CN114731289A - A user identification verification method and related equipment - Google Patents

Abstract

Translated fromChinese

本申请实施例提供了一种用户标识的验证方法及相关设备，用于通信技术领域。该方法包括：第一网元从应用功能网元接收用户标识；所述第一网元根据所述用户标识从第二网元获取第一凭证，所述第一凭证用于验证所述用户账户；所述第一网元获取所述一个或多个终端设备的标识，所述终端设备的标识用于确定目标终端；所述第一网元从所述目标终端接收第二凭证，所述第二凭证为所述目标终端接收的身份验证凭证；所述第一网元根据所述第一凭证和所述第二凭证进行用户验证；第三方应用程序可以根据核心网提供的验证结果来确定用户登录，避免未经验证就可以利用用户标识登录第三方应用程序，保证了用户账户的安全。

The embodiments of the present application provide a user identification verification method and related equipment, which are used in the technical field of communications. The method includes: a first network element receives a user identification from an application function network element; the first network element obtains a first credential from a second network element according to the user identification, where the first credential is used to verify the user account ; the first network element obtains the identifiers of the one or more terminal devices, and the identifiers of the terminal devices are used to determine the target terminal; the first network element receives the second credential from the target terminal, the first The second credential is the identity verification credential received by the target terminal; the first network element performs user authentication according to the first credential and the second credential; the third-party application can determine the user according to the verification result provided by the core network Log in, avoid unauthenticated use of user IDs to log in to third-party applications, and ensure the security of user accounts.

Description

Translated fromChinese

PCT国内申请，说明书已公开。PCT domestic application, the description has been published.

Claims (24)

1. A method for verifying a user identifier, the method comprising:

   the method comprises the steps that a first network element receives a user identification from an application function network element, wherein the user identification is used for indicating a user account, and the user account is associated with identifications of one or more terminal devices;

   the first network element acquires a first certificate from a second network element according to the user identification, wherein the first certificate is used for verifying the user account;

   the first network element acquires the identifiers of the one or more terminal devices, wherein the identifiers of the terminal devices are used for determining a target terminal;

   the first network element receives a second certificate from the target terminal, wherein the second certificate is an authentication certificate received by the target terminal;

   and the first network element performs user authentication according to the first certificate and the second certificate.
2. The method of claim 1, wherein the first network element performs user authentication according to the first credential and the second credential, comprising:

   if the first credential is the same as the second credential, the first network element sends a first indication to the application function network element, where the first indication is used to indicate that user authentication is successful;

   and if the first certificate is different from the second certificate, the first network element sends a second indication to the application function network element, wherein the second indication is used for indicating that the user authentication fails.
3. The method according to any of claims 1 to 2, wherein the obtaining, by the first network element, the identity of the one or more terminal devices comprises:

   the first network element receives the terminal identification from the application function network element; or,

   and the first network element acquires the identifiers of the one or more terminal devices corresponding to the user identifier from the third network element, wherein the mapping relationship between the user identifier and the identifiers of the one or more terminal devices is stored in the third network element.
4. The method according to any one of claims 1 to 3, further comprising:

   and the first network element sends an evaluation report to the application function network element, wherein the evaluation report is used for indicating the credibility of the verification result, and the credibility is related to the verification mode of the user verification.
5. The method of any of claims 1 to 3, further comprising:

   the first network element sends an evaluation request to a fourth network element, wherein the evaluation request is used for indicating the fourth functional network element to generate an evaluation report, the evaluation report is used for indicating the credibility of a verification result, and the credibility is related to a verification mode of the user verification;

   and the first network element sends the evaluation report to the application function network element.
6. The method according to any one of claims 1 to 5, wherein before the first network element obtains the first credential corresponding to the subscriber identity from the second network element according to the subscriber identity, the method further comprises:

   the first network element acquires the verification level sent by the application program network element;

   the first network element determines a verification strategy according to the verification grade;

   the first network element determines the type of the first certificate according to the verification strategy;

   the first network element performs user authentication according to the first credential and the second credential, including:

   and the first network element verifies the first certificate and the second certificate according to the verification strategy.
7. A method of verifying a user identity, the method comprising:

   an application function network element sends a user identifier to a first network element, wherein the user identifier is used for indicating the first network element to carry out identity verification on a user account corresponding to the user identifier, and the user account is associated with identifiers of one or more terminal devices;

   the application function network element receives a verification result sent by the first network element;

   and the application function network element provides service according to the verification result.
8. The method of claim 7, wherein before the application function network element receives the verification result sent by the first network element, the method further comprises:

   the application function network element sends the identification of the one or more terminal devices to the first network element;

   the application function network element providing service according to the verification result, comprising:

   and the application function network element provides service for the terminal corresponding to the identifier of the terminal equipment according to the verification result.
9. The method according to any one of claims 7 to 8, further comprising:

   the application function network element receives an evaluation report sent by the first network element; the evaluation report is used for indicating the credibility of the verification result, and the credibility is related to the verification mode of the user verification;

   the application function network element provides service according to the verification result, and the method comprises the following steps:

   and the application function network element provides service according to the verification result and/or the evaluation report.
10. The method according to any of claims 7 to 9, wherein before the application function network element receives the verification result sent by the first network element, the method further comprises:

    and the application function network element sends a verification grade to the first network element, wherein the verification grade is used for indicating the first network element to determine a verification strategy according to the verification grade.
11. A network element device, wherein the network element device comprises:

    a receiving module, configured to receive a user identifier from an application function network element, where the user identifier is used to indicate a user account, and the user account is associated with identifiers of one or more terminal devices;

    an obtaining module, configured to obtain a first credential from a second network element according to the user identifier, where the first credential is used to verify the user account;

    the acquisition module is further configured to acquire identifiers of the one or more terminal devices, where the identifiers of the terminal devices are used to determine a target terminal;

    the receiving module is further configured to receive a second credential from the target terminal, where the second credential is an authentication credential received by the target terminal;

    and the verification module is used for performing user verification according to the first certificate and the second certificate.
12. The network element device of claim 11, wherein the authentication module is specifically configured to send a first indication to the application function network element if the first credential is the same as the second credential, where the first indication is used to indicate that user authentication is successful; and if the first certificate and the second certificate are different, the verification module sends a second instruction to the application function network element, wherein the second instruction is used for indicating that the user verification fails.
13. The network element device according to any one of claims 11 to 12, wherein the obtaining module is specifically configured to receive the terminal identifier from the application function network element; or acquiring the identifiers of the one or more terminal devices corresponding to the user identifier from the third network element, where the third network element stores a mapping relationship between the user identifier and the identifiers of the one or more terminal devices.
14. The network element device according to any of claims 11 to 13, wherein the network element device further comprises a sending module;

    the sending module is configured to send an evaluation report to the application function network element, where the evaluation report is used to indicate a reliability of a verification result, and the reliability is related to a verification manner of the user verification.
15. The network element device according to any of claims 11 to 13, wherein the network element device further comprises a sending module;

    the sending module is configured to send an evaluation request to a fourth network element, where the evaluation request is used to instruct the fourth network element to generate an evaluation report, and the evaluation report is used to instruct a credibility of a verification result, where the credibility is related to a verification manner of the user verification;

    the sending module is further configured to send the evaluation report to the application function network element.
16. The network element device according to any of claims 11 to 15, wherein the network element device further comprises a determining module;

    the obtaining module is further configured to obtain the verification level sent by the application program network element;

    the determining module is specifically configured to determine a verification policy according to the verification level;

    the determining module is further configured to determine a type of the first credential according to the verification policy;

    the verification module is specifically configured to verify the first credential and the second credential according to the verification policy.
17. An application function network element, wherein the application function network element comprises:

    a sending module, configured to send a user identifier to a first network element, where the user identifier is used to instruct the first network element to perform identity authentication on a user account corresponding to the user identifier, and the user account is associated with identifiers of one or more terminal devices;

    a receiving module, configured to receive a verification result sent by the first network element;

    and the processing module is used for providing service according to the verification result.
18. The network element of claim 17, wherein the sending module is further configured to send the identifier of the one or more terminal devices to the first network element;

    and the processing module is specifically configured to provide a service to a terminal corresponding to the identifier of the terminal device according to the verification result.
19. The network element according to any of claims 17 to 18, wherein the receiving module is further configured to receive an evaluation report sent by the first network element; the evaluation report is used for indicating the credibility of the verification result, and the credibility is related to the verification mode of the user verification;

    the processing module provides service according to the verification result and/or the evaluation report.
20. The network element of any of claims 17 to 19, wherein the sending module is further configured to send an authentication level to the first network element, and the authentication level is used to instruct the first network element to determine an authentication policy according to the authentication level.
21. A network element device, comprising: at least one processor, a memory, the memory storing computer-executable instructions executable on the processor, the processor performing a method according to any one of the possible implementations of the above claims 1 to 6 when the computer-executable instructions are executed by the processor.
22. An application function network element comprising: at least one processor, a memory, the memory storing computer-executable instructions executable on the processor, the processor performing a method according to any one of the possible implementations of claims 7 to 10 when the computer-executable instructions are executed by the processor.
23. A system for authenticating a user identifier, comprising: a network element device according to any one of claims 11 to 16 and an application function network element according to any one of claims 17 to 20.
24. A computer-readable storage medium storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor performs the method of any one of claims 1 to 10.

Images