Cross-region networking system for 5G private network

Abstract

The invention discloses a cross-regional networking system for a 5G private network. In the system, a source terminal sends an ARP (Address Resolution Protocol) request message of a destination terminal address to a network integrated management device through a node gateway of the source terminal; the network integrated management equipment queries a destination terminal according to the ARP request, adds the MAC address of the queried destination terminal and GRE tunnel information into an ARP request message, and sends the ARP request message to a node gateway of the destination terminal; the node gateway of the destination terminal updates an MAC forwarding table according to the MAC address of the destination terminal and GRE tunnel information in the received ARP request message, and feeds back an ARP response to the source terminal through the network integrated management equipment and the node gateway of the source terminal; and the source terminal sends a data message to the destination terminal through the node gateway of the source terminal, the network integrated management equipment and the node gateway of the destination terminal based on the MAC address of the destination terminal. According to the scheme, cross-region unified networking can be kept, and the stability of networking is ensured.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a cross-regional networking system for 5G private networks. Background Art

[0002] Large enterprises generally consist of a headquarters and several branches in various regions. Each branch builds its own independent 5G network for its own internal production, which can operate independently without relying on the headquarters. The headquarters network is used as the central node for communication between the various branch networks, and a data center is set up to centrally store important data of each branch and manage each branch network.

[0003] Each campus of an enterprise is in a local area network, and each device can be interconnected without restrictions. If you need to communicate across campuses and with the headquarters, you cannot access directly. Usually, you need to build a dedicated line on the public network to communicate. The common way to build a dedicated line is through VPN (Virtual Private Network), that is, VPN can be used to establish a secure encrypted channel on the public network, so that devices in other networks can access the company's intranet resources through the Internet. However, the stability of existing VPN connections is affected by many factors, including the performance of user devices, network quality, VPN server load, etc. If the connection is unstable, data transmission may be interrupted. At the same time, VPN is divided into client and server, and the network configuration is different, and it is impossible to form a unified network. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes a cross-regional networking system for 5G private networks, which can maintain unified cross-regional networking and ensure the stability of the networking.

[0005] An embodiment of the present invention provides a cross-regional networking system for a 5G private network, the system comprising a 5G core network, a network integrated management device, a node gateway, and a terminal;

[0006] The source terminal that has completed identity authentication in advance through the 5G core network sends an ARP request message of the destination terminal address to the network integrated management device through its node gateway;

[0007] The network integrated management device queries the destination terminal according to the ARP request, adds the MAC address and GRE tunnel information of the destination terminal obtained by the query to the ARP request message, and sends it to the node gateway of the destination terminal;

[0008] The node gateway of the destination terminal updates the MAC forwarding table according to the MAC address of the destination terminal and the GRE tunnel information in the received ARP request message, and feeds back an ARP response to the source terminal through the network integrated management device and the node gateway of the source terminal;

[0009] The source terminal sends a data message to the destination terminal through the node gateway of the source terminal, the network integrated management device and the node gateway of the destination terminal based on the MAC address of the destination terminal.

[0010] Preferably, after receiving the network ready status notification sent by the 5G core network, the node gateway initiates a registration request to the network integrated management device;

[0011] The network integrated management device authenticates the node gateway according to the registration request, and feeds back a registration success response message to the node gateway after the identity authentication is passed;

[0012] The terminal to be authenticated registers with the 5G core network in a 5G LAN mode and establishes an Ethernet type PDU session;

[0013] The terminal to be authenticated initiates a DHCP request with identity information to the node gateway that has completed registration through the 5G core network;

[0014] The node gateway forwards the DHCP request to the network integrated management device;

[0015] The network integrated management device obtains the identity information from the DHCP request, performs identity authentication, and allocates an IP address to the terminal to be authenticated after the identity authentication passes.

[0016] Preferably, the node gateway signs the identity information in the registration information using its own private key, and sends the registration request to the network integrated management device via a TCP message; wherein the registration request includes the local area code, GRE tunnel information and 5G network status; the GRE tunnel information includes the Key and IP address;

[0017] The response information fed back by the network integrated management device after the identity authentication is passed includes the key information for encrypting and decrypting the GRE data message and the node gateway information of the adjacent area.

[0018] Preferably, the system further comprises a data center;

[0019] The network integrated management device includes a terminal address management module;

[0020] The network integrated management device extracts identity information including MAC address and IMEI phone number from the DHCP request, and performs identity authentication and authorization on the terminal to be authenticated;

[0021] When the identity authentication is passed, the terminal address management module allocates an unused IP address from a preset address pool to the terminal to be authenticated;

[0022] When it is detected that the terminal to be authenticated has the authority to access the data center, an intranet IP address in the address segment of the data center is allocated to the terminal to be authenticated.

[0023] Preferably, after receiving the ARP request message, the network integrated management device queries the information of the destination terminal in a preset terminal information table;

[0024] When the destination terminal is found, the MAC address of the destination terminal in the terminal information table and the GRE tunnel information are added to the ARP request message;

[0025] When the target terminal is not found, the ARP request message is broadcast to node gateways in all regions to query the target terminal.

[0026] Preferably, after receiving the ARP request message, the network integrated management device detects whether the destination terminal is an intranet IP, and if so, adds its own GRE tunnel information to the ARP request message for feedback.

[0027] Preferably, after receiving the data packet, the node gateway searches for the GRE tunnel information in the preset MAC forwarding table through the MAC address of the destination terminal in the data packet. When the GRE tunnel information is queried, the data packet is forwarded to the destination terminal; when the GRE tunnel information is not queried, the data packet is forwarded to the central node gateway using the preset GRE tunnel information.

[0028] Preferably, the node gateway of the source terminal selects a key different from the last encryption from a preset key information table to encrypt the received data message, and calculates a key tag corresponding to the key characteristic value message sequence number and adds it to the header of the encrypted message;

[0029] The node gateway of the destination terminal calculates the corresponding key characteristic value message sequence number according to the key tag information in the header of the received encrypted message, and then queries the key in the preset key information table to decrypt the message.

[0030] Preferably, the network integrated management device includes a forwarding module;

[0031] When the forwarding module receives a data message for accessing the data center, it queries whether the source terminal has an intranet IP address; if so, it replaces the address of the source terminal with the intranet IP address and sends the data message to the intranet.

[0032] Preferably, the system further comprises a backup core network;

[0033] When the node gateway detects that the state of the 5G core network is abnormal, it reports abnormal information including the cause of the fault and the recommended repair method to the network integrated management device;

[0034] The network integrated management device determines the fault handling method according to the configured fault repair strategy and the repair method recommended by the node gateway, and notifies the backup core network to take over;

[0035] If the takeover feedback of the backup core network is received, the fault migration is started; the backup core network restores the network status in the node gateway, including terminal information and interface information, and sends an ARP update broadcast to notify that the network integrated management device has been successfully operated;

[0036] If no takeover feedback from the backup core network is received, the bypass fault handling process is started, several bypass virtual interfaces are created, and the IP of the 5G core network interface in the node gateway is configured to the created bypass virtual interface.

[0037] The embodiment of the present invention also provides a cross-regional networking system for 5G private networks, the system includes a 5G core network, a network integrated management device, a node gateway and a terminal; the source terminal that has completed identity authentication in advance through the 5G core network sends an ARP request message of the destination terminal address to the network integrated management device through its node gateway; the network integrated management device queries the destination terminal according to the ARP request, adds the MAC address of the destination terminal obtained by the query and the GRE tunnel information to the ARP request message, and sends it to the node gateway of the destination terminal; the node gateway of the destination terminal updates the MAC forwarding table according to the MAC address of the destination terminal and the GRE tunnel information in the received ARP request message, and feeds back the ARP response to the source terminal through the network integrated management device and the node gateway of the source terminal; the source terminal sends a data message to the destination terminal through the node gateway of the source terminal, the network integrated management device and the node gateway of the destination terminal based on the MAC address of the destination terminal. The present application scheme can maintain unified cross-regional networking and ensure the stability of networking. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1It is a structural diagram of a 5G private network cross-regional networking system provided by an embodiment of the present invention;

[0039] Figure 2 It is a schematic diagram of the working principle of the general routing encapsulation protocol provided by an embodiment of the present invention;

[0040] Figure 3 It is a schematic diagram of the working principle of the 5G private network cross-regional networking system provided by an embodiment of the present invention;

[0041] Figure 4 It is another structural diagram of a 5G private network cross-regional networking system provided by an embodiment of the present invention;

[0042] Figure 5 It is a schematic diagram of the working principle of the MAC forwarding table provided by an embodiment of the present invention;

[0043] Figure 6 It is a schematic diagram of the working principle of the encryption and decryption method provided by an embodiment of the present invention;

[0044] Figure 7 It is a schematic diagram of a fault switching process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] It can be understood that the various embodiments described below can be combined or combined in a logical manner, and the embodiments of the present invention will not describe various combinations one by one.

[0047] In view of the above-mentioned defects of the prior art, the present invention provides a cross-regional networking system for a 5G private network, the system comprising a 5G core network, a network integrated management device, a node gateway and a terminal;

[0048] The source terminal that has completed identity authentication in advance through the 5G core network sends an ARP request message of the destination terminal address to the network integrated management device through its node gateway;

[0049] The network integrated management device queries the destination terminal according to the ARP request, adds the MAC address and GRE tunnel information of the destination terminal obtained by the query to the ARP request message, and sends it to the node gateway of the destination terminal;

[0050] The node gateway of the destination terminal updates the MAC forwarding table according to the MAC address of the destination terminal and the GRE tunnel information in the received ARP request message, and feeds back an ARP response to the source terminal through the network integrated management device and the node gateway of the source terminal;

[0051] The source terminal sends a data message to the destination terminal through the node gateway of the source terminal, the network integrated management device and the node gateway of the destination terminal based on the MAC address of the destination terminal.

[0052] When this embodiment is implemented, see Figure 1 , is a structural diagram of a 5G private network cross-regional networking system provided by an embodiment of the present invention, wherein the system includes a 5G core network, a network integrated management device, a node gateway, and a terminal;

[0053] 5G private networks are established in various regions through 5G LAN technology, including lightweight 5GC, base stations, industrial gateways, CPE, etc. 5G LAN (Local Area Network) is a technology that uses 5G networks to provide local area network services. It provides private mobile communication services through 5G systems and allows limited terminal groups to conduct Ethernet or IP-based point-to-point communication within a 5G LAN virtual network. Through 5G LAN technology, all equipment in industrial production can be connected to the 5G network without complex protocol conversion. The northbound communication of the campus network needs to go through the node gateway device, which is responsible for communicating with the headquarters and other campuses.

[0054] CPE (Customer Premise Equipment) is a mobile signal access device that receives mobile signals and forwards them as wireless WiFi signals. It can convert high-speed 5G signals into WiFi signals and support multiple mobile terminals to access the Internet at the same time. For devices that do not support direct access to the 5G network, such as computers, tablets and other devices, you can use the 5G network by accessing CPE. Industrial gateways are mainly used for factory equipment to access the 5G network through wired means.

[0055] The headquarters network deploys network integrated management equipment as the central node of the entire network, which is used to uniformly manage and configure the entire network and the identity authentication and permission control of the terminal. At the same time, a data center and business system are set up to save data and perform business management. At the same time, a 5GC core network in hot backup state is deployed in the headquarters network, which is used for disaster recovery backup of the 5GC core network in the enterprise branch network.

[0056] The node gateway will establish GRE tunnels with adjacent nodes and network integrated management devices respectively. GRE (Generic Routing Encapsulation) provides a mechanism to encapsulate one protocol message in another protocol message, so that the message can be transmitted in heterogeneous networks. This channel for transmitting messages in heterogeneous networks is called a tunnel. Figure 2 , is a schematic diagram of the working principle of the general routing encapsulation protocol provided by an embodiment of the present invention. As shown in the figure, the networks of the branch and the headquarters are both Ethernet networks, and the branch and the headquarters are connected through an IP backbone network. By deploying the Ethernet over GRE function, Ethernet messages are transparently transmitted through the GRE tunnel, and Layer 2 intercommunication between the branch and the headquarters is achieved.

[0057] A logical tunnel is established between the source network device and the destination network device, using MAC in IP encapsulation, that is, the original Ethernet message sent by the device is completely encapsulated in the IP message. In this way, the encapsulated message can be forwarded through the routing network just like an ordinary IP message. This is like giving the virtual machine of the second-layer network the wings of routing, so that the virtual machine completely gets rid of the structural limitations of the second and third-layer networks. The GRE tunnel technology can realize the construction of cross-regional LANs, so that each branch network can break the geographical restrictions and realize interconnection, and can also realize cross-regional fault migration.

[0058] Ultimately, all devices connected to the 5G network in each campus and headquarters are in the same large Layer 2 LAN, without any geographical isolation or restrictions.

[0059] Specifically, the communication terminal needs to first complete identity authentication based on the 5G core network.

[0060] When terminal 1, which is the source terminal, needs to communicate with terminal 2, which is the destination terminal, it will first send an ARP request message to request the MAC address of the destination terminal. The message is sent to the network integrated management device through the 5G network and the node gateway.

[0061] The network integrated management device receives the ARP request from the request terminal 2, constructs an ARP response message according to the MAC address obtained from the query, and appends the GRE tunnel information to the message, and sends it to the node gateway of the destination terminal;

[0062] The node gateway of the destination terminal receives the ARP response, extracts the GRE tunnel information and the MAC address of terminal 2 from the message, and updates this information to its own MAC forwarding table. Finally, the ARP response is forwarded to terminal 1 through the 5G network.

[0063] After receiving the ARP response, terminal 1 obtains the MAC address of terminal 2 and starts sending messages to terminal 2.

[0064] The present application provides a method and system for constructing a 5G cross-regional private network based on GRE tunnel encapsulation technology, introduces 5G LAN and GRE tunnel encapsulation technology, and uses gateway devices deployed in various parks to merge the independent internal networks of each park into a large two-layer local area network, so that terminals can access each other without network restrictions. The identifier of the GRE tunnel is divided according to the regional code to distinguish the identity of each node. The branch node registers itself with the central node for authentication and uploads the tunnel information to the central node. When the terminal requests to communicate with the terminal in another network, the central node informs the corresponding gateway device of the tunnel information of the other end. This can simplify the configuration and facilitate the rapid deployment and expansion of the network. Ultimately, as long as the device connected to the 5G network can communicate at the second layer. By establishing a VXLAN enterprise dedicated line between CPE and CPE, only the devices under the two CPEs can communicate with each other, and the coverage of the CPE is limited, and it cannot meet the access requirements of different terminal devices. It can maintain unified networking across regions and ensure the stability of the networking.

[0065] In another embodiment provided by the present invention, after receiving the network ready status notification sent by the 5G core network, the node gateway initiates a registration request to the network integrated management device;

[0066] The network integrated management device authenticates the node gateway according to the registration request, and feeds back a response message of successful registration to the node gateway after the identity authentication is passed;

[0067] The terminal to be authenticated registers with the 5G core network in a 5G LAN mode and establishes an Ethernet type PDU session;

[0068] The terminal to be authenticated initiates a DHCP request with identity information to the node gateway that has completed registration through the 5G core network;

[0069] The node gateway forwards the DHCP request to the network integrated management device;

[0070] The network integrated management device obtains the identity information from the DHCP request, performs identity authentication, and allocates an IP address to the terminal to be authenticated after the identity authentication passes.

[0071] When this embodiment is implemented, see Figure 3 , is a schematic diagram of the working principle of the 5G private network cross-regional networking system provided by an embodiment of the present invention.

[0072] Before communicating, the terminal must complete the identity authentication process, see steps S201 to S207 for details.

[0073] S201, after the 5G network is successfully deployed, the 5G core network will report the network readiness to the node gateway, and will continue to report its status to the node gateway.

[0074] S202: After determining that the network is ready, the node gateway device starts to initiate a registration request to the network integrated management device.

[0075] S203. After receiving the registration request, the network integrated management device first authenticates the node gateway to determine whether it is a legitimate device. If the device is legitimate, it responds with a registration success message to the node gateway.

[0076] S204. The 5G terminal registers to the 5G network in the form of 5G LAN and establishes an Ethernet type PDU session.

[0077] S205. The terminal device obtains an IP address through DHCP, and the message is sent to the node gateway through the 5G network. After receiving the DHCP request message from the terminal, the 5G core network fills the user's identity information (IMEI phone number or IMSI) into the client ID field in the DHCP message. The node gateway encrypts the DHCP discovery message and encapsulates it into a GRE message and sends it to the integrated management system.

[0078] S206. After receiving the DHCP request message, the network integrated management device extracts the user's identity information from the message and performs identity authentication.

[0079] S207: When the user identity authentication is passed, the terminal address management module will allocate an unused IP to the terminal from the address pool.

[0080] In another embodiment provided by the present invention, the node gateway signs the identity information in the registration information using its own private key, and sends the registration request to the network integrated management device via a TCP message; wherein the registration request includes the local area code, GRE tunnel information and 5G network status; the GRE tunnel information includes the Key and IP address;

[0081] The response information fed back by the network integrated management device after the identity authentication is passed includes the key information for encrypting and decrypting the GRE data message and the node gateway information of the adjacent area.

[0082] Specifically, the request message is encrypted using asymmetric encryption technology to ensure network security, and its own identity information is signed using its own private key, and then sent to the network integrated management device via a TCP message. The system key information is pre-installed by the device when it leaves the factory and can only be updated offline later. At the same time, the node key information needs to be saved in the integrated management system in advance. The registration request includes the local area code, GRE tunnel information (Key and IP address), 5G network status, etc.

[0083] The response message contains the key information used for subsequent GRE data message encryption and decryption, as well as the information of the node in the adjacent area. It is best to store the information of the registered node locally.

[0084] In another embodiment provided by the present invention, the system further comprises a data center;

[0085] The network integrated management device includes a terminal address management module;

[0086] The network integrated management device extracts identity information including MAC address and IMEI phone number from the DHCP request, and performs identity authentication and authorization on the terminal to be authenticated;

[0087] When the identity authentication is passed, the terminal address management module allocates an unused IP address from a preset address pool to the terminal to be authenticated;

[0088] When it is detected that the terminal to be authenticated has the authority to access the data center, an intranet IP address in the address segment of the data center is allocated to the terminal to be authenticated.

[0089] When this embodiment is implemented, see Figure 4 , is another structural diagram of a 5G private network cross-regional networking system provided in an embodiment of the present invention.

[0090] The system also includes a data center for the internal network.

[0091] The network integrated management devices responsible for the entire system include: vSwitch forwarding module, device management module, encryption and decryption module, access control module, 5GC HA management module, terminal address management and configuration management module.

[0092] The vSwitch forwarding module is responsible for forwarding data packets and encapsulating and decapsulating GRE packets. It functions like a router and stores a MAC forwarding table. This module mainly performs Layer 2 forwarding based on MAC and VLAN.

[0093] The encryption and decryption module is used for encryption and decryption of data messages and control messages. After encryption, the messages are sent to the forwarding module for forwarding. The data messages use symmetric encryption technology, and the control messages use asymmetric encryption technology. It is also responsible for the management of key information.

[0094] The access control module is used for external access to the internal network. Only authenticated users and user groups with corresponding permissions can access important internal data.

[0095] The device management module is used to manage node devices, to discover node devices on other networks, and to notify other nodes of relevant information about the node so that other nodes can discover the node.

[0096] The terminal address management module allocates IP addresses to terminals in each network to facilitate communication between terminals.

[0097] The HA management module uses the disaster recovery backup of the 5GC core network. When a 5GC in a network fails, the service will be switched to the backup machine to ensure uninterrupted service.

[0098] The configuration management module is used for device configuration management and front-end page display. The integrated management system can also send the configuration to a certain node.

[0099] First, the GRE tunnel GRE Key of all nodes is planned in advance during the network deployment phase. Each node uses a fixed key to distinguish its own identity according to the regional code. When all nodes start, they will register themselves with the integrated management system and negotiate the encryption parameters of both parties. The terminal then goes online through 5G LAN to establish an Ethernet-type PDU session, and then applies for an IP through DHCP. The integrated management device performs secondary authentication on the user's identity and allocates an IP address for mutual communication. For terminals that do not support DHCP, static configuration is used and no authentication is required.

[0100] Specifically, see Figure 3 The process steps in:

[0101] S206. After receiving the DHCP request message, the network integrated management device extracts the user's identity information including the MAC address and IMEI phone number from the message, and then performs identity authentication and authorization on the user.

[0102] S207. When the user identity authentication is passed, the terminal address management module will allocate an unused IP from the address pool to the terminal. If the user also has special permissions to access the data center, and the data center only accepts access from IPs in the same network segment for security reasons, then an additional IP in the data center address segment will be allocated. The additional IP does not need to be sent to the terminal and is saved by the integrated management system itself. The DHCP response message is sent to 5GC to continue the DHCP process. After receiving the DHCP response message, the 5GC core network needs to restore the client ID field to its original state and then send it to the terminal.

[0103] Identity information is inserted into the DHCP message used by the terminal to apply for an IP address to perform secondary authentication and authorization of the user's identity without being perceived. At the same time, access to important intranet data is restricted by checking the source IP. Only IPs in the same network segment can access it. Users with permission to access intranet data will be allocated an additional intranet IP. If the terminal needs to access intranet resources, NAT will be performed on the gateway to replace the source IP with the IP for accessing the intranet.

[0104] In another embodiment provided by the present invention, after receiving the ARP request message, the network integrated management device queries the information of the destination terminal in a preset terminal information table;

[0105] When the destination terminal is found, the MAC address of the destination terminal in the terminal information table and the GRE tunnel information are added to the ARP request message;

[0106] When the target terminal is not found, the ARP request message is broadcast to node gateways in all regions to query the target terminal.

[0107] When this embodiment is executed, see Figure 3 The following steps:

[0108] S208. When terminal 1 needs to communicate with terminal 2, it first sends an ARP request message to request the MAC address of terminal 2. The message is sent to the network integrated management device through the 5G network and the node gateway.

[0109] S209, the forwarding module of the network integrated management device receives the ARP request of the request terminal 2, first searches for the information of terminal 2 in the terminal information table, if so, directly uses the saved MAC address to construct an ARP response message, and appends the GRE tunnel information to the message, if the integrated management system is configured to audit all traffic, then fill in its own GRE tunnel information, if not auditing traffic, then fill in the GRE tunnel of node 2. If the terminal information does not exist, then broadcast the ARP request to node gateways in all regions.

[0110] S210, the node gateway receives the ARP response, extracts the GRE tunnel information and the MAC address of terminal 2 from the message, updates this information to its own MAC forwarding table, and finally forwards the ARP response to terminal 1 through the 5G network.

[0111] S211. After receiving the ARP response, terminal 1 obtains the MAC address of terminal 2 and starts sending messages to terminal 2.

[0112] In another embodiment of the present invention, after receiving the ARP request message, the network integrated management device detects whether the destination terminal is an intranet IP, and if so, adds its own GRE tunnel information to the ARP request message for feedback.

[0113] In the specific implementation of this embodiment, after receiving the ARP request message, the network integrated management device detects whether the destination terminal is an intranet IP, that is, the request is for an IP in the intranet, then the integrated management system's own GRE tunnel information is returned, and the message will enter the intranet of the data center.

[0114] In another embodiment provided by the present invention, after the node gateway receives the data packet, it searches for the GRE tunnel information in the preset MAC forwarding table through the MAC address of the destination terminal in the data packet. When the GRE tunnel information is queried, the data packet is forwarded to the destination terminal; when the GRE tunnel information is not queried, the data packet is forwarded to the central node gateway using the preset GRE tunnel information.

[0115] The message is first sent to the node gateway through the 5G network. The node gateway processes the message in two main steps. Figure 5 , is a schematic diagram of the working principle of the MAC forwarding table provided in an embodiment of the present invention.

[0116] First, the MAC forwarding table is searched by the destination MAC to determine the information of the GRE tunnel, and then the data message is forwarded to the destination terminal. If the specified MAC is not found in the MAC forwarding table, the default GRE tunnel is used to send the message to the central node.

[0117] In another embodiment provided by the present invention, the node gateway of the source terminal selects a key different from the last encryption from a preset key information table to encrypt the received data message, and calculates the key tag of the corresponding key feature value message sequence number and adds it to the header of the encrypted message;

[0118] The node gateway of the destination terminal calculates the corresponding key characteristic value message sequence number according to the key tag information in the header of the received encrypted message, and then queries the key in the preset key information table to decrypt the message.

[0119] In the specific implementation of this embodiment, the message needs to be encrypted to ensure the security of the data. The encryption method of the data message is symmetric. The entire network stores a same key information table containing a certain number of keys, which are obtained from the integrated management system when the node is started. The integrated management system will then periodically generate and update the keys of the entire network in a more secure way. See Figure 6 , is a schematic diagram of the working principle of the encryption and decryption method provided in an embodiment of the present invention.

[0120] After receiving the data message and before forwarding the message, the node gateway of the source terminal will select a key different from the previous one from the key table to encrypt the data, and then calculate a key tag through an algorithm using the key characteristic value, message sequence number and other information and add it to the header of the message.

[0121] The node gateway of the destination terminal at the receiving end obtains the key characteristic value through the same algorithm and then obtains the key from the key table for decryption. That is, according to the key tag information in the header of the received encrypted message, the corresponding key characteristic value message sequence number is calculated, and then the key in the preset key information table is queried for message decryption.

[0122] In the enterprise dedicated line method established through the operator's 5G network, the data transmitted in the tunnel is not encrypted, and it is necessary to rely on the operator to ensure network security and authenticate the user identity. The 5G network constructed by the present invention is that both the 5G private network base station and the core network can be maintained and managed by themselves, which can effectively realize the unified management of the network. At the same time, the GRE tunnel is established in the public network, and the data transmission is encrypted using domestic encryption algorithms and variable keys to ensure the security of data and network. At the same time, the user identity is secondary authenticated and authorized by inserting user identity information in the DHCP discovery message, so that the user is unaware and does not need to enter a username and password when logging in.

[0123] In another embodiment provided by the present invention, the network integrated management device includes a forwarding module;

[0124] When the forwarding module receives a data message for accessing the data center, it queries whether the source terminal has an intranet IP address; if so, it replaces the address of the source terminal with the intranet IP address and sends the data message to the intranet.

[0125] In the specific implementation of this embodiment, after receiving the message, node gateway 2 first uses the source address and source GRE tunnel information in the message to update its MAC table, and in this way learns the tunnel information of node 1 locally, and then forwards it to terminal 2. If the forwarding module of the integrated management system receives a message to access the intranet data center, it first uses the source IP and MAC to find out whether the user has an intranet IP. If so, NAT is performed to replace the source with the intranet IP and then the message is sent to the intranet.

[0126] If the terminal does not support DHCP and can only communicate based on Ethernet, then the MAC forwarding table can only be established through static configuration. The user adds the corresponding configuration in the integrated management, and the integrated management system sends the configuration to each gateway node. Those who use static configuration are generally known users, so identity authentication is not required.

[0127] In another embodiment provided by the present invention, the system further includes a backup core network;

[0128] When the node gateway detects that the state of the 5G core network is abnormal, it reports abnormal information including the cause of the fault and the recommended repair method to the network integrated management device;

[0129] The network integrated management device determines the fault handling method according to the configured fault repair strategy and the repair method recommended by the node gateway, and notifies the backup core network to take over;

[0130] If the takeover feedback of the backup core network is received, the fault migration is started; the backup core network restores the network status in the node gateway, including terminal information and interface information, and sends an ARP update broadcast to notify that the network integrated management device has been successfully operated;

[0131] If no takeover feedback from the backup core network is received, the bypass fault handling process is started, several bypass virtual interfaces are created, and the IP of the 5G core network interface in the node gateway is configured to the created bypass virtual interface.

[0132] In the specific implementation of this embodiment, the node gateway will always monitor the status of 5GC. Once an abnormal status is found, it will immediately report to the network integrated management device. The network integrated management device will install the established strategy to handle the fault. If a backup 5GC is deployed, a failover will be triggered. Figure 7 , is a schematic diagram of a fault switching process provided by an embodiment of the present invention.

[0133] 301. The node gateway reports the abnormal information of 5GC to the integrated management system, including the specific cause of the failure and the suggested repair method, as well as the interface information of 5GC (IP address and MAC address).

[0134] 302. The integrated management system determines the fault handling method according to the configured fault recovery strategy and the suggestions provided by the node gateway. If there is a backup system and the fault cannot be recovered in a short time, the backup core network is first notified to prepare for takeover. If the backup core network is available, the fault migration process is started, otherwise the bypass fault handling process is started.

[0135] 303. If the backup 5GC is in an available state, the integrated management system first pushes the operation data of the 5GC of node 1 to the backup 5GC. The backup 5GC restores the corresponding state of the 5GC in node 1, including terminal information and interface information. Since it is a remote backup, the data is allowed to have certain differences. Then it starts to send ARP update broadcasts to the outside and informs the integrated management system that it has been successfully run. The integrated management system forwards the ARP layer 2 message to the node 1 gateway device through the GRE tunnel.

[0136] If the backup 5GC is unavailable, the integrated management system notifies the node 1 gateway to enable the bypass function, starts creating several bypass virtual interfaces, and configures the 5GC interface IP in node 1 into them.

[0137] After receiving the ARP message, the gateway of node 1 updates its forwarding table, including the destination MAC and GRE tunnel information.

[0138] 304. The terminal in node 1 performs data service through base station N3. The message reaches the node gateway device. The gateway device replaces the destination MAC according to the learned forwarding table. If it goes to the backup 5GC, the message needs to be added with a GRE tunnel header and forwarded to the integrated management system.

[0139] 305a. The forwarding module of the integrated management system removes the GRE header and then forwards the received message to the backup core network for processing.

[0140] 305b. If the bypass virtual interface is to be used for node 1, the bypass special processing flow is started. Bypass processing is mainly used to process the data packets of the terminal. When the 5GC is abnormal, the data packets of the terminal do not go through the 5GC core network processing and directly reach the other end, which can ensure that the ongoing services of the terminal are not interrupted. The specific message processing flow is as follows:

[0141] For the terminal data message received from the base station N3 interface, after removing the GTP header, the destination MAC is used according to the MAC forwarding table (learned in step 209) and the GRE tunnel header is added for forwarding to node 2.

[0142] For the message sent from node 2 to the terminal, the MAC forwarding table is first searched according to the destination MAC and sent to the corresponding bypass virtual interface. The bypass interface processes the message, first searches for the terminal information according to the destination MAC, and then adds the corresponding GTP header according to the terminal information and forwards it to the base station.

[0143] At the same time, the bypass interface maintains the heartbeat of the N2 / N3 interface.

[0144] 306. The 5GC in node 1 recovers from the fault and starts to work, and starts to notify the node 1 gateway of the status.

[0145] 307. The node 1 gateway reports the fault recovery information to the integrated management system.

[0146] 308. The integrated management system stops forwarding messages to the backup system and responds to the node 1 gateway. The node 1 gateway restores the status information of the 5GC from the backup 5GC in the integrated management system. After the restoration is complete, it updates its own forwarding table and forwards the message to the 5GC in node 1.

[0147] If there is no backup 5GC, because the bypass virtual interface does not process signaling messages, after the 5GC is restored, it sends a forced offline message to notify all terminals in node 1 to go back online to ensure consistent status.

[0148] 309. The node gateway reports to the integrated management system that 5GC is operating normally, and the integrated management system restores the backup system to the backup state.

[0149] Based on this network architecture, dual-machine hot standby will not be restricted by geographical location and can achieve off-site disaster recovery and backup, and provide supporting operation management system, unified network management, secondary terminal identity authentication, flow control and other functions. The off-site disaster recovery and backup system built based on GRE tunnel can quickly take over and provide services in the headquarters network when the 5GC core network of the park is abnormal to ensure uninterrupted business. When the backup system is unavailable, the bypass function of the data message is enabled, and the terminal information cached locally can skip the processing of the 5GC core network and forward the message directly, continuing the user's current data service, and ensuring the continuity of the user's data service to the greatest extent.

[0150] It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A cross-regional networking system for 5G private networks, characterized in that: The system includes a 5G core network, a network integrated management device, a node gateway and a terminal; The source terminal that has completed identity authentication in advance through the 5G core network sends an ARP request message of the destination terminal address to the network integrated management device through its node gateway; The network integrated management device queries the destination terminal according to the ARP request, adds the MAC address and GRE tunnel information of the destination terminal obtained by the query to the ARP request message, and sends it to the node gateway of the destination terminal; The node gateway of the destination terminal updates the MAC forwarding table according to the MAC address of the destination terminal and the GRE tunnel information in the received ARP request message, and feeds back an ARP response to the source terminal through the network integrated management device and the node gateway of the source terminal; The source terminal sends a data message to the destination terminal through the node gateway of the source terminal, the network integrated management device and the node gateway of the destination terminal based on the MAC address of the destination terminal.

2. The cross-regional networking system for 5G private networks according to claim 1 is characterized in that: After receiving the network ready status notification sent by the 5G core network, the node gateway initiates a registration request to the network integrated management device; The network integrated management device authenticates the node gateway according to the registration request, and feeds back a response message of successful registration to the node gateway after the identity authentication is passed; The terminal to be authenticated registers with the 5G core network in a 5G LAN mode and establishes an Ethernet type PDU session; The terminal to be authenticated initiates a DHCP request with identity information to the node gateway that has completed registration through the 5G core network; The node gateway forwards the DHCP request to the network integrated management device; The network integrated management device obtains the identity information from the DHCP request, performs identity authentication, and allocates an IP address to the terminal to be authenticated after the identity authentication passes.

3. The cross-regional networking system for 5G private networks according to claim 2 is characterized in that: The node gateway signs the identity information in the registration information using its own private key, and sends the registration request to the network integrated management device via a TCP message; wherein the registration request includes the local area code, GRE tunnel information and 5G network status; the GRE tunnel information includes the Key and IP address; The response information fed back by the network integrated management device after the identity authentication is passed includes the key information for encrypting and decrypting the GRE data message and the node gateway information of the adjacent area.

4. The cross-regional networking system for 5G private networks according to claim 2 is characterized in that: The system also includes a data center; The network integrated management device includes a terminal address management module; The network integrated management device extracts identity information including MAC address and IMEI phone number from the DHCP request, and performs identity authentication and authorization on the terminal to be authenticated; When the identity authentication is passed, the terminal address management module allocates an unused IP address from a preset address pool to the terminal to be authenticated; When it is detected that the terminal to be authenticated has the authority to access the data center, an intranet IP address in the address segment of the data center is allocated to the terminal to be authenticated.

5. The cross-regional networking system for 5G private networks according to claim 1 is characterized in that: After receiving the ARP request message, the network integrated management device queries the information of the destination terminal in a preset terminal information table; When the destination terminal is found, the MAC address of the destination terminal in the terminal information table and the GRE tunnel information are added to the ARP request message; When the target terminal is not found, the ARP request message is broadcast to node gateways in all regions to query the target terminal.

6. The cross-regional networking system for 5G private networks according to claim 1 is characterized in that: After receiving the ARP request message, the network integrated management device detects whether the destination terminal is an intranet IP. If so, the GRE tunnel information of the device is added to the ARP request message for feedback.

7. The cross-regional networking system for 5G private networks according to claim 1 is characterized in that: After receiving the data message, the node gateway searches for GRE tunnel information in a preset MAC forwarding table through the MAC address of the destination terminal in the data message, and when the GRE tunnel information is found, the data message is forwarded to the destination terminal; When no GRE tunnel information is found, the data message is forwarded to the central node gateway using the preset GRE tunnel information.

8. The cross-regional networking system for 5G private networks according to claim 1, characterized in that: The node gateway of the source terminal selects a key different from the last encryption from the preset key information table to encrypt the received data message, and calculates the key tag corresponding to the key feature value message sequence number and adds it to the header of the encrypted message; The node gateway of the destination terminal calculates the corresponding key characteristic value message sequence number according to the key tag information in the header of the received encrypted message, and then queries the key in the preset key information table to decrypt the message.

9. The cross-regional networking system for 5G private networks according to claim 4 is characterized in that: The network integrated management device includes a forwarding module; When the forwarding module receives a data message for accessing the data center, it queries whether the source terminal has an intranet IP address; if so, it replaces the address of the source terminal with the intranet IP address and sends the data message to the intranet.

10. The cross-regional networking system for 5G private networks according to claim 1, characterized in that: The system also includes a backup core network; When the node gateway detects that the state of the 5G core network is abnormal, it reports abnormal information including the cause of the fault and the recommended repair method to the network integrated management device; The network integrated management device determines the fault handling method according to the configured fault repair strategy and the repair method recommended by the node gateway, and notifies the backup core network to take over; If a takeover feedback from the backup core network is received, the fault migration is started; The backup core network restores the network status in the node gateway, including terminal information and interface information, and sends an ARP update broadcast to notify that the network integrated management device has been successfully operated; If no takeover feedback from the backup core network is received, the bypass fault handling process is started, several bypass virtual interfaces are created, and the IP of the 5G core network interface in the node gateway is configured to the created bypass virtual interface.

Images