WO2018119608A1 - Application processing method, network device and terminal device - Google Patents

Abstract

Provided in the embodiments of the present application are an application processing method, a network device and a terminal device. The application processing method provided by the embodiments of the present application comprises: a network device receives, from a terminal device, a verification request comprising information of a certificate to be verified of an application, determines a root certificate according to the information of the certificate to be verified, and then determines whether the certificate to be verified is a certificate issued by an issuing device according to the information of the root certificate and the certificate to be verified. The embodiments of the present application may improve network security.

Description

Application processing method, network device and terminal device Technical field

The embodiments of the present application relate to communications technologies, and in particular, to an application processing method, a network device, and a terminal device.

Background technique

The Next Generation Mobile Network (NGMN) organization is in the 5th generation (5th generation) to meet the quality of service (QoS) requirements of the dissatisfied types of devices, different types of services, and different application scenarios. ^Th Generation, referred to as 5G) communication system, configures a variety of different network slices for different service requirements. A network slice may include a service requirement corresponding network function and a corresponding radio access technology (Radio Access Technology, RAT for short) configuration example. A third party, such as an application (APP), can be authorized by the operator to manage the content of the network slice according to the information provided by the operator, and provide customized services for the user.

At present, as long as the terminal device signs the network slice to the operator, the operator can pre-configure the content of the network handover corresponding to the different service types of the terminal device to the terminal device. The terminal device can access the data server or the application server corresponding to the preset application according to the network slice corresponding to the preset application.

Although the terminal device is a contracted user of the operator, the operator may perform legality authentication on the terminal device, but the illegal application running on the legal terminal device, such as an application that is maliciously modified or disguised, may be utilized. A legitimate terminal device uses a network slice to access the network, causing serious security risks on the current network.

Summary of the invention

The embodiments of the present application provide an application processing method, a network device, and a terminal device, so as to reduce network security risks and improve network security.

In a first aspect, an embodiment of the present application provides an application processing method, including:

The network device receives a verification request from the terminal device, where the verification request includes a certificate to be verified Information; the certificate to be verified is a certificate from the application providing device;

The network device determines the root certificate according to the information of the certificate to be verified;

Determining, by the network device, whether the information of the to-be-verified certificate meets a preset condition, to obtain a verification result of the to-be-verified certificate;

The network device sends a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate;

The determining, by the network device, whether the information of the certificate to be verified meets the preset condition comprises: determining, by the network device, whether the certificate to be verified is a certificate issued by the certificate issuing device according to the information of the root certificate and the certificate to be verified .

The method may send a verification request to the network device by using the terminal device, where the verification request includes information of the certificate to be verified, and the network device determines the root certificate according to the information of the certificate to be verified, and according to the root certificate and the to-be-calibrated The information of the verification certificate determines whether the certificate to be verified is a certificate issued by the certificate issuing device, obtains a verification result of the certificate to be verified, and then returns a verification response to the terminal device, where the verification response includes the to-be-checked The verification result of the certificate. In this method, the network device can verify the certificate to be verified of the application, and can effectively prevent the illegal application running on the terminal device from using the network slice to access the network, thereby effectively ensuring the security of the network.

In an implementation manner, the verification request may further include an application identifier;

The determining, by the network device, that the information of the to-be-verified certificate meets the preset condition, may further include:

The network device determines, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of the providing device that is issued to the application.

In another implementation manner, the application identifier may include: an identifier of the application, and/or an identifier of the application providing device, and the like. The identifier of the application may include at least one of the following: a name of the application, a version number of the application, and the like. The identifier of the application providing device may include: the application provides information such as the name of the provider corresponding to the device.

In yet another implementation manner, the verification request as shown above may further include an identifier of the terminal device;

The network device determines whether the information of the to-be-verified certificate meets the preset condition, and may further include:

Determining, by the network device, information about a network slice corresponding to the application according to the application identifier;

Determining, by the network device, a letter of the network slice signed by the terminal device according to the identifier of the terminal device interest;

The network device determines whether the network slice corresponding to the application is located in the network slice signed by the terminal device, according to the information of the network slice that is subscribed by the terminal device and the network slice information corresponding to the application.

In yet another implementation manner, the identifier of the terminal device as described above may include at least one identifier: an IP address of the terminal device, a medium access control address, a customer identification module identifier, an international mobile subscriber identity, and a global unique temporary User device identification, etc.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response may further include information about a network slice corresponding to the application; wherein the preset condition includes: the to-be-checked The certificate is the certificate issued by the certificate issuing device, the certificate to be verified is the certificate of the providing device issued to the application, and the network slice corresponding to the application is located in the network slice signed by the terminal device.

In another implementation manner, the information about the network slice corresponding to the application includes at least one type of information: an identifier of the network slice, a service type corresponding to the network slice, a usage type corresponding to the network slice, and a network slice. The validity period information and the certificate verification frequency information corresponding to the network slice.

In another implementation manner, the service type may include any type of service such as a video service, a network phone service, and a V2X service.

The type of the terminal device that uses the network slice may also be referred to as the usage type corresponding to the network slice, and the usage type may include: the type of use of the in-vehicle user device, the type of use of the smart phone, and the like, and any terminal device using the network slice. Types of.

In yet another implementation manner, the receiving, by the network device, the verification request from the terminal device, as described above, may include:

The network device receives the verification request from the terminal device during installation of the application; or

The network device receives the verification request from the terminal device during startup of the application.

In another implementation manner, the information about the certificate to be verified may include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash of the certificate to be verified The algorithm, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

In a second aspect, the embodiment of the present application further provides an application processing method, including:

The terminal device sends a verification request to the network device, where the verification request includes a certificate to be verified The information to be verified is a certificate of the provided device from the application; the information of the certificate to be verified is used for verification of the certificate to be verified;

The terminal device receives a verification response from the network device, and the verification response includes a verification result of the to-be-verified certificate.

In an implementation manner, the verification request may further include an application identifier, where the application identifier is used to determine whether the certificate to be verified is a certificate issued by the certificate issuing device to the application providing device.

In another implementation manner, the application identifier is further used for determining the information of the network slice corresponding to the application;

The verification request further includes an identifier of the terminal device; the identifier of the terminal device is used for determining the network slice signed by the terminal device.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response may further include information about the network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate The certificate issued by the device is issued by the device, and the certificate to be verified is a certificate of the device provided to the application, and the network certificate corresponding to the certificate is located in the network slice signed by the terminal device;

The method can also include:

The terminal device stores information of a network slice corresponding to the application.

Optionally, the terminal device may store information about the network slice corresponding to the application to the terminal device, whether the terminal device is in the installation process of the application or the information about the network slice corresponding to the application acquired during the startup process. In the storage area of the SIM card, the information of the network slice corresponding to the application is prevented from being maliciously modified or copied to ensure network security.

Optionally, the terminal device may store the information about the network slice corresponding to the application, and store the public key information corresponding to the application, so as to ensure that the application corresponds to the information. The security of the network sliced information stored on the terminal device side is effective to prevent the information of the network slice corresponding to the application from being maliciously modified or copied to ensure network security.

In another implementation manner, the information about the network slice corresponding to the application may include at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, a type of the terminal device using the network slice, and the The validity period information of the network slice and the certificate verification frequency information corresponding to the network slice.

In yet another implementation manner, the terminal device as shown above sends a verification request to the network device. Can include:

The terminal device sends the verification request to the network device during installation of the application; or

The terminal device sends the verification request to the network device during startup of the application.

In another implementation manner, if the terminal device sends the verification request to the network device during the installation process of the application, the terminal device may further include, after receiving the information including the network slice corresponding to the application, :

The terminal device continues to install the application.

In the application processing method, the terminal device sends the verification request to the network device during the installation process of the application, and if the certificate to be verified satisfies the preset condition, the application is continuously installed, and the If the verification certificate does not meet any of the preset conditions, the installation of the application is stopped, and the installation of the illegal application can be effectively avoided, thereby effectively avoiding the risk of the network slice being accessed or attacked by the malicious application, and improving the security of the network.

In another implementation manner, if the terminal device sends the verification request to the network device during the startup process of the application, the terminal device may further include, after receiving the information including the network slice corresponding to the application, :

The terminal device accesses the network according to the network slice.

The terminal device accesses the network according to the information of the network slice corresponding to the application, and implements a corresponding service requirement of the application.

In another implementation manner, the information about the certificate to be verified may include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash of the certificate to be verified The algorithm, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

In a third aspect, the embodiment of the present application further provides an application processing method, including:

The terminal device searches for information about the root certificate corresponding to the to-be-verified certificate from the preset root certificate area according to the information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application;

The terminal device determines, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device, to obtain a verification result of the certificate to be verified.

The method may further determine, by the terminal device, a root certificate identifier corresponding to the to-be-verified certificate of the application, and find a root certificate corresponding to the root certificate identifier according to the root certificate identifier, and then according to the root certificate. Check the validity of the certificate to be verified. Due to the method, the terminal device The application to be verified can be verified, and the illegal application running on the legal terminal device can be effectively prevented from using the network segment to access the network, thereby effectively ensuring the security of the network.

In an implementation manner, before the terminal device searches for the root certificate corresponding to the to-be-verified certificate from the preset root certificate area according to the information of the certificate to be verified, the method may further include:

The terminal device receives an installation package of the application from the providing device of the application; the installation package may include: an installation file of the application, information of the certificate to be verified, and information of a network slice corresponding to the application.

In another implementation manner, if the certificate to be verified is a certificate issued by the certificate issuing device, the method may further include:

The terminal device stores information of a network slice corresponding to the application.

In a fourth aspect, the embodiment of the present application further provides a network device, including:

a receiving module, configured to receive a verification request from the terminal device, where the verification request includes information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application;

a processing module, configured to determine a root certificate according to the information of the to-be-verified certificate; determine whether the information of the to-be-verified certificate meets a preset condition, to obtain a verification result of the to-be-verified certificate;

a sending module, configured to send a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate;

The processing module is specifically configured to determine, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device.

In an implementation manner, the verification request further includes an application identifier;

The processing module is further configured to determine, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of a providing device that is issued to the application.

In another implementation manner, the verification request may further include an identifier of the terminal device;

The processing module is further configured to: determine, according to the application identifier, information about a network slice corresponding to the application; determine, according to the identifier of the terminal device, information about a network slice subscribed by the terminal device; and information about the network slice signed by the terminal device and the application Corresponding network slice information determines whether the network slice corresponding to the application is located in the network slice that the terminal device subscribes to.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about a network slice corresponding to the application; wherein the preset condition may include: the to-be-checked The certificate is the certificate issued by the certificate issuing device, and the certificate to be verified is issued to the application. The certificate for the device and the network slice corresponding to the application are located in the network slice signed by the terminal device.

In another implementation manner, the information about the network slice corresponding to the application may include at least one type of information: an identifier of the network slice, a service type corresponding to the network slice, a usage type corresponding to the network slice, and the network slice. The validity period information and the certificate verification frequency information corresponding to the network slice.

In another implementation manner, the receiving module is specifically configured to receive the verification request from the terminal device during the installation process of the application or during the startup process of the application.

In another implementation manner, the information about the certificate to be verified may include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash of the certificate to be verified The algorithm, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

In a fifth aspect, the embodiment of the present application further provides a terminal device, including:

a sending module, configured to send a verification request to the network device, where the verification request includes information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; and the information of the certificate to be verified is used for the school to be verified Verification of the verification certificate;

And a receiving module, configured to receive a verification response from the network device, where the verification response includes a verification result of the to-be-verified certificate.

In an implementation manner, the verification request may further include an application identifier, where the application identifier is used to determine whether the certificate to be verified is a certificate issued by the certificate issuing device to the application providing device.

In another implementation manner, the application identifier is further used for determining the information of the network slice corresponding to the application;

The verification request may further include an identifier of the terminal device; the identifier of the terminal device is used for determining the network slice signed by the terminal device.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about the network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate is The certificate issued by the certificate issuing device, the certificate to be verified is a certificate of the providing device issued to the application, and the certificate to be verified is a network slice corresponding to the application, and is located in a network slice signed by the terminal device;

The terminal device further includes:

The storage module is configured to store information about a network slice corresponding to the application.

In another implementation manner, the information about the network slice corresponding to the application includes at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, a type of the terminal device using the network slice, and the network The validity period information of the slice and the certificate verification frequency information corresponding to the network slice.

In another implementation manner, the sending module is specifically configured to send the verification request to the network device during installation of the application or during startup of the application.

In another implementation manner, the information about the certificate to be verified may include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash of the certificate to be verified The algorithm, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

In a sixth aspect, the embodiment of the present application further provides a terminal device, including:

a processing module, configured to search, according to the information of the certificate to be verified, the information of the root certificate corresponding to the certificate to be verified from the preset root certificate area; the certificate to be verified is a certificate of the providing device from the application; The information of the root certificate and the certificate to be verified determines whether the certificate to be verified is a certificate issued by the certificate issuing device, so as to obtain a verification result of the certificate to be verified.

In an implementation manner, the terminal device further includes:

The receiving module is configured to receive an installation package of the application from the providing device of the application; the installation package includes: an installation file of the application, information about the certificate to be verified, and information about a network slice corresponding to the application.

In another implementation manner, if the certificate to be verified is a certificate issued by the certificate issuing device, the terminal device further includes:

The storage module is configured to store information about a network slice corresponding to the application.

In a seventh aspect, the embodiment of the present application further provides a network device, including: a receiver, a processor, and a transmitter; wherein the receiver is connected to the processor, and the processor is connected to the transmitter;

The receiver is configured to receive a verification request from the terminal device, where the verification request includes information about the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application;

a processor, configured to determine a root certificate according to the information of the to-be-verified certificate; determine whether the information of the to-be-verified certificate meets a preset condition, to obtain a verification result of the to-be-verified certificate;

a transmitter, configured to send a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate;

The processor is specifically configured to determine, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device.

In an implementation manner, the verification request further includes an application identifier;

The processor is further configured to determine, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of the providing device that is issued to the application.

In another implementation manner, the verification request may further include an identifier of the terminal device;

The processor is further configured to determine, according to the application identifier, information about a network slice corresponding to the application; determine, according to the identifier of the terminal device, information about a network slice subscribed by the terminal device; and information about the network slice signed by the terminal device and the application Corresponding network slice information determines whether the network slice corresponding to the application is located in the network slice that the terminal device subscribes to.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about a network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate The certificate issued by the device is issued by the device, and the certificate to be verified is the certificate of the providing device issued to the application, and the network slice corresponding to the application is located in the network slice signed by the terminal device.

In another implementation manner, the information about the network slice corresponding to the application includes at least one type of information: an identifier of the network slice, a service type corresponding to the network slice, a usage type corresponding to the network slice, and a network slice. The validity period information and the certificate verification frequency information corresponding to the network slice.

In yet another implementation, the receiver has a means for receiving the verification request from the terminal device during installation of the application or during startup of the application.

In another implementation manner, the information about the certificate to be verified includes at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash algorithm of the certificate to be verified The fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

In an eighth aspect, the embodiment of the present application further provides a terminal device, including: a transmitter and a receiver;

The sender is configured to send a verification request to the network device, where the verification request includes information about the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; and the information of the certificate to be verified is used for Verification of the certificate to be verified;

And a receiver, configured to receive a verification response from the network device, where the verification response includes a verification result of the to-be-verified certificate.

In an implementation manner, the verification request further includes an application identifier, where the application identifier is used to determine whether the certificate to be verified is a certificate issued by the certificate issuing device to the application providing device.

In another implementation manner, the application identifier is further used for determining the information of the network slice corresponding to the application;

The verification request further includes an identifier of the terminal device; the identifier of the terminal device is used for determining a network slice subscribed by the terminal device.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about the network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate is The certificate issued by the certificate issuing device, the certificate to be verified is a certificate of the providing device issued to the application, and the certificate to be verified is a network slice corresponding to the application, and is located in a network slice signed by the terminal device;

The terminal device further includes: a processor and a memory; the processor is connected to the memory, and the processor is further connected to the receiver;

And a processor, configured to store information of the network slice corresponding to the application into the memory.

In another implementation manner, the information about the network slice corresponding to the application includes at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, a type of the terminal device using the network slice, and the network The validity period information of the slice and the certificate verification frequency information corresponding to the network slice.

In yet another implementation manner, the transmitter is specifically configured to send the verification request to the network device during installation of the application or during startup of the application.

In another implementation manner, the information about the certificate to be verified includes at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash algorithm of the certificate to be verified The fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

The ninth aspect, the embodiment of the present application further provides a terminal device, including: a processor;

a processor, configured to search, according to the information of the certificate to be verified, the information of the root certificate corresponding to the certificate to be verified from the preset root certificate area; the certificate to be verified is a certificate of the providing device from the application; The information of the root certificate and the certificate to be verified determines whether the certificate to be verified is a certificate issued by the certificate issuing device, so as to obtain a verification result of the certificate to be verified.

In an implementation manner, the terminal device further includes: a receiver; the receiver is connected to the processor Connect

And a receiver, configured to receive an installation package of the application from the providing device of the application; the installation package includes: an installation file of the application, information about the certificate to be verified, and information about a network slice corresponding to the application.

In another implementation manner, the terminal device further includes: a memory; the processor is connected to the memory;

The processor is configured to store the information of the network slice corresponding to the application into the memory if the certificate to be verified is a certificate issued by the certificate issuing device.

In a tenth aspect, the embodiment of the present application further provides a computer program product, where the computer program product includes a program code corresponding to any one of the application processing methods provided by the first aspect of the embodiment of the present application.

In an eleventh aspect, the embodiment of the present application further provides a computer program product, where the computer program product includes program code corresponding to any one of the application processing methods provided by the second aspect of the embodiment of the present application.

In a twelfth aspect, the embodiment of the present application further provides a computer program product, where the computer program product includes a program code corresponding to any one of the application processing methods provided by the third aspect of the embodiment of the present application.

In a thirteenth aspect, the embodiment of the present application further provides a storage medium, where the storage medium is used to store a computer program product, where the computer program product includes: a program code, where the program code may include the first embodiment of the present application. A program code corresponding to any of the application processing methods provided on the one hand.

In a fourteenth aspect, the embodiment of the present application further provides a storage medium, where the storage medium is used to store a computer program product, where the computer program product includes: a program code, where the program code may include the foregoing The program code corresponding to any of the application processing methods provided by the two aspects.

In a fifteenth aspect, the embodiment of the present application further provides a storage medium, where the storage medium is used to store a computer program product, where the computer program product includes: a program code, where the program code may include the foregoing The program code corresponding to any of the application processing methods provided by the three aspects.

The application processing method, the network device, and the terminal device in the embodiment of the present application may send a verification request to the network device by using the terminal device, where the verification request includes information of the certificate to be verified, and the network device root Determining the root certificate according to the information of the certificate to be verified, and determining whether the certificate to be verified is a certificate issued by the certificate issuing device according to the information of the root certificate and the certificate to be verified, and obtaining the verification of the certificate to be verified As a result, a verification response is then returned to the terminal device, the verification response including the verification result of the certificate to be verified. In this method, the network device can verify the verification certificate, which can effectively prevent the illegal application running on the terminal device from using the network device to access the network, thereby effectively ensuring the security of the network.

DRAWINGS

1 is a structural diagram of a network system to which embodiments of the present application are applied;

2 is a flowchart 1 of an application processing method according to an embodiment of the present application;

FIG. 3 is a second flowchart of an application processing method according to an embodiment of the present disclosure;

4 is a flowchart 3 of an application processing method according to an embodiment of the present application;

FIG. 5 is a flowchart 4 of an application processing method according to an embodiment of the present disclosure;

FIG. 6 is a flowchart 5 of an application processing method according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram 1 of a network device according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram 1 of a terminal device according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram 2 of a terminal device according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram 2 of a network device according to an embodiment of the present disclosure;

FIG. 11 is a schematic structural diagram 1 of a computer program product according to an embodiment of the present application;

FIG. 12 is a schematic structural diagram 1 of a storage medium according to an embodiment of the present disclosure;

FIG. 13 is a schematic structural diagram 3 of a terminal device according to an embodiment of the present disclosure;

FIG. 14 is a schematic structural diagram 2 of a computer program product according to an embodiment of the present application;

FIG. 15 is a second schematic structural diagram of a storage medium according to an embodiment of the present disclosure;

FIG. 16 is a schematic structural diagram 4 of a terminal device according to an embodiment of the present disclosure;

FIG. 17 is a schematic structural diagram 3 of a computer program product according to an embodiment of the present disclosure;

FIG. 18 is a schematic structural diagram 3 of a storage medium according to an embodiment of the present application.

detailed description

The application processing method, device and device provided by the following embodiments of the present application can be applied to a network system configured with network slices. The network system can be, for example, 5G configured with multiple network slices. Communication Systems. FIG. 1 is a structural diagram of a network system to which embodiments of the present application apply. As shown in FIG. 1 , in the network system, the terminal device can access the corresponding server, such as a server, through a radio access network (RAN) and a core network (CN), thereby implementing corresponding Service. In the network system, the applicable scenarios of the terminal device may include: an enhanced mobile broadband (eMBB), a large-scale Internet of Things (mMiveMTC), and a low-latency and high-reliability communication (Ultra-Relaible and Low). At least one scenario, such as Latency Communication (URLLC).

For example, in order to implement the Internet Protocol Multimedia Subsystem (IMS) service and the Internet service in the eMBB scenario, the terminal device may have an APP-slice adaptor corresponding to the eMBB application, where The eMBB application may include: an eMBB E1 application and an eMBB E2 application. The network slice adapter corresponding to the eMBB application may include a correspondence between the eMBB E1 application and the network slice information, and a correspondence between the eMBB E2 application and the network slice information. For the terminal device in the eMBB scenario, the Control Plane Network Functions for eMBB can be accessed according to the eMBB Common CP NFs of the Mobile Broadband Common Control Plane Network Functions (eMBB Common CP NFs). Slice E1) accesses the server device corresponding to the IMS by accessing the User Plane Network Functions for eMBB Slice E1 to implement the corresponding IMS service. The terminal device in the eMBB scenario can also access the eMBB E2 slice control plane network element (Control Plane Network Functions for eMBB Slice E2) according to the eMBB Common CP NFs, and access the user plane network element of the eMBB E2 slice (User Plane Network). Functions for eMBB Slice E2), thereby accessing the server device corresponding to the Internet to implement the corresponding Internet service.

To implement Grid service and Industrial Sensors service in the mMTC scenario, the terminal device may have a network slice adapter corresponding to the mMTC application; the mMTC application may include: mMTC M1 application and mMTC M2 application. The network slice adapter corresponding to the mMTC application may include a correspondence between the mMTC M1 application and the network slice information, and a correspondence between the mMTC M2 application and the network slice information. For the terminal device in the mMTC scenario, the control plane network element (Control Plane Network Functions for mMTC Slice M1) can be connected to the MMTC M1 slice, and the user plane network element of the mMTC M1 slice is accessed. (User Plane Network Functions for mMTC Slice M1), thereby accessing the corresponding server device of the power grid to realize the corresponding grid service. For the terminal device in the mMTC scenario, the Control Plane Network Functions for mMTC Slice M2 can also be accessed by accessing the MMTC M2 sliced user plane network element (User Plane Network Functions for mMTC Slice M2). ), thereby accessing the server device corresponding to the industrial sensor to realize the corresponding industrial sensor service.

To implement the information exchange service and the Tactile Internet service of the URL to the outside of the URL to the scene (V2X), the terminal device may have a network slice adapter corresponding to the URLLC application, and the URLLC application includes the URLLC U1 application and URLLC U2 application. The network slice adapter corresponding to the URLLC application may include a correspondence between the URLLC U1 application and the network slice information, and a correspondence between the URLLC U2 application and the network slice information. The User Plane Network Functions for URLLC Slice U1 can be accessed by the terminal device in the URLLC scenario by accessing the Control Plane Network Functions for URLLC Slice U1. Therefore, the server device corresponding to the V2X is accessed to implement the corresponding grid service. For the terminal device in the URLLC scenario, the Control Plane Network Functions for URLLC Slice U2 can also be accessed, and the User Plane Network Functions for URLLC Slice U2 is accessed by accessing the URLLC U2 slice. ), thereby accessing the server device corresponding to the haptic Internet, and implementing the corresponding haptic Internet service.

It should be noted that the terminal device involved in the following embodiments of the present application may be a device that provides data connectivity to a user, a handheld device with a wireless connection function, or a wireless device that is connected to a wireless modem. The wireless terminal can communicate with one or more core networks via the RAN), which can be a mobile terminal, such as a mobile telephone (or "cellular" telephone) and a computer with a mobile terminal, for example, can be portable, pocket-sized , handheld, computer built-in or in-vehicle mobile devices that exchange language and/or data with a wireless access network. For example, personal communication service (PCS, Personal Communication Service) telephone, cordless telephone, Session Initiation Protocol (SIP) telephone, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA, Personal Digital Assistant), etc. . A wireless terminal may also be called a system, a subscriber unit (Subscriber Unit), a subscriber station (Subscriber Station), and a mobile station (Mobile). Station), Mobile Station, Remote Station, Access Point, Remote Terminal, Access Terminal, User Terminal, User Agent Agent), User Device, User Equipment, smartphone, Automated Device or Internet Of Things Device.

The carrier device involved in the following embodiments of the present application may be a network element device in an operator network. The network element device in the carrier network may be a Mobility Management Entity (MME), or another network element entity with mobility or slice management functions, such as a Common Control Plane (Common Control Plane, Common Common CP) or Slice Select Function (SSF).

The following is exemplified by various embodiments.

FIG. 2 is a flowchart 1 of an application processing method according to an embodiment of the present application. As shown in FIG. 2, the application processing method may include:

S201. The terminal device sends a verification request to the network device. The verification request includes information about the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application.

For example, the terminal device may send a verification request to the network device if it is determined that the application needs to use the network slice to access the corresponding network. For example, the terminal device may send a permission request to the user, and if receiving a confirmation command input by the user, such as clicking and agreeing to the corresponding instruction, it may be determined that the application needs to use the network slice to access the corresponding network.

The application may be an application that the terminal device is installing or already installed after being downloaded from an application store or other channels. The providing device of the application may be a server that provides the application, such as a server of an application provider, or a server of an application store, or the like.

For example, the network device can be a carrier device, such as a carrier device to which the terminal device is attached. That is, the terminal device can send a verification request to the carrier device to which it is attached. For example, the verification request may be an APP Certificate Validate Request. Alternatively, the terminal device may send a Non-Access Stratum (NAS) signaling to the carrier device, where the verification request may be included in the NAS signaling.

Alternatively, the network device can also be a server, such as a certificate verification server. That is, the terminal device can send a verification request to the server. For example, the terminal device can send the verification request to the server through the user plane message. The terminal device may be pre-stored at the end Information such as an internet protocol (IP) address or a network domain name of the server on the end device determines the server, and then sends the verification request to the server.

Correspondingly, the network device receives the verification request from the terminal device.

S202. The network device determines a root certificate according to the information of the to-be-verified certificate.

For example, the information of the certificate to be verified may include a root certificate identifier. The network device can determine the root certificate according to the root certificate identifier.

Optionally, the information of the certificate to be verified may further include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, a hash algorithm of the certificate to be verified, and the to-be-calibrated The fingerprint algorithm of the verification book, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued. The issuer identifier may be an identifier of a certificate issuing device, such as an identifier of a carrier, a certificate authority (CA) identifier, or the like. The CA identifier may be the identity of the issuing authority of the certificate to be verified, such as the carrier device, the certificate server, or other certificate issuing organization. The identifier of the object to which the certificate to be verified is issued may be at least one of an identifier of the application provider, an identifier of the providing device of the application, and the like.

S203. The network device determines whether the information of the to-be-verified certificate meets a preset condition, to obtain a verification result of the to-be-verified certificate.

The determining, by the network device in S203, that the information of the to-be-verified certificate meets the preset condition, may include:

The network device determines, according to the root certificate and the information of the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device.

For example, the network device can determine whether the information of the root certificate and the information of the certificate to be verified include the same information. If the information of the root certificate and the information of the certificate to be verified include the same information, the network device may determine that the certificate to be verified is a certificate issued by the certificate issuing device, and thus the certificate to be verified may be determined. The first check passes. On the other hand, if the information of the root certificate and the information of the certificate to be verified do not include the same information, the network device may determine that the certificate to be verified is not a certificate issued by the certificate issuing device, and thus may determine the pending The first verification of the certificate failed.

It should be noted that the network device may be the same device or different device as the certificate issuing device. The certificate issuing device may be a carrier device or another certificate issuing device.

S204. The network device sends a verification response to the terminal device. The verification response includes a verification result of the to-be-verified certificate.

Correspondingly, the terminal device receives the verification response from the network device.

The verification response can be an APP Certificate Validate response. If the first check of the to-be-verified certificate is passed, the verification result of the to-be-verified certificate in the verification response may include a first verification success indication, and the first verification success indication may also be called a school Pass the Pass (Validate Pass). If the first check of the to-be-verified certificate fails, the verification result of the to-be-verified certificate may also include a first verification failure indication, and the first verification failure indication may also be referred to as a verification pass indication (Validate Fail).

In the application control method provided by the embodiment of the present application, the terminal device may send a verification request to the network device, where the verification request includes information about the certificate to be verified, and the network device determines the root certificate according to the information of the certificate to be verified. And determining, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device, obtaining a verification result of the certificate to be verified, and then returning a verification response to the terminal device, The verification response includes a verification result of the certificate to be verified. In this method, the network device can verify the certificate to be verified of the application, and can effectively prevent the illegal application running on the terminal device from using the network slice to access the network, thereby effectively ensuring the security of the network.

Optionally, the verification request further includes: an application identifier.

Optionally, the application identifier may include: an identifier of the application, and/or an identifier of the application providing device, and the like. The identifier of the application may include at least one of the following: a name of the application, a version number of the application, and the like. The identifier of the application providing device may include: the application provides information such as the name of the provider corresponding to the device.

Optionally, the determining, by the network device in S203, that the information of the to-be-verified certificate meets the preset condition, may further include:

The network device determines, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of the providing device that is issued to the application.

For example, the network device may determine a certificate of the providing device issued to the application according to the application identifier, and then compare whether the information of the certificate issued to the providing device of the application includes the information of the certificate to be verified. If the information of the certificate issued to the application providing device includes the information of the certificate to be verified, the network device determines that the certificate to be verified is a certificate of the providing device issued to the application, and may determine the first certificate to be verified. The second check passed. On the other hand, if the information of the certificate issued to the application providing device does not include the information of the certificate to be verified, the network device determines that the certificate to be verified is not issued. A certificate issued to the application providing device, and thus the second verification failure of the certificate to be verified may be determined.

If the second verification of the to-be-verified certificate is passed, the verification result of the to-be-verified certificate in the verification response may include a second verification success indication. If the second verification of the to-be-verified certificate fails, the verification result of the to-be-verified certificate may include a second verification failure indication.

It should be noted that the first check of the to-be-verified certificate and the second check of the to-be-verified certificate may be performed simultaneously or sequentially. In an example, the network device may perform a second check on the to-be-verified certificate if the first verification of the to-be-verified certificate is successful. The first verification success may be: the certificate to be verified is a certificate issued by the certificate issuing device, and the second verification includes: determining whether the certificate to be verified is a certificate of the providing device issued to the application. .

Optionally, the verification request as described above may further include: an identifier of the terminal device.

Optionally, the identifier of the terminal device as described above may include at least one of the following: an IP address of the terminal device, a Medium Access Control (MAC) address, and a Subscriber Identity Module (SIM). The identification, the International Mobile Subscriber Identification Number (IMSI), and the Globally Unique Temporary UE Identity (GUTI).

Optionally, the determining, by the network device in S203, that the information of the to-be-verified certificate meets the preset condition, may further include:

Determining, by the network device, information about the network slice corresponding to the application according to the application identifier;

Determining, by the network device, information about the network slice subscribed by the terminal device according to the identifier of the terminal device;

The network device determines whether the network slice corresponding to the application is located in the network slice signed by the terminal device, according to the information of the network slice that is subscribed to by the terminal device and the network slice information corresponding to the application.

Specifically, the network device may determine, according to the application identifier, a correspondence between the preset application identifier and the network slice information, the information of the network slice corresponding to the application identifier is information about the network slice corresponding to the application. The network device may determine, according to the identifier of the terminal device, a correspondence between the preset terminal device identifier and the subscription network slice information, information about the network slice that the terminal device subscribes to.

The network device may query the network corresponding to the application in the information of the network slice subscribed by the terminal device. Network slice information. If the information about the network slice corresponding to the application is queried, that is, the information about the network slice corresponding to the application includes the information about the network slice corresponding to the application, the network slice corresponding to the application is determined to be signed by the terminal device. Within the network slice, the third check of the certificate to be verified can be determined to pass. On the other hand, if the information about the network slice corresponding to the application is not queried, that is, the information about the network slice corresponding to the application is not included in the information of the network slice subscribed by the terminal device, the network slice corresponding to the application may be determined not to be It is located in the network slice that is subscribed to by the terminal device, so that the third verification failure of the to-be-verified certificate can be determined.

If the third check of the to-be-verified certificate is passed, the verification result of the to-be-verified certificate in the verification response may include a third verification success indication. If the third verification of the to-be-verified certificate fails, the verification result of the to-be-verified certificate may also include a third verification failure indication.

It should be noted that the first check of the to-be-verified certificate, the second check of the to-be-verified certificate, and the third check of the to-be-verified certificate may be performed simultaneously, or may be performed sequentially. In an example, the network device may perform a second check on the to-be-verified certificate if the first verification of the to-be-verified certificate is successful, and if the second verification is successful, The certificate to be verified performs a third verification. The first verification success may be: the certificate to be verified is a certificate issued by the certificate issuing device, and the second verification succeeds: the certificate to be verified is a certificate of a providing device issued to the application, The third check includes: determining whether the network slice corresponding to the application is located in the network slice signed by the terminal device.

Optionally, if the to-be-verified certificate meets the preset condition, the verification response may further include: information about the network slice corresponding to the application.

The preset condition includes: the certificate to be verified is a certificate issued by the certificate issuing device, the certificate to be verified is a certificate of the providing device issued to the application, and the network slice corresponding to the application is located at the terminal device. Within the network slice.

The network device may determine that the to-be-verified certificate satisfies the preset condition, that is, the first check, the second check, and the third check of the to-be-verified certificate are verified, and the check is passed. Sending information of the network slice corresponding to the application to the terminal device.

The information of the network slice corresponding to the application may include a mapping relationship between the application and the information of the network slice.

When receiving the information about the network slice corresponding to the application, the terminal device may refresh the network slice corresponding to the application stored by the terminal device according to the information of the network slice corresponding to the application. The information in the adapter is to update the information in the network slice adapter corresponding to the application to the received network slice information corresponding to the application.

Optionally, the information about the network slice corresponding to the application, as described above, includes at least one of the following information: an identifier of the network slice, a service type corresponding to the network slice, and a type of the terminal device that uses the network slice. And the validity period information of the network slice, and the like.

The service type may include any of the types of services, such as a video service, a voice over internet protocol (VoIP) service, and a V2X service.

The type of the terminal device that uses the network slice may also be referred to as the usage type (Usage Type) corresponding to the network slice, and the usage type may include: a car UE Usage Type, and a type of use of the smart phone ( Smartphone UE Usage Type) Any type of terminal device that uses this network slice.

Network slices of different security levels have different validity periods. The higher the security level of the network slice, the shorter the validity period of the network slice, and the lower the security level of the network slice, the longer the validity period of the network slice corresponds. Thus, the validity period information of the network slice can be determined by the network device according to the security level of the network slice.

The terminal device may determine the validity period of the network slice according to the received validity period information of the network slice, and access the corresponding network according to the information of the network slice during the validity period of the network slice. If the validity period of the network slice expires, the terminal device may perform the certificate verification of the application by using any one of the application processing methods described above, and re-acquire the network slice from the network device if the certificate verification is passed. information.

Optionally, the verification response further includes: certificate verification frequency information of the application.

For example, network slices of different security levels have different certificate verification frequencies. The higher the security level of the network slice, the higher the certificate check frequency corresponding to the network slice, and the lower the security level of the network slice, the lower the certificate check frequency corresponding to the network slice. Thus, the certificate check frequency indication of the network slice can be determined by the network device based on the security level of the network slice.

The terminal device may determine a certificate verification frequency of the application according to the certificate verification frequency information of the application, and send the verification request to the network device according to the certificate verification frequency of the application, so that the network device is to be The verification is verified again.

In an implementation manner, the embodiment of the present application may further provide an application processing method. FIG. 3 is a second flowchart of an application processing method according to an embodiment of the present application. As shown in Figure 3, the above steps S201 can include:

S301. The terminal device sends the verification request to the network device during the installation process of the application.

For example, during the installation process of the application, the terminal device may suspend the installation of the application and send the verification request to the network device.

Optionally, if the to-be-verified certificate meets the preset condition, the verification response further includes: information about the network slice corresponding to the application. After the terminal device receives the verification response, the method may include:

The terminal device stores information about the network slice corresponding to the application, and installs the application.

If the verification response received by the terminal device from the network device includes information about the network slice corresponding to the application, the terminal device may store information about the network slice corresponding to the application. If the installation of the application is suspended, the terminal device may continue to install the application, so that after the application is installed, the information may be accessed according to the information of the network slice corresponding to the application. The network implements the corresponding business needs of the application.

Optionally, if the certificate to be verified does not meet the preset condition, that is, the certificate to be verified is not issued by the certificate issuing device, and the certificate to be verified is not issued to the application providing device by the certificate issuing device. The method may include: the terminal device stops installing the application, or the network slice corresponding to the application is not located in the network slice signed by the terminal device.

In the application processing method, the terminal device sends the verification request to the network device during the installation process of the application, and if the certificate to be verified satisfies the preset condition, the application is continuously installed, and the If the verification certificate does not meet any of the preset conditions, the installation of the application is stopped, and the installation of the illegal application can be effectively avoided, thereby effectively avoiding the risk of the network slice being accessed or attacked by the malicious application, and improving the security of the network.

Optionally, in the installation process of the application in S301, before the terminal device sends the verification request to the network device, the method may further include:

S301a. The providing device of the application sends the installation package of the application to the terminal device. The installation package includes: a signature file, an installation file, and the certificate to be verified.

Correspondingly, the terminal device receives the installation package of the application from the providing device of the application.

The signature file may be used by the application providing device to perform signature processing on the installation file of the application, obtain signature data, and then encrypt the signature data according to a preset private key by using a preset fingerprint algorithm. The certificate to be verified may be determined by the application providing device according to the certificate obtained from the certificate issuing device, and the certificate to be verified may include, for example, a certificate issued by the certificate issuing device. All or part of the information in the book.

S301b: The terminal device performs integrity verification on the installation file according to the to-be-verified certificate and the signature file.

For example, the terminal device may determine, according to the to-be-verified certificate, a public key, a signature algorithm, and a fingerprint algorithm corresponding to the private key, and perform a signature operation on the installation file according to the signature algorithm to obtain signature data A of the installation file, and then The public key uses the fingerprint algorithm to decrypt the signature file to obtain signature data B. The terminal device performs integrity verification on the installation file by comparing the signature data A and the signature data B. If the signature data A and the signature data B are the same, the terminal device may determine that the integrity check of the installation file passes; if the signature data A and the signature data B are different, the terminal device may determine the installation file. The integrity check failed.

If the terminal device determines that the integrity check is passed, it is determined that the installation file has not been maliciously modified; if the terminal device determines that the integrity check fails, it is determined that the installation file is maliciously modified and belongs to an incomplete file.

Correspondingly, in the method of the foregoing, in the installation process of the application, the terminal device sends the verification request to the network device, which may include:

During the installation process of the application, if the integrity check of the installation file passes, the terminal device sends the verification request to the network device.

In the method, the installation file is integrity checked, and if the integrity check of the installation file passes, the installation of the application is performed, and then the verification request is sent to the network device during the installation process of the application. It can effectively avoid the installation of illegal applications, effectively avoid the risk of network slicing being attacked or attacked by malicious applications, improve the security of the network, and effectively avoid the application incomplete or difficult application caused by malicious modification. Realization, effectively guarantee the implementation of the corresponding function of the application.

Optionally, the embodiment of the present application may further provide an application processing method. FIG. 4 is a third flowchart of an application processing method according to an embodiment of the present disclosure. As shown in FIG. 4, the application processing method may include:

S401. The certificate issuing device sends a first certificate to the providing device of the application.

Correspondingly, the providing device of the application receives the first certificate from the certificate issuing device.

The first certificate may be a certificate issued by the certificate issuing device to the providing device of the application.

S402. The providing device of the application processes the installation file of the application according to the first certificate. Get the signature file for the app.

The installation file of the application may be an installation file pre-stored in the providing device, and the installation file on the providing device may be an installation file uploaded by a developer of the application.

For example, the application providing device may determine a signature algorithm, a private key, a fingerprint algorithm, and the like according to the first certificate, and process the installation file according to the signature algorithm to obtain signature data of the installation file, and adopt the fingerprint algorithm according to the private key. The installation file is encrypted to obtain the signature file of the application.

S403. The application providing device sends the signature file, the installation file, and the second certificate to the terminal device. The second certificate includes all or part of the information of the first certificate, and the second certificate and the signature file are used to enable the terminal device. Perform an integrity check on the installation file.

The second certificate may be a certificate to be verified in the application processing method as described in any of the above.

Optionally, the information about the first certificate as described above may include at least one of the following information: a secret key pair, a signature algorithm, a hash algorithm, a fingerprint algorithm, an expiration date, an issuer identifier, and an identifier of the issued object; The key pair includes: a private key and a public key.

For example, since the first certificate is delivered to the providing device of the application by the certificate issuing device, the issuer identifier may include the identifier of the certificate issuing device in the first certificate. The identifier of the issued object may include: an identifier of the provided device of the application.

In the method as described above, the providing device of the application may process the installation file according to the signature algorithm in the first certificate, obtain signature data of the installation file, and process the processed data according to the hash algorithm. , get the hash value of the signature data. The providing device of the application may, for example, encrypt the hash value of the signature data according to the fingerprint algorithm in the first certificate according to the private key in the key pair to obtain the signature file.

When the providing device of the application determines that the validity period of the first certificate expires, the certificate issuing device may send a certificate update request to obtain the latest certificate issued by the certificate issuing device, so as to implement timely updating of the certificate, so as to effectively avoid being effective. Avoid the installation of illegal applications, effectively avoid the risk of network slicing being attacked or attacked by malicious applications, and improve network security.

Optionally, the information of the second certificate includes partial information of the information of the first certificate. For example, the information of the second certificate may include at least one of the following: a public key in the information of the first certificate, a signature algorithm in the information of the first certificate, a hash algorithm in the information of the first certificate, a fingerprint algorithm in the information of the first certificate, a validity period in the information of the first certificate, and a letter of the first certificate The issuer identifier in the interest and the identifier of the issued object in the information of the first certificate, and the like.

For example, if the second certificate (for example, the certificate to be verified) includes the public key, the signature algorithm, the hash algorithm, and the fingerprint algorithm, the terminal device may perform a signature operation on the installation file according to the signature algorithm. And performing the hash operation on the data after the signature operation according to the hash algorithm, obtaining the signature data A of the installation file, and then decrypting the signature file according to the public key by the fingerprint algorithm to obtain the signature data B. The terminal device can perform integrity check on the installation file by comparing the signature data A and the signature data B. If the signature data A and the signature data B are the same, the terminal device may determine that the integrity check of the installation file passes; otherwise, if the signature data A and the signature data B are different, the terminal device may determine the integrity of the installation file. Sex check failed.

It should be noted that the information included in the foregoing first certificate and the second certificate is only an example, and the first certificate and the second certificate may further include other information such as the certificate specification, and details are not described herein again.

In another implementation manner, the sending, by the terminal device, the verification request to the network device in S201, as described above, may include:

During the startup of the application, the terminal device sends the verification request to the network device.

For example, the terminal device may send the verification request to the network device during each startup of the application, or may send the verification request to the network device during the first startup of the application.

Optionally, if the to-be-verified certificate meets the preset condition, the verification response further includes: information about the network slice corresponding to the application. After the terminal device receives the verification response, the method may further include:

The terminal device stores information about a network slice corresponding to the application, and accesses the network according to the network slice.

If the terminal device stores the information about the network slice corresponding to the application, the terminal device can access the network according to the information of the network slice corresponding to the application, so as to implement the corresponding service requirement of the application.

Optionally, the terminal device may store information about the network slice corresponding to the application to the terminal device, whether the terminal device is in the installation process of the application or the information about the network slice corresponding to the application acquired during the startup process. In the storage area of the SIM card, the information of the network slice corresponding to the application is prevented from being maliciously modified or copied to ensure network security.

Optionally, the terminal device may store the information about the network slice corresponding to the application, and store the public key information corresponding to the application, so as to ensure that the application corresponds to the information. The security of the network sliced information stored on the terminal device side is effectively avoided. The information of the network slice corresponding to the application is maliciously modified or copied to ensure network security.

Optionally, the embodiment of the present application may further provide an application processing method. FIG. 5 is a flowchart 4 of an application processing method according to an embodiment of the present application. As shown in FIG. 5, the application processing method may include:

S501. The terminal device searches for a root certificate corresponding to the to-be-verified certificate from the preset root certificate area according to the information of the certificate to be verified.

The certificate to be verified may be a certificate from the application providing device.

For example, the information of the certificate to be verified may include a root certificate identifier. The terminal device can search for the root certificate corresponding to the root certificate identifier from the preset root certificate area according to the root certificate identifier. The preset root certificate area may store at least one root certificate, and each root certificate has a corresponding root certificate identifier.

S502. The terminal device determines, according to the root certificate, the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device, to obtain a verification result of the to-be-verified certificate.

For example, the terminal device can determine whether the information of the root certificate and the information of the certificate to be verified include the same information. If the information of the root certificate and the information of the certificate to be verified include the same information, the terminal device may determine that the certificate to be verified is a certificate issued by the certificate issuing device, and the validity of the certificate to be verified is verified. . On the other hand, if the information of the root certificate and the information of the certificate to be verified do not include the same information, the terminal device may determine that the certificate to be verified is not a certificate issued by the certificate issuing device, and the certificate to be verified is legal. Sex check failed.

Compared with the application processing method described in any one of the foregoing FIG. 2 to FIG. 4, in the method, the verification of the certificate can be implemented by the terminal device itself.

In the application processing method provided by the embodiment of the present application, the root device identifier corresponding to the to-be-verified certificate of the application is determined by the terminal device, and the root certificate corresponding to the root certificate identifier is searched according to the root certificate identifier. And then verifying the validity of the certificate to be verified according to the root certificate. In this method, the terminal device can verify the certificate to be verified of the application, and can effectively prevent the illegal application running on the legal terminal device from using the network slice to access the network, thereby effectively ensuring the security of the network.

Optionally, the method, in the foregoing S501, the terminal device, before the root certificate corresponding to the to-be-verified certificate, is obtained from the preset root certificate area according to the information of the certificate to be verified, the method may further include:

The terminal device receives the installation package of the application from the providing device of the application; the installation package includes: an installation file of the application, information of the certificate to be verified, and information of a network slice corresponding to the application.

Optionally, if the certificate to be verified is a certificate issued by the certificate issuing device, the method may further include:

The terminal device stores information of a network slice corresponding to the application.

That is, in the method provided by the embodiment of the present application, the terminal device can receive the application from the providing device of the application while receiving the installation file of the application and the information of the certificate to be verified from the providing device of the application. Corresponding network slice information, and the terminal device can verify the application to be verified certificate without sending a request to the network device to obtain information of the network slice corresponding to the application.

The terminal device may receive the information of the network slice corresponding to the application from the providing device of the application, but the terminal device may store the terminal device after determining that the certificate to be verified is a certificate issued by the certificate issuing device. The information of the network slice corresponding to the application. If the certificate to be verified is not a certificate issued by the certificate issuing device, the terminal device may discard the installation package of the application.

It should be noted that the terminal device may further receive a signature file of the application delivered by the application providing device, to perform integrity verification on the installation file. The implementation process of the specific integrity check is similar to the above, and is not described here. A specific description of the information of the to-be-verified certificate, the signature file, and the network slice corresponding to the application may be similar to the foregoing, and details are not described herein again.

The embodiment of the present application further provides an application processing method. FIG. 6 is a flowchart 5 of an application processing method according to an embodiment of the present disclosure. As shown in FIG. 6, the application processing method may include:

S601. The application providing device sends an application certificate request to the operator device.

Correspondingly, the operator device receives the application certificate request from the application providing device.

S602. After receiving the application certificate request, the operator equipment sends the issuing certificate to the application providing device.

Correspondingly, the application providing device receives the issuance certificate from the operator device.

The information for issuing the certificate includes: a secret key pair of the issued certificate, a signature algorithm of the issued certificate, a hash algorithm of the issued certificate, a fingerprint algorithm of the issued certificate, an issuer identifier of the issued certificate, and an application providing device Identification, validity period of the issued certificate, and certificate specification information. The key pair includes: a private key and a public key.

S603. The application providing device processes the installation file of the application according to the signature algorithm, obtains signature data of the installation file, and processes the signature data according to the hash algorithm to obtain a hash value of the signature data, and according to the private The key uses the fingerprint algorithm to encrypt the hash value of the signature data to obtain a signature file of the application.

The installation file of the application may be an installation file pre-stored in the application providing device, and the application file provided on the device may be an installation file uploaded by a developer of the application.

S604. The application providing device sends, to the terminal device, the signature file of the application, the installation file, and the information of the certificate to be verified, where the information of the certificate to be verified includes part of the information of the certificate.

The information of the certificate to be verified includes: the public key, the signature algorithm, the hash algorithm, the fingerprint algorithm, the validity period, the issuer identifier, the identifier of the application providing device, and other contents of the certificate specification.

S605. The terminal device decrypts the signature file by using the fingerprint algorithm according to the public key to obtain a hash value of the signature data A.

S606. The terminal device processes the installation file according to the signature algorithm to obtain signature data B, and processes the signature data B according to the hash algorithm to obtain a hash value of the signature data B.

S607. The terminal device compares whether the hash value of the signature data A and the hash value of the signature data B are the same.

S608. If the hash value of the signature data A and the hash value of the signature data B are the same, the terminal device determines that the installation file passes the integrity check and starts installing the application according to the installation file.

If the hash value of the signature data A and the hash value of the signature data B are different, the terminal device determines that the integrity check of the installation file fails.

S609. The terminal device determines that the application has a network slice access requirement, and sends a verification request to the operator equipment, where the verification request includes an identifier of the application, an identifier of the terminal device, and information about the certificate to be verified.

For example, the terminal device may determine that the application has a network slice access requirement if it is determined that the application needs to use a network slice to access the corresponding network. The terminal device can send a verification request to the operator device during the installation of the application. The terminal device may also send a verification request to the operator device during the startup process of the application.

S610: The operator equipment determines the root certificate according to the information of the certificate to be verified, and determines, according to the information of the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the operator device.

For example, the carrier device in the S610 determines the root certificate according to the information of the to-be-verified certificate, which is similar to the foregoing S202. For the specific implementation process, refer to the foregoing, and details are not described herein.

The carrier device in the S610 determines, according to the root certificate and the information of the certificate to be verified Whether the certificate is a certificate issued by the operator device is similar to that in the above S203. For the specific implementation process, refer to the above, and no further details are provided herein.

S611. The operator equipment determines, according to the identifier of the application and the information of the certificate to be verified, whether the certificate to be verified is a certificate issued by the operator device to the application providing device.

S612. The operator equipment determines, according to the identifier of the terminal device, a network slice that is subscribed by the terminal device, and determines information about the network slice corresponding to the application according to the identifier of the application.

S613. The operator equipment determines whether the network slice corresponding to the application is located in the network slice signed by the terminal device, according to the information of the network slice that is subscribed to by the terminal device and the network slice information corresponding to the application.

It should be noted that, in this application, the execution order of S611, S612, and S613 is not limited, and S611, S612, and S613 may be executed simultaneously or sequentially.

S614. If the certificate to be verified is a certificate issued by the operator device, and the certificate to be verified is a certificate issued to the application providing device, and the network slice corresponding to the application is located in the network slice signed by the terminal device, The operator device sends a verification response to the terminal device, where the verification response includes a verification success indication of the to-be-checked certificate and information about the network slice corresponding to the application.

S615. The terminal device determines, according to the verification success indication of the to-be-verified certificate, that the to-be-verified certificate is verified and stores information of the network slice corresponding to the application.

For example, if the terminal device sends a verification request to the operator device during the installation process of the application, and the terminal device determines that the to-be-verified certificate is verified, the terminal device may continue to install the application according to the installation file.

If the terminal device sends a verification request to the operator device during the startup process of the application, and the terminal device determines that the to-be-verified certificate is verified, the terminal device may also access the network according to the network slice corresponding to the application.

S616. If the certificate to be verified is not a certificate issued by the operator device, the certificate to be verified does not issue a certificate to the device for the device, or the network slice corresponding to the application is not located in the terminal device. Within the contracted network slice, the operator device sends a verification response to the terminal device, and the verification response includes a verification failure indication of the to-be-verified certificate.

S617. The terminal device determines, according to the verification failure indication of the to-be-verified certificate, that the verification of the to-be-verified certificate fails.

For example, if the terminal device sends a verification to the carrier device during the installation process of the application, If the terminal device determines that the verification of the to-be-verified certificate fails, the terminal device also needs to notify the installation of the application.

If the terminal device sends a verification request to the operator device during the startup process of the application, and the terminal device determines that the to-be-verified certificate is verified, the application may also be stopped.

The application processing method may be that the certificate to be verified is a certificate issued by the operator device, the certificate to be verified is a certificate issued to the application providing device, and the network slice corresponding to the application is located in the network signed by the terminal device. In the case of the slice, the terminal device stores the information of the network slice corresponding to the application, so that the terminal device can access the network according to the information of the network slice corresponding to the application, so as to implement the corresponding service requirement of the application. And, the certificate to be verified is not issued by the operator device, the certificate to be verified is not issued by the operator device to the application providing device, or the network slice corresponding to the application is not located in the terminal. The installation of the application is stopped in the case of the network sliced by the device, which can effectively prevent the installation or startup of the illegal application, thereby effectively avoiding the risk of the network slice being accessed or attacked by the malicious application, and improving the security of the network.

The embodiment of the present application further provides a network device. FIG. 7 is a schematic structural diagram 1 of a network device according to an embodiment of the present disclosure. As shown in FIG. 7, the network device 700 includes:

The receiving module 701 is configured to receive a verification request from the terminal device, where the verification request includes information about the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application;

The processing module 702 is configured to determine a root certificate according to the information of the to-be-verified certificate, and determine whether the information of the to-be-verified certificate meets a preset condition to obtain a verification result of the to-be-verified certificate.

The sending module 703 is configured to send a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate.

The processing module 702 is specifically configured to determine, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device.

In an implementation manner, the verification request further includes an application identifier.

The processing module 702 is further configured to determine, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of a providing device that is issued to the application.

In another implementation manner, the verification request may further include an identifier of the terminal device.

The processing module 702 is further configured to: determine, according to the application identifier, information about a network slice corresponding to the application; determine, according to the identifier of the terminal device, information about a network slice that is subscribed by the terminal device; and information about the network slice that is subscribed according to the terminal device Apply the information of the corresponding network slice to determine the response Whether the corresponding network slice is located in the network slice signed by the terminal device.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about a network slice corresponding to the application; wherein the preset condition may include: the to-be-checked The certificate is the certificate issued by the certificate issuing device, the certificate to be verified is the certificate of the providing device issued to the application, and the network slice corresponding to the application is located in the network slice signed by the terminal device.

In another implementation manner, the information about the network slice corresponding to the application may include at least one type of information: an identifier of the network slice, a service type corresponding to the network slice, a usage type corresponding to the network slice, and the network slice. The validity period information and the certificate verification frequency information corresponding to the network slice.

In another implementation manner, the receiving module 701 is specifically configured to receive the verification request from the terminal device during the installation process of the application or during the startup process of the application.

In another implementation manner, the information about the certificate to be verified may include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash of the certificate to be verified The algorithm, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

The network device provided by the embodiment of the present application may perform the application processing method performed by the network device described in any of the foregoing FIG. 2, FIG. 3, FIG. 4, and FIG. 6, and the specific implementation process and beneficial effects thereof may be referred to above. This will not be repeated here.

The embodiment of the present application further provides a terminal device. FIG. 8 is a schematic structural diagram 1 of a terminal device according to an embodiment of the present disclosure. As shown in FIG. 8, the terminal device 800 includes:

The sending module 801 is configured to send a verification request to the network device, where the verification request includes information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; and the information of the certificate to be verified is used for Verify the verification of the certificate.

The receiving module 802 is configured to receive a verification response from the network device, where the verification response includes a verification result of the to-be-verified certificate.

In an implementation manner, the verification request may further include an application identifier, where the application identifier is used to determine whether the certificate to be verified is a certificate issued by the certificate issuing device to the application providing device.

In another implementation manner, the application identifier is further used for determining the information of the network slice corresponding to the application;

The verification request may further include an identifier of the terminal device; the identifier of the terminal device is used for the terminal The determination of the network slice of the device contract.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about the network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate is The certificate issued by the certificate issuing device, the certificate to be verified is a certificate of the providing device issued to the application, and the certificate to be verified is a network slice corresponding to the application, and is located in a network slice signed by the terminal device;

The terminal device 800 further includes:

The storage module is configured to store information about a network slice corresponding to the application.

In another implementation manner, the information about the network slice corresponding to the application includes at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, a type of the terminal device using the network slice, and the network The validity period information of the slice and the certificate verification frequency information corresponding to the network slice.

In another implementation manner, the sending module 801 is specifically configured to send the verification request to the network device during the installation process of the application or during the startup process of the application.

In another implementation manner, the information about the certificate to be verified may include at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash of the certificate to be verified The algorithm, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

The terminal device device provided by the embodiment of the present application may perform the application processing method performed by the terminal device described in any of the foregoing FIG. 2, FIG. 3, FIG. 4, and FIG. 6, and the specific implementation process and beneficial effects thereof may be referred to the foregoing. I will not repeat them here.

The embodiment of the present application further provides a terminal device. FIG. 9 is a schematic structural diagram 2 of a terminal device according to an embodiment of the present disclosure. As shown in FIG. 9, the terminal device 900 includes:

The processing module 901 is configured to search, according to the information of the certificate to be verified, the information of the root certificate corresponding to the certificate to be verified from the preset root certificate area; the certificate to be verified is a certificate of the providing device from the application; The root certificate and the information of the certificate to be verified determine whether the certificate to be verified is a certificate issued by the certificate issuing device, so as to obtain a verification result of the certificate to be verified.

In an implementation manner, the terminal device 900 further includes:

a receiving module, configured to receive an installation package of the application from the providing device of the application; the installation package includes: an installation file of the application, information of the certificate to be verified, and a network slice corresponding to the application interest.

In another implementation manner, if the certificate to be verified is a certificate issued by the certificate issuing device, the terminal device 900 further includes:

The storage module is configured to store information about a network slice corresponding to the application.

The terminal device provided by the embodiment of the present application can perform the application processing method performed by the terminal device in the foregoing FIG. 5, and the specific implementation process and the beneficial effects thereof can be referred to the foregoing, and details are not described herein again.

The embodiment of the present application further provides a network device. FIG. 10 is a schematic structural diagram 2 of a network device according to an embodiment of the present disclosure. As shown in FIG. 10, the network device 1000 includes a receiver 1001, a processor 1002, and a transmitter 1003. The receiver 1001 is connected to the processor 1002, and the processor 1002 is connected to the transmitter 1003.

The receiver 1001 is configured to receive a verification request from the terminal device, where the verification request includes information about the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application.

The processor 1002 is configured to determine a root certificate according to the information of the to-be-verified certificate, and determine whether the information of the to-be-verified certificate meets a preset condition to obtain a verification result of the to-be-verified certificate.

The transmitter 1003 is configured to send a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate.

The processor 1002 is specifically configured to determine, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device.

In an implementation manner, the verification request further includes an application identifier;

The processor 1002 is further configured to determine, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of a providing device that is issued to the application.

In another implementation manner, the verification request may further include an identifier of the terminal device;

The processor 1002 is further configured to: determine, according to the application identifier, information about a network slice corresponding to the application; determine, according to the identifier of the terminal device, information about a network slice that is subscribed by the terminal device; and information about the network slice that is signed by the terminal device and the Applying the information of the corresponding network slice to determine whether the network slice corresponding to the application is located in the network slice signed by the terminal device.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about a network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate The certificate issued by the device is issued by the device, and the certificate to be verified is the certificate of the providing device issued to the application, and the network slice corresponding to the application is located in the network slice signed by the terminal device.

In another implementation manner, the information about the network slice corresponding to the application includes at least one type of information: an identifier of the network slice, a service type corresponding to the network slice, a usage type corresponding to the network slice, and a network slice. The validity period information and the certificate verification frequency information corresponding to the network slice.

In yet another implementation, the receiver 1001 has a means for receiving the verification request from the terminal device during installation of the application or during startup of the application.

In another implementation manner, the information about the certificate to be verified includes at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash algorithm of the certificate to be verified The fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

Optionally, the embodiment of the present application further provides a computer program product. FIG. 11 is a schematic structural diagram 1 of a computer program product according to an embodiment of the present application. As shown in FIG. 11, computer program product 1100 can include program code 1101.

The program code 1101 may be a program code corresponding to an application processing method executed by the network device described in any of the above-mentioned FIG. 2, FIG. 3, FIG. 4, and FIG.

The program code 1101 in the computer program product 1100 can be executed, for example, by the processor 1002 in the network device 1000 shown in FIG. 10 described above.

Optionally, the embodiment of the present application further provides a storage medium. FIG. 12 is a schematic structural diagram 1 of a storage medium according to an embodiment of the present disclosure. As shown in FIG. 12, storage medium 1200 can be used to store computer program product 1201. Computer program product 1201 can include program code 1202.

The program code 1202 may be a program code corresponding to an application processing method executed by the network device described in any of the above-mentioned FIG. 2, FIG. 3, FIG. 4, and FIG.

The storage medium 1200 may be an internal memory in the network device 1000 shown in FIG. 10 described above, or may be an external memory connected to the network device 1000 shown in FIG. 10 described above. The program code 1202 in the computer program product 1201 can be executed, for example, by the processor 1002 in the network device 1000 shown in FIG. 10 described above.

The network device, the computer program product, and the storage medium provided by the embodiments of the present application may perform the application processing method performed by the network device described in any of the foregoing FIG. 2, FIG. 3, FIG. 4, and FIG. 6, and the specific implementation process thereof And the beneficial effects can be seen in the above, and will not be described again here.

The embodiment of the present application further provides a terminal device. FIG. 13 is a schematic structural diagram 3 of a terminal device according to an embodiment of the present disclosure. As shown in FIG. 13, the terminal device 1300 may include a transmitter 1301 receiver 1302.

The sender 1301 is configured to send a verification request to the network device, where the verification request includes information about the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; and the information of the certificate to be verified is used. Check the certificate to be verified.

The receiver 1302 is configured to receive a verification response from the network device, where the verification response includes a verification result of the to-be-verified certificate.

In an implementation manner, the verification request further includes an application identifier, where the application identifier is used to determine whether the certificate to be verified is a certificate issued by the certificate issuing device to the application providing device.

In another implementation manner, the application identifier is further used for determining the information of the network slice corresponding to the application.

The verification request further includes an identifier of the terminal device; the identifier of the terminal device is used for determining a network slice subscribed by the terminal device.

In another implementation manner, if the to-be-verified certificate meets the preset condition, the verification response further includes information about the network slice corresponding to the application; wherein the preset condition includes: the to-be-verified certificate is The certificate is issued by the certificate issuing device, and the certificate to be verified is a certificate of the providing device issued to the application, and the certificate to be verified is a network slice corresponding to the application, and is located in a network slice signed by the terminal device.

The terminal device 1300 further includes: a processor and a memory; the processor is connected to the memory, and the processor is further connected to the receiver;

And a processor, configured to store information of the network slice corresponding to the application into the memory.

In another implementation manner, the information about the network slice corresponding to the application includes at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, a type of the terminal device using the network slice, and the network The validity period information of the slice and the certificate verification frequency information corresponding to the network slice.

In another implementation manner, the transmitter 1301 is specifically configured to send the verification request to the network device during installation of the application or during startup of the application.

In another implementation manner, the information about the certificate to be verified includes at least one of the following: a public key of the certificate to be verified, a signature algorithm of the certificate to be verified, and a hash algorithm of the certificate to be verified , The fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the identifier of the object to which the certificate to be verified is issued.

Optionally, the embodiment of the present application further provides a computer program product. FIG. 14 is a schematic structural diagram 2 of a computer program product according to an embodiment of the present application. As shown in FIG. 14, computer program product 1400 can include program code 1401.

The program code 1401 may be a program code corresponding to an application processing method executed by the terminal device described in any of the above-mentioned FIG. 2, FIG. 3, FIG. 4, and FIG.

The program code 1401 in the computer program product 1400 can be executed, for example, by the processor in the terminal device 1300 shown in FIG. 13 described above.

Optionally, the embodiment of the present application further provides a storage medium. FIG. 15 is a schematic structural diagram 2 of a storage medium according to an embodiment of the present disclosure. As shown in FIG. 15, storage medium 1500 can be used to store computer program product 1501. The computer program product 1501 can include program code 1502.

The program code 1502 may be a program code corresponding to an application processing method executed by the terminal device described in any of the above-mentioned FIG. 2, FIG. 3, FIG. 4, and FIG.

The storage medium 1500 may be an internal memory in the terminal device 1300 shown in FIG. 13 described above, or may be an external memory connected to the terminal device 1300 shown in FIG. 13 described above. The program code 1502 in the computer program product 1501 can be executed, for example, by the processor in the terminal device 1300 shown in FIG. 13 described above.

The terminal device, the computer program product, and the storage medium provided in the embodiments of the present application may perform the application processing method performed by the terminal device in any of the foregoing FIG. 2, FIG. 3, FIG. 4, and FIG. 6, and the specific implementation process thereof And the beneficial effects can be seen in the above, and will not be described again here.

The embodiment of the present application further provides a terminal device. FIG. 16 is a schematic structural diagram 4 of a terminal device according to an embodiment of the present disclosure. As shown in FIG. 16, the terminal device 1600 may include a processor 1601.

The processor 1601 is configured to search, according to the information of the certificate to be verified, the information of the root certificate corresponding to the certificate to be verified from the preset root certificate area; the certificate to be verified is a certificate of the providing device from the application; The root certificate and the information of the certificate to be verified determine whether the certificate to be verified is a certificate issued by the certificate issuing device, so as to obtain a verification result of the certificate to be verified.

In an implementation manner, the terminal device 1600 further includes: a receiver; and the receiver is connected to the processor 1601.

And a receiver, configured to receive an installation package of the application from the providing device of the application; the installation package includes: an installation file of the application, information about the certificate to be verified, and information about a network slice corresponding to the application.

In another implementation manner, the terminal device further includes: a memory; the processor 1601 is connected to the memory;

The processor is configured to store the information of the network slice corresponding to the application into the memory if the certificate to be verified is a certificate issued by the certificate issuing device.

Optionally, the embodiment of the present application further provides a computer program product. FIG. 17 is a schematic structural diagram 3 of a computer program product according to an embodiment of the present application. As shown in FIG. 17, computer program product 1700 can include program code 1701.

The program code 1701 may be a program code corresponding to the application processing method executed by the terminal device described in the above FIG. 5 of the embodiment of the present application.

The program code 1701 in the computer program product 1700 can be executed, for example, by the processor 1601 in the terminal device 1600 shown in FIG. 16 described above.

Optionally, the embodiment of the present application further provides a storage medium. FIG. 18 is a schematic structural diagram 3 of a storage medium according to an embodiment of the present application. As shown in FIG. 18, storage medium 1800 can be used to store computer program product 1801. Computer program product 1801 can include program code 1802.

The program code 1802 may be a program code corresponding to an application processing method executed by the terminal device described in the above FIG. 5 of the embodiment of the present application.

The storage medium 1800 may be an internal memory in the terminal device 1600 shown in FIG. 16 described above, or may be an external memory connected to the terminal device 1600 shown in FIG. 16 described above. The program code 1802 in the computer program product 1801 can be executed, for example, by the processor 1601 in the terminal device 1600 shown in FIG. 16 described above.

The terminal device, the computer program product, and the storage medium provided in the embodiments of the present application can perform the application processing method performed by the terminal device in the foregoing FIG. 5, and the specific implementation process and beneficial effects thereof can be referred to the above, and details are not described herein again. .

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing method includes the steps of the foregoing method embodiments; and the foregoing storage medium includes: a ROM, a RAM, a magnetic disk, or an optical disk, and the like, which can store various program codes. quality.

Finally, it should be noted that the above embodiments are only for explaining the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present application. range.

Claims (30)

An application processing method, comprising: The network device receives the verification request from the terminal device, where the verification request includes information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; Determining, by the network device, the root certificate according to the information of the to-be-verified certificate; Determining, by the network device, whether the information of the to-be-verified certificate meets a preset condition, to obtain a verification result of the to-be-verified certificate; The network device sends a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate; The determining, by the network device, whether the information of the to-be-verified certificate meets the preset condition comprises: determining, by the network device, whether the to-be-verified certificate is a certificate according to the information of the root certificate and the to-be-verified certificate Issue a certificate issued by the device. The method according to claim 1, wherein the verification request further comprises an application identifier; The determining, by the network device, whether the information of the to-be-verified certificate meets a preset condition, further includes: The network device determines, according to the application identifier and the information of the to-be-verified certificate, whether the certificate to be verified is a certificate of a providing device that is issued to the application. The method according to claim 2, wherein the verification request further comprises an identifier of the terminal device; The determining, by the network device, whether the information of the to-be-verified certificate meets a preset condition, further includes: Determining, by the network device, information about a network slice corresponding to the application according to the application identifier; Determining, by the network device, information about a network slice subscribed by the terminal device according to the identifier of the terminal device; And determining, by the network device, whether the network slice corresponding to the application is located in a network slice that is signed by the terminal device, according to the information of the network slice that is subscribed by the terminal device and the information of the network slice corresponding to the application. The method according to claim 3, wherein the verification response further includes information of a network slice corresponding to the application, if the certificate to be verified satisfies the preset condition; The condition includes: the certificate to be verified is a certificate issued by the certificate issuing device, the certificate to be verified is a certificate of a providing device issued to the application, and the network corresponding to the application is cut. The slice is located in a network slice signed by the terminal device. The method according to claim 3 or 4, wherein the information of the network slice corresponding to the application comprises at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, and the network The usage type of the slice, the validity period information of the network slice, and the certificate verification frequency information corresponding to the network slice. The method according to any one of claims 1 to 5, wherein the receiving, by the network device, the verification request from the terminal device comprises: The network device receives the verification request from the terminal device during installation of the application; or The network device receives the verification request from the terminal device during startup of the application. The method according to any one of claims 1-6, wherein the information of the certificate to be verified includes at least one of the following: a public key of the certificate to be verified, and a certificate to be verified The signature algorithm, the hash algorithm of the certificate to be verified, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the issuance of the certificate The ID of the object that verifies the certificate. An application processing method, comprising: The terminal device sends a verification request to the network device, where the verification request includes information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; and the information of the certificate to be verified is used for the school to be verified Verification of the verification certificate; The terminal device receives a verification response from the network device, and the verification response includes a verification result of the to-be-verified certificate. The method according to claim 8, wherein the verification request further comprises an application identifier, wherein the application identifier is used to determine whether the certificate to be verified is a certificate issued by the certificate issuing device to the application providing device. . The method according to claim 9, wherein the application identifier is further used for determining information of a network slice corresponding to the application; The verification request further includes an identifier of the terminal device; the identifier of the terminal device is used for determining a network slice subscribed by the terminal device. The method according to claim 10, wherein if the certificate to be verified is satisfied And the preset condition, the verification response further includes information about the network slice corresponding to the application, where the preset condition includes: the certificate to be verified is a certificate issued by the certificate issuing device, and the The certificate to be verified is a certificate of the providing device that is issued to the application, and the certificate to be verified is a network slice corresponding to the application, and is located in a network slice signed by the terminal device; The method further includes: The terminal device stores information of a network slice corresponding to the application. The method according to claim 10 or 11, wherein the information of the network slice corresponding to the application comprises at least one of the following: an identifier of the network slice, a service type corresponding to the network slice, and using the The type of the terminal device of the network slice, the validity period information of the network slice, and the certificate verification frequency information corresponding to the network slice. The method according to any one of claims 8 to 12, wherein the sending, by the terminal device, the verification request to the network device comprises: The terminal device sends the verification request to the network device during installation of the application; or The terminal device sends the verification request to the network device during startup of the application. The method according to any one of claims 8 to 13, wherein the information of the certificate to be verified includes at least one of the following: a public key of the certificate to be verified, and a certificate to be verified The signature algorithm, the hash algorithm of the certificate to be verified, the fingerprint algorithm of the certificate to be verified, the validity period of the certificate to be verified, the issuer identifier of the certificate to be verified, and the issuance of the certificate The ID of the object that verifies the certificate. An application processing method, comprising: The terminal device searches for information about the root certificate corresponding to the to-be-verified certificate from the preset root certificate area according to the information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; The terminal device determines, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device, to obtain a verification result of the certificate to be verified. The method according to claim 15, wherein the terminal device searches for the root certificate corresponding to the certificate to be verified from the preset root certificate area according to the information of the certificate to be verified, and the method further include: Receiving, by the terminal device, an installation package of the application from a providing device of the application; the installing The package includes: an installation file of the application, information of the certificate to be verified, and information of a network slice corresponding to the application. The method according to claim 16, wherein if the certificate to be verified is a certificate issued by the certificate issuing device, the method further comprises: The terminal device stores information of a network slice corresponding to the application. A network device, comprising: a receiver, a processor, and a transmitter; wherein the receiver is connected to the processor, and the processor is further connected to the transmitter; The receiver is configured to receive a verification request from a terminal device, where the verification request includes information of a certificate to be verified; and the certificate to be verified is a certificate of a providing device from an application; The processor is configured to determine a root certificate according to the information of the to-be-verified certificate, and determine whether the information of the to-be-verified certificate meets a preset condition, to obtain a verification result of the to-be-verified certificate; The transmitter is configured to send a verification response to the terminal device, where the verification response includes a verification result of the to-be-verified certificate; The processor is specifically configured to determine, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by a certificate issuing device. The network device according to claim 18, wherein the verification request further comprises an application identifier; The processor is further configured to determine, according to the application identifier and the information of the certificate to be verified, whether the certificate to be verified is a certificate of a providing device that is issued to the application. The network device according to claim 19, wherein the verification request further comprises an identifier of the terminal device; The processor is further configured to determine, according to the application identifier, information about a network slice corresponding to the application; determine, according to the identifier of the terminal device, information about a network slice subscribed by the terminal device; and sign the contract according to the terminal device The information of the network slice and the information of the network slice corresponding to the application determine whether the network slice corresponding to the application is located in the network slice signed by the terminal device. The network device according to claim 20, wherein the verification response further includes information of a network slice corresponding to the application, if the certificate to be verified satisfies the preset condition; The preset condition includes: the certificate to be verified is a certificate issued by the certificate issuing device, the certificate to be verified is a certificate of a providing device issued to the application, and a network slice corresponding to the application is located in the The terminal device is contracted within the network slice. A network device according to any one of claims 18-21, wherein The receiver is specifically configured to receive the verification request from the terminal device during an installation process of the application or a startup process of the application. A terminal device, comprising: a transmitter and a receiver; The sender is configured to send a verification request to the network device, where the verification request includes information of the certificate to be verified; the certificate to be verified is a certificate of the providing device from the application; and the certificate to be verified The information is used for verification of the certificate to be verified; The receiver is configured to receive a verification response from the network device, where the verification response includes a verification result of the to-be-verified certificate. The terminal device according to claim 23, wherein the verification request further comprises an application identifier, wherein the application identifier is used to determine whether the certificate to be verified is issued to the application providing device by a certificate issuing device. certificate. The terminal device according to claim 24, wherein the application identifier is further used for determining information of a network slice corresponding to the application; The verification request further includes an identifier of the terminal device; the identifier of the terminal device is used for determining a network slice subscribed by the terminal device. The terminal device according to claim 25, wherein, if the certificate to be verified satisfies a preset condition, the verification response further includes information of a network slice corresponding to the application; wherein the preset The condition includes: the certificate to be verified is a certificate issued by the certificate issuing device, the certificate to be verified is a certificate of a providing device issued to the application, and the certificate to be verified is corresponding to the application. The network slice is located in a network slice signed by the terminal device; The terminal device further includes: a processor and a memory; the processor is connected to the memory, and the processor is further connected to the receiver; The processor is configured to store information about a network slice corresponding to the application into the memory. A terminal device according to any one of claims 23 to 26, characterized in that The transmitter is specifically configured to send the verification request to the network device during installation of the application or during startup of the application. A terminal device, comprising: a processor; The processor is configured to search for information about a root certificate corresponding to the to-be-verified certificate from a preset root certificate area according to the information of the certificate to be verified; the certificate to be verified is a providing device from an application. And determining, according to the information about the root certificate and the certificate to be verified, whether the certificate to be verified is a certificate issued by the certificate issuing device, to obtain a verification result of the certificate to be verified. The terminal device according to claim 28, wherein the terminal device further comprises: a receiver; the receiver is connected to the processor; The receiver is configured to receive an installation package of the application from a providing device of the application; the installation package includes: an installation file of the application, information of the certificate to be verified, and a network corresponding to the application Sliced information. The terminal device according to claim 29, wherein the terminal device further comprises: a memory; the memory is connected to the processor; The processor is further configured to: if the certificate to be verified is a certificate issued by the certificate issuing device, store information of a network slice corresponding to the application into the memory.

Images