WO2018108022A1 - Multi-network integration security and authentication method and system - Google Patents

Abstract

The present invention relates to a multi-network integration security and authentication method, comprising the following steps: S1. providing a multi-network integration module, same being simultaneously connected to the Internet and a telecommunication network; and S2. the multi-network integration module carrying out, based on the identity authentication of telecommunication and by means of a channel of a telecommunication network, secure information exchange with a user terminal. In the present invention, by means of a channel of a telecommunication network, secure information exchange is carried out, based on the identity authentication of telecommunication, with a user terminal, wherein the whole process does not require the participation of a third-party cloud end. The present invention avoids the defects in the existing technology, and has the advantages of being secure, reliable and difficult to attack artificially.

Description

Multi-network convergence security and authentication method and system Technical field

The present invention relates to the field of network and telephone communication, and in particular, to a method and system for security and authentication of multi-network convergence.

Background technique

With the development of technology, remote control of various devices via the Internet or remote storage of various information is becoming more and more popular, such as control of smart homes, related applications of the Internet of Things, etc., but security has always been A trouble. People use a variety of modern technologies such as: VPN, various complex encryption algorithms, various huge cloud services, etc., which not only increases the complexity but also increases the user's use cost, and because of the openness of the Internet, security The problem has not been completely solved. How to construct a safe and low-cost control method for ordinary users becomes a problem we have to face.

Among them, the secure transmission of any information needs to be encrypted, and it is better to use dynamic encryption, but the transmission of the dynamic password itself is a difficult point; in addition, the device connected to the Internet also needs to rely on the routing of the IP address. Communication, but the IP address is often dynamic, so how to inform the other party's own IP address and related identity authentication has become a key point.

Figure 1 shows a common method of implementing related functional applications through a third-party cloud or server. If the related device 200 accesses the Internet via the gateway (GateWay) A, the user terminal B can also access the Internet; the related application software is developed by the cloud C, and both ends A and B of the communication are registered to the cloud C, and then the A or B is registered. The communication is initiated to the cloud; the whole process is completed by the cloud C to complete the security authentication of A and B, and finally the communication link of A to C to B or A to B is constructed, and then B is controlled by 200. Due to the characteristics of the Internet, various Internet-based security authentication algorithms are difficult to guarantee security. For example, the transmission of the dynamic password itself is a difficult point, and it is easy to recruit hackers to eavesdrop, intercept or tamper. Therefore, the security method shown in Fig. 2 has been developed.

As shown in FIG. 2, the cloud or server C sends a short message verification code through a short message service (SMS) of the telecommunication network, and then enters the short message verification code when the user B logs in to the cloud C, thereby completing the identity authentication process. However, the SMS verification code must be sent in clear code, so it is not absolutely safe. Moreover, the above methods must be mediated and managed by Cloud C. When faced with attacks from insiders in the cloud, it is completely ineffective.

technical problem

The technical problem to be solved by the present invention is to provide a secure and reliable multi-network convergence-based security and authentication method and system that does not require third-party cloud participation.

Technical solution

The technical solution adopted by the present invention to solve the technical problem is to construct a security and authentication method for multi-network convergence, including the following steps:

S1: setting a multi-network convergence module and connecting to the Internet and the telecommunication network;

S2: The multi-network convergence module performs security information interaction with the user end on the basis of the identity of the telecommunication network through the channel of the telecommunication network.

Preferably, in the step S2, the method includes:

S2-1: the multi-network convergence module generates a dynamic password (Kd), and then encrypts the dynamic password (Kd) with a registration password (Kr) to generate first data (D1), and passes the first data (D1) Transmitting a channel of the telecommunication network to the user terminal;

S2-2: the UE receives the first data (D1) transmitted from the telecommunication network, identifies a CID signal, and decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password. (Kd);

S2-3: The UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module;

S2-4: The multi-network convergence module receives the second data (D2) transmitted from the telecommunication network, identifies a CID signal, and decrypts the second data (D2) by using the dynamic password (Kd) to obtain a The user password (Ku) is compared with the user password (Ku) retained in the multi-network convergence module, and if the same, the IP address of the multi-network convergence module is sent to the user terminal; or the user terminal Exchanging its IP address with the multi-network convergence module;

S2-5: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address.

Preferably, in the step S2, the method includes:

S2-1: The multi-network convergence module sends information to the user end;

S2-2: the user end receives the information, identifies a CID signal, and calls back the multi-network convergence module;

S2-3: The multi-network convergence module receives the callback, identifies a CID signal, and picks up the phone, and establishes channel communication with the user end of the telecommunication network;

S2-4: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network;

S2-5: the client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd);

S2-6: The UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module;

S2-7: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network convergence module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses;

S2-8: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address.

Preferably, in the step S2, the method includes:

S2-1: The multi-network convergence module calls the user end;

S2-2: the user end receives the call signal, identifies a CID signal, and picks up the phone, and establishes channel communication of the telecommunication network with the multi-network convergence module;

S2-3: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network;

S2-4: The client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd);

S2-5: the UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module;

S2-6: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network fusion module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses;

S2-7: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address.

Preferably, in the step S2, the method includes:

S2-1: The UE sends information to the multi-network convergence module.

S2-2: the multi-network convergence module receives the information, identifies a CID signal, and calls back the user terminal;

S2-3: The user end receives the callback, identifies a CID signal, and picks up the phone, and establishes channel communication of the telecommunication network with the multi-network convergence module;

S2-4: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network;

S2-5: the client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd);

S2-6: The UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module;

S2-7: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network convergence module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses;

S2-8: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address.

Preferably, in the step S2, the method includes:

S2-1: The UE calls the multi-network convergence module;

S2-2: The multi-network convergence module receives the call, identifies a CID signal, and picks up the phone, and establishes channel communication with the user end of the telecommunication network;

S2-3: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network;

S2-4: The client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd);

S2-5: the UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module;

S2-6: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network fusion module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses;

S2-7: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address.

Preferably, in the step S2, the method includes:

S2-1: The multi-network convergence module sends information to the user end;

S2-2: the UE receives information transmitted through the telecommunication network, identifies the CID signal, and calls back the multi-network convergence module;

S2-3: The multi-network convergence module identifies the CID signal and off-hook, and establishes channel communication with the user end of the telecommunication network;

S2-4: The multi-network convergence module randomly generates a dynamic password (Kd), and then sends the dynamic password (Kd) to the user end through a channel of the telecommunication network;

S2-5: The UE sends its IP address to the multi-network convergence module; or the multi-network convergence module exchanges its IP address with the user terminal;

S2-6: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address.

Preferably, the registration password (Kr) is generated when the client is registered with the multi-network convergence module, the password (Kr) is a key pair, and the key pair includes a first key (K1) And a second key (K2);

In the step of generating the first data (D1) by encrypting the dynamic password (Kd) with a registration password (Kr), encrypting the dynamic password (Kd) using the first key (K1) to generate first data (D1);

In the step of decrypting the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd), decrypting the first data (D1) with the first key (K1) to obtain The dynamic password (Kd);

In the step of generating the second data (D2) by encrypting the user password (Ku) with the dynamic password (Kd), the dynamic password (Kd) and the user password (Ku) are first calculated to obtain an intermediate code (Kdu). Reusing the second key (K2) to encrypt the intermediate code (Kdu) to generate second data (D2);

In the step of decrypting the second data (D2) with the dynamic password (Kd) to obtain the user password (Ku), first decrypting the second data (D2) with the second key (K2) And obtaining an intermediate code (Kdu), and computing the intermediate code (Kdu) with the dynamic password (Kd) to obtain the user password (Ku).

The present invention also provides a multi-network convergence security and authentication system, comprising a multi-network convergence module that simultaneously connects an Internet and a telecommunication network, and a user terminal; the multi-network convergence module passes the channel of the telecommunication network, and is in the identity of the telecommunication The authentication is based on the security information exchange with the client.

Preferably, the multi-network fusion module includes an algorithm module and a control logic module; the algorithm module communicates with the outside world through a channel of the telecommunication network, and instructs an action of the control logic module; the control logic module is used to be The control object is logically connected to the Internet or logically connected to the telecommunications network.

Preferably, the multi-network convergence module is disposed in a personal computer, a tablet computer and/or a home gateway; the user terminal is a smart phone, a tablet computer and/or a personal computer.

Beneficial effect

The invention carries out security information interaction with the user end through the channel of the telecommunication network and the identity authentication of the telecommunication. The whole process does not require the participation of the third party cloud, avoids the defects of the prior art, and has the advantages of being safe and reliable and difficult to be attacked by humans. .

DRAWINGS

The present invention will be further described below in conjunction with the accompanying drawings and embodiments, in which:

1 is a schematic diagram of a prior art communication implemented by a third party cloud or server;

2 is a schematic diagram of a prior art technology for implementing communication through a short message service;

3 is a schematic diagram of an embodiment of a multi-network convergence security and authentication system of the present invention;

4 is a schematic diagram of a first embodiment of a method for security and authentication of multi-network convergence according to the present invention;

5 is a schematic diagram of a second embodiment of a method for security and authentication of multi-network convergence according to the present invention;

6 is a schematic diagram of a third embodiment of a method for security and authentication of multi-network convergence according to the present invention;

7 is a schematic diagram of a fourth embodiment of a method for security and authentication of multi-network convergence according to the present invention;

8 is a schematic diagram of a fifth embodiment of a method for security and authentication of multi-network convergence according to the present invention;

9 is a schematic diagram of a sixth embodiment of a method for security and authentication of multi-network convergence according to the present invention;

10 is a schematic diagram of a seventh embodiment of a method for security and authentication of multi-network convergence according to the present invention;

11 is a schematic diagram of an eighth embodiment of a method for security and authentication of multi-network convergence according to the present invention;

12 is a schematic diagram of a ninth embodiment of a method for security and authentication of multi-network convergence according to the present invention;

13 is a schematic diagram of a tenth embodiment of a method for security and authentication of multi-network convergence according to the present invention;

14 is a schematic diagram of an embodiment of an encryption method of a multi-network convergence security and authentication method of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

As shown in FIG. 3, it is an embodiment of the multi-network convergence security and authentication system of the present invention, including a multi-network convergence module 100 for simultaneously connecting an Internet and a telecommunication network, and a user terminal UU. The multi-network convergence module 100 performs security information interaction with the user terminal UU based on the identity of the telecommunication network through the channel of the telecommunication network, for example, identification by the calling number of the telecommunication or identity authentication issued by the telecommunication operator. Based on the certificate, such as SIM card, eSIM or U-key.

In this embodiment, the multi-network convergence module 100 includes an algorithm module 110 and a control logic module 120. The algorithm module 110 communicates with the outside world through the channel of the telecommunication network, and instructs the action of the control logic module 120. The control logic module 120 is configured to logically connect the controlled object, such as the device to be controlled or the information 200, to the Internet or logic. Connected to the telecommunications network so that these devices or information can be logically controlled or interacted via the Internet or telecommunications network.

The multi-network convergence module 100 can be disposed in a personal computer, a tablet computer, and/or a home gateway; the user terminal UU can be a smart phone, a tablet computer, and/or a personal computer.

The multi-network convergence security and authentication method of the present invention can be used in the above system. In one embodiment, a multi-network convergence module is set, and the Internet and the telecommunication network are connected at the same time; the multi-network convergence module passes the channel of the telecommunication network to the telecommunication The identity authentication is based on the security information exchange with the client. The security information may be an encrypted password, an IP address of the Internet, or the like.

As shown in FIG. 4, it is a first embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is installed, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module can be placed in any Internet device, such as, but not limited to, the following devices: PC, tablet, home gateway, and the like. The client UU can be a smartphone, a tablet, a PC, or the like. The channel of the telecommunications network can be a wired or wireless channel.

When the multi-network convergence module needs to contact the user end, the multi-network convergence module generates a dynamic password Kd, then encrypts the dynamic password Kd with the registration code Kr to generate the first data D1, and sends the first data D1 to the client through the channel of the telecommunication network. ;

The client receives the first data D1 transmitted from the telecommunication network, identifies the CID signal, and decrypts the first data D1 with the registration code Kr to obtain the dynamic password Kd;

The user end generates the second data D2 by using the dynamic password Kd to encrypt the user password Ku, and sends the second data D2 to the multi-network fusion module through the channel of the telecommunication network;

The multi-network convergence module receives the second data D2 transmitted from the telecommunication network, identifies the CID signal, and decrypts the second data D2 with the dynamic password Kd to obtain the user password Ku, and compares it with the user password Ku retained in the multi-network fusion module, if the same Sending the IP address to the client; or, the client exchanges its IP address with the multi-network convergence module;

The client and the multi-network convergence module communicate with the dynamic password Kd via the Internet (such as IP routing and information interaction) according to the obtained IP address.

It can be understood that the above information exchange can be encrypted by using the dynamic password Kd.

It can be understood that, when the first data D1 and the second data D2 are transmitted through the telecommunication network, the switch of the telecommunication network generates a CID signal, and the CID signal is obtained by turning on the caller ID service at the user end and the multi-network convergence module.

As shown in FIG. 5, it is a second embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is provided, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module can be placed in any Internet device, such as, but not limited to, the following devices: PC, tablet, home gateway, and the like. The client can be a smartphone, a tablet, a PC, or the like. The channel of the telecommunications network can be a wired or wireless channel.

When the multi-network convergence module needs to contact the user end, the multi-network convergence module sends information to the user end;

The UE receives the information transmitted through the telecommunication network, identifies the CID signal, and calls back the multi-network convergence module;

The multi-network convergence module identifies the CID signal and picks up the phone through the callback transmitted by the telecommunication network, and establishes channel communication with the user end of the telecommunication network;

The multi-network convergence module randomly generates the dynamic password Kd, encrypts the dynamic password Kd with the registration code Kr, generates the first data D1, and then sends the first data D1 to the user end through the channel of the telecommunication network;

The user decrypts the first data D1 with the registration code Kr to obtain the dynamic password Kd;

The user end generates the second data D2 by using the dynamic password Kd to encrypt the user password Ku, and sends the second data D2 to the multi-network fusion module through the channel of the telecommunication network;

The multi-network convergence module decrypts the second data D2 with the dynamic password Kd to obtain the user password Ku, and compares it with the user password Ku stored by the multi-network fusion module, and if the same, sends the IP address to the user; or, the client and the multi-network The fusion module exchanges its IP address;

The client and the multi-network convergence module communicate with the dynamic password Kd via the Internet (such as IP routing and information interaction) according to the obtained IP address.

It can be understood that the above information exchange can be encrypted by using the dynamic password Kd.

It can be understood that when transmitting information and calling back through the telecommunication network, the switch of the telecommunication network generates a CID signal, and the CID signal is obtained by opening the caller ID service at the user end and the multi-network convergence module.

As shown in FIG. 6, it is a third embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is provided, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module can be placed in any Internet device, such as, but not limited to, the following devices: PC, tablet, home gateway, and the like. The client can be a smartphone, a tablet, a PC, or the like. The channel of the telecommunications network can be a wired or wireless channel.

When the multi-network convergence module needs to contact the user end, the multi-network convergence module calls the user end;

The UE receives the call signal, identifies the CID signal, and picks up the phone, and establishes channel communication of the telecommunication network with the multi-network convergence module;

The multi-network convergence module randomly generates the dynamic password Kd, encrypts the dynamic password Kd with the registration code Kr, generates the first data D1, and then sends the first data D1 to the user end through the channel of the telecommunication network;

The user decrypts the first data D1 with the registration code Kr to obtain the dynamic password Kd;

The user end generates the second data D2 by using the dynamic password Kd to encrypt the user password Ku, and sends the second data D2 to the multi-network fusion module through the channel of the telecommunication network;

The multi-network convergence module decrypts the second data D2 with the dynamic password Kd to obtain the user password Ku, and compares it with the user password Ku stored by the multi-network fusion module, and if the same, sends the IP address to the user; or, the client and the multi-network The fusion module exchanges its IP address;

The client and the multi-network convergence module communicate with the dynamic password Kd via the Internet (such as IP routing and information interaction) according to the obtained IP address.

It can be understood that the above information exchange can be encrypted by using the dynamic password Kd.

It can be understood that when the call signal is transmitted through the telecommunication network, the switch of the telecommunication network generates a CID signal, and the CID signal is obtained by turning on the caller ID service at the user end and the multi-network convergence module.

As shown in FIG. 7, it is a fourth embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is provided, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module can be placed in any Internet device, such as, but not limited to, the following devices: PC, tablet, home gateway, and the like. The client can be a smartphone, a tablet, a PC, or the like. The channel of the telecommunications network can be a wired or wireless channel.

When the user needs to contact the multi-network convergence module, the user sends the information to the multi-network convergence module.

The multi-network convergence module receives the information transmitted through the telecommunication network, identifies the CID signal, and calls back to the user terminal;

The UE receives the callback transmitted through the telecommunication network, identifies the CID signal, and picks up the phone, and establishes channel communication of the telecommunication network with the multi-network convergence module;

The multi-network convergence module randomly generates the dynamic password Kd, encrypts the dynamic password Kd with the registration code Kr, generates the first data D1, and then sends the first data D1 to the user end through the channel of the telecommunication network;

The user decrypts the first data D1 with the registration code Kr to obtain the dynamic password Kd;

The user end generates the second data D2 by using the dynamic password Kd to encrypt the user password Ku, and sends the second data D2 to the multi-network fusion module through the channel of the telecommunication network;

The multi-network convergence module decrypts the second data D2 with the dynamic password Kd to obtain the user password Ku, and compares it with the user password Ku stored by the multi-network fusion module, and if the same, sends the IP address to the user; or, the client and the multi-network The fusion module exchanges its IP address;

The client and the multi-network convergence module communicate with the dynamic password Kd via the Internet (such as IP routing and information interaction) according to the obtained IP address.

It can be understood that the above information exchange can be encrypted by using the dynamic password Kd.

It can be understood that when transmitting information and calling back through the telecommunication network, the switch of the telecommunication network generates a CID signal, and the CID signal is obtained by opening the caller ID service at the user end and the multi-network convergence module.

As shown in FIG. 8, it is a fifth embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is provided, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module can be placed in any Internet device, such as, but not limited to, the following devices: PC, tablet, home gateway, and the like. The client can be a smartphone, a tablet, a PC, or the like. The channel of the telecommunications network can be a wired or wireless channel.

When the user needs to contact the multi-network convergence module, the UE calls the multi-network convergence module.

The multi-network convergence module receives the call transmitted through the telecommunication network, identifies the CID signal, and picks up the phone, and establishes channel communication with the user end of the telecommunication network;

The multi-network convergence module randomly generates the dynamic password Kd, encrypts the dynamic password Kd with the registration code Kr, generates the first data D1, and then sends the first data D1 to the user end through the channel of the telecommunication network;

The user decrypts the first data D1 with the registration code Kr to obtain the dynamic password Kd;

The user end generates the second data D2 by using the dynamic password Kd to encrypt the user password Ku, and sends the second data D2 to the multi-network fusion module through the channel of the telecommunication network;

The multi-network convergence module decrypts the second data D2 with the dynamic password Kd to obtain the user password Ku, and compares it with the user password Ku stored by the multi-network fusion module, and if the same, sends the IP address to the user; or, the client and the multi-network The fusion module exchanges its IP address;

The client and the multi-network convergence module communicate with the dynamic password Kd via the Internet (such as IP routing and information interaction) according to the obtained IP address.

It can be understood that the above information exchange can be encrypted by using the dynamic password Kd.

As shown in FIG. 9, it is a sixth embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is provided, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module is disposed in a home gateway and connected to the telecommunication network through the PSTN. The client is a smartphone using a 4G network.

When the smartphone UU registers with the multi-network convergence module 100 of the home gateway, the key pair K1 and K2 are generated, and the user sets his own user password Ku; Ku is stored in the home gateway, and K1 and K2 are stored at both ends. In the machine.

When the home gateway detects that there is a situation that needs to contact the user, the multi-network convergence module 100 will send information to the mobile phone UU through the PSTN;

The mobile phone UU receives the information transmitted through the telecommunication network, recognizes the CID signal and confirms that it is the information sent by the home gateway, and then calls back to the multi-network convergence module 100 through the 4G and PSTN networks;

After the multi-network convergence module 100 recognizes the CID signal and confirms that it is an incoming call of the user's mobile phone UU, it picks up the phone and establishes channel communication with the user end to establish a telecommunication network;

Then the multi-network convergence module randomly generates a dynamic password Kd, encrypts Kd with one of the key pairs K1, generates D1, and sends D1 to the mobile phone UU;

After receiving the D1, the UU decrypts with K1 to obtain Kd;

Then the user enters his own user password Ku, Kd will calculate the password to generate the intermediate code Kdu, UU then K2 encrypts Kdu to generate D2, and then sends D2 to the multi-network fusion module 100;

After receiving the D2, the multi-network convergence module 100 decrypts K2 to obtain Kdu, and then calculates K with Kd, and compares this Ku with the password Ku set by the user in the memory. If they are the same, it indicates that the security authentication is passed. Can exchange IP addresses;

When the UU obtains the IP address of the home gateway, it can initiate an Internet connection based on this address. Once the connection is established, both parties can communicate, and all communications will be encrypted by the dynamic password Kd. When a connection is made again, different dynamic passwords are generated, so security is guaranteed.

As shown in FIG. 10, it is a seventh embodiment of the multi-network convergence security and authentication method of the present invention. The multi-network convergence module 100 is provided, and the Internet and the telecommunication network are connected at the same time. The multi-network convergence module 100 is placed in a tablet computer, which is connected to the Internet through WiFi, and simultaneously connects to the wireless network of the telecommunications through 4G; the user terminal UU is a 4G tablet computer.

When registering with the multi-network convergence module 100, the user terminal UU generates the registration password Kr, and the user sets its own user password Ku; the Ku is stored in the tablet where the multi-network convergence module 100 is located, and the Kr is stored at both ends of the machine. in.

When the multi-network convergence module 100 detects that there is a situation that needs to contact the user, the multi-network convergence module 100 will send information to the UU through 4G;

The UU receives the information transmitted through the 4G network, identifies the CID signal, and confirms the information sent by the multi-network convergence module 100, and then calls back to the multi-network convergence module 100 through the 4G network;

The multi-network convergence module 100 receives the callback transmitted through the 4G network, identifies the CID signal, and confirms that it is the incoming call of the user terminal UU, picks up the phone, and establishes channel communication with the user end to establish a telecommunication network.

Then, the user terminal UU randomly generates a dynamic password Kd, encrypts Kd with Kr, generates D1, and sends D1 to the multi-network fusion module 100;

After receiving the D1, the multi-network convergence module 100 decrypts with Kr to obtain Kd;

The user inputs his own user password Ku, UU encrypts Ku with Kd to generate D2, and then sends D2 to the multi-network fusion module 100.

After receiving the D2, the multi-network convergence module 100 decrypts and obtains Ku by Kd, and compares the Ku with the password Ku set by the user in the memory. If they are the same, it indicates that the security authentication is passed, and the two parties can exchange IP addresses;

When the UU obtains the IP address of the tablet where the multi-network convergence module 100 is located, the Internet connection can be initiated according to the address. Once the connection is established, the two parties can communicate, and all communication will be encrypted by the dynamic password Kd.

As shown in FIG. 11, it is an eighth embodiment of the multi-network convergence security and authentication method of the present invention, wherein the multi-network convergence module 100 is placed in a PC, and the PC is connected to the Internet through an optical fiber, and at the same time The PSTN is connected to the telecommunications network; the client UU is also a PC and is connected to the respective networks via optical fibers and PSTNs.

When the user UU registers with the multi-network convergence module 100, the registration password Kr is generated, and the user sets its own user password Ku; the Ku is stored in the PC where the multi-network convergence module 100 is located, and the Kr is stored in the machines at both ends. .

When the user terminal UU needs to contact the PC where the multi-network convergence module 100 is located, the user terminal UU will call the multi-network convergence module 100 through the PSTN;

The multi-network convergence module 100 receives the call transmitted through the PSTN network, recognizes the CID signal, and confirms that it is an incoming call of the user terminal UU, and picks up the phone.

Then, the multi-network convergence module 100 generates a password Kd, encrypts Kd with Kr, generates D1, and sends D1 to the UU;

After receiving the D1, the UU decrypts with Kr to obtain Kd;

The user inputs his own user password Ku, and the UU encrypts Ku with Kd to generate D2, and then transmits D2 to the multi-network fusion module 100.

After receiving the D2, the multi-network convergence module 100 decrypts and obtains Ku by Kd, and compares the Ku with the password Ku set by the user in the memory. If they are the same, it indicates that the security authentication is passed, and the two parties can exchange IP addresses;

When the UU obtains the IP address of the PC where the multi-network convergence module 100 is located, the Internet connection can be initiated according to the address. Once the connection is established, the two parties can communicate, and all communications will be encrypted by the password Kd.

As shown in FIG. 12, it is a ninth embodiment of the multi-network convergence security and authentication method of the present invention, wherein the multi-network convergence module 100 is placed in a PC, and the PC is respectively connected to the Internet and the PSTN network; the user terminal UU It is a smartphone using a 4G network.

The PC is connected to the Internet through a NAT (Network Address Translation) device. IP1 is an intranet address, and the required public network address and port number is IP3:xx, that is, the IP3:xx needs to be notified to the UU. There are two solutions to this. The first solution is that in the seventh step, the UU sends its public network address IP2 to the multi-network convergence module 100, and the multi-network convergence module 100 initiates the first data packet connection to the IP2. At this time, the IP3:xx automatically configured by the NAT is advertised to the UU, and the UU initiates communication to the multi-network convergence module 100 according to the address; the second solution is to develop a new protocol for the NAT, which allows multi-network convergence. The device where the module 100 is located applies for a public network address and port number to the NAT in advance. For example, the NAT reserves the IP3:xx for the multi-network convergence module 100, and the multi-network convergence module 100 can send the IP3:xx in the seventh step. Give UU.

As shown in FIG. 13, it is a tenth embodiment of the multi-network convergence security and authentication method of the present invention, wherein the multi-network convergence module 100 is provided, and the Internet and the telecommunication network are simultaneously connected. The multi-network convergence module can be placed in any Internet device, such as, but not limited to, the following devices: PC, tablet, home gateway, and the like. The client can be a smartphone, a tablet, a PC, or the like. The channel of the telecommunications network can be a wired or wireless channel.

When the multi-network convergence module needs to contact the user end, the multi-network convergence module sends information to the user end;

The UE receives the information transmitted through the telecommunication network, identifies the CID signal, and calls back the multi-network convergence module;

The multi-network convergence module identifies the CID signal and picks up the phone through the callback transmitted by the telecommunication network, and establishes channel communication with the user end of the telecommunication network;

The multi-network convergence module randomly generates a dynamic password Kd, and sends the dynamic password Kd to the user end through the channel of the telecommunication network;

The client sends its IP address to the multi-network convergence module; or, the multi-network convergence module exchanges its IP address with the client; the client and the multi-network convergence module communicate with the dynamic password Kd via the Internet according to the obtained IP address.

It can be understood that the above information exchange can be encrypted by using the dynamic password Kd.

It can be understood that when transmitting information and calling back through the telecommunication network, the switch of the telecommunication network generates a CID signal, and the CID signal is obtained by opening the caller ID service at the user end and the multi-network convergence module.

As shown in FIG. 14 , it is an embodiment of a key pair encryption method, which can be used in all the foregoing embodiments to generate a key pair when the UE is registered with the multi-network convergence module, and the key pair includes the first key K1. And a second key K2;

In all the above embodiments, in the step of generating the first data D1 by encrypting the dynamic password Kd with the registration code Kr, the first key K1 is used to encrypt the dynamic password Kd to generate the first data D1;

In the step of decrypting the first data D1 by the user terminal with the registration code Kr to obtain the dynamic password Kd, the user decrypts the first data D1 with the first key K1 to obtain the dynamic password Kd;

In the step of the user terminal generating the second data D2 by using the dynamic password Kd to encrypt the user password Ku, the user first calculates the dynamic code Kd and the user password Ku to obtain the intermediate code Kdu, and encrypts and generates the second data D2 using the second key K2. ;

In the step of the multi-network convergence module decrypting the second data D2 with the dynamic password Kd to obtain the user password Ku, the multi-network fusion module first decrypts the second data D2 with the second key K2 to obtain Kdu, and then uses the dynamic password Kd to Kdu. Perform an operation to obtain the user password Ku.

It is to be understood that the above-described embodiments are merely illustrative of the preferred embodiments of the present invention, and are not to be construed as limiting the scope of the invention; The above technical features may be freely combined, and various modifications and improvements may be made without departing from the spirit and scope of the invention; therefore, the scope of the claims of the present invention is Equivalent transformations and modifications are intended to be included within the scope of the appended claims.

Claims (10)

A method for security and authentication of multi-network convergence, characterized in that it comprises the following steps: S1: setting a multi-network convergence module and connecting to the Internet and the telecommunication network; S2: The multi-network convergence module performs security information interaction with the user end on the basis of the identity of the telecommunication network through the channel of the telecommunication network. The method for security and authentication of the multi-network convergence according to claim 1, wherein in the step S2, the method includes: S2-1: the multi-network convergence module generates a dynamic password (Kd), and then encrypts the dynamic password (Kd) with a registration password (Kr) to generate first data (D1), and passes the first data (D1) Transmitting a channel of the telecommunication network to the user terminal; S2-2: the UE receives the first data (D1) transmitted from the telecommunication network, identifies a CID signal, and decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password. (Kd); S2-3: The UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module; S2-4: The multi-network convergence module receives the second data (D2) transmitted from the telecommunication network, identifies a CID signal, and decrypts the second data (D2) by using the dynamic password (Kd) to obtain a The user password (Ku) is compared with the user password (Ku) retained in the multi-network convergence module, and if the same, the IP address of the multi-network convergence module is sent to the user terminal; or the user terminal Exchanging its IP address with the multi-network convergence module; S2-5: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address. The method for security and authentication of the multi-network convergence according to claim 1, wherein in the step S2, the method includes: S2-1: The multi-network convergence module sends information to the user end; S2-2: the user end receives the information, identifies a CID signal, and calls back the multi-network convergence module; S2-3: The multi-network convergence module receives the callback, identifies a CID signal, and picks up the phone, and establishes channel communication with the user end of the telecommunication network; S2-4: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network; S2-5: the client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd); S2-6: The UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module; S2-7: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network convergence module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses; S2-8: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address. The method for security and authentication of the multi-network convergence according to claim 1, wherein in the step S2, the method includes: S2-1: The multi-network convergence module calls the user end; S2-2: the user end receives the call signal, identifies a CID signal, and picks up the phone, and establishes channel communication of the telecommunication network with the multi-network convergence module; S2-3: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network; S2-4: The client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd); S2-5: the UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module; S2-6: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network fusion module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses; S2-7: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address. The method for security and authentication of the multi-network convergence according to claim 1, wherein in the step S2, the method includes: S2-1: The UE sends information to the multi-network convergence module. S2-2: the multi-network convergence module receives the information, identifies a CID signal, and calls back the user terminal; S2-3: The user end receives the callback, identifies a CID signal, and picks up the phone, and establishes channel communication of the telecommunication network with the multi-network convergence module; S2-4: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network; S2-5: the client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd); S2-6: The UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module; S2-7: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network convergence module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses; S2-8: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address. The method for security and authentication of the multi-network convergence according to claim 1, wherein in the step S2, the method includes: S2-1: The UE calls the multi-network convergence module; S2-2: The multi-network convergence module receives the call, identifies a CID signal, and picks up the phone, and establishes channel communication with the user end of the telecommunication network; S2-3: The multi-network convergence module randomly generates a dynamic password (Kd), encrypts the dynamic password (Kd) with a registration password (Kr), generates first data (D1), and then the first data (D1) Transmitting to the user terminal through a channel of the telecommunication network; S2-4: The client decrypts the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd); S2-5: the UE generates the second data (D2) by using the dynamic password (Kd) encrypted user password (Ku), and sends the second data (D2) to the channel through the telecommunication network. Multi-network fusion module; S2-6: The multi-network convergence module decrypts the second data (D2) by using the dynamic password (Kd) to obtain the user password (Ku), and the user password stored in the multi-network fusion module (Ku) Comparing, if the same, sending the IP address of the multi-network convergence module to the user end; or, the user terminal and the multi-network convergence module exchange their IP addresses; S2-7: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address. The method for security and authentication of the multi-network convergence according to claim 1, wherein in the step S2, the method includes: S2-1: The multi-network convergence module sends information to the user end; S2-2: the UE receives information transmitted through the telecommunication network, identifies the CID signal, and calls back the multi-network convergence module; S2-3: The multi-network convergence module identifies the CID signal and off-hook, and establishes channel communication with the user end of the telecommunication network; S2-4: The multi-network convergence module randomly generates a dynamic password (Kd), and then sends the dynamic password (Kd) to the user end through a channel of the telecommunication network; S2-5: The UE sends its IP address to the multi-network convergence module; or the multi-network convergence module exchanges its IP address with the user terminal; S2-6: The UE and the multi-network convergence module communicate with the dynamic password (Kd) via the Internet according to the obtained IP address. The method for security and authentication of a multi-network convergence according to any one of claims 2-6, wherein the registration password (Kr) is generated when the client is registered with the multi-network convergence module, The password (Kr) is a key pair, the key pair including a first key (K1) and a second key (K2); In the step of generating the first data (D1) by encrypting the dynamic password (Kd) with a registration password (Kr), encrypting the dynamic password (Kd) using the first key (K1) to generate first data (D1); In the step of decrypting the first data (D1) with the registration password (Kr) to obtain the dynamic password (Kd), decrypting the first data (D1) with the first key (K1) to obtain The dynamic password (Kd); In the step of generating the second data (D2) by encrypting the user password (Ku) with the dynamic password (Kd), the dynamic password (Kd) and the user password (Ku) are first calculated to obtain an intermediate code (Kdu). Reusing the second key (K2) to encrypt the intermediate code (Kdu) to generate second data (D2); In the step of decrypting the second data (D2) with the dynamic password (Kd) to obtain the user password (Ku), first decrypting the second data (D2) with the second key (K2) And obtaining an intermediate code (Kdu), and computing the intermediate code (Kdu) with the dynamic password (Kd) to obtain the user password (Ku). A multi-network convergence security and authentication system, comprising: a multi-network convergence module that simultaneously connects an Internet and a telecommunication network, and a user terminal; the multi-network convergence module passes the channel of the telecommunication network, and is in the identity of a telecommunication The authentication is based on the security information exchange with the client. The multi-network convergence security and authentication system according to claim 9, wherein the multi-network fusion module comprises an algorithm module and a control logic module; the algorithm module communicates with the outside world through a channel of the telecommunication network, and commands The action of the control logic module; the control logic module is configured to logically connect the controlled object to the Internet or logically connect to the telecommunication network.