CN101426029A - Method for identifying customer by network and system thereof - Google Patents

Abstract

The invention discloses a method for identifying users on a network, comprising the steps of: dividing the network into different network domains; replacing the real identity with a masked identity as the user's identity in the network; The domains are respectively defined and used; the mask identity and the user address identification respectively defined are mapped in servers and user terminal devices in different network domains. In addition, the invention also discloses a system for identifying users on the network. By using the present invention, when the user's data packet is transmitted in the network, the data packet does not contain the user's real identity information and real address information at the same time, and there is no user's real identity in the access domain and the service domain Binding with the address identifier also uses the user mask identity identifier to identify the user, thus preventing the leakage of user location information caused by the leakage of the user's real identity identifier.

Description

Method and system for network identification user

technical field

The invention relates to the technical field of network communication, in particular to a method and system for identifying a user in a network.

Background technique

At present, in network data communication, there are two ways to identify users. One is the method of combining the user's identity and address. For example, the IP address simultaneously identifies the user's identity and address in the network; the other is The method of separating the user's identity and address identification functions, for example, the IP address is only used as the user's address identification, and a number or Universal Resource Identifier (URI) is used to identify a user's identity in the network.

When using the former method, the user's IP address is usually fixed and adopts global addressing rules. This method of identifying users has exposed many problems in the current network operation process: first, it is the user's security problem, because Once the IP address assigned to the user is leaked, it means that the user's identity and location information in the network are exposed, so the user may face the security threat of being tracked, information stolen, or subject to purposeful attacks and harassment; The user's mobility support problem. The user's requirement for the network is that the network can provide omnipresent, ubiquitous, and omnipresent comprehensive services. Especially in the future converged network, this user's demand will become more prominent. However, since the original TCP/IP protocol system was designed for fixed-location hosts, the IP address was endowed with the dual function of identifying identity and location, so this method of functional coupling cannot support the dynamic binding of host IP addresses. Then the mobile problem of the host computer cannot be solved.

When using the latter method to identify users for data communication, although the identity identifier and address identifier have achieved functional decoupling in the network, the communication mechanism of the network makes the two identifiers of the user usually bundled for use, storage and transmission in the network. Therefore, network entities or terminal users can easily obtain identity and address information of specific users from the network, as shown in FIGS. 1-4 . Figure 1 is a schematic diagram of the bundled use of user identity and address identifiers in the network. As shown in the figure, for the communication process addressing, billing, authentication and other functions, the network communication mechanism requires that the data packets carry the user's identity information at the same time during transmission and address information. Fig. 2 is a schematic diagram of binding storage of user identity identifiers and address identifiers in the network. Referring to Figure 3, in order to support user mobility, the network requires terminal users to notify the network of location changes on a regular basis or in real time, and the user information database in the network maintains the mapping between user identification and address identification for network communication entities or other users Inquire. In addition, referring to Figure 4, in an all-IP network architecture based on the separation of control and bearer, the two communicating parties will first obtain the identity of the other party (here, the identity used for communication by the user) during the signaling process of call control. address identification, and then start sending business data.

In addition, in view of the fact that the user needs to complete the binding of the user identity and the address identifier in the network through the registration process, since the communicating party knows the other party's identity, the communicating party can also easily obtain the corresponding address identifier of the other party from the network, because The user's address identifier also adopts the global naming rule, and the leakage of the address identifier means the leakage of the user's location information in the network. Therefore, the latter method will also lead to the leakage of important and sensitive user information such as the user's real identity and current location information.

Currently, there is no method for network identification of users that can guarantee the security of the user's real identity and current location information in network communication.

Contents of the invention

In view of this, the problem to be solved by the present invention is to provide a method and system for identifying users on the network, which can effectively prevent leakage of user identity information and location information, and implement security protection for user identity information and location information.

To this end, the present invention provides a method for network identification of users, comprising the following steps:

Divide the network into different domains;

Replace the real identity with the masked identity as the user's identity in the network;

User address identifiers are defined and used in different preset domains;

Mapping the mask identity identifier and the respectively defined user address identifier in the server and the user terminal equipment in different network domains.

Preferably, the network is divided into different network domains as follows:

According to the perspective of users, the network is divided into access domain, service domain and home domain.

Preferably, the preset different network domains are an access domain and a service domain, and the user address identifier is defined as an access domain identifier in the access domain, and defined as a service domain identifier in the service domain.

Preferably, mapping the masked identity and the respectively defined user address identifiers between servers and user terminal devices in different network domains is as follows:

Maintain the mapping relationship between the user's cover identity and the user's real identity in the user terminal device;

Maintaining the mapping relationship between the user's access domain identifier and the user's cover identity identifier in the access domain server;

The mapping relationship between the user's service domain identifier and access domain identifier, and between the service domain identifier and the cover identity identifier is maintained in the service domain server.

Preferably, it also includes the steps of:

Store the user's home domain server address and access domain server address in the user terminal device;

Store the user's current service domain server address in the access domain server;

The user's home domain server address is stored in the service domain server.

Preferably, the address of the home domain server in the user terminal equipment is fixedly assigned before the user accesses the network, or is dynamically updated during use.

Preferably, the address of the access domain server in the user terminal equipment is acquired when the user terminal equipment accesses the network for the first time.

Preferably, the service domain server address in the access domain and the home domain server address in the service domain are acquired after the user prepares to use the network and completes the access authentication process.

In addition, the present invention also provides a network identification system, including:

The user terminal device is used to maintain the mapping relationship between the user's cover identity and the user's real identity and store the user's home domain server address and access domain server address;

The access domain server is used to maintain the mapping relationship between the user's access domain identifier and the user's cover identity identifier and store the server address of the user's current service domain;

The service domain server is used to maintain the mapping relationship between the user's service domain identifier and the access domain identifier, the service domain identifier and the cover identity identifier, and store the address of the user's home domain server;

The home domain server is configured to maintain the mapping relationship between the user's real identity and the masked identity, and between the real identity and the current service domain identity.

Compared with the prior art, the present invention has the following advantages:

In order to prevent user information from leaking, by using the present invention, when the user's data packet is transmitted in the network, the user's real identity information and real address information are not included in the data packet at the same time, and the user's real identity information and real address information are not included in the data packet in the access domain and the service domain. There is no binding between the user's real identity and address. In addition, since the user's location information is easy to be tracked on the network access side, the user's masked identity is used to identify the user in the information exchange between the user terminal device and the access domain server, thereby preventing leakage of the user's real identity. The problem of leakage of user location information is caused.

Description of drawings

Fig. 1 is a schematic diagram of the bundled use of user identity and address identifiers in the network;

Fig. 2 is a schematic diagram of binding and storing user identity and address identifiers in the network;

Fig. 3 is a schematic diagram of a network entity obtaining an address identifier from a user identity identifier;

FIG. 4 is a schematic diagram of a network entity obtaining an address identifier from a user identifier in an all-IP network architecture based on the separation of control and bearer;

FIG. 5 is a flowchart of a method for network identification of users provided by the present invention;

Fig. 6 is a schematic diagram of the network structure defined by the present invention;

FIG. 7 is a schematic diagram of the use of different identifications of user terminal equipment during network home domain authentication;

Fig. 8 is a schematic diagram of alternate use of different identifiers of the user during the location update process when the user's access domain changes and the service domain remains unchanged;

Fig. 9 is a schematic diagram of alternate use of different identities of the user during the location update process when both the user A's access domain and service domain change;

Fig. 10 is a diagram of the delivery process of data packets when user A and user B communicate in the network;

FIG. 11 is a schematic structural diagram of a system for network identification of users provided by the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be specifically described below in conjunction with specific embodiments.

The present invention provides a method for network identification of users, referring to Figure 5, the method includes the following steps:

Step S501: Divide the network into different network domains.

The invention divides the network into different network domains from the perspective of users. For example, the network can be divided into an access domain, a service domain, and a home domain, as shown in FIG. 6 .

The access domain server is set in the access domain, which is connected to the network access points within a certain range; the service domain server is set in the service domain, which is responsible for the mobility management of users within the network coverage of the current service domain, the control of the communication process and the Information forwarding, etc.; while the home domain is located in the user's contracting place, and a home domain server is set up to manage the subscription information of the home user, mobility management, control of the communication process, and information forwarding.

Step S502: Replace the real identity with the masked identity as the user's identity in the network.

Wherein, the sequence between step S501 and step S502 can be adjusted according to the actual situation.

The present invention stores the real identity of the user as the subscription information in the home domain server, and can also be stored in the user terminal equipment at the same time according to the needs of the user.

In order to prevent the user's real identity from leaking when the user accesses the network and communicates, the present invention assigns a cover identity to users with security needs, and uses the cover identity to replace the user's real identity. used when.

The present invention can store the binding or mapping relationship between the user's real identity and the cover identity in the server of the home domain, so that the user's home domain server allocates the user's cover identity, and the specific allocation can adopt a fixed allocation method, A dynamic distribution method may also be adopted, and of course, the present invention does not limit the specific distribution method of the mask identity.

Step S503: Define and use user address identifiers in different preset network domains respectively.

In the present invention, the preset different network domains are access domain and service domain. For example, as shown in Figure 6, user address identifiers are defined and used in the access domain and the service domain respectively, and are respectively defined as the access domain address identifier (hereinafter referred to as the access domain identifier) and the service domain address identifier (referred to as the service domain identifier for short). Domain ID). Wherein, the access domain identifier is used for the communication of the data packet in the access domain, and the service domain identifier is used for the communication of the data packet in the service domain, such as addressing and routing.

The present invention does not limit the allocation method of the access domain identifier and the service domain identifier and the information implied in these two address identifiers. These two identifiers can be fixedly assigned before the user terminal equipment accesses the network, or can real-time dynamic allocation.

Step S504: Mapping the mask identity and the respectively defined user address identifiers in servers and user terminal devices in different network domains.

As shown in Figure 6, the user terminal device maintains the mapping relationship between the user's cover identity and the user's real identity. In addition, the user terminal device needs to store the user's home domain server address and access domain server address.

The access domain server maintains the mapping relationship between the user's access domain identifier and the user's cover identity identifier, and also needs to store the user's current service domain server address.

The service domain server maintains the mapping relationship between the user's service domain identifier and the access domain identifier, and the service domain identifier and the cover identity identifier, and also needs to store the address of the user's home domain server.

The home domain server maintains the mapping relationship between the user's real identity and the masked identity, and between the real identity and the current service domain identity.

As can be seen from the above, in the present invention, except for the user terminal device and the home domain server, there is no binding or mapping relationship between the masked identity and the user's real identity in other devices in the network. Therefore, using the masked identity as the user's identity in the network, even if the masked identity is leaked, it will not cause the leakage of the user's real identity, thereby preventing the location information of the user terminal device from being leaked due to the leak of the user's real identity. Give way.

In order to prevent user information from leaking, the present invention does not contain the user's real identity information and real address information at the same time when the user's data packet is transmitted in the network, and there is no user's real identity information in the access domain and the service domain. Binding of identity identifiers and address identifiers. In addition, since the user's location information is easy to be tracked on the network access side, the user's masked identity is used to identify the user in the information exchange between the user terminal device and the access domain server, thereby preventing leakage of the user's real identity. The problem of leakage of user location information is caused.

Similarly, in the network domain of the communication partner, the user mask identity can also be used to identify the end user, so as to prevent the leakage of the location information of the end user (including the location information of the service domain and the location information of the access domain).

According to the user's information security needs, the user's mask identity and the address identification respectively defined in the present invention can be used in the authentication process (referring to Fig. and 9) and used in the communication process (see FIG. 10), of course, the present invention does not limit the usage occasions of masked identity mark and separately defined address mark.

Fig. 7 is a schematic diagram of the use of different identifiers when the user terminal equipment is authenticated in the home domain of the network. As shown in the figure, user A sends an authentication request packet to home domain server A, which carries the user’s masked identity and home domain server address, and is addressed and routed in the network according to the home domain server address. , arrives at the home domain server A701 of user A, since the real identity and the masked identity of the user are bound and stored in the home domain server A701, so the home domain server A701 replaces the user’s masked identity in the authentication request packet with the user Therefore, using the user's real identity as the user identity, the authentication request data packet is forwarded to the authentication server A702 of user A, and the authentication server A702 completes the authentication of user A.

It should be noted that, in the present invention, the user's authentication server A702 and its home domain server A701 may be separate devices, or may be integrated together.

The present invention does not limit the specific function setting and realization process of various servers in the network. The process of user authentication in the access domain or service domain in the network is similar, and is implemented by the mechanism of identity mapping and replacement.

Figures 8 and 9 illustrate the alternate use of different identities of the user in the process of updating (moving) the user's location, where Figure 8 shows the process of updating the user's location when the user's access domain changes and the service domain remains unchanged. A schematic diagram of alternate use of different identities. FIG. 9 is a schematic diagram of alternate use of different identities of the user during the location update process when user A's access domain and service domain both change.

The location update request data packet in FIG. 8 is used to complete the process of binding and mapping of different identities of users in the new access domain server 801 and service domain server 803 . The user clear request data packet is used to clear the binding and mapping process of the user ID in the previous access domain server 802 . The same as the user access authentication process shown in Figure 7, when the location update request packet is sent from user A, it carries the masked identity of user A, and after arriving at the new access domain server A801, the new access domain server A801 will The cover identity of user A is replaced by the new access domain identifier A. After reaching the service domain server A803, the service domain server A803 sends a user clear request packet to the old access domain server A802, which contains the old access domain Identify A.

In FIG. 9, the location update request data packet completes the process of binding and mapping different user IDs in the new access domain server 801, the new service domain server 901, and the home domain server A701. The user clear request data packet is to clear the binding and mapping process of the user's different identities in the previous access domain server 802 and the previous service domain server 902 . As shown in Figure 9, when the location update request data packet is sent from user A, it carries the user's cover identity A, and after arriving at the new access domain server 801, the user's cover identity is replaced by the new access domain identity A, the After the data packet arrives at the new service domain server A901, the new access domain ID is replaced with the new service domain ID A. Similarly, when the user clear request data packet is sent from the home domain server A701, it carries the old service domain ID of user A.

FIG. 10 schematically illustrates the transmission process of data packets in the access domain, service domain, and home domain of users on both sides of the communication during the communication process.

When the communication data packets are transmitted in different network domains, the corresponding address identification is used to complete addressing, routing and identification of users, and realize the replacement of user service domain address identification and user real identity identification in the home domain. Figure 10 takes user A sending a data packet to user B as an example, the specific process is as follows:

Step S1001: User A fills in the "sender user ID" in the data packet with the cover ID of A, and the "receiver user ID" with the real ID of user B, and user A sends the data packet to the corresponding access domain server a.

Step S1002: Access domain server A replaces user A's cover ID in the data packet with user A's access domain identifier, and forwards the data packet to service domain server A.

Step S1003: Server service domain A replaces user A's access domain identifier in the data packet with user A's service domain identifier, and forwards the data packet to home domain server A.

Step S1004: The home domain server A forwards the data packet containing the real identities of users A and B to the home domain server B.

This step includes three substeps:

Step S1004a: the home domain server A sends the home domain request message of the user B to the resolution server, where the resolution server can resolve the home domain server corresponding to the user according to the real identity of the user.

Step S1004b: According to the real identity of user B, the resolution server returns the home domain request response of user B, and the home domain request response includes the address of user B's home domain server B.

Step S1004c: The home domain server A forwards the data packet to the home domain server B after replacing the service domain identifier of the user A in the data packet with the real identity identifier of the user A.

Step S1005: The home domain server B replaces B's real identity in the data packet with the service domain identity of B, and forwards the data packet to the service domain server B.

Step S1006: The service domain server B replaces the service domain identifier of B in the data packet with the access domain identifier of B, and forwards the data packet to the access domain server B.

Step S1007: the access domain server B replaces the access domain identifier of B in the data packet with the cover identity identifier of B, and sends the data packet to user B.

From the above user access authentication process, it can be analyzed that during the user authentication process, since the mapping relationship between the user's real identity and the masked identity is stored in the home domain server, the authentication server uses the real identity stored in the home domain server. ID to authenticate the user's identity, so the user terminal device needs to know the address of the user's home domain server in advance, so that the authentication request data packet can be addressed to the home domain server, so as to use the user's real identity and mask identity stored in the home domain server The mapping relationship between identifiers.

In addition, it can be seen from the above communication process that the address of the user's current service domain server needs to be stored in the user's current access domain server, and the user's home domain server address needs to be stored in the service domain server.

It should be noted that the home domain server address in the user terminal device may be fixedly assigned before the user accesses the network, or may be dynamically updated during subsequent use. The address of the access domain server in the user terminal device may be automatically obtained when the user first accesses the network. The server address of the service domain and the server address of the home domain in the access domain and the service domain may be acquired after the user prepares to use the network and completes the access authentication process.

What needs to be explained here is that the present invention does not limit the processes or methods for obtaining addresses of servers in different network domains.

Referring to Fig. 11, based on the above-mentioned method for network identification provided by the present invention, the present invention also provides a network identification system, including:

The user terminal device 1101 is configured to maintain the mapping relationship between the user's cover identity and the user's real identity and store the user's home domain server address and access domain server address;

The access domain server 1102 is used to maintain the mapping relationship between the user's access domain identifier and the user's cover identity identifier and store the server address of the user's current service domain;

The service domain server 1103 is used to maintain the mapping relationship between the user's service domain identifier and access domain identifier, service domain identifier and mask identity identifier, and store the user's home domain server address;

The home domain server 1104 is configured to maintain the mapping relationship between the user's real identity and the masked identity, and between the real identity and the current service domain identity.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. It should be pointed out that for those of ordinary skill in the art, some modifications can be made without departing from the principles of the present invention, and any modifications, equivalent replacements, improvements, etc., should be included in the protection of the present invention. within range.

Claims (9)

1. A method for network identification of users, comprising the following steps: Divide the network into different domains; Replace the real identity with the masked identity as the user's identity in the network; User address identifiers are defined and used in different preset domains; Mapping the mask identity identifier and the respectively defined user address identifier in the server and the user terminal equipment in different network domains. 2. The method according to claim 1, wherein dividing the network into different network domains is specifically: According to the perspective of users, the network is divided into access domain, service domain and home domain. 3. The method according to claim 2, wherein the preset different network domains are an access domain and a service domain, and the user address identifier is defined as an access domain identifier in the access domain, and defined as an access domain identifier in the service domain. Service domain ID. 4. The method according to claim 3, characterized in that, mapping the mask identity and the respectively defined user address identifiers in servers and user terminal devices in different network domains is specifically: Maintain the mapping relationship between the user's cover identity and the user's real identity in the user terminal device; Maintaining the mapping relationship between the user's access domain identifier and the user's cover identity identifier in the access domain server; The mapping relationship between the user's service domain identifier and access domain identifier, and between the service domain identifier and the cover identity identifier is maintained in the service domain server. 5. The method according to claim 4, further comprising the steps of: Store the user's home domain server address and access domain server address in the user terminal device; Store the user's current service domain server address in the access domain server; The user's home domain server address is stored in the service domain server. 6. The method according to claim 5, wherein the address of the home domain server in the user terminal device is fixedly assigned before the user accesses the network, or is dynamically updated during use. 7. The method according to claim 5, wherein the address of the access domain server in the user terminal equipment is obtained when the user terminal equipment accesses the network for the first time. 8. The method according to claim 5, wherein the server address of the service domain in the access domain and the address of the home domain server in the service domain are obtained after the user prepares to use the network and completes the access authentication process. 9. A network identification system, characterized in that it comprises: The user terminal device is used to maintain the mapping relationship between the user's cover identity and the user's real identity and store the user's home domain server address and access domain server address; The access domain server is used to maintain the mapping relationship between the user's access domain identifier and the user's cover identity identifier and store the server address of the user's current service domain; The service domain server is used to maintain the mapping relationship between the user's service domain identifier and the access domain identifier, the service domain identifier and the cover identity identifier, and store the address of the user's home domain server; The home domain server is configured to maintain the mapping relationship between the user's real identity and the masked identity, and between the real identity and the current service domain identity.

Images