WO2018196465A1 - Authentication method, terminal and server - Google Patents

Abstract

Disclosed are an authentication method, a terminal and a server. The method is applied to a first terminal, and comprises: acquiring image data of a second terminal; when a radio access bearer is in a released state, by means of an Internet of Things protocol, using signalling for transmitting data to send the image data to a server, wherein the image data is used for requesting that the server sends a key corresponding to a first terminal; and receiving the key sent by the server, and sending the key to the second terminal, wherein the key is used for the authentication of the first terminal by the second terminal.

Description

Authentication method, terminal and server Technical field

The present invention relates to the field of Internet of Things technologies, and in particular, to an authentication method, a terminal, and a server.

Background technique

At present, smart devices are everywhere in people's lives, and human-computer interaction is very frequent. Authentication authentication usually exists during each human-computer interaction process. For example, before the access control of the residential community, the card is swiped by using the access card, or the fingerprint is swiped, or the key is used to authenticate the authentication; on the bus, the card is used by using the bus card or the chip inside the mobile phone. Right authentication; before the bank's automatic teller machine (ATM), the information of the bank card is read by the ATM, and the user inputs the password to perform authentication.

However, in some human-computer interaction situations where a large number of input keys (or passwords) and frequent authentication are required, the problem of low efficiency may be caused by too long waiting time or malfunction of the card; the way of entering the key may be by others. Peeping, leading to a key leak, can lead to insecure problems; in addition, the input key and the fingerprint-based device are shared by many people, and thus there is a health problem.

Therefore, there is an urgent need to find a solution that can achieve fast and secure authentication.

Summary of the invention

An embodiment of the present invention provides an authentication method, which is applied to a first terminal, where the method includes: acquiring image data of a second terminal; and when the wireless access bearer is in a released state, using an Internet of Things protocol to transmit data. Transmitting the image data to the server, wherein the image data is used to request the server to send a key corresponding to the first terminal; receiving a key sent by the server, and sending the key to the first The second terminal; the key is used by the second terminal to authenticate the first terminal.

An embodiment of the present invention further provides an authentication method, which is applied to a server, where the method includes: receiving image data of a second terminal that is used by a first terminal to transmit signaling by using an Internet of Things protocol; and using the The image data is searched in a preset database to obtain a key corresponding to the first terminal, and the key is sent to the first terminal, where the key is used to be sent by the first terminal. And authenticating the first terminal after the second terminal is authenticated.

The embodiment of the present invention further provides a first terminal, where the first terminal includes: an acquiring module, configured to acquire image data of the second terminal; and a first sending module configured to: when the radio access bearer is in a released state Transmitting, by the Internet of Things protocol, the image data to a server by using signaling for transmitting data, the image data being used to request the server to send a key corresponding to the first terminal, and configured to Sending a key to the second terminal, the key is used by the second terminal to authenticate the first terminal; and the first receiving module is configured to receive the key sent by the server .

The embodiment of the present invention further provides a computer storage medium, the computer storage medium comprising a set of instructions, when executed, causing at least one processor to perform the above-mentioned authentication method applied to the first terminal.

The embodiment of the invention further provides a computer storage medium, the computer storage medium comprising a set of instructions, when executed, causing at least one processor to perform the above-mentioned authentication method applied to the server.

DRAWINGS

1 is a schematic diagram of an implementation process of an authentication method according to Embodiment 1 of the present invention;

2 is a schematic diagram of a protocol structure of an NB-IoT network according to an embodiment of the present invention;

3 is a schematic diagram of a manner of transmitting image data on a signaling plane according to an embodiment of the present invention;

4 is a schematic diagram of a manner of transmission of image data on a user plane according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of an implementation process of an authentication method according to Embodiment 2 of the present invention; FIG.

FIG. 6 is a schematic diagram showing the structure of a first terminal according to Embodiment 3 of the present invention; FIG.

7 is a schematic diagram showing the composition of a server according to Embodiment 4 of the present invention;

FIG. 8 is a schematic diagram showing the structure of an internal module of a first terminal according to an embodiment of the present invention; FIG.

FIG. 9 is a schematic diagram of a specific implementation process of an authentication method according to an embodiment of the present invention; FIG.

FIG. 10 is a schematic diagram of a specific implementation process of entering a new key according to an embodiment of the present invention; FIG.

FIG. 11 is a schematic diagram of a specific implementation process of changing a key according to an embodiment of the present invention.

detailed description

In order to understand the features and technical contents of the embodiments of the present invention, the implementation of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

The Internet of Things is a major trend in the development of current communication technologies. In the Internet of Things technology and standards, cellular-based Narrow Band Internet of Things (NB-IoT, Narrow Band Internet of Things) and Enhanced Machine Type Counterparts (eMTC) technology are emerging, regardless of their technical advantages or application scenarios. Both are consistently optimistic in the IoT market. Several device vendors are developing and designing products that support these two protocols. The NB-IoT and eMTC protocols of the Internet of Things support the transmission of a small amount of user data on the signaling plane. The authentication scenario in the human-computer interaction scenario is an IoT application scenario, which has the characteristics of small data volume and discontinuous transmission.

On the other hand, as described in the background art, current authentication methods such as swiping, keying, and fingerprinting have problems in terms of efficiency, safety, and hygiene. The various embodiments proposed by the present invention are directed to the above-described signaling plane transmission techniques to solve these problems.

Embodiment 1

As shown in FIG. 1 , the first terminal side is taken as an example to describe the authentication method in detail. The method includes the following steps:

Step 101: Acquire image data of the second terminal.

Step 101 may specifically include: searching for at least one terminal; determining the second terminal from the at least one terminal; and collecting an image of the second terminal to obtain the image data.

Here, in actual application, the first terminal may search for at least one terminal through Bluetooth, and may also search for at least one terminal by using other local area network protocols, such as Wireless Fidelity (WiFi), ZigBee, and the like. The terminal may specifically be an ATM machine, an access security gate, a smart bus or a credit card machine on a subway, and the like.

Before searching, at least one terminal can be identified. For example, the ATM machine uses the 001 number, the access security gate uses the 002 number, and the smart bus or the credit card on the subway uses the 003 number.

The manner in which the first terminal determines the second terminal from the at least one terminal obtained by the searching may be: the first terminal searches for at least one terminal, and is displayed by the user interface or the form of a button confirmation or a voice prompt, by the first terminal user. A terminal is determined as the second terminal in the at least one terminal. The method may further be: the first terminal pre-sets the rule, and determines the second rule according to the rule. For example, the rule may be that the first terminal separately measures the distance between each terminal and the first terminal obtained by the search. And selecting the terminal closest to the first terminal to determine the second terminal. Further, the method may be: the first terminal compares the distance between each terminal and the first terminal measured according to the preset rule, and displays the second terminal by the first terminal user according to actual needs.

Here, the method may further include: when the state of the first terminal is in a locked state, generating a first prompt message, where the first prompt message is used to prompt the first terminal user to unlock a first terminal; an obtaining operation, wherein the operation is a response operation to the first prompt message; and in response to the operation, performing an unlocking operation on the first terminal; and after the unlocking is successful, entering a working state.

In practical applications, in order to reduce power consumption and ensure security, the first terminal cannot always be in a working state or search for the state of at least one terminal. The working time of the first terminal can be set according to user requirements. For example, the first terminal enters a locked state after working for 1 minute or 10 minutes.

Step 102: When the radio access bearer is in a release state, the image data is sent to the server by using the signaling for transmitting data through the Internet of Things protocol. Here, the image data is used to request the server to send a key corresponding to the first terminal.

The radio access bearer (RAB) includes a radio bearer (RB, Radio Bearer) between the user equipment (UE, UserEquipment) and the UTTS (UMTS Terrestrial Radio Access Network), and a core network. Iu bearer between (CN, Core Network) and UTRAN.

Here, the step of transmitting image data to a server by using an IoT protocol using signaling for transmitting data may include: transmitting image data to the server through a non-access stratum of a signaling plane, wherein The non-access stratum is capable of transmitting data between the terminal and the core network.

In practical applications, the Internet of Things protocol may be an NB-IoT protocol or an eMTC protocol.

In an embodiment, step 102 further includes: reading state variable information of the radio access bearer; and determining that the radio access bearer is in a released state when the state variable information is invalid information.

In a practical application, a series of variables corresponding to the radio access bearer are stored in the protocol stack memory of the first terminal, and the read variables can be used to query whether the first terminal saves the radio access bearer. The valid state variable information, if the variables are empty or the memory is released, the first terminal does not save the valid state variable information related to the radio access bearer between the first terminal and the core network, and the state variable information is The invalid information can further determine that the radio access bearer is in a released state.

In actual application, when the radio access bearer is in the released state, only the signaling plane protocol architecture of the network supports transmitting data through the signaling plane, and the image data can be sent to the server through the non-access stratum of the signaling plane, and the condition is met. The network protocol specifically includes NB-IoT, eMTC, and the like.

Taking NB-IoT as an example, Figure 2 shows the protocol structure of the NB-IoT network. As shown in Figure 2, the protocol structure includes the UE, the base station (E-NodeB), the mobility management entity (MME, Mobility Management Entity), and the service gateway. SGW, Serving GateWay). The protocol architecture of the NB-IoT network includes a control plane protocol architecture and a user plane protocol architecture. The control plane is also referred to as a signaling plane.

The protocol structure of the signaling plane includes: Non-Access Stratum (NAS), Radio Resource Control (RRC), Packet Data Convergence Protoco (PDCP), and Radio Link Control Layer. (RLC, Radio Link Control), Media Access Control Layer (MAC, Medium Access Control), Physical Layer (PHY, Physical Layer). The protocol architecture of the signaling plane is the NAS layer at the layer on the MME side. Among them, the NAS layer supports signaling and data transmission between the terminal and the core network. The RRC layer processes the third layer information of the control plane between the terminal and the base station, and the functions of the RRC include RB control, broadcast, paging, and the like. The PDCP layer is responsible for compressing and decompressing IP headers, transmitting user data, and the like. The RLC layer is responsible for segmentation and connection, retransmission processing, and sequential transmission of high-level data. The MAC layer serves the RLC layer in a logical channel manner. The PHY layer is responsible for coding, modulation, demodulation, multi-antenna mapping, and the like. The protocol structure of the user plane includes: PDCP, RLC, MAC, PHY.

Here, the non-access stratum of the signaling plane sends the image data to the server, including: establishing a signaling radio bearer between the terminal and the core network, and generating a non-access stratum signaling message by using the image data, where The non-access stratum signaling message is sent to the server on the signaling radio bearer.

In actual application, the foregoing steps may include: packing the image data, and filling the packed data packet in a data body field of the non-access stratum to generate a non-access stratum signaling message, and the non-access stratum message The message is transmitted to the server on the network side through the non-access stratum. Specifically, the non-access stratum message is transmitted to the server after passing through the non-access stratum, the RRC layer, the PDCP layer, the RLC layer, and the MAC layer.

In the prior art, the data packet packed with the image data passes through the PDCP layer, the RLC layer, and the MAC layer, and the packed data is encapsulated by the physical layer, and then transmitted to the server on the network side in the form of a transport block.

Figure 3 shows the transmission of image data on the signaling plane, as shown in Figure 3. The transmission of image data between the first terminal and the server on the signaling plane comprises two parts, the first part is data transmission between the first terminal and the base station, and the second part is data transmission between the base station and the core network.

The first part, that is, the data transmission between the first terminal and the base station, is specifically: the first terminal encapsulates the acquired image data of the second terminal and fills the data body field of the non-access layer to generate a non-connection. Incoming layer signaling message. After the non-access stratum signaling message is processed by the NAS layer, the RRC layer, the PDCP layer, the RLC layer, the MAC layer, and the PHY layer, the PHY layer transmits the non-access stratum signaling message to the base station by using a radio frequency signal. Side of the NAS layer. The non-access stratum signaling message transmitted by the NAS layer on the first terminal can be filled with data. Therefore, when the radio access bearer does not exist, that is, when the radio access bearer is in the released state, the radio bearer does not need to be established. The data radio bearer also avoids the delay problem caused by establishing a radio bearer.

The second part, that is, the data transmission between the base station and the core network, specifically: the base station sequentially receives the non-access stratum signaling message including the image data through the PHY layer, the MAC layer, the RLC layer, the PDCP layer, After being processed by the RRC layer and the NAS layer, the LAC layer and the NAS layer are transmitted to the MME. After receiving the non-access stratum signaling message including the image data, the MME may send the non-access stratum signaling message including the image data to a service capa-bility exposure function (SCEF). The SCEF sends the non-access stratum signaling message including the image data to the server. The non-access stratum signaling message including the image data may also be sent to the SGW, and sent by the SGW to the packet data gateway. (PGW, Packet Data Network Gateway), and the PGW sends the non-access stratum signaling message including the image data to the server.

Based on the signaling radio bearer between the first terminal and the core network, when the radio access bearer is in a released state, that is, when there is no data transmission channel between the first terminal and the core network, the first terminal passes the Internet of Things protocol. The image data of the second terminal is transmitted to the server using signaling for transmitting data, more specifically, through the NAS layer of the signaling plane. Because the radio access bearer does not need to be re-established, the delay problem caused by establishing the radio access bearer is avoided, and the image data of the second terminal can be quickly sent to the server on the network side, thereby implementing fast authentication.

In an embodiment, step 102 further includes: when the radio access bearer is in an established state, transmitting image data to the server through the user plane. Here, the image data is used to request the server to send a key corresponding to the first terminal.

Specifically, when the radio access bearer is in an established state, the image data is sent to the server through the user plane. In this case, a data radio bearer needs to be established. The transmission mode of the image data on the user plane is as shown in FIG. 4. The transmission of image data between the first terminal and the server on the user plane comprises two parts, the first part is data transmission between the first terminal and the base station, and the second part is data transmission between the base station and the core network.

The first part, that is, the data transmission between the first terminal and the base station, specifically: the first terminal packs the acquired image data of the second terminal, and sequentially passes the packaged data packet to the PDCP layer and the RLC layer. After the MAC layer processing and the PHY layer encapsulation, the PHY layer transmits the data packet including the image data to the PDCP layer on the base station side in the form of a radio frequency signal.

The second part, that is, the data transmission between the base station and the core network, specifically: the base station sequentially receives the received data packet containing the image data through the PHY layer, the MAC layer, the RLC layer, and the PDCP layer, and then sends the data packet to the SGW. The SGW sends the PGW to the PGW, and the PGW transmits the data packet containing the image data to the server on the network side.

When the radio access bearer is in an established state, the first terminal sends the image data of the second terminal to the server based on the data radio bearer on the user plane.

Step 103: Receive a key sent by the server, and send the key to the second terminal. Here, the key is used for the second terminal to authenticate the first terminal.

Here, before the sending of the key to the second terminal, the step 103 further includes: generating, according to the acquired image data of the second terminal, that the identity of the first terminal user needs to be verified, generating second prompt information; The second prompt information is used to prompt the first terminal user to input verification information; obtain verification information input by the first terminal user; and verify the input verification information, and verify the key after successful verification Send to the second terminal.

In actual application, the second terminal may be a transfer machine, an access card, or another device. When the second terminal is a transfer machine, the identity of the first terminal user needs to be verified, and the second terminal authenticates the first terminal, and the purpose of the verification is to improve security; and when the second terminal is When the access card is used, the identity of the first terminal user does not need to be verified, and the second terminal can authenticate the first terminal.

The verification information input by the first terminal user may be fingerprint information, a piece of voice, a key, or the like.

The verifying the input verification information includes: when the input verification information is fingerprint information, performing fingerprint image format conversion, image segmentation and image enhancement, image filtering, image binarization, and image fineness on the fingerprint message. , feature point extraction and matching processing; when the input verification information is a piece of speech, pre-emphasizing, framing, windowing, and Meer filter group filtering of the speech to obtain a Mel frequency cepstrum parameter (MFCC, Mel) Frequency Cepstrum Coefficient), performing MFCC Principal Components Analysis (DOA) dimension reduction processing, and then using vector quantization (VQ, Vector Quantization) for pattern matching; when the input verification information is a key, the density is The key is compared to a preset keystore.

In an embodiment, the method further includes: sending the changed key or the entered new key to the server when the key corresponding to the first terminal is changed or entering a new key, the changed secret The key or the new key entered is used by the server to update the default database.

In actual application, for example, when the second terminal fails to authenticate the first terminal, after the first terminal receives the authentication failure message sent by the second terminal, the user of the first terminal can change the key corresponding to the first terminal, and Send the changed key to the server for the server to update the default database.

When the key corresponding to the first terminal is not found in the server preset database, the first terminal user may enter a new key and send it to the server; or when the second terminal is a new device, the preset database on the server When the key correspondence between the second terminal and the first terminal is not stored, the first terminal user enters a new key and sends it to the server.

As described above, in the first embodiment, when the radio access bearer is in the released state, the first terminal sends the image data of the second terminal to the server by using the signaling for transmitting data through the Internet of Things protocol. Because the radio access bearer does not need to be re-established, the delay problem caused by establishing the radio access bearer is avoided, and the image data of the second terminal can be quickly sent to the server on the network side, thereby implementing fast authentication. In addition, in the embodiment, the server sends a key to the first terminal, and the first terminal sends the key to the second terminal, thereby avoiding the occurrence of the key being leaked, so that security authentication can be implemented.

Embodiment 2

As shown in FIG. 5, this embodiment uses the server side as an example to describe the authentication method in detail. The method includes the following steps:

Step 501: Receive image data of the second terminal that is sent by the first terminal by using the Internet of Things protocol for signaling transmission of data.

Here, the step of receiving the image data of the second terminal that the first terminal uses the signaling for transmitting data through the Internet of Things protocol comprises: receiving the first terminal by using a signaling radio bearer between the terminal and the core network The non-access stratum signaling message sent by the non-access stratum of the signaling plane on the signaling radio bearer, where the non-access stratum signaling message includes the image data of the second terminal.

In actual application, the signaling radio bearer between the terminal and the core network corresponds to the NAS layer of the MME on the core network side. That is, the image data transmitted on the signaling radio bearer is received by the NAS layer of the MME, and the image data is sent by the MME to the SCEF, and the server receives the image data sent by the SCEF; or the image data is sent by the MME to the MME. The SGW is sent by the SGW to the PGW, and the server receives the image data transmitted by the PGW.

Step 502: Perform a search in the preset database by using the image data, obtain a key corresponding to the first terminal, and send the key to the first terminal.

The key is used to authenticate the first terminal after the first terminal sends the second terminal.

Here, in actual application, sending the key to the first terminal includes: transmitting, by using an IoT protocol, signaling for transmitting data, to the first terminal. Specifically, the key may be sent to the first terminal by using an NB-IoT or an eMTC protocol. Specifically, when the radio access bearer is in the released state, the non-access stratum of the signaling plane sends the key to the first terminal; when the radio access bearer is in the established state, the key is sent to the user plane. The first terminal.

Here, the performing the searching in the preset database by using the image data comprises: extracting feature information from the image data based on the feature extraction strategy by using the image data, and according to the extracted feature information in a preset database Find it.

The information stored in the preset database may include: identifier information of the second terminal, and identifier information of the first terminal. The correspondence between the identification information of the second terminal and the identification information of the first terminal is one-to-many.

In practical applications, the feature extraction strategy first preprocesses the image data, including grayscale, binarization, and noise suppression (filtering) processing. Feature point extraction is performed based on the pre-processed image to construct a graphical feature, where the feature point may be an imaging point of any portion on the second terminal, such as a point at the edge of the second terminal. Graphic features, such as contour features, texture features within the contours, etc., can be formed by feature points. The feature information of the second terminal, such as identification information, is determined based on the graphical feature, and the identification information may be a number.

And performing a search in the preset data according to the extracted identifier information of the second terminal and the correspondence between the identifier information of the second terminal and the identifier information of the first terminal, to obtain a key corresponding to the first terminal.

In an embodiment, the method further includes: receiving a changed key sent by the first terminal or a new key entered; the changed key and the entered new key correspond to the second terminal; The preset database is updated according to the changed key or the entered new key.

Embodiment 3

To implement the method of the first embodiment, the first terminal is provided by the first terminal. As shown in FIG. 6, the first terminal includes: an obtaining module 61, a first sending module 62, and a first receiving module 63, where: The acquisition module 61 is configured to acquire image data of the second terminal.

The first sending module 62 is configured to: when the wireless access bearer is in a released state, send image data to the server by using an IoT protocol for transmitting data, wherein the image data is used to request the server to send a corresponding a key of the first terminal; and transmitting the key to the second terminal, wherein the key is used by the second terminal to authenticate the first terminal.

The first receiving module 63 is configured to receive a key transmitted by the server.

In an embodiment, the obtaining module 61 is further configured to: search for at least one terminal; determine the second terminal from the at least one terminal; collect an image of the second terminal, to obtain the image data .

Here, in actual application, the first terminal may search at least one terminal through Bluetooth, and may also search for at least one terminal by using other local area network protocols, such as WiFi, ZigBee, and the like. The terminal may specifically be an ATM machine, an access security gate, a smart bus or a credit card machine on a subway, and the like.

In an embodiment, the first sending module 62 is further configured to establish a signaling radio bearer between the terminal and the core network, generate non-access stratum signaling messages by using image data, and use the non-access stratum signal The message is sent to the server on the signaling radio bearer. Specifically, when the terminal is the first terminal and the image data is the image data of the second terminal, the first sending module 62 establishes a signaling radio bearer between the first terminal and the core network, and generates non-image data by using the image data of the second terminal. And accessing the layer signaling message, and sending the non-access stratum signaling message to the server on the signaling radio bearer.

Here, when the radio access bearer is in the released state, only the signaling plane protocol architecture of the network supports transmitting data through the signaling plane, and the image data can be sent to the server through the non-access stratum of the signaling plane, and the network satisfying such conditions The protocol specifically includes NB-IoT, eMTC, and the like.

In an embodiment, the first sending module 62 is further configured to: when the radio access bearer is in an established state, send image data to the server based on the data radio bearer on the user plane.

In an embodiment, the first terminal further includes an unlocking module, where the unlocking module is configured to generate a first prompt message when the state of the first terminal is in a locked state, where the first prompt message is used for prompting The first terminal user unlocks the first terminal; the operation is performed in response to the first prompt message; in response to the operation, the first terminal is unlocked; and after the unlocking is successful, the first A terminal enters a working state.

In actual application, in order to reduce power consumption and ensure security, the first terminal cannot always be in a working state and search for the state of at least one terminal, and the working time of the first terminal can be set according to user requirements, for example, the first terminal works for 1 minute or After 10 minutes, it enters the locked state.

In an embodiment, the first terminal further includes a determining module configured to read a state of a radio access bearer between the first terminal and the core network saved in the protocol stack, when the first terminal and the core When there is no data transmission channel between the networks, the determining module determines that the radio access bearer is in a released state.

In an embodiment, the first terminal further includes a verification module configured to generate a second prompt information when it is determined that the identity of the first terminal user needs to be verified according to the acquired image data of the second terminal. . The second prompt information is used to prompt the first terminal user to input the verification information, and is further configured to obtain the verification information input by the first terminal user, and is further configured to verify the input verification information.

Correspondingly, the first sending module 62 is further configured to send the key to the second terminal after the verification succeeds.

In actual application, since the second terminal may be a transfer machine or an access card, when the second terminal is a transfer machine, the identity of the first terminal user needs to be verified, and the second terminal only contacts the first terminal. The authentication is performed, and the purpose of the verification is to improve security. When the second terminal is an access card, the identity of the first terminal user does not need to be verified, and the second terminal can authenticate the first terminal.

In an embodiment, the first terminal further includes an entry module configured to: when the key corresponding to the first terminal is changed or the new key is entered, the changed key or the entered new key Sent to the server, the changed key or the entered new key is used by the server to update the preset database.

In a practical application, the first receiving module 63 is implemented by a communication interface on the first terminal; the obtaining module 61, the unlocking module, and the determining module may be a processor located on the first terminal, such as a central processing unit (CPU). The implementation is performed by a microprocessor (MPU, Micro Processor Unit), a DSP, or a Field Programmable Gate Array (FPGA). The first sending module 62, the verification module, and the input module are processed by the first terminal. The device is implemented by a communication interface such as a CPU, an MPU, a DSP, or an FPGA.

Embodiment 4

To implement the method of the second embodiment, the embodiment provides a server. As shown in FIG. 7, the server includes a second receiving module 71 and a second sending module 72. among them:

The second receiving module 71 is configured to receive image data of the second terminal that the first terminal transmits using signaling for transmitting data through the Internet of Things protocol.

The second sending module 72 is configured to perform a lookup in the preset database by using the image data, obtain a key corresponding to the first terminal, and send the key to the first terminal, where the key is used The first terminal is authenticated after being sent by the first terminal to the second terminal.

In an embodiment, the second receiving module 71 is further configured to receive the changed key or the entered new key sent by the first terminal, the changed key and the entered new key and the second The terminal corresponds.

In an embodiment, the second receiving module 71 is further configured to receive, by the signaling radio bearer between the first terminal and the core network, the first terminal by using a non-access stratum of the signaling plane. A non-access stratum signaling message sent on the radio bearer, where the non-access stratum signaling message includes image data of the second terminal.

In actual application, the signaling radio bearer between the terminal and the core network corresponds to the NAS layer of the MME on the core network side, that is, the image data transmitted on the signaling radio bearer is received by the NAS layer of the MME. Then, the MME sends the image data to the SCEF, and the server receives the image data sent by the SCEF. The MME may send the image data to the SGW, and the SGW sends the image data to the PGW, and the server receives the image data sent by the PGW.

In an embodiment, the second sending mode 72 is further configured to use the image data to extract feature information from the image data based on a feature extraction strategy, and perform a search in a preset database according to the extracted feature information. .

Here, in actual application, the second sending module 72 sends the password to the first terminal by using the signaling for transmitting data through the Internet of Things protocol. Specifically, the key may be sent to the first terminal by using an NB-IoT or an eMTC protocol. That is, when the radio access bearer is in the released state, the second sending module 72 sends the key to the first terminal through the NAS layer of the signaling plane; when the radio access bearer is in the established state, the second sending module 72 The key is sent to the first terminal through the user plane.

In an embodiment, the server further includes an update module configured to update the preset database based on the changed key or a new key entered.

In an actual application, the update module is implemented by a processor located on the second terminal, such as a CPU, an MPU, a DSP, an FPGA, or the like; the second receiving module 71 and the second sending module 72 may be a processor, such as a CPU, located on the second terminal. MPU, DSP, FPGA, etc. are implemented in combination with a communication interface.

The specific implementation process of the authentication method will be described below with specific examples.

FIG. 8 is a schematic diagram of the internal module structure of the first terminal, as shown in FIG. 8. The first terminal internal module includes a user interaction module 801, an NB-IoT/eMTC communication module 802, a Bluetooth/WiFi communication module 803, an information collection module 804, and an image acquisition module 805.

Each component is described in detail below, as follows:

(1) User interaction module 801: used to complete the interaction between the first terminal and the user. The interaction mode can be a user interface (UI, User Interface) display, button confirmation, voice prompts and the like.

(2) NB-IoT/eMTC communication module 802: used by the first terminal to interact with the server through the wireless network. The image data of the second terminal is sent uplink, and the downlink includes authentication information such as a key and personal information to be requested by the first terminal. In the case where the radio access bearer is established, the user plane is used to transmit the image data, and in the case where the radio access bearer is released, the image data is transmitted using the signaling plane.

(3) Bluetooth/WiFi communication module 803: used to search for and connect surrounding hosts (second terminals), such as ATM machines, access control security gates, smart bus/metro credit card machines, and the like. After the server sends the authentication data, such as the key, to the first terminal for authentication, the key is sent to the host through the Bluetooth/WiFi communication module 803, and the host completes the authentication of the first terminal. Among them, the search and connection technology can use Bluetooth, and can also be completed by other LAN protocols such as WiFi, ZigBee, and the like.

(4) Information collection module 804: for input and output. In order to save power and ensure security, the first terminal cannot always be in the working state and search for the state of the surrounding host. In most of the time, it is the standby state, that is, the locked state. In the locked state, the first terminal is not available, nor is it used. Will search for nearby hosts. The working time of the first terminal can be set by the first terminal user, and the working time can be set to 1 minute or 10 minutes, and the like. Before the first terminal user uses the first terminal, the information collecting module 804 is required to unlock the first terminal. During the period after unlocking, the first terminal is in the available and search state. In addition, the information collection module 804 is also used in the process of adding a key and modifying a key.

(5) Image acquisition module 805: In an open situation, the first terminal may continuously search for various hosts. For example, there may be an ATM machine at the door of the cell, and the first terminal searches for multiple hosts. In this case, the first terminal user needs to confirm which host is specifically connected as the second terminal. After determining the second terminal, the method of taking a live view is taken. The user can use the camera of the first terminal (belonging to the image acquisition module) to collect the image, and then send the image to the server through the NB-IoT/eMTC protocol, and the server determines that the host is the second terminal, and then the key corresponding to the first terminal is Send to the first terminal. The first terminal can also be equipped with smart glasses or similar wearable products, so that the first terminal user can automatically work and upload the second terminal, for example, as long as the vehicle is running straight or observing the host to be operated. The image data is given to the server, saving time and manpower.

FIG. 9 is a schematic diagram of a specific implementation process of an authentication method according to an embodiment of the present invention. As shown in FIG. 9, the process includes the following steps:

Step 901: Determine whether the first terminal is in an active state. If it is determined that the first terminal is in an active state, step 902 is performed. If the first terminal is in the locked state (for example, after the first terminal exceeds the preset working time, the first terminal is in the locked state), step 917 is performed.

Step 917: The user is prompted to unlock the first terminal, and wait for the user to unlock the first terminal by using a fingerprint or an eye pattern. After the unlocking is successful, step 902 is performed.

Step 902: In the case that it is determined that the first terminal is in the working state, the first terminal enters a state of searching for the host. When the first terminal searches for at least one host (the second terminal), step 903 is performed. If the first terminal does not find the host, then return to step 901.

Step 903: Prompt the first terminal user to open the live view authentication by, for example, the user interaction module 801, and wait for the user to open the live view authentication.

Step 904: The user performs the live view entry. If the live view entry is successful, step 9041 is performed; if the live view entry is unsuccessful, the process returns to step 903.

Step 9041: The device (the first terminal) is connected to the target host by using a method such as Bluetooth or other local area network, and then step 905 is performed. As an example of real-life entry, the user can take a picture of the host device using the first terminal. The photo can be the gate of the community that the user is about to enter, or it can be a house smart door lock, a bank ATM machine, a bus, a private club key cabinet, and so on.

Step 905: The first terminal determines whether the radio access bearer exists, and if yes, that is, the radio access bearer is in an established state, step 906 is performed, if not, that is, the radio access bearer is in a released state, then executing Step 912.

In the protocol stack memory of the first terminal, a series of variables corresponding to the radio access bearer are stored, and the read variables can be used to query whether the first terminal saves the valid state related to the radio access bearer. The variable information, if the variables are empty or the memory is released, the first terminal does not save the valid state variable information related to the radio access bearer between the first terminal and the core network, and the state variable information is invalid information, and further The wireless access bearer may be determined to be in a released state.

According to the wireless network standard, for wireless network devices, if there is no data traffic for a period of time, the bearer and signaling connection established between the terminal and the core network will be released, and when the user requests data again, the core network will be first Perform service request (SR, Service Request) signaling interaction, establish an RRC bearer, and establish a radio bearer and a radio access bearer, and then perform data interaction between the terminal and the core network.

Step 906: Send the picture data of the host to the server by using the IoT protocol to use signaling for transmitting data.

Here, in actual application, the picture data of the host may be sent to the server through the user plane based on the NB-IoT (or eMTC) protocol.

On the server side, the server searches for a preset database. If the key corresponding to the first terminal is found, the key is sent to the first terminal by using the NB-IoT/eMTC protocol.

Step 907: It is determined whether the key sent by the server to the first terminal is received. If the key is received, step 908 is performed, otherwise step 913 is performed.

Step 908: Generate a prompt message, for example, "Receive the key of the host "xxx", whether to send?" The prompt message is used by the terminal to determine whether to verify the identity of the user, and when it is determined that the identity of the first terminal user needs to be performed When verifying, step 909 is performed.

Here, whether the identity of the user is verified can be determined according to the security level preset by the user. For example, the key authentication of the ATM machine and the identity authentication on the bus can be set to the high security level. Only when the user identity is verified and the user presses the confirmation key, the key completion authentication process is sent. When the host is a transfer machine, the first terminal needs to verify the identity of the user, and then sends the key to the host after verifying the identity of the user. The cell access control, company gates, etc. can be set to a low security level, without first verifying the user identity and the user's confirmation, the first terminal will send the key directly to the host (in this case, skip steps 908-909).

Step 909: Determine whether the verification information input by the user is received (the confirmation of the user is received). If yes, go to step 910, otherwise go back to step 908.

Step 910: After verifying that the identity of the user is successful, the key is sent to the host by using Bluetooth or the like.

Step 911: Determine whether the host authentication is passed. If the host authentication succeeds, step 916 is performed; if the authentication fails, step 915 is performed.

Step 912: Send the picture data of the host to the server by using the IoT protocol to use signaling for transmitting data.

Here, in actual application, the picture of the host may be sent to the server through the NAS layer of the signaling plane based on the NB-IoT or eMTC protocol.

The picture data of the host is packaged, and the packed data packet is filled in the data body field of the NAS layer to generate a non-access stratum signaling message, and the non-access stratum signaling message is transmitted to the network side through the NAS layer. server. Specifically, the non-access stratum message including the host picture data is encapsulated by the NAS layer, the RRC layer, the PDCP layer, the RLC layer, the MAC layer, and the PHY layer, and then transmitted to the server by using a radio signal.

Since the radio access bearer does not need to be re-established, the service request, the radio bearer, and the establishment of the radio access bearer are omitted, and the data can be quickly sent to the server.

Step 913: Prompt the user to take a photo again, return to step 903; or prompt the user that this is a new host device, need to enter a new key, and then perform step 914.

Step 914: Enter the new device process.

Step 915: The host prompts the first terminal user to perform key modification. Step 915 can also be: the host directly sleeps on standby.

Step 916: The first terminal selects to continue searching or enters the standby mode according to the working time situation. If the working time exceeds the preset time of the user, the device is locked, and the first terminal is in a low power state after being locked.

FIG. 10 is a schematic diagram of a specific implementation process of a new device according to an embodiment of the present invention, that is, a specific implementation process of entering a new key. As shown in FIG. 10, the process includes the following steps:

Step 1001: Enter the process of entering a new key.

Step 1002: Confirm the user information by the information collecting module 804, confirm that the first terminal is used by a legitimate user, and make the first terminal enter the working mode.

Step 1003: Enter user information and a new key through the information collection module 804.

Step 1004: Send the entered key to the server.

Specifically, based on the NB-IoT/eMTC protocol, when the radio access bearer does not exist (in a released state), the NAS layer of the signaling plane may be used to send the entered new key of the corresponding first terminal to the server; otherwise ( The radio bearer is established, and the new key corresponding to the first terminal that is entered is sent to the server through the user plane. Of course, the radio access bearer may be established first, and then the packetized data packet is packaged through the PDCP layer, the RLC layer, the MAC layer processing, and the PHY layer, and then sent to the network through the transport block. Side server.

Step 1005: The server updates the preset database, creates new key information, and the correspondence between the new key and the first terminal, and the correspondence between the host (second terminal) and the first terminal.

Step 1006: prompt the user to enter the new key successfully.

FIG. 11 is a schematic diagram of a specific implementation process of changing a key according to an embodiment of the present invention. As shown in FIG. 11, the process includes the following steps:

Step 1101: Enter the change key process.

Step 1102: Confirm the user information by the information collecting module 804, confirm that the first terminal is used by a legitimate user, and make the first terminal enter the working mode.

Step 1103: Enter the changed key through the information collection module 804.

Step 1104: Send the changed key to the server.

Here, in actual application, the changed key can be sent to the server based on the NB-IoT/eMTC protocol. Specifically, when the radio access bearer does not exist (in the released state), the NAS layer of the signaling plane may be used to send the entered key of the corresponding first terminal to the server; otherwise (the radio bearer has been established), through the user plane The entered key corresponding to the first terminal is sent to the server. Of course, the radio access bearer may be established first, and then the packetized data packet is packaged by the PDCP layer, the RLC layer, the MAC layer, and the physical layer, and then sent to the physical layer through the transport block. Server on the network side.

Step 1105: The server updates the preset database, creates the changed key information, and the correspondence between the changed key and the first terminal, and the correspondence between the host and the first terminal.

Step 1106: The server prompts the user to change the key successfully.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Based on this, an embodiment of the present invention further provides a computer storage medium, where the computer storage medium includes a set of instructions, when executing the instruction, causing at least one processor to execute the server side authentication method, or perform the above Authentication method on the terminal side.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims (16)

An authentication method is applied to a first terminal, where the method includes: Step 101: Acquire image data of the second terminal. Step 102: When the radio access bearer is in a release state, send the image data to the server by using an identifier for transmitting data by using an Internet of Things protocol, where the image data is used to request the server to send the corresponding The key of the first terminal; Step 103: Receive a key sent by the server, and send the key to the second terminal, where the key is used by the second terminal to authenticate the first terminal. The method of claim 1 wherein said step 102 comprises: The image data is transmitted to the server via a non-access stratum of the signaling plane, wherein data is transferable between the first terminal and the core network based on the non-access stratum. The method of claim 1 wherein said step 101 comprises: Searching for at least one terminal; Determining the second terminal from the at least one terminal; Acquiring an image of the second terminal to obtain the image data. The method of claim 1 further comprising: Reading state variable information of the wireless access bearer; When the state variable information is invalid information, determining that the radio access bearer is in the released state. The method of claim 2, wherein the step of transmitting the image data to the server via a non-access stratum of the signaling plane comprises: Establishing a signaling radio bearer between the first terminal and the core network, generating a non-access stratum signaling message by using the image data, and sending the non-access stratum signaling message on the signaling radio bearer Give the server. The method of claim 1, wherein before the transmitting the key to the second terminal, step 103 further comprises: And generating, according to the obtained image data of the second terminal, the second prompt information is generated when the identity of the first terminal user needs to be verified; the second prompt information is used to prompt the first terminal user to input the verification information. ; Obtaining verification information input by the first terminal user; The input verification information is verified, and after the verification is successful, the key is sent to the second terminal. The method of claim 1 further comprising: Transmitting the changed key or the entered new key to the server when the key corresponding to the first terminal is changed or entering a new key, the changed key or the newly entered key The key is used by the server to update the preset database. The method of any of claims 1 to 7, wherein the step 102 further comprises: When the radio access bearer is in an established state, the image data is sent to the server based on a data radio bearer on the user plane. An authentication method is applied to a server, and the method includes: Step 501: Receive image data of a second terminal that is used by the first terminal to transmit signaling by using the Internet of Things protocol; and Step 502: Perform a search in a preset database by using the image data, obtain a key corresponding to the first terminal, and send the key to the first terminal, where the key is used to be After the first terminal sends the second terminal, the first terminal is authenticated. The method according to claim 9, wherein the step of receiving the image data of the second terminal that the first terminal uses the signaling for transmitting data through the Internet of Things protocol comprises: Receiving, by the signaling radio bearer between the first terminal and the core network, a non-access stratum signaling message sent by the first terminal on the signaling radio bearer by using a non-access stratum of the signaling plane, where The non-access stratum signaling message includes image data of the second terminal. The method according to claim 9, wherein said step of performing a search in a preset database using said image data comprises: Using the image data, extracting feature information from the image data based on a feature extraction strategy, Searching is performed in the preset database according to the extracted feature information. The method of claim 9 further comprising: Receiving the changed key or the entered new key sent by the first terminal, where the changed key and the entered new key correspond to the second terminal; Updating the preset database according to the changed key or the entered new key. A first terminal includes: An obtaining module configured to acquire image data of the second terminal; a first sending module configured to: when the wireless access bearer is in a released state, send the image data to a server by using an IoT protocol for transmitting data, the image data being used to request the server Transmitting a key corresponding to the first terminal; and transmitting the key to the second terminal, the key being used by the second terminal to authenticate the first terminal; The first receiving module is configured to receive the key sent by the server. The first terminal according to claim 13, wherein The first sending module is further configured to establish a signaling radio bearer between the first terminal and the core network, generate a non-access stratum signaling message by using the image data, and use the non-access stratum signaling The message is sent to the server on the signaling radio bearer. A server that includes: a second receiving module, configured to receive image data of the second terminal that is used by the first terminal to transmit signaling for transmitting data through the Internet of Things protocol; a second sending module, configured to perform a search in a preset database by using the image data, obtain a key corresponding to the first terminal, and send the key to the first terminal, the secret The key is used to authenticate the first terminal after being sent by the first terminal to the second terminal. The server according to claim 15, wherein The second receiving module is further configured to receive, by the signaling radio bearer between the first terminal and the core network, the first terminal by using a non-access stratum of the signaling plane on the signaling radio bearer The non-access stratum signaling message sent on the non-access stratum signaling message includes the image data of the second terminal.

Images