Data communication method and system

Abstract

The present application discloses a data communication method and system. The method comprises: a user plane function entity receives user plane data from a user device; the user plane function entity forwards the user plane data to a local area network device for authentication, wherein, when the authentication is passed, it is determined that the user device is allowed to access the local area network corresponding to the local area network device. The present application solves the technical problem that when an existing mobile terminal connects to a local area network, various configurations and verifications of accounts are required, and the process steps are cumbersome and inconvenient.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular, to a data communication method and system. Background Art

[0002] With the popularization of mobile terminals for office work, how to safely and conveniently access a local area network (such as an enterprise intranet) for mobile terminals in an enterprise campus is a technical problem that needs to be solved urgently. To solve this technical problem, in the related technology, a mobile terminal accesses the enterprise intranet by opening a virtual private network (Virtual Personal Network, referred to as VPN). However, this method requires various configurations for VPN accounts and various verification processes during the access process. Therefore, there are technical problems such as cumbersome steps and low convenience.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a data communication method and system to at least solve the technical problem that when an existing mobile terminal connects to a local area network, various configurations and verifications of accounts are required, and the process steps are complicated and inconvenient.

[0005] According to one aspect of an embodiment of the present application, a data communication method is provided, including: a user plane function (UPF) entity receives user plane data from a user equipment (User Equipment, detected as UE); the user plane function entity forwards the user plane data to a local area network device for authentication, wherein, when the authentication is passed, it is determined that the user equipment is allowed to access a local area network (LAN) corresponding to the local area network device.

[0006] According to another aspect of an embodiment of the present application, a data communication method is provided, including: a slicing network device receives user plane data from a user device; the slicing network device authenticates the user plane data; and after the authentication is passed, determines that the user device is allowed to access a local area network, and forwards the user plane data to the local area network.

[0007] According to another aspect of an embodiment of the present application, a data communication method is provided, comprising: a local area network device receives user plane data from a user device forwarded by a user plane functional entity; the local area network device authenticates the user plane data, wherein, when the authentication is passed, it is determined that the user device is allowed to access a local area network corresponding to the local area network device.

[0008] According to another aspect of an embodiment of the present application, a method for accessing a local area network is provided, comprising: a local area network device sends a registration request to a network exposure function (NEF) entity; after receiving a registration success message from the network exposure function entity, the local area network device sends authorized user information to the network exposure function entity, wherein the authorized user information satisfies the following conditions: a user device corresponding to the authorized user information is allowed to access the local area network device through a user plane function entity.

[0009] According to another aspect of an embodiment of the present application, a data communication method is provided, comprising: a user device obtains a current location of the user device; when the user device determines that the current location is located in a coverage area of ​​a target local area network, the user device sends user plane data to a local area network device through a user plane function entity to access the target local area network.

[0010] According to another aspect of an embodiment of the present application, a user plane functional entity is provided, including: a receiving module for receiving user plane data from a user device; a sending module for forwarding the user plane data to a local area network device for authentication, wherein, when the authentication is passed, it is determined that the user device is allowed to access the local area network corresponding to the local area network device.

[0011] According to another aspect of an embodiment of the present application, a local area network access device is also provided, including: a first sending module, used to send a registration request to a network open function entity; a receiving module, used to receive a registration success message from the network open function entity; a second sending module, used to send authorized user information to the network open function entity after the receiving module receives the registration success message, wherein the authorized user information satisfies the following conditions: the user device corresponding to the authorized user information is allowed to access the local area network device through the user plane function entity.

[0012] According to another aspect of an embodiment of the present application, a data communication system is also provided, including: a user device, used to send user plane data to the user plane functional entity; a user plane functional entity, used to receive the user plane data and forward the user plane data to a local area network device for authentication, wherein, when the authentication is passed, it is determined that the user device is allowed to access the local area network corresponding to the local area network device.

[0013] In an embodiment of the present application, a user plane function entity is used to receive user plane data with information indicating the data type from a user device and then forward the user plane data to a local area network device for authentication. When the authentication is successful, a method is determined to allow the user device to access the local area network corresponding to the local area network device, thereby achieving that the user device can quickly access the local area network through the local area network device after a simple verification without the need for complex VPN login access, thereby solving the technical problem that the existing mobile terminal needs to perform various configurations and verifications on the account when connecting to the local area network, and the process steps are cumbersome and the convenience is not high. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0015] Figure 1 is a schematic diagram of a communication system according to an embodiment of the present application;

[0016] Figure 2 is a schematic diagram of another communication system according to an embodiment of the present application;

[0017] Figure 3 is a schematic diagram of another communication system according to an embodiment of the present application;

[0018] Figure 4 is a flow chart of a data communication method according to an embodiment of the present application;

[0019] Figure 5 is a flow chart of another data communication method according to an embodiment of the present application;

[0020] Figure 6 It is a flowchart of a method for accessing a local area network according to an embodiment of the present application;

[0021] Figure 7 This is a schematic diagram of an authorized user configuration process according to an embodiment of the present application;

[0022] Figure 8 is a flow chart of another data communication method according to an embodiment of the present application;

[0023] Fig. 9 is a flow chart of another data communication method according to an embodiment of the present application;

[0024] Fig.10 is a schematic diagram of a user plane functional entity according to an embodiment of the present application;

[0025] Fig.11is a schematic diagram of a local area network access device according to an embodiment of the present application;

[0026] Fig.12 is a schematic diagram of a data communication system according to an embodiment of the present application;

[0027] Fig.13 It is a flow chart of a data communication method according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] It should also be noted that the various functional entities involved in the embodiments of the present application, such as the user plane functional entity, the network open functional entity, the policy control functional entity, the session management functional entity, etc., can be a specific network function instantiated on the same core network server. Optionally, the above entities can also be a separate server respectively, and in some cases, it can also be shown that multiple functional entities share one server.

[0031] The specific structure of the above server includes, but is not limited to: a processor, a memory for storing data, and a transmission module for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera.

[0032] It should be noted that the above-mentioned processor may generally be referred to as "data processing circuit" in this article. The data processing circuit may be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit may be a single independent processing module, or may be fully or partially integrated into any of the other components of the server. As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory can be used to store software programs and modules of application software, such as the program instruction / data storage device corresponding to the data communication method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory.

[0034] The transmission module is used to receive or send data via a network. In one example, the transmission device includes a network adapter, which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module can be a radio frequency module, which is used to communicate with the Internet wirelessly.

[0035] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are translated and explained as follows:

[0036] User Equipment (UE): In the embodiments of the present application, it can be an electronic communication device such as a mobile phone, tablet, or computer.

[0037] User plane function (UPF): includes routing and forwarding of user data packets, data interaction with the external data network DN, user plane service quality processing, flow control rule implementation, etc.

[0038] Radio Access Network (RAN): The Radio Access Network is a part of the mobile communication system. It is the implementation of radio access technology, which exists between a device (such as a mobile phone, computer, or any remotely controlled machine) and the core network, providing a communication connection between the two.

[0039] Local Area Network (LAN): refers to a computer communication network consisting of multiple computers, external devices and databases connected to each other in a certain area. It can be connected to a remote local area network, database or processing center through a data communication network or a dedicated data circuit to form a larger information processing system, which can realize file management, application software sharing, printer sharing, workgroup scheduling, email and fax communication services, etc. In the embodiment of the present application, the local area network can be an intranet of an enterprise.

[0040] Data Network (DN): A data network is a network consisting of data terminal equipment, data exchange equipment and data transmission links distributed in various places. With the support of network protocols (software including the three-layer protocols under OSI), it realizes data transmission and exchange between data terminals and remote information processing.

[0041] Enterprise Access Control (EAC) is used to implement terminal registration, security checks, security isolation, security notifications, and security repairs to ensure that the identity of the terminal devices connected to the enterprise intranet is credible and meets the mandatory security policy requirements. External terminal devices can be restricted to access only some public resources; terminal devices that do not meet the mandatory security policy requirements can be securely isolated and can only access network resources normally after repair; only terminal devices that meet the mandatory security policy requirements and are internal users can access network resources normally. In the embodiment of the present application, EAC entities include but are not limited to gateway devices.

[0042] Network open function (NEF): located between the 5G core network and external third-party application functions (possibly also some internal AF), responsible for managing the open network data. All external applications that want to access the internal data of the 5G core network must go through NEF. NEF provides corresponding security guarantees to ensure the security of external applications to the 3gpp network, and provides external application QoS customization capability opening, mobility status event subscription, AF request distribution and other functions.

[0043] Access and Mobility Management Function (AMF): AMF includes registration management, connection management, reachability management, mobility management, access authentication, access authorization, legal interception, forwarding of session management (SM) messages between UE and SMF, forwarding of SMS messages between UE and SMSF, etc. Among them, AMF receives all connection and session related information from UE, but is only responsible for processing connection and mobility management tasks. All messages related to session management are forwarded to SMF for processing through the N11 reference interface.

[0044] Session Management Function (SMF): SMF is a functional unit of the 5G service-based architecture. It is mainly responsible for interacting with the separated data plane, creating, updating and deleting PDU (Protocol Data Unit) sessions, and managing the session environment with UPF.

[0045] Policy Control Function (PCF): PCF supports a unified policy framework to ensure network behavior and provides access and mobility management-related policies to the AMF that implements these policies.

[0046] Network Address Translation (NAT): When some hosts inside a private network have been assigned local IP addresses but now want to communicate with hosts on the Internet, the NAT method can be used. It requires installing NAT software on the router that connects the private network to the Internet. A router equipped with NAT software is called a NAT router. It has at least one valid external global IP address. In this way, all hosts using local addresses must convert their local addresses into global IP addresses on the NAT router when communicating with the outside world before they can connect to the Internet.

[0047] Network Slice Function (NSF): Network slicing is an on-demand networking method that allows operators to separate multiple virtual end-to-end networks on a unified infrastructure. Each network slice is logically isolated from the wireless access network, the bearer network, and the core network to adapt to various types of applications. In a network slice, it can be divided into at least three parts: wireless network sub-slices, bearer network sub-slices, and core network sub-slices. Network slicing is a logical-based concept and a reorganization of resources. The reorganization is to select the required virtual machines and physical resources for a specific communication service type based on the SLA (service level agreement). In an embodiment of the present application, the NSF entity may be a slicing network device.

[0048] Example 1

[0049] According to an embodiment of the present application, a data communication method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0050] like Figure 1 As shown, Figure 1There are two ways to access the local area network. Among them, the user equipment (UE) connects to the user plane function entity (UPF) through the wireless access network (LAN) and sends user plane data to the user plane function entity (UPF); the user plane function entity (UPF) connects to the network open function entity (NEF) and the policy control function entity (PCF) through the session management function entity (SMF) to exchange information and obtain the forwarding strategy corresponding to the user plane data; then two ways are used to connect to the local area network: the first one: according to the forwarding strategy, the user plane function entity (UPF) can choose to forward the user plane data to the local area network device (such as Figure 3 The second method is to select the user plane data to be forwarded to the local area network via the data network (DN) to realize the connection between the user equipment (UE) and the local area network (LAN) (such as Figure 2 described process).

[0051] Figure 2 It is a schematic diagram of a conventional system for realizing UE access to a local area network in the related art. Among them, the UE connects to the UPF through the RAN and sends user plane data to the UPF; the UPF connects to the NEF entity and the PCF entity through the session management function entity to obtain the forwarding strategy; and forwards the user plane data to the local area network via the DN according to the forwarding strategy instruction, wherein the DN and the local area network are accessed using VPN, and finally the information interaction between the UE and the local area network is realized. It can be seen that in order to realize the access of the UE to the local area network, VPN can be used for access. However, since the network configuration and access process of VPN are relatively complicated, the embodiment of the present application provides Figure 3 The access method shown is as follows:

[0052] like Figure 3 As shown, the UE connects to the UPF through the RAN and sends user plane data to the UPF; the UPF connects to the NEF entity and the PCF entity through the session management function entity to obtain the forwarding strategy; and forwards the user plane data to the LAN device, namely the EAC entity, according to the forwarding strategy instructions. After passing the authentication, the UE can realize information interaction with the LAN.

[0053] exist Figure 1-Figure 3 In the operating environment shown, the embodiment of the present application provides a data communication method, such as Figure 4 As shown, the method at least includes steps S402-S406:

[0054] S402, UPF receives user plane data from UE.

[0055] In an embodiment of the present application, the user plane data carries indication information for indicating the type of the user plane data, which includes at least one of the following: identification information of the UE or a protocol type adopted by the user plane data.

[0056] Among them, optionally, the UE's identification information can be personal information such as the UE's account name, mobile phone number, etc.; the protocol type used by the user plane data can be a 5G communication protocol, or an Ethernet protocol, etc., and the indication information of the user plane data data type is mainly used to authenticate whether the UE is authorized to access the local area network.

[0057] S404, UPF forwards the user plane data to the local area network device for authentication. Figure 4 As shown, the local area network device includes but is not limited to: EAC entity.

[0058] In some embodiments of the present application, the UPF determines a forwarding strategy for the user plane data based on the data type indication information, wherein the forwarding strategy is at least used to instruct the UPF to forward the user plane data to the local area network device; when the forwarding strategy instructs the UPF to forward the user plane data to the local area network device, the UPF forwards the user plane data to the local area network device.

[0059] In an embodiment of the present application, when the forwarding strategy instructs the UPF to forward the user plane data to the local area network via the DN, the UPF forwards the user plane data to the local area network device via the DN.

[0060] In an embodiment of the present application, before the UPF determines the forwarding strategy of the user plane data based on the data type indication information, the UPF obtains the forwarding strategy from the session management function entity and stores the forwarding strategy.

[0061] In an embodiment of the present application, before the UPF forwards the user plane data to the LAN device for authentication, it is necessary to configure the network elements in the core network, for example: the LAN device sends a registration request to the NEF entity; after receiving the registration success message from the NEF entity, the LAN device sends the authorized user information to the NEF entity to notify the PCF entity to modify the forwarding policy, wherein the UE corresponding to the authorized user information is allowed to forward the user plane data to the LAN device through the UPF, and the modified forwarding policy is used to instruct the UPF to forward the user plane data from the UE corresponding to the authorized user information to the LAN device. For ease of understanding, the following combined Figure 5 Describe the above configuration process in detail.

[0062] Take the LAN device as an enterprise access control (EAC) device as an example. Figure 5 As shown, the above configuration process at least includes steps S502-S510:

[0063] S502, the local area network device sends a registration service request to the NEF entity, wherein the local area network device includes but is not limited to: an enterprise access control (EAC) device.

[0064] S504, after successful authentication, the NEF entity sends a registration success message to the LAN device.

[0065] Since NEF is located between the 5G core network and the external third-party application function body, it is responsible for managing the open network data. All external applications that want to access the internal data of the 5G core network must go through the NEF entity. In the embodiment of the present application, in order to enable the UE to access the local area network normally, the local area network device needs to register the UE in the NEF entity. After the registration is successful, the UE obtains the qualification to access the local area network, that is, the UE that obtains the qualification to access the local area network is an authorized UE.

[0066] S506, the LAN device sends the authorized user information to the NEF entity.

[0067] In an embodiment of the present application, if the NEF entity recognizes that the authorized user information is correct, that is, the UE corresponding to the information has been authorized to access the local area network, then the forwarding path of the UPF for the user plane data can be changed.

[0068] S508, the NEF entity sends information on changing the authorized user forwarding policy to the PCF entity.

[0069] In an embodiment of the present application, the forwarding strategy is used to instruct the UPF to forward the user plane data to the local area network device or to instruct the UPF to forward the user plane data to the local area network via the DN; wherein, the modified forwarding strategy is used to instruct the UPF to forward the user plane data to the local area network device, and when the forwarding strategy instructs the UPF to forward the user plane data to the local area network device, the UPF forwards the user plane data to the local area network device.

[0070] S510, NEF entity and LAN equipment are configured.

[0071] In the embodiment of the present application, when all configurations are successful, the LAN device allows receiving the user plane data forwarded by the UE through the UPF, which is the so-called one-time authentication. The normal implementation of the LAN access method can ensure Figure 4 The normal implementation of the data communication method shown, that is, Figure 5 The LAN access method shown is Figure 4The basis of the data communication method shown.

[0072] It should be noted that the local area network access method provided in the embodiment of the present application can be used in conjunction with the data communication method in Example 2, but it does not depend on the data communication method and can be used independently. The method itself is an independent local area network access method.

[0073] S406: When the authentication is successful, determine whether the UE is allowed to access the local area network corresponding to the local area network device.

[0074] In an embodiment of the present application, the LAN device determines the source of the UE and whether the UE has been authorized to access the LAN corresponding to the LAN device based on the data type indication information in the user plane data. When the authentication is passed, it is determined that the UE is allowed to access the LAN corresponding to the LAN device. After that, the LAN device determines that the user plane data is allowed to be received, and the LAN device determines that data is allowed to be sent to the UE through the UPF.

[0075] The following describes in detail the process of UE accessing the LAN in conjunction with the core network. Figure 6 As shown, the process includes at least the following steps:

[0076] S602: The UE sends a session establishment request to an access and mobility management function (AMF) entity through the RAN.

[0077] Since the 5G core network supports both access through 3GPP access networks (such as gNB, eNB) and Non 3GPP network access (such as Ethernet communication protocol, WIFI protocol), the communication method between the UE and the mobility management function entity is not fixed. In this embodiment, the UE communicates with the access and mobility management function entity through RAN, which is only an optional implementation method.

[0078] S604, the access and mobility management function (AMF) entity selects a session management function and sends a service call establishment request to the session management function entity (SMF).

[0079] In the 5G core network, the access and mobility management functional entity receives all connection and session related information from the UE, but it is only responsible for processing connection and mobility management tasks. All messages related to session management are forwarded to the session management functional entity through the N11 reference interface.

[0080] S606: The session management function entity sends a policy service invocation request to the PCF entity.

[0081] Among them, the session management function entity and the PCF entity are also connected through the N11 reference interface.

[0082] S608, the session management function entity completes the establishment of the user plane path between the UE and the UPF.

[0083] In an embodiment of the present application, by establishing a user plane path, the UPF can receive user plane data from the UE and simultaneously receive a forwarding strategy from the PCF entity.

[0084] S610, UPF receives user plane data from UE.

[0085] In the embodiment of the present application, the user plane data carries indication information for indicating the data type of the user plane data, which at least includes the identification information of the UE or the protocol type adopted by the user plane data. The identification information of the UE may be information such as the account name and mobile phone number of the UE; the protocol type adopted by the user plane data may be a 5G communication protocol, etc.

[0086] S612, UPF forwards the user plane data to the LAN device according to the forwarding strategy.

[0087] In an embodiment of the present application, first, the UPF obtains a forwarding strategy from a session management function entity and stores the forwarding strategy, wherein the forwarding strategy is determined based on the data type indication information of the user plane data; secondly, the UPF forwards the user plane data based on the forwarding strategy, wherein the forwarding strategy is at least used to instruct the UPF to forward the user plane data to the local area network device; when the forwarding strategy instructs the UPF to forward the user plane data to the local area network device, the UPF forwards the user plane data to the local area network device.

[0088] In an optional embodiment of the present application, the forwarding strategy may also instruct the UPF to forward the user plane data to the local area network via the DN. In this case, the UPF forwards the user plane data to the local area network via the DN.

[0089] S614, the LAN device authenticates the source of the user plane data and completes the network address translation.

[0090] In an embodiment of the present application, the LAN device determines the source of the UE and whether the UE has been authorized to access the LAN corresponding to the LAN device based on the UE identification information in the user plane data. When the authentication is passed, the LAN device completes the network address translation, and the UE can access the LAN corresponding to the LAN device.

[0091] S616, UE accesses the local area network.

[0092] In an embodiment of the present application, after determining that the UE is allowed to access the LAN corresponding to the LAN device, the LAN device determines that it is allowed to receive the user plane data, and the LAN device determines that it is allowed to send data to the UE through the UPF.

[0093] According to an optional embodiment of the present application, the data communication method is applied to the access of users in the enterprise park to the enterprise intranet, and the specific method is as follows: based on the 5G public network, the enterprise deploys EAC to communicate with the operator's core network to complete the intercommunication of authorized user information and user data; when the authorized user enters the coverage area of ​​the enterprise intranet and accesses the operator's 5G network, the user data enters the EAC after being identified by the UPF in the core network (for example, identifying the UE identifier carried in the user data, the data type of the user data, etc.), and completes the secondary authentication in the EAC, allowing access to the enterprise intranet. At this time, the user can automatically and securely access the enterprise intranet through the 5G terminal without manually opening the VPN; when the user leaves the enterprise park, the intranet connection is disconnected, and the enterprise intranet needs to be accessed again through the VPN. This method creatively solves the customer's need for low-cost, convenient and secure access to the enterprise intranet based on the reuse of the public 5G network.

[0094] Take UE access to the enterprise intranet (LAN) as an example. Figure 7 As shown, the process includes at least the following steps:

[0095] S702: The user plane function entity receives user plane data from user equipment.

[0096] In an embodiment of the present application, the user plane data carries indication information for indicating the type of the user plane data, and the indication information at least includes identification information of the user equipment or a protocol type adopted by the user plane data.

[0097] S704, the user plane function entity (UPF) forwards the user plane data to the local area network device, that is, forwards it to the EAC device according to the forwarding strategy.

[0098] In an embodiment of the present application, first, the user plane functional entity obtains a forwarding policy from a session management functional entity and stores the forwarding policy, wherein the forwarding policy is determined based on the data type indication information of the user plane data; secondly, the user plane functional entity forwards the user plane data based on the forwarding policy, wherein the forwarding policy is at least used to instruct the user plane functional entity to forward the user plane data to the local area network device; when the forwarding policy instructs the user plane functional entity to forward the user plane data to the local area network device, the user plane functional entity forwards the user plane data to the local area network device.

[0099] In an optional embodiment of the present application, the forwarding strategy may also instruct the user plane function entity to forward the user plane data to the local area network via the data network. At this time, the user plane function entity forwards the user plane data to the local area network via the data network.

[0100] S706, the EAC device authenticates the source of the user plane data and completes network address translation, for example, translating the external network address carried in the user plane data into the address of the host to be accessed in the local area network, thereby enabling the UE to access the enterprise intranet.

[0101] In an embodiment of the present application, the LAN device determines the source of the user device and whether the user device has been authorized to access the LAN corresponding to the LAN device based on the user device identification information in the user plane data. When the authentication is passed, the LAN device completes the network address translation, and the user device can access the LAN corresponding to the LAN device.

[0102] S708, the user equipment accesses the local area network.

[0103] In an embodiment of the present application, after determining that the user equipment is allowed to access the local area network corresponding to the local area network device, the local area network device determines that it is allowed to receive the user plane data, and the local area network device determines that it is allowed to send data to the user equipment through the user plane functional entity.

[0104] It should be noted that the local area network involved in this embodiment includes but is not limited to: an enterprise local area network or an enterprise internal private network.

[0105] Example 2

[0106] According to an embodiment of the present application, a data communication method is also provided, such as Figure 8 As shown, the method comprises at least the following steps:

[0107] S802, the slice network device receives user plane data from the user equipment.

[0108] In an embodiment of the present application, the user plane data carries data type indication information for indicating the data type of the user plane data, and the indication information at least includes identification information of the user equipment or a protocol type adopted by the user plane data.

[0109] S804, the slice network device authenticates the user plane data.

[0110] In an embodiment of the present application, the slicing network device determines a forwarding strategy for the user plane data based on the data type indication information, wherein the forwarding strategy is at least used to instruct the slicing network device to forward the user plane data to the local area network; when the forwarding strategy instructs the slicing network device to forward the user plane data to the local area network, the slicing network device forwards the user plane data to the local area network.

[0111] S806: After the authentication is passed, it is determined that the user device is allowed to access the local area network.

[0112] Among them, network slicing is an on-demand networking method that allows operators to separate multiple virtual end-to-end networks on a unified infrastructure. Each network slice is logically isolated from the wireless access network bearer network to the core network to adapt to various types of applications, that is, user devices can access the local area network through network slicing devices. On this basis, the embodiment of the present application proposes a data communication method based on network slicing devices.

[0113] It should be noted that as Figure 4 An alternative to the data communication method shown, the slicing network device receives user plane data from a user device and authenticates the user plane data. After the authentication is successful, it determines that the user device is allowed to access the local area network and forwards the user plane data to the local area network.

[0114] In some optional embodiments, the data communication method can be applied to the access of users within an enterprise campus to the enterprise intranet, wherein the secondary authentication within the 5G network slice will be open to third-party enterprise users, and the operator completes the primary authentication process of user access control. When it is necessary to access the enterprise intranet through the network slice, the slice network device completes the secondary authentication, and only authorized users of the enterprise can use the slice network to access the intranet.

[0115] Example 3

[0116] According to an embodiment of the present application, a data communication method is also provided, such as Fig. 9 As shown, the method comprises at least the following steps:

[0117] S902: The local area network device receives user plane data from the user equipment that is forwarded by the user plane function entity.

[0118] In the embodiment of the present application, the user plane data carries data type indication information for indicating the user plane data.

[0119] S904, the local area network device authenticates the user plane data.

[0120] S906: After the authentication is passed, it is determined that the user device is allowed to access the local area network corresponding to the local area network device.

[0121] In an embodiment of the present application, the LAN device determines the source of the user device and whether the user device has been authorized to access the LAN corresponding to the LAN device based on the user device identification information in the user plane data. When the authentication is passed, the LAN device completes the network address translation, and the user device can access the LAN corresponding to the LAN device; when it is determined that the user device is allowed to access the LAN corresponding to the LAN device, the LAN device determines that the user plane data is allowed to be received, and the LAN device determines that data is allowed to be sent to the user device through the user plane functional entity.

[0122] It should be noted that the preferred implementation of this embodiment can be found in Figure 4-8 The relevant description of the corresponding embodiment will not be repeated here.

[0123] Example 4

[0124] According to an embodiment of the present application, a user plane function entity is also provided, which is used to implement Figure 4 The method shown, such as Fig.10 As shown, the user plane functional entity includes at least the following modules:

[0125] The receiving module 102 is used to receive user plane data from a user equipment;

[0126] In an embodiment of the present application, the user plane data carries indication information for indicating the type of the user plane data, which includes at least one of the following: identification information of the user equipment or the protocol type adopted by the user plane data.

[0127] The sending module 104 is used to forward the user plane data to the local area network device for authentication, wherein when the authentication is passed, it is determined to allow the user equipment to access the local area network corresponding to the local area network device.

[0128] In an embodiment of the present application, the sending module is also used to determine a forwarding strategy for the user plane data based on the data type indication information, wherein the forwarding strategy is at least used to instruct the user plane function entity to forward the user plane data to the local area network device; and when the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network device, the user plane data is forwarded to the local area network device.

[0129] It should be noted that the preferred implementation of this embodiment can be found in Figure 4-8 The relevant description of the corresponding embodiment will not be repeated here.

[0130] Example 5

[0131] According to an embodiment of the present application, a local area network access device is also provided, which is applied to a local area network device and is used to implement Fig. 9 The data communication method shown is as follows: Fig.11 As shown, the device at least includes the following structure:

[0132] A first sending module 112, configured to send a registration request to the NEF entity;

[0133] The receiving module 114 is configured to receive a registration success message from the NEF entity;

[0134] The second sending module 116 is used to send authorized user information to the NEF entity after the receiving module receives the registration success message, wherein the authorized user information meets the following conditions: the user equipment corresponding to the authorized user information is allowed to access the LAN device through the user plane function entity.

[0135] It should be noted that the preferred implementation of this embodiment can be found in Figure 4-8 The relevant description of the corresponding embodiment will not be repeated here.

[0136] Example 6

[0137] According to an embodiment of the present application, a data communication system is also provided, such as Fig.12 As shown, the system at least includes:

[0138] User equipment 122, used to send user plane data to the user plane function entity;

[0139] The user plane function entity 124 is used to receive the user plane data and forward the user plane data to the local area network device for authentication, wherein when the authentication is passed, it is determined to allow the user equipment to access the local area network corresponding to the local area network device.

[0140] It should be noted that the preferred implementation of this embodiment can be found in Figure 4-8 The relevant description of the corresponding embodiment will not be repeated here.

[0141] Example 7

[0142] According to an embodiment of the present application, a data communication method is also provided, such as Fig.13 As shown, the method includes:

[0143] Step S130, the user equipment obtains the current location of the user equipment;

[0144] Step S132: When the user equipment determines that the current location is in the coverage area of ​​the target local area network, the user equipment sends user plane data to the local area network device through the user plane function entity to access the target local area network. The specific implementation process of the user equipment accessing the local area network in step S132 can be found in Figure 4-8 The relevant description of the illustrated embodiment will not be repeated here.

[0145] User devices include but are not limited to mobile phones, tablet computers and other mobile terminals.

[0146] In some embodiments of the present application, the user equipment may determine the above-mentioned current location through a positioning system set in the user equipment, and the positioning system may include but is not limited to: a global positioning system, a Beidou positioning system, etc.

[0147] The method for user equipment to access the LAN can be selected based on the actual needs of the user, specifically:

[0148] The user equipment displays an access method list in the human-computer interaction interface, wherein the access method list includes: VPN access method and non-VPN access method, wherein the non-VPN access method is used to indicate that the UE is allowed to access the local area network through the user plane function entity; the user equipment responds to the selection instruction and selects an access method for accessing the target local area network from the access method list, wherein when the non-VPN access method is selected, the user equipment is triggered to send user plane data to the local area network device through the user plane function entity.

[0149] It should be noted that the preferred implementation of this embodiment can be found in Figure 4-8 The relevant description of the corresponding embodiment will not be repeated here.

[0150] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0151] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0152] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0153] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0154] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0155] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0156] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data communication method, include: The user plane function entity receives user plane data from the user equipment, wherein the user plane data carries data type indication information for indicating the user plane data; The user plane function entity forwards the user plane data to the local area network device for authentication, wherein when the authentication is passed, it is determined that the user equipment is allowed to access the local area network corresponding to the local area network device, and the user plane function entity forwards the user plane data to the local area network device for authentication, including: The user plane function entity determines a forwarding strategy for the user plane data according to the data type indication information, wherein the forwarding strategy is at least used to instruct the user plane function entity to forward the user plane data to the local area network device; and When the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network device, the user plane function entity forwards the user plane data to the local area network device; The data communication method further comprises: the local area network device sending a registration request to the network open function entity; After receiving the registration success message from the network open function entity, the local area network device sends the authorized user information to the network open function entity to notify the policy control function entity to modify the forwarding policy, wherein the user device corresponding to the authorized user information is allowed to forward the user plane data to the local area network device through the user plane function entity, and the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user device corresponding to the authorized user information to the local area network device.

2. The method according to claim 1, in, Before the user plane function entity determines the forwarding strategy of the user plane data according to the data type indication information, the method further includes: The user plane function entity obtains the forwarding policy from the session management function entity and stores the forwarding policy.

3. The method according to claim 1, in, The method further comprises: When the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network via the data network, the user plane function entity forwards the user plane data to the local area network via the data network.

4. The method according to claim 1, in, Before the user plane function entity forwards the user plane data to the local area network device, the method further includes: The user plane function entity receives a forwarding policy from a policy function entity via a session management function entity, wherein the forwarding policy is used to instruct the user plane function entity to forward the user plane data to the local area network device or to instruct the user plane function entity to forward the user plane data to the local area network via a data network.

5. The method according to claim 1, in, The data type indication information includes at least one of the following: identification information of the user equipment; and a protocol type adopted by the user plane data.

6. The method according to any one of claims 1 to 4, in, After determining that the user equipment is allowed to access the local area network corresponding to the local area network device, the method further includes: The local area network device determines that reception of the user plane data is allowed, and the local area network device determines that sending data to the user equipment is allowed through the user plane function entity.

7. A data communication method, include: The local area network device receives user plane data from the user equipment forwarded by the user plane function entity, wherein the user plane data carries data type indication information for indicating the user plane data; The local area network device authenticates the user plane data, wherein, when the authentication is successful, it is determined to allow the user equipment to access the local area network corresponding to the local area network device; The data communication method further comprises: the local area network device sending a registration request to the network open function entity; After receiving the registration success message from the network open function entity, the local area network device sends the authorized user information to the network open function entity to notify the policy control function entity to modify the forwarding policy, wherein the user device corresponding to the authorized user information is allowed to forward the user plane data to the local area network device through the user plane function entity, and the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user device corresponding to the authorized user information to the local area network device.

8. A method for accessing a local area network, in, The method comprises: The LAN device sends a registration request to the network open function entity; After receiving the registration success message from the network open function entity, the local area network device sends the authorized user information to the network open function entity, wherein the authorized user information satisfies the following conditions: the user equipment corresponding to the authorized user information is allowed to access the local area network device through the user plane function entity; The network open function entity sends the modified forwarding policy to the user plane function entity through the policy control function entity and the session management function entity, wherein the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user equipment to the local area network device; The method also includes: receiving the user plane data forwarded by the user plane function entity, and authenticating the user plane data, wherein the user plane function entity determines a forwarding strategy for the user plane data based on data type indication information, wherein the forwarding strategy is at least used to instruct the user plane function entity to forward the user plane data to the local area network device; and when the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network device, the user plane function entity forwards the user plane data to the local area network device.

9. The method according to claim 8, in, The network open function entity sending the modified forwarding policy through the policy control function entity and the session management function entity includes: The network open function entity sends a notification message of modifying the forwarding policy to the policy control function entity, wherein the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user equipment to the local area network device.

10. The method according to claim 9, in, The network open function entity sending the modified forwarding policy through the policy control function entity and the session management function entity includes: The policy control function entity sends the modified forwarding policy to the user plane function entity through the session management function entity, so that the user plane function entity sends the user plane data to the local area network device according to the forwarding policy.

11. A user plane functional entity, include: A receiving module, configured to receive user plane data from a user equipment, wherein the user plane data carries data type indication information for indicating the user plane data; A sending module, configured to forward the user plane data to a local area network device for authentication, wherein, when the authentication is passed, determining that the user equipment is allowed to access the local area network corresponding to the local area network device, and forwarding the user plane data to the local area network device for authentication, comprises: The sending module determines a forwarding strategy for the user plane data according to the data type indication information, wherein the forwarding strategy is at least used to instruct the user plane function entity to forward the user plane data to the local area network device; and when the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network device, forwards the user plane data to the local area network device; The local area network device sends a registration request to the network open function entity; After receiving the registration success message from the network open function entity, the local area network device sends the authorized user information to the network open function entity to notify the policy control function entity to modify the forwarding policy, wherein the user device corresponding to the authorized user information is allowed to forward the user plane data to the local area network device through the user plane function entity, and the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user device corresponding to the authorized user information to the local area network device.

12. A local area network access device, applied to a local area network device, the device include: A first sending module, used for sending a registration request to a network open function entity; A first receiving module, configured to receive a registration success message from the network open function entity; A second sending module is configured to send authorized user information to the network open function entity after the receiving module receives the registration success message, wherein the authorized user information satisfies the following conditions: the user equipment corresponding to the authorized user information is allowed to access the local area network device through the user plane function entity; The network open function entity sends the modified forwarding policy through the policy control function entity and the session management function entity, wherein the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user equipment to the local area network device; The second receiving module is used to receive the user plane data forwarded by the user plane function entity and authenticate the user plane data, wherein the user plane function entity determines a forwarding strategy for the user plane data based on data type indication information, wherein the forwarding strategy is at least used to instruct the user plane function entity to forward the user plane data to the local area network device; and when the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network device, the user plane function entity forwards the user plane data to the local area network device.

13. A data communication system, include: User equipment, used to send user plane data to the user plane function entity; The user plane function entity is configured to receive the user plane data and forward the user plane data to the local area network device for authentication, wherein when the authentication is passed, it is determined that the user equipment is allowed to access the local area network corresponding to the local area network device, and the user plane data carries data type indication information for indicating the user plane data; the user plane function entity forwards the user plane data to the local area network device for authentication, including: The user plane function entity determines a forwarding strategy for the user plane data according to the data type indication information, wherein the forwarding strategy is at least used to instruct the user plane function entity to forward the user plane data to the local area network device; and When the forwarding strategy instructs the user plane function entity to forward the user plane data to the local area network device, the user plane function entity forwards the user plane data to the local area network device; A local area network device, used to send a registration request to a network open function entity; After receiving the registration success message from the network open function entity, the local area network device sends the authorized user information to the network open function entity to notify the policy control function entity to modify the forwarding policy, wherein the user device corresponding to the authorized user information is allowed to forward the user plane data to the local area network device through the user plane function entity, and the modified forwarding policy is used to instruct the user plane function entity to forward the user plane data from the user device corresponding to the authorized user information to the local area network device.

Images