Private network security access system, method and equipment based on identity strategy

Abstract

The invention relates to the field of network security, and particularly discloses a private network security access system based on an identity strategy, comprising: a 5G private network networking module, which is used for constructing an independently networked 5G network and comprises an operator core network control plane network element, a session management function module, a user plane function module and a 5G security gateway, wherein the 5G security gateway is deployed in a school central computer room and is connected with an operator private network user plane function module through a GRE tunnel (universal routing encapsulation); through an independent networking mode, an efficient and safe 5G private network environment is constructed, safe transmission of data is achieved, stable and high-speed network connection is provided for users, and meanwhile confidentiality, integrity and usability of the data are ensured; and the identity strategy module carries out strict identity strategy on the access equipment by inquiring the campus unified identity strategy platform, so that the unauthorized equipment is effectively prevented from accessing the private network, and the security of the system is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a private network security access system, method and equipment based on identity strategy. Background Art

[0002] With the popularization and deepening of the Internet, the security situation in cyberspace has become increasingly severe. Hacker attacks, virus transmission, data leakage and other network security incidents have occurred frequently, causing huge losses to individuals, enterprises and the country. Especially in the special environment of colleges and universities, due to the characteristics of large amount of information, dense personnel and complex systems, network security issues are more prominent. Therefore, it is particularly important to strengthen network security protection in colleges and universities and build a safe and reliable information system access environment.

[0003] Traditional network security protection solutions have problems such as large exposure, insufficient identity authentication and access control, and are unable to meet the current digital and intelligent needs of university information construction and education management methods. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a private network security access system, method and equipment based on identity strategy to solve the problems of large exposure, insufficient identity authentication and access control in traditional network security protection solutions in the prior art, and difficulty in meeting the current digital and intelligent needs of university informatization construction and education management methods.

[0005] A private network security access system based on identity policy, comprising: 5G private network module: used to build an independent 5G network, including the operator's core network control plane network element, session management function module, user plane function module and 5G security gateway. The 5G security gateway is deployed in the school's central computer room and connected to the operator's private network user plane function module through a GRE tunnel (generic routing encapsulation); Identity policy module: It is set in the 5G security gateway and is used to receive policy messages from the operator network. The message contains the international mobile equipment identity code of the device, the card number of the mobile phone card and the IoT card, and the billing ID. It also queries the unified identity policy platform within the school to determine whether the access device has the permission to access the intranet. Authorization and billing module: After the identity policy is passed, the user is assigned intranet usage rights according to the database records, and the user registration, security policy initialization and security policy binding operations are completed on the security layer application, and the billing message from the operator network is received at the same time; Security protection module: It is set in the security layer of the 5G security gateway to prevent scanning, virus, vulnerability and DDoS of network data, and block illegal external connections and illegal access in real time; Multi-tenant support and isolation module: used to support multi-tenant environment and provide each tenant with an independent network environment and resources by isolating the network environment and resources of different tenants.

[0006] Preferably, a log recording module is also included to record user access behavior, access records and security events, providing a basis for network security auditing and troubleshooting.

[0007] Preferably, it also includes realizing the dynamic security policy configuration capability of the 5G security gateway, specifically including: Policy Decision Engine: An advanced policy decision engine is integrated inside the 5G security gateway, which can make a comprehensive assessment based on the user's identity information, access time, and access behavior factors; Real-time data analysis: Through built-in or external data analysis modules, network traffic data, user behavior logs, and security incident reports are collected and analyzed in real time to identify potential security threats or abnormal behavior patterns; Dynamic policy adjustment: Based on the evaluation results of the policy decision engine and the findings of real-time data analysis, the system automatically triggers the adjustment of security policies, including adjusting access control rules, enhancing data encryption strength, and restricting specific types of network traffic or user behavior; Policy execution and feedback: The adjusted security policy is immediately executed by the 5G security gateway, and the system records detailed information about the policy change, including the time and reason of the change, as well as the effect of the changed policy; User notification and feedback mechanism: When there are significant changes in policies, the system provides timely notifications and explanations to affected users or administrators via SMS, email, or in-app notifications.

[0008] Preferably, the multi-tenant support and isolation module further includes: Tenant management unit: used to manage tenant registration, deregistration and tenant information update; Resource allocation unit: allocates independent network resources and security policies to tenants based on their needs and permissions.

[0009] A method for secure access to a private network based on identity policy, comprising the following steps: Step A: When a mobile phone or IoT terminal device accesses the operator network, the network access policy is triggered, and the operator network copies the policy message to the 5G security gateway; Step B: The identity policy module of the 5G security gateway receives the policy message and queries the unified identity policy platform on campus to see whether the device IMEI is legal, whether the mobile phone card or IoT card number is valid, whether the user has registered and has the corresponding access rights, and whether the access device has the right to access the intranet. Based on the above query content, the identity policy module will decide whether to allow the device to access the intranet. If the device information is legal, the card number is valid, and the user has access rights, access is allowed; otherwise, access is denied and may trigger corresponding security alarms or record logs; Step C: If the user has access rights, the authorization phase begins. The authorization and billing module assigns intranet usage rights to the user based on database records, completes related operations on the security layer application, and assigns an independent network environment and resources to the user based on tenant information. Relevant operations include user registration: formally recording user information in the system to ensure the accuracy and traceability of user identity; Security policy initialization: configure initial security policy settings for users, including access control rules, encryption requirements, and data integrity checks; Security policy binding: Bind specific security policies to users or devices to ensure that users always comply with these policies when using intranet resources; Step D: The 5G security gateway receives the billing message from the operator network, implements the binding of IPv4 address, IPv6 prefix and security policy, and billing management; Step E: When the mobile phone or IoT terminal device is disconnected from the operator's network, the authorization and billing module of the 5G security gateway removes the security policy, reclaims the user's access to the intranet, and releases the network resources allocated to the user.

[0010] A private network security access device based on identity policy, comprising: Physical hardware layer: includes the physical interface used to connect to the operator's network; Virtual network layer: forms a complete system encapsulated in a physical box through virtual network connection policies, authorization, billing, security protection, multi-tenant support and isolation components; Input / output memory management unit: used to implement direct memory access between the physical layer and the virtual network layer; Security layer application: runs on the virtual network layer and is responsible for the implementation of identity policy, authorization, billing, security protection, and multi-tenant management functions. It also implements identity-based secure access control by binding security policies to Ethernet traffic.

[0011] Preferably, it also includes an operating system kernel bridge for connecting applications with low network data transmission rate requirements, including policy management, authorization processing, billing system, controller function, logging, network time synchronization protocol service and tenant management related applications.

[0012] Compared with the prior art, the present invention has the following beneficial effects: Through independent networking, an efficient and secure 5G private network environment is built to achieve secure data transmission, which provides users with a stable and high-speed network connection while ensuring the confidentiality, integrity and availability of data. The identity policy module queries the school's unified identity policy platform and implements strict identity policies for access devices, effectively preventing unauthorized devices from accessing the private network and improving the security of the system. This mechanism ensures that only legitimate users and devices can access intranet resources, reducing security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a diagram of a private network security access system based on identity strategy of the present invention; Figure 2 This is the 5G private network topology diagram of the present invention; Figure 3 This is a schematic diagram of the virtual network topology of the 5G security gateway of the present invention; Figure 4 This is a schematic diagram of the security strategy based on mobile phone numbers of the present invention; Figure 5 This is a schematic diagram of traffic presentation based on mobile phone numbers in the present invention; Figure 6 The present invention is a flow chart of a private network security access method based on identity strategy. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] like Figure 1 As shown: Embodiment 1: The present invention provides a private network security access system based on identity policy, comprising: 5G private network module: adopts an independent networking mode, including the operator's core network control plane network element, session management function module, user plane function module and 5G security gateway. The 5G security gateway is deployed in the school's central computer room and connected to the operator's private network user plane function module through a GRE tunnel to achieve secure data transmission; This module adopts an independent networking (SA) mode to build an efficient and secure 5G private network environment. This networking mode covers the operator's core network control plane network elements (such as AMF), session management function module (SMF), user plane function module (UPF) and customized 5G security gateway; among them, the 5G security gateway is deployed in the school's central computer room, and seamlessly connected with the operator's private network user plane function module (UPF) through the GRE tunnel, ensuring the security and integrity of data during transmission.

[0016] Identity policy module: It is set in the 5G security gateway and is used to receive policy messages from the operator network. The message contains the international mobile equipment identity code of the device, the card number of the mobile phone card and the IoT card, and the billing ID. It also queries the unified identity policy platform within the school to determine whether the access device has the permission to access the intranet. This module is built into the 5G security gateway and is responsible for implementing identity policies for access devices. When a mobile phone or IoT terminal device accesses the operator's network, the network access policy process will be triggered. At this time, SMF will copy the policy message containing the device's International Mobile Equipment Identity (IMEI), mobile phone card or IoT card number, and billing ID to the 5G security gateway; the identity policy module will then query the school's unified identity policy platform to determine whether the device has the authority to access the intranet. This mechanism effectively prevents unauthorized devices from accessing the private network and improves the security of the system. Authorization and billing module: After the identity policy is passed, the user is assigned intranet usage rights according to the database records, and the user registration, security policy initialization and security policy binding operations are completed on the security layer application. At the same time, the billing message from the operator network is received to realize the binding of IPv4 address, IPv6 prefix and security policy, as well as billing management; After the identity policy is passed, the authorization and billing module will assign intranet usage rights to users based on the records in the database. During this process, the module will complete user registration, security policy initialization, and security policy binding on the security layer application to ensure that users can smoothly access intranet resources. At the same time, the module is also responsible for receiving billing messages from the operator network, binding IPv4 addresses, IPv6 prefixes and security policies, as well as accurate billing management. This mechanism not only improves the convenience of user access, but also ensures the accuracy and transparency of the billing process.

[0017] Security protection module: It is set in the security layer of the 5G security gateway to prevent scanning, virus, vulnerability and DDoS of network data, block illegal external connections and illegal access in real time, and ensure the security of the entire 5G security gateway itself; The security protection module is one of the core components of the 5G security gateway. It is set in the security layer of the gateway. The module performs comprehensive anti-scanning, anti-virus, anti-vulnerability, and anti-DDoS processing on network data, and blocks illegal external connections and illegal access in real time, thereby effectively protecting the security of the entire 5G security gateway and intranet system. Through this mechanism, the system can effectively resist various network attacks and security threats, and ensure the confidentiality, integrity and availability of data.

[0018] like Figure 2 As shown in the figure: When a mobile phone accesses public network services, the data flow passes through the operator's mobile phone access point intelligent diversion UPF and its supporting bearer equipment, and enters the public network from the local computer room of the access point operator. When accessing the school's intranet services, the data flow is forwarded to the intelligent diversion UPF through the core network of the mobile phone access point, and the intelligent diversion UPF then forwards it to the private network UPF. The private network UPF then sends the data to the school-side 5G security gateway through the GRE tunnel. After further processing by the 5G security gateway, it finally reaches the intranet server. The way IoT devices access the school's intranet is basically the same as the way mobile phones access it, except that the former is a ToC (ToC) service and the latter is a ToB (ToB) service. The two belong to different 5GC (5G core network), so it is necessary to build a dedicated UPF for IoT terminals and establish a GRE tunnel with the 5G gateway to transmit user traffic.

[0019] Multi-tenant support and isolation module: used to support multi-tenant environment and provide each tenant with independent network environment and resources. By isolating the network environment and resources of different tenants, mutual influence and interference between tenants can be prevented. In order to meet the needs of different tenants and ensure their security, this system is also designed with a multi-tenant support and isolation module, which can support multi-tenant environments and provide independent network resources and security policy configurations for each tenant. By implementing a strict tenant isolation mechanism, the system can effectively prevent mutual influence and potential security risks between tenants. This feature enables this system to be widely used in various scenarios such as universities, enterprises, and government agencies to meet the diverse needs of different users.

[0020] Specifically, it also includes a log recording module, which is used to record user access behavior, access records and security events, provide a basis for network security auditing and troubleshooting, and help to promptly discover and deal with potential security risks.

[0021] Specifically, the 5G security gateway also has the ability to dynamically configure security policies. It can adjust security policies in real time based on user identity information, access time, and access behavior factors, thereby improving the flexibility and effectiveness of network security protection. It can also better adapt to the ever-changing network environment and ensure the secure transmission of user data.

[0022] Specifically, the multi-tenant support and isolation module further includes: Tenant management unit: used to manage tenant registration, deregistration and tenant information update to ensure the accuracy and completeness of tenant information; Resource allocation unit: allocates independent network resources and security policies to tenants according to their needs and permissions, achieving effective isolation between tenants and efficient use of resources.

[0023] like Figure 3 As shown: To ensure network processing performance, IOMMU (input / output memory management unit) technology is used between the physical layer X0 and X1 interfaces and the security layer 1 / 1 and 1 / 2 virtual interfaces to achieve network direct access through DMA (direct memory access). The principle is that when the application of the security layer needs to access physical network data, it sends a request to the IOMMU, which contains the physical address of the device. The IOMMU converts the physical address of the device into the virtual address of the system memory according to the address translation table and forwards the request to the memory controller. The memory controller returns the data to the IOMMU according to the virtual address. The IOMMU then returns the network data to the security layer application, reducing the operating system kernel processing process and improving the network throughput. At the same time, in order to maintain the flexibility of the system, applications such as AAA (policy, authorization, accounting), Controller, log, and NTP (network time protocol) that do not require high network throughput are connected using the operating system kernel bridge. These applications control the operation behavior of the entire 5G security gateway and are strictly protected by the security layer application. Their interaction with the external network must be permitted by the security layer application. The security layer application also performs anti-scanning, anti-virus, anti-vulnerability, and anti-DDoS operations on the traffic accessing them, blocking illegal external connections and illegal access in real time, effectively ensuring the security of the entire 5G security gateway itself.

[0024] The implementation logic and main process of the 5G security gateway are as follows: When a mobile phone or IoT terminal device accesses the operator's network, the network access policy will be triggered, and SMF will copy the policy message to the 5G security gateway. The message contains the device IMEI number (International Mobile Equipment Identity), mobile phone card or IoT card number, and billing ID. After the 5G security gateway receives the policy message, it first enters the Authentication stage. In this stage, the policy module will query the school's unified identity policy platform to determine whether the mobile phone or IoT device has the right to access the intranet. If it has the corresponding authority, it will enter the Authorization stage. In this stage, the authorization module will query the database for relevant records to obtain the user's permission to enter the intranet, and complete user registration, security policy initialization or security policy binding on the security layer application, and then send the result of the policy success to SMF. After receiving the policy success message, SMF will immediately copy the billing start message to the 5G security gateway. In addition to the IMEI number, mobile phone card or IoT card number, and billing ID, the billing message also includes the user's IPv4 address and IPv6 prefix. After receiving the billing message, the 5G security gateway immediately enters the Accounting stage. In this stage, the 5G security gateway will implement the binding of IPv4 address, IPv6 prefix and security policy, such as Figure 4 This is a schematic diagram of the security strategy based on mobile phone numbers of the present invention.

[0025] When a mobile phone or IoT terminal device disconnects from the operator's network, SMF will copy the billing end message to the 5G security gateway. When the 5G security gateway receives the billing end message, it will immediately remove the security policy of the security layer, thereby reclaiming the user's access to the intranet.

[0026] It should be noted that the security policy of the security layer can be static or dynamic. However, whether it is dynamic or static, it is configured based on the mobile phone number / IoT card number and IMEI number, not based on the IP address. In this way, the identity-based security policy is bound to the Ethernet traffic.

[0027] This system makes full use of the powerful capabilities of the operator's 5GC and the unique functions of the customized 5G gateway to organically integrate encryption, transmission, policy, authorization, billing, firewall, log and other elements. It realizes the interconnection between the operator's 5G network and the campus intranet through air interface encryption and secondary policy technology, and realizes the refined management and visual presentation of traffic based on identity information. At the same time, it solves the problem of real-name access management of IoT terminals that does not rely on specific services. The system has commercial-level identity strategy and security protection capabilities, which can effectively solve the contradiction between the "exposure" and "convenient use" of information systems, and can prevent illegal access to the campus network through forging or borrowing identity information, account trading, etc. to a large extent, ensuring the authenticity and uniqueness of user traceability, such as Figure 5 It is a schematic diagram of presenting traffic based on mobile phone numbers in the present invention.

[0028] From the above, it can be seen that this system builds an efficient and secure network environment through the 5G private network networking module, and uses the 5G security gateway and the operator's private network to achieve seamless and secure data transmission. The identity policy module ensures that only authorized devices can access the intranet, which improves security. The authorization and billing module allocates permissions according to user identity and accurately manages billing, which improves the convenience of user access and the transparency of the billing process. The security protection module comprehensively protects network data, blocks illegal access in real time, and ensures system security. The multi-tenant support and isolation module supports multi-tenant environment, provides independent resources and security policies, and prevents interference between tenants. In addition, the system also includes a logging module to record user behavior and security incidents. The 5G security gateway has the ability to configure dynamic security policies. The multi-tenant module also includes tenant management and resource allocation units. Overall, this system meets the security access needs in various scenarios such as universities, enterprises, and government agencies, and provides a flexible, efficient, and secure network access solution.

[0029] like Figure 6 As shown: Embodiment 2: A method for secure access to a private network based on identity strategy, comprising the following steps: Step A: When a mobile phone or IoT terminal device accesses the operator network, the network access policy is triggered, and the operator network copies the policy message to the 5G security gateway; Specifically, when a user-end device such as a mobile phone or IoT terminal device attempts to access the operator's network, the network access policy process will be triggered first. This process is designed to ensure that only authorized devices can access the network, thereby initially ensuring the security of the network; After receiving the device access request, the operator network will generate a policy message containing device information (such as the International Mobile Equipment Identity (IMEI), mobile phone card or IoT card number, etc.), and copy the message to the 5G security gateway deployed in the private network.

[0030] Step B: The identity policy module of the 5G security gateway receives the policy message and queries the unified identity policy platform within the school to determine whether the access device has the permission to access the intranet; Specifically, the identity policy module of the 5G security gateway is responsible for receiving policy messages from the operator network; This module will parse the device information in the policy message and query the school's unified identity policy platform (which usually contains the device information of all legitimate users and their corresponding access rights); By comparing the device information in the policy message with the records in the identity policy platform, the identity policy module can determine whether the access device has the authority to access the intranet.

[0031] Step C: If the user has access rights, the authorization phase begins. The authorization and billing module assigns intranet usage rights to the user based on database records, completes related operations on the security layer application, and assigns an independent network environment and resources to the user based on tenant information. Specifically, if the device has permission to access the intranet, it enters the authorization stage.

[0032] The authorization and billing module assigns intranet usage permissions to users based on records in the database, which usually include permissions to access specific resources and perform specific operations; In the security layer application, the authorization and billing module will also complete operations such as user registration, security policy initialization, and security policy binding to ensure that users can access intranet resources safely and smoothly; At the same time, the module will also allocate independent network environments and resources to users based on tenant information (such as the organization or department to which the user belongs) to achieve effective isolation between multiple tenants and efficient use of resources.

[0033] Step D: The 5G security gateway receives the billing message from the operator network, implements the binding of IPv4 address, IPv6 prefix and security policy, and billing management; Specifically, the 5G security gateway also receives billing messages from the operator network, which usually contain the user's billing information (such as usage, fees, etc.); The authorization and accounting module will bind the IPv4 address, IPv6 prefix and security policy according to the information in the accounting message to ensure that users can comply with the corresponding security policy when using network resources; At the same time, this module will also perform billing management, record the user's expenses, and provide a basis for subsequent fee settlement.

[0034] Step E: When the mobile phone or IoT terminal device is disconnected from the operator's network, the authorization and billing module of the 5G security gateway removes the security policy, reclaims the user's access to the intranet, and releases the network resources allocated to the user; Specifically, when a user-end device such as a mobile phone or IoT terminal device disconnects from the operator's network, the authorization and billing module of the 5G security gateway will immediately detect this change; To ensure the security and efficient use of network resources, this module will immediately remove the security policy previously assigned to the user and revoke the user's access to the intranet; At the same time, the module will also release the network resources previously allocated to the user, such as IP address, network bandwidth, etc., in order to provide services to other users.

[0035] As can be seen from the above, this method first triggers the network access policy process. When a mobile phone or IoT terminal device accesses the operator network, the operator network will copy the policy message to the 5G security gateway. Then, the identity policy module of the 5G security gateway receives the policy message and queries the unified identity policy platform on campus to verify whether the access device has the authority to access the intranet. If the device has access rights, it enters the authorization stage, and the authorization and billing module allocates intranet usage rights and independent network environment and resources to the user. At the same time, the 5G security gateway can also receive billing messages from the operator network to realize the binding of IP addresses and security policies and billing management. Finally, when the device disconnects from the operator network, the authorization and billing module will dismantle the security policy, reclaim user rights, and release network resources. The entire method process ensures the security, flexibility and effectiveness of private network access, and is suitable for network access needs in various scenarios.

[0036] Embodiment 3: A private network security access device based on identity policy, comprising: Physical hardware layer: includes the physical interface used to connect to the operator's network; Virtual network layer: forms a complete system encapsulated in a physical box through virtual network connection policies, authorization, billing, security protection, multi-tenant support and isolation components; Input / output memory management unit: used to achieve direct memory access between the physical layer and the virtual network layer, improve network pass-through capability, and ensure network processing performance; Security layer application: runs on the virtual network layer and is responsible for the implementation of identity policy, authorization, billing, security protection, and multi-tenant management functions. It also implements identity-based secure access control by binding security policies to Ethernet traffic.

[0037] Specifically, it also includes an operating system kernel bridge, which is used to connect applications that do not require high network throughput, including policies, authorization, billing, controllers, logs, network time protocols, and tenant management related applications, to improve the flexibility and scalability of the system.

[0038] As can be seen from the above, this access device is composed of core parts such as the physical hardware layer, virtual network layer, input and output memory management unit and security layer application. The physical hardware layer provides a connection interface with the operator network, and the virtual network layer integrates key components such as policy, authorization, billing, security protection and multi-tenant support to form a compact system package. The input and output memory management unit enhances the data flow efficiency between the physical layer and the virtual layer through direct memory access technology, ensuring high performance of network processing. The security layer application runs on the virtual network layer, realizing identity-based secure access control and integrating multi-tenant management functions. In addition, the device also connects to applications with low throughput requirements through the operating system kernel bridge, which improves the flexibility and scalability of the system and provides solid technical support for secure access to private networks.

[0039] The standard parts used in the present invention can all be purchased from the market, and the special-shaped parts can be customized according to the description and the drawings. The specific connection methods of each part adopt conventional means such as mature bolts, rivets, welding, etc. in the prior art. The machinery, parts and equipment all adopt conventional models in the prior art, and the circuit connection adopts the conventional connection method in the prior art, which will not be described in detail here. The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0040] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. "Multiple" means two or more, unless otherwise clearly and specifically defined.

[0041] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0042] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature being "above", "above" or "above" a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below", "below" or "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0043] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0044] In the drawings of the embodiments disclosed in the present invention, only the structures related to the embodiments disclosed in the present invention are involved, and other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of the present invention can be combined with each other.

[0045] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A private network security access system based on identity strategy, characterized in that: include: 5G private network module: used to build an independent 5G network, including the operator's core network control plane network element, session management function module, user plane function module and 5G security gateway. The 5G security gateway is deployed in the school's central computer room and connected to the operator's private network user plane function module through a GRE tunnel (generic routing encapsulation); Identity policy module: It is set in the 5G security gateway and is used to receive policy messages from the operator network. The message contains the international mobile equipment identity code of the device, the card number of the mobile phone card and the IoT card, and the billing ID. It also queries the unified identity policy platform within the school to determine whether the access device has the permission to access the intranet. Authorization and billing module: After the identity policy is passed, the user is assigned intranet usage rights according to the database records, and the user registration, security policy initialization and security policy binding operations are completed on the security layer application, and the billing message from the operator network is received at the same time; Security protection module: It is set in the security layer of the 5G security gateway to prevent scanning, virus, vulnerability and DDoS of network data, and block illegal external connections and illegal access in real time; Multi-tenant support and isolation module: used to support multi-tenant environment and provide each tenant with an independent network environment and resources by isolating the network environment and resources of different tenants.

2. A private network security access system based on identity policy as claimed in claim 1, characterized in that: It also includes a log recording module, which is used to record user access behavior, access records, and security events, providing a basis for network security auditing and troubleshooting.

3. A private network security access system based on identity policy as claimed in claim 2, characterized in that: It also includes the ability to implement dynamic security policy configuration for 5G security gateways, including: Policy Decision Engine: An advanced policy decision engine is integrated inside the 5G security gateway, which can make a comprehensive assessment based on the user's identity information, access time, and access behavior factors; Real-time data analysis: Through built-in or external data analysis modules, network traffic data, user behavior logs, and security incident reports are collected and analyzed in real time to identify potential security threats or abnormal behavior patterns; Dynamic policy adjustment: Based on the evaluation results of the policy decision engine and the findings of real-time data analysis, the system automatically triggers the adjustment of security policies, including adjusting access control rules, enhancing data encryption strength, and restricting specific types of network traffic or user behavior; Policy execution and feedback: The adjusted security policy is immediately executed by the 5G security gateway, and the system records detailed information about the policy change, including the time and reason of the change, as well as the effect of the changed policy; User notification and feedback mechanism: When there are significant changes in policies, the system provides timely notifications and explanations to affected users or administrators via SMS, email, or in-app notifications.

4. A private network security access system based on identity policy as claimed in claim 3, characterized in that: The multi-tenant support and isolation module also includes: Tenant management unit: used to manage tenant registration, deregistration and tenant information update; Resource allocation unit: allocates independent network resources and security policies to tenants based on their needs and permissions.

5. A private network security access method based on identity policy, characterized in that: The following steps are involved: Step A: When a mobile phone or IoT terminal device accesses the operator network, the network access policy is triggered, and the operator network copies the policy message to the 5G security gateway; Step B: The identity policy module of the 5G security gateway receives the policy message and queries the unified identity policy platform on campus to see whether the device IMEI is legal, whether the mobile phone card or IoT card number is valid, whether the user has registered and has the corresponding access rights, and whether the access device has the right to access the intranet. Based on the above query content, the identity policy module will decide whether to allow the device to access the intranet. If the device information is legal, the card number is valid, and the user has access rights, access is allowed; otherwise, access is denied and may trigger corresponding security alarms or record logs; Step C: If the user has access rights, the authorization phase begins. The authorization and billing module assigns intranet usage rights to the user based on database records and completes related operations on the security layer application. At the same time, an independent network environment and resources are assigned to the user based on tenant information. Relevant operations include user registration: formally recording user information in the system to ensure the accuracy and traceability of user identity; Security policy initialization: configure initial security policy settings for users, including access control rules, encryption requirements, and data integrity checks; Security policy binding: Bind specific security policies to users or devices to ensure that users always comply with these policies when using intranet resources; Step D: The 5G security gateway receives the billing message from the operator network, implements the binding of IPv4 address, IPv6 prefix and security policy, and billing management; Step E: When the mobile phone or IoT terminal device is disconnected from the operator's network, the authorization and billing module of the 5G security gateway removes the security policy, reclaims the user's access to the intranet, and releases the network resources allocated to the user.

6. A private network security access device based on identity policy, characterized in that: include: Physical hardware layer: includes the physical interface used to connect to the operator's network; Virtual network layer: forms a complete system encapsulated in a physical box through virtual network connection policies, authorization, billing, security protection, multi-tenant support and isolation components; Input / output memory management unit: used to implement direct memory access between the physical layer and the virtual network layer; Security layer application: runs on the virtual network layer and is responsible for the implementation of identity policy, authorization, billing, security protection, and multi-tenant management functions. It also implements identity-based secure access control by binding security policies to Ethernet traffic.

7. The identity policy-based private network security access device as claimed in claim 6, characterized in that: It also includes an operating system kernel bridge for connecting applications with low network data transfer rate requirements, including policy management, authorization processing, billing systems, controller functions, logging, network time synchronization protocol services, and tenant management related applications.

Images