Edge user plane function access method, device, system, equipment and medium

Abstract

The present disclosure provides an edge user plane function access method, device, system and medium, which relate to the field of communication technology. The method includes an edge UPF sending a DHCP request to a DHCP server. The DHCP server returns a DHCP response message with a key request identifier. Based on the DHCP response message, a service quantum key negotiation request message is sent to a quantum key distribution management platform. The edge UPF encrypts the DHCP request message based on the negotiation response message returned by the key distribution management platform. The DHCP server decrypts the encrypted DHCP request message, and when the decryption is successful, an address configuration message is generated and sent to the edge UPF. The method encrypts the DHCP request message based on the service quantum key, and the DHCP server performs address configuration only when the decryption is successful, which effectively improves the security level of the edge UPF automatic identification access and ensures the security of the network.

Description

Background Art

[0002] With the rapid development of 5G networks, a large number of edge UPFs (User Plane Functions) have been put online, especially UPFs deployed in the user-owned computer rooms of campus enterprises. Edge UPF plug-and-play has been widely studied and applied due to its high deployment efficiency and low manual participation. However, when the proximal data communication device DC (Domain Controller)-GW (Gateway) of the edge UPF automatically obtains the management address, gateway address and other information from the DHCP (Dynamic Host Configuration Protocol) server after power-on, it will be subject to the security issue of user data leakage caused by the DHCP server's inability to accurately identify the access of legitimate DC-GW devices. Therefore, there is an urgent need for a method to improve the security level of automatic access identification of DC-GW devices of edge UPF.

[0003] At present, the traditional security encryption based on the computational complexity of mathematical algorithms and the method of authenticating access devices using two layers of VLAN tags still have the security problem of illegal device access.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an edge user plane function access method, apparatus, system, device and medium, which at least to some extent overcome one or more problems in the related art.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a method for accessing an edge user plane function is provided, including:

[0008] The edge UPF (User Plane Function) sends a DHCP (Dynamic Host Configuration Protocol) request to the DHCP server;

[0009] The edge UPF receives a DHCP response message returned by the DHCP server, where the DHCP response message carries a key request identifier;

[0010] The edge UPF sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0011] The edge UPF receives a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0012] The edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message;

[0013] The edge UPF sends the encrypted DHCP request message to the DHCP server;

[0014] The edge UPF receives the address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message and generates the address configuration message when the decryption is successful.

[0015] In an exemplary embodiment of the present disclosure, the quantum key distribution management platform performs identity authentication on the edge UPF and the DHCP server, and when the identity authentication passes, generates the service quantum key negotiation response message based on the quantum key negotiation request messages of the edge UPF and the DHCP server.

[0016] In an exemplary embodiment of the present disclosure, the step of the quantum key distribution management platform authenticating the edge UPF and the DHCP server includes:

[0017] The quantum key distribution management platform obtains the authentication quantum key corresponding to the edge UPF, wherein the authentication quantum key is obtained through a quantum key module;

[0018] The quantum key distribution management platform verifies the authentication quantum key;

[0019] If the verification is successful, the edge UPF is determined to be a legitimate device.

[0020] In an exemplary embodiment of the present disclosure, the edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message, including:

[0021] The edge UPF identifies the service quantum key negotiation response message through the quantum key module to obtain the service quantum key;

[0022] The DHCP request message is encrypted according to the service quantum key to obtain an encrypted DHCP request message.

[0023] In an exemplary embodiment of the present disclosure, the quantum key module is configured as a plug-and-play device and is connected to the edge UPF and / or the DHCP server through a universal serial bus interface.

[0024] In an exemplary embodiment of the present disclosure, the quantum key module includes:

[0025] An authenticated quantum key distribution module, used to enable an access device to obtain an authenticated quantum key; wherein the access device includes an edge UPF and / or a DHCP server;

[0026] The service quantum key extraction module is used to identify the service quantum key negotiation response message and obtain the service quantum key, so as to encrypt the DHCP request message based on the service quantum key or decrypt the encrypted DHCP request message.

[0027] In an exemplary embodiment of the present disclosure, the quantum key distribution management platform generates the service quantum key negotiation response message based on the quantum key negotiation request message of the edge UPF and the DHCP server, including:

[0028] Obtaining the quantum key negotiation request message, wherein the quantum key negotiation request message carries address information;

[0029] Matching the quantum key negotiation request messages of the edge UPF and the DHCP server based on the address information to obtain a matching result;

[0030] Based on the matching result, a service quantum key negotiation response message corresponding to the edge UPF and the DHCP server is generated.

[0031] According to a second aspect of the present disclosure, a method for accessing an edge user plane function is provided, including:

[0032] The DHCP server receives the DHCP request sent by the edge UPF;

[0033] The DHCP server sends a DHCP response message to the edge UPF, wherein the DHCP response message carries a key request identifier;

[0034] The DHCP server sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0035] The DHCP server receives a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0036] The DHCP server receives the encrypted DHCP request message sent by the edge UPF; wherein the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message;

[0037] The DHCP server decrypts the encrypted DHCP request message based on the service quantum key negotiation response message;

[0038] When the decryption is successful, the DHCP server generates address configuration information;

[0039] The DHCP server sends the address configuration information to the edge UPF.

[0040] According to a third aspect of the present disclosure, an edge user plane function access device is provided, which is applied to an edge UPF, including:

[0041] The first sending module is used to send a Dynamic Host Configuration Protocol DHCP request to a DHCP server;

[0042] A first receiving module, configured to receive a DHCP response message returned by the DHCP server, wherein the DHCP response message carries a key request identifier;

[0043] The second sending module is used to send a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0044] A second receiving module is used to receive a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0045] An encryption module, used to encrypt the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message;

[0046] A third sending module, used to send the encrypted DHCP request message to the DHCP server;

[0047] The third receiving module is used to receive the address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message and generates the address configuration message when the decryption is successful.

[0048] According to a fourth aspect of the present disclosure, an edge user plane function access device is provided, which is applied to a DHCP server, including:

[0049] A first receiving module, configured to receive a DHCP request sent by an edge UPF;

[0050] A first sending module, configured to send a DHCP response message to the edge UPF, wherein the DHCP response message carries a key request identifier;

[0051] A second sending module is used to send a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0052] A second receiving module is used to receive a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0053] A third receiving module is used to receive the encrypted DHCP request message sent by the edge UPF; wherein the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message;

[0054] A decryption module, configured to decrypt the encrypted DHCP request message based on the service quantum key negotiation response message;

[0055] A generation module, used to generate address configuration information when decryption is successful;

[0056] The third sending module is used to send the address configuration information to the edge UPF.

[0057] According to a fifth aspect of the present disclosure, an edge user plane function access system is provided, comprising the edge UPF as described above, a quantum key distribution management platform, and the DHCP server as described above.

[0058] According to a sixth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the above-mentioned edge user plane function access method by executing the executable instructions.

[0059] According to a seventh aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned edge user plane function access method is implemented.

[0060] The edge user plane function access method and device, electronic device and storage medium provided by the embodiments of the present disclosure utilize the characteristics of quantum keys, such as randomness, non-clonability and one-business-one-confidentiality. The edge UPF and the DHCP server simultaneously send a service quantum key negotiation request message to the quantum key distribution management platform, and then obtain the real-time distributed service quantum key based on the service quantum key negotiation response message returned by the quantum key distribution management platform. The edge UPF encrypts the DHCP request message with the service quantum key and then sends it to the DHCP server. The DHCP server decrypts the DHCP request message based on the service quantum key. If the decryption is successful, the edge UPF is identified as a legitimate device and the address and other information are allocated to the edge UPF. If the decryption is unsuccessful, the DHCP request message is discarded. The above process effectively provides the security level of the edge UPF to automatically identify access, thereby improving the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0062] Figure 1 A flow chart of an edge user plane function access method in an embodiment of the present disclosure is shown;

[0063] Figure 2 A flowchart showing identity authentication performed by the QMS platform in an embodiment of the present disclosure is shown;

[0064] Figure 3 A schematic diagram of a quantum key module according to an embodiment of the present disclosure is shown;

[0065] Figure 4 A flow chart of an edge user plane function access method in another embodiment of the present disclosure is shown;

[0066] Figure 5 A structural diagram of a DW-GC device in an application scenario of the present disclosure is shown;

[0067] Figure 6 A structural diagram of a DHCP server in an application scenario of the present disclosure is shown;

[0068] Figure 7 A flow chart showing an edge user plane function access method in an application scenario of the present disclosure is shown;

[0069] Figure 8A diagram showing a process of automatic identification and access of a DHCP server to a DC-GW device in an application scenario of the present disclosure;

[0070] Fig. 9 A structural diagram of an edge user plane function access system in an embodiment of the present disclosure is shown;

[0071] Fig.10 A structural diagram of an edge user plane function access device in an embodiment of the present disclosure is shown;

[0072] Fig.11 A structural diagram of an edge user plane function access device in another embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0073] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0074] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0075] In order to ensure the security level of the automatic access of the edge UPF proximal data communication device DC-GW, it is necessary to authenticate the legitimacy of the edge UPF proximal data communication device DC-GW. Device legitimacy authentication can be achieved through a secure encryption algorithm. With the popularization of computer technology, encryption algorithms tend to be highly complex and have higher security. However, the generation and transmission of keys are easy to be cracked, resulting in certain security risks, making it possible for illegal devices to access.

[0076] With the combination of quantum physics and information technology, quantum key distribution (QKD) technology has become a hope for solving security issues such as key generation and transmission. The "No-Cloning Theorem" is used to achieve absolute security of key distribution. The "No-Cloning Theorem" is a corollary of the "Heisenberg Uncertainty Principle". It means that the process of making an identical copy of any unknown quantum state in quantum mechanics is not feasible, because the premise of copying is measurement, and measurement generally changes the state of the quantum. Each bit of the key in QKD technology is transmitted by a single photon. The quantum behavior of a single photon makes it impossible for an eavesdropper to intercept and copy the state of the photon without being noticed, thereby ensuring the security of key generation and transmission. Based on the characteristics of quantum keys, the present disclosure encrypts the DHCP request of the edge UPF access process through the service quantum key to realize the authentication of automatic device access.

[0077] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0078] Figure 1 A flowchart of an edge user plane function access method 100 of an embodiment of the present application is schematically shown. Figure 1 , the edge user plane function access method 100 includes:

[0079] Step S101, the edge UPF sends a DHCP request to the DHCP server;

[0080] Step S102, the edge UPF receives a DHCP response message returned by the DHCP server, where the DHCP response message carries a key request identifier;

[0081] Step S103, the edge UPF sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0082] Step S104, the edge UPF receives a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0083] Step S105, the edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message;

[0084] Step S106, the edge UPF sends the encrypted DHCP request message to the DHCP server;

[0085] Step S107: The edge UPF receives the address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message, and generates the address configuration message when the decryption is successful.

[0086] In the edge UPF access method of this embodiment, the edge UPF sends a service quantum key negotiation request message to the quantum key distribution management platform based on the response message with the key request identifier returned by the DHCP server. The quantum key distribution management platform returns a service quantum key negotiation response message to the edge UPF and the DHCP server based on the service quantum key negotiation request message. The edge UPF extracts the service quantum key from the service quantum key negotiation response message, encrypts the DHCP request message with the service quantum key, and then sends it to the DHCP server. The DHCP server decrypts the DHCP request message based on the service quantum key. If the decryption is successful, the edge UPF is identified as a legitimate device and the address and other information are assigned to the edge UPF. If the decryption is unsuccessful, the DHCP request message is discarded. The above process effectively provides the security level of automatic access identification of the edge UPF, thereby improving the security of the network.

[0087] The following describes in detail each step of the edge user plane function access method 100.

[0088] In step S101, the edge UPF sends a DHCP request to a DHCP server.

[0089] In one embodiment of the present disclosure, the edge UPF is automatically connected through the proximal data communication device DC-GW. The DHCP request carries information such as the MAC (Media / Medium Access Control) address of the DC-GW device to identify a specific edge UPF.

[0090] In step S102, the edge UPF receives a DHCP response message returned by the DHCP server, where the DHCP response message carries a key request identifier.

[0091] In one embodiment of the present disclosure, the step of generating a DHCP response message includes:

[0092] The DHCP server receives the DHCP request;

[0093] The DHCP server inserts a key request identifier into the message header of the DHCP request to obtain a DHCP response message; wherein the key request identifier is used to obtain the service quantum key from the key distribution management platform.

[0094] In step S103, the edge UPF sends a service quantum key negotiation request message to the quantum-key-distribution management system (QMS) platform based on the DHCP response message. Specifically, the service quantum key negotiation request message carries a key request identifier and MAC address information.

[0095] After receiving the DHCP request, the DHCP server also sends a service key negotiation request message to the QMS platform based on the DHCP request. The service quantum key negotiation request message of the DHCP server carries key request identifier and MAC address information, etc.

[0096] In step S104, the edge UPF receives the service quantum key negotiation response message sent by the QMS platform.

[0097] In one embodiment of the present disclosure, after the QMS platform receives the service quantum key negotiation request message, it first authenticates the edge UPF and the DHCP server. When the authentication passes, it generates a service quantum key negotiation response message based on the quantum key negotiation request message of the edge UPF and the DHCP server.

[0098] See also Figure 2 Specifically, in one embodiment of the present disclosure, the steps of the QMS platform authenticating the edge UPF / DHCP server include:

[0099] S201, the QMS platform obtains the authentication quantum key corresponding to the edge UPF / DHCP server, wherein the authentication quantum key is obtained through a quantum key module;

[0100] S202, the QMS platform verifies the authentication quantum key;

[0101] S203, if the verification is successful, the edge UPF / DHCP server is determined to be a legitimate device;

[0102] S204: If the verification fails, the edge UPF / DHCP server is determined to be an illegal device.

[0103] Figure 3 The structure of the quantum key module in the exemplary embodiment of the present disclosure is schematically shown. Figure 3As shown, the quantum key module 300 includes an authentication quantum key distribution module 310 and a business quantum key extraction module 320. In one embodiment of the present disclosure, the quantum key module 300 is configured as a plug-and-play device, and the device is accessed through a universal serial bus USB interface 330. The accessed device includes the edge UPF and / or the DHCP server. The quantum key module 300 can be plugged in and out between multiple devices, and authenticated quantum keys are distributed to multiple devices, which is highly convenient.

[0104] In one embodiment of the present disclosure, the certified quantum key distribution module 310 is used to enable the access device to obtain the certified quantum key. Specifically, the certified quantum key distribution module 310 is configured with a quantum key storage unit, and the quantum key storage unit is once filled with the certified quantum key. The certified quantum key is obtained based on the QMS platform.

[0105] In steps S201 to S204, when the quantum key module is connected to the DHCP server / edge UPF device, an authentication quantum key will be assigned to the access device. After receiving the message sent by the DHCP server / edge UPF device, the QMS platform verifies the identity of the DHCP server / edge UPF device based on the authentication quantum key of the DHCP server / edge UPF device. Only when the authentication quantum key is verified by the QMS platform, the DHCP server / edge UPF device is confirmed to be a legal device, otherwise it is an illegal device.

[0106] The service quantum key extraction module 320 is used to identify the service quantum key negotiation response message and obtain the service quantum key, so as to encrypt the DHCP request message or decrypt the encrypted DHCP request message based on the service quantum key, which will be described in detail in step S105 below.

[0107] It is understandable that in other embodiments of the present disclosure, the quantum key module can also be a built-in module configured in the edge UPF / DHCP server. Compared with the built-in module, the quantum key module in the embodiment of the present disclosure has plug-and-play capability and can be inserted into different DHCP servers / edge UPF devices for use, effectively improving the use efficiency of the quantum key module and further reducing the cost of system implementation.

[0108] See also Figure 4 In one embodiment of the present disclosure, in step S104, the quantum key distribution management platform generates a service quantum key negotiation response message based on the quantum key negotiation request message of the edge UPF and the DHCP server, specifically including:

[0109] Step S1041: The QMS platform obtains a quantum key negotiation request message, wherein the quantum key negotiation request message carries address information.

[0110] In step S1042, the QMS platform matches the quantum key negotiation request messages of the edge UPF and the DHCP server based on the address information to obtain a matching result. For example, in one embodiment, the MAC address information in the quantum key negotiation request message is matched, and the edge UPF and DHCP server with the same MAC address information are matched.

[0111] Step S1043, the QMS platform generates a service quantum key negotiation response message for the corresponding edge UPF and DHCP server based on the matching result. Specifically, the QMS platform generates a service quantum key in real time through the QKD network for the service quantum key negotiation request of the matching parties, and sends it to the DHCP server and edge UPF device through the service quantum key negotiation response message.

[0112] In step S105, the edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message;

[0113] In one embodiment of the present disclosure, step S105 specifically includes: the edge UPF identifies the service quantum key negotiation response message through the quantum key module to obtain the service quantum key; and encrypts the DHCP request message according to the service quantum key to obtain an encrypted DHCP request message.

[0114] Specifically, in one embodiment of the present disclosure, in step S105, the service quantum key negotiation response message is identified by the service quantum key extraction module 320 of the quantum key module to extract the service quantum key. For example, in a specific embodiment, after the QMS platform generates the service quantum key in real time, it performs encryption processing based on the authentication quantum key corresponding to the device to generate an encrypted service quantum key negotiation response message. After receiving the response message, the DHCP server / edge UPF device identifies and extracts the response message based on its own authentication quantum key to obtain the service quantum key.

[0115] Through the above method, one business, one key is achieved, ensuring that the business quantum key used for each device authentication is different, effectively improving the security level of automatic identification and access of edge UPF devices.

[0116] In step S106, the edge UPF sends the encrypted DHCP request message to the DHCP server.

[0117] In step S107, the edge UPF receives the address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message, and generates an address configuration message when the decryption is successful.

[0118] Specifically, the DHCP server obtains the service quantum key based on the received service quantum key negotiation response message, which is a shared key between the DHCP server and the edge UPF. The DHCP server decrypts the encrypted DHCP request message through the service quantum key, and generates an address configuration message when the decryption is successful. Based on this, the DHCP server completes the automatic authentication of the access device and performs address configuration for the legitimate edge UPF device, including allocating management address, gateway address and mask information.

[0119] Figure 4 A flowchart of an edge user plane function access method 400 of an embodiment of the present application is schematically shown. Figure 4 As shown, the edge user plane function access method 400 is applied to a DHCP server, including:

[0120] Step S401: The DHCP server receives a DHCP request sent by the edge UPF. Specifically, the DHCP request carries information such as the MAC address of the DC-GW device.

[0121] Step S402: The DHCP server sends a DHCP response message to the edge UPF, and the DHCP response message carries a key request identifier. Specifically, the DHCP server inserts the key request identifier into the message header of the DHCP request to obtain the DHCP response message.

[0122] Step S403: The DHCP server sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message. The service quantum key negotiation request message of the DHCP server carries a key request identifier and MAC address information, etc.

[0123] Step S404, the DHCP server receives a service quantum key negotiation response message sent by the quantum key distribution management platform. Specifically, in one embodiment of the present disclosure, after receiving the service quantum key negotiation request message, the QMS platform first authenticates the edge UPF and the DHCP server, and when the authentication is passed, generates a service quantum key negotiation response message based on the quantum key negotiation request message of the edge UPF and the DHCP server.

[0124] Step S405: The DHCP server receives the encrypted DHCP request message sent by the edge UPF, wherein the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message.

[0125] Step S406: The DHCP server decrypts the encrypted DHCP request message based on the service quantum key negotiation response message. Specifically, the DHCP server decrypts the encrypted DHCP request message through the connected quantum key module. The quantum key module identifies the service quantum key negotiation response message, obtains the service quantum key, and decrypts the encrypted DHCP request message through the service quantum key.

[0126] Step S407: When the decryption is successful, the DHCP server generates address configuration information, which includes management address, gateway address, and mask information.

[0127] Step S408: The DHCP server sends address configuration information to the edge UPF.

[0128] In one embodiment of the present disclosure, the edge user plane function access method 400 further includes:

[0129] When the decryption fails, the DHCP server discards the DHCP request message, thereby denying access to the edge UPF.

[0130] In the edge UPF access method of this embodiment, the DHCP server inserts a key request identifier in the DHCP request, and sends a service quantum key negotiation request message to the QMS platform at the same time as the edge UPF. The edge UPF and DHCP service obtain real-time service quantum keys through the QMS platform distribution. The edge UPF encrypts the DHCP request message with the service quantum key to obtain an encrypted DHCP request message. The DHCP server decrypts the DHCP request message based on the service quantum key. If the decryption is successful, the edge UPF is identified as a legitimate device, and the address and other information are allocated to the edge UPF, so as to realize automatic identification and access of the edge UPF and improve the security of the network.

[0131] In a specific application scenario, the edge UPF accesses the DHCP server through the DC-GW device. Figure 5As shown, in this application scenario, the DC-GW device 500 includes a receiving module 510, a sending module 520 and a quantum identification module 530. The receiving module 510 is configured with an interface 511 for interacting with the DHCP server and receiving the message sent by it. The sending module 520 is configured with an interface 521 for interacting with the DHCP server and sending a message to the DHCP server. The quantum identification module 530 is configured with an interface 531 for communicating with the QMS platform, and interacts with the QMS platform through the interface 531 to obtain the business quantum key. The quantum identification module 530 is also configured with an interface 532 for interacting with the quantum key module, and obtains the authentication quantum key through the interface 532.

[0132] See also Figure 6 As shown, in this application scenario, the DHCP server includes a receiving module 610, a sending module 620, a quantum identification module 630 and an address allocation module 640. The receiving module 610 is configured with an interface 611 for interacting with the DC-GW device and receiving the message sent by it. The sending module 620 is configured with an interface 621 for interacting with the DC-GW device and sending a message to the DC-GW device. The quantum identification module 630 is configured with an interface 631 for communicating with the QMS platform, and interacts with the QMS platform through the interface 631 to obtain the business quantum key. The quantum identification module 630 is also configured with an interface 632 for interacting with the quantum key module, and obtains the authentication quantum key through the interface 632. The address allocation module 640 is used to allocate management address, gateway address, mask and other information to the legal DC-GW device.

[0133] See also Figure 7 As shown, in this application scenario, the quantum key module is connected to both the DC-GW device 710 and the DHCP server 720. After the device is powered on, the edge UPF automatically identifies and accesses according to the following steps:

[0134] Step 1: The DC-GW device 710 sends a DHCP request via a common message, carrying relevant information such as the MAC address of the DC-GW;

[0135] Step 2: After receiving the DHCP request, the DHCP server 720 responds to the request and inserts information such as the service key identifier that the requesting party needs to obtain from the QMS platform into the message header;

[0136] Step 3: The DHCP server 720 and the DC-GW device 730 use the operator's internal interface to simultaneously send a service key negotiation request message to the QMS platform 730;

[0137] Step 4: QMS authenticates the DHCP server 720 and the DC-GW device 710 according to the authentication quantum key, matches the service key negotiation request of both parties according to the MAC address, generates the service key in real time through the QKD network, and sends it to the DHCP server 720 and the DC-GW device 710;

[0138] Step 5: After receiving the service key negotiation response message, the DC-GW device 710 uses the quantum identification module to call the authentication quantum key in the quantum key module to extract the service quantum key. The service quantum key is used to encrypt the DHCP request message to be sent, including the MAC address of the DC-GW and other information, and sent to the DHCP server 720;

[0139] Step 6: The DHCP server 720 automatically identifies and allocates management address, gateway address and mask information, etc. to the legal DC-GW device.

[0140] See also Figure 8 In the above step 6, the automatic identification access process of the DHCP server to the DC-GW device is as follows:

[0141] Step S801: The DHCP server calls the quantum key module to extract the service quantum key from the service key negotiation response message. The encrypted DHCP request message is decrypted using the service quantum key;

[0142] Step S802, determining whether the decryption is successful through the quantum recognition module.

[0143] Step S803: If yes, the DHCP server considers the DC-GW device to be a legitimate device, and calls the address allocation module to allocate a management address, a gateway address, and mask information, etc. to the DC-GW device.

[0144] Step S804: If not, discard the DHCP request message.

[0145] Through the above steps S801 to S804, the DHCP server decrypts the encrypted DHCP request with the obtained service quantum key. When the decryption is successful, the DC-GW device is accessed. When the decryption fails, the relevant message is discarded, thereby realizing automatic identification and access to the legitimate DC-GW device.

[0146] Fig. 9 A schematic diagram of an edge user plane function access system 900 of an embodiment of the present application is schematically shown. Fig. 9As shown, the edge user plane access system 900 includes an edge UPF, a DHCP server 920, and a quantum key distribution management QMS (Quantum-key-distribution Management Systerm) platform 930. In one embodiment, the edge UPF is accessed through a DC-GW device 910. The DC-GW device 910 and the DHCP server 920 are respectively connected to quantum key modules 911 and 921.

[0147] The automatic identification access process of the edge user plane access system 900 is as follows:

[0148] Step ①, the DC-GW device 910 and the DHCP server 920 are respectively connected to the quantum key modules 911 and 921 through the USB interface.

[0149] Step ②, after the DC-GW device 910 is powered on, it sends a DHCP request to the DHCP server 920 via a normal message, and the DHCP request carries relevant information such as the MAC address of the DC-GW device;

[0150] Step ③, after receiving the DHCP request, the DHCP server 920 responds to the request and inserts information such as the service key identifier that the requesting party needs to obtain from the QMS platform into the DHCP request message header;

[0151] Step ④, the DHCP server 920 and the DC-GW device 910 use the operator's internal interface to simultaneously send a service quantum key negotiation request message to the QMS platform 930;

[0152] Step ⑤, the QMS platform 930 authenticates the DHCP server 920 and the DC-GW device 910 according to the authentication quantum key. After the authentication is passed, the DHCP server 920 and the DC-GW device 910 are matched according to the MAC address in the service quantum key negotiation request message. For the matched DHCP server 920 and DC-GW device 910, the service quantum key of this time is generated in real time through the QKD network. The service quantum key negotiation response message carrying the service quantum key is sent to the DHCP server 920 and the DC-GW device 910 respectively.

[0153] Step ⑥, after receiving the service quantum key negotiation response message, the DC-GW device 910 uses the service quantum key extraction module in the quantum key module to extract the service quantum key, encrypts the DHCP request message to be sent based on the service chain key, and sends the encrypted DHCP request message to the DHCP server 920.

[0154] Step 7, the DHCP server uses the service quantum key extraction module of the quantum key module to extract the service quantum key in the service quantum key negotiation response message sent by the QMS platform. Decrypt the received encrypted DHCP request message based on the service quantum key. If the decryption is successful, the authentication of the access device is completed, and the address configuration information is generated and sent to the DC-GW device 910, and the management address, gateway address and mask information are allocated to the legitimate DC-GW device 910.

[0155] Fig.10 Schematically shows a schematic diagram of an edge UPF device 1000. Fig.10 , the edge UPF device 1000 includes:

[0156] The first sending module 1010 is used to send a Dynamic Host Configuration Protocol DHCP request to a DHCP server;

[0157] The first receiving module 1020 is used to receive a DHCP response message returned by the DHCP server, where the DHCP response message carries a key request identifier;

[0158] The second sending module 1030 is used to send a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0159] The second receiving module 1040 is used to receive a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0160] The encryption module 1050 is used to encrypt the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message;

[0161] The third sending module 1060 is used to send the encrypted DHCP request message to the DHCP server;

[0162] The third receiving module 1070 is configured to receive an address configuration message sent by a DHCP server. The DHCP server decrypts the encrypted DHCP request message and generates an address configuration message when the decryption is successful.

[0163] In the edge UPF device of this embodiment, the edge UPF sends a service quantum key negotiation request message to the quantum key distribution management platform based on the response message with the key request identifier returned by the DHCP server. The quantum key distribution management platform returns a service quantum key negotiation response message to the edge UPF and the DHCP server based on the service quantum key negotiation request message. The edge UPF extracts the service quantum key from the service quantum key negotiation response message, encrypts the DHCP request message with the service quantum key, and then sends it to the DHCP server. The DHCP server decrypts the DHCP request message based on the service quantum key. If the decryption is successful, the edge UPF is identified as a legitimate device and the address and other information are assigned to the edge UPF. If the decryption is unsuccessful, the DHCP request message is discarded. The above process effectively provides the security level of automatic access identification of the edge UPF, thereby improving the security of the network.

[0164] In one embodiment of the present disclosure, the edge UPF device 1000 may also include modules for implementing other process steps of the above-mentioned edge user plane access method embodiments. Since the functions of the edge UPF device 500 have been described in detail in its corresponding method embodiment, the present disclosure will not repeat them here.

[0165] Fig.11 A schematic diagram of a DHCP server 1100 is shown schematically. Fig.11 , the DHCP server 1100 includes:

[0166] The first receiving module 1110 is used to receive a DHCP request sent by the edge UPF;

[0167] The first sending module 1120 is used to send a DHCP response message to the edge UPF, where the DHCP response message carries a key request identifier;

[0168] The second sending module 1130 is used to send a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message;

[0169] The second receiving module 1140 is used to receive a service quantum key negotiation response message sent by the quantum key distribution management platform;

[0170] The third receiving module 1150 is used to receive the encrypted DHCP request message sent by the edge UPF; wherein the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message;

[0171] A decryption module 1160, configured to decrypt the encrypted DHCP request message based on the service quantum key negotiation response message;

[0172] A generating module 1170, for generating address configuration information when the decryption is successful;

[0173] The third sending module 1180 is used to send address configuration information to the edge UPF.

[0174] In the DHCP server of this embodiment, the DHCP server inserts a key request identifier in the DHCP request, and sends a service quantum key negotiation request message to the QMS platform simultaneously with the edge UPF. The edge UPF and the DHCP service obtain real-time service quantum keys through the QMS platform distribution. The edge UPF encrypts the DHCP request message with the service quantum key to obtain an encrypted DHCP request message. The DHCP server decrypts the DHCP request message based on the service quantum key. If the decryption is successful, the edge UPF is identified as a legitimate device, and the address and other information are allocated to the edge UPF, so as to realize automatic identification and access of the edge UPF and improve the security of the network.

[0175] In one embodiment of the present disclosure, the DHCP server 1100 may further include modules for implementing other process steps of the above-mentioned edge user plane access method embodiments. Since the functions of the DHCP server have been described in detail in the corresponding method embodiments, the present disclosure will not repeat them here.

[0176] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0177] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above-mentioned edge user plane function access method is also provided.

[0178] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0179] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processing unit, the at least one storage unit, and a bus connecting different system components (including the storage unit and the processing unit).

[0180] The storage unit stores program codes, which can be executed by the processing unit, so that the processing unit performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit can perform the following steps: Figure 1 In step S101 shown in the figure, the edge UPF sends a DHCP request to the DHCP server; in step S102, the edge UPF receives a DHCP response message returned by the DHCP server, and the DHCP response message carries a key request identifier; in step S103, the edge UPF sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message; in step S104, the edge UPF receives a service quantum key negotiation response message sent by the quantum key distribution management platform; in step S105, the edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message; in step S106, the edge UPF sends the encrypted DHCP request message to the DHCP server; in step S107, the edge UPF receives an address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message, and generates the address configuration message when the decryption is successful. Or the processing unit 810 may execute as follows Figure 4 In step S401 shown in the figure, the DHCP server receives the DHCP request sent by the edge UPF; in step S402, the DHCP server sends a DHCP response message to the edge UPF, and the DHCP response message carries a key request identifier; in step S403, the DHCP server sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message; in step S404, the DHCP server receives the service quantum key negotiation response message sent by the quantum key distribution management platform; in step S405, the DHCP server receives the encrypted DHCP request message sent by the edge UPF. Among them, the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message; in step S406, the DHCP server decrypts the encrypted DHCP request message based on the service quantum key negotiation response message; in step S407, the DHCP server generates address configuration information when the decryption is successful. Specifically, the address configuration information includes management address, gateway address and mask information, etc.; in step S408, the DHCP server sends the address configuration information to the edge UPF.

[0181] The storage unit may include a readable medium in the form of a volatile memory unit, such as a random access memory unit (RAM) and / or a cache memory unit, and may further include a read-only memory unit (ROM).

[0182] The storage unit may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0183] The bus may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0184] The electronic device can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable users to interact with the electronic device, and / or communicate with any device (such as routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. This communication can be carried out through an input / output (I / O) interface. In addition, the electronic device can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs) and / or public networks, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0185] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0186] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0187] A program product for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0188] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0189] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0190] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0191] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0192] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0193] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0194] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0195] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for accessing edge user plane functions, characterized in that: include: The edge user plane function UPF sends a Dynamic Host Configuration Protocol DHCP request to the DHCP server; The DHCP request identifies the edge UPF; The edge UPF receives a DHCP response message returned by the DHCP server, where the DHCP response message carries a key request identifier; The edge UPF sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message; The edge UPF receives a service quantum key negotiation response message sent by the quantum key distribution management platform; The edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message; The edge UPF sends the encrypted DHCP request message to the DHCP server; The edge UPF receives the address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message and generates the address configuration message when the decryption is successful; The edge UPF encrypts the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message, including: The edge UPF identifies the service quantum key negotiation response message through the quantum key module to obtain the service quantum key; The DHCP request message is encrypted according to the service quantum key to obtain an encrypted DHCP request message.

2. The edge user plane function access method according to claim 1, characterized in that: The quantum key distribution management platform performs identity authentication on the edge UPF and the DHCP server, and when the identity authentication passes, generates the service quantum key negotiation response message based on the quantum key negotiation request message of the edge UPF and the DHCP server.

3. The edge user plane function access method according to claim 2, characterized in that: The step of the quantum key distribution management platform authenticating the edge UPF and the DHCP server includes: The quantum key distribution management platform obtains the authentication quantum key corresponding to the edge UPF / the DHCP server, wherein the authentication quantum key is obtained through a quantum key module; The quantum key distribution management platform verifies the authentication quantum key; If the verification is successful, the edge UPF is determined to be a legitimate device.

4. The edge user plane function access method according to claim 3, characterized in that: The quantum key module is configured as a plug-and-play device and is connected to the edge UPF and / or the DHCP server through a universal serial bus interface.

5. The edge user plane function access method according to claim 3, characterized in that: The quantum key module comprises: An authenticated quantum key distribution module, used to enable an access device to obtain an authenticated quantum key; wherein the access device includes an edge UPF and / or a DHCP server; The service quantum key extraction module is used to identify the service quantum key negotiation response message and obtain the service quantum key, so as to encrypt the DHCP request message or decrypt the encrypted DHCP request message based on the service quantum key.

6. The edge user plane function access method according to claim 1, characterized in that: The quantum key distribution management platform generates the service quantum key negotiation response message based on the quantum key negotiation request message of the edge UPF and the DHCP server, including: Obtaining the quantum key negotiation request message, wherein the quantum key negotiation request message carries address information; Matching the quantum key negotiation request messages of the edge UPF and the DHCP server based on the address information to obtain a matching result; Based on the matching result, a service quantum key negotiation response message corresponding to the edge UPF and the DHCP server is generated.

7. A method for accessing edge user plane functions, characterized in that: include: The DHCP server receives the DHCP request sent by the edge UPF; The DHCP request identifies the edge UPF; The DHCP server sends a DHCP response message to the edge UPF, wherein the DHCP response message carries a key request identifier; The DHCP server sends a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message; The DHCP server receives a service quantum key negotiation response message sent by the quantum key distribution management platform; The DHCP server receives an encrypted DHCP request message sent by the edge UPF; wherein the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message; wherein the edge UPF identifies the service quantum key negotiation response message through a quantum key module to obtain a service quantum key; and encrypts the DHCP request message according to the service quantum key to obtain an encrypted DHCP request message; The DHCP server decrypts the encrypted DHCP request message based on the service quantum key negotiation response message; When the decryption is successful, the DHCP server generates address configuration information; The DHCP server sends the address configuration information to the edge UPF.

8. An edge user plane function access device, applied to edge UPF, characterized in that: include: The first sending module is used to send a Dynamic Host Configuration Protocol DHCP request to a DHCP server; The DHCP request identifies the edge UPF; A first receiving module, configured to receive a DHCP response message returned by the DHCP server, wherein the DHCP response message carries a key request identifier; The second sending module is used to send a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message; A second receiving module is used to receive a service quantum key negotiation response message sent by the quantum key distribution management platform; An encryption module, used to encrypt the DHCP request message based on the service quantum key negotiation response message to obtain an encrypted DHCP request message; A third sending module, used to send the encrypted DHCP request message to the DHCP server; A third receiving module is used to receive the address configuration message sent by the DHCP server; wherein the DHCP server decrypts the encrypted DHCP request message and generates the address configuration message when the decryption is successful; The encryption module is used to identify the service quantum key negotiation response message through the quantum key module to obtain the service quantum key; and encrypt the DHCP request message according to the service quantum key to obtain the encrypted DHCP request message.

9. An edge user plane function access device, applied to a DHCP server, characterized in that: include: A first receiving module, configured to receive a DHCP request sent by an edge UPF; The DHCP request identifies the edge UPF; A first sending module, configured to send a DHCP response message to the edge UPF, wherein the DHCP response message carries a key request identifier; A second sending module is used to send a service quantum key negotiation request message to the quantum key distribution management platform based on the DHCP response message; A second receiving module is used to receive a service quantum key negotiation response message sent by the quantum key distribution management platform; A third receiving module is configured to receive an encrypted DHCP request message sent by the edge UPF; wherein the encrypted DHCP request message is obtained by the edge UPF encrypting the DHCP request message based on the service quantum key negotiation response message; wherein the edge UPF identifies the service quantum key negotiation response message through a quantum key module to obtain a service quantum key; and encrypts the DHCP request message according to the service quantum key to obtain an encrypted DHCP request message; A decryption module, configured to decrypt the encrypted DHCP request message based on the service quantum key negotiation response message; A generation module, used to generate address configuration information when decryption is successful; The third sending module is used to send the address configuration information to the edge UPF.

10. An edge user plane function access system, characterized in that: It includes the edge UPF as described in claim 8, the quantum key distribution management platform and the DHCP server as described in claim 9.

11. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the edge user plane function access method according to any one of claims 1 to 7 by executing the executable instructions.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the edge user plane function access method described in any one of claims 1 to 7 is implemented.

Images