Network slice selection method, system, device and storage medium

Abstract

The present invention provides a network slice selection method, system, device and storage medium, wherein the method comprises: an access gateway receives a networking requirement of at least one target service sent by a terminal device based on an updated IP packet header, extracts a device identifier of the terminal device and a service identifier of the target service from the updated IP packet header, performs access authentication on the device identifier of the terminal device, and selects a corresponding target network slice based on the service identifier when the access authentication passes. The present invention can implement device access authentication of terminal devices and network slice selection based on service identifiers at an access gateway, solving the problem of multi-head decentralized management of device access authentication and network slice selection in the prior art. Since device access authentication and network slice selection are executed at one end, consistency in time management can be ensured, which is beneficial to improving the networking configuration efficiency of terminal devices and network slices.

Description

Technical Field

[0001] The present invention relates to the field of network security, and specifically, to a network slice selection method, system, device and storage medium. Background Art

[0002] With the continuous emergence of various communication services, different communication services have significantly different requirements for network performance. Therefore, the concept of network slice (NS) is introduced to cope with the differences in the requirements of different communication services for network performance.

[0003] Network slicing refers to a collection of logical network function entities that support specific communication business requirements. It mainly uses software defined network (SDN) technology and network function virtualization (NFV) technology to achieve customizable communication services. SDN separates network forwarding functions from network control functions, with the goal of creating a centrally manageable and programmable network. NFV abstracts network functions from hardware. NFV supports SDN by providing an infrastructure that can run SDN software.

[0004] Selecting corresponding network slices for different business services on terminal devices can enable terminal devices to provide diversified services to users. Therefore, how to provide efficient network slice selection services for terminal devices is a common research topic in the industry. Summary of the invention

[0005] In response to the problems in the prior art, the purpose of the present invention is to provide a network slice selection method, system, device and storage medium, which overcome the difficulties of the prior art, can perform terminal device authentication and network slice selection at the access gateway of the network layer, and solve the problem of low network slice selection efficiency caused by the separation of terminal device authentication and network slice selection.

[0006] An embodiment of the present invention provides a network slice selection method, which is applied to a terminal device, including:

[0007] Invoking an IP protocol stack according to a networking requirement of at least one target service;

[0008] In the IP protocol stack, the device identifier of the terminal device and the service identifier of the target service are embedded in the IP packet header to obtain an updated IP packet header;

[0009] The updated IP packet header is used as the data encapsulation header for the networking demand, and the networking demand is sent to the access gateway, where the device identifier is used by the access gateway to authenticate the terminal device, and the service identifier is used to select the corresponding target network slice for the terminal device if the access authentication is passed.

[0010] Preferably, the method further comprises:

[0011] Before embedding the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack, the device identification is signed using the device private key to obtain the device identification with signature information;

[0012] In the IP protocol stack, the device identifier of the terminal device and the service identifier of the target service are embedded in the IP packet header, including:

[0013] In the IP protocol stack, the device identifier with signature information and the service identifier of the target service are embedded in the IP packet header.

[0014] Preferably, embedding the device identifier of the terminal device and the service identifier of the target service into the IP header in the IP protocol stack includes:

[0015] In the IP protocol stack, the device identifier of the terminal device and the service identifier of the target service are embedded in the SRv6 label of the IP packet header.

[0016] An embodiment of the present invention further provides a network slice selection method, which is applied to an access gateway, including:

[0017] Receiving a networking demand of at least one target service sent by a terminal device based on updating an IP packet header;

[0018] Extracting the device identification of the terminal device and the service identification of the target service from the update IP packet header;

[0019] Perform access authentication on the device identification of the terminal device;

[0020] If the access authentication is passed, the corresponding target network slice is selected for the terminal device according to the service identifier.

[0021] Preferably, performing access authentication on the device identification of the terminal device includes:

[0022] In the case where the device identification carries signature information, the public key is obtained to verify the signature information, wherein the signature information is obtained by signing the device identification using the device private key corresponding to the public key.

[0023] Preferably, the service identifier is an application identifier of a target application running on a terminal device, and obtaining the public key includes:

[0024] Obtain the corresponding target application matrix according to the application identifier;

[0025] Determine the corresponding public key based on the target application matrix.

[0026] Preferably, the network slice selection method further includes:

[0027] Connect terminal devices to network slices based on networking needs, and forward data packets through network slices.

[0028] An embodiment of the present invention further provides a network slice selection system, including:

[0029] The terminal device calls the IP protocol stack according to the networking demand of at least one target service, embeds the device identifier of the terminal device and the service identifier of the target service into the IP packet header in the IP protocol stack, obtains an updated IP packet header, uses the updated IP packet header as a data encapsulation header of the networking demand, and sends the networking demand to the access gateway;

[0030] The access gateway receives the networking requirements of at least one target service sent by the terminal device, extracts the device identification of the terminal device and the service identification of the target service from the updated IP packet header, performs access authentication on the device identification of the terminal device, and if the authentication is successful, selects the corresponding target network slice for the terminal device according to the service identification.

[0031] An embodiment of the present invention further provides a network slice selection device, applied to a terminal device, including:

[0032] A calling module, calling an IP protocol stack according to a networking requirement of at least one target service;

[0033] The embedding module embeds the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack to obtain an updated IP packet header;

[0034] The authentication initiation module updates the IP packet header as the data encapsulation header of the networking requirement and sends the networking requirement to the access gateway. The device identifier is used by the access gateway to perform access authentication on the terminal device, and the service identifier is used to select the corresponding target network slice for the terminal device if the access authentication is passed.

[0035] An embodiment of the present invention further provides a network slice selection device, which is applied to an access gateway, including:

[0036] A receiving module, receiving a networking requirement of at least one target service sent by a terminal device based on an updated IP packet header;

[0037] An extraction module extracts a device identifier of a terminal device and a service identifier of a target service from an update IP packet header;

[0038] An authentication module performs access authentication on the device identification of the terminal device;

[0039] The selection module selects the corresponding target network slice for the terminal device based on the service identifier when the access authentication is passed.

[0040] An embodiment of the present invention further provides a network slice selection device, including:

[0041] processor;

[0042] a memory in which executable instructions for the processor are stored;

[0043] In which, the processor is configured to perform the steps of the above-mentioned network slice selection method by executing executable instructions.

[0044] An embodiment of the present invention also provides a computer-readable storage medium for storing a program, which implements the steps of the above-mentioned network slice selection method when the program is executed.

[0045] The purpose of the present invention is to provide a network slice selection method, system, device and storage medium, where a terminal device initiates a networking requirement based on device access authentication to an access gateway, and the access gateway implements device access authentication of the terminal device and network slice selection based on a service identifier, thereby solving the problem of multi-head decentralized management of device access authentication and network slice selection in the prior art. Since device access authentication and network slice selection are executed at one end, consistency in time management can be ensured, which is conducive to improving the networking configuration efficiency of terminal devices and network slices. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Other features, objectives and advantages of the present invention will become more apparent from a reading of the detailed description of non-limiting embodiments made with reference to the following accompanying drawings.

[0047] Figure 1 is a schematic diagram of the structure of a network slice selection system according to an embodiment of the present invention;

[0048] Figure 2 This is one of the flow charts of the network slice selection method according to an embodiment of the present invention;

[0049] Figure 3 This is the second flowchart of the network slice selection method according to an embodiment of the present invention;

[0050] Figure 4 This is a third flowchart of the network slice selection method according to an embodiment of the present invention;

[0051] Figure 5 This is a fourth flowchart of the network slice selection method according to an embodiment of the present invention;

[0052] Figure 6 This is the fifth flowchart of the network slice selection method according to an embodiment of the present invention;

[0053] Figure 7 This is the sixth flowchart of the network slice selection method according to an embodiment of the present invention;

[0054] Figure 8 This is one of the structural diagrams of the network slice selection device according to an embodiment of the present invention;

[0055] Fig. 9 This is the second structural diagram of the network slice selection device according to an embodiment of the present invention;

[0056] Fig.10 This is the third structural diagram of the network slice selection device according to an embodiment of the present invention;

[0057] Fig.11 This is the fourth structural diagram of the network slice selection device according to an embodiment of the present invention;

[0058] Fig.12 It is a schematic diagram of the operation of the network slice selection system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the embodiments set forth herein. Instead, these embodiments are provided to make the present invention comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art.

[0060] The accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware forwarding modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0061] In addition, the processes shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps can be decomposed, some steps can be combined or partially combined, and the actual execution order may change according to the actual situation. The words "first", "second" and similar words used in the specific description do not indicate any order, quantity or importance, but are only used to distinguish different components. It should be noted that the embodiments of the present invention and the features in different embodiments can be combined with each other without conflict.

[0062] In actual applications, it is found that in the prior art, the access authentication and service access configuration of terminal devices are separated and implemented by different entities, that is, no service distinction is made in the device access and data transmission links. This leads to the inconsistency of multiple management and time management, which makes the network access management of terminal devices, the selection and connection of network slices, etc. cumbersome and scattered, and inefficient. In addition, it is also considered that multiple management and time inconsistency may also lead to service interruption or security risks exposed for too long.

[0063] The embodiment of the present invention proposes a technical solution to solve the above technical problems, and implements device access authentication of terminal devices and network slice selection based on service identification at the access gateway, which solves the problem of multi-head decentralized management of device access authentication and network slice selection in the prior art. Since device access authentication and network slice selection are executed at one end, consistency in time management can be ensured, and high configuration efficiency and connection efficiency of terminal devices and network slices can be ensured.

[0064] In addition, the embodiments of the present invention can also reduce the security risk problems caused by business interruption or prolonged exposure time caused by multiple management.

[0065] Figure 1 : is a structural diagram of a network slice selection system according to an embodiment of the present invention. The system includes:

[0066] The terminal device 110 calls the IP protocol stack according to the networking requirement of at least one target service, embeds the device identifier of the terminal device 110 and the service identifier of the target service into the IP header in the IP protocol stack, obtains an updated IP header, uses the updated IP header as a data encapsulation header of the networking requirement, and sends the networking requirement to the access gateway 120;

[0067] The access gateway 120 receives a networking demand of at least one target service sent by the terminal device 110, extracts the device identifier of the terminal device 110 and the service identifier of the target service from the updated IP packet header, performs access authentication on the device identifier of the terminal device 110, and if the authentication is successful, selects a corresponding target network slice for the terminal device 110 according to the service identifier.

[0068] In an optional embodiment, the access gateway 120 can receive and process networking requirements sent by one or more terminal devices 110, and centrally perform device authentication and network slice selection based on service identification for the networking requirements of each terminal device 110, thereby avoiding decentralized execution problems and improving the network configuration efficiency of the terminal devices.

[0069] At the same time, since network slicing selection is implemented based on service identification at the access gateway level, various types of services can be diverted and isolated at the first hop of the access link, solving the problem of no isolation of various types of services in the transmission link in the existing technology. It can guarantee business security to a certain extent, reduce configuration links, and be more efficient.

[0070] In an optional embodiment, the terminal device 110 can be a smart phone, a laptop computer, a tablet computer, a camera device, etc., or the terminal device 110 can be an industrial application device such as a remote terminal unit (RTU) or a programmable logic controller (RTU), which is not specifically limited here.

[0071] RTU is a microprocessor controlled electronic device used as a device interface to introduce data into a distributed control system or a supervisory control and data acquisition system (SCADA), transmit telemetry data to the main system, and use the data from the main monitoring system to control the connected devices. RTU can also be interpreted as a remote telemetry device or a remote control device.

[0072] PLC is a digital electronic device with a microprocessor, a digital logic controller used for automated control, which can load control instructions into the memory for storage and operation at any time.

[0073] In an optional embodiment, the access gateway may be an optical line terminal ONU (Optical NetWork Unit), which is used to realize the conversion between optical signals and electrical signals and the multiplexing and separation of optical signals. ONU is usually called an optical modem, but the difference is that the modem performs analog-to-digital conversion of communication, while the ONU performs optical-to-digital signal conversion.

[0074] Figure 2 This is a flowchart of the network slice selection method of an embodiment of the present invention. The executor of this method is a terminal device to be connected to the network, or an application installed on the terminal device, which is not limited here.

[0075] refer to Figure 2 The network slice selection method provided by the embodiment of the present invention comprises the following steps:

[0076] Step 210: calling an IP protocol stack according to a networking requirement of at least one target service;

[0077] Step 220: embed the device identifier of the terminal device and the service identifier of the target service into the IP packet header in the IP protocol stack to obtain an updated IP packet header;

[0078] Step 230: Use the updated IP packet header as the data encapsulation header of the networking requirement, and send the networking requirement to the access gateway, where the device identifier is used by the access gateway to authenticate the terminal device, and the service identifier is used to select the corresponding target network slice for the terminal device if the access authentication is passed.

[0079] In this embodiment, the service identifier is identification information used to determine a specific service. A network slice can carry one or a class of services, so there is a certain correspondence between the network slice and the service identifier.

[0080] The IP packet header is modified on the terminal device side, and the device identifier and service identifier are embedded in the IP packet header and sent to the access gateway, thereby realizing device access authentication and network slice selection based on the service identifier on the access gateway side, thereby solving the problem of low efficiency of terminal device network access configuration caused by decentralized management of device access authentication and network slice selection in related technologies.

[0081] In an optional embodiment, the service identifier may be an application identifier of a target application that provides a service, or identification information of a controller that executes a specific service function in a terminal device.

[0082] Figure 3 This is a flowchart of an optional embodiment of a network slice selection method provided by the present invention, and the method specifically includes the following steps:

[0083] Step 310: calling an IP protocol stack according to a networking requirement of at least one target service;

[0084] Step 320: Sign the device identification using the device private key to obtain a device identification with signature information;

[0085] Step 330: embed the device identifier with signature information and the service identifier of the target service into the IP packet header in the IP protocol stack to obtain an updated IP packet header;

[0086] Step 340: Use the updated IP packet header as the data encapsulation header of the networking requirement, and send the networking requirement to the access gateway, where the device identifier is used by the access gateway to authenticate the terminal device, and the service identifier is used to select the corresponding target network slice for the terminal device if the access authentication is passed.

[0087] This embodiment adopts an asymmetric signature technology. On the terminal device side, the device private key is used to sign the device identification, and then on the access gateway side, the public key corresponding to the device private key is used to verify the signature information.

[0088] When using asymmetric signature technology, the device private key and the corresponding public key are separated. The device private key is held by the terminal device, and the public key is public. Only the signature information using the real device private key can be verified by the public key. Therefore, even if a fake device identification is used, but the device private key is wrong, the signature verification cannot pass. Therefore, asymmetric signature technology can enhance information security.

[0089] Among them, the device private key can be agreed upon in advance between the access gateway and the terminal device.

[0090] In an optional embodiment, a symmetric encryption technology may be selected to encrypt the device identification, and the access gateway may perform decryption verification.

[0091] In an optional embodiment, there is a preset corresponding relationship between the device private key and the service identifier. Therefore, before the device identifier is signed using the device private key, the corresponding device private key can be obtained according to the service identifier.

[0092] In this case, each service has a corresponding device private key.

[0093] refer to Figure 4 In an optional embodiment, the device identification of the terminal device and the service identification of the target service are embedded in the SRv6 tag of the IP packet header in the IP protocol stack, such as the service ID and the signature string, and the signature string is the signature information.

[0094] SRv6 is the abbreviation of Segment Routing IPv6. It uses the existing IPv6 forwarding technology and implements network programmability through flexible IPv6 extension headers. SRv6 simplifies the network protocol type, has good scalability and programmability, can meet the diverse needs of more new services, and provide high reliability.

[0095] The SRv6 label defines the next hop address of the storage segment routing. This embodiment inserts the device identifier and the service identifier of the target service before the address, thereby redefining the next hop address and providing a new protocol expression. Therefore, this embodiment uses the programmability of SRv6 to automatically embed authentication information such as the device identifier and service identifier in the IP packet header, which enhances the credibility and reliability of the solution of this embodiment.

[0096] Figure 5 A flow chart of a network slice selection method provided for an embodiment of the present invention. The executor of this method is an access gateway AG (access gateway), which is located at the edge access layer of the soft switch architecture and provides an analog user line interface for directly connecting ordinary telephone users to the soft switch network.

[0097] In a three-layer IP network, access gateway refers to various IP gateway devices that connect to user hosts at the edge of the network. Typical access gateways include: broadband access gateway (BRAS), wireless access gateway (WiFi router), home (access) gateway, various dial-up (protocol) access gateways, dedicated line access gateway, VPN access gateway, enterprise access gateway, etc.

[0098] This method comprises the following steps:

[0099] Step 510: receiving a network connection requirement of at least one target service sent by a terminal device based on an updated IP packet header;

[0100] Step 520: extracting the device identifier of the terminal device and the service identifier of the target service from the update IP packet header;

[0101] Step 530: Perform access authentication on the device identification of the terminal device;

[0102] Step 540: If the access authentication is passed, the corresponding target network slice is selected for the terminal device according to the service identifier.

[0103] In an embodiment of the present invention, terminal device access authentication and network slice selection functions are deployed in the access gateway to solve the problem of low network access efficiency caused by separate processing of access authentication and network slice selection in related technologies.

[0104] Figure 6 This is a flowchart of an embodiment of a network slice selection method provided by the present invention. The method comprises the following steps:

[0105] Step 610: receiving a network connection requirement of at least one target service sent by a terminal device based on an updated IP packet header;

[0106] Step 620: extracting the device identifier of the terminal device and the service identifier of the target service from the update IP packet header;

[0107] Step 630: When the device identification carries signature information, obtain the public key and verify the signature information, wherein the signature information is obtained by signing the device identification using the device private key corresponding to the public key;

[0108] Step 640: If the access authentication is passed, the corresponding target network slice is selected for the terminal device according to the service identifier.

[0109] Among them, steps 610, 620, and 640 refer to the above steps 210, 220, and 240 respectively, and are not repeated again.

[0110] Corresponding to the above Figure 3In the illustrated embodiment, the public key and the device private key on the terminal device side constitute a key pair, and the access gateway uses the public key to decrypt the signature information. If the correct device identification is obtained through parsing, it indicates that the signature information is valid, and the corresponding target network slice is queried based on the service identification; if the correct device identification cannot be parsed, the networking demand is discarded and the current process ends.

[0111] In an optional embodiment, the service identifier is an application identifier of a target application running on a terminal device, and obtaining the public key includes the following steps:

[0112] Obtain the corresponding target application matrix according to the application identifier;

[0113] Determine the corresponding public key based on the target application matrix.

[0114] The target application matrix can be used directly as a public key, or a public key can be generated according to the target application matrix.

[0115] In an optional embodiment, when the access gateway selects a target network slice, the method further includes:

[0116] Connect terminal devices to network slices based on networking needs, and forward data packets through network slices.

[0117] This can achieve instant business diversion and isolation, and ensure business transparency.

[0118] Figure 7 The present invention provides a flowchart of an embodiment of a network slice selection method, which specifically includes the following steps:

[0119] Step 710: the application installed on the terminal device starts a network transmission requirement and calls the IP protocol stack. The network transmission requirement corresponds to the network transmission requirement described above.

[0120] Step 720: The terminal device signs the device ID using the device private key, and embeds the signature information and the application ID into the SRv6 tag in the IP protocol stack;

[0121] Step 730: The access gateway receives the network transmission demand carrying the data packet from the terminal device, obtains the corresponding application matrix using the application ID, obtains the public key using the pre-made application matrix, and verifies the signature information using the public key. If the verification is successful, the process proceeds to step 740; if the verification is unsuccessful, the process proceeds to step 760;

[0122] Step 740: The access gateway queries and configures policies, which may specifically include: using the application ID to query the diversion policy, access control policy, and security audit requirements configured for the service provided by the application ID, opening the corresponding VLAN (Virtual LAN), which is translated into Chinese as "virtual local area network". The virtual local area network is an example of a network slice for the Internet access target, and configuring rules on the firewall of the access gateway;

[0123] Step 750: Allocate VLAN to the data packets of the terminal device according to the pre-configured policies, execute the corresponding filtering policies, and perform split forwarding;

[0124] Step 760: If the authentication fails, the access gateway discards the data packet and ends the process.

[0125] In an optional embodiment, device access authentication and diversion links are added to the access gateway. The access gateway can provide timely network diversion services based on the network slices selected for the services on each terminal device. Each service data packet is output by the access gateway to the corresponding network slice, thereby realizing end-to-end network service isolation and achieving diversion at the first hop of the access authentication link, fully ensuring service security and reducing configuration links.

[0126] Figure 8 An embodiment of the present invention provides a network slice selection device, which is applied to a terminal device and includes:

[0127] A calling module 810, calling an IP protocol stack according to a networking requirement of at least one target application;

[0128] The embedding module 820 embeds the device identification of the terminal device and the application identification of the target application into the IP header in the IP protocol stack to obtain an updated IP header;

[0129] The authentication initiation module 830 updates the IP packet header as the data encapsulation header of the networking requirement and sends the networking requirement to the access gateway, wherein the device identifier is used by the access gateway to perform access authentication on the terminal device, and the service identifier is used to select the corresponding target network slice for the terminal device if the access authentication is passed.

[0130] The implementation principle of the above modules can be found in the relevant introduction of the network slice selection method, which will not be repeated here.

[0131] The network slice selection device of the present invention can embed both the device identifier and the service identifier into the IP packet header and send it to the access gateway, thereby realizing device access authentication and network slice selection based on the service identifier on the access gateway side, thereby solving the problem of low efficiency of terminal device network access configuration caused by decentralized management of device access authentication and network slice selection in related technologies.

[0132] In an optional embodiment, the embedding module 820 may be specifically used for:

[0133] In the IP protocol stack, the device identifier of the terminal device and the service identifier of the target service are embedded in the SRv6 label of the IP packet header.

[0134] In an alternative embodiment, Figure 8 compared to, Fig. 9 The network slice selection device shown also includes:

[0135] The signature module 910 signs the device identification with the device private key before embedding the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack to obtain the device identification with signature information;

[0136] The embedding module 920 may be specifically used for:

[0137] In the IP protocol stack, the device identifier with signature information and the service identifier of the target service are embedded in the IP packet header.

[0138] Fig.10 A structural diagram of a network slice selection device provided by the present invention, wherein the network slice selection device is applied to an access gateway and includes:

[0139] A receiving module 1010 receives a networking requirement of at least one target service sent by a terminal device based on an updated IP packet header;

[0140] Extraction module 1020, extracting the device identification of the terminal device and the application identification of the target service from the update IP packet header;

[0141] The authentication module 1030 performs access authentication on the device identification of the terminal device;

[0142] Selection module 1040, when the access authentication is passed, selects the corresponding target network slice for the terminal device according to the service identifier.

[0143] This network slice selection device can deploy terminal device access authentication and network slice selection functions in the access gateway, solving the problem of low network access efficiency caused by separate processing of access authentication and network slice selection in related technologies.

[0144] In an optional embodiment, the authentication module 1030 may be specifically used for:

[0145] In the case where the device identification carries signature information, the public key is obtained to verify the signature information, wherein the signature information is obtained by signing the device identification using the device private key corresponding to the public key.

[0146] In an optional embodiment, the authentication module 1030 may be specifically used for:

[0147] Obtain the corresponding target application matrix according to the application identifier;

[0148] Determine the corresponding public key based on the target application matrix.

[0149] In an alternative embodiment, reference Fig.11 ,and Fig.10 In comparison, the network slice selection device may also include:

[0150] The policy execution module 1110 uses the application ID to query the diversion policy, access control policy and security audit requirements configured for the target service, and opens the corresponding VLAN;

[0151] The network traffic diversion module 1120 diverts the data packets of the terminal device according to the diversion strategy.

[0152] Fig.12 Schematic diagram of the network slice selection device of the present invention. Fig.12 The electronic device 1200 according to this embodiment of the present invention is described. Fig.12 The electronic device 1200 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0153] like Fig.12 As shown, the electronic device 1200 is in the form of a general computing device. The components of the electronic device 1200 may include, but are not limited to: at least one processing unit 1210, at least one storage unit 1220, a bus 1230 connecting different platform components (including the storage unit 1220 and the processing unit 1210), a display unit 1240, etc.

[0154] The storage unit stores program codes, which can be executed by the processing unit 1210, so that the processing unit 1210 executes the steps of various exemplary embodiments of the present invention described in the electronic prescription circulation processing method section of this specification. For example, the processing unit 1210 can execute the following steps: Figure 2-Figure 7 The steps shown in any one of the embodiments.

[0155] The storage unit 1220 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 1221 and / or a cache memory unit 1222 , and may further include a read-only memory unit (ROM) 1223 .

[0156] The storage unit 1220 may also include a program / utility 1224 having a set (at least one) of program modules 1225, such program modules 1225 including but not limited to: a processing system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0157] Bus 1230 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0158] The electronic device 1200 may also communicate with one or more external devices 1250 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1200, and / or communicate with any device that enables the electronic device 1200 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1260. Furthermore, the electronic device 1200 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1270. The network adapter 1270 may communicate with other modules of the electronic device 1200 via the bus 1230. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1200, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms.

[0159] The embodiment of the present invention also provides a computer-readable storage medium for storing a program, and the steps of the network slice selection method are implemented when the program is executed. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps of various exemplary embodiments of the present invention described in the above network slice selection method section of this specification.

[0160] The program product 800 for implementing the above method according to an embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device.

[0161] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0162] Computer readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program codes contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0163] Program code for performing the processes of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0164] In summary, the purpose of the present invention is to provide a network slice selection method, system, device and storage medium, which implements device access authentication of terminal devices and network slice selection based on service identification at the access gateway, solving the problem of multi-head decentralized management of device access authentication and network slice selection in the prior art. Since device access authentication and network slice selection are executed at one end, consistency in time management can be ensured, which is conducive to improving the networking configuration efficiency of terminal devices and network slices.

[0165] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A network slice selection method, characterized in that: Applied to terminal equipment, including: Invoking an IP protocol stack according to a networking requirement of at least one target service; Embedding the device identification of the terminal device and the service identification of the target service into an IP packet header in the IP protocol stack to obtain an updated IP packet header; The updated IP packet header is used as the data encapsulation header of the networking demand, and the networking demand is sent to the access gateway, wherein the device identifier is used by the access gateway to perform access authentication on the terminal device, and the service identifier is used to select the corresponding target network slice for the terminal device if the access authentication passes; Before embedding the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack, the device identification is signed using a device private key to obtain a device identification with signature information; Embedding the device identifier of the terminal device and the service identifier of the target service into an IP packet header in the IP protocol stack includes: Embedding the device identifier with signature information and the service identifier of the target service into an IP packet header in the IP protocol stack; The access authentication refers to obtaining a public key and verifying the signature information when the device identification carries signature information, wherein the signature information is obtained by signing the device identification using the device private key corresponding to the public key.

2. The network slice selection method according to claim 1, characterized in that: Embedding the device identifier of the terminal device and the service identifier of the target service into an IP packet header in the IP protocol stack includes: In the IP protocol stack, the device identification of the terminal device and the service identification of the target service are embedded in the SRv6 label of the IP packet header.

3. A network slice selection method, characterized in that: Applicable to access gateways, including: Receiving a networking demand of at least one target service sent by a terminal device based on updating an IP packet header; Extracting the device identification of the terminal device and the service identification of the target service from the update IP packet header; Performing access authentication on the device identification of the terminal device; If the access authentication is passed, selecting a corresponding target network slice for the terminal device according to the service identifier; The performing access authentication on the device identification of the terminal device includes: In the case where the device identification carries signature information, a public key is obtained to verify the signature information, wherein the signature information is obtained by signing the device identification using a device private key corresponding to the public key.

4. The network slice selection method according to claim 3, characterized in that: The service identifier is an application identifier of a target application running on the terminal device, and obtaining the public key includes: Acquire a corresponding target application matrix according to the application identifier; The corresponding public key is determined according to the target application matrix.

5. The network slice selection method according to claim 3, characterized in that: Also includes: The terminal device is connected to the network slice according to the networking requirements, and data packets are forwarded through the network slice.

6. A network slice selection system, characterized in that: include: The terminal device calls the IP protocol stack according to the networking demand of at least one target service, embeds the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack, obtains an updated IP packet header, uses the updated IP packet header as the data encapsulation header of the networking demand, and sends the networking demand to the access gateway; The access gateway receives the networking demand of the at least one target service sent by the terminal device, extracts the device identifier of the terminal device and the service identifier of the target service from the update IP packet header, performs access authentication on the device identifier of the terminal device, and selects a corresponding target network slice for the terminal device according to the service identifier if the authentication passes; Before embedding the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack, the device identification is signed using a device private key to obtain a device identification with signature information; The step of embedding the device identifier of the terminal device and the service identifier of the target service into an IP packet header in the IP protocol stack includes: Embedding the device identifier with signature information and the service identifier of the target service into an IP packet header in the IP protocol stack; The performing access authentication on the device identification of the terminal device includes: In the case where the device identification carries signature information, a public key is obtained to verify the signature information, wherein the signature information is obtained by signing the device identification using a device private key corresponding to the public key.

7. A network slice selection device, characterized in that: Applied to terminal equipment, including: A calling module, calling an IP protocol stack according to a networking requirement of at least one target service; An embedding module, which embeds the device identification of the terminal device and the service identification of the target service into an IP packet header in the IP protocol stack to obtain an updated IP packet header; an authentication initiation module, using the updated IP packet header as a data encapsulation header for the networking requirement, and sending the networking requirement to an access gateway, wherein the device identifier is used by the access gateway to perform access authentication on the terminal device, and the service identifier is used to select a corresponding target network slice for the terminal device if the access authentication passes; Before embedding the device identification of the terminal device and the service identification of the target service into the IP packet header in the IP protocol stack, the device identification is signed using a device private key to obtain a device identification with signature information; The step of embedding the device identifier of the terminal device and the service identifier of the target service into an IP packet header in the IP protocol stack includes: Embedding the device identifier with signature information and the service identifier of the target service into an IP packet header in the IP protocol stack; The access authentication refers to obtaining a public key and verifying the signature information when the device identification carries signature information, wherein the signature information is obtained by signing the device identification using the device private key corresponding to the public key.

8. A network slice selection device, characterized in that: Applicable to access gateways, including: A receiving module, receiving a networking requirement of at least one target service sent by a terminal device based on an updated IP packet header; An extraction module, extracting a device identifier of the terminal device and a service identifier of a target service from the update IP packet header; An authentication module, performing access authentication on a device identification of the terminal device; A selection module, which selects a corresponding target network slice for the terminal device according to the service identifier when the access authentication is passed; The performing access authentication on the device identification of the terminal device includes: In the case where the device identification carries signature information, a public key is obtained to verify the signature information, wherein the signature information is obtained by signing the device identification using a device private key corresponding to the public key.

9. A network slice selection device, characterized in that: include: processor; a memory storing executable instructions of the processor; Wherein, the processor is configured to perform the steps of the network slice selection method described in any one of claims 1 to 5 by executing the executable instructions.

10. A computer-readable storage medium for storing a program, characterized in that: When the program is executed by a processor, the steps of the network slice selection method described in any one of claims 1 to 5 are implemented.

Images