Network isolation access method and communication network system, device, storage medium

Abstract

The present disclosure provides a network isolation access method, a communication network system, a device and a storage medium, and relates to the technical field of communication. The network isolation access method comprises the following steps: an SMF acquires a first interface address from a second UPF through a signaling interworking gateway, then acquires a second interface address from a user plane gateway and the first UPF, and determines a third interface address and a fourth interface address from the first interface address and the second interface address, and then forwards the third interface address to the second UPF through the signaling interworking gateway, and forwards the fourth interface address to the user plane gateway and the first UPF; and a user plane tunnel is created between the second UPF and the first UPF based on the user plane gateway, the third interface address and the fourth interface address. The technical scheme in the present disclosure can realize the control plane isolation between networks through the signaling interworking gateway, realize the user plane isolation between networks through the user plane gateway, and improve the security of simultaneously accessing a private network and a public network.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and more specifically, to a network isolation access method, a communication network system, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the rapid development of internet technology, fifth-generation mobile communication technology (5G) is being used more and more widely. Among them, a 5G private network is a local area network (LAN) that uses 5G technology to create a dedicated network with unified connectivity, optimized services, and secure communication within a specific area.

[0003] Due to the rapid development of 5G private network services, the need for interoperability between private networks and operators' public networks is becoming increasingly urgent. Currently, in relevant technical solutions, there are no effective isolation access measures between networks, resulting in poor network security during interoperability.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide a network isolation access method, a communication network system, an electronic device, and a computer-readable storage medium, thereby improving network security at least to some extent when private networks and public networks communicate with each other.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to a first aspect of the present disclosure, a network isolation access method is provided. This method can be applied to a communication network system capable of simultaneously accessing a public network and a private network. The communication network system at least includes a Session Management Function (SMF), a First User Plane Function (UPF), and a base station (gNB) corresponding to the public network; a Second User Plane Function (UPF) corresponding to the private network; a signaling interconnection gateway deployed between the SMF and the UPF; and a user plane gateway deployed between the UPF and the UPF. The method includes:

[0008] The Session Management Function (SMF) obtains the first interface address from the second User Plane Function (UPF) through the Signaling Interconnection Gateway.

[0009] The Session Management Function (SMF) obtains the second interface address from the User Plane Gateway and the first User Plane Function (UPF).

[0010] The Session Management Function (SMF) determines the third and fourth interface addresses from the first and second interface addresses;

[0011] The Session Management Function (SMF) forwards the third interface address to the second User Plane Function (UPF) through the Signaling Interconnection Gateway, and forwards the fourth interface address to the User Plane Gateway and the first User Plane Function (UPF).

[0012] The second user plane function network element (UPF) and the first user plane function network element (UPF) create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, so that private network users can simultaneously access the public network and the private network through the user plane tunnel.

[0013] In some example embodiments of this disclosure, based on the foregoing scheme, the Session Management Function (SMF) responds to the detected access request to the private network and obtains the first interface address from the second User Plane Function (UPF) through the signaling interconnection gateway, including:

[0014] During the process of the private network user accessing the public network through the first user plane function element UPF, the session management function element SMF responds to the detection of the private network user's access request for the private network, inserts the second user plane function element UPF and the user plane gateway, and creates a PFCP session request.

[0015] The Session Management Function (SMF) network element sends the PFCP session request to the signaling interconnection gateway.

[0016] The signaling interconnection gateway hides the public network security information in the PFCP session request and sends the hidden PFCP session request to the second user plane functional network element UPF.

[0017] The second user plane function network element UPF responds to the hidden PFCP session request, generates PFCP response information containing the first interface address, and forwards it to the signaling interconnection gateway. The first interface address includes the N3, N6, and N9 interface addresses corresponding to the second user plane function network element UPF.

[0018] The signaling interconnection gateway hides the dedicated network security information in the PFCP response information and returns the hidden PFCP response information to the session management function element (SMF).

[0019] In some example embodiments of this disclosure, based on the foregoing scheme, the PFCP session request includes a first PDR and a second PDR;

[0020] The first PDR is used to instruct the second user plane function network element UPF on the first traffic forwarding rule when the private network user accesses the private network.

[0021] The first traffic forwarding rule includes uplink traffic from the RAN side to the N3 interface of the second user plane functional network element (UPF), and from the N6 interface of the second user plane functional network element (UPF) to the dedicated network (DN), while downlink traffic is the opposite.

[0022] The second PDR is used to instruct the second user plane function element (UPF) on the second traffic forwarding rule when the private network user accesses the public network;

[0023] The second traffic forwarding rule includes uplink traffic from the RAN side to the N3 interface of the second user plane function network element (UPF), and from the N9 interface of the second user plane function network element (UPF) to the N9 interface of the user plane gateway, while downlink traffic is the opposite.

[0024] In some example embodiments of this disclosure, based on the foregoing scheme, the Session Management Function (SMF) obtains the second interface address from the User Plane Gateway and the first User Plane Function (UPF), including:

[0025] The Session Management Function (SMF) creates a PFCP service request and sends the PFCP service request to the User Plane Gateway and the first User Plane Function (UPF).

[0026] The user plane gateway and the first user plane functional network element UPF respond to the PFCP service request and return the second interface address. The second interface address includes the N9 interface address corresponding to the user plane gateway and the N6 and N9 interface addresses corresponding to the first user plane functional network element UPF.

[0027] In some example embodiments of this disclosure, based on the foregoing scheme, the PFCP service request includes a third PDR and a fourth PDR;

[0028] The third PDR is used to instruct the user plane gateway on the third traffic forwarding rule when the private network user accesses the public network.

[0029] The third traffic forwarding rule includes uplink traffic from the N9 interface of the second user plane functional network element (UPF) to the N9 interface of the user plane gateway, and from the N9 interface of the user plane gateway to the N9 interface of the first user plane functional network element (UPF), while downlink traffic is the opposite.

[0030] The fourth PDR is used to indicate the fourth traffic forwarding rule of the first user plane function network element UPF when the private network user accesses the public network.

[0031] The fourth traffic forwarding rule includes uplink traffic from the N9 interface of the user plane gateway to the N9 interface of the first user plane functional network element (UPF), and from the N6 interface of the first user plane functional network element (UPF) to the public network (DN), while downlink traffic is the opposite.

[0032] In some example embodiments of this disclosure, based on the foregoing scheme, the method further includes:

[0033] The Session Management Function (SMF) network element sets the security filtering rules corresponding to the user plane gateway through the PFCP service request. The security filtering rules include session-level traffic filtering.

[0034] In some example embodiments of this disclosure, based on the foregoing scheme, the Session Management Function (SMF) forwards the third interface address to the second User Plane Function (UPF) through the signaling interconnection gateway, and forwards the fourth interface address to the user plane gateway and the first User Plane Function (UPF), including:

[0035] The Session Management Function (SMF) creates a PFCP session modification request containing the third interface address, which includes the N9 interface address corresponding to the user plane gateway and the N3 interface address corresponding to the base station gNB.

[0036] The Session Management Function (SMF) sends the PFCP session modification request to the Signaling Interconnection Gateway, so that the Signaling Interconnection Gateway hides the public network security information in the PFCP session modification request and forwards it to the second User Plane Function (UPF).

[0037] The Session Management Function (SMF) creates a PFCP session modification request containing the fourth interface address. The fourth interface address includes the N6 and N9 interfaces corresponding to the second User Plane Function (UPF) and the N6 and N9 interfaces corresponding to the first User Plane Function (UPF).

[0038] The Session Management Function (SMF) element sends the PFCP session modification request to the User Plane Gateway and the first User Plane Function (UPF) element.

[0039] According to a second aspect of the present disclosure, a communication network system is provided, including a Session Management Function (SMF), a First User Plane Function (UPF), and a base station (gNB) corresponding to a public network, and a Second User Plane Function (UPF) corresponding to a private network, characterized in that the communication network system further includes:

[0040] A signaling interconnection gateway is deployed between the Session Management Function (SMF) and the Second User Plane Function (UPF) network elements to provide control plane isolation between the public network and the private network.

[0041] The user plane gateway is deployed between the first user plane functional network element (UPF) and the second user plane functional network element (UPF) for user plane isolation between the public network and the private network, and supports session-level traffic filtering.

[0042] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory storing computer-readable instructions that, when executed by the processor, implement the network isolation access method described in any one of the preceding embodiments.

[0043] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the network isolation access method according to any one of the preceding claims.

[0044] The technical solutions provided in this disclosure may have the following beneficial effects:

[0045] In the network isolation access method of the example embodiment of this disclosure, the Session Management Function (SMF) obtains a first interface address from the second User Plane Function (UPF) through a signaling interconnection gateway; the SMF obtains a second interface address from the user plane gateway and the first UPF; the SMF determines a third interface address and a fourth interface address from the first and second interface addresses; the SMF forwards the third interface address to the second UPF through the signaling interconnection gateway, and forwards the fourth interface address to both the user plane gateway and the first UPF; the second UPF and the first UPF create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, so that private network users can simultaneously access the public network and the private network through the user plane tunnel. On the one hand, by deploying a signaling interconnection gateway between the Session Management Function (SMF) and the second User Plane Function (UPF), control plane isolation between the private network and the public network is achieved, ensuring the correct forwarding of signaling messages and improving the security and stability of inter-network access. On the other hand, the signaling interconnection gateway enables interface address allocation and management between the first and second User Plane Function (UPF) network elements. Furthermore, by deploying a user plane gateway between the first and second UPF network elements, a user plane tunnel is formed, avoiding direct connection between them and achieving user plane isolation between the private network and the public network, further enhancing the security of inter-network access. Moreover, all signaling processing between the private and public networks is completed by the signaling interconnection gateway. Network elements in both the private and public networks only need to support standard interface protocols, eliminating the need for custom development and effectively reducing hardware costs.

[0046] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0048] Figure 1 The schematic diagram illustrates the configuration of a communication network system according to some embodiments of the present disclosure;

[0049] Figure 2The schematic diagram illustrates a flow chart of a network isolation access method according to some embodiments of the present disclosure;

[0050] Figure 3 The illustration shows a flowchart of obtaining a first interface address from a second user plane function network element according to some embodiments of the present disclosure;

[0051] Figure 4 This illustration schematically shows a flowchart of the process of allocating interface addresses to network elements for session management functions according to some embodiments of the present disclosure;

[0052] Figure 5 The illustration schematically depicts a process diagram of achieving network isolated access by creating a user plane tunnel according to some embodiments of the present disclosure;

[0053] Figure 6 The schematic diagram illustrates the structural schematic of a computer system of an electronic device according to some embodiments of the present disclosure;

[0054] Figure 7 A schematic diagram of a computer-readable storage medium according to some embodiments of the present disclosure is shown.

[0055] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0056] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art.

[0057] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0058] Furthermore, the accompanying drawings are for illustrative purposes only and are not necessarily drawn to scale. The block diagrams shown in the drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0059] As 5G customized private networks mature, more and more enterprise campuses are likely to deploy private network elements. Edge UPF deployment, as the lowest-cost method, not only achieves low latency but also meets the requirement that enterprise business data does not leave the campus, making it popular among enterprise customers. For enterprise users' handheld terminals, there is a need to access both the main network and the enterprise private network simultaneously. Therefore, the need for interoperability between enterprise-level private networks and operators' public networks is becoming increasingly urgent, but this also brings about issues such as network security, operator control, and national regulation.

[0060] To address these issues, the concept of a Signaling Interconnection Gateway (C-IWF) has been proposed in relevant technical solutions. This gateway is deployed between private and public networks, and all signaling messages between the two networks must be forwarded through it. This enables functions such as network isolation, topology hiding, and network security, ensuring the security of both the main network and the private network while simplifying the complexity of network interconnection.

[0061] However, in this technical solution, the signaling interconnection gateway only achieves network isolation between networks at the control plane. In some scenarios, such as when the edge UPF is deployed, if the customer needs to use the UL CL (Uplink Classifier) ​​feature, the edge UPF still needs to communicate with the N9 interface of the operator's public network UPF through direct connection or firewall isolation. The firewall does not support session-level traffic control and can only set relatively simple filtering rules. When the networks communicate with each other, there are network security issues.

[0062] Based on one or more problems in related technologies, this disclosure firstly provides a communication network system. Figure 1 The schematic diagram illustrates the configuration of a communication network system according to some embodiments of the present disclosure.

[0063] refer to Figure 1 As shown, the communication network system may include a session management function network element SMF110, a first user plane function network element UPF120, and a base station gNB130 corresponding to the public network, and a second user plane function network element UPF140 corresponding to the private network.

[0064] Furthermore, the communication network system may also include:

[0065] The signaling interconnection gateway 150 is deployed between the session management function network element SMF 110 and the second user plane function network element UPF140 for control plane isolation between the public network and the private network.

[0066] User plane gateway 160 is deployed between the first user plane functional network element UPF 120 and the second user plane functional network element UPF 140. It is used for user plane isolation between public and private networks and supports session-level traffic filtering.

[0067] In an exemplary application scenario, assume that a private network user first communicates wirelessly with the base station gNB 130 via a user equipment (UE), and then connects to the first user plane function network element UPF 120 corresponding to the public network to access the public data network DN (Data Network) 170. When the private network user needs to access the private data network DN 180, the communication network system simultaneously inserts the second user plane function network element UPF 140 and the user plane gateway 160 corresponding to the private network. The specific forwarding rules are as follows:

[0068] The Session Management Function (SMF) 110 can send two pairs of PDRs (Packet Detection Rules) to the second User Plane Function (UPF) 140 through the Signalling Interconnection Gateway 150.

[0069] One pair of PDRs is used to indicate the forwarding rules for traffic accessing the private data network DN 180. For example, the forwarding rule can be that uplink traffic goes from the RAN (Radio Access Network) side to the N3 interface of the second user plane function element UPF 140, and then from the N6 interface of the second user plane function element UPF 140 to the private data network DN 180; downlink traffic goes in the opposite direction, that is, from the private data network DN 180 to the N6 interface of the second user plane function element UPF 140, then from the N3 interface of the second user plane function element UPF 140 to the base station gNB 130 on the RAN side, and finally from the base station gNB 130 to the terminal UE of the private network user.

[0070] Another pair of PDRs is used to indicate the forwarding rules for traffic accessing the public data network DN 170. For example, the forwarding rule could be that uplink traffic goes from the RAN side to the N3 interface of the second user plane functional network element UPF 140, and then from the N9 interface of the second user plane functional network element UPF 140 to the N9 interface of the user plane gateway 160; downlink traffic is the opposite, that is, downlink traffic goes from the N9 interface of the user plane gateway 160 to the N9 interface of the second user plane functional network element UPF 140, then from the N3 interface of the second user plane functional network element UPF 140 to the base station gNB 130 on the RAN side, and finally from the base station gNB 130 to the terminal UE of the private network user. Of course, the forwarding rules here are only illustrative examples and should not impose any special limitations on this embodiment.

[0071] The Session Management Function (SMF) 110 can issue a pair of Pre-Delivery Directives (PDRs) to the User Plane Gateway 160. These PDRs instruct the forwarding rules for traffic from private network users accessing the public data network DN 170. For example, the forwarding rules could be as follows: uplink traffic flows from the N9 interface of the second User Plane Function (UPF) 140 to the N9 interface of the User Plane Gateway 160, and then from the N9 interface of the User Plane Gateway 160 to the N9 interface of the first User Plane Function (UPF) 120; downlink traffic flows in the opposite direction, from the N9 interface of the first User Plane Function (UPF) 120 to the N9 interface of the User Plane Gateway 160, and then from the N9 interface of the User Plane Gateway 160 to the N9 interface of the second User Plane Function (UPF) 140. Simultaneously, a corresponding security filtering mechanism, such as session-level traffic filtering, is configured on the User Plane Gateway 160. Of course, the forwarding rules described here are merely illustrative examples and should not impose any specific limitations on this embodiment.

[0072] The Session Management Function (SMF) 110 can issue a pair of Pre-Delivery Directives (PDRs) to the First User Plane Function (UPF) 120. These PDRs instruct the forwarding rules for traffic from the private network user accessing the public data network DN 170. For example, the forwarding rule could be that uplink traffic flows from the N9 interface of the user plane gateway 160 to the N9 interface of the first user plane function (UPF) 120, and then from the N6 interface of the first user plane function (UPF) 120 to the public data network DN 170; downlink traffic flows in the opposite manner, i.e., downlink traffic flows from the public data network DN 170 to the N6 interface of the first user plane function (UPF) 120, and then from the N9 interface of the first user plane function (UPF) 120 to the N9 interface of the user plane gateway 160. Of course, the forwarding rules described here are merely illustrative examples and should not impose any special limitations on this embodiment.

[0073] In this example embodiment, a network isolation access method is also provided, which can be applied to... Figure 1 The communication network system shown. Figure 2 A schematic flowchart illustrating a network isolation access method according to some embodiments of the present disclosure is shown. (Reference) Figure 2 As shown, the network isolation access method may include the following steps:

[0074] Step S210: The Session Management Function (SMF) obtains the first interface address from the second User Plane Function (UPF) through the Signaling Interconnection Gateway;

[0075] Step S220: The Session Management Function (SMF) obtains the second interface address from the User Plane Gateway and the first User Plane Function (UPF).

[0076] Step S230: The Session Management Function (SMF) determines the third interface address and the fourth interface address from the first interface address and the second interface address;

[0077] Step S240: The Session Management Function (SMF) forwards the third interface address to the second User Plane Function (UPF) through the Signaling Interconnection Gateway, and forwards the fourth interface address to the User Plane Gateway and the first User Plane Function (UPF).

[0078] In step S250, the second user plane function network element (UPF) and the first user plane function network element (UPF) create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, so that the private network user can simultaneously access the public network and the private network through the user plane tunnel.

[0079] According to the network isolation access method in this example embodiment, on the one hand, by deploying a signaling interconnection gateway between the Session Management Function (SMF) and the second User Plane Function (UPF), control plane isolation between the private network and the public network is achieved, ensuring the correct forwarding of signaling messages and improving the security and stability of inter-network access. On the other hand, the signaling interconnection gateway enables interface address allocation management between the first and second User Plane Function (UPF) and forms a user plane tunnel by deploying a user plane gateway between the first and second User Plane Function (UPF), avoiding direct connection between them and achieving user plane isolation between the private network and the public network, further improving the security of inter-network access. Furthermore, all signaling processing between the private network and the public network is completed by the signaling interconnection gateway, and the network elements of both the private network and the public network only need to support standard interface protocols, eliminating the need for custom development and effectively reducing hardware costs.

[0080] The network isolation access method in this example embodiment will be further explained below.

[0081] In step S210, the Session Management Function (SMF) obtains the first interface address from the second User Plane Function (UPF) through the Signaling Interconnection Gateway.

[0082] In one example embodiment of this disclosure, the first interface address refers to the necessary interface address corresponding to the second user plane function network element UPF required by the session management function network element SMF to control the creation of user plane tunnels. For example, the first interface address may be the N3 interface address corresponding to the second user plane function network element UPF, or the N6 interface address, N9 interface address, etc., corresponding to the second user plane function network element UPF. This example embodiment does not impose any special limitations on this.

[0083] The Session Management Function (SMF) can send an interface address request to the Second User Plane Function (UPF) via the signaling interconnection gateway. The UPF can return an interface address response to the SMF via the signaling interconnection gateway. In both processes, the signaling interconnection gateway can hide network security information that may be contained in the messages sent by the UPF or SMF during the message transmission process. For example, the network security information that may be contained may be the node ID of the SMF or UPF, the IP address of the SMF, or the N4 interface address of the UPF. This example embodiment is not limited to these.

[0084] In step S220, the Session Management Function (SMF) obtains the second interface address from the User Plane Gateway and the first User Plane Function (UPF).

[0085] In one example embodiment of this disclosure, the second interface address refers to the necessary interface address corresponding to the user plane gateway and the first user plane function network element UPF required by the session management function network element SMF to control the creation of the user plane tunnel. For example, the second interface address can be the N9 interface address corresponding to the user plane gateway, or the N6 interface address, N9 interface address, etc. corresponding to the first user plane function network element UPF. This example embodiment is not limited to this.

[0086] In step S230, the Session Management Function (SMF) determines the third interface address and the fourth interface address from the first interface address and the second interface address.

[0087] In one example embodiment of this disclosure, the third interface address refers to the interface address selected by the Session Management Function (SMF) and required by the Second User Plane Function (UPF) when creating a user plane tunnel. For example, the third interface address may include at least the N9 interface address of the user plane gateway and the N3 interface address of the base station gNB. This embodiment is not limited to this.

[0088] The fourth interface address refers to the interface address selected by the Session Management Function (SMF) and required by the User Plane Gateway and the First User Plane Function (UPF) when creating a user plane tunnel. For example, the fourth interface address may include at least the N9 interface address corresponding to the Second User Plane Function (UPF), the N9 interface address corresponding to the First User Plane Function (UPF), and the N9 interface address corresponding to the User Plane Gateway, etc. This embodiment is not limited to this.

[0089] It should be noted that the terms "first," "second," "third," and "fourth" in the "first interface address," "second interface address," "third interface address," and "fourth interface address" of this example embodiment are only used to distinguish different types of interface addresses and have no special meaning. They should not impose any special limitations on this example embodiment.

[0090] In step S240, the Session Management Function (SMF) forwards the third interface address to the second User Plane Function (UPF) through the Signaling Interconnection Gateway, and forwards the fourth interface address to the User Plane Gateway and the first User Plane Function (UPF).

[0091] In step S250, the second user plane function network element (UPF) and the first user plane function network element (UPF) create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, so that the private network user can simultaneously access the public network and the private network through the user plane tunnel.

[0092] In one example embodiment of this disclosure, the User Plane Part of GTP (GTP-U) protocol is the user plane part of GTP. It is an IP / UDP-based tunneling protocol that allows the establishment of unidirectional point-to-point tunnels between various GTP-U protocol entities. For example, it can be a bidirectional tunnel composed of two unidirectional tunnels, UL (uplink) and DL (downlink).

[0093] The following is a detailed explanation of the steps in steps S210 to S230, taking the application scenario where a private network user first accesses the public data network DN through the first user plane function network element UPF of the public network, and then inserts the second user plane function network element UPF and the user plane gateway to access the private data network DN.

[0094] In one example embodiment of this disclosure, it can be achieved through Figure 3 The steps in the diagram implement the Session Management Function (SMF) network element obtaining the first interface address from the second User Plane Function (UPF) network element through the signaling interconnection gateway, refer to [reference]. Figure 3 As shown, it can specifically include:

[0095] Step S310: During the process of the private network user accessing the public network through the first user plane function element UPF, the session management function element SMF responds to the detection of the private network user's access request for the private network, inserts the second user plane function element UPF and the user plane gateway, and creates a PFCP session request.

[0096] Step S320: The Session Management Function (SMF) sends the PFCP session request to the Signaling Interconnection Gateway.

[0097] Step S330: The signaling interconnection gateway hides the public network security information in the PFCP session request and sends the hidden PFCP session request to the second user plane functional network element UPF.

[0098] Step S340: The second user plane function network element UPF responds to the hidden PFCP session request, generates PFCP response information containing the first interface address, and forwards it to the signaling interconnection gateway. The first interface address includes the N3, N6, and N9 interface addresses corresponding to the second user plane function network element UPF.

[0099] In step S350, the signaling interconnection gateway hides the dedicated network security information in the PFCP response information and returns the hidden PFCP response information to the session management function network element (SMF).

[0100] In the process of a private network user accessing the public network data DN through the first user plane function element UPF, if the session management function element SMF detects an access request for the private network initiated by the private network user, the session management function element SMF will create a PFCP (Packet Forwarding Control Protocol) session request.

[0101] Specifically, the PFCP session request in this embodiment may include a first PDR and a second PDR. Of course, the PFCP session request may also include any number of PDR pairs. The specific settings can be customized according to the actual application scenario. This example embodiment is not limited to this.

[0102] For example, the first PDR can be used to instruct the second user plane function network element (UPF) on the first traffic forwarding rule when a private network user accesses a private network. This first traffic forwarding rule may include: uplink traffic from the RAN side to the N3 interface of the second user plane function network element (UPF), and then from the N6 interface of the second user plane function network element (UPF) to the private network DN; downlink traffic is the opposite, i.e., downlink traffic from the private data network DN to the N6 interface of the second user plane function network element (UPF), then from the N3 interface of the second user plane function network element (UPF) to the base station gNB on the RAN side, and finally transmitted from the base station gNB 130 to the terminal UE of the private network user. Of course, the forwarding rule here is merely an illustrative example and should not impose any special limitations on this embodiment.

[0103] For example, the second PDR can be used to instruct the second user plane function element (UPF) on the second traffic forwarding rules when a private network user accesses a public network. The second traffic forwarding rules may include: uplink traffic flows from the RAN side to the N3 interface of the second user plane function element (UPF), and then from the N9 interface of the second user plane function element (UPF) to the N9 interface of the user plane gateway; downlink traffic flows in the opposite direction, i.e., downlink traffic flows from the N9 interface of the user plane gateway to the N9 interface of the second user plane function element (UPF), then from the N3 interface of the second user plane function element (UPF) to the base station gNB on the RAN side, and finally from the base station gNB to the terminal UE of the private network user. Of course, the forwarding rules here are merely illustrative examples and should not impose any special limitations on this embodiment.

[0104] The public network security information in the PFCP session request can be the node identifier in the PFCP session request, or the IP address corresponding to the Session Management Function (SMF) network element. Of course, it can also be other types of information that may affect the public network security. This example embodiment does not impose any special limitations on this.

[0105] The dedicated network security information in the PFCP response information can be the node identifier in the PFCP response information, or the N4 interface address corresponding to the second user plane function network element UPF. Of course, it can also be other types of information that may affect the dedicated network security. This example embodiment does not make any special limitations on this.

[0106] Hiding processing refers to processing in a way that makes the public network security information in the PFCP session request or the private network security information in the PFCP response information invisible to the second user plane function network element UPF or the session management function network element SMF. For example, the public network security information in the PFCP session request or the private network security information in the PFCP response information can be directly deleted. Alternatively, the public network security information in the PFCP session request or the private network security information in the PFCP response information can be replaced with blank or useless information. Or, the public network security information in the PFCP session request or the private network security information in the PFCP response information can be encrypted. This embodiment does not impose any special limitations on the hiding processing method.

[0107] When forwarding PFCP session requests created by the Session Management Function (SMF) to the Second User Plane Function (UPF), or when forwarding PFCP response information from the UPF in response to the PFCP session request to the SMF, the forwarding is done through the signaling interconnection gateway. During the forwarding process, the signaling interconnection gateway hides the relevant network security information, thereby achieving control plane isolation between the private network and the public network and effectively improving network security between the private network and the public network.

[0108] In one example embodiment of this disclosure, the Session Management Function (SMF) can directly obtain the second interface address from the User Plane Gateway and the First User Plane Function (UPF).

[0109] Specifically, the Session Management Function (SMF) can create PFCP service requests and forward them directly to the User Plane Gateway and the First User Plane Function (UPF). The User Plane Gateway and the First User Plane Function (UPF) respond to the received PFCP service requests by returning a second interface address. The second interface address may include the N9 interface address corresponding to the User Plane Gateway and the N6 and N9 interface addresses corresponding to the First User Plane Function (UPF).

[0110] The PFCP service request may include a third PDR and a fourth PDR; of course, the PFCP service request may also contain any number of PDR pairs, which can be customized according to the actual application scenario. This example embodiment is not limited to this.

[0111] For example, the third PDR can be used to instruct the user plane gateway on the third traffic forwarding rule when a private network user accesses a public network. The third traffic forwarding rule may include: uplink traffic from the N9 interface of the second user plane functional network element (UPF) to the N9 interface of the user plane gateway, and then from the N9 interface of the user plane gateway to the N9 interface of the first user plane functional network element (UPF); downlink traffic is the opposite, that is, downlink traffic from the N9 interface of the first user plane functional network element (UPF) to the N9 interface of the user plane gateway, and then from the N9 interface of the user plane gateway to the N9 interface of the second user plane functional network element (UPF). Of course, the forwarding rule here is only an illustrative example and should not impose any special limitations on this embodiment.

[0112] Optionally, the Session Management Function (SMF) element can configure corresponding security filtering mechanisms on the user plane gateway via PFCP service requests. Security filtering rules can include session-level traffic filtering. The user plane gateway enables user session-level traffic isolation between the private and public networks. Compared to direct N9 address connection or firewall isolation between the first and second user plane functional elements (UPF), this effectively improves network security when private network users simultaneously access both the private and public networks.

[0113] For example, the fourth PDR can be used to instruct the first user plane function network element (UPF) on the fourth traffic forwarding rule when a private network user accesses a public network. This fourth traffic forwarding rule may include: uplink traffic can travel from the N9 interface of the user plane gateway to the N9 interface of the first user plane function network element (UPF), and then from the N6 interface of the first user plane function network element (UPF) to the public data network (DN); downlink traffic is the opposite, i.e., downlink traffic can travel from the public data network (DN) to the N6 interface of the first user plane function network element (UPF), and then from the N9 interface of the first user plane function network element (UPF) to the N9 interface of the user plane gateway. Of course, the forwarding rules described here are merely illustrative examples and should not impose any special limitations on this embodiment.

[0114] In one example embodiment of this disclosure, it can be achieved through Figure 4 The steps in the document implement the session management function, where the network element SMF forwards the third and fourth interface addresses. Refer to [reference needed]. Figure 4 As shown, it can specifically include:

[0115] Step S410: The Session Management Function (SMF) creates a PFCP session modification request containing the third interface address, wherein the third interface address includes the N9 interface address corresponding to the user plane gateway and the N3 interface address corresponding to the base station gNB.

[0116] Step S420: The Session Management Function (SMF) sends the PFCP session modification request to the Signaling Interconnection Gateway, so that the Signaling Interconnection Gateway hides the public network security information in the PFCP session modification request and forwards it to the second User Plane Function (UPF).

[0117] Step S430: The Session Management Function (SMF) creates a PFCP session modification request containing the fourth interface address. The fourth interface address includes the N6 and N9 interfaces corresponding to the second User Plane Function (UPF) and the N6 and N9 interfaces corresponding to the first User Plane Function (UPF).

[0118] In step S440, the Session Management Function (SMF) sends the PFCP session modification request to the User Plane Gateway and the first User Plane Function (UPF).

[0119] After receiving the returned first and second interface addresses, the Session Management Function (SMF) can filter the third interface address required by the Second User Plane Function (UPF) for creating a user plane tunnel, and the fourth interface address required by the User Plane Gateway and the First User Plane Function (UPF) for creating a user plane tunnel. The SMF forwards the PFCP session modification request containing the third interface address to the Second User Plane Function (UPF) through the signaling interconnection gateway. The SMF also directly forwards the PFCP session modification request containing the fourth interface address to the User Plane Gateway and the First User Plane Function (UPF).

[0120] Furthermore, the second user plane function network element (UPF) and the first user plane function network element (UPF) create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address. This allows private network users to access both the public and private networks simultaneously through the user plane tunnel. The user plane gateway provides user plane isolation between the public and private networks and enables session-level traffic filtering between the public and private networks, further enhancing the network security of both networks.

[0121] Figure 5 The illustration schematically depicts a process diagram of achieving network isolated access by creating a user plane tunnel according to some embodiments of the present disclosure.

[0122] refer to Figure 5 As shown, in step S510, the private network user can normally access the public network through the first user plane function element UPF 120;

[0123] In step S520, the private network user initiates a private network access request. The session management function network element SMF 110 responds to the private network access request and can initiate a PFCP session establishment request to the signaling interconnection gateway 150. The PFCP session establishment request can include at least two pairs of PDRs. One pair of PDRs can be used to indicate the forwarding rules for traffic accessing the private network, and the other pair of PDRs can be used to indicate the forwarding rules for traffic accessing the public network.

[0124] In step S530, the signaling interconnection gateway 150 forwards the PFCP session establishment request to the second user plane function network element UPF140, and at the same time hides the public network security information such as the node ID and the IP address corresponding to the session management function network element SMF110 in the message. For example, the node ID and the IP address corresponding to the session management function network element SMF110 in the message can be replaced with blank information or useless information.

[0125] In step S540, the second user plane function network element UPF 140 sends a PFCP response message to the signaling interconnection gateway 150. The PFCP response message may contain the N3, N6, and N9 interface addresses corresponding to the second user plane function network element UPF 140.

[0126] In step S550, the signaling interconnection gateway 150 forwards the PFCP response message to the session management function network element SMF 110. At the same time, it hides the node identifier Node ID and the N4 interface address corresponding to the second user plane function network element UPF 140 in the message. It should be noted that the signaling interconnection gateway 150 cannot replace the N3, N6, N9 and other interface address information corresponding to the second user plane function network element UPF 140.

[0127] In step S560, the Session Management Function (SMF) 110 continues to initiate PFCP service requests to the User Plane Gateway (MPG) 160 and the First User Plane Function (UPF) 120, so as to issue forwarding rules for traffic accessing the public network through the PFCP service requests, and obtain the N9 interface address corresponding to the User Plane Gateway (MPG) 160 and the N6 and N9 interface addresses corresponding to the First User Plane Function (UPF) 120.

[0128] Step S570: The Session Management Function (SMF) 110 sends a PFCP session modification request to the Signaling Interconnection Gateway 150. The PFCP session modification request may include the N9 interface address of the User Plane Gateway 160 and the N3 interface address of the Base Station gNB.

[0129] In step S580, the signaling interconnection gateway 150 forwards the PFCP session modification request to the second user plane function network element UPF140 and replaces the node identifier and the IP address corresponding to the session management function network element SMF110 in the PFCP session modification request, as well as other public network security information. However, the N9 interface address of the user plane gateway 160 and the N3 interface address of the base station gNB should remain unchanged.

[0130] In step S590, the Session Management Function (SMF) 110 continues to send PFCP session modification requests to the User Plane Gateway 160 and the First User Plane Function (UPF) 120. These PFCP session modification requests may include the interface addresses required by the User Plane Gateway 160 and the First User Plane Function (UPF) 120 when creating the user plane tunnel. For example, they may include the N6 and N9 interfaces corresponding to the Second User Plane Function (UPF) and the First User Plane Function (UPF). Once the user plane tunnel is established, private network users can simultaneously access both the private network and the public network through this tunnel, ensuring the security of both networks.

[0131] In summary, the Session Management Function (SMF) obtains the first interface address from the second User Plane Function (UPF) through the signaling interconnection gateway; the SMF obtains the second interface address from the user plane gateway and the first UPF; the SMF determines the third and fourth interface addresses from the first and second interface addresses; the SMF forwards the third interface address to the second UPF through the signaling interconnection gateway, and forwards the fourth interface address to both the user plane gateway and the first UPF; the second UPF and the first UPF establish a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, enabling private network users to simultaneously access both the public and private networks through the user plane tunnel. On the one hand, by deploying a signaling interconnection gateway between the Session Management Function (SMF) and the second User Plane Function (UPF), control plane isolation between the private network and the public network is achieved, ensuring the correct forwarding of signaling messages and improving the security and stability of inter-network access. On the other hand, the signaling interconnection gateway enables interface address allocation and management between the first and second User Plane Function (UPF) network elements. Furthermore, by deploying a user plane gateway between the first and second UPF network elements, a user plane tunnel is formed, avoiding direct connection between them and achieving user plane isolation between the private network and the public network, further enhancing the security of inter-network access. Moreover, all signaling processing between the private and public networks is completed by the signaling interconnection gateway. Network elements in both the private and public networks only need to support standard interface protocols, eliminating the need for custom development and effectively reducing hardware costs.

[0132] It should be noted that although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0133] Furthermore, in an exemplary embodiment of this disclosure, an electronic device capable of implementing the network isolation access method described above is also provided.

[0134] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be embodied in the following forms: a completely hardware embodiment, a completely software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0135] The following reference Figure 6 To describe an electronic device 600 according to such an embodiment of the present disclosure. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0136] like Figure 6 As shown, Figure 6 This is a block diagram illustrating the composition of electronic device 601 within a computing and communication environment. Electronic device 601 can be used to implement the communication network systems and methods disclosed herein. In some embodiments, electronic device 601 can be a component in a communication network infrastructure. For example, electronic device 601 can be various other nodes or functions within a base station (e.g., NodeB, enhanced NodeB, eNodeB, next-generation base station (sometimes referred to as gNodeB or gNB)), home subscriber server (HSS), gateway (GW) (e.g., packet gateway (PGW) or serving gateway (SGW)), or evolved packet core (EPC) network.

[0137] In other embodiments, electronic device 601 may be a device connected to network infrastructure via a wireless interface. For example, electronic device 601 may be a mobile phone, smartphone, or other device that can be classified as user equipment (UE).

[0138] In some embodiments, electronic device 601 may also be a machine-type communication (MTC) device (also known as a machine-to-machine (M2M) device) or other such device that can be classified as a UE (although it does not provide direct service to the user).

[0139] In some embodiments, electronic device 601 may also be a mobile device (MD), a term used to refer to a device connected to a mobile network, regardless of whether the device itself is designed or capable of being mobile. A particular device may use all of the components shown or only a subset of those components, and the degree of integration between devices may vary. Furthermore, a device may include multiple instances of components, such as multiple processors, multiple memories, multiple transmitters, multiple receivers, etc.

[0140] Electronic device 601 typically includes a processor 602, such as a central processing unit (CPU), and may also include a dedicated processor (e.g., a graphics processing unit (GPU) or other such processor), memory 603, a network interface 604, and a bus 605 for connecting the various components in electronic device 601. Electronic device 601 may also optionally include components such as a mass storage device 606, a video adapter 607, and an I / O interface 608 (as shown by dashed lines).

[0141] Memory 603 may include any type of non-transitory system memory that can be read by processor 602, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), read-only memory (ROM), or combinations thereof. In a specific embodiment, memory 603 may include more than one type of memory, such as ROM used at power-on and DRAM used to store programs and data during program execution. Bus 605 may be one or more of several bus architectures of any type, including a memory bus or memory controller, a peripheral bus, or a video bus.

[0142] The electronic device 601 may also include one or more network interfaces 604, which may include at least one of wired network interfaces and wireless network interfaces. Figure 6As shown, network interface 604 may include a wired network interface connected to network 609, or a wireless access network interface 610 connected to other devices via a wireless link. When electronic device 601 is network infrastructure, the wireless access network interface 610 may be omitted for nodes or functions used as core network (CN) elements rather than wireless edge elements (e.g., eNBs). When electronic device 601 is infrastructure located at the wireless edge of the network, both wired and wireless network interfaces may be included. When electronic device 601 is a wirelessly connected device (e.g., user equipment UE), the wireless access network interface 610 may be present and may be supplemented by other wireless interfaces such as a Wi-Fi network interface. Network interface 604 enables electronic device 601 to communicate with remote entities (e.g., entities connected to network 609).

[0143] Mass storage 606 may include any type of non-transitory storage device for storing data, programs, and other information and making this data, programs, and other information accessible via bus 605. For example, mass storage 606 may include one or more of a solid-state drive, hard disk drive, disk drive, and optical disk drive. In some embodiments, mass storage 606 may be located remotely at the electronic device 601 and may be accessed via a network interface such as interface 604. In the illustrated embodiment, mass storage 606 differs from the included memory 603 and typically performs storage tasks insensitive to high latency, but generally provides low or no volatility. In some embodiments, mass storage 606 may be integrated with memory 603 to form a heterogeneous memory.

[0144] Optional video adapter 607 and I / O interface 608 (shown as dashed lines) provide interfaces to couple electronics 601 to external input and output devices. Examples of input and output devices include a display 611 coupled to video adapter 607 and one or more I / O devices 612 (e.g., touchscreens) coupled to I / O interface 608. Other devices may be coupled to electronics 601, and more or fewer interfaces may be used. For example, a serial interface such as Universal Serial Bus (USB) (not shown) may be used to provide interfaces for external devices. Those skilled in the art will understand that in embodiments where electronics 601 is part of a data center, I / O interface 608 and video adapter 607 may be virtualized and provided via network interface 604.

[0145] In some embodiments, electronic device 601 may be a standalone device, while in other embodiments, electronic device 601 may be located within a data center. In the art, a data center can be understood as a collection of computing resources (typically in the form of servers) that can be used as collective computing and storage resources. Within a data center, multiple servers may be connected together to provide a pool of computing resources, on which virtualized entities can be instantiated. Data centers may be interconnected to form a network comprising pools of computing and storage resources interconnected by connectivity resources. Connectivity resources may be physical connections such as Ethernet or optical communication links, and may also include wireless communication channels. If two different data centers are connected via multiple different communication channels, the links can be grouped together using any of a variety of techniques, including forming a link aggregation group (LAG). It should be understood that any or all computing resources, storage resources, and connectivity resources (as well as other resources within the network) can be partitioned across different subnets, and in some cases, partitioned in the form of resource slices. Different network slices can be created by slicing resources across multiple connected data centers or other sets of nodes.

[0146] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0147] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0148] refer to Figure 7As shown, a program product 700 for implementing the network isolation access method described in embodiments of the present disclosure is illustrated. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0149] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0150] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0151] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0152] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0153] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0154] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0155] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0156] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A network isolation access method, characterized in that, The system is applied to a communication network system capable of simultaneously accessing public and private networks. The communication network system includes at least a Session Management Function (SMF), a First User Plane Function (UPF), and a base station (gNB) corresponding to the public network; a Second User Plane Function (UPF) corresponding to the private network; a signaling interconnection gateway deployed between the SMF and the UPF; and a user plane gateway deployed between the UPF and the UPF. The method includes: The Session Management Function (SMF) obtains the first interface address from the second User Plane Function (UPF) through the Signaling Interconnection Gateway. The Session Management Function (SMF) obtains the second interface address from the User Plane Gateway and the first User Plane Function (UPF). The Session Management Function (SMF) determines the third and fourth interface addresses from the first and second interface addresses; The Session Management Function (SMF) forwards the third interface address to the second User Plane Function (UPF) through the Signaling Interconnection Gateway, and forwards the fourth interface address to the User Plane Gateway and the first User Plane Function (UPF). The second user plane function network element (UPF) and the first user plane function network element (UPF) create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, so that private network users can simultaneously access the public network and the private network through the user plane tunnel.

2. The network isolation access method according to claim 1, characterized in that, The Session Management Function (SMF) network element obtains the first interface address from the second User Plane Function (UPF) network element through the signaling interconnection gateway, including: During the process of the private network user accessing the public network through the first user plane function element UPF, the session management function element SMF responds to the detection of the private network user's access request for the private network, inserts the second user plane function element UPF and the user plane gateway, and creates a PFCP session request. The Session Management Function (SMF) network element sends the PFCP session request to the signaling interconnection gateway. The signaling interconnection gateway hides the public network security information in the PFCP session request and sends the hidden PFCP session request to the second user plane functional network element UPF. The second user plane function network element UPF responds to the hidden PFCP session request, generates PFCP response information containing the first interface address, and forwards it to the signaling interconnection gateway. The first interface address includes the N3, N6, and N9 interface addresses corresponding to the second user plane function network element UPF. The signaling interconnection gateway hides the dedicated network security information in the PFCP response information and returns the hidden PFCP response information to the session management function element (SMF).

3. The network isolation access method according to claim 2, characterized in that, The PFCP session request includes a first PDR and a second PDR; The first PDR is used to instruct the second user plane function network element UPF on the first traffic forwarding rule when the private network user accesses the private network. The first traffic forwarding rule includes uplink traffic from the RAN side to the N3 interface of the second user plane functional network element (UPF), and from the N6 interface of the second user plane functional network element (UPF) to the dedicated network (DN), while downlink traffic is the opposite. The second PDR is used to instruct the second user plane function element (UPF) on the second traffic forwarding rule when the private network user accesses the public network; The second traffic forwarding rule includes uplink traffic from the RAN side to the N3 interface of the second user plane function network element (UPF), and from the N9 interface of the second user plane function network element (UPF) to the N9 interface of the user plane gateway, while downlink traffic is the opposite.

4. The network isolation access method according to claim 1, characterized in that, The Session Management Function (SMF) obtains the second interface address from the User Plane Gateway and the first User Plane Function (UPF), including: The Session Management Function (SMF) creates a PFCP service request and sends the PFCP service request to the User Plane Gateway and the first User Plane Function (UPF). The user plane gateway and the first user plane functional network element UPF respond to the PFCP service request and return the second interface address. The second interface address includes the N9 interface address corresponding to the user plane gateway and the N6 and N9 interface addresses corresponding to the first user plane functional network element UPF.

5. The network isolation access method according to claim 4, characterized in that, The PFCP service request includes a third PDR and a fourth PDR; The third PDR is used to instruct the user plane gateway on the third traffic forwarding rule when the private network user accesses the public network. The third traffic forwarding rule includes uplink traffic from the N9 interface of the second user plane functional network element (UPF) to the N9 interface of the user plane gateway, and from the N9 interface of the user plane gateway to the N9 interface of the first user plane functional network element (UPF), while downlink traffic is the opposite. The fourth PDR is used to indicate the fourth traffic forwarding rule of the first user plane function network element UPF when the private network user accesses the public network. The fourth traffic forwarding rule includes uplink traffic from the N9 interface of the user plane gateway to the N9 interface of the first user plane functional network element (UPF), and from the N6 interface of the first user plane functional network element (UPF) to the public network (DN), while downlink traffic is the opposite.

6. The network isolation access method according to claim 4, characterized in that, The method further includes: The Session Management Function (SMF) network element sets the security filtering rules corresponding to the user plane gateway through the PFCP service request. The security filtering rules include session-level traffic filtering.

7. The network isolation access method according to claim 1, characterized in that, The Session Management Function (SMF) forwards the third interface address to the second User Plane Function (UPF) via the signaling interconnection gateway, and forwards the fourth interface address to the user plane gateway and the first User Plane Function (UPF), including: The Session Management Function (SMF) creates a PFCP session modification request containing the third interface address, which includes the N9 interface address corresponding to the user plane gateway and the N3 interface address corresponding to the base station gNB. The Session Management Function (SMF) sends the PFCP session modification request to the Signaling Interconnection Gateway, so that the Signaling Interconnection Gateway hides the public network security information in the PFCP session modification request and forwards it to the second User Plane Function (UPF). The Session Management Function (SMF) creates a PFCP session modification request containing the fourth interface address. The fourth interface address includes the N6 and N9 interfaces corresponding to the second User Plane Function (UPF) and the N6 and N9 interfaces corresponding to the first User Plane Function (UPF). The Session Management Function (SMF) element sends the PFCP session modification request to the User Plane Gateway and the first User Plane Function (UPF) element.

8. A communication network system, comprising a Session Management Function (SMF), a First User Plane Function (UPF), and a base station (gNB) for a public network, and a Second User Plane Function (UPF) for a private network, characterized in that, The communication network system also includes: A signaling interconnection gateway is deployed between the Session Management Function (SMF) and the Second User Plane Function (UPF) network elements to provide control plane isolation between the public network and the private network. The user plane gateway is deployed between the first user plane functional network element (UPF) and the second user plane functional network element (UPF) for user plane isolation between the public network and the private network, and supports session-level traffic filtering.

9. An electronic device, comprising: processor; as well as A memory storing computer-readable instructions that, when executed by the processor, implement the network isolation access method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the network isolation access method as described in any one of claims 1 to 7.

Images