

Optionally, the application identity of the device 1000 is a value obtained by processing the network identity of the device 1000 using a preset one-way derivation function, or the application identity of the device 1000 is the network identity of the device 1000.

Optionally, the sending unit 1010 is used to: send fourth information to the application server, the fourth information is used to indicate an update of the application identity of the device 1000, the fourth information carries a second random number and a second ciphertext, the second ciphertext is the ciphertext obtained by encrypting the new network identifier of the device 1000, the network identifier and the second random number using the private key of the device 1000.

Optionally, the sending unit 1010 is further used to: send fifth information to the application server, the fifth information being used to request that the first application identity be used as the identity of the device 1000 under the application corresponding to the application server, the fifth information carrying the first application identity;

Optionally, the receiving unit 1020 is further used to: receive a second authentication request from the application server, the second authentication request is used to request authentication of the device 1000; and send a second authentication response to the application server, the second authentication response carrying information used for authentication.

Optionally, the information used for authentication includes: a public key of the device 1000, a third random number and a third ciphertext, and the third ciphertext is a ciphertext obtained by encrypting the first application identity and the third random number using the private key of the device 1000.

Optionally, the receiving unit 1020 is used to: receive a third authentication request from the application server, the third authentication request carries a fourth ciphertext, and the fourth ciphertext is the ciphertext obtained by encrypting the first application identity, the network identity of the device 1000 and the fourth random number using the public key of the device 1000; the device 1000 also includes a processing unit, which is used to: use the private key of the device 1000 to decrypt the fourth ciphertext to obtain the decrypted first application identity, the decrypted network identity of the device 1000 and the decrypted fourth random number; the processing unit is also used to: use the private key of the device 1000 to encrypt the decrypted first application identity, the decrypted network identity of the device 1000 and the decrypted fourth random number to obtain a fourth ciphertext; the sending unit 1010 is used to: send a third authentication response to the application server, and the third authentication response carries the fourth ciphertext.

It should be understood that the device 1000 here is embodied in the form of a functional unit. The term "unit" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and/or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 1000 can be specifically a terminal device in the above-mentioned embodiment, and the device 1000 can be used to execute the various processes and/or steps corresponding to the terminal device in the above-mentioned method embodiment. To avoid repetition, it will not be repeated here.

The apparatus 900 of each of the above-mentioned schemes has the function of implementing the corresponding steps executed by the application server in the above-mentioned method, and the apparatus 1000 of each of the above-mentioned schemes has the function of implementing the corresponding steps executed by the terminal device in the above-mentioned method; the functions can be implemented by hardware, or by hardware executing corresponding software implementations. The hardware or software includes one or more modules corresponding to the above-mentioned functions. For example, the above-mentioned transceiver unit 910 may include a sending unit and a receiving unit, the sending unit can be used to implement the above-mentioned transceiver unit 910 corresponding to the various steps and/or processes for performing the sending action, and the receiving unit can be used to implement the above-mentioned transceiver unit corresponding to the various steps and/or processes for performing the receiving action. The sending unit can be replaced by a transmitter, and the receiving unit can be replaced by a receiver, respectively performing the sending and receiving operations and related processing operations in each method embodiment.

In the embodiment of the present application, the device 900 in FIG. 9 and/or the device 1000 in FIG. 10 may also be a chip or a chip system, for example, a system on chip (SoC). Correspondingly, the transceiver unit (including the transmitting unit and the receiving unit) may be the transceiver circuit of the chip, which is not limited here.

FIG11 shows another application authentication device 1100 provided in an embodiment of the present application. The device 1100 includes a processor 1110, a transceiver 1120, and a memory 1130. The processor 1110, the transceiver 1120, and the memory 1130 communicate with each other through an internal connection path, the memory 1130 is used to store instructions, and the processor 1110 is used to execute the instructions stored in the memory 1130 to control the transceiver 1120 to send and/or receive signals.

In one design, the apparatus 1100 may be an application server. The transceiver 1120 is used to: obtain first information from a terminal device, the first information is used to request service data, and the first information carries a network identifier of the terminal device; the processor 1110 is used to: authenticate the terminal device based on the network identifier of the terminal device and a pre-stored correspondence relationship, the correspondence relationship is used to indicate a correspondence between a public key of at least one terminal device and at least one application identifier authenticated by the apparatus 1100, the at least one application identifier is obtained based on the network identifier of the terminal device corresponding to the at least one application identifier; the transceiver 1120 is also used to: send second information to the terminal device when the authentication is successful, the second information is used to indicate that the terminal device is successful.

In another design, the device 1100 may be a terminal device. The transceiver 1120 is used to: send first information to an application server, the first information is used to request service data, the first information carries the network identification of the device 1100, the network identification of the device 1100 is used by the application server to authenticate the device 1100 based on a pre-stored correspondence relationship, the correspondence relationship is used to indicate the correspondence between the public key of at least one device 1100 and at least one application identity authenticated by the application server, the at least one application identity is obtained based on the network identification of the device 1100 corresponding to the at least one application identity; the transceiver 1120 is also used to: receive second information from the application server, the second information is used to indicate that the device 1100 has passed the authentication.

It should be understood that the device 1100 can be specifically an application server or terminal device in the above-mentioned embodiment, and can be used to execute the various steps and/or processes corresponding to the application server or terminal device in the above-mentioned method embodiment. Optionally, the memory 1130 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A part of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type. The processor 1110 may be used to execute instructions stored in the memory, and when the processor 1110 executes instructions stored in the memory, the processor 1110 is used to execute the various steps and/or processes of the above-mentioned method embodiment corresponding to the application server or terminal device. The transceiver 1120 may include a transmitter and a receiver, the transmitter may be used to implement the various steps and/or processes corresponding to the above-mentioned transceiver for performing the sending action, and the receiver may be used to implement the various steps and/or processes corresponding to the above-mentioned transceiver for performing the receiving action.

It should be understood that in the embodiments of the present application, the processor of the above-mentioned device may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software units in a processor for execution. The software unit can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor executes the instructions in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

Those of ordinary skill in the art will appreciate that the various method steps and units described in the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims (35)

1. An application authentication method, comprising:

the method comprises the steps that an application server obtains first information from terminal equipment, wherein the first information is used for requesting to obtain service data, and the first information carries a network identifier of the terminal equipment;

The application server authenticates the terminal equipment based on the network identification of the terminal equipment and a prestored corresponding relation, wherein the corresponding relation is used for indicating the corresponding relation between a public key of at least one terminal equipment and at least one application identity identified by the application server, and the at least one application identity is obtained based on the network identification of the terminal equipment corresponding to the at least one application identity;

and under the condition that the authentication is passed, the application server sends second information to the terminal equipment, wherein the second information is used for indicating that the terminal equipment is passed the authentication.

2. The method according to claim 1, wherein the application identity of the terminal device is a value obtained by processing the network identity of the terminal device with a preset one-way derivation function, or the application identity of the terminal device is the network identity of the terminal device.

3. The method according to claim 1 or 2, wherein the application identity of the terminal device is a value obtained by processing the network identity of the terminal device with a preset one-way derivation function;

The application server authenticates the terminal device based on the network identifier of the terminal device and a pre-stored correspondence, and the application server comprises:

The application server processes the network identifier of the terminal equipment by utilizing a preset one-way derivative function to obtain a processing result;

And if the first application identity mark is equal to the processing result in the at least one application identity mark, the application server determines that the terminal equipment passes the authentication.

4. The method according to claim 1, characterized in that the application identity of the terminal device is a network identity of the terminal device;

The method further comprises the steps of: the application server receives a first authentication request from the terminal equipment, wherein the first authentication request carries a first random number and a first ciphertext, and the first ciphertext is obtained by encrypting a network identifier of the terminal equipment and the first random number by adopting a private key of the terminal equipment;

The application server authenticates the terminal device based on the network identifier of the terminal device and a pre-stored correspondence, and the application server comprises:

The application server decrypts the first ciphertext by adopting the public key of the terminal equipment to obtain the decrypted network identifier of the terminal equipment and the decrypted first random number;

And under the condition that a first application identity is equal to the decrypted network identity of the terminal equipment and the decrypted first random number is equal to the first random number carried in the first authentication request in the at least one application identity, the application server determines that the terminal equipment passes authentication.

5. The method of claim 4, wherein prior to the application server receiving the first authentication request from the terminal device, the method further comprises:

the application server sends third information to the network equipment corresponding to the application server, wherein the third information is used for responding to the first information, and the third information carries the network identification of the terminal equipment.

6. The method according to claim 4 or 5, characterized in that the method further comprises:

under the condition that authentication is passed, the application server allocates a temporary external identifier for the terminal equipment, wherein the temporary external identifier is used for externally identifying the application of the terminal equipment;

the application server sends information indicating a correspondence between the network identifier and the temporary external identifier to a blockchain device.

7. The method according to any one of claims 4 to 6, further comprising:

The application server receives fourth information from the terminal equipment, wherein the fourth information is used for indicating to update an application identity of the terminal equipment, the fourth information carries a second random number and a second ciphertext, and the second ciphertext is obtained by encrypting a new network identity of the terminal equipment, the network identity and the second random number by adopting a private key of the terminal equipment;

the application server decrypts the second ciphertext by adopting the public key of the terminal equipment to obtain the decrypted new network identifier, the decrypted network identifier and the decrypted second random number;

And under the condition that the decrypted second random number is equal to the second random number carried in the second ciphertext and the first application identity is equal to the decrypted network identity in the at least one application identity, the application server updates the first application identity from the network identity to the new network identity.

8. The method according to any one of claims 1 to 7, further comprising:

The application server receives fifth information from the terminal equipment, wherein the fifth information is used for requesting a first application identity to be used as the identity of the terminal equipment under the application corresponding to the application server, and the fifth information carries the first application identity;

The application server sends a second authentication request to the terminal equipment based on the fifth information, wherein the second authentication request is used for requesting authentication of the terminal equipment;

The application server receives a second authentication response from the terminal equipment, wherein the second authentication response carries information for authentication;

the application server authenticates the terminal equipment based on the second authentication response;

and under the condition that the authentication is passed, the application server stores the corresponding relation between the first application identity and the public key of the terminal equipment.

9. The method of claim 8, wherein the information for authenticating comprises: the public key of the terminal equipment, a third random number and a third ciphertext, wherein the third ciphertext is obtained by encrypting the first application identity and the third random number by adopting the private key of the terminal equipment;

The application server authenticates the terminal device based on the second authentication response, including:

the application server decrypts the third ciphertext by adopting the public key of the terminal equipment to obtain the decrypted first application identity and the decrypted third random number;

and under the condition that the decrypted first application identity is equal to the first application identity carried in the fifth information and the decrypted third random number is equal to the third random number carried in the second authentication response, the application server determines that the authentication of the terminal equipment is passed.

10. The method according to any one of claims 1 to 9, further comprising:

The application server sends a third authentication request to the terminal equipment, wherein the third authentication request carries a fourth ciphertext, and the fourth ciphertext is obtained by encrypting an application identity of the terminal equipment, a network identity of the terminal equipment and the fourth random number by adopting a public key of the terminal equipment;

the application server receives a third authentication response from the terminal equipment, wherein the third authentication response carries a fourth ciphertext, and the fourth ciphertext is obtained by encrypting an application identity of the terminal equipment, a network identity of the terminal equipment and the fourth random number, which are obtained by decrypting the fourth ciphertext by adopting a private key of the terminal equipment;

The application server authenticates the terminal equipment based on the third authentication response;

And the application server sends the second information to the terminal equipment under the condition that the authentication is passed.

11. An application authentication method, comprising:

The method comprises the steps that a terminal device sends first information to an application server, wherein the first information is used for requesting to acquire service data, the first information carries network identification of the terminal device, the network identification of the terminal device is used for authenticating the terminal device by the application server based on a pre-stored corresponding relation, the corresponding relation is used for indicating a corresponding relation between a public key of at least one terminal device and at least one application identity identified by the application server, and the at least one application identity is obtained based on the network identification of the terminal device corresponding to the at least one application identity;

the terminal equipment receives second information from the application server, wherein the second information is used for indicating that the terminal equipment passes authentication.

12. The method according to claim 11, wherein the application identity of the terminal device is a value obtained by processing the network identity of the terminal device with a preset one-way derivation function, or the application identity of the terminal device is the network identity of the terminal device.

13. The method according to claim 11 or 12, characterized in that the method further comprises:

The terminal equipment sends fourth information to the application server, wherein the fourth information is used for indicating to update the application identity of the terminal equipment, the fourth information carries a second random number and a second ciphertext, and the second ciphertext is obtained by encrypting the new network identity, the network identity and the second random number of the terminal equipment by adopting a private key of the terminal equipment.

14. The method according to any one of claims 11 to 13, further comprising:

The terminal equipment sends fifth information to the application server, wherein the fifth information is used for requesting a first application identity to be used as the identity of the terminal equipment under the application corresponding to the application server, and the fifth information carries the first application identity;

The terminal equipment receives a second authentication request from the application server, wherein the second authentication request is used for requesting authentication of the terminal equipment;

And the terminal equipment sends a second authentication response to the application server, wherein the second authentication response carries information for authentication.

15. The method of claim 14, wherein the information for authenticating comprises: the public key of the terminal equipment, a third random number and a third ciphertext, wherein the third ciphertext is obtained by encrypting the first application identity and the third random number by adopting the private key of the terminal equipment.

16. The method according to any one of claims 11 to 15, further comprising:

The terminal equipment receives a third authentication request from the application server, wherein the third authentication request carries a fourth ciphertext, and the fourth ciphertext is obtained by encrypting the first application identity, the network identity of the terminal equipment and the fourth random number by adopting a public key of the terminal equipment;

The terminal equipment adopts a private key of the terminal equipment to decrypt the fourth ciphertext to obtain the decrypted first application identity, the decrypted network identity of the terminal equipment and the decrypted fourth random number;

The terminal equipment adopts a private key of the terminal equipment to encrypt the decrypted first application identity, the decrypted network identity of the terminal equipment and the decrypted fourth random number to obtain a fourth ciphertext;

And the terminal equipment sends a third authentication response to the application server, wherein the third authentication response carries the fourth ciphertext.

17. An application authentication device, comprising:

the receiving and transmitting unit is used for acquiring first information from the terminal equipment, wherein the first information is used for requesting to acquire service data, and the first information carries a network identifier of the terminal equipment;

the processing unit is used for authenticating the terminal equipment based on the network identification of the terminal equipment and a prestored corresponding relation, wherein the corresponding relation is used for indicating the corresponding relation between a public key of at least one terminal equipment and at least one application identity identified by the device, and the at least one application identity is obtained based on the network identification of the terminal equipment corresponding to the at least one application identity;

The transceiver unit is further configured to: and sending second information to the terminal equipment under the condition that the authentication is passed, wherein the second information is used for indicating that the terminal equipment is passed the authentication.

18. The apparatus according to claim 17, wherein the application identity of the terminal device is a value obtained by processing the network identity of the terminal device using a preset one-way derivation function, or the application identity of the terminal device is the network identity of the terminal device.

19. The apparatus according to claim 17 or 18, wherein the application identity of the terminal device is a value obtained by processing the network identity of the terminal device with a preset one-way derivation function;

The processing unit is further configured to:

Processing the network identification of the terminal equipment by utilizing a preset one-way derivative function to obtain a processing result;

and if the first application identity mark is equal to the processing result in the at least one application identity mark, determining that the terminal equipment passes the authentication.

20. The apparatus of claim 17, wherein the application identity of the terminal device is a network identity of the terminal device;

the transceiver unit is further configured to:

receiving a first authentication request from the terminal equipment, wherein the first authentication request carries a first random number and a first ciphertext, and the first ciphertext is obtained by encrypting a network identifier of the terminal equipment and the first random number by adopting a private key of the terminal equipment;

The processing unit is further configured to:

decrypting the first ciphertext by adopting the public key of the terminal equipment to obtain the decrypted network identifier of the terminal equipment and the decrypted first random number;

And determining that the terminal equipment passes authentication under the condition that a first application identity is equal to the decrypted network identity of the terminal equipment and the decrypted first random number is equal to the first random number carried in the first authentication request in the at least one application identity.

21. The apparatus of claim 20, wherein the transceiver unit is further configured to:

And sending third information to the network equipment corresponding to the device, wherein the third information is used for responding to the first information, and the third information carries the network identification of the terminal equipment.

22. The apparatus of claim 20 or 21, wherein the processing unit is further configured to:

Under the condition that authentication is passed, a temporary external identifier is allocated to the terminal equipment, and the temporary external identifier is used for externally identifying the application of the terminal equipment;

the transceiver unit is further configured to:

And sending information for indicating the corresponding relation between the network identification and the temporary external identifier to a blockchain device.

23. The apparatus according to any one of claims 20 to 22, wherein the transceiver unit is further configured to:

Receiving fourth information from the terminal equipment, wherein the fourth information is used for indicating to update the application identity of the terminal equipment, the fourth information carries a second random number and a second ciphertext, and the second ciphertext is obtained by encrypting a new network identity of the terminal equipment, the network identity and the second random number by adopting a private key of the terminal equipment;

The processing unit is further configured to:

Decrypting the second ciphertext by adopting the public key of the terminal equipment to obtain the decrypted new network identifier, the decrypted network identifier and the decrypted second random number;

And under the condition that the decrypted second random number is equal to the second random number carried in the second ciphertext and the first application identity is equal to the decrypted network identity in the at least one application identity, updating the first application identity from the network identity to the new network identity.

24. The apparatus according to any one of claims 17 to 23, wherein the transceiver unit is further configured to:

receiving fifth information from the terminal equipment, wherein the fifth information is used for requesting a first application identity to be used as the identity of the terminal equipment under the application corresponding to the device, and the fifth information carries the first application identity;

The processing unit is further configured to:

based on the fifth information, sending a second authentication request to the terminal equipment, wherein the second authentication request is used for requesting authentication of the terminal equipment;

the transceiver unit is further configured to:

receiving a second authentication response from the terminal equipment, wherein the second authentication response carries information for authentication;

The processing unit is further configured to:

Authenticating the terminal equipment based on the second authentication response;

And storing the corresponding relation between the first application identity and the public key of the terminal equipment under the condition that the authentication is passed.

25. The apparatus of claim 24, wherein the information for authenticating comprises: the public key of the terminal equipment, a third random number and a third ciphertext, wherein the third ciphertext is obtained by encrypting the first application identity and the third random number by adopting the private key of the terminal equipment;

The processing unit is further configured to:

decrypting the third ciphertext by adopting the public key of the terminal equipment to obtain the decrypted first application identity and the decrypted third random number;

And determining that the terminal equipment passes authentication under the condition that the decrypted first application identity is equal to the first application identity carried in the fifth information and the decrypted third random number is equal to the third random number carried in the second authentication response.

26. The apparatus according to any one of claims 17 to 25, wherein the transceiver unit is further configured to:

A third authentication request is sent to the terminal equipment, wherein the third authentication request carries a fourth ciphertext, and the fourth ciphertext is obtained by encrypting an application identity of the terminal equipment, a network identity of the terminal equipment and the fourth random number by adopting a public key of the terminal equipment;

Receiving a third authentication response from the terminal equipment, wherein the third authentication response carries a fourth ciphertext, and the fourth ciphertext is obtained by encrypting an application identity of the terminal equipment, a network identity of the terminal equipment and the fourth random number, which are obtained by decrypting the fourth ciphertext by adopting a private key of the terminal equipment;

The processing unit is further configured to: authenticating the terminal equipment based on the third authentication response;

In case the authentication is passed, the transceiving unit is further configured to: and sending the second information to the terminal equipment.

27. An application authentication device, comprising:

A sending unit, configured to send first information to an application server, where the first information is used to request to obtain service data, the first information carries a network identifier of the device, the network identifier of the device is used by the application server to authenticate the device based on a pre-stored correspondence, the correspondence is used to indicate a correspondence between a public key of at least one device and at least one application identity authenticated by the application server, and the at least one application identity is obtained based on the network identifier of the device corresponding to the at least one application identity;

And the receiving unit is used for receiving second information from the application server, wherein the second information is used for indicating the device to pass authentication.

28. The apparatus of claim 27, wherein the application identity of the apparatus is a value obtained by processing the network identity of the apparatus using a preset one-way derivation function, or wherein the application identity of the apparatus is the network identity of the apparatus.

29. The apparatus according to claim 27 or 28, wherein the transmitting unit is further configured to:

And sending fourth information to the application server, wherein the fourth information is used for indicating to update the application identity of the device, the fourth information carries a second random number and a second ciphertext, and the second ciphertext is obtained by encrypting the new network identity of the device, the network identity and the second random number by adopting a private key of the device.

30. The apparatus according to any one of claims 27 to 29, wherein the transmitting unit is further configured to:

Sending fifth information to the application server, wherein the fifth information is used for requesting a first application identity to be used as the identity of the device under the application corresponding to the application server, and the fifth information carries the first application identity;

The receiving unit is further configured to:

Receiving a second authentication request from the application server, the second authentication request being for requesting authentication of the device;

The transmitting unit is further configured to:

And sending a second authentication response to the application server, wherein the second authentication response carries information for authentication.

31. The apparatus of claim 30, wherein the information for authenticating comprises: the public key, the third random number and the third ciphertext of the device are obtained by encrypting the first application identity and the third random number by adopting the private key of the device.

32. The apparatus according to any one of claims 27 to 31, wherein the receiving unit is further configured to:

Receiving a third authentication request from the application server, wherein the third authentication request carries a fourth ciphertext, and the fourth ciphertext is obtained by encrypting the first application identity, the network identity of the device and the fourth random number by adopting a public key of the device;

The apparatus further comprises:

The processing unit is used for decrypting the fourth ciphertext by adopting the private key of the device to obtain the decrypted first application identity, the decrypted network identity of the device and the decrypted fourth random number;

encrypting the decrypted first application identity, the decrypted network identity of the device and the decrypted fourth random number by adopting a private key of the device to obtain a fourth ciphertext;

The transmitting unit is further configured to:

and sending a third authentication response to the application server, wherein the third authentication response carries the fourth ciphertext.

33. An application authentication device, comprising: a processor coupled to a memory for storing a computer program which, when invoked by the processor, causes the apparatus to perform the method of any one of claims 1 to 16.

34. A computer readable storage medium storing a computer program comprising instructions for implementing the method of any one of claims 1 to 16.

35. A computer program product comprising computer program code embodied therein, which when run on a computer causes the computer to implement the method of any of claims 1 to 16.