CN110061833B

CN110061833B - Binding update method and device for identity position

Info

Publication number: CN110061833B
Application number: CN201810055629.4A
Authority: CN
Inventors: 王东晖; 李鸿培; 刘冰洋
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2018-01-19
Filing date: 2018-01-19
Publication date: 2020-09-04
Anticipated expiration: 2038-01-19
Also published as: CN110061833A

Abstract

In the method, GRIDS generates challenge message, which includes challenge content; the GRIDS sends the challenge message to a communication device; the communication equipment receives a challenge message sent by a GRIDS, and sends a challenge response message to the GRIDS, wherein the challenge response message comprises the challenge content, a challenge result and the identity position mapping relation updated by the communication equipment. The GRIDS receives a challenge response message sent by the communication equipment, verifies the validity of the challenge response message based on the challenge content and the challenge result, and stores the updated identity position mapping relation of the communication equipment if the challenge response message is valid so as to improve the safety of realizing the binding update process based on a subscription and publishing mode.

Description

Binding update method and device for identity position

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method and an apparatus for binding and updating an identity location.

Background

An identity-oriented networking (ION) is a new network architecture facing future networks.

In the ION network architecture, a unique Identity (ID) is used to represent the identity of the communication device, and a location (Locator or IP address) is used to represent the network location of the communication device. In an ION network architecture, a change in the location of a communication device will cause a change in the Locator, while the ID remains unchanged. As shown in fig. 1, taking a communication device as a Mobile Node (MN) as an example, when the MN moves from location a to location B, the ID remains unchanged, and is still ID _ JOHN, and the location changes from 2.2.2.2 to 1.1.1.1, that is, the mapping relationship between the ID and the location changes. For subsequent link re-establishment, the MN needs to notify the Correspondent Node (CN) of the updated ID/Locator, which is called binding-update of identity location (BU).

In the ION network architecture, a Mobile IPv6(Mobile IPv6, MIPv6) communication protocol is used as a Mobile communication network protocol based on ID and Locator separation. In MIPv6, the ID is hoa (home address), the Locator is COA (care-of address), and a communication flow between the MN and the CN is defined. In MIPv6, a binding update process of an identity location can be implemented by sending an updated ID/Locator mapping relationship between communication devices, for example, a MN can encrypt the updated ID/Locator mapping relationship and send the encrypted ID/Locator mapping relationship to a Correspondent Node (CN), and the binding update process is executed between a peer and a peer.

In the ION network architecture, a uniform control management layer (grid) is also established for managing related services, and the control management layer is deployed in a distributed manner in the network for uniformly managing information such as the identity and Location of a host, for example, a Mapping/Location Service (map/Location Service) can be provided. Based on the management service that the GRIDS can provide the identity and the position mapping, the binding update can be realized between the nodes by adopting a PUB/SUB (publish/subscribe) mode. For example, in fig. 2, the node UE _ D subscribes to the grid IDs the ID/Locator mapping relationship of the node (e.g., node UE _ S) that needs to communicate with the node UE _ D, and when the location of the node UE _ S changes, the node UE _ S reports the updated location information to the grid ID. The GRIDS publishes the location information of the node UE _ S to all communication devices subscribing to the node UE _ S (e.g., node UE _ D). The binding update process is realized based on the PUB/SUB mode, and compared with the end-to-end binding update process, the operation of the nodes can be reduced, and the calculation and network overhead in the binding update process are reduced. However, when the binding update process is realized based on the PUB/SUB mode, a mode of simply reporting the position is adopted, and a large potential safety hazard can be generated.

Disclosure of Invention

The embodiment of the application provides a binding update method and device of an identity position, so as to improve the security of the binding update process based on a subscription and release mode.

In a first aspect, embodiments of the present application provide a binding update system for identity location, in which the system includes a GRIDS and a communication device, where the GRIDS is configured to generate a challenge message and send the challenge message to the communication device. The communication device is used for receiving the challenge message sent by the GRIDS, determining a challenge response message and sending the challenge response message to the GRIDS, wherein the challenge response message comprises challenge content included in the challenge message, and the challenge response message also comprises a challenge result and an identity position mapping relation updated by the communication device. The GRIDS receives the challenge response message sent by the communication equipment, verifies the validity of the challenge response message based on the challenge content and the challenge result, and stores the updated identity position mapping relation of the communication equipment if the challenge response message is valid.

In the embodiment of the application, the challenge message is sent by the GRIDS, the authentication of the GRIDS on the communication equipment sending the updated identity position mapping relation is realized by the way that the communication equipment feeds back the challenge response message, the DOS/DDOS attack of the communication equipment on the GRIDS can be prevented, and the challenge response message comprises the challenge content and the challenge result, so that the GRIDS does not need to store the session state information, and the replay attack can be avoided. By the method for binding and updating the identity position, the safety of the binding and updating process can be improved.

Wherein, the updated identity position mapping relation can be encrypted or plaintext.

In one possible implementation, the challenge content includes an identity of the communication device, a random number generated by the grid for the communication device, and a message authentication code generated by the grid for the challenge content using the local key. The GRIDS can verify the validity of a message verification code included in the challenge content, and if the message verification code is valid, further determine whether the challenge result is the challenge result of the challenge content.

Further, the challenge content further includes at least one of a timestamp of the challenge content and a difficulty factor of the challenge content. If the challenge content comprises the time stamp of the challenge content, the GRIDS determines whether the challenge result is before the challenge result of the challenge content, and the challenge content can be determined to be in the valid period according to the time stamp of the challenge content. If the challenge content does not include the timestamp of the challenge content, it is not necessary to determine whether the challenge content is within the validity period, and whether the challenge result is the challenge result of the challenge content can be directly determined.

If the challenge content comprises the difficulty coefficient of the challenge content, the GRIDS can determine whether the challenge result is the challenge result of the challenge content by confirming whether the low-k bit of the hash operation result of the challenge result and the random number is 0, wherein k is the difficulty coefficient. If the challenge content does not include the difficulty coefficient of the challenge content, the GRIDS can determine whether the challenge result is the challenge result of the challenge content by confirming whether the hash operation result of the challenge result and the random number is 0.

In another possible implementation, the communication device sends an identity-location binding update request to the GRIDS, which receives the identity-location binding update request sent by the communication device. The identity location binding update request comprises a sequence number, and the sequence number is used for identifying an identity location binding update request message sent by the communication equipment. The challenge message sent by the GRIDS to the communication device also includes a sequence number. Before the communication device sends the challenge response message to the GRIDS, whether the serial number included in the challenge message is consistent with the serial number included in the identity location binding update request sent by the communication device is determined, and under the condition that the serial number included in the challenge message is determined to be consistent with the serial number included in the identity location binding update request sent by the communication device, the calculation of the challenge result and the sending of the challenge response message are carried out, so that the received challenge message is ensured to be the challenge message sent by the communication device, and a malicious attacker is prevented from counterfeiting the GRIDS to cause a counterfeiting attack on the communication device.

In yet another possible implementation, after the GRIDS receives the challenge response message sent by the communication device, it may generate a key for verifying the identity-location binding update message sent by the communication device subsequently and store the generated key and the validity period of the key. The GRIDS sends a key message to the communication device, the key message including the key and a validity period for the key. The communication device receives the key message sent by the GRIDS and stores the key included in the key message and the validity period of the key, so that when the communication device subsequently sends the updated identity position mapping relation to the GRIDS, whether the key is in the validity period can be determined, and if the key is in the validity period, the identity position binding update message can be directly sent without performing security verification in a challenge-response mode.

In particular, the GRIDS may utilize the public key of the communication device to encrypt the key message and send the encrypted key message to the communication device to further improve security.

Further, after the communication device saves the key and the validity period of the key, if it is determined that an updated identity location mapping relationship needs to be sent to the GRIDS, the communication device determines whether the key is within the validity period, and if so, generates a message authentication code by using the key. The communication equipment sends an identity location binding update message to the GRIDS, wherein the identity location binding update message comprises the message authentication code and the subsequently updated identity location mapping relation of the communication equipment. The GRIDS receives the identity position binding update message sent by the communication equipment, verifies the message authentication code by using the stored secret key, and stores the subsequently updated identity position mapping relation of the communication equipment if the verification is passed.

Furthermore, the GRIDS sends the key message to the communication device, the signature of the GRIDS can be included in the key message, and the terminal receives the key message sent by the GRIDS, and the signature of the GRIDS can be used for authenticating the key message. The challenge response message sent by the communication device to the GRIDS can also comprise the signature of the communication device, and after the GRIDS receives the challenge response message sent by the communication device, the GRIDS can authenticate the challenge response message by using the signature of the communication device contained in the challenge response message. By the signature authentication mode, the communication device and the GRIDS can realize mutual authentication.

Further, the challenge response message further includes a public key certificate of the communication device, and the key message further includes a public key certificate of the GRIDS. After the GRIDS receives the challenge response message, the GRIDS can verify the public key certificate of the communication equipment in the challenge response message, acquire the public key of the communication equipment and realize the authentication of the signature of the communication equipment by using the public key of the communication equipment. After the communication equipment receives the key message, the public key certificate of the GRIDS included in the key message can be verified, the public key of the GRIDS is obtained, and the signature of the GRIDS is authenticated by using the public key of the GRIDS.

Furthermore, the challenge response message also includes session key negotiation parameters of the communication device, and the key message also includes session key negotiation parameters of the GRIDS. The communication device sends the session key negotiation parameters to the GRIDS through the challenge response message, so that the GRIDS can generate keys based on the session key negotiation parameters of the communication device and the session key negotiation parameters of the GRIDS. The GRIDS sends the session key negotiation parameters used for generating the key to the communication equipment through the key message, so that the communication equipment can generate the key based on the session key negotiation parameters of the communication equipment and the session key negotiation parameters of the GRIDS.

In a second aspect, the embodiments of the present application provide a binding update method for an identity location, which can be applied to a GRIDS, and certainly also to a chip in the GRIDS. As applied to a GRIDS, in this approach, the GRIDS generates and sends a challenge message to the communication device, the challenge message including challenge content. The GRIDS receives a challenge response message sent by the communication equipment, wherein the challenge response message comprises the challenge content, a challenge result and an identity position mapping relation updated by the communication equipment, the identity is an identity of the communication equipment, and the position is a network address of the communication equipment. And the GRIDS verifies the validity of the challenge response message based on the challenge content and the challenge result, and if the challenge response message is valid, the updated identity position mapping relation of the communication equipment is stored.

The identity and position mapping relation involved in the embodiment of the application is encrypted or plaintext.

In one possible design, the challenge content includes an identity of the communication device, a random number generated by the GRIDS for the communication device, and a message authentication code generated by the GRIDS for the challenge content using a local key. And the GRIDS verifies the validity of a message verification code included in the challenge content when verifying the validity of the challenge response message based on the challenge content and the challenge result, and determines whether the challenge result is the challenge result of the challenge content if the message verification code is valid.

In another possible design, the challenge content further includes at least one of a timestamp of the challenge content and a difficulty factor of the challenge content. If the challenge content comprises the time stamp of the challenge content, the GRIDS determines whether the challenge result is in front of the challenge result of the challenge content, and determines that the challenge content is in the valid period according to the time stamp of the challenge content. If the challenge content comprises the difficulty coefficient of the challenge content, the GRIDS confirms whether the low-k bit of the hash operation result of the challenge result and the random number is 0 or not when determining whether the challenge result is the challenge result of the challenge content, and k is the difficulty coefficient.

In yet another possible design, before the GRIDS generates the challenge message, the GRIDS may further receive an identity and location binding update request sent by the communication device, where the identity and location binding update request includes a serial number, where the serial number is used to identify the identity and location binding update request message sent by the communication device, and the serial number is included in the sent challenge message, so that before the communication device sends the challenge response message to the GRIDS, it is determined whether the serial number included in the challenge message is consistent with the serial number included in the identity and location binding update request sent by the communication device, and in a case that it is determined that the serial number included in the challenge message is consistent with the serial number included in the identity and location binding update request sent by the communication device, the calculation of the challenge result and the sending of the challenge response message are performed again to ensure that the received challenge message is the challenge message sent by the communication, prevent a malicious attacker from counterfeiting the GRIDS to cause a counterfeit attack on the communication device.

In yet another possible design, after the GRIDS receives the challenge-response message sent by the communication device, the GRIDS may generate and store a key and a validity period of the key, where the key is used to verify an identity-location binding update message subsequently sent by the communication device, and the GRIDS sends a key message to the communication device, where the key message includes the key and the validity period of the key, so that when the communication device subsequently sends an updated identity-location mapping relationship to the GRIDS, it may be determined whether the key is within the validity period, and if so, the identity-location binding update message may be directly sent without performing security verification in a challenge-response manner.

Wherein the key message is a message encrypted by the GRIDS using a public key of the communication device.

Further, after the GRIDS sends the key message to the communication device, the GRIDS may receive an identity location binding update message sent by the communication device, where the identity location binding update message includes a message authentication code and an identity location mapping relationship subsequently updated by the communication device, and the message authentication code is generated by the communication device based on the key. The GRIDS verifies the message authentication code by using the stored secret key, and if the message authentication code passes the verification, the identity position mapping relation subsequently updated by the communication equipment is stored.

Still further, the challenge-response message may also include a signature of the communication device, which is used by the GRIDS to authenticate the challenge-response message. The key message may also include a signature of the GRIDS, which is used by the communication device to authenticate the key message. The challenge response message comprises the signature of the communication equipment, and the key message comprises the signature of the GRIDS, so that the communication equipment and the GRIDS can realize mutual authentication in a signature authentication mode.

Furthermore, the challenge response message further includes a certificate of the communication device, and the key message further includes a certificate of the GRIDS, so that after the GRIDS receives the challenge response message, the GRIDS can verify the public key certificate of the communication device included in the challenge response message, acquire the public key of the communication device, and authenticate the signature of the communication device by using the public key of the communication device. After the communication equipment receives the key message, the public key certificate of the GRIDS included in the key message can be verified, the public key of the GRIDS is obtained, and the signature of the GRIDS is authenticated by using the public key of the GRIDS.

Or, the challenge response message further includes the session key negotiation parameter of the communication device, so that the communication device sends the session key negotiation parameter to the GRIDS through the challenge response message, and the GRIDS can generate a key based on the session key negotiation parameter of the communication device and the session key negotiation parameter of the GRIDS. The key message also comprises session key negotiation parameters of the GRIDS, so that the GRIDS sends the session key negotiation parameters used for generating the key to the communication equipment through the key message, and the communication equipment can generate the key based on the session key negotiation parameters of the communication equipment and the session key negotiation parameters of the GRIDS.

In a third aspect, an embodiment of the present application provides a binding update method for an identity location, where the method is applicable to a communication device and also applicable to a chip in the communication device. When applied to a communication device, in the method, the communication device receives a challenge message sent by a GRIDS, the challenge message including challenge content. The communication device sends a challenge response message to the GRIDS, wherein the challenge response message comprises the challenge content, a challenge result and the updated identity position mapping relation of the communication device.

The embodiment of the application summarizes that the communication device receives the challenge message and sends the challenge response message, so that the GRIDS can authenticate the communication device sending the updated identity position mapping relation, the DOS/DDOS attack of the communication device on the GRIDS can be prevented, and the challenge response message comprises the challenge content and the challenge result, so that the GRIDS does not need to store the session state information, and the replay attack can be avoided. By the method for binding and updating the identity position, the safety of the binding and updating process can be improved.

In one possible design, the challenge content includes an identity of the communication device, a random number generated by the GRIDS for the communication device, and a message authentication code generated by the GRIDS for the challenge content using a local key.

Further, the challenge content further includes at least one of a timestamp of the challenge content and a difficulty factor of the challenge content.

In another possible design, before the communication device receives the challenge message sent by the GRIDS, an identity location binding update request may also be sent to the GRIDS, where the identity location binding update request includes a sequence number, and the sequence number is used to identify the identity location binding update request message sent by the communication device. The challenge message also includes the sequence number. Before the communication device sends the challenge response message to the GRIDS, the serial number included in the challenge message can be determined to be consistent with the serial number included in the identity location binding update request sent by the communication device, and under the condition that the serial number included in the challenge message is determined to be consistent with the serial number included in the identity location binding update request sent by the communication device, the calculation of the challenge result and the sending of the challenge response message are carried out, so that the received challenge message is ensured to be the challenge message sent by the communication device, and a malicious attacker is prevented from counterfeiting the GRIDS to cause a counterfeiting attack on the communication device.

In yet another possible design, after sending the challenge response message to the GRIDS, the communication device may further receive a key message sent by the GRIDS, and store the key and a validity period of the key, so that when the communication device subsequently sends the updated identity and location mapping relationship to the GRIDS, it may determine whether the key is within the validity period, and if so, the identity and location binding update message may be directly sent without performing security verification by means of challenge-response. The key message comprises a key and the validity period of the key, wherein the key is generated by the GRIDS for the communication equipment and is used for verifying the identity position mapping relation subsequently updated by the communication equipment.

Wherein the key message is a message encrypted by the GRIDS using the public key of the communication device.

Further, after the communication device saves the secret key and the validity period of the secret key, when the secret key is determined to be within the validity period, the message authentication code is generated by using the secret key, and an identity location binding update message is sent to the GRIDS, wherein the identity location binding update message comprises the message authentication code and the subsequently updated identity location mapping relation of the communication device, so that the GRIDS verifies the message authentication code by using the saved secret key, and if the verification is passed, the subsequently updated identity location mapping relation of the communication device is saved.

Further, the challenge response message also includes a signature of the communication device, and the signature of the communication device is used for the GRIDS to authenticate the challenge response message. The key message also includes a signature of the GRIDS, which is used by the communication device to authenticate the key message. The challenge response message comprises the signature of the communication equipment, and the key message comprises the signature of the GRIDS, so that the communication equipment and the GRIDS can realize mutual authentication in a signature authentication mode.

In a fourth aspect, the present application provides a binding update device for an identity location, where the binding update device may be a GRIDS, or may be a chip inside the GRIDS. The GRIDS or a chip inside the GRIDS has the function of realizing the method for the GRIDS to execute the binding update of the identity location in any one of the possible designs related to the second aspect, and the function can be realized by hardware and can also be realized by hardware to execute corresponding software. The hardware or software includes one or more modules corresponding to the above-described functions. The modules may be software and/or hardware.

Wherein, the GRIDS comprises a sending unit, a receiving unit and a processing unit. The transmitting unit and the receiving unit may be transceivers, which may include therein radio frequency circuitry, and the processing unit may be, for example, a processor. Optionally, the GRIDS further comprises a storage unit, which may be a memory, for example. When the GRIDS comprises a processing unit and a storage unit, the storage unit is used for storing computer-executed instructions, the processing unit is connected with the storage unit, and the processing unit executes the computer-executed instructions stored in the storage unit, so that the GRIDS executes the binding update method of the identity location in the second aspect or any possible design of the second aspect.

The chip comprises a sending unit, a receiving unit and a processing unit. The sending unit and the receiving unit may be input/output interfaces, pins or circuits etc. on the chip. The processing unit may be, for example, a processor. Optionally, the chip further comprises a storage unit, which may be a memory, for example. The processing unit may execute the computer executable instructions stored by the storage unit to cause the chip to perform the binding update method for the identity location in the second aspect or any possible design of the second aspect.

Alternatively, the storage unit may be a storage unit (e.g., a register, a cache, etc.) within the chip, a storage unit (e.g., a read-only memory) external to the chip within the GRIDS, or other types of static storage devices (e.g., a random access memory) that may store static information and instructions, etc.

In a fifth aspect, an embodiment of the present application provides an identity location binding update apparatus, where the binding update apparatus may be a communication device, or may also be a chip inside the communication device, and the communication device or the chip inside the communication device has a function of implementing the identity location binding update method executed by the communication device in any one of the possible designs related to the third aspect or the third aspect, where the function may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described functions. The modules may be software and/or hardware.

The communication device comprises a receiving unit and a processing unit. Optionally, the communication device may further comprise a transmitting unit, or may also comprise a storage unit. The transmitting unit and the receiving unit may be transceivers, which may include radio frequency circuits therein, and the processing unit may be a processor, for example. The storage unit may be a memory, for example. When the communication device comprises a processing unit and a storage unit, the storage unit is used for storing computer-executable instructions, the processing unit is connected with the storage unit, and the processing unit executes the computer-executable instructions stored in the storage unit, so that the communication device executes the binding update method of the identity location in the third aspect or any possible design of the third aspect.

Wherein the chip comprises a receiving unit and a processing unit. Optionally, the communication device may further comprise a transmitting unit, or may also comprise a storage unit. The sending unit and the receiving unit may be input/output interfaces, pins or circuits etc. on the chip. The processing unit may be, for example, a processor. The storage unit may be a memory, for example. The processing unit may execute the computer executable instructions stored by the storage unit to cause the chip to perform the binding update method for the identity location in the second aspect or any possible design of the second aspect.

Alternatively, the storage unit may be a storage unit (e.g., a register, a cache, etc.) inside the chip, and the storage unit may also be a storage unit (e.g., a read-only memory) outside the chip inside the communication device or other types of static storage devices (e.g., a random access memory) that may store static information and instructions, and the like.

According to the method and the device for binding and updating the identity location, the GRIDS sends the challenge message, and the communication equipment feeds back the challenge response message to perform binding and updating of the identity location, so that the safety of the binding and updating process can be improved. In addition, the challenge response message in the embodiment of the application includes the challenge content and the challenge result of the challenge content, so that the GRIDS does not need to store the session state information, and therefore replay attack can be avoided.

Drawings

FIG. 1 is a diagram illustrating a binding update procedure between communication devices via a binding update message;

FIG. 2 is a diagram illustrating a process for implementing a binding update between communication devices based on a subscription-publishing scheme;

FIG. 3 is a diagram of a system architecture for use with an embodiment of the present application;

fig. 4 is a flowchart of an implementation of a binding update method for an identity location according to an embodiment of the present application;

fig. 5 is a flowchart of an implementation of another method for binding update of an identity location according to an embodiment of the present application;

fig. 6 is a flowchart of an implementation of a binding update method for an identity location according to an embodiment of the present application;

fig. 7 is a flowchart of an implementation of a binding update method for an identity location according to an embodiment of the present application;

fig. 8 is a flowchart of an implementation of a binding update method for an identity location according to an embodiment of the present application;

fig. 9 is a flowchart of an implementation of a binding update method for an identity location according to an embodiment of the present application;

fig. 10 is a schematic structural diagram of a binding update apparatus for an identity location according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of a binding update apparatus for an identity location according to an embodiment of the present application;

fig. 12 is a schematic structural diagram of another binding update apparatus for identity location according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

The embodiment of the application provides a binding update method and a binding update device for an identity location, and the method can be applied to the ION network architecture shown in fig. 3. Referring to fig. 3, the lon network architecture includes communication devices (also referred to as communication nodes or node devices) and an lon uniform control management layer (GRIDS). The communication devices may be understood as a data plane of an ION network architecture, and end-to-end communication may be performed between the communication devices in the ION network architecture, for example, end-to-end communication may be performed between the communication devices in fig. 1 through a Radio Access Network (RAN), a User Plane Function (UPF), and the Internet (Internet). Each communication device on the data plane supports a protocol for separating an identity from a location when performing end-to-end communication, that is, a protocol stack includes a physical layer (PHY layer), a link layer (linklayer), an IP layer (IP layer or locator), an identity layer (ID layer), a Transport layer (Transport), and an application layer (App). The grid is distributed and deployed in the ION network architecture, and is used for performing unified management on information such as an Identity Service, an Identity/Location Service (Mapping/Location Service), an Identity relationship management Service (Grouping Service), and a Metadata management Service (Metadata Service), for example. The communication device with the changed identity position mapping relation sends an identity position binding updating request to a software communication module of the GRIDS, the GRIDS provides the report of the identity position mapping relation for the software communication module of the GRIDS, and the GRIDS sends the updated identity position mapping relation to other communication devices subscribing the identity position mapping relation of the communication device to complete the binding updating process.

At present, when a communication device with a changed identity location mapping relationship reports the identity location mapping relationship to a grid device identification, a simple location reporting may have a large potential safety hazard, for example: in the process of updating the identity location mapping relationship by reporting identity location information by the communication equipment, if the GRIDS maintains the session state, malicious communication equipment can cause Denial of Service (DOS)/Distributed Denial of Service (DDOS) attacks if a large number of communication connections are initiated. For another example, if a malicious communication device counterfeits the identity location information reported by other communication devices and reports location information that does not belong to its own ID, a counterfeit attack may be caused. For another example, a malicious communication device uses the legal signature information of other communication devices to repeatedly send identity location information to the GRIDS, which consumes a lot of network resources and computing resources of the GRIDS, resulting in replay attack.

In view of this, the embodiments of the present application provide a method for binding and updating an identity location, in which a challenge-response authentication manner is used to implement authentication of a communication device by a GRIDS. The challenge-response authentication method may be understood as a calculation process, and specifically, may be understood as a calculation request initiated by the GRIDS, where the calculation request includes the calculated content, the communication device receives the calculation request, performs calculation (for example, calculation in an exhaustive manner) according to the calculation content included in the calculation request, obtains a calculation result, sends the calculation result to the GRIDS, and the GRIDS receives the calculation result and verifies whether the calculation result is correct. The calculation request may be understood as a challenge message, the calculation content may be understood as challenge content, and the calculation result may be understood as a challenge response message.

When the GRIDS authenticates the communication equipment by applying a challenge-response authentication mode in the embodiment of the application, the communication equipment sends an identity location binding update request to the GRIDS, and the GRIDS receives the identity location update request sent by the communication equipment, generates a challenge message and sends a challenge to the communication equipment. The communication device receives the challenge message sent by the GRIDS, determines a challenge response message and sends the challenge response message to the GRIDS, wherein the challenge response message comprises challenge content and a challenge result which are contained in the challenge message and an updated identity position mapping relation of the communication device. The GRIDS receives the challenge response message sent by the communication equipment, verifies the validity of the challenge response message based on the challenge content and the challenge result, and stores the updated identity position mapping relation of the communication equipment if the challenge response message is valid. In the embodiment of the application, the challenge message is sent by the GRIDS, the communication device feeds back the challenge response message, the authentication of the GRIDS to the communication device is realized, the DOS/DDOS attack of the communication device to the GRIDS can be prevented, and the challenge response message comprises the challenge content and the challenge result of the challenge content, so that the GRIDS does not need to store session state information, and the replay attack can be avoided. By the method for binding and updating the identity position, the safety of the binding and updating process can be improved.

It is to be understood that the communication Device related in this embodiment of the present application needs to support a protocol of identity and location separation, for example, the communication Device may be a terminal supporting the identity and location separation protocol, where the terminal is also referred to as a User Equipment (UE), a Mobile Station (MS), a Mobile Terminal (MT), and the like, and may include a Mobile phone, a tablet computer, a notebook computer, a Mobile Internet Device (MID), a wearable Device (e.g., a smart watch, a smart bracelet, a pedometer, and the like), and may further include other communication devices supporting the identity and location separation protocol. The communication device in the embodiment of the present application may also be a gateway (gateway) or other network device that supports the identity and location separation protocol.

For convenience of description in the embodiments of the present application, a communication device is taken as an example for explanation.

Fig. 4 is a flowchart illustrating an implementation of a binding update method for an identity location according to an embodiment of the present application, referring to fig. 4, where the method includes:

s101: the UE sends an identity location binding update request to the GRIDS.

In the embodiment of the application, if the location of the UE changes, the UE can send an identity location binding update request message to the GRIDS so as to report the identity location binding update to the GRIDS. In this embodiment of the present application, for descriptive purposes, the identity and location binding update request message may be denoted by U1, and the parameters carried in U1 include a message type (message _ type) and a sequence number (seq _ number), where the message _ type is an identity and location binding update request type (update _ request _ type) used for identifying an identity and location binding update request sent by the UE to the grid. The seq _ number is a sequence number of the identity location binding update request message currently reported by the UE, and can be specified by the UE, and is used for identifying the identity location binding update request message sent by the UE.

S102: the GRIDS generates a challenge message.

Specifically, in the embodiment of the present application, the GRIDS may generate the challenge message after receiving the identity location binding update request sent by the UE. Wherein, the challenge message includes challenge content (challenge), and the GRIDS may construct challenge content for the UE, and the challenge content is used for the UE to calculate a corresponding challenge result (solution).

In one possible implementation, the GRIDS may construct a challenge for each UE that sends an identity-location binding update request. The challenge content constructed by the grid IDs may include an Identity (ID) of the UE, a random number (random) generated by the grid IDs for the UE, and a message authentication code generated by the grid IDs for the challenge content using the local key. The ID of the UE is used for identifying the UE to which the challenge content aims, random is a random number parameter used when a challenge result corresponding to the challenge content is calculated, and a message verification code generated by the GRIDS by using a local key for the challenge content can be used for realizing authentication of the challenge content in a challenge response message, so that the UE is prevented from counterfeiting the challenge content.

Further, the challenge content constructed by the grid ids in the embodiment of the present application may further include at least one of a timestamp (timestamp) of the challenge content and a difficulty coefficient (k) of the challenge content. Wherein, the validity period of the challenge content can be identified through timestamp. By using the difficulty coefficient for setting the calculation difficulty of the challenge result, for example, different difficulty coefficients k may be set for different UEs.

Further, before the GRIDS generates the challenge message in the embodiment of the present application, the identity of the UE may be authenticated, if the authentication passes, the challenge message may be generated, and if the authentication fails, the received identity location binding update request message may be discarded.

Specifically, in this embodiment of the present application, the grid IDs may authenticate the identity of the UE by verifying whether an Identity (ID) of the UE is in a preset blacklist.

S103: the GRIDS sends a challenge message to the UE, including challenge content in the challenge message.

Specifically, the challenge message may be denoted by G1 for descriptive convenience in the embodiments of the present application. The parameters carried in G1 may include a message type (message _ type) and challenge content (challenge). Wherein, the message _ type carried in G1 identifies the message as a challenge message, and challenge is the challenge content constructed by the GRIDS for the UE.

Further, a sequence number (seq _ number) may also be included in G1, and the seq _ number is the sequence number carried in U1, so as to prevent a malicious attacker from counterfeiting the GRIDS to cause a bypass attack on the UE.

S104: the UE receives the challenge message sent by the GRIDS, calculates the challenge result (solution) of the challenge content, and sends a challenge response message to the GRIDS.

In the embodiment of the application, the solution corresponding to challenge can be generated through exhaustive calculation, and the solution is sent to the GRIDS through a challenge response message.

In the embodiment of the application, the challenge response message sent by the UE to the GRIDS also comprises challenge, and the challenge and the solution are sent to the GRIDS together, so that the GRIDS does not need to store the session state information of the challenge, and the replay attack of a malicious attacker can be avoided.

Further, in the embodiment of the present application, the UE further sends the updated identity location mapping relationship to the GRIDS together with challenge and solution, so as to send the updated identity location mapping relationship (ID/Locator mapping information) to the GRIDS in a challenge-response manner, thereby implementing the binding update of the identity location and improving the security of the identity location binding update process to a certain extent.

Specifically, for convenience of description in this embodiment of the present application, the challenge response message may be denoted by U2, and the parameters carried in U2 include message _ type, challenge, solution, and ID/Locator mapping information. Wherein, the message _ type carried in U2 is challenge _ response, and is used to identify the challenge response message. challenge is carried out in G1 message, solution is challenge result corresponding to challenge, and ID/Locator mapping information identifies binding update content of identity position.

Further, in this embodiment of the present application, the UE may determine whether the seq _ number included in G1 is consistent with the seq _ number carried in U1, and in a case that it is determined that the seq _ number included in G1 is consistent with the seq _ number carried in U1, perform the calculation of the challenge result and the sending of the challenge response information again to ensure that the received challenge message is the challenge message sent for the UE, so as to prevent a malicious attacker from impersonating the grid to attack the UE.

S105: the GRIDS receives the challenge response message sent by the UE, verifies the validity of the challenge response message based on challenge and solution included in the challenge response message, and stores the identity position mapping relation updated by the UE if the challenge response message is valid. If the challenge response message is invalid, the identity position mapping relation updated by the UE is not stored, and the safety of the identity position binding updating process is improved.

In the embodiment of the application, if the challenge includes the ID of the UE, the grid IDs is a random number generated by the UE, and the grid IDs uses the local key to generate the message authentication code for the challenge, the grid IDs may authenticate the message authentication code included in the challenge, and authenticate whether the challenge is the challenge sent by the grid IDs, thereby determining whether the solution in the received challenge response message is the solution corresponding to the challenge. If the message authentication code included in the challenge is validated by the GRIDS, it may be determined that the solution in the received challenge response message is the solution corresponding to the challenge.

Further, in this embodiment of the application, if the challenge includes a timestamp, it is determined whether the challenge included in the challenge response message is within the validity period according to the timestamp, and if the challenge is within the validity period, it may be further determined whether the solution in the received challenge response message is the solution corresponding to the challenge. If the challenge does not include the timestamp, it may be determined whether the solution in the received challenge-response message is the solution corresponding to the challenge without determining whether the challenge is within the validity period.

Furthermore, in this embodiment of the present application, if the challenge includes the difficulty coefficient k, the GRIDS may perform a hash operation on the random and solution generated by the GRIDS for the UE, and if the low k bit of the hash operation result is 0, it may be determined that the solution in the received challenge response message is the solution corresponding to the challenge. If challenge does not include difficulty coefficient k, GRIDS can utilize GRIDS to perform hash operation on random and solution generated by UE, and GRIDS can determine that the solution in the received challenge response message is the solution corresponding to challenge by determining whether the hash operation result is 0. If the hash operation result is 0, it can be determined that the solution in the received challenge response message is the solution corresponding to challenge. If the hash operation result is not 0, it is determined that the solution in the received challenge response message is not the solution corresponding to challenge.

In the embodiment of the present application, by the above method for verifying validity of solution, it may be determined that the challenge included in the challenge response message is the challenge sent by the GRIDS, and it is determined that the solution included in the challenge response message is the solution corresponding to the challenge, and under the condition that the challenge is the challenge sent by the GRIDS and the solution is valid, the identity location mapping relationship updated by the UE is saved, so that security of the binding update process may be improved.

Furthermore, the GRIDS in the embodiment of the application can verify the signature of the UE, and the updated identity location mapping relation of the UE is stored under the condition that the signature passes the verification, so that the security of the binding update process is further improved.

In the embodiment of the application, the challenge message is sent through the GRIDS, and the binding update of the identity position is carried out in a mode that the UE feeds back the challenge response message, so that the security of the binding update process can be improved. In addition, the challenge response message in the embodiment of the application includes the challenge content and the challenge result of the challenge content, so that the GRIDS does not need to store the session state information, and therefore replay attack can be avoided.

In a possible implementation manner of the present application, after the GRIDS stores the updated identity location mapping relationship reported by the UE through the challenge-response manner, the GRIDS may generate and store a key (token) and a validity period (timer) of the key, where the token and the timer are used for verifying the subsequently updated identity location mapping relationship of the UE. The GRIDS sends the token and the timer to the UE, and the UE receives and stores the token and the timer sent by the GRIDS. If the UE sends the subsequently updated identity location mapping relation to the GRIDS, whether the token is in the validity period or not can be determined, and if the token is in the validity period, the subsequently updated identity location binding update message can be directly sent without performing security verification in the challenge-response mode.

Therefore, the embodiment of the present application may further include the following steps based on the method shown in fig. 4, as shown in fig. 5:

s106: the GRIDS generates and stores the token and the timer.

Specifically, the GRIDS may control the token and the timer to be generated and saved for some UEs, for example, the GRIDS may generate and save the token and the timer for some UEs with higher credibility.

S107: the GRIDS sends a key message to the UE, wherein the key message comprises token and timer.

Specifically, for convenience of description in the embodiment of the present application, the key message sent by the grid ids to the UE may be described as G2. The parameters carried in G2 include message _ type, token, and timer, where the message _ type included in G2 is used to identify a key message, token is a key generated by the GRIDS for the current UE, and timer is the validity period of the token generated by the GRIDS.

Further, the GRIDS can utilize the private key of the GRIDS to sign the key message and send the signature to the UE.

Further, the GRIDS can encrypt the token and the timer by using the public key of the UE, and send the encrypted token and the encrypted timer to the UE so as to improve the security.

It can be understood that, in the embodiment of the present application, the order of signing the key message and encrypting the key message is not limited.

S108: and the UE receives the key message sent by the GRIDS and stores the token and the timer included in the key message.

Furthermore, if the token and the timer are encrypted by the public key of the UE, the UE may decrypt the token and the timer by using the private key of the UE, and then store the token and the timer obtained by decryption, so that the UE reports the identity location binding subsequent update content to the GRIDS.

When the subsequent UE reports the updated identity location mapping relationship (the subsequently updated identity location mapping relationship) to the GRIDS again, the method implementation flow shown in fig. 6 may be adopted to report the subsequently updated content of the identity location binding update.

Fig. 6 is a flowchart illustrating another implementation of a binding update method for an identity location according to an embodiment of the present application. Referring to fig. 6, the method includes:

s201: the UE determines whether the token is within the validity period.

Specifically, if token is within the validity period, S202 may be executed. If token has expired, the identity location binding update can be performed in a challenge-response manner according to the method flow shown in fig. 4.

S202: and the UE generates a message authentication code for the updated identity position mapping relation by using the token.

S203: and the UE sends an identity location binding update message to the GRIDS, wherein the identity location binding update message comprises a message authentication code generated by using token and identity location binding subsequent update content.

For convenience of description in this embodiment of the present application, the ID-location binding update message may be represented by U3, and the parameters carried in U3 include message _ type, ID/Locator mapping information, and mac (token). The message _ type is an identity location binding update message (update _ type), and the message is identified as a simplified version of binding update report message. And the ID/Locator mapping information is the UE identity position binding subsequent updating content. Mac (token) is a message authentication code generated with a token based on the entire message.

Further, seq _ number may also be included in U3. The seq _ number is a sequence number of the id-location binding update message reported by the UE this time and can be specified by the UE.

S204: the GRIDS receives the identity location binding update message sent by the UE, verifies the message authentication code included in the identity location binding update message by using the saved token, if the verification is passed, the subsequently updated identity location mapping relation reported by the UE is saved, and if the verification is not passed, the identity location binding update message can be discarded.

Specifically, the GRIDS can determine the token used to verify the message authentication code via the ID of the UE.

Furthermore, the grid in this embodiment of the present application may also send a response message to the UE, where the seq _ number included in U3 is included, so that the UE may determine whether the grid has saved the subsequently updated identity location mapping relationship.

S205: the GRIDS sends a response message to the UE, including the seq _ number included in U3.

Specifically, the response message may be represented by G4, and the parameters carried in G4 include message _ type and seq _ number. The message _ type is an acknowledgement message (ACK _ type), and identifies the message as a reply message. seq _ number is a sequence number included in the U3 message, so that the UE determines a saving result of the grid to the subsequently updated identity location mapping relationship corresponding to seq _ number.

Wherein S205 is an optional step.

In the embodiment of the application, the GRIDS generates and stores the token and the timer, and sends the token and the timer to the UE, the UE stores the token and the timer, and when the subsequently updated identity position mapping relation needs to be reported, if the token is in the validity period corresponding to the timer, the identity position binding update message can be directly sent without performing the challenge-response process, so that the interactive flow is simplified.

In yet another possible implementation of the embodiment of the present application, the UE and the GRIDS may authenticate each other to further improve security.

In one possible implementation, the UE and the GRIDS may implement security authentication by verifying the private key signature.

Fig. 7 is a flowchart illustrating an implementation of a process for performing security authentication on a UE and a GRIDS based on signatures and implementing identity and location binding update according to an embodiment of the present application.

The method flow shown in fig. 7 in this embodiment of the application is similar to the implementation method flow shown in fig. 5, and differs only in that the UE needs to send the signature of the UE to the GRID, and the GRID needs to send the signature of the GRID to the UE, and perform security authentication with each other.

Specifically, the UE may send the UE's signature via a challenge response message sent to the GRIDS. The UE sends the signature of the UE to the GRIDS, so that the GRIDS can carry out security authentication on the challenge response message by using the signature of the UE, and the security is further improved. The GRIDS may carry a signature of the GRIDS in a key message sent to the UE. The GRIDS sends the signature of the GRIDS to the UE for the UE to authenticate the GRIDS. Furthermore, the UE can authenticate the key message by using the signature of the GRIDS, if the authentication is passed, the token and the timer can be saved, and if the authentication is not passed, the key message can be discarded, so that the security is further improved.

In a possible implementation manner, in the embodiment of the present application, the UE and the GRIDS may obtain an opposite-end public key based on an asymmetric key scheme of a certificate system, and verify a signature by using the opposite-end public key.

Fig. 8 is a flowchart illustrating an implementation of a process for a UE and a GRIDS to perform security authentication based on a certificate and implement identity and location binding update according to an embodiment of the present application.

The method flow shown in fig. 8 in the embodiment of the present application is similar to the implementation method flow shown in fig. 7, and is different only in that the UE needs to send the UE certificate to the GRID, and the GRID needs to send the UE certificate to the GRID, and perform authentication of the certificates with each other.

Specifically, the UE may send the UE's public key certificate via a challenge response message sent to the GRIDS. After the GRIDS receives the challenge response message, the GRIDS can verify the UE public key certificate included in the challenge response message and acquire the UE public key. The GRIDS may carry the public key certificate of the GRIDS in a key message sent to the UE. After receiving the key message, the UE can verify the public key certificate of the GRIDS included in the key message and acquire the public key of the GRIDS.

In one possible implementation manner, in this embodiment of the present application, the UE may send Diffie-Hellman (DH) session key negotiation parameters to the GRIDS, so that the GRIDS may generate a token based on the DH session key negotiation parameters of the UE and the DH session key negotiation parameters of the GRIDS. The GRIDS sends the DH session key negotiation parameters of the GRIDS for generating the token to the UE, so that the UE can generate the token based on the DH session key negotiation parameters of the UE and the DH session key negotiation parameters of the GRIDS.

Fig. 9 is a flowchart illustrating an implementation of generating a token and implementing an identity and location binding update process by a UE and a GRIDS based on a DH session key negotiation parameter according to an embodiment of the present application.

The method flow shown in fig. 9 in this embodiment of the application is similar to the implementation method flow shown in fig. 7, and is different only in that the UE needs to send the DH session key negotiation parameter of the UE to the GRID, the GRID needs to send the DH session key negotiation parameter of the GRID to the UE, and the UE generates token based on the DH session key negotiation parameter of the UE and the DH session key negotiation parameter of the GRID.

Specifically, the UE may send the DH session key negotiation parameters of the UE through a challenge response message sent to the GRIDS. After the GRIDS receives the challenge response message, the token can be generated based on the DH session key negotiation parameters of the UE and the DH session key negotiation parameters of the GRIDS. The GRIDS may send the DH session key negotiation parameters of the GRIDS via a key message sent to the UE. After the UE receives the key message, a token may be generated based on the DH session key negotiation parameters of the UE and the DH session key negotiation parameters of the GRIDS.

The above description mainly introduces the solution provided by the embodiments of the present application from the perspective of UE and GRIDS interaction. It is understood that the UE and the GRIDS contain corresponding hardware structures and/or software modules for performing the respective functions in order to realize the functions. The elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein may be embodied in hardware or in a combination of hardware and computer software. Whether a function is performed as hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present teachings.

The embodiments of the present application may perform the functional unit division on the UE and the GRIDS according to the above method examples, for example, each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present application is schematic, and is only a logic function division, and there may be another division manner in actual implementation.

Based on the same concept as the method embodiment, the embodiment of the present application further provides a binding update device for an identity location, where the binding update device for an identity location can be applied to a UE and also can be applied to a GRIDS.

When implemented in hardware, the identity and location binding update means applied to the UE and the identity and location binding update means applied to the GRIDS can be implemented by the identity and location binding update means 100 shown in fig. 10.

As shown in fig. 10, the identity location binding update device 100 may comprise at least one processor 101, a memory 103 and at least one transceiver 104. These components may communicate over one or more communication buses 102.

It should be noted that fig. 10 is only one implementation manner of the embodiment of the present application, and in practical applications, the identity location binding update apparatus 100 may further include more or less components, which is not limited herein.

The transceiver 104 is for receiving and transmitting radio frequency signals and is coupled to a receiver and a transmitter of the identity location binding update device 100. The transceiver 104 communicates with a communication network and other communication devices, such as Ethernet (Ethernet), Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc., through radio frequency signals. In particular implementations, the communication protocols supported by the transceiver 104 may include, but are not limited to: 2G/3G, Long Term Evolution (LTE), wireless-fidelity (Wi-Fi), 5G New Radio (NR), etc.

Memory 103 is coupled to processor 101 for storing various software programs and/or sets of instructions. In particular implementations, memory 103 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid-state storage devices. The memory 103 may store an operating system (hereinafter referred to simply as a system), such as an embedded operating system like ANDROID, IOS, WINDOWS, or LINUX. The memory 103 may be used to store the implementation programs of the embodiments of the present application. The memory 103 may also store a network communication program that may be used to communicate with one or more additional devices, one or more terminal devices, one or more network devices.

The processor 101 may be a general-purpose Central Processing Unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more ics for controlling the execution of programs in accordance with the present disclosure.

In some embodiments, the identity location binding update apparatus 100 may further comprise an output device 105 and an input device 106. The output device 105 is in communication with the processor 101 and may display information in a variety of ways. For example, the output device 105 may be a Liquid Crystal Display (LCD), a Light Emitting Diode (LED) display device, a Cathode Ray Tube (CRT) display device, a projector (projector), or the like. The input device 106 is in communication with the processor 101 and may receive user input in a variety of ways. For example, the input device 106 may be a mouse, a keyboard, a touch screen device, or a sensing device, among others. In order to facilitate the user's use of the output device 105 and the input device 106, in some embodiments, the memory 202 may further store a user interface program, which may vividly display the contents of the application program through a graphical operation interface and receive the user's control operation of the application program through input controls such as menus, dialog boxes, and buttons. When the identity location binding update apparatus 100 shown in fig. 10 implements the function of the UE, one or more software modules may be stored in the memory of the identity location binding update apparatus 100, and may be configured to provide the functions of receiving the challenge message, calculating the challenge response message, and sending the challenge response message, which may refer to the above method embodiments. When the id-binding update apparatus 100 shown in fig. 10 implements the function of a grid id, one or more software modules may be stored in the memory of the id-binding update apparatus 100, and may be used to provide the functions of generating a challenge message, verifying a challenge response message, and storing an updated id-location mapping relationship, which may refer to the above-mentioned method embodiments.

When the device is implemented in the form of a software functional unit, fig. 11 is a schematic structural diagram of a binding update apparatus for identity and location binding according to an embodiment of the present application. The binding update apparatus 1000 for identity location may be a UE, or may be an internal component of the UE. Referring to fig. 11, the binding update apparatus 1000 for identity location includes a receiving unit 1002 and a processing unit 1003.

Specifically, the receiving unit 1002 is configured to receive a challenge message sent by the GRIDS, where the challenge message includes challenge content. A processing unit 1003, configured to send a challenge response message to the GRIDS, where the challenge response message includes the challenge content, a challenge result, and an identity location mapping relationship updated by the UE.

Specifically, the challenge content includes an identity of the UE, a random number generated by the grid ids for the UE, and a message authentication code generated by the grid ids for the challenge content by using a local key.

In one possible example, the binding update apparatus 1000 for identity location further includes a sending unit 1001. A sending unit 1001 is used to send an identity location binding update request to the GRIDS. The identity location binding update request comprises a sequence number, the sequence number is used for identifying an identity location binding update request message sent by the UE, and the challenge message also comprises the sequence number.

The processing unit 1003 is further configured to: before the sending unit 1001 sends a challenge response message to the GRIDS, it is determined that a sequence number included in the challenge message coincides with a sequence number included in the UE send identity location binding update request.

In another possible example, the receiving unit 1002 is further configured to: after the sending unit 1001 sends a challenge response message to the GRIDS, a key message sent by the GRIDS is received, and the key and the validity period of the key are saved. Wherein the key message includes a key and a validity period of the key, and the key is generated for the UE by the GRIDS and is used for verifying identity location binding update messages subsequently sent by the UE.

Further, the key message is a message encrypted by the GRIDS by using a public key of the UE.

In another possible example, the processing unit 1003 is further configured to: after the receiving unit 1002 saves the key and the validity period of the key, it is determined that the key is within the validity period, and a message authentication code is generated using the key. The sending unit 1001 is further configured to: sending an identity location binding update message to the GRIDS, where the identity location binding update message includes an identity location mapping relationship subsequently updated by the UE and a message authentication code generated by the processing unit 1003.

Further, the challenge response message further includes a signature of the UE, and the signature of the UE is used for the GRIDS to authenticate the challenge response message. The signature of the GRIDS is also included in the key message, and the signature of the GRIDS is used for the UE to authenticate the key message.

Further, the challenge response message further includes a certificate of the UE, and the key message further includes a certificate of the GRIDS. Or the challenge response message further includes session key negotiation parameters of the UE, and the key message further includes session key negotiation parameters of the GRIDS.

Specifically, the updated identity location mapping relationship in the embodiment of the present application is encrypted or plaintext.

Further, the above-mentioned binding update apparatus 1000 for identity location may further include a storage unit. The storage unit is configured to store a computer executable instruction, the processing unit 1003 is connected to the storage unit, and the processing unit 1003 executes the computer executable instruction stored in the storage unit, so that the identity location binding update apparatus 1000 executes the identity location binding update method executed by the UE in the above method embodiment.

When implemented in hardware, the transmitting unit 1001 and the receiving unit 1002 may be a communication interface, a transceiver, or the like. Radio frequency circuitry may be included in the transceiver. The communication interface is a generic term and may include one or more interfaces. The processing unit 1003 may be, for example, a processor or a controller. The storage unit may be a memory, for example.

Specifically, when the sending unit 1001 and the receiving unit 1002 are transceivers, the processing unit 1003 is a processor, and the storage unit is a memory, the identity location binding update apparatus 1000 may be the identity location binding update apparatus 100 shown in fig. 10, and the identity location binding update apparatus 100 is applied to a UE for executing the methods executed by the UE in fig. 4 to 9.

When implemented in the form of a chip, the binding update apparatus 1000 for an identity location according to the embodiment of the present application may be applied to a chip in a UE, where the chip has a function related to implementing the binding update method for an identity location performed by the UE according to the above-mentioned method embodiment. The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or software includes one or more units corresponding to the above functions. For example, the chip includes: a receiving unit 1002 and a processing unit 1003. Optionally, the communication device may further include a sending unit 1003, or may also include a storage unit. The transmitting unit 1001 and the receiving unit 1002 may be input/output interfaces, pins, or circuits on the chip, etc. The processing unit 1003 may be, for example, a processor. The storage unit may be a memory, for example. The processing unit 1003 can execute the computer executable instructions stored in the storage unit, so that the chip executes the binding update method for the identity location performed by the UE in the above method embodiment. Alternatively, the storage unit may be a storage unit (e.g., a register, a cache, etc.) inside the chip, and the storage unit may also be a storage unit (e.g., a read-only memory (ROM)) located outside the chip inside the UE or another type of static storage device (e.g., a Random Access Memory (RAM)) that may store static information and instructions.

When implemented in the form of a software functional unit, fig. 12 shows the structure of a binding update apparatus 200 for identity and location binding provided by an embodiment of the present application. The binding update device 200 for identity location binding may be a GRIDS or a component within a GRIDS. Referring to fig. 12, the binding update apparatus 2000 for an identity location includes a sending unit 2001, a receiving unit 2002, and a processing unit 2003.

Specifically, the sending unit 2001 is configured to send, to the UE, the challenge message generated by the processing unit 2003, where the challenge message includes challenge content. A receiving unit 2002, configured to receive a challenge response message sent by the UE, where the challenge response message includes a challenge result, an identity location mapping relationship updated by the UE, and challenge content included in the challenge message sent by the sending unit 2001. The processing unit 2003 is configured to generate a challenge message, where the challenge message includes challenge content, verify validity of the challenge response message based on the challenge content and the challenge result included in the challenge response message received by the receiving unit 2002, and store the identity location mapping relationship updated by the UE if the challenge response message is valid.

The processing unit 2003 verifies the validity of the message verification code included in the challenge content, and determines whether the challenge result is the challenge result of the challenge content if the message verification code is valid.

Further, the challenge content further includes at least one of a timestamp of the challenge content and a difficulty factor of the challenge content. The processing unit 2003, is further configured to: and if the challenge content comprises the time stamp of the challenge content, determining whether the challenge result is in the validity period according to the time stamp of the challenge content before determining whether the challenge result is the challenge result of the challenge content. And if the challenge content comprises the difficulty coefficient of the challenge content, determining whether the low k bits of the hash operation result of the challenge result and the random number are 0 or not, wherein k is the difficulty coefficient.

In one possible example, the receiving unit 2002 is further configured to: before the processing unit 2003 generates the challenge message, an identity location binding update request sent by the UE is received, where the identity location binding update request includes a sequence number, and the sequence number is used to identify the identity location binding update request message sent by the UE. Wherein the challenge message further includes the sequence number.

In yet another possible example, the processing unit 2003 is further configured to: after the receiving unit 2002 receives the challenge response message sent by the UE, a key and a validity period of the key are generated and stored, where the key is used to verify an identity location binding update message subsequently sent by the UE. The sending unit 2001 is further configured to: and sending a key message to the UE, wherein the key message comprises the key and the valid period of the key.

Further, the processing unit 2003 is further configured to encrypt the key message with a public key of the UE; the transmission unit 2001 transmits the encrypted key message.

In yet another possible example, the receiving unit 2002 is further configured to: after the sending unit 2001 sends the key message to the UE, an identity location binding update message sent by the UE is received, where the identity location binding update message includes a message authentication code and an identity location mapping relationship subsequently updated by the UE, and the message authentication code is generated by the UE based on the key. The processing unit 2003, is further configured to: the message authentication code is verified by using the key stored in the receiving unit 2002, and if the verification is passed, the subsequently updated identity location mapping relationship of the UE is stored.

In one possible embodiment, the challenge response message further includes a signature of the UE, and the signature of the UE is used for the GRIDS to authenticate the challenge response message. The signature of the GRIDS is also included in the key message, and the signature of the GRIDS is used for the UE to authenticate the key message.

In another possible embodiment, the challenge response message further includes a certificate of the UE, and the key message further includes a certificate of the GRIDS; or the challenge response message further includes session key negotiation parameters of the UE, and the key message further includes session key negotiation parameters of the GRIDS.

Further, the above-mentioned binding update apparatus 2000 for identity location may further include a storage unit. The storage unit is used for storing computer executable instructions, the processing unit 2003 is connected with the storage unit, and the processing unit 2003 executes the computer executable instructions stored in the storage unit, so that the binding update apparatus 2000 for identity location performs the binding update method for identity location performed by the GRIDS in the above method embodiment.

When implemented in hardware, the transmitting unit 2001 and the receiving unit 2002 may be transceivers or communication interfaces. Wherein, radio frequency circuit can be included in the transceiver. The communication interface is a generic term and may comprise one or more interfaces. The processing unit 2003 may be, for example, a processor or a controller.

When the sending unit 2001 and said receiving unit 2002 are transceivers, the processing unit 2003 is a processor, and the storage unit is a memory, the binding update means 2000 of the identity location can be the binding update means 100 of the identity location shown in fig. 10, and the binding update means 100 of the identity location is applied to a GRIDS for executing the methods executed by the GRIDS in fig. 4 to 9.

When implemented in the form of a chip, the identity location binding update apparatus 2000 in the embodiment of the present application can be applied to a chip in a grid id, where the chip has a function related to implementing the binding update method for the grid id to execute the identity location in the above method embodiment. The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or software includes one or more units corresponding to the above functions. For example, the chip includes: a transmitting unit 2001, a receiving unit 2002, and a processing unit 2003. The transmitting unit 2001 and the receiving unit 2002 may be input/output interfaces, pins, or circuits on the chip, or the like. The processing unit 2003 may be, for example, a processor. Optionally, the chip further comprises a storage unit, which may be a memory, for example. The processing unit 2003 may execute the computer executable instructions stored in the storage unit to cause the chip to perform the binding update method for identity location performed by the GRIDS in the above-described method embodiments. Alternatively, the storage unit may be a storage unit (e.g., a register, a cache, etc.) within the chip, a storage unit (e.g., a read-only memory) external to the chip within the GRIDS, or other types of static storage devices (e.g., a random access memory) that may store static information and instructions, etc.

In the embodiment of the present application, for concepts, explanations, and detailed descriptions and other steps related to the technical solutions provided in the embodiment of the present application, reference is made to the foregoing methods or descriptions related to these contents in other embodiments, and details are not described herein.

The embodiment of the application also provides a binding update system of the identity location, the system comprises the GRIDS and the UE, and the GRIDS and the UE have respective corresponding functions for realizing the method embodiment.

Claims

1. A binding update method for identity location, the method comprising:

the GRIDS generates a challenge message, wherein the challenge message comprises challenge content;

the GRIDS sends the challenge message to a communication device;

the GRIDS receives a challenge response message sent by the communication equipment, wherein the challenge response message comprises the challenge content, a challenge result and an identity position mapping relation updated by the communication equipment, the identity is an identity of the communication equipment, and the position is a network address of the communication equipment;

and the GRIDS verifies the validity of the challenge response message based on the challenge content and the challenge result, and if the challenge response message is valid, the updated identity position mapping relation of the communication equipment is saved.

2. The method of claim 1, wherein the challenge content includes an identity of the communication device, a random number generated by the GRIDS for the communication device, and a message authentication code generated by the GRIDS for the challenge content using a local key;

the GRIDS verifies the validity of the challenge response message based on the challenge content and the challenge result, including:

the GRIDS verifies the validity of a message verification code included in the challenge content, and if the message verification code is valid, whether the challenge result is the challenge result of the challenge content is determined.

3. The method of claim 2, wherein the challenge content further comprises at least one of a timestamp of the challenge content and a difficulty factor of the challenge content;

the GRIDS determines whether the challenge result is before the challenge result of the challenge content, the method further comprising:

if the challenge content comprises the time stamp of the challenge content, determining that the challenge content is in the valid period according to the time stamp of the challenge content;

the GRIDS determines whether the challenge result is a challenge result of the challenge content, including:

and if the challenge content comprises the difficulty coefficient of the challenge content, determining whether the low k bits of the hash operation result of the challenge result and the random number are 0 or not, wherein k is the difficulty coefficient.

4. The method of any of claims 1-3, wherein prior to the GRIDS generating the challenge message, the method further comprises:

the GRIDS receives an identity location binding update request sent by communication equipment, wherein the identity location binding update request comprises a serial number which is used for identifying an identity location binding update request message sent by the communication equipment;

the challenge message also includes the sequence number.

5. The method as recited in claim 1, wherein after the GRIDS receives a challenge response message sent by the communication device, the method further comprises:

the GRIDS generates and stores a key and the validity period of the key, wherein the key is used for verifying identity and location binding update messages subsequently sent by the communication equipment;

the GRIDS sends a key message to the communication device, the key message including the key and a validity period for the key.

6. The method of claim 5, wherein the key message is a message encrypted by the GRIDS using a public key of the communication device.

7. The method as claimed in claim 5 or 6, wherein after the GRIDS sends a key message to the communication device, the method further comprises:

the GRIDS receives an identity location binding update message sent by the communication equipment, wherein the identity location binding update message comprises a message authentication code and an identity location mapping relation subsequently updated by the communication equipment, and the message authentication code is generated by the communication equipment based on the secret key;

the GRIDS verifies the message authentication code by using the stored secret key, and if the message authentication code passes the verification, the identity position mapping relation subsequently updated by the communication equipment is stored.

8. The method of claim 5, wherein the challenge-response message further includes a signature of the communication device, the signature of the communication device being used by the GRIDS to authenticate the challenge-response message;

the key message also includes a signature of the GRIDS, which is used by the communication device to authenticate the key message.

9. The method of claim 8, wherein the challenge response message further includes a certificate of the communication device, and wherein the key message further includes a certificate of the GRIDS;

or

The challenge response message also comprises session key negotiation parameters of the communication equipment, and the key message also comprises session key negotiation parameters of the GRIDS.

10. An identity location binding update device applied to a unified control management layer (GRIDS), which is characterized by comprising a sending unit, a receiving unit and a processing unit, wherein:

the sending unit is configured to send the challenge message generated by the processing unit to the communication device, where the challenge message includes challenge content;

the receiving unit is configured to receive a challenge response message sent by the communication device, where the challenge response message includes a challenge result, an identity location mapping relationship updated by the communication device, and challenge content included in the challenge message sent by the sending unit, where the identity is an identity of the communication device, and the location is a network address of the communication device;

the processing unit is configured to generate a challenge message, where the challenge message includes challenge content, verify validity of the challenge response message based on the challenge content and the challenge result included in the challenge response message received by the receiving unit, and store an updated identity location mapping relationship of the communication device if the challenge response message is valid.

11. The apparatus of claim 10, wherein the challenge content includes an identification of the communication device, a random number generated by the GRIDS for the communication device, and a message authentication code generated by the GRIDS for the challenge content using a local key;

the processing unit verifies the validity of the challenge response message based on the challenge content and the challenge result in the following way:

and verifying the validity of a message verification code included in the challenge content, and if the message verification code is valid, determining whether the challenge result is the challenge result of the challenge content.

12. The apparatus according to claim 11, wherein the challenge content further comprises at least one of a timestamp of the challenge content and a difficulty factor of the challenge content;

the processing unit is further configured to:

if the challenge content comprises the time stamp of the challenge content, determining whether the challenge result is in the validity period according to the time stamp of the challenge content before the challenge result of the challenge content is determined;

13. The apparatus according to any of claims 10-12, wherein the receiving unit is further configured to:

before the processing unit generates a challenge message, receiving an identity location binding update request sent by communication equipment, wherein the identity location binding update request comprises a sequence number, and the sequence number is used for identifying the identity location binding update request message sent by the communication equipment;

wherein the challenge message further includes the sequence number.

14. The apparatus of claim 10, wherein the processing unit is further configured to:

after the receiving unit receives a challenge response message sent by communication equipment, a key and the validity period of the key are generated and stored, wherein the key is used for verifying identity location binding update messages sent by the communication equipment subsequently;

the sending unit is further configured to:

and sending a key message to the communication equipment, wherein the key message comprises the key and the valid period of the key.

15. The apparatus of claim 14, wherein the processing unit is further configured to encrypt the key message with a public key of a communication device;

the transmitting unit transmits the encrypted key message.

16. The apparatus according to claim 14 or 15, wherein the receiving unit is further configured to:

after the sending unit sends a key message to the communication equipment, receiving an identity location binding update message sent by the communication equipment, wherein the identity location binding update message comprises a message authentication code and an identity location mapping relation subsequently updated by the communication equipment, and the message authentication code is generated by the communication equipment based on the key;

the processing unit is further configured to:

and verifying the message authentication code by using the key stored by the receiving unit, and if the verification is passed, storing the subsequently updated identity position mapping relation of the communication equipment.

17. The apparatus of claim 14, wherein the challenge-response message further comprises a signature of the communication device, wherein the signature of the communication device is used by the GRIDS to authenticate the challenge-response message;

18. The apparatus of claim 17, wherein the challenge response message further includes a certificate of the communication device, and wherein the key message further includes a certificate of the GRIDS;

or