CN114302396B - Data management methods, devices, equipment, storage media and systems - Google Patents

Abstract

The application provides a data management method, a device, equipment, a storage medium and a system, and relates to the field of communication. The method is applied to a first node in a UDM system, and comprises the following steps: acquiring authentication information of a first user; broadcasting authentication information of the first user; receiving first information respectively sent by at least one second node; the second node is a node other than the first node or a center node among the plurality of edge nodes; the first information is generated after the second node verifies whether the first user is a valid registered user according to the authentication information of the first user and the registration information of the first user stored in the second node; the first information is used for indicating whether authentication information of the first user passes verification of the second node; and determining an authentication result of the first user according to the first information which indicates the verification by the second node, the duty ratio in all the first information and the preset first proportion. The method is suitable for the authentication process and is used for improving the security of the UDM system.

Description

Data management methods, devices, equipment, storage media and systems

Technical field

The present application relates to the field of communications, and in particular, to a data management method, device, equipment, storage medium and system.

Background technique

The unified data management (UDM) network element is one of the network elements in the core network of the fifth generation mobile communication technology (5G). UDM network elements can be used to store user subscription data, authentication, etc. For example, the UDM network element can obtain the authentication information sent by the user equipment. When the authentication information sent by the user equipment is the same as the registration information prestored in the UDM network element, the UDM network element can determine that the user equipment has passed the authentication. After passing the authentication, the UDM network element can provide services to the user based on the service information in the user's subscription data. For example, the service information may include quality of service (QoS) information.

Currently, some users need to establish flexible production lines, and establishing flexible production lines requires a high availability (HA) network. In order to provide users with a high-availability network, operators have proposed a distributed UDM system. The distributed UDM system can include central UDM network elements and edge UDM network elements. The central UDM network element and multiple edge UDM network elements are connected in star mode. Each edge UDM network element can obtain and store the registration information and subscription data of users in the subnet corresponding to the edge UDM network element from the central UDM network element. Each edge UMD network element can implement the functions of the above UDM network element in the subnet corresponding to the edge UDM network element based on the registration information and subscription data of the user in the subnet corresponding to the edge UDM network element.

However, in the current distributed UDM system, there may be users of edge UDM network elements maliciously disconnecting the edge UDM network element from the central UDM network element, and privately tampering with the user's registration information and information stored in the edge UDM network element. Risks of Contracting Data.

Contents of the invention

This application provides a data management method, device, equipment and storage medium, which can prevent users of edge nodes from maliciously disconnecting edge nodes and central nodes, tampering with user registration information privately, and improving the security of the UDM system.

In the first aspect, this application provides a data management method, which is applied to the first node in the unified data management UDM system. The UDM system includes a central node and multiple edge nodes; each edge node is connected to the central node, and Each edge node is connected to at least one other edge node of the plurality of edge nodes; the first node is one of the plurality of edge nodes. The method includes: a first node obtains authentication information of a first user, and the first user is a user of a subnet corresponding to the first node; the first node broadcasts the authentication information of the first user; and the first node receives data from at least one The first information sent by the two nodes respectively; the second node is a node other than the first node among the plurality of edge nodes, and at least one of the central nodes; the first information is the authentication information of the second node based on the first user , and the registration information of the first user stored in the second node, generated after verifying whether the first user is a valid registered user; the first information is used to indicate whether the authentication information of the first user passes the verification of the second node. ; The first node determines the authentication result of the first user based on the proportion of the first information indicating that it has passed the verification of the second node in all the first information, and the preset first proportion.

In a possible implementation, before the first node broadcasts the authentication information of the first user, the method further includes: the first node broadcasts the authentication information of the first user based on the authentication information of the first user and the registration of the first user stored in the first node. information to determine that the first user is a valid registered user.

In another possible implementation, the method further includes: when the central node and the edge node are disconnected, the first node receives the data sent from the edge node other than the first node, and/or the first node The administrator of the corresponding subnet inputs the registration information of the first user and stores the registration information of the first user.

In another possible implementation, the first node broadcasts the authentication information of the first user, including: the first node generates a block based on the authentication information of the first user; the block includes the authentication information of the first user, and The identity information of the first node; the identity information of the first node is used by the second node to verify the identity of the first node; the first node broadcasts the block.

In another possible implementation manner, the first node broadcasts the authentication information of the first user, including: the first node sends the authentication information of the first user to the third node, so that the third node performs the authentication according to the authentication information of the first user. Generate a block based on weight information and broadcast the block; the third node is an edge node or central node among multiple edge nodes except the first node.

In another possible implementation, the first node is connected to the first network device, and the first node stores service quality information of users of the subnet corresponding to each edge node; the authentication result of the first user includes: passing or Failure; the method also includes: after the first node determines that the first user is a valid registered user, determine and record the service quality information of the first user based on the service quality information of the user in the subnet corresponding to each edge node; when the first node When the authentication result of a user is passed, the first node sends the first user's quality of service information to the first network device, so that the first network device provides services for the first user according to the first user's quality of service information.

In another possible implementation, the first node is connected to the first network device, and the first node stores service quality information of users of the subnet corresponding to each edge node; the authentication result of the first user includes: passing or Not passed; the method also includes: the first node receives a first instruction sent by the central node, and the first instruction is used to instruct the first node to send the basic quality of service to the first network device when the authentication result of the first user is passed. Information; the first instruction is sent by the central node when the number of other edge nodes connected to the first node is less than the preset number threshold; in response to the first instruction, when the authentication result of the first user is passed, the first The node sends basic service quality information to the first network device, so that the first network device provides services for the first user according to the basic service quality information.

In another possible implementation, the central node includes multiple central nodes; multiple central nodes are connected to each other; each edge node is connected to the central node, which means: each edge node is connected to one of the multiple central nodes; second A node is a central node, which means: the second node is one of multiple central nodes.

In the data management method provided by the embodiment of the present application, point to point (P2P) is adopted between the central node and the central node, between the central node and the edge node, and between the edge node and the edge node in the UDM system. Connections, P2P connections are more robust than existing star connections. The central node and each edge node in the UDM system can store the user registration information of the subnet corresponding to each edge node. A certain edge node in the UDM system (such as the first node mentioned above) can obtain the authentication information of users in the subnet corresponding to the edge node and broadcast it. Other edge nodes or central nodes in the UDM system (such as the second node mentioned above) can verify the user's authentication information based on the user's registration information stored in the subnet corresponding to each edge node, and generate The first information is sent to the edge node that broadcasts the user's authentication information. The edge node that broadcasts the user's authentication information can determine the user's authentication result based on the first information. The edge node that broadcasts the user's authentication information can perform normal authentication only after receiving the first information verified by other edge nodes based on the user's authentication information. When a user of an edge node maliciously disconnects the edge node and When connecting to the central node and trying to tamper with the user's registration information privately, the user of the subnet corresponding to the edge node stored in other edge nodes is different from the user's registration information after private tampering. At this time, the edge node will not tamper with privately. Authentication of the user who registered the information. Improved UDM system security.

In a second aspect, this application provides a data management device, which can be applied to the first node in the unified data management UDM system described in the first aspect. The UDM system includes a central node and multiple edge nodes; each The edge nodes are connected to the central node, and each edge node is connected to at least one other edge node of the plurality of edge nodes; the first node is one of the plurality of edge nodes. The device may include: an acquisition unit, a sending unit, and a processing unit. The obtaining unit is used to obtain the authentication information of the first user, where the first user is a user of the subnet corresponding to the first node. A sending unit, configured to broadcast the authentication information of the first user. The acquisition unit is also configured to receive the first information respectively sent from at least one second node; the second node is a node other than the first node among the plurality of edge nodes, and at least one of the central nodes; the first information is The second node is generated after verifying whether the first user is a valid registered user based on the first user's authentication information and the first user's registration information stored in the second node; the first information is used to indicate the first user's Whether the authentication information passes the verification of the second node. The processing unit is configured to determine the authentication result of the first user based on the proportion of the first information indicating that it has passed the second node verification in all the first information, and the preset first proportion.

In a possible implementation, the processing unit is further configured to, before the sending unit broadcasts the authentication information of the first user, based on the authentication information of the first user and the registration information of the first user stored in the first node, The first user is determined to be a valid registered user.

In another possible implementation, the acquisition unit is also configured to receive data sent from edge nodes other than the first node and/or corresponding to the first node when the central node and the edge node are disconnected. The administrator of the subnet inputs the registration information of the first user and stores the registration information of the first user.

In another possible implementation, the sending unit is specifically configured to generate a block based on the authentication information of the first user. The block includes the authentication information of the first user and the identity information of the first node; The identity information is used by the second node to verify the identity of the first node; broadcast the block.

In another possible implementation, the sending unit is specifically configured to send the first user's authentication information to the third node, so that the third node generates a block based on the first user's authentication information and broadcasts it; third The node is an edge node other than the first node or a central node among the plurality of edge nodes.

In another possible implementation, the first node is connected to the first network device, and the first node stores service quality information of users of the subnet corresponding to each edge node; the authentication result of the first user includes: passing or Fail. The processing unit is also configured to determine and record the service quality information of the first user based on the service quality information of the user in the subnet corresponding to each edge node after determining that the first user is a valid registered user. The sending unit is also configured to send the first user's quality of service information to the first network device when the first user's authentication result is passed, so that the first network device provides the first user with the first user's quality of service information according to the first user's quality of service information. Provide services.

In yet another possible implementation, the acquisition unit is further configured to receive a first instruction sent by the central node. The first instruction is used to instruct the first node to send the authentication request to the first network device when the authentication result of the first user is passed. Send basic service quality information; the first instruction is sent by the central node when the number of other edge nodes connected to the first node is less than a preset quantity threshold. The sending unit is also configured to respond to the first instruction, when the authentication result of the first user is passed, send basic service quality information to the first network device, so that the first network device provides the first user with basic service quality information based on the basic service quality information. Provide services.

In another possible implementation, the central node includes multiple central nodes; multiple central nodes are connected to each other. Each edge node is connected to a central node, which means: each edge node is connected to one of multiple central nodes. The second node is a central node, which means that the second node is one of multiple central nodes.

In the third aspect, this application provides a data management method, which can be applied to the second node in the UDM system. The UDM system includes a central node and multiple edge nodes; each edge node is connected to the central node, and each The edge node is connected to at least one other edge node among the plurality of edge nodes; the second node is a node among the plurality of edge nodes except the first node, and at least one of the central nodes, and the first node is the plurality of edge nodes. one of the. The method includes: the second node receives the authentication information of the first user broadcast by the first node, and the first user is a user of the subnet corresponding to the first node; the second node receives the authentication information of the first user according to the authentication information of the first user, and the second node The registration information of the first user stored in the node is used to verify whether the first user is a valid registered user; the second node generates the first information based on the result of verifying whether the first user is a valid registered user; the first information is used to indicate The second node passes or fails the first user's authentication information; the second node sends the first information to the first node, so that the first node passes the first information verified by the second node according to the instruction, and in all the first information The proportion in , and the preset first proportion determine the authentication result of the first user.

In a possible implementation, the authentication information of the first user broadcast by the first node received by the second node is based on the authentication information of the first user and the authentication information of the first user stored in the first node. Registration information, sent after confirming that the first user is a valid registered user.

In another possible implementation, when the central node and the edge node are disconnected, the registration information of the first user stored in the first node is sent by an edge node other than the first node, and/or the Input by the administrator of the subnet corresponding to a node.

In yet another possible implementation, the second node receives the authentication information of the first user broadcast by the first node, including: the second node receives the block broadcast by the first node, and the block is the first node's authentication information based on the first user's information. Generated with authentication information, the block includes the authentication information of the first user and the identity information of the first node; the identity information of the first node is used by the second node to verify the identity of the first node.

In yet another possible implementation, the second node receives the authentication information of the first user broadcast by the first node, including: the second node receives a block broadcast by the third node, and the block is the block broadcast by the first node to the third node. After the node sends the authentication information of the first user, it is generated by the third node based on the authentication information of the first user. The block includes the authentication information of the first user and the identity information of the third node; the identity of the third node The information is used by the central node and edge nodes to verify the identity of the third node; the third node is an edge node or a central node other than the first node among multiple edge nodes.

In another possible implementation, the second node stores the service quality information of the users of the subnet corresponding to each edge node; the second node determines the quality of service based on the authentication information of the first user and the first user stored in the second node. The user's registration information, after verifying whether the first user is a valid registered user, the method also includes: when the second node determines that the first user is a valid registered user, the second node determines according to each edge stored in the second edge node The service quality information of the users of the subnet corresponding to the node determines the service quality information of the first user and records it.

In another possible implementation, the central node includes multiple central nodes; multiple central nodes are connected to each other. Each edge node is connected to a central node, which means: each edge node is connected to one of multiple central nodes. The second node is a central node, which means that the second node is one of multiple central nodes.

In the fourth aspect, the present application provides a data management device, which can be applied to the second node in the UDM system described in the third aspect. The UDM system includes a central node and multiple edge nodes; each edge node and The central nodes are connected, and each edge node is connected to at least one other edge node among the plurality of edge nodes; the second node is a node among the plurality of edge nodes except the first node, and at least one of the central nodes, and A node is one of multiple edge nodes. The device may include: an acquisition unit, a processing unit, and a sending unit. The obtaining unit is configured to receive the authentication information of the first user broadcast by the first node. The first user is a user of the subnet corresponding to the first node. A processing unit configured to verify whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node; to verify whether the first user is a valid registered user based on As a result, first information is generated, and the first information is used to indicate whether the authentication information of the first user passes the verification of the second node. A sending unit configured to send the first information to the first node, so that the first node passes the first information verified by the second node according to the instruction, the proportion of all the first information, and the preset first proportion, Determine the authentication result of the first user.

In a possible implementation, the authentication information of the first user broadcast by the first node received by the second node is based on the authentication information of the first user and the authentication information of the first user stored in the first node. Registration information, sent after confirming that the first user is a valid registered user.

In another possible implementation, when the central node and the edge node are disconnected, the registration information of the first user stored in the first node is sent by an edge node other than the first node, and/or the Input by the administrator of the subnet corresponding to a node.

In another possible implementation, the acquisition unit is specifically configured to receive a block broadcast by the first node. The block is generated by the first node based on the authentication information of the first user, and the block includes the authentication information of the first user. information, and the identity information of the first node; the identity information of the first node is used by the second node to verify the identity of the first node.

In another possible implementation, the acquisition unit is specifically configured to receive a block broadcast by a third node. The block is obtained by the third node according to the first node's authentication information after the first node sends the first user's authentication information to the third node. The authentication information of the first user is generated; the third node is an edge node or a central node among the plurality of edge nodes except the first node.

In another possible implementation manner, the second node stores the service quality information of users of the subnet corresponding to each edge node. The processing unit is also configured to, when it is determined that the first user is a valid registered user, determine and record the service quality information of the first user based on the service quality information of the user of the subnet corresponding to each edge node stored in the second node.

In another possible implementation, the central node includes multiple central nodes; multiple central nodes are connected to each other. Each edge node is connected to a central node, which means: each edge node is connected to one of multiple central nodes. The second node is a central node, which means that the second node is one of multiple central nodes.

In the fifth aspect, this application provides a data management method, which can be applied to the central node in the UDM system. The UDM system includes a central node and multiple edge nodes; each edge node is connected to the central node, and each edge node The node is connected to at least one other edge node among the plurality of edge nodes; the edge node has a one-to-one correspondence with the identity information of the first organization. The method includes: a central node obtains a system log set, and the system log set includes edge nodes and event information corresponding to the edge nodes. For each edge node, when the system logs are concentrated and the event information corresponding to the edge node meets the preset conditions, the central node determines that the edge node is a malicious node and generates the first request. The central node broadcasts the first request and the first log corresponding to the first request. The first request is used to request to reveal the identity information of the first organization corresponding to the malicious node. The first log is a system log that centrally records the event information corresponding to the malicious node. log. The central node obtains the vote of the edge node for the first request. When during the voting, the proportion that agrees to the first request is greater than the preset second proportion, the central node broadcasts the identity information of the first organization corresponding to the malicious node corresponding to the first request.

In a sixth aspect, the present application provides a data management device, which can be applied to the central node in the UDM system described in the fifth aspect. The UDM system includes a central node and multiple edge nodes; each edge node is connected to the central node. The nodes are connected, and each edge node is connected to at least one other edge node among the plurality of edge nodes; the edge node has a one-to-one correspondence with the identity information of the first organization. The device includes: an acquisition unit, a processing unit, and a sending unit. The acquisition unit is used to acquire a system log set. The system log set includes edge nodes and event information corresponding to the edge nodes. The processing unit is used for each edge node, when the system logs are concentrated and the event information corresponding to the edge node meets the preset conditions, determine that the edge node is a malicious node, and generate a first request. The sending unit is used to broadcast the first request and the first log corresponding to the first request. The first request is used to request to reveal the identity information of the first organization corresponding to the malicious node. The first log is a system log that centrally records the correspondence of the malicious node. Log of event information. The acquisition unit is also used to obtain the vote of the edge node for the first request. The sending unit is also configured to broadcast the identity information of the first organization corresponding to the malicious node corresponding to the first request when the proportion agreeing to the first request is greater than the preset second proportion in the voting.

In a seventh aspect, this application provides a unified data management UDM system. The UDM system includes a central node and multiple edge nodes; each edge node is connected to the central node, and each edge node is connected to at least one of the multiple edge nodes. Other edge nodes are connected; the first node obtains the authentication information of the first user, and the first user is a user of the subnet corresponding to the first node; the first node is one of multiple edge nodes; the first node broadcasts the first user authentication information; the second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node; the second node is a plurality of edge nodes A node or central node other than the first node; the second node generates the first information based on the result of verifying whether the first user is a valid registered user; the first information is used to indicate whether the first user's authentication information has passed Verification of the second node; the second node sends the first information to the first node; the first node passes the first information verified by the second node according to the instructions, the proportion of all the first information, and the preset third A ratio to determine the authentication result of the first user.

In addition, the unified data management UDM system provided by this application can also perform the steps performed by the first node in the first aspect, the second node in the third aspect, and the central node in the fifth aspect to achieve the above. All functions of the first node in the first aspect, the second node in the above-mentioned third aspect, and the central node in the above-mentioned fifth aspect will not be repeated here.

In an eighth aspect, the present application provides a computer program product. When the computer program product is run on a computer, it causes the computer to execute the steps of the related method described in the first aspect, the third aspect, or the fifth aspect, so as to Implement the method described in the above first aspect, or the third aspect, or the fifth aspect.

In a ninth aspect, the present application provides a network device, which includes: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the network device implements the above first aspect, Or the method described in the third aspect, or the fifth aspect.

In a tenth aspect, the present application provides a computer-readable storage medium. The computer-readable storage medium includes: computer software instructions; when the computer software instructions are run in a network device, the network device enables the network device to implement the first aspect or the third aspect. aspect, or the method described in the fifth aspect.

The beneficial effects of the above-mentioned second to tenth aspects can be referred to those described in the first aspect, and will not be described again.

Description of the drawings

In order to explain the embodiments of the present application or the technical solutions in the prior art more clearly, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a schematic diagram of the connection of the distributed UDM system;

Figure 2 is a schematic connection diagram of the UDM system provided by this application;

Figure 3 is a schematic flow chart of the data management method provided by the embodiment of the present application;

Figure 4 is another schematic flow chart of the data management method provided by the embodiment of the present application;

Figure 5 is a schematic diagram of block composition provided by the embodiment of the present application;

Figure 6 is another schematic flow chart of the data management method provided by the embodiment of the present application;

Figure 7 is a schematic diagram of another block composition provided by an embodiment of the present application;

Figure 8 is a schematic diagram of another block composition provided by an embodiment of the present application;

Figure 9 is a schematic diagram of the composition of the first node provided by the embodiment of the present application;

Figure 10 is another schematic flow chart of the data management method provided by the embodiment of the present application;

Figure 11 is another schematic flow chart of the data management method provided by the embodiment of the present application;

Figure 12 is a schematic diagram of the composition of the data management device provided by the embodiment of the present application;

Figure 13 is a schematic diagram of the composition of another data management device provided by an embodiment of the present application;

Figure 14 is a schematic diagram of the composition of another data management device provided by an embodiment of the present application;

Figure 15 is a schematic structural diagram of a network device provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

It should be noted that in the embodiments of this application, words such as "exemplarily" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "such as" in the embodiments of the present application is not to be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as “first” and “second” are used to distinguish the same or similar items with basically the same functions and effects. Skilled persons can understand that words such as "first" and "second" do not limit the quantity and execution order.

The unified data management (UDM) network element is one of the network elements in the core network of the fifth generation mobile communication technology (5G). UDM network elements can have corresponding relationships with operators. For example, UDM network elements can correspond to operators one-to-one. UDM network elements can be used to store user subscription data and registration information, and perform authentication based on the stored user registration information.

For example, the UDM network element can obtain the authentication information sent by the user equipment. When the authentication information sent by the user equipment matches the registration information stored in the UDM network element, the UDM network element can determine that the user equipment has passed the authentication. After passing the authentication, the UDM network element can send the service information in the user's subscription data to the data plane network element, so that the data plane network element can provide services to the user based on the service information in the user's subscription data. For example, network elements of the data plane may include a data network (DN).

The service information may include quality of service (QoS) information.

For example, taking the quality of service information including delay, throughput, and packet loss rate as an example, the user's quality of service information may be as shown in Table 1 below.

Table 1

As shown in Table 1, the user's quality of service information may include delay, throughput, and packet loss rate. Users may include user 1, user 2, user 3, user 4, user 5, etc.

Among them, the service quality information corresponding to user 1 may include: the delay is less than ("<" means less than) 1 millisecond (ms), the throughput is 1 gigabit per second (Gbps), and the packet loss rate is less than 10 ^-5 ; The service quality information corresponding to user 2 may include: the delay is less than 5ms, the throughput is 1Gbps, and the packet loss rate is less than 10 ^-5 ; the service quality information corresponding to user 3 may include: the delay is less than 10ms, the throughput is 500 Mbits per second (Mbps), and the packet loss rate is less than 10 ^-5 ; the service quality information corresponding to user 4 can include: the delay is less than 20ms, the throughput is 300Mbps, and the packet loss rate is less than 10 ^-4 ; the service quality information corresponding to user 5 The information may include: delay less than 25ms, throughput 150Mbps, and packet loss rate less than 10 ^-3 .

A flexible production line refers to a production line composed of multiple adjustable machine tools connected together with automatic transportation devices. Flexible production lines rely on computer management. Computer management of flexible production lines requires a high availability (HA) network. In order to provide users with a high-availability network, operators have proposed a distributed UDM system. The distributed UDM system can include central UDM network elements and edge UDM network elements. The central UDM network element can be connected to multiple edge UDM network elements in star mode.

Among them, the central UDM network element can store user registration information and contract data of the subnet corresponding to each edge UDM network element. Each edge UDM network element can obtain and store the registration information and subscription data of users in the subnet corresponding to the edge UDM network element from the central UDM network element. Each edge UMD network element can implement the functions of the above UDM network element in the subnet corresponding to the edge UDM network element based on the registration information and subscription data of the user in the subnet corresponding to the edge UDM network element.

However, in the current distributed UDM system, there may be users of edge UDM network elements maliciously disconnecting the edge UDM network element from the central UDM network element, and privately tampering with the user's registration information and information stored in the edge UDM network element. Risks of Contracting Data.

By way of example, Figure 1 is a schematic connection diagram of a distributed UDM system. As shown in Figure 1, the distributed UDM system can include a central UDM network element (the central UDM network element 1 is shown as an example in the figure), and multiple edge UDM network elements (eight are shown as an example in the figure), that is, Edge UDM network element 1, edge UDM network element 2, edge UDM network element 3, edge UDM network element 4, edge UDM network element 5, edge UDM network element 6, edge UDM network element 7, and edge UDM network element 8).

Among them, edge UDM network element 1, edge UDM network element 2, edge UDM network element 3, edge UDM network element 4, edge UDM network element 5, edge UDM network element 6, edge UDM network element 7, and edge UDM network element 8 Each can correspond to a subnet. Center UDM network element 1 can store edge UDM network element 1, edge UDM network element 2, edge UDM network element 3, edge UDM network element 4, edge UDM network element 5, edge UDM network element 6, edge UDM network element 7, and Registration information and subscription data of users in the subnet corresponding to edge UDM network element 8. Edge UDM network element 1, edge UDM network element 2, edge UDM network element 3, edge UDM network element 4, edge UDM network element 5, edge UDM network element 6, edge UDM network element 7, and edge UDM network element 8 can be respectively Obtain the registration information and contract data of users of respective subnets from the central UDM network element 1. And authenticate users in corresponding subnets based on the user's registration information and contract data.

Taking edge UDM network element 1 and the users of the subnet corresponding to edge UDM network element 1, including user 1, as an example, the user of edge UDM network element 1 can maliciously disconnect the edge UDM network element 1 from the central UDM network element 1. , and privately tamper with the registration information of user 1 in edge UDM network element 1, so that user 1 can authenticate according to the privately tampered registration information and obtain services corresponding to the privately tampered registration information.

Against this background technology, this application provides a data management method, which can be applied to UDM systems. The UDM system may include one or more central UDM network elements and multiple edge UDM network elements. When there are multiple central UDM network elements, multiple central UDM network elements can be connected to each other. Each edge UDM network element can be connected to a central UDM network element. For example, edge UDM network elements are connected to adjacent central UDM network elements. For each edge UDM network element, the edge UDM network element can be connected to one or more edge UDM network elements. For example, the edge UDM network element is connected to one or more adjacent edge UDM network elements. When there is only one central UDM network element, all edge UDM network elements can be connected to the central UDM network element.

The central UDM network element can store the user registration information and contract data of the subnet corresponding to each edge UDM network element.

The edge UDM network element can also store user registration information and contract data of the subnet corresponding to each edge UDM network element. For example, the edge UDM network element can obtain the user's registration information and contract data input by the administrator of the subnet corresponding to the edge UDM network element and store them. For another example, the edge UDM network element can also obtain the user's registration information and contract data sent by the central UDM network element and store them. For another example, the edge UDM network element can also obtain and store the user registration information and subscription data of the subnets corresponding to the other edge UDM network elements sent by other edge UDM network elements connected to the edge UDM network element.

For a certain edge UDM network element, the edge UDM network element can also obtain the user's authentication information. The edge UDM network element can also broadcast the user's authentication information to other UDM network elements in the UDM system. Other UDM network elements in the UDM system can generate the first information based on the user's authentication information and the user's registration information stored in other UDM network elements in the UDM system. The edge UDM network element can receive the first information sent by other UDM network elements in the UDM system, and determine the authentication result of the user based on the first information.

For example, take the above-mentioned flexible production line as an example. Edge UDM network element 1 corresponds to subnet 1, and subnet 1 corresponds to factory 1. Factory 1 includes machine tool 1, machine tool 2, machine tool 3, computer 1, computer 2, and computer 3. Computer 1 controls machine tool 1, computer 2 controls machine tool 2, and computer 3 controls machine tool 3. To produce product A, machine tool 1 and machine tool 2 are required, and to produce product B, machine tool 2 and machine tool 3 are required. Assuming that the need to produce product A changes to the need to produce product B, computer 2 and computer 3 need to be re-authenticated. Computer 2 and computer 3 can respectively send authentication requests to edge UDM network element 1. The authentication requests include computer 2 and computer 3. Authentication information of computer 3. Edge UDM network element 1 can authenticate computers 2 and 3. Authentication results can include pass and fail. When the authentication result is passed, computer 2 and computer 3 can access subnet 1 and control machine tool 2 and machine tool 3 respectively, so that machine tool 2 and machine tool 3 cooperate to produce product B.

The data management method provided by the embodiment of the present application is introduced in detail below.

For example, Figure 2 is a connection diagram of the UDM system provided by this application. As shown in Figure 2, the UDM system may include one or more central nodes (three are shown as an example in the figure, namely central node 1, central node 2, and central node 3), and multiple edge nodes (in the figure Four are shown as an example, namely edge node 1, edge node 2, edge node 3, and edge node 4).

Among them, the central node 1, the central node 2, and the central node 3 can be connected to each other. Edge node 1 can be connected to center node 1 and edge node 2. Edge node 2 can be connected to center node 2, edge node 1, and edge node 3. Edge node 3 can be connected to center node 3, edge node 2, and edge node 4. Edge node 4 can be connected to center node 3 and edge node 3.

It should be noted that the central node may be the central UDM network element in Figure 1 above. The edge node may be the edge UDM network element in Figure 1 above. The central node may also be a node in the above-mentioned central UDM network element. That is, the central UDM network element can be composed of multiple central nodes. For example, taking the connection diagram of the UDM system described in Figure 2 as an example, the central node 1, the central node 2, and the central node 3 can also be three nodes in a certain central UDM network element.

Optionally, the central node can belong to the operator, and the proportion of the central node in the UDM system can be between 20% and 50% to ensure the stability and credibility of the UDM system.

Figure 3 is a schematic flowchart of a data management method provided by an embodiment of the present application. As shown in Figure 3, the method may include S301 to S306.

S301. The first node obtains the authentication information of the first user.

The first node can be any edge node in the UDM system. The first user may be a user of the subnet corresponding to the first node.

S302. The first node broadcasts the authentication information of the first user.

Correspondingly, the second node may receive the authentication information of the first user broadcast by the first node.

The second node may be at least one of a plurality of edge nodes other than the first node and a central node.

S303. The second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node.

For example, when the authentication information of the first user matches the registration information of the first user stored in the second node, the second node may determine that the first user is a valid registered user. When the authentication information of the first user does not match the registration information of the first user stored in the second node, the second node may determine that the first user is an invalid registered user.

In a possible implementation, the user's registration information can be directly stored in the central node and edge node in the UDM system. The second node may directly verify whether the first user is a valid registered user based on the authentication information of the first user and the stored registration information of the second user.

In another possible implementation, the user's registration information can be encrypted and stored in the central node and edge nodes in the UDM system. The second node verifies whether the first user is a valid registered user based on the first user's authentication information and the first user's registration information stored in the second node, which may include: the second node's registration information of the first user Decrypt; the second node verifies whether the first user is a valid registered user based on the first user's authentication information and the decrypted first user's registration information.

Optionally, the central node and edge nodes in the UDM system can use the data encryption standard (DES) algorithm, the triple data encryption standard (triple data encryption standard, 3DES) algorithm, and the international data encryption algorithm (international data encryption algorithm). IDEA), and digital signature algorithm (DSA) to encrypt the user's registration information. The embodiments of this application do not limit the specific encryption methods of the central node and edge nodes in the UDM system.

S304. The second node generates the first information based on the result of verifying whether the first user is a valid registered user.

Wherein, as mentioned above, the result of the second node verifying whether the first user is a valid registered user may include: the first user is a valid registered user or not a valid registered user. Correspondingly, the first information may be used to indicate whether the second node passes or fails the authentication information of the first user, or in other words, the first information is used to indicate whether the authentication information of the first user passes the verification of the second node. .

S305. The second node sends the first information to the first node.

Correspondingly, the first node receives the first information sent by the second node.

It should be noted that the second node that sends the first information to the first node may include one or more. That is, the second node sending the first information to the first node may include: at least one second node sending the first information to the first node.

S306. The first node determines the authentication result of the first user based on the first information.

The authentication result of the first user may include pass or fail.

In a possible implementation, the first node determines the authentication result of the first user based on the first information, which may include: the first node determines the authentication result of the first user based on the first information and a preset first ratio. result.

Among them, the first ratio can be preset by the manager. For example, the first ratio is 50%, 70%, etc. The embodiments of this application do not limit the specific numerical value of the first ratio.

Optionally, as mentioned above, the first information may be used to indicate whether the second node passes or fails the authentication information of the first user. The first node determines the authentication result of the first user based on the first information and the preset first ratio, which may include: the first node passes the first information verified by the second node according to the instruction, among all the first information and the preset first ratio to determine the authentication result of the first user.

Illustratively, taking the UDM system shown in Figure 2 above as an example, assume that the first node is edge node 2, the preset first ratio is 50%, and edge node 2 receives the indication in the first information of edge node 1 The first user is an invalid registered user. The edge node 2 receives the first information from the central node 2 indicating that the first user is a valid registered user. The edge node 2 receives the first information from the edge node 3 indicating that the first user is a valid registered user. user. Then the edge node 2 may determine that the authentication result of the first user is passed based on the fact that the proportion of the first information indicating that the first user is a valid registered user is 66.7%, which is greater than the preset first proportion of 50%.

Illustratively, taking the UDM system shown in Figure 2 above as an example, assuming that the first node is edge node 2, the preset first ratio is 50%, and the first information received by edge node 2 is received by edge node 1. Indicates that the first user is an invalid registered user. The edge node 2 receives the first information from the central node 2 indicating that the first user is an invalid registered user. The edge node 2 receives the first information from the edge node 3 indicating that the first user is an invalid registered user. Be a valid registered user. Then the edge node 2 may determine that the authentication result of the first user is failed based on the fact that the proportion of the first information indicating that the first user is a valid registered user is 33.3%, which is less than the preset first proportion of 50%.

Illustratively, taking the UDM system shown in Figure 2 above as an example, assuming that the first node is edge node 1, the preset first ratio is 100%, and the connection between center node 1 and edge node 1 is disconnected, The first information received by edge node 1 from edge node 2 indicates that the first user is a valid registered user. Then the edge node 1 may determine that the authentication result of the first user is passed based on the fact that the proportion of the first information indicating that the first user is a valid registered user is 100%, which is equal to the preset first proportion of 100%.

In the data management method provided by the embodiment of the present application, point to point (P2P) is adopted between the central node and the central node, between the central node and the edge node, and between the edge node and the edge node in the UDM system. Connections, P2P connections are more robust than existing star connections. The central node and each edge node in the UDM system can store the user registration information of the subnet corresponding to each edge node. A certain edge node in the UDM system (such as the first node mentioned above) can obtain the authentication information of users in the subnet corresponding to the edge node and broadcast it. Other edge nodes or central nodes in the UDM system (such as the second node mentioned above) can verify the user's authentication information based on the user's registration information stored in the subnet corresponding to each edge node, and generate The first information is sent to the edge node that broadcasts the user's authentication information. The edge node that broadcasts the user's authentication information can determine the user's authentication result based on the first information. The edge node that broadcasts the user's authentication information can perform normal authentication only after receiving the first information verified by other edge nodes based on the user's authentication information. When a user of an edge node maliciously disconnects the edge node and When connecting to the central node and trying to tamper with the user's registration information privately, the user of the subnet corresponding to the edge node stored in other edge nodes is different from the user's registration information after private tampering. At this time, the edge node will not tamper with privately. Authentication of the user who registered the information. Improved UDM system security.

Optionally, before the first node broadcasts the authentication information of the first user in S302, the first node may also make a preliminary judgment based on the authentication information of the first user and the registration information of the first user stored in the first node. Whether the first user is a valid registered user. After the first node initially determines that the first user is a valid registered user, the first node triggers the step of broadcasting the first user's authentication information. That is, before the first node broadcasts the authentication information of the first user, the method may further include: the first node determines based on the authentication information of the first user and the registration information of the first user stored in the first node. The first user is a valid registered user.

It should be noted that, based on the authentication information of the first user and the registration information of the first user stored in the first node, the first node can preliminarily determine whether the first user is a valid registered user by referring to the second node in S303 above. The authentication information of the first user and the registration information of the first user stored in the second node are as described in the steps of verifying whether the first user is a valid registered user, which will not be described again here.

In the data management method provided by the embodiment of the present application, after the first node obtains the authentication information of the first user, it may first use the authentication information of the first user and the registration information of the first user stored in the first node, Preliminarily determine whether the first user is a valid registered user. After determining that the first user is a valid registered user, the first node triggers the step of broadcasting the first user's authentication information. The first user's authentication information broadcast by the first node has a higher probability of passing the verification of the second node. , which overall improves the efficiency of the UDM system in authenticating the first user.

Optionally, as mentioned above, the edge node can obtain and store the user's registration information and subscription data input by the administrator of the subnet corresponding to the edge node and sent by other edge nodes. That is, in the case where the central node and the edge node are disconnected, the first node may receive a third message sent from an edge node other than the first node and/or input by a manager of the subnet corresponding to the first node. A user’s registration information and contract data.

Similarly, when the central node and the edge node are disconnected, the second node can receive the registration information and subscription data of the first user sent by the first node; the registration information and subscription data of the first user sent by the first node The data may be input by the administrator of the subnet corresponding to the first node and saved by the first node.

In the data management method provided by the embodiment of this application, when the central node or the connection between the central node and the edge node fails, and there are newly registered users or old users who need to change the registration information, the edge node in the UDM system The registration information of newly registered users or the changed registration information of old users can be obtained from the administrator and updated synchronously to other edge nodes of the UDM system. After the update, you can also authenticate newly registered users or old users who have changed their registration information according to the process shown in Figure 3 above. Overall the usability of the UDM system is improved.

In some possible embodiments, the central node and edge nodes in the above UDM system can also be divided into master nodes and slave nodes. The number of master nodes can be one. The slave node may include an edge node different from the master node in the UDM system, or a central node. The master node can generate a block based on the first user's authentication information and broadcast it to the slave node. The slave nodes can vote for the block based on the result of judging whether the first user is a valid registered user. The first node can obtain the voting results and determine the authentication result of the first user based on the voting results.

Optionally, the central node and edge nodes in the UDM system can serve as master nodes according to random queues. For example, a central node or an edge node (can be called a queue node) in the UDM system can use the timestamp as a seed to generate a random queue. The central node and edge nodes in the UDM system can generate random queues according to the random queue. Serve as the master node in sequence. After the central node and edge nodes in the UDM system have served as the master node once in the order of the random queue, another node in the UDM system can use the timestamp as the seed again to generate a new random queue. The central node and the edge node can serve as the master node in sequence in the new random queue, and the cycle continues.

In a possible implementation, the primary node may be the first node. That is, the first node is the master node and the second node is the slave node. Figure 4 is another schematic flow chart of the data management method provided by the embodiment of the present application. As shown in Figure 4, when the first node serves as the master node, the method may include S401 to S407.

S401. The first node obtains the authentication information of the first user.

S401 may refer to the above-mentioned S301, and will not be described again here.

S402. The first node generates a block based on the authentication information of the first user.

The block may include the authentication information of the first user and the identity information of the first node. The identity information of the first node is used by the second node to verify the identity of the first node.

Exemplarily, FIG. 5 is a schematic diagram of block composition provided by the embodiment of the present application. As shown in Figure 5, the block generated by the first node may include a block header, block data, and block metadata. Among them, the block header can include the block number, block hash value, and previous block hash value. The block data may include authentication information of the first user. Block metadata can include the identity information of the master node (block creator, here it can be the first node). The identity information of the master node may include the certificate of the master node, the digital signature of the master node, etc. The node's certificate can be assigned by the operator during registration installation and is used to verify the node's identity. Digital signatures have a corresponding relationship with nodes.

S403. The first node broadcasts the block.

It should be noted that S402 and S403 are also a possible implementation manner of the above-mentioned S302. In other words, the first node broadcasting the authentication information of the first user may include: the first node generates a block based on the authentication information of the first user, and the block includes the authentication information of the first user and the identity of the first node. Information, the identity information of the first node is used by the second node to verify the identity of the first node, and the first node broadcasts the block.

Correspondingly, the second node may receive the block broadcast by the first node.

S404. The second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node.

S404 may refer to the above-mentioned S303, and will not be described again here.

S405. The second node generates the first information based on the result of verifying whether the first user is a valid registered user.

S405 may refer to the above-mentioned S304, and will not be described again here.

S406. The second node sends the first information to the first node.

S406 may refer to the above-mentioned S305, and will not be described again here.

It should be noted that, as mentioned above, master nodes can generate blocks and slave nodes can vote for blocks. In S404 to S406, the second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node. The result of registering the user, generating the first information and sending it to the first node, can be regarded as a form of voting for the block by the second node (slave node).

S407. The first node determines the authentication result of the first user based on the first information.

S407 may refer to the above-mentioned S306, and will not be described again here.

In another possible implementation, the master node may be an edge node other than the first node or a central node in the UDM system. For example, the third node is a node other than the first node or the central node among multiple edge nodes, the third node is the master node, and the nodes in the UDM system except the third node are all slave nodes. Figure 6 is another schematic flowchart of the data management method provided by the embodiment of the present application. As shown in Figure 6, when the third node serves as the master node, the method may include S601 to S608.

S601. The first node obtains the authentication information of the first user.

S601 may refer to the above-mentioned S301, and will not be described again here.

S602. The first node sends the authentication information of the first user to the third node.

Optionally, the first node sending the authentication information of the first user to the third node may include: the first node sending the authentication information of the first user to the third node in the form of broadcast.

S603. The third node generates a block based on the authentication information of the first user.

Among them, the block generated by the third node can be referred to as shown in Figure 5 above, and will not be described again here.

S604. The third node broadcasts the block.

It should be noted that the above-mentioned S602 to S604 is also a possible implementation manner of the above-mentioned S303. In other words, the first node broadcasting the authentication information of the first user may include: the first node sending the authentication information of the first user to the third node, so that the third node generates a block based on the authentication information of the first user. , and broadcast the block.

Correspondingly, the second node may receive the block broadcast by the third node.

S605. The second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node.

S605 may refer to the above-mentioned S303, and will not be described again here.

S606. The second node generates the first information based on the result of verifying whether the first user is a valid registered user.

S606 may refer to the above-mentioned S304, and will not be described again here.

S607. The second node sends the first information to the first node.

It should be noted that, for similar reasons to S404 to S406 above, S605 to S607 can also be regarded as a form of the second node (slave node) voting for the block.

It should also be noted that the above-mentioned S606 to S607 means that after the second node generates the first information based on the result of verifying whether the first user is a valid registered user, it directly sends the first information to the first node for voting.

Optionally, after the second node generates the first information based on the result of verifying whether the first user is a valid registered user, the second node may also send the first information to the third node, and the third node forwards the second information to the first node. The first message sent by the node is voted on.

S608. The first node determines the authentication result of the first user based on the first information.

S608 may refer to the above-mentioned S306, and will not be described again here.

Optionally, when the proportion of votes passed by slave nodes on a block is greater than the preset first proportion, the master node (such as the above-mentioned first node or third node) can also use the block as the highest zone Blocks are added to the blockchain.

In the data management method provided by the embodiment of this application, the edge nodes and central nodes in the UDM system can also be divided into master nodes and slave nodes. The master node can generate a block based on the first user's authentication information and broadcast it to the slave node. Blocks can include block headers, block data, and block metadata. Block metadata can include the identity information of the block creator. Edge nodes and central nodes in the UDM system can be created based on the blocks in the block. The user's identity information is used to supervise the authentication of the first user, which improves the security of the UDM system as a whole.

In addition, the slave nodes can vote for the block based on the result of judging whether the first user is validly registered. The master node aggregates the votes of slave nodes. The first node can obtain the voting results and determine the authentication result of the first user based on the voting results. The authentication process is combined with the consensus process, and the consensus process only includes generating blocks and voting for blocks. Compared with the consensus process of the traditional practical byzantine fault tolerance algorithm (practical byzantine fault tolerance, PBFT), the consensus of this application The process has fewer steps.

It should be noted that, the first node in S301 obtains the authentication information of the first user, and the first node in S302 broadcasts the authentication information of the first user, any second node can also obtain the authentication information of the first user. rights information. That is, after the first node determines that the first user is a valid registered user, each central node and edge node in the UDM system can obtain the authentication information of the first user.

Optionally, after obtaining the authentication information of the first user, the central node and the edge node in the UDM system can record the authentication information of the first user in the temporary account book. The master node generating the block based on the authentication information of the first user may include: the master node generating the block based on the authentication information of the first user recorded in the temporary ledger.

In a possible implementation, the user's authentication information in the block may include one. That is, when the master node obtains the first user's authentication information and records the first user's authentication information in the temporary ledger, the master node can trigger the step of generating a block based on the first user's authentication information. Figure 7 is a schematic diagram of another block composition provided by an embodiment of the present application. As shown in Figure 7, taking the composition of the block shown in Figure 5 above as an example, assuming that the first user is user 1, the block data in the block generated by the master node may include the authentication information of user 1.

In another possible implementation, the user's authentication information in the block can include multiple pieces. When the time difference between the current time and the generation time of the previous block reaches the first period, the master node can trigger the first cycle. Steps to generate blocks of user authentication information. That is, the master node generates a block based on the authentication information of the first user recorded in the temporary ledger, which may include: the master node generates the block based on the authentication information of the first user recorded in the temporary ledger within the first period. . Figure 8 is another schematic diagram of block composition provided by an embodiment of the present application. As shown in Figure 8, taking the composition of the block shown in Figure 5 above as an example, assume that the user's authentication information in the first cycle in the master node's temporary ledger includes user 1's authentication information, user 2's Authentication information, user 3’s authentication information, and user 4’s authentication information, then the block data in the block generated by the master node based on the first user’s authentication information recorded in the temporary ledger in the first cycle, It may include the authentication information of user 1, the authentication information of user 2, the authentication information of user 3, and the authentication information of user 4.

Among them, the first period can be preset by the manager. For example, the first period is 1 second, 2 seconds, etc. The embodiment of this application does not limit the specific duration of the first cycle.

In the data management method provided by the embodiment of the present application, after the first node broadcasts the authentication information of the first user, all nodes in the UDM system can obtain the authentication information of the first user and transfer the authentication information of the first user to Information is recorded in a temporary ledger. The master node can generate blocks based on the authentication information of the first user in the first cycle recorded in the temporary ledger, which can avoid frequent block generation and frequent voting on blocks, and overall improve the user authentication of the UDM system. efficiency of power.

In some possible embodiments, the first node also stores service quality information of users of the subnet corresponding to each edge node. After the first node determines that the first user is a valid registered user, the first node may also determine the service quality information of the first user based on the service quality information of the user of the subnet corresponding to each edge node stored in the first node and Record. Similarly, after the second node determines that the first user is a valid registered user, the second node can also determine the service of the first user based on the service quality information of the users of the subnet corresponding to each edge node stored in the second node. Quality information and records.

Illustratively, taking the first node as an example, the authentication information of the first user may include the identity of the first user. The identity of the first user may be in one-to-one correspondence with the service quality information of the first user. When the first node determines that the authentication result of the first user is passed, the first node can query the service quality information of the user of the subnet corresponding to each edge node stored in the first node according to the identity of the first user, and determine The service quality information of the first user is recorded.

In the data management method provided by the embodiment of the present application, after the first node determines that the first user is a valid registered user, the first node can also determine the service quality information of the first user based on the service quality information stored in the first node and record it. . After the second node determines that the first user is a valid registered user, the second node can determine the service quality information of the first user based on the service quality information stored in the second node and record it. The second node can conduct third-party recording and supervision of the service quality information of the first user, and when the first user has doubts about the service quality actually obtained by the first user, the second node can record and supervise the service quality information of the first user according to the first user's service quality information recorded by the first node and the second node respectively. The service quality information is verified, thereby improving the transparency and credibility of the service.

Optionally, the above steps performed by the first node may be performed by a functional module in the first node. Figure 9 is a schematic diagram of the composition of the first node provided by the embodiment of the present application. As shown in Figure 9, the first node may include a service manager module. The first node obtaining the authentication information of the first user may include: the service management module in the first node obtaining the authentication information of the first user. For example, when the first user's terminal device accesses the subnet corresponding to the first node, it connects to the service management module, and sends the first user's authentication information to the first node through the service management module.

Optionally, edge nodes in the UDM system can also be connected to network elements on the data plane. When the first node determines that the authentication result of the first user is passed, the first node may send the first user's quality of service information to the network element of the data plane, so that the network element of the data plane can use the first user's quality of service information according to the first user's authentication result. Provide services to first users.

For example, the network elements of the data plane may be arranged on the first network device. When the first node determines that the authentication result of the first user is passed, the first node sends the service quality information of the first user to the network element of the data plane, so that the network element of the data plane according to the service quality information of the first user is The first user providing services may include: when the first node determines that the first user's authentication result is passed, the first node sends the first user's quality of service information to the first network device, so that the first network device determines according to the first user's authentication result. The service quality information of one user provides services to the first user.

For another example, the first node may send the service quality information in the first user's subscription data to the first network device through the service management module, so that the first network device provides the first service quality information based on the service quality information in the first user's subscription data. Users provide services.

For example, the network element of the data plane may include a data network (DN).

In some possible embodiments, before the first node sends the first user's quality of service information to the first network device, so that the first network device provides services to the first user based on the first user's quality of service information, the central node also The number of other edge nodes (edge nodes other than the first node) connected to the first node can be obtained. When the number of other edge nodes connected to the first node is less than the preset quantity threshold, the central node may control the first node to send basic service quality information to the first network device, so that the first network device provides the first network device with basic service quality information based on the basic service quality information. A user provides services.

The quantity threshold can be preset by the operator. For example, the quantity threshold is 3, or 4, etc. The embodiments of this application do not limit the specific numerical value of the quantity threshold.

In a possible implementation, the step of the central node obtaining the number of other edge nodes connected to the first node may be performed before S301. Figure 10 is another schematic flowchart of the data management method provided by the embodiment of the present application. As shown in Figure 10, the method may include new edge node registration, new edge node startup, new edge node establishing P2P connection with the old edge node, new edge node establishing P2P connection with the central node, synchronizing users Register information, update node connection status, receive user authentication information, complete user authentication, etc.

1. For the new edge node registration part:

The first organization can apply to the operator for a new edge node based on the identity information of the first organization. When a new edge node is installed for the first time, it can obtain a certificate assigned by the operator based on the identity information of the first organization. The certificate corresponds to the identity information of the first organization one-to-one. The certificate is used to verify the identity of the node and the first organization. The central node in the UDM system can store the identity information of the first organization.

Among them, the first organization can include any unit or individual.

For example, the identity information of the first organization may be as shown in Table 2 below.

Table 2

edge node Certificate First institution’s identity information Edge node 1 Certificate 1 Identity information 1 Edge node 2 Certificate 2 Identity information 2 Edge node 3 Certificate 3 Identity information 3

As shown in Table 2, the table may include edge node items, certificate items, and identity information items of the first organization. The edge node items may include edge nodes such as edge node 1, edge node 2, edge node 3, etc. Certificate items may include certificates such as certificate 1, certificate 2, and certificate 3. The identity information items of the first organization may include identity information of the first organization such as identity information 1, identity information 2, and identity information 3. Edge node 1, certificate 1, and identity information 1 have a corresponding relationship. Edge node 2, certificate 2, and identity information 2 have a corresponding relationship. Edge node 3, certificate 3, and identity information 3 have a corresponding relationship.

2. Start the new edge node part:

After the new edge node is installed for the first time, it can be started for the first time and accept configuration from the administrator.

3. Establish a P2P connection between the new edge node and the old edge node:

After the new edge node is started for the first time and accepts the configuration from the administrator, it can establish P2P connections with the old edge nodes in other geographically adjacent subnets. For example, edge nodes in the same urban area, or edge nodes in the same city, or edge nodes in the same province, or the straight-line distance between edge nodes is less than a preset distance threshold can be called geographical proximity. The embodiments of this application do not limit the specific criteria of geographical proximity.

4. Establish a P2P connection between the new edge node and the central node:

The new edge node can obtain the network topology information for establishing P2P connections with the old edge nodes in other geographically adjacent subnets after the first startup; the new edge node can send its own certificate and the network topology information to the central node. After the central node passes the certificate verification of the new edge node, a P2P connection between the new edge node and the central node can be established.

It can be understood that the above-mentioned central node obtains the number of other edge nodes connected to the first node by the central node according to the network topology information sent by the first node to the central node when the first node establishes the P2P connection part with the central node. get.

5. For the synchronized user registration information part:

As mentioned above, the edge node in the UDM system can obtain the registration information of users of the subnets corresponding to other edge nodes and the subscriptions of users of the operator network from managers, central nodes, and other edge nodes connected to the edge node. Data, edge nodes in the UDM system can regularly synchronize and update user registration information.

6. For the update node connection status part:

Nodes connected to each other in the UDM system can regularly send heartbeat packets to each other and regularly check whether the connection is normal. When an edge node cannot normally receive heartbeat packets sent by other edge nodes connected to the node, the edge node can determine the connection failure of the edge node corresponding to the heartbeat packet that cannot be received normally, and notify the central node Report the certificate of the edge node corresponding to the heartbeat packet that cannot be received normally.

It can be understood that the above-mentioned central node obtains the number of other edge nodes connected to the first node, and can also obtain it based on the certificate of the edge node corresponding to the heartbeat packet reported by the edge node in the UDM system that cannot be received normally.

7. For the part receiving user authentication requests:

As described in S301 above, details will not be repeated here.

8. Complete the user authentication part:

As described in the embodiments shown in FIG. 3 , FIG. 4 , and FIG. 6 , details will not be described again here.

Optionally, as mentioned above, the authentication result of the first user determined by the first node based on the first information may include pass and fail. When the number of other edge nodes connected to the first node is less than a preset number threshold, the central node may send a first instruction to the first node. The first instruction is used to command the first user when the authentication result of the first user is passed. A node sends basic service quality information to the first network device, so that the first network device provides services for the first user according to the basic service quality information.

For example, when the number of other edge nodes connected to the first node is less than a preset quantity threshold, the central node sends a first instruction to the service management module in the first node. The service management module can receive the first instruction. The service management module may also be configured to respond to the first instruction, and when the first node determines that the authentication result of the first user is passed, send basic service quality information to the first network device, so that the first network device determines the first network device according to the basic service quality. Information is provided to the first user.

In the data management method provided by the embodiment of the present application, the central node can obtain the number of other edge nodes connected to the first node. When the first node determines that the authentication result of the first user is passed and the number of other edge nodes connected to the first node is less than the preset quantity threshold, the central node may control the first node to send the basic quality of service to the first network device. information, so that the first network device provides services for the first user according to the basic service quality information. When the number of other edge nodes connected to the first node is too small, there is a risk that subnet users maliciously disconnect the edge node from other edge nodes and the central node, and privately tamper with the user's service quality information. At this time, limiting the service quality information of users in the subnet corresponding to the first node can prevent subnet users from maliciously disconnecting edge nodes from other edge nodes and central nodes, and privately tampering with service quality information, thus improving the security of the UDM system. sex.

As mentioned above, the first organization can apply to the operator for a new edge node based on the identity information of the first organization. When a new edge node is installed for the first time, it can obtain a certificate assigned by the operator based on the identity information of the first organization. The certificate corresponds to the identity information of the first organization one-to-one. The certificate is used to verify the identity of the node and the first organization. The central node in the UDM system can store the identity information of the first organization. And the master node can generate a block based on the first user's authentication information and broadcast it to the slave node. The slave nodes can vote for the block based on the result of judging whether the first user is a valid registered user.

In some possible embodiments, slave nodes can vote anonymously on the block. Certificates can be used to verify identities between edge nodes. That is, the slave nodes vote for the block based on the result of judging whether the first user is a valid registered user, which may include: the slave nodes vote anonymously for the block based on the result of judging whether the first user is a valid registered user. .

Optionally, the central node and edge node in the UDM system can also record each authentication process in their respective system log sets. A system log set can include one or more logs. The log may include edge nodes and event information corresponding to the edge nodes.

Optionally, the central node and edge nodes in the UDM system can also obtain the event information in the system log set. When the event information corresponding to the nodes in the system log meets the preset conditions, the central node and edge nodes in the UDM system Voting can be conducted to reveal the identity information of the first organization corresponding to the edge node.

The following description takes the central node in the UDM system as an example to initiate a vote to reveal the identity information of the first organization corresponding to the edge node. Figure 11 is another schematic flowchart of the data management method provided by the embodiment of the present application. As shown in Figure 11, the method may also include S1101 to S1104.

S1101. The central node obtains the first request and the first log corresponding to the first request.

The first request is used to request to reveal the identity information of the first organization corresponding to the malicious node. The first log may include a system log that centrally records event information corresponding to the malicious node.

In a possible implementation, the first request may be generated by a central node. That is, obtaining the first request by the central node may include: the central node generates the first request according to the system log set.

For example, for each edge node, when the system logs are concentrated and the event information corresponding to the edge node meets the preset conditions, the central node can determine that the edge node is a malicious node and generate a first request.

Among them, preset conditions can include:

1. The number of times an edge node broadcasts incorrect authentication information is greater than the preset threshold.

2. The number of failures of the edge node acting as the master node to generate blocks is greater than the preset threshold.

3. The number of nodes connected to the edge node is less than the number threshold and the duration is longer than the preset duration threshold.

It should be noted that the frequency threshold, duration threshold, etc. can be preset by the administrator in the nodes in the UDM system. For example, the number threshold is 3 times, 5 times, etc. The duration threshold is one week, one month, etc. The embodiments of this application do not place any restrictions on the specific numerical values of the times threshold and the duration threshold.

It should also be noted that in the above preset conditions, the threshold of times corresponding to the edge node broadcasting incorrect authentication information and the threshold of times corresponding to the failure of the edge node to act as the master node to generate blocks can be the same or different. The embodiments of this application have No restrictions.

In another possible implementation, the first request may be generated by an edge node. That is, obtaining the first request by the central node may include: the central node receives the first request sent by the edge node, and the first request is generated by the edge node according to the system log set.

It should be noted that the steps for the edge node to generate the first request may refer to the steps for the central node to generate the first request, and will not be described again here.

S1102. The central node broadcasts the first request and the first log corresponding to the first request.

S1103. The central node obtains the vote of the edge node for the first request.

The edge node's vote on the first request may include agreeing to the first request or not agreeing to the first request.

S1104. When the edge node votes for the first request and the proportion agreeing to the first request is greater than the preset second proportion, the central node broadcasts the identity information of the first organization corresponding to the malicious node corresponding to the first request.

Wherein, the second ratio can be preset in the node in the UDM system by the administrator. For example, the second ratio is 50%, 70%, etc. The embodiments of the present application do not limit the specific numerical value of the second ratio.

It should be noted that when the proportion of nodes agreeing to the first request is less than the preset second proportion, the central node may reject the first request. That is, for each edge node in the UDM system, after the central node obtains the vote for the first request sent by the edge node, it can also based on the proportion of edge nodes that agree to the first request and the preset second proportion, Determine whether to broadcast the identity information of the first organization corresponding to the malicious node corresponding to the first request.

In the data management method provided by the embodiment of the present application, when there is a malicious node in the UDM system, the central node and the edge node in the UDM system can also record each authentication process in their respective system log sets, and record the authentication process according to the system log set. The log set determines the malicious node, and the voting reveals the identity information of the first organization corresponding to the malicious node, thereby preventing the first organization corresponding to the malicious node from continuing to use malicious nodes to interfere with the normal authentication of the UDM system.

In an exemplary embodiment, the functional modules in the above-mentioned first node can also be integrated into units. This embodiment of the present application provides a data management device, which can be applied to the first node in the above method embodiment. Figure 12 is a schematic diagram of the composition of a data management device provided by an embodiment of the present application. As shown in Figure 12, the data management device 1200 may include: an acquisition unit 1201, a sending unit 1202, and a processing unit 1203. The obtaining unit 1201 may be used to obtain authentication information of a first user, where the first user is a user of the subnet corresponding to the first node. The sending unit 1202 may be used to broadcast the authentication information of the first user. The acquisition unit 1201 may also be configured to receive the first information respectively sent from at least one second node; the second node is a node other than the first node among the plurality of edge nodes, and at least one of the central node; the first The information is generated by the second node after verifying whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node; the first information can be used to indicate that the first user is a valid registered user. Whether a user's authentication confidence passes the verification of the second node. The processing unit 1203 may be configured to determine the authentication result of the first user based on the proportion of the first information indicating that it has passed the second node verification in all the first information, and the preset first proportion.

In some possible embodiments, the processing unit 1203 may also be configured to, before the sending unit 1202 broadcasts the authentication information of the first user, based on the authentication information of the first user and the registration of the first user stored in the first node. information to determine that the first user is a valid registered user.

In other possible embodiments, the acquisition unit 1201 may also be used to receive data sent from edge nodes other than the first node when the central node and the edge node are disconnected, and/or the first node corresponds to The administrator of the subnet inputs the registration information of the first user and stores the registration information of the first user.

In some possible embodiments, the sending unit 1202 may be configured to generate a block based on the authentication information of the first user. The block includes the authentication information of the first user and the identity information of the first node; the first node The identity information can be used by the second node to verify the identity of the first node; broadcast block.

In some possible embodiments, the sending unit 1202 may be specifically configured to send the first user's authentication information to a third node, so that the third node generates a block based on the first user's authentication information and broadcasts it; The third node is an edge node or a central node among multiple edge nodes except the first node.

In some possible embodiments, the first node is connected to the first network device, and the first node stores service quality information of users of the subnet corresponding to each edge node; the authentication result of the first user includes: pass or fail. pass. The processing unit 1203 may also be configured to determine and record the service quality information of the first user based on the service quality information of the user in the subnet corresponding to each edge node after determining that the first user is a valid registered user. The sending unit 1202 may also be configured to send the first user's quality of service information to the first network device when the authentication result of the first user is passed, so that the first network device is the first user according to the first user's quality of service information. A user provides services.

In some possible embodiments, the acquisition unit 1201 may also be used to receive a first instruction sent by the central node. The first instruction may be used to instruct the first node to send the first user to the first user when the authentication result is passed. The network device sends basic service quality information; the first instruction is sent by the central node when the number of other edge nodes connected to the first node is less than a preset quantity threshold. The sending unit 1202 may also be configured to respond to the first instruction and, when the authentication result of the first user is passed, send basic service quality information to the first network device, so that the first network device provides the first network device with the basic service quality information based on the basic service quality information. A user provides services.

In some possible embodiments, the central node includes multiple central nodes; multiple central nodes are connected to each other. Each edge node is connected to a central node, which means: each edge node is connected to one of multiple central nodes. The second node is a central node, which means that the second node is one of multiple central nodes.

In an exemplary embodiment, the embodiment of the present application further provides a data management device, which can be applied to the second node in the above method embodiment. Figure 13 is a schematic diagram of the composition of a data management device provided by an embodiment of the present application. As shown in Figure 13, the data management device 1300 may include: an acquisition unit 1301, a processing unit 1302, and a sending unit 1303. The obtaining unit 1301 may be configured to receive the authentication information of the first user broadcast by the first node. The first user is a user of the subnet corresponding to the first node. The processing unit 1302 may be configured to verify whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node; verify whether the first user is valid based on As a result of registering the user, first information is generated, and the first information can be used to indicate whether the authentication information of the first user passes the verification of the second node. The sending unit 1303 may be used to send the first information to the first node, so that the first node passes the first information verified by the second node according to the instruction, the proportion of all the first information, and the preset first Proportion to determine the authentication result of the first user.

In some possible embodiments, the authentication information of the first user broadcast by the first node received by the second node is based on the authentication information of the first user and the registration of the first user stored in the first node. Information, sent after confirming that the first user is a valid registered user.

In other possible embodiments, when the central node and the edge node are disconnected, the registration information of the first user stored in the first node is sent by an edge node other than the first node, and/or the first Input by the administrator of the subnet corresponding to the node.

In some possible embodiments, the acquisition unit 1301 may be configured to receive a block broadcast by the first node. The block is generated by the first node based on the authentication information of the first user. The block includes the authentication information of the first user. Rights information, and identity information of the first node; the identity information of the first node can be used by the second node to verify the identity of the first node.

In some possible embodiments, the acquisition unit 1301 may be specifically configured to receive a block broadcast by a third node. The block is obtained by the third node after the first node sends the first user's authentication information to the third node. Generated according to the authentication information of the first user; the third node is an edge node or a central node among the plurality of edge nodes other than the first node.

In some possible embodiments, the second node stores service quality information of users of the subnet corresponding to each edge node. The processing unit 1302 may also be configured to, when it is determined that the first user is a valid registered user, determine the service quality information of the first user according to the service quality information of the user of the subnet corresponding to each edge node stored in the second node and Record.

In some possible embodiments, the central node includes multiple central nodes; multiple central nodes are connected to each other. Each edge node is connected to a central node, which means: each edge node is connected to one of multiple central nodes. The second node is a central node, which means that the second node is one of multiple central nodes.

In an exemplary embodiment, the embodiment of the present application also provides a data management device, which can be applied to the central node in the above method embodiment. Figure 14 is a schematic diagram of the composition of a data management device provided by an embodiment of the present application. As shown in Figure 14, the data management device 1400 may include: an acquisition unit 1401, a processing unit 1402, and a sending unit 1403. The acquisition unit 1401 can be used to acquire a system log set, which includes edge nodes and event information corresponding to the edge nodes. The processing unit 1402 may be configured to determine, for each edge node, that the edge node is a malicious node and generate a first request when the system logs are concentrated and the event information corresponding to the edge node meets preset conditions. The sending unit 1403 can be used to broadcast the first request and the first log corresponding to the first request. The first request can be used to request to reveal the identity information of the first organization corresponding to the malicious node. The first log is a centralized record of the system log. Logs of event information corresponding to malicious nodes. The obtaining unit 1401 may also be used to obtain the vote of the edge node for the first request. The sending unit 1403 may also be configured to broadcast the identity information of the first organization corresponding to the malicious node corresponding to the first request when the proportion agreeing to the first request is greater than the preset second proportion in the voting.

In an exemplary embodiment, the embodiment of the present application also provides a unified data management UDM system. The UDM system includes a central node and multiple edge nodes; each edge node is connected to the central node, and each edge node Connected to at least one other edge node among the plurality of edge nodes; the first node obtains the authentication information of the first user, and the first user is a user of the subnet corresponding to the first node; the first node is one of the plurality of edge nodes. One; the first node broadcasts the authentication information of the first user; the second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node ; The second node generates the first information based on the result of verifying whether the first user is a valid registered user; the first information is used to indicate whether the authentication information of the first user passes the verification of the second node; the first node generates the first information according to the instruction The authentication result of the first user is determined based on the proportion of the first information verified by the second node in all the first information and the preset first proportion.

It should be noted that the unified data management UDM system provided by the embodiment of the present application can also perform the steps performed by the first node, the second node, the central node, etc. in the above method embodiment to realize the first step in the above method embodiment. All functions of the node, the second node, and the central node will not be described one by one here.

In an exemplary embodiment, the embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, it causes the computer to execute the above related method steps to implement the data management method in the above embodiment. .

In an exemplary embodiment, the embodiment of the present application also provides a network device. Figure 15 is a schematic structural diagram of a network device provided by an embodiment of the present application. As shown in Figure 15, the network device may include: a processor 1501 and a memory 1502; the memory 1502 stores instructions executable by the processor 1501; when the processor 1501 is configured to execute the instructions, the network device implements the foregoing method embodiments. the method described in .

In an exemplary embodiment, embodiments of the present application also provide a computer-readable storage medium on which computer program instructions are stored; when the computer program instructions are executed by a network device, the network device implements the foregoing embodiments the method described in . The computer-readable storage medium may be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device wait.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be covered by the protection scope of the present application. . Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims (11)

1. A data management method, characterized in that the method is applied to the first node in a unified data management UDM system. The UDM system includes a central node and a plurality of edge nodes; each of the edge nodes is connected to the first node in the unified data management UDM system. The central node is connected, and each of the edge nodes is connected to at least one other edge node among the plurality of edge nodes; the first node is one of the plurality of edge nodes; The methods include: The first node obtains authentication information of a first user, and the first user is a user of the subnet corresponding to the first node; The first node broadcasts the authentication information of the first user; The first node receives the first information respectively sent from at least one second node; the second node is a node other than the first node among the plurality of edge nodes or the central node; The first information is generated after the second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node. ; the first information is used to indicate whether the authentication information of the first user passes the verification of the second node; The first node determines the authentication of the first user based on the proportion of the first information that is indicated to be verified by the second node in all the first information, and a preset first proportion. right result; When the central node and the edge node are disconnected, the first node receives data sent from edge nodes other than the first node, and/or the subnet corresponding to the first node The registration information of the first user input by the administrator, and the registration information of the first user is stored. 2. The method according to claim 1, characterized in that before the first node broadcasts the authentication information of the first user, the method further includes: The first node determines that the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the first node. 3. The method according to claim 1, characterized in that the first node broadcasts the authentication information of the first user, including: The first node generates a block based on the first user's authentication information; the block includes the first user's authentication information and the first node's identity information; the first node's The identity information is used by the second node to verify the identity of the first node; The first node broadcasts the block. 4. The method according to claim 1, characterized in that the first node broadcasts the authentication information of the first user, including: The first node sends the first user's authentication information to a third node, so that the third node generates a block based on the first user's authentication information and broadcasts the block; The third node is an edge node other than the first node among the plurality of edge nodes or the center node. 5. The method according to any one of claims 1 to 4, characterized in that the first node is connected to a first network device, and the first node stores information about the subnet corresponding to each edge node. The user's quality of service information; the authentication result of the first user includes: pass or fail; the method also includes: After the first node determines that the first user is a valid registered user, it determines and records the service quality information of the first user based on the service quality information of the user in the subnet corresponding to each edge node; When the authentication result of the first user is passed, the first node sends the service quality information of the first user to the first network device, so that the first network device performs the authentication according to the first The user's quality of service information provides services to the first user. 6. The method according to any one of claims 1 to 4, characterized in that the first node is connected to a first network device, and the first node stores information about the subnet corresponding to each edge node. The user's quality of service information; the authentication result of the first user includes: pass or fail; the method also includes: The first node receives a first instruction sent by the central node, and the first instruction is used to instruct the first node to send a message to the first network device when the authentication result of the first user is passed. Send basic quality of service information; the first instruction is sent by the central node when the number of other edge nodes connected to the first node is less than a preset quantity threshold; In response to the first instruction, when the authentication result of the first user is passed, the first node sends the basic quality of service information to the first network device, so that the first network device Provide services to the first user according to the basic service quality information. 7. The method according to claim 1, characterized in that the central node includes multiple; A plurality of said central nodes are connected to each other; The connection between each edge node and the central node means: each edge node is connected to one of the plurality of central nodes; The second node being the central node means that the second node is one of a plurality of central nodes. 8. A data management device, characterized in that the device is applied to the first node in a unified data management UDM system. The UDM system includes a central node and a plurality of edge nodes; each edge node is connected to the The central node is connected, and each edge node is connected to at least one other edge node among the plurality of edge nodes; the first node is one of a plurality of edge nodes, and the first node The registration information of users of the subnet corresponding to each edge node is stored; The device includes: an acquisition unit, a sending unit, and a processing unit; The obtaining unit is used to obtain authentication information of a first user, where the first user is a user of the subnet corresponding to the first node; The sending unit is used to broadcast the authentication information of the first user; The acquisition unit is also configured to receive the first information respectively sent from at least one second node; the second node is a node other than the first node among the plurality of edge nodes or the central node. ; The first information is after the second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node. The second node is determined based on the result of verifying whether the first user is a valid registered user; the first information is used to instruct the first node to pass the first user's authentication information, or not to pass the first user's authentication information. Authentication information of the first user; The processing unit is configured to determine the first node according to a proportion of the first information sent by at least one second node indicating that the first node passes the first user's authentication information and a preset first proportion. User’s authentication results; The acquisition unit is also configured to receive data sent from edge nodes other than the first node when the central node and the edge node are disconnected, and/or the first node corresponds to The administrator of the subnet inputs the registration information of the first user, and stores the registration information of the first user. 9. A network device, characterized in that the network device includes: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instruction, the network device implements the method according to any one of claims 1-7. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium includes: computer software instructions; When the computer software instructions are run in the network device, the network device is caused to implement the method according to any one of claims 1-7. 11. A unified data management UDM system, characterized in that the UDM system includes a central node and a plurality of edge nodes; each edge node is connected to the central node, and each edge node is connected to all edge nodes. At least one other edge node among the plurality of edge nodes is connected; The first node obtains the authentication information of the first user, and the first user is a user of the subnet corresponding to the first node; the first node is one of a plurality of edge nodes; The first node broadcasts the authentication information of the first user; The second node verifies whether the first user is a valid registered user based on the authentication information of the first user and the registration information of the first user stored in the second node; the second node is a plurality of the edge Nodes other than the first node or the central node among the nodes; The second node generates first information based on the result of verifying whether the first user is a valid registered user; the first information is used to indicate whether the authentication information of the first user passes the verification of the second node; The second node sends the first information to the first node; The first node determines the authentication of the first user based on the proportion of the first information that is indicated to be verified by the second node in all the first information, and a preset first proportion. right result; When the central node and the edge node are disconnected, the first node receives data sent from edge nodes other than the first node, and/or the subnet corresponding to the first node The registration information of the first user input by the administrator, and the registration information of the first user is stored.