Single-user level policy control method, device, base station and medium

Abstract

The present application provides a single-user-level policy control method, device, base station and medium, which relates to the field of communication technology, wherein the method includes: obtaining a user-level policy, wherein the user-level policy includes policy control information and terminal information, wherein the terminal information carries the international mobile user identity code IMSI and / or mobile user number MSISDN of the user terminal; when the user terminal corresponding to the terminal information conducts a protocol data unit PDU session, the PDU session is controlled based on the policy control information. Through the above method, the present application can reduce the complexity and delay of the single-user policy implementation, while reducing the load of the 5G core network and improving the policy control efficiency.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a single-user level policy control method, device, base station and medium. Background Art

[0002] With the continuous development of communication technology, enterprise customers have put forward higher requirements for terminal user access security management and control, especially for user access security management and control of the fifth generation mobile communication technology (5G) private network.

[0003] At present, the policy control solution of 5G private network mainly sends requests to the network exposure function (NEF) network element of the 5G core network through the enterprise server. The NEF network element calls the policy control function (PCF) network element to write terminal access control rules, and the PCF pushes the control rules to the session management function (SMF) network element. The SMF then sends the control rules to the user plane function (UPF) network element, and finally the UPF executes the terminal access control rules and actions.

[0004] In the above solution, many core network elements are involved in policy control, the process is too complicated and the latency is high, which increases the load on the 5G core network and reduces the efficiency of policy control. Summary of the invention

[0005] In view of the above problems, namely, the current policy control scheme involves a large number of core network elements, a heavy core network load, and low policy control efficiency, the present application provides a single-user level policy control method, device, base station and medium.

[0006] In order to achieve the above objectives, this application provides the following technical solutions:

[0007] According to one aspect of the present application, a single-user-level policy control method is provided, comprising:

[0008] Acquire a user-level policy, where the user-level policy includes policy control information and terminal information, where the terminal information carries an international mobile subscriber identity code IMSI and / or a mobile subscriber number MSISDN of the user terminal;

[0009] When a user terminal corresponding to the terminal information conducts a protocol data unit PDU session, the PDU session is controlled based on the policy control information.

[0010] In one implementation, the method is applied to a base station, and acquiring the user-level policy includes: acquiring the user-level policy based on a base station console or a northbound API interface.

[0011] In one implementation, before obtaining the user-level policy, the method further includes:

[0012] Pre-acquire the international mobile subscriber identity code IMSI and / or mobile subscriber number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session;

[0013] Establishing a mapping relationship between the international mobile subscriber identity code IMSI and / or the mobile subscriber number MSISDN and the terminal IP address;

[0014] The controlling the PDU session based on the policy control information includes:

[0015] The terminal IP address corresponding to the terminal information is acquired based on the mapping relationship, and PDU session control is performed for the terminal IP address.

[0016] In one embodiment, the pre-acquiring the international mobile user identity code IMSI and / or the mobile user number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session, includes:

[0017] In response to the registration message of the fifth generation mobile communication technology 5G private network, the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session and the terminal IP address assigned to the current PDU session are pre-acquired based on the next generation application protocol NGAP.

[0018] In one embodiment, after establishing the mapping relationship, it also includes: responding to the re-registration message of the 5G private network, re-obtaining the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session based on the next generation application protocol NGAP, and the terminal IP address assigned to the current PDU session, and updating the mapping relationship.

[0019] In one implementation, after controlling the PDU session based on the policy control information, the method further includes: deleting the mapping relationship in response to a PDU session end message.

[0020] In one implementation, the user-level policy includes a traffic interception policy, and controlling the PDU session based on the policy control information includes:

[0021] Based on the traffic interception strategy, the corresponding traffic in the PDU session is intercepted, and the unintercepted traffic is forwarded to the user plane function UPF network element.

[0022] According to another aspect of the present application, a single-user-level policy control device is provided, including:

[0023] A policy acquisition module, which is configured to acquire a user-level policy, wherein the user-level policy includes policy control information and terminal information, wherein the terminal information carries an international mobile subscriber identity code IMSI and / or a mobile subscriber number MSISDN of the user terminal;

[0024] A policy control module is configured to control the protocol data unit PDU session based on the policy control information when the user terminal corresponding to the terminal information conducts the PDU session.

[0025] According to another aspect of the present application, a base station is provided, comprising: a memory and a processor;

[0026] The memory stores computer-executable instructions;

[0027] The processor executes the computer-executable instructions stored in the memory, so that the base station executes the single-user-level policy control method.

[0028] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the single-user-level policy control method.

[0029] It can be understood that the single-user-level policy control method, device, base station and medium provided by the present application obtain a user-level policy, wherein the user-level policy includes policy control information and terminal information, wherein the terminal information carries the international mobile user identity code IMSI and / or mobile user number MSISDN of the user terminal, and when the user terminal corresponding to the terminal information performs a protocol data unit PDU session, the PDU session is controlled based on the policy control information. Through the above method, the present application can obtain the user-level policy on the base station side, and perform policy control when the terminal performs a PDU session, without going through multiple core network elements, which can effectively reduce the complexity and delay of the single-user policy implementation, while reducing the load of the 5G core network and improving the policy control efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0031] Figure 1A schematic diagram of a scenario for performing policy control in related technologies;

[0032] Figure 2 A possible scenario diagram provided for an embodiment of the present application;

[0033] Figure 3 A flowchart of a single-user level policy control method provided in an embodiment of the present application;

[0034] Figure 4 A flowchart of another single-user level policy control method provided in an embodiment of the present application;

[0035] Figure 5 One of the structural schematic diagrams of a single-user-level policy control device provided in an embodiment of the present application;

[0036] Figure 6 A second structural diagram of a single-user-level policy control device provided in an embodiment of the present application;

[0037] Figure 7 A schematic diagram of the structure of a base station provided in an embodiment of the present application.

[0038] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0039] The development of mobile communication technology has led to the emergence and continued prosperity of related industries. Global mobile communications are undergoing an iteration from the fourth generation of mobile communication technology (Fourth Generation Communications System, referred to as 4G) to 5G. Compared with 4G and previous enterprise private networks, 5G private networks support a wealth of enterprise customized network industry attributes, including high bandwidth, low latency, massive access, exclusive network resources, security, etc.

[0040] At the same time, enterprise customers have also put forward higher requirements for the terminal user access security management of 5G private networks. Enterprise customers hope to be able to independently control and implement policy control at the single-user level of the private network, such as intercepting traffic for a certain user terminal in the private network, diverting and forwarding traffic, or other policy rules, so as to achieve more flexible and autonomous control and management of the private network.

[0041] Combination Figure 1 As shown, Figure 1This is a flow chart of the policy control scheme for 5G private networks in related technologies. First, the enterprise server sends a request to the NEF network element of the 5G core network, and the NEF network element calls the PCF to write the terminal access control rules. The PCF pushes the control rules to the SMF, and the SMF sends the control rules to the UPF. Finally, the UPF executes the terminal access control rules and actions. It can be seen that the current 5G private network single-user level policy control method involves many core network elements, the process is too complicated and the latency is high, which increases the load on the 5G core network; in addition, since the existing networks of various operators cannot provide policy API interfaces for enterprise customers to use, the current policy release is not enough to meet the needs of enterprise customers to flexibly configure and control the private network single-user policies conveniently and efficiently.

[0042] In view of this, an embodiment of the present application provides a single-user-level policy control method, device, base station and medium, by obtaining a user-level policy, the user-level policy including policy control information and terminal information, the terminal information carries the international mobile subscriber identity (International Mobile Subscriber Identity, IMSI) or mobile subscriber number (Mobile Subscriber Integrated Services Digital Number, MSISDN) of the user terminal, and when a protocol data unit (Protocol Data Unit, PDU) session is conducted at the user terminal corresponding to the terminal information, the PDU session is controlled based on the policy control information to achieve flexible and autonomous control of policy rules for a single user of a private network, reduce the complexity and delay of single-user policy implementation, and at the same time reduce the load on the 5G core network and improve policy control efficiency.

[0043] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described in more detail below in conjunction with the drawings in the embodiments of the present application. In the drawings, the same or similar reference numerals throughout represent the same or similar parts or parts with the same or similar functions. The described embodiments are part of the embodiments of the present application, not all of the embodiments. The embodiments described below with reference to the drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limitations on the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0044] Figure 2 A possible scenario diagram provided for an embodiment of the present application is as follows: Figure 2As shown, it includes a network device 210 and a first terminal device 220 and a second terminal device 230. The network device 210 and the first terminal device 220 and the second terminal device 230 are electrically connected. In this embodiment, the first terminal device 220 generates a user-level policy and submits the user-level policy to the network device 210. The second terminal device 230 is a user terminal for network registration and PDU session. Optionally, the user-level policy can be traffic interception, traffic diversion and forwarding, or other policy rules. The network device 210 is used to obtain policy rule data and perform single-user-level policy control on the second terminal device 230 according to the policy rule when the corresponding second terminal device 230 conducts a PDU session.

[0045] Among them, the network device 210 can be a base station, which can include multiple cells. Depending on the specific application scenario, the base station can also be called an access point, or it can refer to a device in the access network that communicates with the wireless terminal device through one or more sectors on the air interface, or other names. The network device can be used to convert received air frames to Internet Protocol (IP) packets and act as a router between the wireless terminal device and the rest of the access network, where the rest of the access network may include an Internet Protocol (IP) communication network. The network device can also coordinate the attribute management of the air interface. For example, the network device involved in the embodiments of the present application may be a network device (base transceiver station, BTS) in a global system for mobile communications (GSM) or code division multiple access (CDMA), or a network device (NodeB) in wide-band code division multiple access (WCDMA), or an evolved network device (evolutional node B, eNB or e-NodeB) in a long term evolution (LTE) system, a 5G base station in a 5G network architecture (next generation system), or a home evolved node B (HeNB), a relay node, a home base station (femto), a pico base station (pico), etc. The embodiments of the present application take the network device 210 as a base station as an example.

[0046] The first terminal device 220 can be an enterprise client or an enterprise server, and the second terminal device 230 can be a user terminal. Both can include but are not limited to computers, smart phones, tablet computers, e-book readers, Moving Picture experts group audio layer III (MP3) players, Moving Picture experts group audio layer IV (MP4) players, portable computers, car computers, wearable devices, desktop computers, set-top boxes, smart TVs, etc. The embodiments of the present application do not limit the specific form of the terminal device.

[0047] Optionally, the number of the above-mentioned network devices 210 or the first terminal devices 220 or the second terminal devices 230 may be more or less, which is not limited in the embodiment of the present application.

[0048] The above is a brief description of the scenario diagram of this application. Figure 1 The network device 210 in FIG. 1 is taken as an example to describe in detail the single-user level policy control method provided in an embodiment of the present application.

[0049] Please refer to Figure 3 , Figure 3 A flowchart of a single-user-level policy control method provided in an embodiment of the present application includes step S301 and step S302.

[0050] Step S301: Acquire a user-level policy, wherein the user-level policy includes policy control information and terminal information, wherein the terminal information carries the international mobile subscriber identity IMSI and / or mobile subscriber number MSISDN of the user terminal.

[0051] In this embodiment, one or more user-level policies may be obtained at the same time. When multiple user-level policies are obtained, policy control is performed on the user terminal based on the multiple user-level policies respectively.

[0052] It can be understood that the policy control information can be a traffic control policy, such as a traffic interception policy, a traffic diversion and forwarding policy, or other policy rules; by carrying the IMSI and / or MSISDN of the user terminal, the user terminal identity is identified when the user terminal conducts a PDU session.

[0053] Further, in order to meet the flexible control requirements of the user-level policies of enterprise customers, this embodiment obtains the single-user-level policy through the console or northbound API interface of the base station, and the enterprise user can flexibly use the console or northbound API interface to transmit the single-user-level policy according to the situation. Specifically, the method is applied to the base station, and step S301 of obtaining the user-level policy includes the following steps: obtaining the user-level policy based on the base station console or northbound API interface.

[0054] In this embodiment, the basic configuration of the base station is utilized to enable users to flexibly transmit corresponding policy data, and the base station performs single-user level policy control based on the policy data, which can effectively meet the needs of enterprise customers for flexible configuration and control of private network single-user level policies in a convenient and efficient manner.

[0055] In one possible implementation, the base station may obtain single-user level policies transmitted by enterprise users from the console or northbound API interface at irregular intervals, for example, by setting a policy transmission cycle and obtaining user level policies based on the policy transmission cycle; in other possible implementations, the base station may also obtain single-user level policies transmitted by enterprise users from the console or northbound API interface in real time to meet user policy control requirements, which is not particularly limited in this embodiment.

[0056] In one possible implementation, the user-level policy is obtained before establishing a PDU session to facilitate full-process policy control of the PDU session; in other possible implementations, the user-level policy can also be obtained after the PDU session is established, and only the control of the PDU session after the user-level policy is obtained is implemented.

[0057] Step S302: When a user terminal corresponding to the terminal information conducts a protocol data unit (PDU) session, the PDU session is controlled based on the policy control information.

[0058] Compared with the related technology, policy control needs to be implemented through multiple core network elements, the process is too complicated and the latency is high, which increases the load on the 5G core network and reduces the efficiency of policy control. This embodiment uses a base station device to obtain single-user level rules transmitted by enterprise users, and performs policy control according to the corresponding policy control information when the corresponding terminal conducts a PDU session. It does not need to go through multiple core network elements, reduces the load on the 5G core network, and improves the efficiency of policy control.

[0059] In one implementation, in order to efficiently implement the traffic interception function, the user-level policy in this embodiment may be a traffic interception policy, and step S302 controls the PDU session based on the policy control information, specifically the following steps:

[0060] Based on the traffic interception strategy, the corresponding traffic in the PDU session is intercepted, and the unintercepted traffic is forwarded to the user plane function UPF network element.

[0061] Among them, the traffic interception strategy carries the corresponding characteristics of the traffic to be intercepted. For example, the characteristics of the traffic to be intercepted may be information such as the type of traffic to be intercepted, and the corresponding traffic is intercepted according to the traffic interception strategy, and the traffic that does not belong to the characteristics of the traffic to be intercepted is forwarded normally, that is, the non-intercepted traffic is forwarded to the user plane function (User Plane Function, referred to as UPF) network element.

[0062] Please refer to Figure 4 , Figure 4 A flow chart of another single-user-level policy control method provided for an embodiment of the present application. On the basis of the above embodiment, considering that some policy control functions need to be implemented using the IP address of the terminal, for example, traffic policy control needs to be controlled through the IP address of the terminal, in order to further improve the policy control efficiency of the terminal, in addition to the above-mentioned steps S301 and S302, this embodiment also includes steps S401-S402 before step S301 obtains the user-level policy, and step S302 is further divided into step S302a.

[0063] Step S401: pre-acquire the international mobile subscriber identity IMSI and / or mobile subscriber number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session.

[0064] In this embodiment, each time a PDU session is established, the corresponding IMSI and / or MSISDN, as well as the terminal IP address allocated by the current PDU session are obtained. It can be understood that each time a PDU session is established, a terminal IP address is allocated to the user.

[0065] In a more specific implementation, corresponding information such as IMSI and / or MSISDN is obtained based on the NGAP protocol to improve data security. Specifically, step S401 may include the following steps: in response to a registration message of a fifth-generation mobile communication technology 5G private network, pre-acquire the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session and the terminal IP address assigned to the current PDU session based on the next-generation application protocol NGAP.

[0066] It can be understood that the application layer protocol - Next Generation Application Protocol (NGGAP) is an application layer protocol for communication between the access and mobility management function (AMF) in the NG radio access network / 5G radio access network (NG Radio Access Network, NG-RAN) and the 5G core network (5G Core, 5GC).

[0067] It can be understood that in response to the conditions or states on which the executed operations depend, when the dependent conditions or states are met, one or more operations executed can be in real time or have a set delay; unless otherwise specified, there is no restriction on the order of execution of the multiple operations executed.

[0068] Step S402: Establish a mapping relationship between the International Mobile Subscriber Identity IMSI and / or the Mobile Subscriber Number MSISDN and the terminal IP address.

[0069] In this embodiment, the base station records the above-mentioned IMSI, MSISDN and terminal IP address, and establishes a mapping relationship between the three, so that when performing policy control, the base station can quickly determine the terminal IP address corresponding to the IMSI / MSISDN according to the mapping relationship.

[0070] In one embodiment, after the mapping relationship is established in step S402, it also includes: responding to the re-registration message of the 5G private network, re-obtaining the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session based on the next generation application protocol NGAP, and the terminal IP address assigned to the current PDU session, and updating the mapping relationship.

[0071] Step S302a: acquiring a terminal IP address corresponding to the terminal information based on the mapping relationship, and performing PDU session control for the terminal IP address.

[0072] Exemplarily, the user-level policy may be a traffic interception policy, which controls the corresponding traffic of the terminal IP address.

[0073] Specifically, each time a user registers to join the network, the mapping relationship must be performed and updated in a timely manner. Enterprise users can issue policy rules directly to a user's IMSI or MSISDN through the base station console or northbound API interface, such as intercepting traffic for IMSI_1; after receiving this rule, the policy rule management module of the base station device analyzes it and establishes a rule for intercepting IMSI_1, the user's currently obtained terminal IP_1, and all traffic; then, the base station monitors all traffic flowing through the base station according to this rule, and when traffic matching this policy rule is found, it is intercepted, and traffic that does not match this rule is forwarded normally to the UPF.

[0074] In one embodiment, the corresponding mapping relationship is deleted to facilitate the next policy control and reduce the cache. Specifically, after controlling the PDU session based on the policy control information, the following steps may also be included: deleting the mapping relationship in response to the PDU session end message.

[0075] Please refer to Figure 5 , Figure 5 The schematic diagram of the structure of a single-user-level policy control device provided in an embodiment of the present application includes a policy acquisition module 51 and a policy control module 52, wherein:

[0076] A policy acquisition module 51 is configured to acquire a user-level policy, wherein the user-level policy includes policy control information and terminal information, wherein the terminal information carries an international mobile subscriber identity code IMSI and / or a mobile subscriber number MSISDN of a user terminal;

[0077] The policy control module 52 is configured to control the protocol data unit PDU session based on the policy control information when the user terminal corresponding to the terminal information conducts the PDU session.

[0078] In one implementation, the method is applied to a base station, and the policy acquisition module is specifically configured to acquire user-level policies based on a base station console or a northbound API interface.

[0079] In one embodiment, the device further comprises:

[0080] An information pre-acquisition module, which is configured to pre-acquire the international mobile subscriber identity code IMSI and / or mobile subscriber number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session;

[0081] A mapping establishment module, which is configured to establish a mapping relationship between the international mobile subscriber identity code IMSI and / or the mobile subscriber number MSISDN and the terminal IP address;

[0082] The policy control module is specifically configured to obtain a terminal IP address corresponding to the terminal information based on the mapping relationship, and perform PDU session control on the terminal IP address.

[0083] In one embodiment, the information pre-acquisition module is specifically configured to respond to a registration message of a fifth-generation mobile communication technology 5G private network, and pre-acquire the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session based on the next-generation application protocol NGAP, as well as the terminal IP address assigned to the current PDU session.

[0084] In one embodiment, the device also includes: a mapping update module, which is configured to respond to a re-registration message of the 5G private network, re-acquire the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session based on the next generation application protocol NGAP, and the terminal IP address assigned to the current PDU session, and update the mapping relationship.

[0085] In one implementation, the device further includes: a mapping deletion module, which is configured to delete the mapping relationship in response to a PDU session end message.

[0086] In one embodiment, the user-level policy includes a traffic interception policy, and the policy control module is specifically configured to intercept the corresponding traffic in the PDU session based on the traffic interception policy, and forward the unintercepted traffic to the user plane function UPF network element.

[0087] In an exemplary embodiment of the present application, Figure 6 As shown, the device includes a processing module, which is used to execute application code to implement the single-user level policy control method in the present application. The processing module can be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0088] As shown in the figure, the method device may also include a storage module. The storage module is used to store the application code for executing the scheme of the present application, and the execution is controlled by the processing module. The storage module can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0089] At the same time, a policy management module (corresponding to the policy acquisition module 51) and a policy control module are provided to manage and execute the single-user level policy rules of the UPF; a PDU session analysis module (corresponding to the information pre-acquisition module, mapping establishment module, etc.) is provided to perform extraction and analysis functions of user IMSI, MSISDN and terminal IP.

[0090] Furthermore, the device also includes an API interface, and users receive API requests from the console interface and the enterprise's own platform, so that enterprise users can add, delete, modify, and query single-user level policy rules.

[0091] It should be noted here that the above-mentioned device provided in the present application can correspondingly implement all the method steps implemented by the network device in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be specifically described here.

[0092] In addition, the device structure shown in the figure does not constitute a limitation on the device. In addition to the components shown in the figure, the device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0093] Please refer to Figure 7 , Figure 7 A base station provided in an embodiment of the present application includes: a memory 71, a processor 72, and a communication interface 73, and the processor 71, the memory 72, and the communication interface 73 may be coupled to each other via a bus;

[0094] The memory 71 stores computer-executable instructions;

[0095] The processor 72 executes the computer-executable instructions stored in the memory 71, so that the base station executes the single-user-level policy control method;

[0096] The communication interface 73 is used to exchange information with other devices, for example, to support information exchange between the base station and other devices, such as obtaining data from other devices or sending data to other devices.

[0097] It should be noted here that the above-mentioned base station provided in the present application can correspondingly implement all the method steps implemented by the network device in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0098] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the single-user level policy control method.

[0099] It should be noted here that the above-mentioned computer-readable storage medium provided in the present application can correspondingly implement all the method steps implemented by the network device in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be specifically described here.

[0100] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0101] As is well known to those skilled in the art, the term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. In addition, as is well known to those skilled in the art, communication media typically contains computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0102] In the description of the embodiments of the present application, the term "and / or" merely represents an association relationship that describes associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" represents any combination of at least two of any one or more of a plurality of. For example, at least one of A, B, may represent any one or more elements selected from a set that communicates A, B, and C. In addition, the term "plurality" means two or more, unless otherwise precisely and specifically specified.

[0103] In the description of the embodiment of the present application, the terms "first", "second", "third", "fourth", etc. (if present) are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A single-user level policy control method, characterized in that: Applied to a base station, the method includes: Pre-acquire the international mobile subscriber identity code IMSI and / or mobile subscriber number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session; Establishing a mapping relationship between the international mobile subscriber identity code IMSI and / or the mobile subscriber number MSISDN and the terminal IP address; Obtaining a user-level policy based on a base station console or a northbound API interface, wherein the user-level policy includes policy control information and terminal information, wherein the terminal information carries an international mobile subscriber identity code IMSI and / or a mobile subscriber number MSISDN of the user terminal, and the policy control information includes a traffic interception policy; When the user terminal corresponding to the terminal information conducts a protocol data unit PDU session, the terminal IP address corresponding to the terminal information is obtained based on the mapping relationship; the traffic corresponding to the terminal IP address is intercepted based on the traffic interception strategy, and the unintercepted traffic is forwarded to the user plane function UPF network element.

2. The method according to claim 1, characterized in that The pre-acquisition of the international mobile subscriber identity code IMSI and / or the mobile subscriber number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session, includes: In response to the registration message of the fifth generation mobile communication technology 5G private network, the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session and the terminal IP address assigned to the current PDU session are pre-acquired based on the next generation application protocol NGAP.

3. The method according to claim 2, characterized in that After establishing the mapping relationship, it also includes: responding to the re-registration message of the 5G private network, re-obtaining the international mobile user identity code IMSI and / or mobile user number MSISDN corresponding to the current PDU session based on the next generation application protocol NGAP, and the terminal IP address assigned to the current PDU session, and updating the mapping relationship.

4. The method according to claim 1, characterized in that: After controlling the PDU session based on the policy control information, the method further includes: deleting the mapping relationship in response to a PDU session end message.

5. A single-user level policy control device, characterized in that: Applied to base stations, including: A pre-acquisition module, used to pre-acquire the international mobile subscriber identity IMSI and / or mobile subscriber number MSISDN corresponding to the current PDU session, and the terminal IP address allocated to the current PDU session; A relationship mapping module, used to establish a mapping relationship between the international mobile subscriber identity code IMSI and / or the mobile subscriber number MSISDN and the terminal IP address; A policy acquisition module, which is configured to acquire user-level policies based on a base station console or a northbound API interface, wherein the user-level policies include policy control information and terminal information, wherein the terminal information carries an international mobile subscriber identity code IMSI and / or a mobile subscriber number MSISDN of the user terminal, and the policy control information includes a traffic interception policy; A policy control module is configured to obtain a terminal IP address corresponding to the terminal information based on the mapping relationship when the user terminal corresponding to the terminal information conducts a protocol data unit PDU session; intercept the traffic corresponding to the terminal IP address based on the traffic interception strategy, and forward the unintercepted traffic to the user plane function UPF network element.

6. A base station, characterized in that: include: Memory and processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the base station executes the single-user-level policy control method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the single-user-level policy control method according to any one of claims 1 to 4.

Images