Granted Patent B2

US 12,342,165 · App. 17/565,875 · Granted Jun 24, 2025

Inventor: Hui Xie (Shanghai, CN)

Assignee: CloudMinds Robotics Co., Ltd.

H04W12/069H04W12/0431H04W12/082

Abstract

Claims (67)

1. A mobile network access system, comprising:

a first network authentication service node and a first certificate authority node located in a block chain network, wherein the first network authentication service node and the first certificate authority node belong to a first operator;

the first certificate authority node comprising a first processor and a first memory, the first processor is configured to authorize a first authentication certificate indicating an identity of the first network authentication service node to the first network authentication service node, authorize a first UE (user equipment) certificate indicating an identity of user equipment of the first operator to the user equipment of the first operator, and store first UE certificate revocation information and a first CA (certificate authority) certificate indicating an identity of the first certificate authority node to a block chain; and

the first network authentication service node comprising a second processor and a second memory, the second processor is configured to obtain the first UE certificate revocation information and the first CA certificate from the block chain, perform mutual identity authentication with the user equipment of the first operator under the condition of receiving a first access authentication message of the user equipment of the first operator, and make the user equipment of the first operator access a mobile network under the condition of completing the mutual identity authentication;

wherein the system further comprising:

a second network authentication service node and a second certificate authority node located in the block chain network, wherein the second network authentication service node and the second certificate authority node belong to a second operator;

the first certificate authority node comprising the first processor that is further configured to write a first roaming license certificate authorized for the second certificate authority node into the block chain; and

the second certificate authority node comprising a third processor and a third memory, the third processor is configured to authorize a second authentication certificate indicating an identity of the second network authentication service node to the second network authentication service node, authorize a second UE certificate indicating an identity of user equipment of the second operator to the user equipment of the second operator, store second UE certificate revocation information and a second CA certificate indicating an identity of the second certificate authority node to a block chain, and write a second roaming license certificate authorized for the first certificate authority node into the block chain.

2. The system according to claim 1 , wherein the first CA certificate and the first UE certificate authorized by the first certificate authority node to the user equipment of the first operator are preset in an identification card of the user equipment of the first operator; and

the first certificate authority node authorized by the first certificate authority node to the first network authentication service node is preset in the first network authentication service node or stored in the block chain.

3. A mobile network access method, wherein the method is performed by a first network authentication service node in a mobile network access system, the method comprising:

receiving first access authentication information sent by user equipment of a first operator, wherein the first access authentication information comprises a first UE (user equipment) certificate;

obtaining first UE certificate revocation information and a first CA (certificate authority) certificate from a block chain;

verifying whether the first UE certificate is authorized by a first certificate authority node according to a public key in the first CA (certificate authority) certificate, and determining whether the first UE certificate is revoked according to the first UE certificate revocation information; and

sending a second access authentication message to the user equipment of the first operator on the condition that determined the first UE certificate is authorized by the first certificate authority node and the first UE certificate is not revoked, wherein the second access authentication message comprises a first authentication certificate, and the first authentication certificate is configured to perform identity authentication by the user equipment of the first operator on the first network authentication service node and make the user equipment of the first operator access a mobile network on the condition that the identity authentication passes;

receiving third access authentication information sent by user equipment of a second operator, wherein the third access authentication information comprises a second UE certificate;

obtaining the first CA certificate, a first roaming license certificate and a second roaming license certificate from the block chain;

on the condition that the first CA certificate, the second UE certificate, the first roaming license certificate and the second roaming license certificate have been obtained, verifying whether the first roaming license certificate is authorized by the first certificate authority node according to a public key in the first CA certificate and verifying whether the second UE certificate is authorized by the second certificate authority node according to a public key of the second certificate authority node in the second roaming license certificate; and

sending a fourth access authentication message to the user equipment of the second operator on the condition that the first roaming license certificate is authorized by the first certificate authority node and the second UE certificate is authorized by the second certificate authority node have been determined, wherein the fourth access authentication message comprises the first authentication certificate and the first roaming license certificate, and the first authentication certificate and the first roaming license certificate are configured to perform identity authentication by the user equipment of the second operator on the first network authentication service node and make the user equipment of the second operator access the mobile network on the condition that the identity authentication passes.

4. A mobile network access method, wherein the method is performed by a user equipment of a first operator comprising:

sending first access authentication information to a first network authentication service node, wherein the first access authentication information comprises a first UE (user equipment) certificate;

receiving a second access authentication message sent by the first network authentication service node, wherein the second access authentication message comprises a first authentication certificate;

verifying whether the first authentication certificate is authorized by a first certificate authority node according to a public key in a preset first CA (certificate authority) certificate; and

accessing the user equipment to the mobile network on the condition that the first authentication certificate is authorized by the first certificate authority node have been determined;

sending fifth access authentication information to the second network authentication service node, wherein the fifth access authentication information comprises a second UE certificate;

receiving a sixth access authentication message sent by the second network authentication service node, wherein the sixth access authentication message comprises a second authentication certificate and a first roaming license certificate;

verifying whether the first roaming license certificate is authorized by the first certificate authority node according to a public key in the preset first CA certificate, and verifying whether the second authentication certificate is authorized by a second certificate authority node according to a public key of the second certificate authority node in the first roaming license certificate; and

accessing the user equipment to the mobile network on the condition that the first roaming license certificate is authorized by the first certificate authority node and the second authentication certificate is authorized by the second certificate authority node have been determined.

5. A non-transitory computer-readable medium storing a computer program when executed by a processor of a network authentication server, causes the network authentication server to:

receive first access authentication information sent by user equipment of a first operator, wherein the first access authentication information comprises a first UE (user equipment) certificate;

obtain first UE certificate revocation information and a first CA (certificate authority) certificate from a block chain;

verify whether the first UE certificate is authorized by a first certificate authority node according to a public key in the first CA certificate, and determine whether the first UE certificate is revoked according to the first UE certificate revocation information; and

send a second access authentication message to the user equipment of the first operator on the condition that determined the first UE certificate is authorized by the first certificate authority node and the first UE certificate is not revoked, wherein the second access authentication message comprises a first authentication certificate, and the first authentication certificate is configured to perform identity authentication by the user equipment of the first operator on the first network authentication service node and make the user equipment of the first operator access a mobile network on the condition that the identity authentication passes;

receive third access authentication information sent by user equipment of a second operator, wherein the third access authentication information comprises a second UE certificate;

obtain the first CA certificate, a first roaming license certificate and a second roaming license certificate from the block chain;

on the condition that the first CA certificate, the second UE certificate, the first roaming license certificate and the second roaming license certificate have been obtained, verify whether the first roaming license certificate is authorized by the first certificate authority node according to a public key in the first CA certificate and verifying whether the second UE certificate is authorized by the second certificate authority node according to a public key of the second certificate authority node in the second roaming license certificate; and

send a fourth access authentication message to the user equipment of the second operator on the condition that the first roaming license certificate is authorized by the first certificate authority node and the second UE certificate is authorized by the second certificate authority node have been determined, wherein the fourth access authentication message comprises the first authentication certificate and the first roaming license certificate, and the first authentication certificate and the first roaming license certificate are configured to perform identity authentication by the user equipment of the second operator on the first network authentication service node and make the user equipment of the second operator access the mobile network on the condition that the identity authentication passes.

6. A non-transitory computer-readable medium storing a computer program when executed by a processor of a user equipment of a first operator, causes the user equipment of the first operator to:

send first access authentication information to a first network authentication service node, wherein the first access authentication information comprises a first UE (user equipment) certificate;

receiving a second access authentication message sent by the first network authentication service node, wherein the second access authentication message comprises a first authentication certificate;

verifying whether the first authentication certificate is authorized by a first certificate authority node according to a public key in a preset first CA (certificate authority) certificate; and

accessing the user equipment to the mobile network on the condition that the first authentication certificate is authorized by the first certificate authority node have been determined;

sending fifth access authentication information to the second network authentication service node, wherein the fifth access authentication information comprises a second UE certificate;

receiving a sixth access authentication message sent by the second network authentication service node, wherein the sixth access authentication message comprises a second authentication certificate and a first roaming license certificate;

verifying whether the first roaming license certificate is authorized by the first certificate authority node according to a public key in the preset first CA certificate, and verifying whether the second authentication certificate is authorized by a second certificate authority node according to a public key of the second certificate authority node in the first roaming license certificate; and

accessing the user equipment to the mobile network on the condition that the first roaming license certificate is authorized by the first certificate authority node and the second authentication certificate is authorized by the second certificate authority node have been determined.

7. A network authentication server, comprising:

a memory, storing a computer program thereon; and

a processor, configured to:

receiving first access authentication information sent by user equipment of a first operator, wherein the first access authentication information comprises a first UE (user equipment) certificate;

obtaining first UE certificate revocation information and a first CA (certificate authority) certificate from a block chain;

verifying whether the first UE certificate is authorized by a first certificate authority node according to a public key in the first CA certificate, and determining whether the first UE certificate is revoked according to the first UE certificate revocation information; and

sending a second access authentication message to the user equipment of the first operator under the condition of determining that the first UE certificate is authorized by the first certificate authority node and the first UE certificate is not revoked, wherein the second access authentication message comprises a first authentication certificate, and the first authentication certificate is configured to perform identity authentication by the user equipment of the first operator on the first network authentication service node and make the user equipment of the first operator access a mobile network under the condition that the identity authentication passes;

receiving third access authentication information sent by user equipment of the second operator, wherein the third access authentication information comprises the second UE certificate;

obtaining the first CA certificate, the first roaming license certificate and the second roaming license certificate from the block chain;

on the condition that the first CA certificate, the second UE certificate, the first roaming license certificate and the second roaming license certificate have been obtained, verifying whether the first roaming license certificate is authorized by the first certificate authority node according to a public key in the first CA certificate and verifying whether the second UE certificate is authorized by the second certificate authority node according to a public key of the second certificate authority node in the second roaming license certificate; and

sending a fourth access authentication message to the user equipment of the second operator on the condition that the first roaming license certificate is authorized by the first certificate authority node and the second UE certificate is authorized by the second certificate authority node have been determined, wherein the fourth access authentication message comprises the first authentication certificate and the first roaming license certificate, and the first authentication certificate and the first roaming license certificate are configured to perform identity authentication by the user equipment of the second operator on the first network authentication service node and make the user equipment of the second operator access the mobile network on the condition that the identity authentication passes.

8. A user equipment, comprising:

a memory, storing a computer program thereon; and a processor, configured to:

send first access authentication information to a first network authentication service node, wherein the first access authentication information comprises the first UE (user equipment) certificate;

receive a second access authentication message sent by the first network authentication service node, wherein the second access authentication message comprises the first authentication certificate;

verify whether the first authentication certificate is authorized by the first authority node according to a public key in a preset first CA (certificate authority) certificate; and

access the user equipment to the mobile network on the condition that the first authentication certificate is authorized by the first authority node have been determined;

send fifth access authentication information to the second network authentication service node, wherein the fifth access authentication information comprises a second UE certificate;

receive a sixth access authentication message sent by the second network authentication service node, wherein the sixth access authentication message comprises a second authentication certificate and a first roaming license certificate;

verify whether the first roaming license certificate is authorized by the first certificate authority node according to a public key in the preset first CA certificate, and verifying whether the second authentication certificate is authorized by a second certificate authority node according to a public key of the second certificate authority node in the first roaming license certificate; and

access the user equipment to the mobile network on the condition that the first roaming license certificate is authorized by the first certificate authority node and the second authentication certificate is authorized by the second certificate authority node have been determined.

Assignments (4)

Priority Claims (1)

Continuity (2)

References Cited (26)