Network access method, device and electronic equipment

Abstract

The present application provides a network access method, device and electronic device, including: receiving a network access request sent by a communication server; determining preset authentication information according to the network access request; verifying the network access request through the preset authentication information and obtaining a verification result; sending the verification result to the communication server, so that the communication server connects the user device to the communication network when the authentication result indicates that the verification is successful. On the basis of the existing communication network, the communication server can be connected to the authentication server, and the network access request received by the communication server can be verified by the authentication server. By returning the verification result indicating the verification is successful to the communication server, the communication server connects the device sending the network access request to the communication network, which not only increases the security of the communication network, but also avoids the stability risks caused by directly upgrading the security of the communication server.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and in particular, to a network access method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of Internet technology, the fifth generation mobile communication technology (5G) is rapidly becoming popular. More and more users are beginning to use 5G technology to deploy private networks, allowing users to access the organization's intranet at high speed through 5G terminals.

[0003] In the related art, after a private network is deployed through 5G technology, a data network name (DNN) corresponding to the private network will be set, and the data network name will be notified to the users of the private network. The users of the private network can configure the data network name corresponding to the private network through the 5G terminal. The 5G terminal sends a network access request containing the data network name to the 5G base station. The 5G base station parses the data network name from the network access request and enables the user's 5G terminal to access the corresponding private network.

[0004] Since there is a risk of data network name leakage, once the data network name is leaked, it may cause security risks to the user's internal private network. Summary of the invention

[0005] The embodiments of the present application provide a network access method, device, electronic device, computer-readable storage medium and computer program product to solve the problem of poor security of dedicated networks deployed through 5G technology in related technologies.

[0006] In a first aspect, an embodiment of the present application provides a network access method, the method comprising:

[0007] Receiving a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server;

[0008] Determining preset authentication information according to the network access request;

[0009] Verifying the network access request through the preset authentication information and obtaining a verification result;

[0010] The verification result is sent to the communication server, so that the communication server connects the user equipment to the communication network if the verification result indicates that the verification is successful.

[0011] In an optional implementation, the communication server is a session management network element, the session management network element belongs to the 5G core network, and the session management network element receives the network access request sent by the user equipment through a 5G base station.

[0012] In an optional implementation manner, the network access request includes a user account identifier, and determining the preset authentication information according to the network access request includes:

[0013] The user account identifier is compared with an authentication information database to determine preset authentication information corresponding to the user account identifier; wherein the preset authentication information and the network access request have the same data structure.

[0014] In an optional implementation manner, the network access request further includes user equipment information, an access network identifier, and a user account password corresponding to the user account identifier; and the verifying the network access request by using the preset authentication information and obtaining a verification result includes:

[0015] Matching the user device information with the preset device information in the preset authentication information, matching the access network identifier with the preset network information in the preset authentication information, and matching the user account password with the preset account password in the preset authentication information;

[0016] In the case where the user equipment information, the access network identifier and the user account password all successfully match the preset authentication information, the verification result is determined to be a successful verification.

[0017] In an optional implementation manner, the user equipment information includes an International Mobile Equipment Identity and an International Mobile Subscriber Identity, and the method further includes:

[0018] If the international mobile equipment identity code fails to match the preset device identity code of the preset device information, and the first other information included in the network access request matches the preset authentication information successfully, determining that the verification result is partially successful; wherein the first other information refers to the information in the network access request other than the international mobile equipment identity code;

[0019] When the verification result is partially successful, the user equipment is connected to a public network.

[0020] In an optional implementation, the method further includes:

[0021] If the access network identifier fails to match the preset network information, and the second other information included in the network access request matches the preset authentication information, determining the similarity between the access network identifier and the preset network information;

[0022] When the similarity is greater than or equal to a preset similarity, the verification result is determined to be a successful verification, and the access network identifier is corrected according to the preset network information.

[0023] In an optional implementation, the network access request includes an access network identifier, and the sending of the verification result to the communication server so that the communication server accesses the user equipment to the communication network when the authentication result indicates that the verification is successful includes:

[0024] Acquire the access network identifier from the network access request;

[0025] Comparing the access network identifier with a preset correspondence relationship to determine a target communication server corresponding to the access network identifier; wherein the preset correspondence relationship includes a one-to-one correspondence between at least one network identifier and a communication server;

[0026] The verification result and the network access request are sent to the target communication server, so that the target communication server connects the user equipment to the target communication network according to the network access request.

[0027] In a second aspect, an embodiment of the present application provides a network access device, the device comprising:

[0028] A receiving module, used for receiving a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server;

[0029] An information module, used to determine preset authentication information according to the network access request;

[0030] A verification module, used to verify the network access request through the preset authentication information and obtain a verification result;

[0031] The sending module is used to send the verification result to the communication server, so that the communication server connects the user equipment to the communication network when the authentication result indicates that the verification is successful.

[0032] In an optional implementation manner, the network access request includes a user account identifier, and the information module includes:

[0033] The preset authentication information submodule is used to compare the user account identifier with the authentication information database to determine the preset authentication information corresponding to the user account identifier; wherein the preset authentication information and the network access request have the same data structure.

[0034] In an optional implementation manner, the network access request further includes user equipment information, an access network identifier, and a user account password corresponding to the user account identifier; and the verification module includes:

[0035] a matching submodule, configured to match the user device information with the preset device information in the preset authentication information, match the access network identifier with the preset network information in the preset authentication information, and match the user account password with the preset account password in the preset authentication information;

[0036] The verification result submodule is used to determine that the verification result is successful verification when the user equipment information, the access network identifier and the user account password all match the preset authentication information successfully.

[0037] In an optional implementation manner, the user equipment information includes an international mobile equipment identity code and an international mobile subscriber identity code, and the apparatus further includes:

[0038] a partial matching module, configured to determine that the verification result is partially successful if the international mobile equipment identity code fails to match the preset device identity code of the preset device information, and the first other information included in the network access request matches the preset authentication information successfully; wherein the first other information refers to information in the network access request other than the international mobile equipment identity code;

[0039] The public network module is used to connect the user equipment to the public network when the verification result is partially successful.

[0040] In an optional embodiment, the device further comprises:

[0041] a similarity module, configured to determine the similarity between the access network identifier and the preset network information when the access network identifier fails to match the preset network information and the second other information included in the network access request matches the preset authentication information successfully;

[0042] The similarity verification module is used to determine that the verification result is successful when the similarity is greater than or equal to a preset similarity, and to correct the access network identifier according to the preset network information.

[0043] In an optional implementation, it is characterized in that the network access request includes an access network identifier, and the sending module includes:

[0044] An acquisition submodule, used to acquire the access network identifier from the network access request;

[0045] The communication server submodule is used to compare the access network identifier with a preset corresponding relationship to determine the target communication server corresponding to the access network identifier; wherein the preset corresponding relationship includes a one-to-one correspondence between at least one network identifier and a communication server;

[0046] The sending submodule is used to send the verification result and the network access request to the target communication server, so that the target communication server connects the user equipment to the target communication network according to the network access request.

[0047] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the network access method.

[0048] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the network access method.

[0049] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, which implements the network access method when executed by a processor.

[0050] In the embodiment of the present application, a network access request sent by a communication server can be received; the network access request is sent by a user device to the communication server; preset authentication information is determined according to the network access request; the network access request is verified by the preset authentication information, and a verification result is obtained; the verification result is sent to the communication server, so that the communication server connects the user device to the communication network when the authentication result indicates that the verification is successful. On the basis of the existing communication network, the communication server can be connected to the authentication server, and the network access request received by the communication server can be verified by the authentication server. By returning the verification result indicating successful verification to the communication server, the communication server connects the device that sent the network access request to the communication network, which not only increases the security of the communication network, but also avoids the stability risks caused by directly upgrading the security of the communication server.

[0051] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0053] Figure 1 is a flowchart of a network access method provided by an embodiment of the present application;

[0054] Figure 2 is a flowchart of another network access method provided by an embodiment of the present application;

[0055] Figure 3 This is a 5G core network architecture diagram provided by an embodiment of the present application;

[0056] Figure 4 This is a 5G core network architecture diagram for setting a verification server provided in an embodiment of the present application;

[0057] Figure 5 is a network access interaction diagram provided by an embodiment of the present application;

[0058] Figure 6 is a structural diagram of a network access device provided in an embodiment of the present application;

[0059] Figure 7 It is a logic block diagram of an electronic device provided in an embodiment of the present application;

[0060] Figure 8 It is a logic block diagram of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0062] The present application embodiment provides a network access method applied to an authentication server, referring to Figure 1 , Figure 1 is a flowchart of a network access method provided by an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0063] Step 101: Receive a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server.

[0064] The communication server may include a 5G base station, and other servers that can connect to user devices and enable user devices to access the Internet and / or a local area network. The embodiments of the present application are not specifically limited here. Among them, user devices may include mobile phones, mobile computers, data cards, wireless routers, and other devices that can access wireless networks, which are not specifically limited in the embodiments of the present application.

[0065] Since the communication server can be connected to the Internet, the communication server can serve as a node of multiple sub-networks at the same time. Therefore, users can access different sub-networks through the communication server.

[0066] When a user device accesses a network through a communication server, it can send a network access request to the communication server. The network access request may include a network identifier that the user device wants to access. For example, the network identifier may be a data network name (Data Network Name, DNN) to notify the communication server to connect the user device to the network corresponding to the network identifier.

[0067] In order to enhance network security, in an embodiment of the present application, after receiving a network access request sent by a user device, the communication server may forward the network access request to an authentication server, and the authentication server verifies the network access request.

[0068] Step 102: Determine preset authentication information according to the network access request.

[0069] In addition to the network identifier that the user device wants to access, the network access request may also include verification information. The verification information may be the device information of the user device that sends the network access request, such as a device identification code, etc., or it may be pre-declared authentication information, such as user account information, etc. Before the user device sends a network access request to the communication server, the correspondence between the verification information and the network identifier may be pre-registered in the authentication server, and the authentication server stores the correspondence between the verification information and the network identifier as preset authentication information in the authentication information database. It should be noted that the verification information may also include other forms of information that can identify the identity of the user device, which is not specifically limited in the embodiments of the present application.

[0070] After receiving the network access request forwarded by the communication server, the authentication server needs to verify the network access request to determine whether the user equipment sending the network access request is allowed to access the network it wants to access.

[0071] Specifically, the network identification and verification information can be obtained from the network access request, and the network identification or verification information can be matched with the authentication information database to determine the preset authentication information corresponding to the network identification or verification information. It should be noted that only the network identification can be matched with the authentication information database to query the preset authentication information containing the network identification. It is also possible to only match the verification information with the authentication information database to query the preset authentication information containing the verification information.

[0072] Step 103: Verify the network access request using the preset authentication information and obtain a verification result.

[0073] After obtaining the preset authentication information corresponding to the network access request, the network access request can be verified according to the preset authentication information.

[0074] If the network identifier and the verification information included in the network access request are completely included in the corresponding preset authentication information, the authentication server generates a verification result indicating that the verification is successful.

[0075] If the network identifier and verification information included in the network access request are not completely included in the corresponding preset authentication information, the authentication server generates a verification result indicating verification failure for the network access request.

[0076] Step 104: Send the verification result to the communication server, so that the communication server connects the user equipment to the communication network when the authentication result indicates that the verification is successful.

[0077] After the authentication server generates a verification result for the network access request, the verification result can be sent to the communication server. It should be noted that since the communication server may process multiple network access requests at the same time, when the authentication server returns the verification result to the communication server for a certain network access request, the corresponding network access request can also be added to the verification result to indicate the communication server the user device corresponding to the verification result.

[0078] After receiving the verification result, the communication server reads the content of the verification result. If the verification result indicates that the verification is successful, the network access request corresponding to the verification result is parsed, the network identifier is obtained, and the user device corresponding to the verification result is connected to the communication network corresponding to the network identifier.

[0079] Specifically, the communication server may connect the user device to the communication network by assigning an IP address belonging to the communication network to the user device, or may use other methods to connect the user device to the communication network, which is not specifically limited in the embodiments of the present application.

[0080] In an embodiment of the present application, a network access method is disclosed, which can receive a network access request sent by a communication server; the network access request is sent by a user device to the communication server; preset authentication information is determined according to the network access request; the network access request is verified by the preset authentication information, and a verification result is obtained; the verification result is sent to the communication server, so that the communication server connects the user device to the communication network when the authentication result indicates that the verification is successful. On the basis of the existing communication network, the communication server can be connected to the authentication server, and the network access request received by the communication server can be verified by the authentication server. By returning the verification result indicating the verification is successful to the communication server, the communication server connects the device that sent the network access request to the communication network, which not only increases the security of the communication network, but also avoids the stability risks caused by directly upgrading the security of the communication server.

[0081] Figure 2 is a flowchart of another network access method provided by an embodiment of the present application, such as Figure 2 As shown, the method includes:

[0082] Step 201: Receive a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server.

[0083] The embodiments of the present application can be applied to a dedicated network built by 5G technology, such as a Smart Transport Network (STN), an optical transport network (OTN), etc., and a user device can access its intranet through a dedicated network. In the case of a dedicated network built by 5G technology, the communication server can be a session management network element in the 5G core network. The user sends a network access request to a 5G base station, and the 5G base station then transmits the network access request to the session management network element in the 5G core network (5G Core Network, 5GC). The session management network element can respond to the network access request of the user device and connect the user device to the communication network it wants to access.

[0084] Reference Figure 3 , Figure 3 A 5G core network architecture diagram provided in an embodiment of the present application is shown, such as Figure 3As shown, the 5G core network may include an access and mobility management function network element (AMF), a session management network element (SMF), a user plane network element (UPF), a radio access network network element (RAN), and a user equipment (UE). Among them, the user equipment communicates with the access and mobility management function network element through N1 messages, the access and mobility management function network element communicates with the radio access network element through N2 messages, the radio access network element communicates with the user plane network element through N3 messages, and the session management network element communicates with the user plane network element through N4 messages. The above description is an explanatory description of the basic architecture of the 5G core network. In the embodiment of the present application, the 5G core network may include but is not limited to the above network architecture.

[0085] After receiving the network access request sent by the user equipment, the base station hands the network access request to the access and mobility management function network element for processing. After processing, the access and mobility management function network element forwards it to the session management network element. The session management network element parses the network access request to determine the private network that needs to be accessed, and notifies the user plane network element to which private network the user equipment is to be accessed. Finally, the user plane network element controls the wireless access network element to connect the user equipment to the corresponding private network. It should be noted that the above process of connecting the user equipment to the required private network is only an exemplary description. It should be noted that the network access process may also include only some of the above steps, or include other steps in addition to the above steps. The specific detailed process of accessing the private network in the embodiment of the present application is not specifically limited here.

[0086] Reference Figure 4 , Figure 4 The 5G core network architecture diagram of the setting verification server provided in the embodiment of the present application is shown as follows: Figure 4 As shown, the authentication server (AAA) can be connected to the session management network element (SMF) to verify the access request received by the session management network element and return the verification result to the session management network element to instruct the session management network element how to respond to the access request.

[0087] Step 202: Compare the user account identifier with an authentication information database to determine preset authentication information corresponding to the user account identifier; wherein the preset authentication information and the network access request have the same data structure.

[0088] In an embodiment of the present application, a user account identifier may be included in a network access request. A user may enter preset authentication information including a user account identifier into an authentication information database in advance through an authentication information configuration interface. When an authentication server receives a network access request, it may parse the user account identifier from the network access request and compare it with the user account identifier stored in the authentication information database to determine the preset authentication information entry corresponding to the preset account identifier in the authentication information database. The authentication information configuration interface may be run on a terminal or server specified by the user and connected to the authentication information database. The user may add, delete, and adjust authentication information entries to the authentication information database in the authentication information configuration interface to enable the user to manage the authentication information of each user device on his own.

[0089] It should be noted that since the information contained in the network access request needs to be compared with the preset authentication information to determine whether the user device sending the network access request is allowed to access the corresponding network, the preset authentication information may include other data that is the same as the network access request in addition to the user account identifier.

[0090] Step 203: Match the user device information with the preset device information in the preset authentication information, match the access network identifier with the preset network information in the preset authentication information, and match the user account password with the preset account password in the preset authentication information.

[0091] In addition to the user account identifier, the network access request may also include user device information, access network, and a user account password corresponding to the user account identifier. Preset authentication information including the user account identifier, user device information, access network, and the user account password corresponding to the user account identifier may be entered into the authentication information database in advance, and a corresponding relationship among the user account identifier, user device information, access network, and user account password may be established to form the preset authentication information.

[0092] When the authentication server receives the network access request, it can parse the user account identifier from the network access request and compare it with the user account identifier stored in the authentication information database to determine the preset authentication information corresponding to the preset account identifier in the authentication information database, and then compare the network access request with the preset authentication information to obtain the corresponding verification result.

[0093] In the specific matching process, the user device information can be directly matched with the preset device information in the preset authentication information, the access network identifier can be matched with the preset network information in the preset authentication information, and the user account password can be matched with the preset account password in the preset authentication information. The user device information, the access network identifier, and the user account password can also be combined or calculated to obtain the first user comparison data, and then the first user comparison data is compared with the first preset comparison data, wherein the first preset comparison data can be obtained by combining or calculating the preset device information, the preset network identifier, and the preset account password in the preset authentication information in advance, and stored in the authentication information database.

[0094] Step 204: When the user equipment information, the access network identifier, and the user account password all successfully match the preset authentication information, determine that the verification result is a successful verification.

[0095] If the above comparison result shows that the user device information in the network access request is consistent with the preset device identifier in the preset authentication information matched by the user account identifier of the network access request, the access network identifier in the network access request is consistent with the preset network identifier in the preset authentication information, and the user account password in the network access request is consistent with the preset account password in the preset authentication information, then it can be determined that the verification result is successful.

[0096] Furthermore, in an embodiment of the present application, the corresponding preset authentication information may not be determined by the user account identifier in the network access request, and the user account identifier, user device information, access network identifier, and user account password in the network access request may be directly combined or calculated to obtain the second user comparison data, and then the second user comparison data may be compared with the second preset comparison data, wherein the second preset comparison data may be obtained by combining or calculating the preset account identifier, preset device information, preset network identifier, and preset account password in the preset authentication information in advance, and stored in the authentication information database.

[0097] Optionally, step 204 may also include:

[0098] Sub-step 2041: When the international mobile equipment identity code fails to match the preset device identity code of the preset device information, and the first other information included in the network access request matches the preset authentication information successfully, determine that the verification result is partially successful; wherein the first other information refers to the information in the network access request other than the international mobile equipment identity code.

[0099] In an embodiment of the present application, the user equipment information may include an international mobile equipment identity and an international mobile subscriber identity, wherein the international mobile equipment identity (IMEI), commonly referred to as the user equipment serial number or the user equipment "serial number", is used to identify each independent user equipment in the mobile network, which is equivalent to the user equipment ID card. The serial number has 15 digits in total, the first 6 digits (TAC) are the model approval number, representing the user equipment type. The next 2 digits (FAC) are the final assembly number, representing the place of origin. The last 6 digits (SNR) are the serial number, representing the production sequence number. The last 1 digit (SP) is generally 0, which is a check code. The international mobile equipment identity is generally present in the memory of the user equipment. The international mobile subscriber identity (IMSI) is an identification code used to distinguish different users in a cellular network and is not repeated in all cellular networks. The user equipment stores the IMSI in a 64-bit field and sends it to the network. That is commonly referred to as the SIM card identification code, and each SIM card corresponds to an international mobile equipment identity code.

[0100] Since the International Mobile Equipment Identity code corresponds to the user device, and the International Mobile User Identity code is bound to the SIM card or mobile phone number, the SIM card and the mobile phone number are generally bound to the user's identity information. Considering that the user may frequently change the user device, therefore, when the user changes the user device, the International Mobile Equipment Identity code in the network access request will not match the preset authentication information corresponding to the network access request. At this time, if the International Mobile User Identity code in the network access request can match the preset authentication information, it can be determined that the user who sent the network access request may have changed the user device but did not change the SIM card or mobile phone number. In this case, if the first other information in the network access request except the International Mobile Equipment Identity code successfully matches the corresponding preset authentication information, the verification result of the network access request can be determined as partially successful.

[0101] Sub-step 2042: When the verification result is partially successful, access the user equipment to a public network.

[0102] If only the international user equipment identity code of a network access request cannot match the corresponding preset authentication information, it is likely that the user has changed the user equipment and has not updated the authentication information database in time according to the international mobile equipment identity code of the replaced user equipment, indicating that the user who sent the network access request is most likely not a malicious user. However, considering that there is still a certain security risk when the network access request cannot completely match the preset authentication information, the authentication server can return a partially successful verification result to the communication server, so that the communication server will access the user equipment that sent the network access request to the public network when the verification result indicates a partial success. Among them, the public network can be a general 5G network that enables the user equipment to access the Internet.

[0103] Sub-step 2043: When the access network identifier fails to match the preset network information, and the second other information included in the network access request matches the preset authentication information successfully, determine the similarity between the access network identifier and the preset network information.

[0104] In an embodiment of the present application, the access network information may include the data network name (Data Network Name, DNN) corresponding to the 5G private network. The main function of the data network name is to distinguish the access of different communication networks. The communication server (such as the 5G core network) can divert and converge the session to different SMF / UPF according to the data network name to achieve customer-directed access to the designated private network.

[0105] Since the user has pre-registered the correspondence between the preset account identifier, preset account password and other information and the preset network information that needs to be accessed in the authentication information server, if the second other information contained in the network access request can be successfully matched with the corresponding preset authentication information, and only the preset network information contained in the network access request is different, it can be determined that there is a high probability that the user made an input error when entering the preset network information, and it is not a malicious access. At this time, the similarity between the access network information in the network access request and the preset network information in the preset authentication information can be calculated, and based on the similarity, it can be determined whether the error in the access network information is caused by a user's typo.

[0106] Sub-step 2044: when the similarity is greater than or equal to the preset similarity, determine that the verification result is successful verification, and correct the access network identifier according to the preset network information.

[0107] In order to determine whether the error in the access network information is caused by a user's typo based on the similarity determined in the above steps. A preset similarity can be set, and after the similarity is calculated, the similarity is compared with the preset similarity. If the similarity is greater than or equal to the preset similarity, it means that the similarity between the access network information in the network access request and the preset network information in the preset authentication information is high, and there is a high probability that the error is caused by a user's typo. Therefore, the verification result can be determined as a successful verification, avoiding the user from re-entering the information and sending the network access request in the case of a typo. In addition, since the access network information needs to be sent to the communication server to notify the communication server to connect the user device to the communication network corresponding to the access network information, therefore, in the case of an access network information error, the access network information can also be corrected according to the preset network information to send the correct access network information to the communication server.

[0108] In addition, the network access request may also include domain name information, which may be the domain name of the private network that the user wants to access. In the case where the network access request includes domain name information, when the user sets the preset authentication information, the user also needs to add the preset domain name to the authentication information database. Furthermore, when matching the information in the network access request with the corresponding preset authentication information, the domain name information in the network access request and the preset domain name corresponding to the network access request also need to be matched. If the two do not match, the verification result is verification failure.

[0109] Refer to Table 1 below, which provides test results on how to handle network access requests sent by terminal devices when the network access requests sent by terminal devices contain different error information:

[0110]

[0111] Table 1

[0112] Step 205: Acquire the access network identifier from the network access request.

[0113] Step 206: Compare the access network identifier with a preset correspondence relationship to determine a target communication server corresponding to the access network identifier; wherein the preset correspondence relationship includes a one-to-one correspondence between at least one network identifier and a communication server.

[0114] Since there may be more than one communication server in the network, different communication servers may be responsible for processing services of different users, or processing services accessing different private networks. For example, when the communication server is a session management network element in the 5G core network, the 5G core network may contain a large number of session management network elements at the same time. Therefore, the verification server can also store the correspondence between the preset network identifier and the communication server. And send the verification result of the network access request to the target communication server corresponding to the network access request.

[0115] It should be noted that if the access network identifier in the network access request is wrong, the access network identifier in the network access request can be corrected in the manner of step 204 above, and the corrected access network identifier is sent to the corresponding target communication server.

[0116] Step 207: Send the verification result and the network access request to the target communication server, so that the target server connects the user equipment to the target communication network according to the network access request.

[0117] The target communication network is the dedicated network corresponding to the access network identifier in the network access request. Figure 5 , Figure 5 is a network access interaction diagram provided by an embodiment of the present application, such as Figure 5 As shown, the user equipment (UE) initiates a network access request to the session management network element (SMF), the session management network element forwards the network access request to the verification server (AAA), the verification server verifies the network access request and returns the verification result to the session management network element, the session management network element sends an N4 message to the user plane network element (UPF) according to the verification result to notify the user plane network element to allocate the IP address of the private network corresponding to the network access request to the user equipment sending the network access request, the user plane network element returns the IP address to the session management network element, and the session management network element allocates the IP address to the user equipment and connects the user equipment to the private network.

[0118] It should be noted that in the embodiment of the present application, the verification server may be an AAA server, which is an abbreviation of three English words: Authentication, Authorization, and Accounting. It provides authentication, authorization, and account services, and its main purpose is to manage user access to network servers and provide services to users with access rights. The communication server (such as a session management network element) can establish a connection with the AAA server through the Remote Authentication Dial-In User Service (RADIUS) and collaborate to complete the verification work.

[0119] In summary, another network access method provided by the embodiment of the present application can receive a network access request sent by a communication server; the network access request is sent by a user device to the communication server; the preset authentication information is determined according to the network access request; the network access request is verified by the preset authentication information, and a verification result is obtained; the verification result is sent to the communication server, so that the communication server connects the user device to the communication network when the authentication result indicates that the verification is successful. On the basis of the existing communication network, the communication server can be connected to the authentication server, and the network access request received by the communication server can be verified by the authentication server. By returning the verification result indicating the verification is successful to the communication server, the communication server connects the device that sent the network access request to the communication network, which not only increases the security of the communication network, but also avoids the stability risks caused by directly upgrading the security of the communication server.

[0120] Corresponding to the method provided by the network access method embodiment of the present invention, see Figure 6 , Figure 6 : is a structural diagram of a network access device provided in an embodiment of the present application. In this embodiment, the device may include:

[0121] The receiving module 301 is used to receive a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server;

[0122] An information module 302 is used to determine preset authentication information according to the network access request;

[0123] The verification module 303 is used to verify the network access request through the preset authentication information and obtain a verification result;

[0124] The sending module 304 is used to send the verification result to the communication server, so that the communication server connects the user equipment to the communication network when the authentication result indicates that the verification is successful.

[0125] In an optional implementation manner, the network access request includes a user account identifier, and the information module includes:

[0126] The preset authentication information submodule is used to compare the user account identifier with the authentication information database to determine the preset authentication information corresponding to the user account identifier; wherein the preset authentication information and the network access request have the same data structure.

[0127] In an optional implementation manner, the network access request further includes user equipment information, an access network identifier, and a user account password corresponding to the user account identifier; and the verification module includes:

[0128] a matching submodule, configured to match the user device information with the preset device information in the preset authentication information, match the access network identifier with the preset network information in the preset authentication information, and match the user account password with the preset account password in the preset authentication information;

[0129] The verification result submodule is used to determine that the verification result is successful verification when the user equipment information, the access network identifier and the user account password all match the preset authentication information successfully.

[0130] In an optional implementation manner, the user equipment information includes an international mobile equipment identity code and an international mobile subscriber identity code, and the apparatus further includes:

[0131] a partial matching module, configured to determine that the verification result is partially successful if the international mobile equipment identity code fails to match the preset device identity code of the preset device information, and the first other information included in the network access request matches the preset authentication information successfully; wherein the first other information refers to information in the network access request other than the international mobile equipment identity code;

[0132] The public network module is used to connect the user equipment to the public network when the verification result is partially successful.

[0133] In an optional embodiment, the device further comprises:

[0134] a similarity module, configured to determine the similarity between the access network identifier and the preset network information when the access network identifier fails to match the preset network information and the second other information included in the network access request matches the preset authentication information successfully;

[0135] The similarity verification module is used to determine that the verification result is successful when the similarity is greater than or equal to a preset similarity, and to correct the access network identifier according to the preset network information.

[0136] In an optional implementation, it is characterized in that the network access request includes an access network identifier, and the sending module includes:

[0137] An acquisition submodule, used to acquire the access network identifier from the network access request;

[0138] The communication server submodule is used to compare the access network identifier with a preset corresponding relationship to determine the target communication server corresponding to the access network identifier; wherein the preset corresponding relationship includes a one-to-one correspondence between at least one network identifier and a communication server;

[0139] The sending submodule is used to send the verification result and the network access request to the target communication server, so that the target server connects the user equipment to the target communication network according to the network access request.

[0140] In summary, the embodiment of the present application provides a network access model generation device, which can receive a network access request sent by a communication server; the network access request is sent by a user device to the communication server; the preset authentication information is determined according to the network access request; the network access request is verified by the preset authentication information, and a verification result is obtained; the verification result is sent to the communication server, so that the communication server connects the user device to the communication network when the authentication result indicates that the verification is successful. On the basis of the existing communication network, the communication server can be connected to the authentication server, and the network access request received by the communication server can be verified by the authentication server. By returning the verification result indicating the successful verification to the communication server, the communication server connects the device that sent the network access request to the communication network, which not only increases the security of the communication network, but also avoids the stability risks caused by directly upgrading the security of the communication server.

[0141] Figure 7 600 is a logic block diagram of an electronic device 600 provided in an embodiment of the present application. For example, the electronic device 600 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0142] Reference Figure 7 , the electronic device 600 may include one or more of the following components: a processing component 602 , a memory 604 , a power component 606 , a multimedia component 608 , an audio component 610 , an input / output (I / O) interface 612 , a sensor component 614 , and a communication component 616 .

[0143] The processing component 602 generally controls the overall operation of the electronic device 600, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 602 may include one or more processors 620 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 602 may include one or more modules to facilitate the interaction between the processing component 602 and other components. For example, the processing component 602 may include a multimedia module to facilitate the interaction between the multimedia component 608 and the processing component 602.

[0144] The memory 604 is used to store various types of data to support the operation of the electronic device 600. Examples of such data include instructions for any application or method operating on the electronic device 600, contact data, phone book data, messages, pictures, videos, etc. The memory 604 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0145] The power supply component 606 provides power to the various components of the electronic device 600. The power supply component 606 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 600.

[0146] The multimedia component 608 includes a screen that provides an output interface between the electronic device 600 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 608 includes a front camera and / or a rear camera. When the electronic device 600 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0147] The audio component 610 is used to output and / or input audio signals. For example, the audio component 610 includes a microphone (MIC), and when the electronic device 600 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive an external audio signal. The received audio signal can be further stored in the memory 604 or sent via the communication component 616. In some embodiments, the audio component 610 also includes a speaker for outputting audio signals.

[0148] I / O interface 612 provides an interface between processing component 602 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0149] The sensor assembly 614 includes one or more sensors for providing various aspects of status assessment for the electronic device 600. For example, the sensor assembly 614 can detect the open / closed state of the electronic device 600, the relative positioning of the components, such as the display and keypad of the electronic device 600, and the sensor assembly 614 can also detect the position change of the electronic device 600 or a component of the electronic device 600, the presence or absence of contact between the user and the electronic device 600, the orientation or acceleration / deceleration of the electronic device 600, and the temperature change of the electronic device 600. The sensor assembly 614 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 614 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 614 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0150] The communication component 616 is used to facilitate wired or wireless communication between the electronic device 600 and other devices. The electronic device 600 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 616 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 616 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0151] In an exemplary embodiment, the electronic device 600 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to implement a network access method provided in an embodiment of the present application.

[0152] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 604 including instructions, and the instructions can be executed by a processor 620 of an electronic device 600 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0153] Figure 8700 is a logic block diagram of another electronic device 700 provided in an embodiment of the present application. For example, the electronic device 700 may be provided as a server. Figure 8 The electronic device 700 includes a processing component 722, which further includes one or more processors, and a memory resource represented by a memory 732 for storing instructions executable by the processing component 722, such as an application. The application stored in the memory 732 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 722 is configured to execute instructions to perform a network access method provided in an embodiment of the present application.

[0154] The electronic device 700 may also include a power supply component 726 configured to perform power management of the electronic device 700, a wired or wireless network interface 750 configured to connect the electronic device 700 to a network, and an input / output (I / O) interface 758. The electronic device 700 may operate based on an operating system stored in the memory 732, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0155] An embodiment of the present application also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the network access method is implemented.

[0156] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0157] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network access method, characterized in that: Applied to an authentication server, the method comprises: Receiving a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server; Determining preset authentication information according to the network access request; Verifying the network access request through the preset authentication information and obtaining a verification result; Sending the verification result to the communication server, so that the communication server connects the user equipment to the communication network if the verification result indicates that the verification is successful or partially successful; The verifying the network access request by using the preset authentication information and obtaining a verification result includes: Matching the user equipment information in the network access request with the preset equipment information in the preset authentication information; When the international mobile equipment identity code in the user equipment information fails to match the preset equipment identity code in the preset equipment information, and the first other information included in the network access request matches the preset authentication information successfully, the verification result is determined to be partially successful; wherein the first other information refers to the information in the network access request other than the international mobile equipment identity code.

2. The method according to claim 1, characterized in that: The communication server is a session management network element, which belongs to the 5G core network. The session management network element receives the network access request sent by the user equipment through the 5G base station.

3. The method according to claim 1, characterized in that The network access request includes a user account identifier, and the determining of preset authentication information according to the network access request includes: The user account identifier is compared with an authentication information database to determine preset authentication information corresponding to the user account identifier; wherein the preset authentication information and the network access request have the same data structure.

4. The method according to claim 3, characterized in that The network access request also includes user equipment information, an access network identifier, and a user account password corresponding to the user account identifier; the network access request is verified by the preset authentication information, and a verification result is obtained, including: In the case where the user equipment information, the access network identifier and the user account password all successfully match the preset authentication information, the verification result is determined to be a successful verification.

5. The method according to claim 4, characterized in that The method further comprises: If the access network identifier fails to match the preset network information, and the second other information included in the network access request matches the preset authentication information, determining the similarity between the access network identifier and the preset network information; When the similarity is greater than or equal to a preset similarity, the verification result is determined to be a successful verification, and the access network identifier is corrected according to the preset network information.

6. The method according to claim 1, characterized in that The network access request includes an access network identifier, and the sending of the verification result to the communication server so that the communication server accesses the user equipment to the communication network when the verification result indicates that the verification is successful includes: Acquire the access network identifier from the network access request; Comparing the access network identifier with a preset correspondence relationship to determine a target communication server corresponding to the access network identifier; wherein the preset correspondence relationship includes a one-to-one correspondence between at least one network identifier and a communication server; The verification result and the network access request are sent to the target communication server, so that the target communication server connects the user equipment to the target communication network according to the network access request.

7. A network access device, characterized in that: Applied to an authentication server, the device comprises: A receiving module, used for receiving a network access request sent by a communication server, wherein the network access request is sent by a user device to the communication server; An information module, used to determine preset authentication information according to the network access request; A verification module, used to verify the network access request through the preset authentication information and obtain a verification result; A sending module, configured to send the verification result to the communication server, so that the communication server connects the user equipment to the communication network when the verification result indicates that the verification is successful or partially successful; the verification module includes: A matching submodule, used to match the user equipment information in the network access request with the preset equipment information in the preset authentication information; A partial matching submodule is used to determine that the verification result is partially successful when the international mobile equipment identity code in the user equipment information fails to match the preset equipment identity code of the preset equipment information, and the first other information included in the network access request matches the preset authentication information successfully; wherein the first other information refers to the information in the network access request other than the international mobile equipment identity code.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images