Virtual private dial-up network access method, network side system, system and storage medium

Abstract

The present disclosure proposes a virtual private dial-up network access method, a network side system, a system and a storage medium, and relates to the field of mobile communication technology. A virtual private dial-up network access method disclosed in the present disclosure includes: the access and mobility management function AMF receives a VPDN access request from a user, and the VPDN access request includes the data network name DNN of the target VPDN, the account number and key of the target VPDN; the AMF obtains the target session management function SMF supporting the VPDN service through the network storage function NRF, and sends a session management context request to the target SMF; the SMF selects the user plane function UPF supporting the VPDN service to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF. Through such a method, the support of 5G network element equipment for VPDN service characteristics can be improved, and the convenience of VPDN access can be improved; there is no need to change the existing enterprise private network equipment on the client side, which is conducive to rapid deployment and promotion of application.

Description

Technical Field

[0001] The present disclosure relates to the field of mobile communication technology, and in particular to a VPDN (Virtual Private Dial-up Networks) access method, a network side system, a system and a storage medium. Background Art

[0002] VPDN is a virtual private network technology that communicates through encrypted tunnels on the public network. VPDN users can connect to the user's internal user network through a virtual secure channel over the public network, while users on the public network cannot access resources within the user network through the virtual channel.

[0003] The authentication and authorization mechanism used by traditional VPDN services is PAP / CHAP: PAP (Password Authentication Protocol) establishes authentication through two-way handshakes, and the peer node continues to send ID / password (plain text) to the verifier repeatedly until the authentication is responded to or the connection is terminated. It is commonly used in PPPOE dial-up environments; CHAP (Challenge Handshake Authentication Protocol) verifies the identity of the authenticated party (ciphertext) through three-way handshakes. It is completed when the initial link is established. In order to improve security, verification is performed periodically after the link is established. It is currently more common in remote access environments of enterprise networks. Summary of the invention

[0004] One purpose of the present disclosure is to propose a solution for accessing VPDN through a 5G network.

[0005] According to one aspect of some embodiments of the present disclosure, a VPDN access method is proposed, including: AMF (Access and Mobility Management Function) receives a VPDN access request from a user, the VPDN access request includes a DNN (Data Network Name) of a target VPDN, an account number and a key of the target VPDN; AMF obtains a target SMF (Session Management Function) supporting VPDN services through NRF (NF Repository Function), and sends a session management context request to the target SMF; SMF selects a UPF (User Plane Function) supporting VPDN services to establish a session based on the session management context request, so as to establish a tunnel with the target VPDN through the UPF.

[0006] In some embodiments, AMF obtains the target SMF supporting VPDN service through NRF, including: AMF sends a network function discovery request to NRF, and the network function discovery request includes the DNN of the target VPDN; NRF determines the SMF supporting VPDN service according to DNN, and feeds it back to AMF as the target SMF.

[0007] In some embodiments, the UPF supporting the VPDN service is a UPF supporting L2TP (Layer 2 Tunneling Protocol).

[0008] In some embodiments, the VPDN access request is carried by a non-access stratum NAS message.

[0009] In some embodiments, the VPDN access method further includes: if the NRF fails to query the SMF supporting the VPDN service, the VPDN service session establishment fails.

[0010] In some embodiments, the VPDN access method further includes: if the SMF fails to query the UPF that supports the VPDN service, the VPDN service session establishment fails.

[0011] In some embodiments, the VPDN access method further includes: the UPF receives a session establishment request from the SMF, and when determining that the session is a VPDN service, establishes a tunnel so that the target VPDN authenticates the account and key.

[0012] This method can improve the support of 5G network element equipment for VPDN services, realize the access of 5G network to virtual private network, and improve the convenience of VPDN access. There is no need to change the existing enterprise private network equipment on the customer side, which is conducive to rapid deployment and promotion of application.

[0013] According to one aspect of some embodiments of the present disclosure, a VPDN access method is proposed, including: a user terminal initiates a VPDN service request in a 5G network, wherein the VPDN service request includes an account and a key of a target VPDN; and any one of the above VPDN access methods executed by the network side.

[0014] Through this method, the user terminal can actively provide relevant information about VPDN authentication when initiating a request. The network side can identify the information and select a network element capable of handling VPDN services to handle the service request, and then access the virtual private network, thereby improving the convenience and efficiency of VPDN access.

[0015] According to one aspect of some embodiments of the present disclosure, a virtual private dial-up network access network side system is proposed, including: AMF, configured to receive a VPDN access request from a user, the VPDN access request including a DNN of a target VPDN, an account number and a key of the target VPDN; obtaining a target SMF supporting the VPDN service through NRF, and sending a session management context request to the target SMF; NRF, configured to determine an SMF supporting the VPDN service, and feed it back to AMF as the target SMF; SMF, configured to select a UPF supporting the VPDN service to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF.

[0016] In some embodiments, the VPDN access system further includes: a UPF configured to receive a session establishment request from the SMF, and to establish a tunnel when determining that the session is a VPDN service so that the target VPDN authenticates the account and key.

[0017] According to one aspect of some embodiments of the present disclosure, a virtual private dial-up network access network side system is proposed, including: a memory; and a processor coupled to the memory, the processor being configured to execute any one of the VPDN access methods mentioned above based on instructions stored in the memory.

[0018] Such a network-side system improves the support of 5G network element equipment for VPDN services, realizes virtual private network access for 5G networks, and improves the convenience of VPDN access. There is no need to change the existing enterprise private network equipment on the customer side, which is conducive to rapid deployment and promotion of applications.

[0019] According to one aspect of some embodiments of the present disclosure, a virtual private dial-up network access system is proposed, comprising: any one of the virtual private dial-up network access network side systems mentioned above; and a user terminal, configured to initiate a VPDN service request in a 5G network, wherein the VPDN service request includes an account and a key of a target VPDN.

[0020] In such a system, the user terminal can actively provide relevant information about VPDN authentication when initiating a request. The network side can identify the information and select a network element capable of handling VPDN services to handle the service request, and then access the virtual private network, thereby improving the convenience and efficiency of VPDN access.

[0021] According to one aspect of some embodiments of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the steps of any one of the VPDN access methods mentioned above are implemented.

[0022] By executing instructions on such storage media, the support of 5G network element equipment for VPDN services can be improved, and the virtual private network for 5G network access can be realized, which improves the convenience of VPDN access. There is no need to change the existing enterprise private network equipment on the customer side, which is conducive to rapid deployment and promotion of application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0024] Figure 1 The present invention provides a flowchart of some embodiments of the VPDN access method of the present invention.

[0025] Figure 2 Flow charts of other embodiments of the VPDN access method disclosed in the present invention.

[0026] Figure 3A The figure is a signaling interaction diagram of some embodiments of the VPDN access method disclosed in the present invention.

[0027] Figure 3B The following are signaling interaction diagrams of other embodiments of the VPDN access method disclosed herein.

[0028] Figure 4A It is a schematic diagram of some embodiments of the VPDN access network side system disclosed in the present invention.

[0029] Figure 4B The diagrams are schematic diagrams of some embodiments of the network architecture of the VPDN access network side system disclosed in the present invention.

[0030] Figure 5 Schematic diagrams of other embodiments of the VPDN access network side system disclosed in the present invention.

[0031] Figure 6 Schematic diagrams of some further embodiments of the VPDN access network side system disclosed in the present invention.

[0032] Figure 7 Schematic diagrams of some embodiments of the VPDN access system disclosed in the present invention. DETAILED DESCRIPTION

[0033] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments.

[0034] The flowcharts of some embodiments of the VPDN access method disclosed in the present invention are as follows: Figure 1 shown.

[0035] In step 101, the AMF receives a VPDN access request from a user. In some embodiments, the VPDN access request includes a DNN of a target VPDN, and an account number and a key of the target VPDN.

[0036] In some embodiments, the VPDN access request can be carried by a NAS message, for example, by adding support for PAP / CHAP features in the ePCO information element to carry the VPDN service identifier: VPDN account and password. In some embodiments, the VPDN access request can be carried by a PDU session establishment request.

[0037] In some embodiments, when a user needs to initiate a request to access a VPDN, the user terminal sends a VPDN access request carrying a PAP / CHAP feature, such as adding a PAP / CHAP feature to the ePCO information element to carry a VPDN service identifier: VPDN account and password. In some embodiments, the VPDN access request also includes the DNN of the target VPDN.

[0038] In step 102, the AMF obtains the target SMF supporting the VPDN service through the NRF. In some embodiments, when the NRF determines that the current session establishment request is for the VPDN service, it determines the SMF supporting the VPDN according to the stored information and feeds it back to the AMF as the target SMF.

[0039] In step 103, the AMF sends a session management context request to the target SMF based on the feedback information of the NRF.

[0040] In step 104, the SMF selects a UPF supporting the VPDN service to establish a session according to the session management context request. In some embodiments, the tunnel technology used by the VPDN service is currently widely used L2TP, so the UPF supporting the VPDN service is a UPF supporting L2TP.

[0041] In some embodiments, the session management context request may carry DNN information so that the UPF determines that the session is for VPDN service. In some embodiments, when the UPF determines that the session to be established is for VPDN service, it establishes a tunnel with the target private network.

[0042] This method can improve the support of 5G network element equipment for VPDN service characteristics, enable the 5G network to smoothly take over traditional VPDN services based on PAP / CHAP authentication, and improve the convenience of VPDN access. There is no need to change the existing enterprise private network equipment on the customer side, which is conducive to rapid deployment and promotion of applications.

[0043] The flowcharts of other embodiments of the VPDN access method disclosed in the present invention are as follows: Figure 2 shown.

[0044] In step 201, the AMF receives a VPDN access request from a user, where the VPDN access request includes a DNN of a target VPDN, and an account and a key of the target VPDN.

[0045] In step 202, the AMF sends a network function discovery request to the NRF, where the network function discovery request includes the DNN of the target VPDN.

[0046] In step 203, the NRF determines, based on the DNN, that an SMF that supports VPDN services needs to be provided to the AMF.

[0047] In step 204, the NRF determines whether an SMF supporting the VPDN service is found. If no SMF supporting the VPDN service is found, step 205 is executed; if an SMF supporting the VPDN service is found, step 206 is executed.

[0048] In step 205, it is determined that the VPDN service session establishment fails. In some embodiments, the session establishment failure may be fed back to the user.

[0049] In step 206, one of the found SMFs that supports the VPDN service is used as the target SMF, and the target SMF is fed back to the AMF.

[0050] In step 207, the AMF sends a session management context request to the target SMF.

[0051] In step 208, the SMF determines that a UPF supporting the VPDN service needs to be selected based on the session management context request. In some embodiments, the session management context request may carry DNN information of the target VPDN so that the SMF determines that the request is for the VPDN service and then selects a UPF supporting the VPDN service.

[0052] In step 209, the SMF determines whether a UPF supporting the VPDN service is found. If no UPF supporting the VPDN service is found, step 205 is executed. If a UPF supporting the VPDN service is found, step 210 is executed.

[0053] In step 210, the AMF establishes a session with the determined UPF to cause the UPF to establish a tunnel with the target VPDN.

[0054] Through this method, the network elements of the 5G network can identify and process the access requests for VPDN from the user terminals, realize the access to VPDN through the 5G network, and improve the convenience of accessing VPDN; during the session establishment process, if there is no VPDN support capability, it can respond to the establishment failure in time to improve reliability.

[0055] In some embodiments, Figure 2 As shown, the VPDN access method may further include steps 211 to 213.

[0056] In step 211, the UPF receives a session establishment request from the SMF. In some embodiments, the session establishment request may include the DNN of the target VPDN, and the account and key of the target VPDN.

[0057] In step 212, the UPF determines whether the session to be established is for a VPDN service. If it is determined to be for a VPDN service, step 213 is executed; if it is not for a VPDN service, the corresponding processing flow for other services in the related technology is executed.

[0058] In step 213, the UPF establishes an L2TP tunnel with the target VPDN so that the target VPDN can authenticate the account and key. In some embodiments, the LNS and AAA of the VPDN can perform PAP or CHAP authentication on the user according to the account and key of the target VPDN. If the authentication is successful, the VPDN service is successfully established; if the authentication is not successful, the VPDN service is unsuccessful.

[0059] Through this method, after the tunnel is established, the information required for VPDN to authenticate the user can be further provided, thereby ensuring the security of VPDN while ensuring that the 5G network supports access to VPDN.

[0060] The signaling interaction diagrams of some embodiments of the VPDN access method disclosed in the present invention are as follows: Figure 3A In some embodiments, the connection relationship of the network elements involved in the VPDN access method can be as follows Figure 4B As shown in the figure, the network mainly consists of two parts: 5G network and enterprise network as VPDN. Users connect to the enterprise network via the 5G network.

[0061] In 301, the terminal UE sends a PDU Session Establishment Request to the AMF, which includes the DNN and the account and key of the target VPDN carried by the cell ePCO.

[0062] In 302, AMF sends NF Discover Request to NRF. NRF recognizes that the request includes DNN of VPDN, and determines that it needs to query SMF supporting VPDN.

[0063] In 303, if the NRF queries the SMF that supports VPDN, it will be fed back to the AMF as the target SMF.

[0064] In 304, AMF provides DNN and the user's account and key in the target VPDN to SMF through Create SM Context Request.

[0065] In 305-307, SMF initiates Subscription Retrieval to UDM, and feeds back Create SM Context Response to AMF. For this process, reference may be made to the interaction process between SMF and UDM in the related art.

[0066] In 308, the SMF selects a UPF that supports VPDN service characteristics, such as a UPF device that supports L2TP, based on the service characteristics of the session.

[0067] In 309-310, the SMF sends an N4Session Establishment Request session establishment request to the selected UPF, and sends the DNN and VPDN authentication information to the UPF through the request, and the UPF responds with an N4Session EstablishmentResponse.

[0068] In 311 to 313, the SMF informs the terminal through the AMF and RAN (Radio Access Network) that the PDU session is successfully established.

[0069] In some embodiments, after the transfer of the 5G network part is completed, the process of the 5G system accessing the VPDN service is as follows: Figure 3B As shown in the figure, the CHAP authentication mechanism is taken as an example. In some embodiments, the connection relationship of the network elements involved in the VPDN access method can be as follows Figure 4B as shown in .

[0070] In 321, the PDU Session Establishment Request sent by the user terminal to the UPF includes the DNN, and the account and key of the target VPDN. In some embodiments, the PDU Session Establishment Request is sent to the UPF through the processes of 301 to 309 above.

[0071] In 322-323, when the UPF determines that the session to be established is for the VPDN service, it establishes an L2TP tunnel with the relevant LNS through the public network.

[0072] In 324-328, the private network device of the VPDN performs CHAP authentication on the VPDN user. In some embodiments, the authentication process is the same as that in the related art.

[0073] Through this method, the terminal has a private network DNN in the VPDN session. By expanding the relevant information element characteristics of the NAS messages interacting between the UE and the network, and enhancing the support of the 5G network element equipment for the VPDN service characteristics, VPDN users can access the virtual private network of the enterprise and closed sites through 5G access combined with the original authentication system and authorization mechanism to better realize various network communications between the enterprise and its branches, between branches, and between enterprises and partners. In addition, the implementation process of this method does not require improvements to the VPDN internally, which improves deployment efficiency, reduces implementation difficulty, and is conducive to promotion and application.

[0074] Schematic diagrams of some embodiments of the VPDN access network side system disclosed in the present invention are as follows Figure 4A shown.

[0075] AMF 401 can receive a VPDN access request from a user, the VPDN access request includes the DNN of the target VPDN, the account number and key of the target VPDN; AMF 401 can obtain the target SMF supporting the VPDN service through NRF, and send a session management context request to the target SMF. In some embodiments, the session management context request can carry the DNN information of the target VPDN, so that the SMF determines that the request is for the VPDN service, and then selects the UPF supporting the VPDN service.

[0076] NRF 402 can determine the SMF that supports the VPDN service and feed it back to AMF as the target SMF. In some embodiments, NRF can determine whether the request from AMF includes the DNN of VPDN. If it is determined that the DNN of VPDN is included, it will initiate a search for the SMF that supports the VPDN service and provide the found SMF as the target SMF to AMF, thereby ensuring the support capability of subsequent nodes for VPDN.

[0077] SMF 403 can select a UPF supporting VPDN services to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF. In some embodiments, SMF 403 can determine whether the request from AMF includes the DNN of VPDN. If it is determined that the DNN of VPDN is included, it will initiate a search for UPF supporting VPDN services, thereby ensuring the support capability of subsequent nodes for VPDN.

[0078] Such a network-side system improves the support of 5G network element equipment for VPDN service features, realizes virtual private network access for 5G networks, and improves the convenience of VPDN access. There is no need to change the existing enterprise private network equipment on the customer side, which is conducive to rapid deployment and promotion of applications.

[0079] In some embodiments, Figure 4A As shown, the VPDN access system may also include UPF404, which can receive a session establishment request from the SMF and establish a tunnel when determining that the session is for a VPDN service. In some embodiments, after completing the tunnel establishment, the UPF provides the user's account and key to the VPDN so that the VPDN equipment can verify.

[0080] After the tunnel is established, such a network-side system can further provide the information required for VPDN to authenticate the user, thereby ensuring the security of VPDN while ensuring that the 5G network supports access to VPDN.

[0081] In some embodiments, the connection relationship between the various parts of the VPDN access system can be as follows: Figure 4B As shown in the figure, based on the existing 5G network and private network, VPDN access can be achieved by simply expanding the functions of 5G network equipment, reducing the difficulty of implementation.

[0082] The structural diagram of an embodiment of the VPDN access system disclosed in the present invention is as follows: Figure 5As shown. The VPDN access network side system includes a memory 501 and a processor 502. Among them: the memory 501 can be a disk, a flash memory or any other non-volatile storage medium. The memory is used to store the instructions in the corresponding embodiment of the VPDN access method above. The processor 502 is coupled to the memory 501 and can be implemented as one or more integrated circuits, such as a microprocessor or a microcontroller. The processor 502 is used to execute the instructions stored in the memory, which can improve the convenience of VPDN access and facilitate rapid deployment and promotion of applications.

[0083] In one embodiment, it is also possible to Figure 6 As shown, the VPDN access network side system 600 includes a memory 601 and a processor 602. The processor 602 is coupled to the memory 601 via a BUS 603. The VPDN access network side system 600 can also be connected to an external storage device 605 via a storage interface 604 to call external data, and can also be connected to a network or another computer system (not shown) via a network interface 606. No further detailed description will be given here.

[0084] In this embodiment, by storing data instructions in a memory and then processing the instructions through a processor, the convenience of VPDN access can be improved, which is conducive to rapid deployment and promotion of applications.

[0085] In another embodiment, a computer-readable storage medium stores thereon computer program instructions, which, when executed by a processor, implement the steps of the method in the corresponding embodiment of the VPDN access method. Those skilled in the art should understand that the embodiments of the present disclosure may be provided as methods, devices, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transitory storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] Schematic diagrams of some embodiments of the VPDN access system disclosed in the present invention are as follows Figure 7 shown.

[0087] The VPDN access network side system 71 can be any one of the ones mentioned above. The VPDN access system also includes user terminals 721~72n, where n is a positive integer. When a user needs to initiate a request to access the VPDN, the user terminal sends a VPDN access request carrying the PAP / CHAP feature, such as adding the PAP / CHAP feature to the ePCO information element to carry the VPDN service identifier: VPDN account and password. In some embodiments, the VPDN access request also includes the DNN of the target VPDN.

[0088] In such a system, the user terminal can actively provide relevant information about VPDN authentication when initiating a request. The network side can identify the information and select a network element capable of handling VPDN services to handle the service request, and then access the virtual private network, thereby improving the convenience and efficiency of VPDN access.

[0089] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0092] So far, the present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0093] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present disclosure rather than to limit it. Although the present disclosure has been described in detail with reference to the preferred embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present disclosure can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present disclosure, which should be included in the scope of the technical solution for protection of the present disclosure.

Claims

1. A virtual private dial-up network access method, comprising: The access and mobility management function AMF receives a virtual private dial-up network VPDN access request from a user, wherein the VPDN access request includes a data network name DNN of a target VPDN, an account number and a key of the target VPDN; The AMF obtains the target session management function SMF supporting the VPDN service through the network storage function NRF, and sends a session management context request to the target SMF; The SMF selects a user plane function UPF supporting VPDN services to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF.

2. The method according to claim 1, wherein: The target SMF that the AMF obtains through the NRF to support the VPDN service includes: The AMF sends a network function discovery request to the NRF, where the network function discovery request includes the DNN of the target VPDN; The NRF determines the SMF that supports the VPDN service based on the DNN, and feeds it back to the AMF as the target SMF.

3. The method according to claim 1, wherein: The UPF supporting the VPDN service is a UPF supporting L2TP.

4. The method according to claim 1, wherein: The VPDN access request is carried by a non-access layer NAS message.

5. The method according to claim 2, further comprising: If the NRF fails to query the SMF that supports the VPDN service, the VPDN service session establishment fails.

6. The method according to claim 1, further comprising: If the SMF does not query the UPF that supports the VPDN service, the VPDN service session establishment fails.

7. The method according to claim 1, further comprising: The UPF receives the session establishment request from the SMF, and when determining that the session is a VPDN service, establishes a tunnel so that the target VPDN authenticates the account and key.

8. A virtual private dial-up network access method, comprising: The user terminal initiates a VPDN service request in the 5G network, wherein the VPDN service request includes an account number and a key of the target VPDN; and A VPDN access method as claimed in any one of claims 1 to 7 executed by the network side.

9. A virtual private dial-up network access network side system, comprising: The access and mobility management function AMF is configured to receive a virtual private dial-up network VPDN access request from a user, wherein the VPDN access request includes a data network name DNN of a target VPDN, an account number and a key of the target VPDN; Acquire a target session management function SMF supporting the VPDN service through the network storage function NRF, and send a session management context request to the target SMF; The NRF is configured to determine the SMF supporting the VPDN service and feed it back to the AMF as the target SMF; The SMF is configured to select a user plane function UPF supporting VPDN services to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF.

10. The network side system according to claim 9, further comprising: The UPF is configured to receive a session establishment request from the SMF, and when determining that the session is a VPDN service, establish a tunnel so that the target VPDN authenticates the account and key.

11. A virtual private dial-up network access network side system, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method according to any one of claims 1 to 7 based on instructions stored in the memory.

12. A virtual private network access system, comprising: The virtual private dial-up network access network side system as described in any one of claims 9 to 11; and The user terminal is configured to initiate a VPDN service request in the 5G network, wherein the VPDN service request includes an account and a key of a target VPDN.

13. A computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Images