Enterprise-level MEC authentication system hierarchical deployment method and device

Abstract

The application discloses an enterprise-level MEC authentication system hierarchical deployment method and device, wherein the method comprises the following steps: deploying a first-level system at an operator to provide SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding function; deploying a second-level system at an enterprise to provide APN configuration, user account configuration, client configuration and authentication service function; the two-level systems work in cooperation and interact through the Radius message forwarding function. The method and device realize two-level control, the first-level system realizes operator network access equipment management and security policy, and the second-level system realizes enterprise internal control, effectively solving the complexity and security problems of operator and enterprise user configuration.

Description

Technical Field

[0001] This invention relates to the field of MEC applications, and in particular to a hierarchical deployment method and apparatus for an enterprise-level MEC authentication system. Background Technology

[0002] Operators are vigorously expanding MEC (Mobile Edge Computing) applications to support enterprise digital transformation. In MEC applications, when a 5G user's mobile terminal accesses the network, it first undergoes initial authentication with the operator to obtain network access permission; then, it undergoes secondary authentication with the enterprise authentication system. Currently, the mainstream implementation involves the enterprise authentication system directly connecting to the operator's NAS (Network Access Device), using the Radius (a remote access authentication protocol) to achieve network access authentication. However, with the development of 5G services, when the SMF (Session Management Function, a type of NAS device) device changes, configuration modifications are required on each enterprise authentication system, resulting in a significant workload for operators and enterprises, as well as accompanying security issues. Summary of the Invention

[0003] To address the complexity and security issues associated with configuration for both telecom operators and enterprise users, this invention provides a hierarchical deployment method and apparatus for an enterprise-level MEC authentication system. By deploying a first-level system at the operator level, ensuring proper basic configuration and security protection, the burden on enterprises is reduced, allowing them to focus on managing their internal accounts.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In one embodiment of the present invention, a hierarchical deployment method for an enterprise-level MEC authentication system is proposed, the method comprising:

[0006] Deploy a Tier 1 system in the carrier, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and RADIUS packet forwarding functionality;

[0007] Deploy a secondary system in the enterprise to provide APN configuration, user account configuration, client configuration and authentication service functions;

[0008] The two-level system collaborates and interacts through the Radius message forwarding function.

[0009] Furthermore, the enterprise-level authentication system configuration function is for the system to forward Radius authentication messages to the enterprise based on the APN identifier.

[0010] Furthermore, the signaling firewall configuration function allows setting the maximum concurrency limit for a single enterprise and an account blacklist. The matching conditions for the account blacklist support regular expression matching rules for usernames / passwords, user numbers, and device identifiers.

[0011] Furthermore, the Radius message forwarding function receives authentication requests sent by the SMF and forwards them to the corresponding enterprise's authentication server based on the APN identifier.

[0012] Furthermore, the authentication service function receives authentication request messages forwarded from the primary system, performs internal enterprise authentication, and returns the authentication result to the primary system.

[0013] In one embodiment of the present invention, a hierarchical deployment device for an enterprise-level MEC authentication system is also proposed, the device comprising:

[0014] The first-level system function module is used to deploy the first-level system in the operator, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and Radius packet forwarding functions;

[0015] The secondary system functional module is used to deploy secondary systems in enterprises, providing APN configuration, user account configuration, client configuration and authentication service functions;

[0016] The forwarding module is used for collaboration between the two-level systems, and interacts through the Radius message forwarding function.

[0017] Furthermore, the enterprise-level authentication system configuration function is for the system to forward Radius authentication messages to the enterprise based on the APN identifier.

[0018] Furthermore, the signaling firewall configuration function allows setting the maximum concurrency limit for a single enterprise and an account blacklist. The matching conditions for the account blacklist support regular expression matching rules for usernames / passwords, user numbers, and device identifiers.

[0019] Furthermore, the Radius message forwarding function receives authentication requests sent by the SMF and forwards them to the corresponding enterprise's authentication server based on the APN identifier.

[0020] Furthermore, the authentication service function receives authentication request messages forwarded from the primary system, performs internal enterprise authentication, and returns the authentication result to the primary system.

[0021] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned hierarchical deployment method for the enterprise-level MEC certification system.

[0022] In one embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that executes a hierarchical deployment method for an enterprise-level MEC authentication system.

[0023] Beneficial effects:

[0024] 1. This invention designs a hierarchical deployment scheme for an enterprise-level MEC authentication system, which has been effectively applied in 5G IoT services.

[0025] 2. This invention, through a two-tier deployment approach, utilizes the Radius forwarding protocol and signaling firewall technologies to achieve collaboration between operators and enterprises, providing a secure and efficient enterprise-level authentication service. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the hierarchical deployment method of the enterprise-level MEC certification system of the present invention;

[0027] Figure 2 This is a schematic diagram of an SMF configuration page according to an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of the configuration page of an enterprise authentication system according to an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of a signaling firewall configuration page according to an embodiment of the present invention;

[0030] Figure 5 This is a schematic diagram of the APN configuration page according to an embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of a user account configuration page according to an embodiment of the present invention;

[0032] Figure 7 This is a schematic diagram of a client configuration page according to an embodiment of the present invention;

[0033] Figure 8 This is a schematic diagram of the hierarchical deployment device of the enterprise-level MEC certification system of the present invention;

[0034] Figure 9 This is a schematic diagram of the computer device structure of the present invention. Detailed Implementation

[0035] The principles and spirit of the present invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0036] Those skilled in the art will recognize that embodiments of the present invention can be implemented as a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0037] According to an embodiment of the present invention, a hierarchical deployment method and apparatus for an enterprise-level MEC authentication system is proposed, which realizes two-level control. The first-level system realizes the management and security policies of operator network access devices, and the second-level system realizes the internal control of the enterprise, effectively solving the problems of complexity and security in the configuration of operators and enterprise users.

[0038] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.

[0039] Figure 1 This is a schematic diagram of the hierarchical deployment method for the enterprise-level MEC certification system of this invention. (See diagram below.) Figure 1 As shown, this method is implemented in two levels, including:

[0040] S1. Deploy a first-level system in the operator's network, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and Radius packet forwarding functions;

[0041] S2. Deploy a secondary system in the enterprise to provide APN (Access Point Name) configuration, user account configuration, client configuration and authentication service functions;

[0042] S3, a two-tier system, works collaboratively and interacts through the Radius message forwarding function to jointly safeguard the enterprise's MEC business and achieve a secure and efficient business experience.

[0043] It should be noted that although the operation of the method of the present invention has been described in a specific order in the above embodiments and figures, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0044] To provide a clearer explanation of the above-mentioned hierarchical deployment method for the enterprise-level MEC certification system, a specific embodiment will be used for illustration below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation of the present invention.

[0045] This solution was applied in China Unicom's MEC project, significantly improving the usability of the enterprise-level authentication system, reducing network security risks, and greatly promoting the development of MEC services. China Unicom's MEC serves multiple enterprise customers, including Sany Heavy Industry and Midea. Each customer deployed an authentication server. Initially, these servers directly connected to the core network SMF equipment, resulting in a significant network configuration workload and substantial security vulnerabilities. Later, a carrier-level system was established for authentication forwarding, configuring the core network SMF equipment IP and keys. Enterprise secondary systems only needed to configure the carrier-level system's IP and keys. This eliminated the need for frequent configuration of the core network SMF equipment and firewalls; furthermore, security protection could be effectively implemented at the national authentication centers, preventing adverse impacts on the core network.

[0046] The specific implementation method is as follows:

[0047] 1. Introduction to the functions of the operator's primary system

[0048] (1) SMF configuration function, such as Figure 2 As shown, the information used to configure SMF devices is displayed. The system only accepts authentication requests initiated by the devices that have been entered.

[0049] Note: Fields marked with "*" are required; others are optional. Enter the key in ciphertext for encrypted transmission.

[0050] (2) Enterprise authentication system configuration functions, such as Figure 3 As shown, the system forwards Radius authentication messages to enterprises based on the APN identifier.

[0051] Note: Fields marked with "*" are required; others are optional. Enter the key in ciphertext for encrypted transmission. The primary and backup servers use the same key.

[0052] (3) Signaling firewall configuration functions, such as Figure 4 As shown, this feature is used to defend against attacks. It allows you to set a maximum concurrency limit for a single enterprise and an account blacklist. The matching criteria for the account blacklist support regular expression matching rules for usernames / passwords, user numbers, and device identifiers.

[0053] Note: Fields marked with "*" are required; others are optional. The "User Attributes" dropdown options in "Matching Criteria" include: Username / Password, User Number, and Device Identifier.

[0054] (4) Radius message forwarding function: receive authentication requests sent by SMF and forward them to the corresponding enterprise's authentication server according to the APN identifier.

[0055] 2. Enterprise Level 2 System

[0056] (1) APN configuration function, such as Figure 5 As shown, users maintain the company's APN information.

[0057] Note: Fields marked with "*" are required; others are optional. The "Authentication Method" dropdown menu includes: Username / Password, User Number, and Device Identifier.

[0058] (2) User account configuration function, such as Figure 6 As shown, this is used for maintaining enterprise 5G account information.

[0059] Note: The search term "APN" is selected from the dropdown menu, and intelligent suggestions are provided. Fields marked with "*" are required; others are optional. Based on the authentication method corresponding to the selected APN, the required fields are listed first:

[0060] When the authentication method is "username / password", username / password is required.

[0061] When the authentication method is "user number", the user number is required.

[0062] When the authentication method is "Device Identifier", the Device Identifier is required.

[0063] (3) Client configuration functions, such as Figure 7 As shown, this is used to set up information maintenance for the operator's primary system.

[0064] Note: Fields marked with "*" are required; others are optional. Enter the key in ciphertext for encrypted transmission.

[0065] (4) Authentication service function: receive authentication request messages forwarded by the operator's primary system, perform internal enterprise authentication, and return the authentication result to the operator's primary system.

[0066] Based on the same inventive concept, this invention also proposes a hierarchical deployment device for an enterprise-level MEC authentication system. The implementation of this device can refer to the implementation of the method described above, and repeated details will not be repeated. The term "module" used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0067] Figure 8 This is a schematic diagram of the hierarchical deployment device structure of the enterprise-level MEC certification system of the present invention. (See diagram below.) Figure 8 As shown, the device includes:

[0068] Level 1 system function module 101 is used to deploy the Level 1 system in the operator, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and Radius packet forwarding functions;

[0069] The enterprise-level authentication system configuration function is for the system to forward Radius authentication messages to the enterprise based on the APN identifier;

[0070] The signaling firewall configuration function allows setting the maximum concurrency limit for a single enterprise and an account blacklist. The matching conditions for the account blacklist support regular expression matching rules for usernames / passwords, user numbers, and device identifiers.

[0071] The Radius message forwarding function receives authentication requests sent by SMF and forwards them to the corresponding enterprise's authentication server based on the APN identifier.

[0072] The secondary system functional module 102 is used to deploy secondary systems in enterprises, providing APN configuration, user account configuration, client configuration and authentication service functions;

[0073] The authentication service function receives authentication request messages forwarded from the primary system, performs internal enterprise authentication, and returns the authentication result to the primary system.

[0074] The forwarding module 103 is used for the division of labor and cooperation between the two-level systems, and interacts through the Radius message forwarding function.

[0075] It should be noted that although several modules of the enterprise-level MEC certification system tiered deployment device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.

[0076] Based on the aforementioned inventive concept, such as Figure 8 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, it implements the aforementioned hierarchical deployment method of the enterprise-level MEC certification system.

[0077] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium storing a computer program that executes the aforementioned hierarchical deployment method for the enterprise-level MEC authentication system.

[0078] In MEC (Mobile Edge Computing) application scenarios of telecom operators, in addition to the operator's network access authentication, an enterprise-level authentication system provides secondary authentication, offering enterprises more flexible access control. The hierarchical deployment method and apparatus for an enterprise-level MEC authentication system proposed in this invention has been effectively applied in 5G IoT services. Through a two-level deployment approach, based on the Radius forwarding protocol and employing technologies such as signaling firewalls, it achieves division of labor and collaboration between operators and enterprises, providing a secure and efficient enterprise-level authentication service.

[0079] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0080] Regarding the limitation of the scope of protection of this invention, those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solution of this invention are still within the scope of protection of this invention.

Claims

1. An enterprise-level MEC authentication system hierarchical deployment method, characterized in that, The method comprises: The first-level system is deployed by the operator to provide SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and Radius message forwarding function; the SMF configuration function is used to configure information of the SMF device, and the first-level system of the operator only receives the Radius authentication request initiated by the access device; the enterprise-level authentication system configuration function is used to forward the Radius authentication request to the enterprise according to the APN identifier; the Radius message forwarding function is used to receive the Radius authentication request sent by the SMF and forward the Radius authentication request to the authentication server of the corresponding enterprise according to the APN identifier; The second-level system is deployed by the enterprise to provide APN configuration, user account configuration, client configuration, and authentication service function; the authentication service function is used to receive the Radius authentication request forwarded by the first-level system of the operator, perform internal authentication of the enterprise, and return the authentication result to the first-level system of the operator; The two-level systems work in cooperation and interact through the Radius message forwarding function. 2.The enterprise-level MEC authentication system hierarchical deployment method of claim 1, wherein, The signaling firewall configuration function is used to set the maximum concurrent limit of a single enterprise and the account blacklist, and the matching condition of the account blacklist supports regular expression matching rules for the username / password, user number, and device identifier.

3. An enterprise-level MEC authentication system hierarchical deployment device, characterized in that, The device comprises: The first-level system function module is used to deploy the first-level system by the operator to provide SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and Radius message forwarding function; the SMF configuration function is used to configure information of the SMF device, and the first-level system of the operator only receives the Radius authentication request initiated by the access device; the enterprise-level authentication system configuration function is used to forward the Radius authentication request to the enterprise according to the APN identifier; the Radius message forwarding function is used to receive the Radius authentication request sent by the SMF and forward the Radius authentication request to the authentication server of the corresponding enterprise according to the APN identifier; The second-level system function module is used to deploy the second-level system by the enterprise to provide APN configuration, user account configuration, client configuration, and authentication service function; the authentication service function is used to receive the Radius authentication request forwarded by the first-level system of the operator, perform internal authentication of the enterprise, and return the authentication result to the first-level system of the operator; The forwarding function module is used to work in cooperation between the two-level systems and interact through the Radius message forwarding function. 4.The enterprise-level MEC authentication system hierarchical deployment apparatus of claim 3, wherein, The signaling firewall configuration function is used to set the maximum concurrent limit of a single enterprise and the account blacklist, and the matching condition of the account blacklist supports regular expression matching rules for the username / password, user number, and device identifier.

5. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method in any one of claims 1-2.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores the computer program for executing the method in any one of claims 1-2.

Images